Intel 64 and IA-32 Architectures. Software Developer’s Manual (2026)

INTEL® SGX INSTRUCTION REFERENCES

Flags Affected

Sets ZF if page is not modifiable, otherwise cleared. Clears CF, PF, AF, OF, SF.

Protected Mode Exceptions

#GP(0)

If executed outside an enclave.

If a memory operand effective address is outside the DS segment limit.

If a memory operand is not properly aligned.

If a memory operand is locked.

#PF(error code)

If a page fault occurs in accessing memory operands.

If a memory operand is not an EPC page.

If EPC page has incorrect page type or security attributes.

64-Bit Mode Exceptions

#GP(0)

If executed outside an enclave.

If a memory operand is non-canonical form.

If a memory operand is not properly aligned.

If a memory operand is locked.

#PF(error code)

If a page fault occurs in accessing memory operands.

If a memory operand is not an EPC page.

If EPC page has incorrect page type or security attributes.

41-82

Vol. 3D

EACCEPTCOPY-Initialize a Pending Page

INTEL® SGX INSTRUCTION REFERENCES

EDECCSSA-Decrements TCS.CSSA

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

EAX = 09H

V/V

EDECCSSA

This leaf function decrements TCS.CSSA.

ENCLU[EDECCSSA]

Instruction Operand Encoding

Op/En

EAX

EDECCSSA (In)

Description

This leaf function changes the current SSA frame by decrementing TCS.CSSA for the current enclave thread. If the

enclave has enabled CET shadow stacks or indirect branch tracking, then EDECCSSA also changes the current CET

state save frame. This instruction leaf can only be executed inside an enclave.

EDECCSSA Memory Parameter Semantics

TCS

Read/Write access by Enclave

The instruction faults if any of the following:

EDECCSSA Faulting Conditions

TCS.CSSA is 0.

TCS is not valid or available or locked.

The SSA frame is not valid or in use.

Concurrency Restrictions

Table 41-56. Base Concurrency Restrictions of EDECCSSA

Base Concurrency Restrictions

Leaf

Parameter

Access

On Conflict

EDECCSSA

TCS [CR_TCS_PA]

Shared

#GP

Table 41-57. Additional Concurrency Restrictions of EDECCSSA

Additional Concurrency Restrictions

vs. EACCEPT, EACCEPTCOPY,

Leaf

Parameter

vs. EADD, EEXTEND, EINIT

vs. ETRACK

EMODPE, EMODPR, EMODT

Access

On Conflict

Access

On Conflict

Access

On Conflict

EDECCSSA

TCS [CR_TCS_PA]

Concurrent

EDECCSSA-Decrements TCS.CSSA

Vol. 3D

41-83

INTEL® SGX INSTRUCTION REFERENCES

Operation

Temp Variables in EDECCSSA Operational Flow

Name

Type

Size (bits)

Description

TMP_SSA

Effective

32/64

Address of current SSA frame.

Address

TMP_XSIZE

Integer

Size of XSAVE area based on SECS.ATTRIBUTES.XFRM.

TMP_SSA_PAGE

Effective

32/64

Pointer used to iterate over the SSA pages in the target frame.

Address

TMP_GPR

Effective

32/64

Address of the GPR area within the target SSA frame.

Address

TMP_XSAVE_PAGE_PA_n

Physical

32/64

Physical address of the nth page within the target SSA frame.

Address

TMP_CET_SAVE_AREA

Effective

32/64

Address of the current CET save area.

Address

TMP_CET_SAVE_PAGE

Effective

32/64

Address of the current CET save area page.

Address

(* Check concurrency of TCS operation *)

IF (Other Intel SGX instructions are operating on TCS)

THEN #GP(0); FI;

IF (CR_TCS_PA.CSSA = 0)

THEN #GP(0); FI;

(* Compute linear address of SSA frame *)

TMP_SSA := CR_TCS_PA.OSSA + CR_ACTIVE_SECS.BASEADDR + 4096 * CR_ACTIVE_SECS.SSAFRAMESIZE * (CR_TCS_PA.CSSA - 1);

TMP_XSIZE := compute_XSAVE_frame_size(CR_ACTIVE_SECS.ATTRIBUTES.XFRM);

FOR EACH TMP_SSA_PAGE = TMP_SSA to TMP_SSA + TMP_XSIZE

(* Check page is read/write accessible *)

Check that DS:TMP_SSA_PAGE is read/write accessible;

If a fault occurs, release locks, abort and deliver that fault;

IF (DS:TMP_SSA_PAGE does not resolve to EPC page)

THEN #PF(DS:TMP_SSA_PAGE); FI;

IF (EPCM(DS:TMP_SSA_PAGE).VALID = 0)

THEN #PF(DS:TMP_SSA_PAGE); FI;

IF (EPCM(DS:TMP_SSA_PAGE).BLOCKED = 1)

THEN #PF(DS:TMP_SSA_PAGE); FI;

IF ((EPCM(DS:TMP_SSA_PAGE).PENDING = 1) or (EPCM(DS:TMP_SSA_PAGE_.MODIFIED = 1))

THEN #PF(DS:TMP_SSA_PAGE); FI;

IF ( ( EPCM(DS:TMP_SSA_PAGE).ENCLAVEADDRESS ≠ DS:TMPSSA_PAGE) or

(EPCM(DS:TMP_SSA_PAGE).PT ≠ PT_REG) or

(EPCM(DS:TMP_SSA_PAGE).ENCLAVESECS ≠ EPCM(CR_TCS_PA).ENCLAVESECS) or

(EPCM(DS:TMP_SSA_PAGE).R = 0) or (EPCM(DS:TMP_SSA_PAGE).W = 0))

THEN #PF(DS:TMP_SSA_PAGE); FI;

TMP_XSAVE_PAGE_PA_n := Physical_Address(DS:TMP_SSA_PAGE);

ENDFOR

(* Compute address of GPR area*)

TMP_GPR := TMP_SSA + 4096 * CR_ACTIVE_SECS.SSAFRAMESIZE - sizeof(GPRSGX_AREA);

41-84

Vol. 3D

EDECCSSA-Decrements TCS.CSSA

INTEL® SGX INSTRUCTION REFERENCES

Check that DS:TMP_SSA_PAGE is read/write accessible;

If a fault occurs, release locks, abort and deliver that fault;

IF (DS:TMP_GPR does not resolve to EPC page)

THEN #PF(DS:TMP_GPR); FI;

IF (EPCM(DS:TMP_GPR).VALID = 0)

THEN #PF(DS:TMP_GPR); FI;

IF (EPCM(DS:TMP_GPR).BLOCKED = 1)

THEN #PF(DS:TMP_GPR); FI;

IF ((EPCM(DS:TMP_GPR).PENDING = 1) or (EPCM(DS:TMP_GPR).MODIFIED = 1))

THEN #PF(DS:TMP_GPR); FI;

IF ( ( EPCM(DS:TMP_GPR).ENCLAVEADDRESS ≠ DS:TMP_GPR) or

(EPCM(DS:TMP_GPR).PT ≠ PT_REG) or

(EPCM(DS:TMP_GPR).ENCLAVESECS ≠ EPCM(CR_TCS_PA).ENCLAVESECS) or

(EPCM(DS:TMP_GPR).R = 0) or (EPCM(DS:TMP_GPR).W = 0) )

THEN #PF(DS:TMP_GPR); FI;

IF (TMP_MODE64 = 0)

THEN

IF (TMP_GPR + (sizeof(GPRSGX_AREA) -1) is not in DS segment)

THEN #GP(0); FI;

FI;

IF (CPUID.12H.01H:EAX[6] = 1)

THEN

IF ((CR_ACTIVE_SECS.CET_ATTRIBUTES.SH_STK_EN == 1) OR (CR_ACTIVE_SECS.CET_ATTRIBUTES.ENDBR_EN == 1))

THEN

(* Compute linear address of what will become new CET state save area and cache its PA *)

TMP_CET_SAVE_AREA := CR_TCS_PA.OCETSSA + CR_ACTIVE_SECS.BASEADDR + (CR_TCS_PA.CSSA - 1) * 16;

TMP_CET_SAVE_PAGE := TMP_CET_SAVE_AREA & ~0xFFF;

Check the TMP_CET_SAVE_PAGE page is read/write accessible

If fault occurs release locks, abort and deliver fault

(* read the EPCM VALID, PENDING, MODIFIED, BLOCKED and PT fields atomically *)

IF ((DS:TMP_CET_SAVE_PAGE Does NOT RESOLVE TO EPC PAGE) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).VALID = 0) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).PENDING = 1) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).MODIFIED = 1) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).BLOCKED = 1) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).R = 0) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).W = 0) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).ENCLAVEADDRESS ≠ DS:TMP_CET_SAVE_PAGE) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).PT ≠ PT_SS_REST) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).ENCLAVESECS ≠ EPCM(CR_TCS_PA).ENCLAVESECS))

THEN #PF(DS:TMP_CET_SAVE_PAGE); FI;

FI;

(* At this point, the instruction is guaranteed to complete *)

CR_TCS_PA.CSSA := CR_TCS_PA.CSSA - 1;

CR_GPR_PA := Physical_Address(DS:TMP_GPR);

FOR EACH TMP_XSAVE_PAGE_n

CR_XSAVE_PAGE_n := TMP_XSAVE_PAGE_PA_n;

EDECCSSA-Decrements TCS.CSSA

Vol. 3D

41-85

INTEL® SGX INSTRUCTION REFERENCES

ENDFOR

IF (CPUID.12H.01H:EAX[6] = 1)

THEN

IF ((TMP_SECS.CET_ATTRIBUTES.SH_STK_EN == 1) OR

(TMP_SECS.CET_ATTRIBUTES.ENDBR_EN == 1))

THEN

CR_CET_SAVE_AREA_PA := Physical_Address(DS:TMP_CET_SAVE_AREA);

FI;

Flags Affected

None

Protected Mode Exceptions

#GP(0)

If executed outside an enclave.

If CR_TCS_PA.CSSA = 0.

#PF(error code)

If a page fault occurs in accessing memory.

If one or more pages of the target SSA frame are not readable/writable, or do not resolve to a

valid PT_REG EPC page.

If CET is enabled for the enclave and the target CET SSA frame is not readable/writable, or

does not resolve to a valid PT_REG EPC page.

64-Bit Mode Exceptions

#GP(0)

If executed outside an enclave.

If CR_TCS_PA.CSSA = 0.

#PF(error code)

If a page fault occurs in accessing memory.

If one or more pages of the target SSA frame are not readable/writable, or do not resolve to a

valid PT_REG EPC page.

If CET is enabled for the enclave and the target CET SSA frame is not readable/writable, or

does not resolve to a valid PT_REG EPC page.

41-86

Vol. 3D

EDECCSSA-Decrements TCS.CSSA

INTEL® SGX INSTRUCTION REFERENCES

EENTER-Enters an Enclave

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

EAX = 02H

V/V

SGX1

This leaf function is used to enter an enclave.

ENCLU[EENTER]

Instruction Operand Encoding

Op/En

EAX

RBX

RCX

Content of RBX.CSSA

Address of IP following

EENTER (In)

Address of a TCS (In)

Address of AEP (In)

(Out)

EENTER (Out)

Description

The ENCLU[EENTER] instruction transfers execution to an enclave. At the end of the instruction, the logical

processor is executing in enclave mode at the RIP computed as EnclaveBase + TCS.OENTRY. If the target address

is not within the CS segment (32-bit) or is not canonical (64-bit), a #GP(0) results.

EENTER Memory Parameter Semantics

TCS

Enclave access

EENTER is a serializing instruction. The instruction faults if any of the following occurs:

Address in RBX is not properly aligned.

Any TCS.FLAGS’s must-be-zero bit is not zero.

TCS pointed to by RBX is not valid or available or locked.

Current 32/64 mode does not match the enclave mode in

SECS.ATTRIBUTES.MODE64.

The SECS is in use.

Either of TCS-specified FS and GS segment is not a subsets of the

current DS segment.

Any one of DS, ES, CS, SS is not zero.

If XSAVE available, CR4.OSXSAVE = 0, but

SECS.ATTRIBUTES.XFRM ≠ 3.

CR4.OSFXSR ≠ 1.

If CR4.OSXSAVE = 1, SECS.ATTRIBUTES.XFRM is not a subset of

XCR0.

If SECS.ATTRIBUTES.AEXNOTIFY ≠ TCS.FLAGS.AEXNOTIFY and

TCS.FLAGS.DBGOPTIN = 0.

The following operations are performed by EENTER:

• RSP and RBP are saved in the current SSA frame on EENTER and are automatically restored on EEXIT or

interrupt.

• The AEP contained in RCX is stored into the TCS for use by AEXs.FS and GS (including hidden portions) are

saved and new values are constructed using TCS.OFSBASE/GSBASE (32 and 64-bit mode) and

TCS.OFSLIMIT/GSLIMIT (32-bit mode only). The resulting segments must be a subset of the DS segment.

• If CR4.OSXSAVE == 1, XCR0 is saved and replaced by SECS.ATTRIBUTES.XFRM. The effect of RFLAGS.TF

depends on whether the enclave entry is opt-in or opt-out (see Section 43.1.2):

- On opt-out entry, TF is saved and cleared (it is restored on EEXIT or AEX). Any attempt to set TF via a POPF

instruction while inside the enclave clears TF (see Section 43.2.5).

- On opt-in entry, a single-step debug exception is pended on the instruction boundary immediately after

EENTER (see Section 43.2.2).

EENTER-Enters an Enclave

Vol. 3D

41-87

INTEL® SGX INSTRUCTION REFERENCES

• All code breakpoints that do not overlap with ELRANGE are also suppressed. If the entry is an opt-out entry, all

code and data breakpoints that overlap with the ELRANGE are suppressed.

• On opt-out entry, a number of performance monitoring counters and behaviors are modified or suppressed (see

Section 43.2.3):

- All performance monitoring activity on the current thread is suppressed except for incrementing and firing

of FIXED_CTR1 and FIXED_CTR2.

- PEBS is suppressed.

- AnyThread counting on other threads is demoted to MyThread mode and IA32_PERF_GLOBAL_STATUS[60]

on that thread is set

- If the opt-out entry on a hardware thread results in suppression of any performance monitoring, then the

processor sets IA32_PERF_GLOBAL_STATUS[60] and IA32_PERF_GLOBAL_STATUS[63].

Concurrency Restrictions

Table 41-58. Base Concurrency Restrictions of EENTER

Base Concurrency Restrictions

Leaf

Parameter

Access

On Conflict

EENTER

TCS [DS:RBX]

Shared

#GP

Table 41-59. Additional Concurrency Restrictions of EENTER

Additional Concurrency Restrictions

vs. EACCEPT, EACCEPTCOPY,

Leaf

Parameter

vs. EADD, EEXTEND, EINIT

vs. ETRACK

EMODPE, EMODPR, EMODT

Access

On Conflict

Access

On Conflict

Access

On Conflict

EENTER

TCS [DS:RBX]

Concurrent

Operation

Temp Variables in EENTER Operational Flow

Name

Type

Size (Bits)

Description

TMP_FSBASE

Effective Address

32/64

Proposed base address for FS segment.

TMP_GSBASE

Effective Address

32/64

Proposed base address for FS segment.

TMP_FSLIMIT

Effective Address

32/64

Highest legal address in proposed FS segment.

TMP_GSLIMIT

Effective Address

32/64

Highest legal address in proposed GS segment.

TMP_XSIZE

integer

Size of XSAVE area based on SECS.ATTRIBUTES.XFRM.

TMP_SSA_PAGE

Effective Address

32/64

Pointer used to iterate over the SSA pages in the current frame.

TMP_GPR

Effective Address

32/64

Address of the GPR area within the current SSA frame.

TMP_MODE64 := ((IA32_EFER.LMA = 1) && (CS.L = 1));

(* Make sure DS is usable, expand up *)

IF (TMP_MODE64 = 0 and (DS not usable or DS[bits 11:9] != 001B))

THEN #GP(0); FI;

(* Check that CS, SS, DS, ES.base is 0 *)

IF (TMP_MODE64 = 0)

THEN

41-88

Vol. 3D

EENTER-Enters an Enclave

INTEL® SGX INSTRUCTION REFERENCES

IF(CS.base ≠ 0 or DS.base ≠ 0) #GP(0); FI;

IF(ES usable and ES.base ≠ 0) #GP(0); FI;

IF(SS usable and SS.base ≠ 0) #GP(0); FI;

IF(SS usable and SS.B = 0) #GP(0); FI;

FI;

IF (DS:RBX is not 4KByte Aligned)

THEN #GP(0); FI;

IF (DS:RBX does not resolve within an EPC)

THEN #PF(DS:RBX); FI;

(* Check AEP is canonical*)

IF (TMP_MODE64 = 1 and (CS:RCX is not canonical) )

THEN #GP(0); FI;

(* Check concurrency of TCS operation*)

IF (Other Intel SGX instructions are operating on TCS)

THEN #GP(0); FI;

(* TCS verification *)

IF (EPCM(DS:RBX).VALID = 0)

THEN #PF(DS:RBX); FI;

IF (EPCM(DS:RBX).BLOCKED = 1)

THEN #PF(DS:RBX); FI;

IF ( (EPCM(DS:RBX).ENCLAVEADDRESS ≠ DS:RBX) or (EPCM(DS:RBX).PT ≠ PT_TCS) )

THEN #PF(DS:RBX); FI;

IF ((EPCM(DS:RBX).PENDING = 1) or (EPCM(DS:RBX).MODIFIED = 1))

THEN #PF(DS:RBX); FI;

IF ( (DS:RBX).OSSA is not 4KByte Aligned)

THEN #GP(0); FI;

(* Check proposed FS and GS *)

IF ( ( (DS:RBX).OFSBASE is not 4KByte Aligned) or ( (DS:RBX).OGSBASE is not 4KByte Aligned) )

THEN #GP(0); FI;

(* Get the SECS for the enclave in which the TCS resides *)

TMP_SECS := Address of SECS for TCS;

(* Ensure that the FLAGS field in the TCS does not have any reserved bits set *)

IF ( ( (DS:RBX).FLAGS & FFFFFFFFFFFFFFFCH) ≠ 0)

THEN #GP(0); FI;

(* SECS must exist and enclave must have previously been EINITted *)

IF (the enclave is not already initialized)

THEN #GP(0); FI;

(* make sure the logical processor’s operating mode matches the enclave *)

IF ( (TMP_MODE64 ≠ TMP_SECS.ATTRIBUTES.MODE64BIT) )

THEN #GP(0); FI;

EENTER-Enters an Enclave

Vol. 3D

41-89

INTEL® SGX INSTRUCTION REFERENCES

IF (CR4.OSFXSR = 0)

THEN #GP(0); FI;

(* Check for legal values of SECS.ATTRIBUTES.XFRM *)

IF (CR4.OSXSAVE = 0)

THEN

IF (TMP_SECS.ATTRIBUTES.XFRM ≠ 03H) THEN #GP(0); FI;

ELSE

IF ( (TMP_SECS.ATTRIBUTES.XFRM & XCR0) ≠ TMP_SECS.ATTRIBUES.XFRM) THEN #GP(0); FI;

FI;

IF ((DS:RBX).CSSA.FLAGS.DBGOPTIN = 0) and (DS:RBX).CSSA.FLAGS.AEXNOTIFY ≠ TMP_SECS.ATTRIBUTES.AEXNOTIFY))

THEN #GP(0); FI;

(* Make sure the SSA contains at least one more frame *)

IF ( (DS:RBX).CSSA ≥ (DS:RBX).NSSA)

THEN #GP(0); FI;

(* Compute linear address of SSA frame *)

TMP_SSA := (DS:RBX).OSSA + TMP_SECS.BASEADDR + 4096 * TMP_SECS.SSAFRAMESIZE * (DS:RBX).CSSA;

TMP_XSIZE := compute_XSAVE_frame_size(TMP_SECS.ATTRIBUTES.XFRM);

FOR EACH TMP_SSA_PAGE = TMP_SSA to TMP_SSA + TMP_XSIZE

(* Check page is read/write accessible *)

Check that DS:TMP_SSA_PAGE is read/write accessible;

If a fault occurs, release locks, abort, and deliver that fault;

IF (DS:TMP_SSA_PAGE does not resolve to EPC page)

THEN #PF(DS:TMP_SSA_PAGE); FI;

IF (EPCM(DS:TMP_SSA_PAGE).VALID = 0)

THEN #PF(DS:TMP_SSA_PAGE); FI;

IF (EPCM(DS:TMP_SSA_PAGE).BLOCKED = 1)

THEN #PF(DS:TMP_SSA_PAGE); FI;

IF ((EPCM(DS:TMP_SSA_PAGE).PENDING = 1) or (EPCM(DS:TMP_SSA_PAGE).MODIFIED = 1))

THEN #PF(DS:TMP_SSA_PAGE); FI;

IF ( ( EPCM(DS:TMP_SSA_PAGE).ENCLAVEADDRESS ≠ DS:TMP_SSA_PAGE) or (EPCM(DS:TMP_SSA_PAGE).PT ≠ PT_REG) or

(EPCM(DS:TMP_SSA_PAGE).ENCLAVESECS ≠ EPCM(DS:RBX).ENCLAVESECS) or

(EPCM(DS:TMP_SSA_PAGE).R = 0) or (EPCM(DS:TMP_SSA_PAGE).W = 0) )

THEN #PF(DS:TMP_SSA_PAGE); FI;

CR_XSAVE_PAGE_n := Physical_Address(DS:TMP_SSA_PAGE);

ENDFOR

(* Compute address of GPR area*)

TMP_GPR := TMP_SSA + 4096 * DS:TMP_SECS.SSAFRAMESIZE - sizeof(GPRSGX_AREA);

If a fault occurs; release locks, abort, and deliver that fault;

IF (DS:TMP_GPR does not resolve to EPC page)

THEN #PF(DS:TMP_GPR); FI;

IF (EPCM(DS:TMP_GPR).VALID = 0)

THEN #PF(DS:TMP_GPR); FI;

IF (EPCM(DS:TMP_GPR).BLOCKED = 1)

THEN #PF(DS:TMP_GPR); FI;

IF ((EPCM(DS:TMP_GPR).PENDING = 1) or (EPCM(DS:TMP_GPR).MODIFIED = 1))

THEN #PF(DS:TMP_GPR); FI;

41-90

Vol. 3D

EENTER-Enters an Enclave

INTEL® SGX INSTRUCTION REFERENCES

IF ( ( EPCM(DS:TMP_GPR).ENCLAVEADDRESS ≠ DS:TMP_GPR) or (EPCM(DS:TMP_GPR).PT ≠ PT_REG) or

(EPCM(DS:TMP_GPR).ENCLAVESECS EPCM(DS:RBX).ENCLAVESECS) or

(EPCM(DS:TMP_GPR).R = 0) or (EPCM(DS:TMP_GPR).W = 0) )

THEN #PF(DS:TMP_GPR); FI;

IF (TMP_MODE64 = 0)

THEN

IF (TMP_GPR + (GPR_SIZE -1) is not in DS segment) THEN #GP(0); FI;

FI;

CR_GPR_PA := Physical_Address (DS: TMP_GPR);

(* Validate TCS.OENTRY *)

TMP_TARGET := (DS:RBX).OENTRY + TMP_SECS.BASEADDR;

IF (TMP_MODE64 = 1)

THEN

IF (TMP_TARGET is not canonical) THEN #GP(0); FI;

ELSE

IF (TMP_TARGET > CS limit) THEN #GP(0); FI;

FI;

(* Check proposed FS/GS segments fall within DS *)

IF (TMP_MODE64 = 0)

THEN

TMP_FSBASE := (DS:RBX).OFSBASE + TMP_SECS.BASEADDR;

TMP_FSLIMIT := (DS:RBX).OFSBASE + TMP_SECS.BASEADDR + (DS:RBX).FSLIMIT;

TMP_GSBASE := (DS:RBX).OGSBASE + TMP_SECS.BASEADDR;

TMP_GSLIMIT := (DS:RBX).OGSBASE + TMP_SECS.BASEADDR + (DS:RBX).GSLIMIT;

(* if FS wrap-around, make sure DS has no holes*)

IF (TMP_FSLIMIT < TMP_FSBASE)

THEN

IF (DS.limit < 4GB) THEN #GP(0); FI;

ELSE

IF (TMP_FSLIMIT > DS.limit) THEN #GP(0); FI;

FI;

(* if GS wrap-around, make sure DS has no holes*)

IF (TMP_GSLIMIT < TMP_GSBASE)

THEN

IF (DS.limit < 4GB) THEN #GP(0); FI;

ELSE

IF (TMP_GSLIMIT > DS.limit) THEN #GP(0); FI;

FI;

ELSE

TMP_FSBASE := (DS:RBX).OFSBASE + TMP_SECS.BASEADDR;

TMP_GSBASE := (DS:RBX).OGSBASE + TMP_SECS.BASEADDR;

IF ( (TMP_FSBASE is not canonical) or (TMP_GSBASE is not canonical))

THEN #GP(0); FI;

FI;

(* Ensure the enclave is not already active and this thread is the only one using the TCS*)

IF (DS:RBX.STATE = ACTIVE)

THEN #GP(0); FI;

TMP_IA32_U_CET := 0

EENTER-Enters an Enclave

Vol. 3D

41-91

INTEL® SGX INSTRUCTION REFERENCES

TMP_SSP : = 0

IF CPUID.12H.01H:EAX[6] = 1

THEN

IF ( CR4.CET = 0 )

THEN

(* If part does not support CET or CET has not been enabled and enclave requires CET then fail *)

IF ( TMP_SECS.CET_ATTRIBUTES ≠ 0 OR TMP_SECS.CET_LEG_BITMAP_OFFSET ≠ 0 ) #GP(0); FI;

FI;

(* If indirect branch tracking or shadow stacks enabled but CET state save area is not 16B aligned then fail EENTER *)

IF ( TMP_SECS.CET_ATTRIBUTES.SH_STK_EN = 1 OR TMP_SECS.CET_ATTRIBUTES.ENDBR_EN = 1 )

THEN

IF (DS:RBX.OCETSSA is not 16B aligned) #GP(0); FI;

FI;

IF (TMP_SECS.CET_ATTRIBUTES.SH_STK_EN OR TMP_SECS.CET_ATTRIBUTES.ENDBR_EN)

THEN

(* Setup CET state from SECS, note tracker goes to IDLE *)

TMP_IA32_U_CET = TMP_SECS.CET_ATTRIBUTES;

IF (TMP_IA32_U_CET.LEG_IW_EN = 1 AND TMP_IA32_U_CET.ENDBR_EN = 1 )

THEN

TMP_IA32_U_CET := TMP_IA32_U_CET + TMP_SECS.BASEADDR;

TMP_IA32_U_CET := TMP_IA32_U_CET + TMP_SECS.CET_LEG_BITMAP_BASE;

FI;

(* Compute linear address of what will become new CET state save area and cache its PA *)

TMP_CET_SAVE_AREA = DS:RBX.OCETSSA + TMP_SECS.BASEADDR + (DS:RBX.CSSA) * 16

TMP_CET_SAVE_PAGE = TMP_CET_SAVE_AREA & ~0xFFF;

Check the TMP_CET_SAVE_PAGE page is read/write accessible

If fault occurs release locks, abort, and deliver fault

(* Read the EPCM VALID, PENDING, MODIFIED, BLOCKED, and PT fields atomically *)

IF ((DS:TMP_CET_SAVE_PAGE Does NOT RESOLVE TO EPC PAGE) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).VALID = 0) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).PENDING = 1) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).MODIFIED = 1) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).BLOCKED = 1) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).R = 0) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).W = 0) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).ENCLAVEADDRESS ≠ DS:TMP_CET_SAVE_PAGE) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).PT ≠ PT_SS_REST) OR

(EPCM(DS:TMP_CET_SAVE_PAGE).ENCLAVESECS ≠ EPCM(DS:RBX).ENCLAVESECS))

THEN

#PF(DS:TMP_CET_SAVE_PAGE);

FI;

CR_CET_SAVE_AREA_PA := Physical address(DS:TMP_CET_SAVE_AREA)

IF TMP_IA32_U_CET.SH_STK_EN = 1

THEN

TMP_SSP = TCS.PREVSSP;

FI;

41-92

Vol. 3D

EENTER-Enters an Enclave

INTEL® SGX INSTRUCTION REFERENCES

FI;

CR_ENCLAVE_MODE := 1;

CR_ACTIVE_SECS := TMP_SECS;

CR_ELRANGE := (TMPSECS.BASEADDR, TMP_SECS.SIZE);

(* Save state for possible AEXs *)

CR_TCS_PA := Physical_Address (DS:RBX);

CR_TCS_LA := RBX;

CR_TCS_LA.AEP := RCX;

(* Save the hidden portions of FS and GS *)

CR_SAVE_FS_selector := FS.selector;

CR_SAVE_FS_base := FS.base;

CR_SAVE_FS_limit := FS.limit;

CR_SAVE_FS_access_rights := FS.access_rights;

CR_SAVE_GS_selector := GS.selector;

CR_SAVE_GS_base := GS.base;

CR_SAVE_GS_limit := GS.limit;

CR_SAVE_GS_access_rights := GS.access_rights;

(* If XSAVE is enabled, save XCR0 and replace it with SECS.ATTRIBUTES.XFRM*)

IF (CR4.OSXSAVE = 1)

CR_SAVE_XCR0 := XCR0;

XCR0 := TMP_SECS.ATTRIBUTES.XFRM;

FI;

RCX := RIP;

RIP := TMP_TARGET;

RAX := (DS:RBX).CSSA;

(* Save the outside RSP and RBP so they can be restored on interrupt or EEXIT *)

DS:TMP_SSA.U_RSP := RSP;

DS:TMP_SSA.U_RBP := RBP;

(* Do the FS/GS swap *)

FS.base := TMP_FSBASE;

FS.limit := DS:RBX.FSLIMIT;

FS.type := 0001b;

FS.W := DS[bit 9];

FS.S := 1;

FS.DPL := DS.DPL;

FS.G := 1;

FS.B := 1;

FS.P := 1;

FS.AVL := DS.AVL;

FS.L := DS[bit 21];

FS.unusable := 0;

FS.selector := 0BH;

GS.base := TMP_GSBASE;

GS.limit := DS:RBX.GSLIMIT;

GS.type := 0001b;

GS.W := DS[bit 9];

GS.S := 1;

EENTER-Enters an Enclave

Vol. 3D

41-93

INTEL® SGX INSTRUCTION REFERENCES

GS.DPL := DS.DPL;

GS.G := 1;

GS.B := 1;

GS.P := 1;

GS.AVL := DS.AVL;

GS.L := DS[bit 21];

GS.unusable := 0;

GS.selector := 0BH;

CR_DBGOPTIN := TCS.FLAGS.DBGOPTIN;

Suppress_all_code_breakpoints_that_are_outside_ELRANGE;

IF (CR_DBGOPTIN = 0)

THEN

Suppress_all_code_breakpoints_that_overlap_with_ELRANGE;

CR_SAVE_TF := RFLAGS.TF;

RFLAGS.TF := 0;

Suppress_monitor_trap_flag for the source of the execution of the enclave;

Suppress any pending debug exceptions;

Suppress any pending MTF VM exit;

ELSE

IF RFLAGS.TF = 1

THEN pend a single-step #DB at the end of EENTER; FI;

IF the “monitor trap flag” VM-execution control is set

THEN pend an MTF VM exit at the end of EENTER; FI;

FI;

IF ((CPUID.07H.00H:EDX.CET_IBT = 1) OR (CPUID.07H.00H:ECX.CET_SS = 1)

THEN

(* Save enclosing application CET state into save registers *)

CR_SAVE_IA32_U_CET := IA32_U_CET

(* Setup enclave CET state *)

IF CPUID.07H.00H:ECX.CET_SS = 1

THEN

CR_SAVE_SSP := SSP

SSP := TMP_SSP

FI;

IA32_U_CET := TMP_IA32_U_CET;

FI;

Flush_linear_context;

Allow_front_end_to_begin_fetch_at_new_RIP;

Flags Affected

RFLAGS.TF is cleared on opt-out entry.

41-94

Vol. 3D

EENTER-Enters an Enclave

INTEL® SGX INSTRUCTION REFERENCES

Protected Mode Exceptions

#GP(0)

If DS:RBX is not page aligned.

If the enclave is not initialized.

If part or all of the FS or GS segment specified by TCS is outside the DS segment or not prop-

erly aligned.

If the thread is not in the INACTIVE state.

If CS, DS, ES or SS bases are not all zero.

If executed in enclave mode.

If any reserved field in the TCS FLAG is set.

If the target address is not within the CS segment.

If CR4.OSFXSR = 0.

If CR4.OSXSAVE = 0 and SECS.ATTRIBUTES.XFRM ≠ 3.

If CR4.OSXSAVE = 1and SECS.ATTRIBUTES.XFRM is not a subset of XCR0.

If SECS.ATTRIBUTES.AEXNOTIFY ≠ TCS.FLAGS.AEXNOTIFY and TCS.FLAGS.DBGOPTIN = 0.

#PF(error code)

If a page fault occurs in accessing memory.

If DS:RBX does not point to a valid TCS.

If one or more pages of the current SSA frame are not readable/writable, or do not resolve to

a valid PT_REG EPC page.

64-Bit Mode Exceptions

#GP(0)

If DS:RBX is not page aligned.

If the enclave is not initialized.

If the thread is not in the INACTIVE state.

If CS, DS, ES or SS bases are not all zero.

If executed in enclave mode.

If part or all of the FS or GS segment specified by TCS is outside the DS segment or not prop-

erly aligned.

If the target address is not canonical.

If CR4.OSFXSR = 0.

If CR4.OSXSAVE = 0 and SECS.ATTRIBUTES.XFRM ≠ 3.

If CR4.OSXSAVE = 1and SECS.ATTRIBUTES.XFRM is not a subset of XCR0.

If SECS.ATTRIBUTES.AEXNOTIFY ≠ TCS.FLAGS.AEXNOTIFY and TCS.FLAGS.DBGOPTIN = 0.

#PF(error code)

If a page fault occurs in accessing memory operands.

If DS:RBX does not point to a valid TCS.

If one or more pages of the current SSA frame are not readable/writable, or do not resolve to

a valid PT_REG EPC page.

EENTER-Enters an Enclave

Vol. 3D

41-95

INTEL® SGX INSTRUCTION REFERENCES

EEXIT-Exits an Enclave

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

EAX = 04H

V/V

SGX1

This leaf function is used to exit an enclave.

ENCLU[EEXIT]

Instruction Operand Encoding

Op/En

EAX

RBX

RCX

EEXIT (In)

Target address outside the enclave (In)

Address of the current AEP (Out)

Description

The ENCLU[EEXIT] instruction exits the currently executing enclave and branches to the location specified in RBX.

RCX receives the current AEP. If RBX is not within the CS (32-bit mode) or is not canonical (64-bit mode) a #GP(0)

results.

EEXIT Memory Parameter Semantics

Target Address

Non-Enclave read and execute access

If RBX specifies an address that is inside the enclave, the instruction will complete normally. The fetch of the next

instruction will occur in non-enclave mode, but will attempt to fetch from inside the enclave. This fetch returns a

fixed data pattern.

If secrets are contained in any registers, it is responsibility of enclave software to clear those registers.

If XCR0 was modified on enclave entry, it is restored to the value it had at the time of the most recent EENTER or

ERESUME.

If the enclave is opt-out, RFLAGS.TF is loaded from the value previously saved on EENTER.

Code and data breakpoints are unsuppressed.

Performance monitoring counters are unsuppressed.

Concurrency Restrictions

Table 41-60. Base Concurrency Restrictions of EEXIT

Base Concurrency Restrictions

Leaf

Parameter

Access

On Conflict

EEXIT

Concurrent

Table 41-61. Additional Concurrency Restrictions of EEXIT

Additional Concurrency Restrictions

vs. EACCEPT, EACCEPTCOPY,

Leaf

Parameter

vs. EADD, EEXTEND, EINIT

vs. ETRACK

EMODPE, EMODPR, EMODT

Access

On Conflict

Access

On Conflict

Access

On Conflict

EEXIT

Concurrent

41-96

Vol. 3D

EEXIT-Exits an Enclave

INTEL® SGX INSTRUCTION REFERENCES

Operation

Temp Variables in EEXIT Operational Flow

Name

Type

Size (Bits)

Description

TMP_RIP

Effective Address

32/64

Saved copy of CRIP for use when creating LBR.

TMP_MODE64 := ((IA32_EFER.LMA = 1) && (CS.L = 1));

IF (TMP_MODE64 = 1)

THEN

IF (RBX is not canonical) THEN #GP(0); FI;

ELSE

IF (RBX > CS limit) THEN #GP(0); FI;

FI;

TMP_RIP := CRIP;

RIP := RBX;

(* Return current AEP in RCX *)

RCX := CR_TCS_PA.AEP;

(* Do the FS/GS swap *)

FS.selector := CR_SAVE_FS.selector;

FS.base := CR_SAVE_FS.base;

FS.limit := CR_SAVE_FS.limit;

FS.access_rights := CR_SAVE_FS.access_rights;

GS.selector := CR_SAVE_GS.selector;

GS.base := CR_SAVE_GS.base;

GS.limit := CR_SAVE_GS.limit;

GS.access_rights := CR_SAVE_GS.access_rights;

(* Restore XCR0 if needed *)

IF (CR4.OSXSAVE = 1)

XCR0 := CR_SAVE__XCR0;

FI;

Unsuppress_all_code_breakpoints_that_are_outside_ELRANGE;

IF (CR_DBGOPTIN = 0)

THEN

UnSuppress_all_code_breakpoints_that_overlap_with_ELRANGE;

Restore suppressed breakpoint matches;

RFLAGS.TF := CR_SAVE_TF;

UnSuppress_montior_trap_flag;

UnSuppress_LBR_Generation;

UnSuppress_performance monitoring_activity;

Restore performance monitoring counter AnyThread demotion to MyThread in enclave back to AnyThread

FI;

IF RFLAGS.TF = 1

THEN Pend Single-Step #DB at the end of EEXIT;

FI;

EEXIT-Exits an Enclave

Vol. 3D

41-97

INTEL® SGX INSTRUCTION REFERENCES

IF the “monitor trap flag” VM-execution control is set

THEN pend a MTF VM exit at the end of EEXIT;

FI;

IF (CPUID.12H.01H:EAX[6] = 1)

THEN

(* Record PREVSSP *)

IF (IA32_U_CET.SH_STK_EN == 1)

THEN CR_TCS_PA.PREVSSP = SSP; FI;

FI;

IF ((CPUID.07H.00H:EDX.CET_IBT = 1) OR (CPUID.07H.00H:ECX.CET_SS = 1)

THEN

(* Restore enclosing app’s CET state from the save registers *)

IA32_U_CET := CR_SAVE_IA32_U_CET;

IF CPUID.07H.00H:ECX.CET_SS = 1

THEN SSP := CR_SAVE_SSP; FI;

(* Update enclosing app’s TRACKER if enclosing app has indirect branch tracking enabled *)

IF (CR4.CET = 1 AND IA32_U_CET.ENDBR_EN = 1)

THEN

IA32_U_CET.TRACKER := WAIT_FOR_ENDBRANCH;

IA32_U_CET.SUPPRESS := 0

FI;

CR_ENCLAVE_MODE := 0;

CR_TCS_PA.STATE := INACTIVE;

(* Assure consistent translations *)

Flush_linear_context;

Flags Affected

RFLAGS.TF is restored from the value previously saved in EENTER or ERESUME.

Protected Mode Exceptions

#GP(0)

If executed outside an enclave.

If RBX is outside the CS segment.

#PF(error code)

If a page fault occurs in accessing memory.

64-Bit Mode Exceptions

#GP(0)

If executed outside an enclave.

If RBX is not canonical.

#PF(error code)

If a page fault occurs in accessing memory operands.

41-98

Vol. 3D

EEXIT-Exits an Enclave

INTEL® SGX INSTRUCTION REFERENCES

EGETKEY-Retrieves a Cryptographic Key

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

EAX = 01H

V/V

SGX1

This leaf function retrieves a cryptographic key.

ENCLU[EGETKEY]

Instruction Operand Encoding

Op/En

EAX

RBX

RCX

EGETKEY (In)

Return error code (Out)

Address to a KEYREQUEST (In)

Address of the OUTPUTDATA (In)

Description

The ENCLU[EGETKEY] instruction returns a 128-bit secret key from the processor specific key hierarchy. The

mine the key being requested. The Requesting Keys section below provides a description of the keys that can be

requested. The RCX register contains the effective address where the key will be returned. Both the addresses in

RBX & RCX should be locations inside the enclave.

EGETKEY derives keys using a processor unique value to create a specific key based on a number of possible

inputs. This instruction leaf can only be executed inside an enclave.

EEGETKEY Memory Parameter Semantics

KEYREQUEST

OUTPUTDATA

Enclave read access

Enclave write access

After validating the operands, the instruction determines which key is to be produced and performs the following

actions:

• The instruction assembles the derivation data for the key based on the Table 41-62.

• Computes derived key using the derivation data and package specific value.

• Outputs the calculated key to the address in RCX.

The instruction fails with #GP(0) if the operands are not properly aligned. Successful completion of the instruction

will clear RFLAGS.{ZF, CF, AF, OF, SF, PF}. The instruction returns an error code if the user tries to request a key

based on an invalid CR_CPUSVN or ISVSVN (when the user request is accepted, see the table below), requests a

key for which it has not been granted the attribute to request, or requests a key that is not supported by the hard-

ware. These checks may be performed in any order. Thus, an indication by error number of one cause (for example,

invalid attribute) does not imply that there are not also other errors. Different processors may thus give different

error numbers for the same Enclave. The correctness of software should not rely on the order resulting from the

checks documented in this section. In such cases the ZF flag is set and the corresponding error bit (SGX_IN-

VALID_SVN, SGX_INVALID_ATTRIBUTE, SGX_INVALID_KEYNAME) is set in RAX and the data at the address spec-

ified by RCX is unmodified.

Requesting Keys

The KEYREQUEST structure (see Section 38.18.1) identifies the key to be provided. The Keyrequest.KeyName field

identifies which type of key is requested.

Deriving Keys

Key derivation is based on a combination of the enclave specific values (see Table 41-62) and a processor key.

Depending on the key being requested a field may either be included by definition or the value may be included

from the KeyRequest. A “yes” in Table 41-62 indicates the value for the field is included from its default location,

identified in the source row, and a “request” indicates the values for the field is included from its corresponding

KeyRequest field.

EGETKEY-Retrieves a Cryptographic Key

Vol. 3D

41-99

INTEL® SGX INSTRUCTION REFERENCES

Table 41-62. Key Derivation

Owner

CPU

ISV

ISVEXT

ISVFAM

CONFIG

CONFIGS

Key Name

Attributes

Epoch

SVN

ISV SVN

PRODID

ILYID

MRENCLAVE

MRSIGNER

RAND

Key

Y :=

CR_SGX

Y :=

R :=

SECS.

SECS.IS

SECS.

SECS.CO

Req.

Dependent

SECS.ATTRIBUTES

OWNER

CPUSVN

Req.ISV

ISVID

VEXTPR

VFAMIL

MRENCLAVE

MRSIGNER

NFIGID

NFIGSVN

KEYID

Constant

and

EPOCH

SVN;

ODID

YID

SECS.MISCSELECT

and

SECS.CET_ATTRIB

UTES;

Source

R := AttribMask &

R :=

SECS.ATTRIBUTES

Req.CPU

and

SVN;

SECS.MISCSELECT

and

SECS.CET_ATTRIB

UTES;

EINITTOKEN

Yes

Request

Yes

Request

Yes

Request

Report

Yes

Request

Seal

Yes

Request

Yes

Request

Provisioning

Yes

Request

Yes

Provisioning

Yes

Request

Yes

Request

Yes

Seal

Keys that permit the specification of a CPU or ISV's code's, or enclave configuration's SVNs have additional require-

ments. The caller may not request a key for an SVN beyond the current CPU, ISV or enclave configuration's SVN,

respectively.

Several keys are access controlled. Access to the Provisioning Key and Provisioning Seal key requires the enclave's

ATTRIBUTES.PROVISIONKEY be set. The EINITTOKEN Key requires ATTRIBUTES.EINITTOKEN_KEY be set and

SECS.MRSIGNER equal IA32_SGXLEPUBKEYHASH.

Some keys are derived based on a hardcode PKCS padding constant (352 byte string):

HARDCODED_PKCS1_5_PADDING[15:0] := 0100H;

HARDCODED_PKCS1_5_PADDING[2655:16] := SignExtend330Byte(-1); // 330 bytes of 0FFH

HARDCODED_PKCS1_5_PADDING[2815:2656] := 2004000501020403650148866009060D30313000H;

The error codes are:

Table 41-63. EGETKEY Return Value in RAX

Error Code (see Table 41-3)

Value

Description

No Error

EGETKEY successful.

SGX_INVALID_ATTRIBUTE

The KEYREQUEST contains a KEYNAME for which the enclave is not authorized.

SGX_INVALID_CPUSVN

If KEYREQUEST.CPUSVN is an unsupported platforms CPUSVN value.

SGX_INVALID_ISVSVN

If KEYREQUEST software SVN (ISVSVN or CONFIGSVN) is greater than the

enclave's corresponding SVN.

SGX_INVALID_KEYNAME

If KEYREQUEST.KEYNAME is an unsupported value.

Concurrency Restrictions

Table 41-64. Base Concurrency Restrictions of EGETKEY

Base Concurrency Restrictions

Leaf

Parameter

Access

On Conflict

EGETKEY

KEYREQUEST [DS:RBX]

Concurrent

OUTPUTDATA [DS:RCX]

Concurrent

41-100

Vol.

EGETKEY-Retrieves a Cryptographic Key

INTEL® SGX INSTRUCTION REFERENCES

Table 41-65. Additional Concurrency Restrictions of EGETKEY

Additional Concurrency Restrictions

vs. EACCEPT, EACCEPTCOPY,

Leaf

Parameter

vs. EADD, EEXTEND, EINIT

vs. ETRACK

EMODPE, EMODPR, EMODT

Access

On Conflict

Access

On Conflict

Access

On Conflict

EGETKEY

KEYREQUEST

Concurrent

[DS:RBX]

OUTPUTDATA

Concurrent

[DS:RCX]

Operation

Temp Variables in EGETKEY Operational Flow

Name

Type

Size (Bits)

Description

TMP_CURRENTSECS

Address of the SECS for the currently executing enclave.

TMP_KEYDEPENDENCIES

Temp space for key derivation.

TMP_ATTRIBUTES

128

Temp Space for the calculation of the sealable Attributes.

TMP_ISVEXTPRODID

16 bytes

Temp Space for ISVEXTPRODID.

TMP_ISVPRODID

2 bytes

Temp Space for ISVPRODID.

TMP_ISVFAMILYID

16 bytes

Temp Space for ISVFAMILYID.

TMP_CONFIGID

64 bytes

Temp Space for CONFIGID.

TMP_CONFIGSVN

2 bytes

Temp Space for CONFIGSVN.

TMP_OUTPUTKEY

128

Temp Space for the calculation of the key.

(* Make sure KEYREQUEST is properly aligned and inside the current enclave *)

IF ( (DS:RBX is not 512Byte aligned) or (DS:RBX is not within CR_ELRANGE) )

THEN #GP(0); FI;

(* Make sure DS:RBX is an EPC address and the EPC page is valid *)

IF ( (DS:RBX does not resolve to an EPC address) or (EPCM(DS:RBX).VALID = 0) )

THEN #PF(DS:RBX); FI;

IF (EPCM(DS:RBX).BLOCKED = 1)

THEN #PF(DS:RBX); FI;

(* Check page parameters for correctness *)

IF ( (EPCM(DS:RBX).PT ≠ PT_REG) or (EPCM(DS:RBX).ENCLAVESECS ≠ CR_ACTIVE_SECS) or (EPCM(DS:RBX).PENDING = 1) or

(EPCM(DS:RBX).MODIFIED = 1) or (EPCM(DS:RBX).ENCLAVEADDRESS ≠ (DS:RBX & ~0FFFH) ) or (EPCM(DS:RBX).R = 0) )

THEN #PF(DS:RBX);

FI;

(* Make sure OUTPUTDATA is properly aligned and inside the current enclave *)

IF ( (DS:RCX is not 16Byte aligned) or (DS:RCX is not within CR_ELRANGE) )

THEN #GP(0); FI;

(* Make sure DS:RCX is an EPC address and the EPC page is valid *)

IF ( (DS:RCX does not resolve to an EPC address) or (EPCM(DS:RCX).VALID = 0) )

EGETKEY-Retrieves a Cryptographic Key

Vol. 3D

41-101

INTEL® SGX INSTRUCTION REFERENCES

THEN #PF(DS:RCX); FI;

IF (EPCM(DS:RCX).BLOCKED = 1)

THEN #PF(DS:RCX); FI;

(* Check page parameters for correctness *)

IF ( (EPCM(DS:RCX).PT ≠ PT_REG) or (EPCM(DS:RCX).ENCLAVESECS ≠ CR_ACTIVE_SECS) or (EPCM(DS:RCX).PENDING = 1) or

(EPCM(DS:RCX).MODIFIED = 1) or (EPCM(DS:RCX).ENCLAVEADDRESS ≠ (DS:RCX & ~0FFFH) ) or (EPCM(DS:RCX).W = 0) )

THEN #PF(DS:RCX);

FI;

(* Verify RESERVED spaces in KEYREQUEST are valid *)

IF ( (DS:RBX).RESERVED ≠ 0) or (DS:RBX.KEYPOLICY.RESERVED ≠ 0) )

THEN #GP(0); FI;

TMP_CURRENTSECS := CR_ACTIVE_SECS;

(* Verify that CONFIGSVN & New Policy bits are not used if KSS is not enabled *)

IF ((TMP_CURRENTSECS.ATTRIBUTES.KSS == 0) AND ((DS:RBX.KEYPOLICY & 0x003C ≠ 0) OR (DS:RBX.CONFIGSVN > 0)))

THEN #GP(0); FI;

(* Determine which enclave attributes that must be included in the key. Attributes that must always be include INIT & DEBUG *)

REQUIRED_SEALING_MASK[127:0] := 00000000 00000000 00000000 00000003H;

TMP_ATTRIBUTES := (DS:RBX.ATTRIBUTEMASK | REQUIRED_SEALING_MASK) & TMP_CURRENTSECS.ATTRIBUTES;

(* Compute MISCSELECT fields to be included *)

TMP_MISCSELECT := DS:RBX.MISCMASK & TMP_CURRENTSECS.MISCSELECT

(* Compute CET_ATTRIBUTES fields to be included *)

IF (CPUID.12H.01H:EAX[6] = 1)

THEN TMP_CET_ATTRIBUTES := DS:RBX.CET_ATTRIBUTES_ MASK & TMP_CURRENTSECS.CET_ATTRIBUTES; FI;

TMP_KEYDEPENDENCIES := 0;

CASE (DS:RBX.KEYNAME)

SEAL_KEY:

IF (DS:RBX.CPUSVN is beyond current CPU configuration)

THEN

RFLAGS.ZF := 1;

RAX := SGX_INVALID_CPUSVN;

GOTO EXIT;

FI;

IF (DS:RBX.ISVSVN > TMP_CURRENTSECS.ISVSVN)

THEN

RFLAGS.ZF := 1;

RAX := SGX_INVALID_ISVSVN;

GOTO EXIT;

FI;

IF (DS:RBX.CONFIGSVN > TMP_CURRENTSECS.CONFIGSVN)

THEN

RFLAGS.ZF := 1;

RAX := SGX_INVALID_ISVSVN;

GOTO EXIT;

FI;

(*Include enclave identity?*)

41-102

Vol.

EGETKEY-Retrieves a Cryptographic Key

INTEL® SGX INSTRUCTION REFERENCES

TMP_MRENCLAVE := 0;

IF (DS:RBX.KEYPOLICY.MRENCLAVE = 1)

THEN TMP_MRENCLAVE := TMP_CURRENTSECS.MRENCLAVE;

FI;

(*Include enclave author?*)

TMP_MRSIGNER := 0;

IF (DS:RBX.KEYPOLICY.MRSIGNER = 1)

THEN TMP_MRSIGNER := TMP_CURRENTSECS.MRSIGNER;

FI;

(* Include enclave product family ID? *)

TMP_ISVFAMILYID := 0;

IF (DS:RBX.KEYPOLICY.ISVFAMILYID = 1)

THEN TMP_ISVFAMILYID := TMP_CURRENTSECS.ISVFAMILYID;

FI;

(* Include enclave product ID? *)

TMP_ISVPRODID := 0;

IF (DS:RBX.KEYPOLICY.NOISVPRODID = 0)

TMP_ISVPRODID := TMP_CURRENTSECS.ISVPRODID;

FI;

(* Include enclave Config ID? *)

TMP_CONFIGID := 0;

TMP_CONFIGSVN := 0;

IF (DS:RBX.KEYPOLICY.CONFIGID = 1)

TMP_CONFIGID := TMP_CURRENTSECS.CONFIGID;

TMP_CONFIGSVN := DS:RBX.CONFIGSVN;

FI;

(* Include enclave extended product ID? *)

TMP_ISVEXTPRODID := 0;

IF (DS:RBX.KEYPOLICY.ISVEXTPRODID = 1 )

TMP_ISVEXTPRODID := TMP_CURRENTSECS.ISVEXTPRODID;

FI;

//Determine values key is based on

TMP_KEYDEPENDENCIES.KEYNAME := SEAL_KEY;

TMP_KEYDEPENDENCIES.ISVFAMILYID := TMP_ISVFAMILYID;

TMP_KEYDEPENDENCIES.ISVEXTPRODID := TMP_ISVEXTPRODID;

TMP_KEYDEPENDENCIES.ISVPRODID := TMP_ISVPRODID;

TMP_KEYDEPENDENCIES.ISVSVN := DS:RBX.ISVSVN;

TMP_KEYDEPENDENCIES.SGXOWNEREPOCH := CR_SGXOWNEREPOCH;

TMP_KEYDEPENDENCIES.ATTRIBUTES := TMP_ATTRIBUTES;

TMP_KEYDEPENDENCIES.ATTRIBUTESMASK := DS:RBX.ATTRIBUTEMASK;

TMP_KEYDEPENDENCIES.MRENCLAVE := TMP_MRENCLAVE;

TMP_KEYDEPENDENCIES.MRSIGNER := TMP_MRSIGNER;

TMP_KEYDEPENDENCIES.KEYID := DS:RBX.KEYID;

TMP_KEYDEPENDENCIES.SEAL_KEY_FUSES := CR_SEAL_FUSES;

TMP_KEYDEPENDENCIES.CPUSVN := DS:RBX.CPUSVN;

TMP_KEYDEPENDENCIES.PADDING := TMP_CURRENTSECS.PADDING;

TMP_KEYDEPENDENCIES.MISCSELECT := TMP_MISCSELECT;

TMP_KEYDEPENDENCIES.MISCMASK := ~DS:RBX.MISCMASK;

TMP_KEYDEPENDENCIES.KEYPOLICY := DS:RBX.KEYPOLICY;

TMP_KEYDEPENDENCIES.CONFIGID := TMP_CONFIGID;

EGETKEY-Retrieves a Cryptographic Key

Vol. 3D

41-103

INTEL® SGX INSTRUCTION REFERENCES

TMP_KEYDEPENDENCIES.CONFIGSVN := TMP_CONFIGSVN;

IF CPUID.12H.01H:EAX[6] = 1

THEN

TMP_KEYDEPENDENCIES.CET_ATTRIBUTES := TMP_CET_ATTRIBUTES;

TMP_KEYDEPENDENCIES.CET_ATTRIBUTES _MASK := DS:RBX.CET_ATTRIBUTES _MASK;

FI;

BREAK;

REPORT_KEY:

//Determine values key is based on

TMP_KEYDEPENDENCIES.KEYNAME := REPORT_KEY;

TMP_KEYDEPENDENCIES.ISVFAMILYID := 0;

TMP_KEYDEPENDENCIES.ISVEXTPRODID := 0;

TMP_KEYDEPENDENCIES.ISVPRODID := 0;

TMP_KEYDEPENDENCIES.ISVSVN := 0;

TMP_KEYDEPENDENCIES.SGXOWNEREPOCH := CR_SGXOWNEREPOCH;

TMP_KEYDEPENDENCIES.ATTRIBUTES := TMP_CURRENTSECS.ATTRIBUTES;

TMP_KEYDEPENDENCIES.ATTRIBUTESMASK := 0;

TMP_KEYDEPENDENCIES.MRENCLAVE := TMP_CURRENTSECS.MRENCLAVE;

TMP_KEYDEPENDENCIES.MRSIGNER := 0;

TMP_KEYDEPENDENCIES.KEYID := DS:RBX.KEYID;

TMP_KEYDEPENDENCIES.SEAL_KEY_FUSES := CR_SEAL_FUSES;

TMP_KEYDEPENDENCIES.CPUSVN := CR_CPUSVN;

TMP_KEYDEPENDENCIES.PADDING := HARDCODED_PKCS1_5_PADDING;

TMP_KEYDEPENDENCIES.MISCSELECT := TMP_CURRENTSECS.MISCSELECT;

TMP_KEYDEPENDENCIES.MISCMASK := 0;

TMP_KEYDEPENDENCIES.KEYPOLICY := 0;

TMP_KEYDEPENDENCIES.CONFIGID := TMP_CURRENTSECS.CONFIGID;

TMP_KEYDEPENDENCIES.CONFIGSVN := TMP_CURRENTSECS.CONFIGSVN;

IF (CPUID.12H.01H:EAX[6] = 1)

THEN

TMP_KEYDEPENDENCIES.CET_ATTRIBUTES := TMP_CURRENTSECS.CET_ATTRIBUTES;

TMP_KEYDEPENDENCIES.CET_ATTRIBUTES_MASK := 0;

FI;

BREAK;

EINITTOKEN_KEY:

(* Check ENCLAVE has EINITTOKEN Key capability *)

IF (TMP_CURRENTSECS.ATTRIBUTES.EINITTOKEN_KEY = 0)

THEN

RFLAGS.ZF := 1;

RAX := SGX_INVALID_ATTRIBUTE;

GOTO EXIT;

FI;

IF (DS:RBX.CPUSVN is beyond current CPU configuration)

THEN

RFLAGS.ZF := 1;

RAX := SGX_INVALID_CPUSVN;

GOTO EXIT;

FI;

IF (DS:RBX.ISVSVN > TMP_CURRENTSECS.ISVSVN)

THEN

RFLAGS.ZF := 1;

RAX := SGX_INVALID_ISVSVN;

GOTO EXIT;

FI;

41-104

Vol.

EGETKEY-Retrieves a Cryptographic Key

INTEL® SGX INSTRUCTION REFERENCES

(* Determine values key is based on *)

TMP_KEYDEPENDENCIES.KEYNAME := EINITTOKEN_KEY;

TMP_KEYDEPENDENCIES.ISVFAMILYID := 0;

TMP_KEYDEPENDENCIES.ISVEXTPRODID := 0;

TMP_KEYDEPENDENCIES.ISVPRODID := TMP_CURRENTSECS.ISVPRODID

TMP_KEYDEPENDENCIES.ISVSVN := DS:RBX.ISVSVN;

TMP_KEYDEPENDENCIES.SGXOWNEREPOCH := CR_SGXOWNEREPOCH;

TMP_KEYDEPENDENCIES.ATTRIBUTES := TMP_ATTRIBUTES;

TMP_KEYDEPENDENCIES.ATTRIBUTESMASK := 0;

TMP_KEYDEPENDENCIES.MRENCLAVE := 0;

TMP_KEYDEPENDENCIES.MRSIGNER := TMP_CURRENTSECS.MRSIGNER;

TMP_KEYDEPENDENCIES.KEYID := DS:RBX.KEYID;

TMP_KEYDEPENDENCIES.SEAL_KEY_FUSES := CR_SEAL_FUSES;

TMP_KEYDEPENDENCIES.CPUSVN := DS:RBX.CPUSVN;

TMP_KEYDEPENDENCIES.PADDING := TMP_CURRENTSECS.PADDING;

TMP_KEYDEPENDENCIES.MISCSELECT := TMP_MISCSELECT;

TMP_KEYDEPENDENCIES.MISCMASK := 0;

TMP_KEYDEPENDENCIES.KEYPOLICY := 0;

TMP_KEYDEPENDENCIES.CONFIGID := 0;

TMP_KEYDEPENDENCIES.CONFIGSVN := 0;

IF (CPUID.12H.01H:EAX[6] = 1)

THEN

TMP_KEYDEPENDENCIES.CET_ATTRIBUTES := TMP_CET_ATTRIBUTES;

TMP_KEYDEPENDENCIES.CET_ATTRIBUTES _MASK := 0;

FI;

BREAK;

PROVISION_KEY:

(* Check ENCLAVE has PROVISIONING capability *)

IF (TMP_CURRENTSECS.ATTRIBUTES.PROVISIONKEY = 0)

THEN

RFLAGS.ZF := 1;

RAX := SGX_INVALID_ATTRIBUTE;

GOTO EXIT;

FI;

IF (DS:RBX.CPUSVN is beyond current CPU configuration)

THEN

RFLAGS.ZF := 1;

RAX := SGX_INVALID_CPUSVN;

GOTO EXIT;

FI;

IF (DS:RBX.ISVSVN > TMP_CURRENTSECS.ISVSVN)

THEN

RFLAGS.ZF := 1;

RAX := SGX_INVALID_ISVSVN;

GOTO EXIT;

FI;

(* Determine values key is based on *)

TMP_KEYDEPENDENCIES.KEYNAME := PROVISION_KEY;

TMP_KEYDEPENDENCIES.ISVFAMILYID := 0;

TMP_KEYDEPENDENCIES.ISVEXTPRODID := 0;

TMP_KEYDEPENDENCIES.ISVPRODID := TMP_CURRENTSECS.ISVPRODID;

TMP_KEYDEPENDENCIES.ISVSVN := DS:RBX.ISVSVN;

TMP_KEYDEPENDENCIES.SGXOWNEREPOCH := 0;

TMP_KEYDEPENDENCIES.ATTRIBUTES := TMP_ATTRIBUTES;

EGETKEY-Retrieves a Cryptographic Key

Vol. 3D

41-105

INTEL® SGX INSTRUCTION REFERENCES

TMP_KEYDEPENDENCIES.ATTRIBUTESMASK := DS:RBX.ATTRIBUTEMASK;

TMP_KEYDEPENDENCIES.MRENCLAVE := 0;

TMP_KEYDEPENDENCIES.MRSIGNER := TMP_CURRENTSECS.MRSIGNER;

TMP_KEYDEPENDENCIES.KEYID := 0;

TMP_KEYDEPENDENCIES.SEAL_KEY_FUSES := 0;

TMP_KEYDEPENDENCIES.CPUSVN := DS:RBX.CPUSVN;

TMP_KEYDEPENDENCIES.PADDING := TMP_CURRENTSECS.PADDING;

TMP_KEYDEPENDENCIES.MISCSELECT := TMP_MISCSELECT;

TMP_KEYDEPENDENCIES.MISCMASK := ~DS:RBX.MISCMASK;

TMP_KEYDEPENDENCIES.KEYPOLICY := 0;

TMP_KEYDEPENDENCIES.CONFIGID := 0;

IF (CPUID.12H.01H:EAX[6] = 1)

THEN

TMP_KEYDEPENDENCIES.CET_ATTRIBUTES := TMP_CET_ATTRIBUTES;

TMP_KEYDEPENDENCIES.CET_ATTRIBUTES _MASK := 0;

FI;

BREAK;

PROVISION_SEAL_KEY:

(* Check ENCLAVE has PROVISIONING capability *)

IF (TMP_CURRENTSECS.ATTRIBUTES.PROVISIONKEY = 0)

THEN

RFLAGS.ZF := 1;

RAX := SGX_INVALID_ATTRIBUTE;

GOTO EXIT;

FI;

IF (DS:RBX.CPUSVN is beyond current CPU configuration)

THEN

RFLAGS.ZF := 1;

RAX := SGX_INVALID_CPUSVN;

GOTO EXIT;

FI;

IF (DS:RBX.ISVSVN > TMP_CURRENTSECS.ISVSVN)

THEN

RFLAGS.ZF := 1;

RAX := SGX_INVALID_ISVSVN;

GOTO EXIT;

FI;

(* Include enclave product family ID? *)

TMP_ISVFAMILYID := 0;

IF (DS:RBX.KEYPOLICY.ISVFAMILYID = 1)

THEN TMP_ISVFAMILYID := TMP_CURRENTSECS.ISVFAMILYID;

FI;

(* Include enclave product ID? *)

TMP_ISVPRODID := 0;

IF (DS:RBX.KEYPOLICY.NOISVPRODID = 0)

TMP_ISVPRODID := TMP_CURRENTSECS.ISVPRODID;

FI;

(* Include enclave Config ID? *)

TMP_CONFIGID := 0;

TMP_CONFIGSVN := 0;

IF (DS:RBX.KEYPOLICY.CONFIGID = 1)

TMP_CONFIGID := TMP_CURRENTSECS.CONFIGID;

41-106

Vol.

EGETKEY-Retrieves a Cryptographic Key

INTEL® SGX INSTRUCTION REFERENCES

TMP_CONFIGSVN := DS:RBX.CONFIGSVN;

FI;

(* Include enclave extended product ID? *)

TMP_ISVEXTPRODID := 0;

IF (DS:RBX.KEYPOLICY.ISVEXTPRODID = 1)

TMP_ISVEXTPRODID := TMP_CURRENTSECS.ISVEXTPRODID;

FI;

(* Determine values key is based on *)

TMP_KEYDEPENDENCIES.KEYNAME := PROVISION_SEAL_KEY;

TMP_KEYDEPENDENCIES.ISVFAMILYID := TMP_ISVFAMILYID;

TMP_KEYDEPENDENCIES.ISVEXTPRODID := TMP_ISVEXTPRODID;

TMP_KEYDEPENDENCIES.ISVPRODID := TMP_ISVPRODID;

TMP_KEYDEPENDENCIES.ISVSVN := DS:RBX.ISVSVN;

TMP_KEYDEPENDENCIES.SGXOWNEREPOCH := 0;

TMP_KEYDEPENDENCIES.ATTRIBUTES := TMP_ATTRIBUTES;

TMP_KEYDEPENDENCIES.ATTRIBUTESMASK := DS:RBX.ATTRIBUTEMASK;

TMP_KEYDEPENDENCIES.MRENCLAVE := 0;

TMP_KEYDEPENDENCIES.MRSIGNER := TMP_CURRENTSECS.MRSIGNER;

TMP_KEYDEPENDENCIES.KEYID := 0;

TMP_KEYDEPENDENCIES.SEAL_KEY_FUSES := CR_SEAL_FUSES;

TMP_KEYDEPENDENCIES.CPUSVN := DS:RBX.CPUSVN;

TMP_KEYDEPENDENCIES.PADDING := TMP_CURRENTSECS.PADDING;

TMP_KEYDEPENDENCIES.MISCSELECT := TMP_MISCSELECT;

TMP_KEYDEPENDENCIES.MISCMASK := ~DS:RBX.MISCMASK;

TMP_KEYDEPENDENCIES.KEYPOLICY := DS:RBX.KEYPOLICY;

TMP_KEYDEPENDENCIES.CONFIGID := TMP_CONFIGID;

TMP_KEYDEPENDENCIES.CONFIGSVN := TMP_CONFIGSVN;

IF (CPUID.12H.01H:EAX[6] = 1)

THEN

TMP_KEYDEPENDENCIES.CET_ATTRIBUTES := TMP_CET_ATTRIBUTES;

TMP_KEYDEPENDENCIES.CET_ATTRIBUTES _MASK := 0;

FI;

BREAK;

DEFAULT:

(* The value of KEYNAME is invalid *)

RFLAGS.ZF := 1;

RAX := SGX_INVALID_KEYNAME;

GOTO EXIT:

ESAC;

(* Calculate the final derived key and output to the address in RCX *)

TMP_OUTPUTKEY := derivekey(TMP_KEYDEPENDENCIES);

DS:RCX[15:0] := TMP_OUTPUTKEY;

RAX := 0;

RFLAGS.ZF := 0;

EXIT:

RFLAGS.CF := 0;

RFLAGS.PF := 0;

RFLAGS.AF := 0;

RFLAGS.OF := 0;

RFLAGS.SF := 0;

EGETKEY-Retrieves a Cryptographic Key

Vol. 3D

41-107

INTEL® SGX INSTRUCTION REFERENCES

EMODPE-Extend an EPC Page Permissions

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

EAX = 06H

V/V

SGX2

This leaf function extends the access rights of an existing EPC

ENCLU[EMODPE]

page.

Instruction Operand Encoding

Op/En

EAX

RBX

RCX

EMODPE (In)

Address of a SECINFO (In)

Address of the destination EPC page (In)

Description

This leaf function extends the access rights associated with an existing EPC page in the running enclave. THE RWX

bits of the SECINFO parameter are treated as a permissions mask; supplying a value that does not extend the page

permissions will have no effect. This instruction leaf can only be executed when inside the enclave.

RBX contains the effective address of a SECINFO structure while RCX contains the effective address of an EPC

page. The table below provides additional information on the memory parameter of the EMODPE leaf function.

EMODPE Memory Parameter Semantics

SECINFO

EPCPAGE

Read access permitted by Non Enclave

Read access permitted by Enclave

The instruction faults if any of the following:

EMODPE Faulting Conditions

The operands are not properly aligned.

If security attributes of the SECINFO page make the page inaccessible.

The EPC page is locked by another thread.

RBX does not contain an effective address in an EPC page in the running enclave.

The EPC page is not valid.

RCX does not contain an effective address of an EPC page in the running enclave.

SECINFO contains an invalid request.

Concurrency Restrictions

Table 41-66. Base Concurrency Restrictions of EMODPE

Base Concurrency Restrictions

Leaf

Parameter

Access

On Conflict

EMODPE

Target [DS:RCX]

Concurrent

SECINFO [DS:RBX]

Concurrent

Table 41-67. Additional Concurrency Restrictions of EMODPE

Additional Concurrency Restrictions

vs. EACCEPT, EACCEPTCOPY,

Leaf

Parameter

vs. EADD, EEXTEND, EINIT

vs. ETRACK

EMODPE, EMODPR, EMODT

Access

On Conflict

Access

On Conflict

Access

On Conflict

EMODPE

Target [DS:RCX]

Exclusive

#GP

Concurrent

SECINFO [DS:RBX]

Concurrent

EMODPE-Extend an EPC Page Permissions

Vol. 3D

41-109

INTEL® SGX INSTRUCTION REFERENCES

Operation

Temp Variables in EMODPE Operational Flow

Name

Type

Size (bits)

Description

SCRATCH_SECINFO

SECINFO

512

Scratch storage for holding the contents of DS:RBX.

IF (DS:RBX is not 64Byte Aligned)

THEN #GP(0); FI;

IF (DS:RCX is not 4KByte Aligned)

THEN #GP(0); FI;

IF ((DS:RBX is not within CR_ELRANGE) or (DS:RCX is not within CR_ELRANGE) )

THEN #GP(0); FI;

IF (DS:RBX does not resolve within an EPC)

THEN #PF(DS:RBX); FI;

IF (DS:RCX does not resolve within an EPC)

THEN #PF(DS:RCX); FI;

IF ( (EPCM(DS:RBX).VALID = 0) or (EPCM(DS:RBX).R = 0) or (EPCM(DS:RBX).PENDING ≠ 0) or (EPCM(DS:RBX).MODIFIED ≠ 0) or

(EPCM(DS:RBX).BLOCKED ≠ 0) or (EPCM(DS:RBX).PT ≠ PT_REG) or (EPCM(DS:RBX).ENCLAVESECS ≠ CR_ACTIVE_SECS) or

(EPCM(DS:RBX).ENCLAVEADDRESS ≠ (DS:RBX & ~0xFFF)) )

THEN #PF(DS:RBX); FI;

SCRATCH_SECINFO := DS:RBX;

(* Check for misconfigured SECINFO flags*)

IF (SCRATCH_SECINFO reserved fields are not zero )

THEN #GP(0); FI;

(* Check security attributes of the EPC page *)

IF ( (EPCM(DS:RCX).VALID = 0) or (EPCM(DS:RCX).PENDING ≠ 0) or (EPCM(DS:RCX).MODIFIED ≠ 0) or

(EPCM(DS:RCX).BLOCKED ≠ 0) or (EPCM(DS:RCX).PT ≠ PT_REG) or (EPCM(DS:RCX).ENCLAVESECS ≠ CR_ACTIVE_SECS) )

THEN #PF(DS:RCX); FI;

(* Check the EPC page for concurrency *)

IF (EPC page in use by another SGX2 instruction)

THEN #GP(0); FI;

(* Re-Check security attributes of the EPC page *)

IF ( (EPCM(DS:RCX).VALID = 0) or (EPCM(DS:RCX).PENDING ≠ 0) or (EPCM(DS:RCX).MODIFIED ≠ 0) or

(EPCM(DS:RCX).PT ≠ PT_REG) or (EPCM(DS:RCX).ENCLAVESECS ≠ CR_ACTIVE_SECS) or

(EPCM(DS:RCX).ENCLAVEADDRESS ≠ DS:RCX))

THEN #PF(DS:RCX); FI;

(* Check for misconfigured SECINFO flags*)

IF ( (EPCM(DS:RCX).R = 0) and (SCRATCH_SECINFO.FLAGS.R = 0) and (SCRATCH_SECINFO.FLAGS.W ≠ 0) )

THEN #GP(0); FI;

41-110

Vol.

EMODPE-Extend an EPC Page Permissions

INTEL® SGX INSTRUCTION REFERENCES

EREPORT-Create a Cryptographic Report of the Enclave

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

EAX = 00H

V/V

SGX1

This leaf function creates a cryptographic report of the enclave.

ENCLU[EREPORT]

Instruction Operand Encoding

Op/En

EAX

RBX

RCX

RDX

Address of TARGETINFO

Address of REPORTDATA

Address where the REPORT is

EREPORT (In)

(In)

written to in an OUTPUTDATA (In)

Description

This leaf function creates a cryptographic REPORT that describes the contents of the enclave. This instruction leaf

can only be executed when inside the enclave. The cryptographic report can be used by other enclaves to deter-

mine that the enclave is running on the same platform.

RBX contains the effective address of the MRENCLAVE value of the enclave that will authenticate the REPORT

output, using the REPORT key delivered by EGETKEY command for that enclave. RCX contains the effective address

of a 64-byte REPORTDATA structure, which allows the caller of the instruction to associate data with the enclave

from which the instruction is called. RDX contains the address where the REPORT will be output by the instruction.

EREPORT Memory Parameter Semantics

TARGETINFO

REPORTDATA

OUTPUTDATA

Read access by Enclave

Read/Write access by Enclave

This instruction leaf perform the following:

1. Validate the 3 operands (RBX, RCX, RDX) are inside the enclave.

2. Compute a report key for the target enclave, as indicated by the value located in RBX(TARGETINFO).

3. Assemble the enclave SECS data to complete the REPORT structure (including the data provided using the RCX

(REPORTDATA) operand).

4. Computes a cryptographic hash over REPORT structure.

5. Add the computed hash to the REPORT structure.

6. Output the completed REPORT structure to the address in RDX (OUTPUTDATA).

The instruction fails if the operands are not properly aligned.

CR_REPORT_KEYID, used to provide key wearout protection, is populated with a statistically unique value on boot

of the platform by a trusted entity within the SGX TCB.

The instruction faults if any of the following:

EREPORT Faulting Conditions

An effective address not properly aligned.

An memory address does not resolve in an EPC page.

If accessing an invalid EPC page.

If the EPC page is blocked.

May page fault.

41-112

Vol.

EREPORT-Create a Cryptographic Report of the Enclave

INTEL® SGX INSTRUCTION REFERENCES

Concurrency Restrictions

Table 41-68. Base Concurrency Restrictions of EREPORT

Base Concurrency Restrictions

Leaf

Parameter

Access

On Conflict

EREPORT

TARGETINFO [DS:RBX]

Concurrent

REPORTDATA [DS:RCX]

Concurrent

OUTPUTDATA [DS:RDX]

Concurrent

Table 41-69. Additional Concurrency Restrictions of EREPORT

Additional Concurrency Restrictions

vs. EACCEPT, EACCEPTCOPY,

Leaf

Parameter

vs. EADD, EEXTEND, EINIT

vs. ETRACK

EMODPE, EMODPR, EMODT

Access

On Conflict

Access

On Conflict

Access

On Conflict

EREPORT

TARGETINFO [DS:RBX]

Concurrent

REPORTDATA

Concurrent

[DS:RCX]

OUTPUTDATA

Concurrent

[DS:RDX]

Operation

Temp Variables in EREPORT Operational Flow

Name

Type

Size (bits)

Description

TMP_ATTRIBUTES

Physical address of SECS of the enclave to which source operand belongs.

TMP_CURRENTSECS

Address of the SECS for the currently executing enclave.

TMP_KEYDEPENDENCIES

Temp space for key derivation.

TMP_REPORTKEY

128

REPORTKEY generated by the instruction.

TMP_REPORT

3712

TMP_MODE64 := ((IA32_EFER.LMA = 1) && (CS.L = 1));

(* Address verification for TARGETINFO (RBX) *)

IF ( (DS:RBX is not 512Byte Aligned) or (DS:RBX is not within CR_ELRANGE) )

THEN #GP(0); FI;

IF (DS:RBX does not resolve within an EPC)

THEN #PF(DS:RBX); FI;

IF (EPCM(DS:RBX).VALID = 0)

THEN #PF(DS:RBX); FI;

IF (EPCM(DS:RBX).BLOCKED = 1)

THEN #PF(DS:RBX); FI;

(* Check page parameters for correctness *)

IF ( (EPCM(DS:RBX).PT ≠ PT_REG) or (EPCM(DS:RBX).ENCLAVESECS ≠ CR_ACTIVE_SECS) or (EPCM(DS:RBX).PENDING = 1) or

(EPCM(DS:RBX).MODIFIED = 1) or (EPCM(DS:RBX).ENCLAVEADDRESS ≠ (DS:RBX & ~0FFFH) ) or (EPCM(DS:RBX).R = 0) )

EREPORT-Create a Cryptographic Report of the Enclave

Vol. 3D

41-113

INTEL® SGX INSTRUCTION REFERENCES

THEN #PF(DS:RBX);

FI;

(* Verify RESERVED spaces in TARGETINFO are valid *)

IF (DS:RBX.RESERVED != 0)

THEN #GP(0); FI;

(* Address verification for REPORTDATA (RCX) *)

IF ( (DS:RCX is not 128Byte Aligned) or (DS:RCX is not within CR_ELRANGE) )

THEN #GP(0); FI;

IF (DS:RCX does not resolve within an EPC)

THEN #PF(DS:RCX); FI;

IF (EPCM(DS:RCX).VALID = 0)

THEN #PF(DS:RCX); FI;

IF (EPCM(DS:RCX).BLOCKED = 1)

THEN #PF(DS:RCX); FI;

(* Check page parameters for correctness *)

IF ( (EPCM(DS:RCX).PT ≠ PT_REG) or (EPCM(DS:RCX).ENCLAVESECS ≠ CR_ACTIVE_SECS) or (EPCM(DS:RCX).PENDING = 1) or

(EPCM(DS:RCX).MODIFIED = 1) or (EPCM(DS:RCX).ENCLAVEADDRESS ≠ (DS:RCX & ~0FFFH) ) or (EPCM(DS:RCX).R = 0) )

THEN #PF(DS:RCX);

FI;

(* Address verification for OUTPUTDATA (RDX) *)

IF ( (DS:RDX is not 512Byte Aligned) or (DS:RDX is not within CR_ELRANGE) )

THEN #GP(0); FI;

IF (DS:RDX does not resolve within an EPC)

THEN #PF(DS:RDX); FI;

IF (EPCM(DS:RDX).VALID = 0)

THEN #PF(DS:RDX); FI;

IF (EPCM(DS:RDX).BLOCKED = 1)

THEN #PF(DS:RDX); FI;

(* Check page parameters for correctness *)

IF ( (EPCM(DS:RDX).PT ≠ PT_REG) or (EPCM(DS:RDX).ENCLAVESECS ≠ CR_ACTIVE_SECS) or (EPCM(DS:RCX).PENDING = 1) or

(EPCM(DS:RCX).MODIFIED = 1) or (EPCM(DS:RDX).ENCLAVEADDRESS ≠ (DS:RDX & ~0FFFH) ) or (EPCM(DS:RDX).W = 0) )

THEN #PF(DS:RDX);

FI;

(* REPORT MAC needs to be computed over data which cannot be modified *)

TMP_REPORT.CPUSVN := CR_CPUSVN;

TMP_REPORT.ISVFAMILYID := TMP_CURRENTSECS.ISVFAMILYID;

TMP_REPORT.ISVEXTPRODID := TMP_CURRENTSECS.ISVEXTPRODID;

TMP_REPORT.ISVPRODID := TMP_CURRENTSECS.ISVPRODID;

TMP_REPORT.ISVSVN := TMP_CURRENTSECS.ISVSVN;

TMP_REPORT.ATTRIBUTES := TMP_CURRENTSECS.ATTRIBUTES;

TMP_REPORT.REPORTDATA := DS:RCX[511:0];

TMP_REPORT.MRENCLAVE := TMP_CURRENTSECS.MRENCLAVE;

41-114

Vol.

EREPORT-Create a Cryptographic Report of the Enclave

INTEL® SGX INSTRUCTION REFERENCES

TMP_REPORT.MRSIGNER := TMP_CURRENTSECS.MRSIGNER;

TMP_REPORT.MRRESERVED := 0;

TMP_REPORT.KEYID[255:0] := CR_REPORT_KEYID;

TMP_REPORT.MISCSELECT := TMP_CURRENTSECS.MISCSELECT;

TMP_REPORT.CONFIGID := TMP_CURRENTSECS.CONFIGID;

TMP_REPORT.CONFIGSVN := TMP_CURRENTSECS.CONFIGSVN;

IF (CPUID.12H.01H:EAX[6] = 1)

THEN TMP_REPORT.CET_ATTRIBUTES := TMP_CURRENTSECS.CET_ATTRIBUTES; FI;

(* Derive the report key *)

TMP_KEYDEPENDENCIES.KEYNAME := REPORT_KEY;

TMP_KEYDEPENDENCIES.ISVFAMILYID := 0;

TMP_KEYDEPENDENCIES.ISVEXTPRODID := 0;

TMP_KEYDEPENDENCIES.ISVPRODID := 0;

TMP_KEYDEPENDENCIES.ISVSVN := 0;

TMP_KEYDEPENDENCIES.SGXOWNEREPOCH := CR_SGXOWNEREPOCH;

TMP_KEYDEPENDENCIES.ATTRIBUTES := DS:RBX.ATTRIBUTES;

TMP_KEYDEPENDENCIES.ATTRIBUTESMASK := 0;

TMP_KEYDEPENDENCIES.MRENCLAVE := DS:RBX.MEASUREMENT;

TMP_KEYDEPENDENCIES.MRSIGNER := 0;

TMP_KEYDEPENDENCIES.KEYID := TMP_REPORT.KEYID;

TMP_KEYDEPENDENCIES.SEAL_KEY_FUSES := CR_SEAL_FUSES;

TMP_KEYDEPENDENCIES.CPUSVN := CR_CPUSVN;

TMP_KEYDEPENDENCIES.PADDING := TMP_CURRENTSECS.PADDING;

TMP_KEYDEPENDENCIES.MISCSELECT := DS:RBX.MISCSELECT;

TMP_KEYDEPENDENCIES.MISCMASK := 0;

TMP_KEYDEPENDENCIES.KEYPOLICY := 0;

TMP_KEYDEPENDENCIES.CONFIGID := DS:RBX.CONFIGID;

TMP_KEYDEPENDENCIES.CONFIGSVN := DS:RBX.CONFIGSVN;

IF (CPUID.12H.01H:EAX[6] = 1)

THEN

TMP_KEYDEPENDENCIES.CET_ATTRIBUTES := DS:RBX.CET_ATTRIBUTES;

TMP_KEYDEPENDENCIES.CET_ATTRIBUTES _MASK := 0;

FI;

(* Calculate the derived key*)

TMP_REPORTKEY := derivekey(TMP_KEYDEPENDENCIES);

(* call cryptographic CMAC function, CMAC data are not including MAC&KEYID *)

TMP_REPORT.MAC := cmac(TMP_REPORTKEY, TMP_REPORT[3071:0] );

DS:RDX[3455: 0] := TMP_REPORT;

Flags Affected

None

Protected Mode Exceptions

#GP(0)

If executed outside an enclave.

If the address in RCS is outside the DS segment limit.

If a memory operand is not properly aligned.

If a memory operand is not in the current enclave.

#PF(error code)

If a page fault occurs in accessing memory operands.

EREPORT-Create a Cryptographic Report of the Enclave

Vol. 3D

41-115

INTEL® SGX INSTRUCTION REFERENCES

ERESUME-Re-Enters an Enclave

Opcode/

Op/En

64/32

CPUID

Description

Instruction

bit Mode

Feature

Support

Flag

EAX = 03H

V/V

SGX1

This leaf function is used to re-enter an enclave after an inter-

ENCLU[ERESUME]

rupt.

Instruction Operand Encoding

Op/En

RAX

RBX

RCX

ERESUME (In)

Address of a TCS (In)

Address of AEP (In)

Description

The ENCLU[ERESUME] instruction resumes execution of an enclave that was interrupted due to an exception or

interrupt, using the machine state previously stored in the SSA.

ERESUME Memory Parameter Semantics

TCS

Enclave read/write access

The instruction faults if any of the following occurs:

Address in RBX is not properly aligned.

Any TCS.FLAGS’s must-be-zero bit is not zero.

TCS pointed to by RBX is not valid or available or

Current 32/64 mode does not match the enclave mode in

locked.

SECS.ATTRIBUTES.MODE64.

The SECS is in use by another enclave.

Either of TCS-specified FS and GS segment is not a subset of the current DS

segment.

Any one of DS, ES, CS, SS is not zero.

If XSAVE available, CR4.OSXSAVE = 0, but SECS.ATTRIBUTES.XFRM ≠ 3.

CR4.OSFXSR ≠ 1.

If CR4.OSXSAVE = 1, SECS.ATTRIBUTES.XFRM is not a subset of XCR0.

Offsets 520-535 of the XSAVE area not 0.

The bit vector stored at offset 512 of the XSAVE area must be a subset of

SECS.ATTRIBUTES.XFRM.

The SSA frame is not valid or in use.

If SECS.ATTRIBUTES.AEXNOTIFY ≠ TCS.FLAGS.AEXNOTIFY and

TCS.FLAGS.DBGOPTIN = 0.

The following operations are performed by ERESUME:

• RSP and RBP are saved in the current SSA frame on EENTER and are automatically restored on EEXIT or an

asynchronous exit due to any Interrupt event.