encls

Execute Enclave Supervisor Leaf

ENCLS

Executes an SGX supervisor function specified by EAX.

Details

Executes an SGX supervisor enclave leaf function specified by a leaf number in EAX. The instruction serializes the CPU pipeline and transitions from non-root mode to root mode for executing privileged enclave operations. The actual operation depends on the leaf function code; CF flag may be set on error conditions, and various other registers may be modified based on the leaf function.

Pseudocode Operation

leaf_function = EAX
if (leaf_function == EBLOCK) then
  // Block enclave
elseif (leaf_function == ETRACK) then
  // Flush TLB
elseif (leaf_function == EWBLOCK) then
  // Write block enclave
else
  // Execute other supervisor leaf functions
end if

Example

ENCLS

Encoding

Binary Layout

Format Legacy

Opcode NP 0F 01 CF

Extension SGX

Operands

Reference (Intel® SDM)

Instruction Forms

Opcode	Instruction	Op/En	64/32-bit Mode	CPUID	Description
NP 0F 01 CF	ENCLS	ZO	V/V	NA	This instruction is used to execute privileged Intel SGX leaf functions that are used for managing and debugging the enclaves.

Description

The ENCLS instruction invokes the specified privileged Intel SGX leaf function for managing and debugging enclaves. Software specifies the leaf function by setting the appropriate value in the register EAX as input. The registers RBX, RCX, and RDX have leaf-specific purpose, and may act as input, as output, or may be unused. In 64bit mode, the instruction ignores upper 32 bits of the RAX register. The ENCLS instruction produces an invalid-opcode exception (#UD) if CR0.PE = 0 or RFLAGS.VM = 1, or if it is executed in system-management mode (SMM). Additionally, any attempt to execute the instruction when CPL > 0 results in #UD. The instruction produces a general-protection exception (#GP) if CR0.PG = 0 or if an attempt is made to invoke an undefined leaf function. In VMX non-root operation, execution of ENCLS may cause a VM exit if the “enable ENCLS exiting” VM-execution control is 1. In this case, execution of individual leaf functions of ENCLS is governed by the ENCLS-exiting bitmap field in the VMCS. Each bit in that field corresponds to the index of an ENCLS leaf function (as provided in EAX). Software in VMX root operation can thus intercept the invocation of various ENCLS leaf functions in VMX non-root operation by setting the “enable ENCLS exiting” VM-execution control and setting the corresponding bits in the ENCLS-exiting bitmap. Addresses and operands are 32 bits outside 64-bit mode (IA32_EFER.LMA = 0 || CS.L = 0) and are 64 bits in 64bit mode (IA32_EFER.LMA = 1 || CS.L = 1). CS.D value has no impact on address calculation. The DS segment is used to create linear addresses. Segment override prefixes and address-size override prefixes are ignored, as is the REX prefix in 64-bit mode.

Operation

IF TSX_ACTIVE
THEN GOTO TSX_ABORT_PROCESSING; FI;

IF CR0.PE = 0 or RFLAGS.VM = 1 or in SMM or CPUID.12H.00H:EAX.SGX1 = 0
THEN #UD; FI;

IF (CPL > 0)
THEN #UD; FI;

IF in VMX non-root operation and the “enable ENCLS exiting“ VM-execution control is 1
THEN
IF EAX < 63 and ENCLS_exiting_bitmap[EAX] = 1 or EAX> 62 and ENCLS_exiting_bitmap[63] = 1
THEN VM exit;
FI;
FI;
IF IA32_FEATURE_CONTROL.LOCK = 0 or IA32_FEATURE_CONTROL.SGX_ENABLE = 0
THEN #GP(0); FI;

IF (EAX is an invalid leaf number)
THEN #GP(0); FI;





IF CR0.PG = 0
THEN #GP(0); FI;

(* DS must not be an expanded down segment *)
IF not in 64-bit mode and DS.Type is expand-down data
THEN #GP(0); FI;

Jump to leaf specific flow

Flags Affected

See individual leaf functions

Exceptions

Protected Mode Exceptions

#UD If any of the LOCK/66H/REP/VEX prefixes are used. If current privilege level is not 0. If CPUID.12H.00H:EAX.SGX1[0] = 0. If logical processor is in SMM. #GP(0) If IA32_FEATURE_CONTROL.LOCK = 0. If IA32_FEATURE_CONTROL.SGX_ENABLE = 0. If input value in EAX encodes an unsupported leaf. If data segment expand down. If CR0.PG=0.

Real-Address Mode Exceptions

#UD ENCLS is not recognized in real mode.

Virtual-8086 Mode Exceptions

#UD ENCLS is not recognized in virtual-8086 mode.

Compatibility Mode Exceptions

Same exceptions as in protected mode.