Skip to content

EEXIT

Jump to bottom
Henk-Jan Lebbink edited this page Jun 4, 2026 · 4 revisions

INTEL® SGX INSTRUCTION REFERENCES EEXIT — Exits an Enclave

Description CPUID Opcode/ Op/En 64/32 Feature Instruction bit Mode Flag Support EAX = 04H IR V/V SGX1 This leaf function is used to exit an enclave. ENCLU[EEXIT]

Instruction Operand Encoding

Op/En EAX RBX RCX
IR EEXIT (In) Target address outside the enclave (In) Address of the current AEP (Out)

Description

The ENCLU[EEXIT] instruction exits the currently executing enclave and branches to the location specified in RBX. RCX receives the current AEP. If RBX is not within the CS (32-bit mode) or is not canonical (64-bit mode) a #GP(0) results.

EEXIT Memory Parameter Semantics

Target Address
Non-Enclave read and execute access

If RBX specifies an address that is inside the enclave, the instruction will complete normally. The fetch of the next instruction will occur in non-enclave mode, but will attempt to fetch from inside the enclave. This fetch returns a fixed data pattern.

If secrets are contained in any registers, it is responsibility of enclave software to clear those registers.

If XCR0 was modified on enclave entry, it is restored to the value it had at the time of the most recent EENTER or ERESUME.

If the enclave is opt-out, RFLAGS.TF is loaded from the value previously saved on EENTER.

Code and data breakpoints are unsuppressed.

Performance monitoring counters are unsuppressed.

Concurrency Restrictions

Table 41-60. Base Concurrency Restrictions of EEXIT

Leaf Parameter Base Concurrency Restrictions
Access On Conflict
EEXIT Concurrent

Table 41-61. Additional Concurrency Restrictions of EEXIT

Leaf Parameter Additional Concurrency Restrictions
vs. EACCEPT, EACCEPTCOPY, EMODPE, EMODPR, EMODT vs. EADD, EEXTEND, EINIT vs. ETRACK
Access On Conflict Access On Conflict Access On Conflict
EEXIT Concurrent Concurrent Concurrent

41-96 Vol. 3D INTEL® SGX INSTRUCTION REFERENCES

Operation

Temp Variables in EEXIT Operational Flow




	

		Name
		Type
		Size (Bits)
		Description
	

	

		TMP_RIP
		Effective Address
		32/64
		Saved copy of CRIP for use when creating LBR.
	




TMP_MODE64 ← ((IA32_EFER.LMA = 1) && (CS.L = 1));
IF (TMP_MODE64 = 1)
    THEN
        IF (RBX is not canonical) THEN #GP(0); FI;
    ELSE
        IF (RBX > CS limit) THEN #GP(0); FI;
FI;
TMP_RIP ← CRIP;
RIP ← RBX;
(* Return current AEP in RCX *)
RCX ← CR_TCS_PA.AEP;
(* Do the FS/GS swap *)
FS.selector ← CR_SAVE_FS.selector;
FS.base ← CR_SAVE_FS.base;
FS.limit ← CR_SAVE_FS.limit;
FS.access_rights ← CR_SAVE_FS.access_rights;
GS.selector ← CR_SAVE_GS.selector;
GS.base ← CR_SAVE_GS.base;
GS.limit ← CR_SAVE_GS.limit;
GS.access_rights ← CR_SAVE_GS.access_rights;
(* Restore XCR0 if needed *)
IF (CR4.OSXSAVE = 1)
    XCR0 ← CR_SAVE__XCR0;
FI;
Unsuppress_all_code_breakpoints_that_are_outside_ELRANGE;
IF (CR_DBGOPTIN = 0)
    THEN
        UnSuppress_all_code_breakpoints_that_overlap_with_ELRANGE;
        Restore suppressed breakpoint matches;
        RFLAGS.TF ← CR_SAVE_TF;
        UnSuppress_montior_trap_flag;
        UnSuppress_LBR_Generation;
        UnSuppress_performance monitoring_activity;
        Restore performance monitoring counter AnyThread demotion to MyThread in enclave back to AnyThread
FI;
IF RFLAGS.TF = 1
    THEN Pend Single-Step #DB at the end of EEXIT;
FI;
                            Vol. 3D 41-97


INTEL® SGX INSTRUCTION REFERENCES
IF the “monitor trap flag” VM-execution control is set
    THEN pend a MTF VM exit at the end of EEXIT;
FI;
IF (CPUID.12H.01H:EAX[6] = 1)
    THEN
        (* Record PREVSSP *)
        IF (IA32_U_CET.SH_STK_EN == 1)
            THEN CR_TCS_PA.PREVSSP = SSP; FI;
FI;
IF ((CPUID.07H.00H:EDX.CET_IBT = 1) OR (CPUID.07H.00H:ECX.CET_SS = 1)
    THEN
        (* Restore enclosing app’s CET state from the save registers *)
        IA32_U_CET ← CR_SAVE_IA32_U_CET;
IF CPUID.07H.00H:ECX.CET_SS = 1
            THEN SSP ← CR_SAVE_SSP; FI;
        (* Update enclosing app’s TRACKER if enclosing app has indirect branch tracking enabled *)
        IF (CR4.CET = 1 AND IA32_U_CET.ENDBR_EN = 1)
            THEN
                IA32_U_CET.TRACKER ← WAIT_FOR_ENDBRANCH;
                IA32_U_CET.SUPPRESS ← 0
        FI;
FI;
CR_ENCLAVE_MODE ← 0;
CR_TCS_PA.STATE ← INACTIVE;
(* Assure consistent translations *)
Flush_linear_context;


Flags Affected


RFLAGS.TF is restored from the value previously saved in EENTER or ERESUME.


Protected Mode Exceptions


#GP(0)
If executed outside an enclave.
If RBX is outside the CS segment.

#PF(error code)
If a page fault occurs in accessing memory.

64-Bit Mode Exceptions


#GP(0)
If executed outside an enclave.
If RBX is not canonical.

#PF(error code)
If a page fault occurs in accessing memory operands.

41-98 Vol. 3D




Source: Intel® 64 and IA-32 Architectures Software Developer's Manual, Combined Volumes (Order Number 325462-091US, March 2026)
Generated: 7-6-2026


              


          



  
          

            


            
Clone this wiki locally