39-14 Vol. 3D

ENCLAVE OPERATION

RDTSC and RDTSCP are legal inside an enclave for processors that support SGX2 (subject to the value of CR4.TSD). 
For processors which support SGX1 but not SGX2, RDTSC and RDTSCP will cause #UD.
RDTSC and RDTSCP instructions may cause a VM exit when inside an enclave.
Software developers must take into account that the RDTSC/RDTSCP results are not immune to influences by other 
software, e.g. the TSC can be manipulated by software outside the enclave.

NOTE

Some early processor implementation of Intel SGX will generate a #UD when RDTSC and RDTSCP 
are executed inside an enclave. See the model-specific processor errata for details of which 
processors treat execution of RDTSC and RDTSCP inside an enclave as illegal.

39.6.2 

RDRAND and RDSEED Instructions

These instructions may cause a VM exit if the “RDRAND exiting” VM-execution control is 1. Unlike other instructions 
that can cause VM exits, these instructions are legal inside an enclave. As noted in Section 6.5.5, any VM exit orig-
inating on an instruction boundary inside an enclave sets bit 27 of the exit-reason field of the VMCS. If a VMM 
receives a VM exit due to an attempt to execute either of these instructions determines (by that bit) that the execu-
tion was inside an enclave, it can do either of two things. It can clear the “RDRAND exiting” VM-execution control 
and execute VMRESUME; this will result in the enclave executing RDRAND or RDSEED again, and this time a VM exit 
will not occur. Alternatively, the VMM might choose to discontinue execution of this virtual machine.

NOTE

It is expected that VMMs that virtualize Intel SGX will not set “RDRAND exiting” to 1.

39.6.3 PAUSE 

Instruction

The PAUSE instruction may cause a VM exit if either of the “PAUSE exiting” and “PAUSE-loop exiting” VM-execution 
controls is 1. Unlike other instructions that can cause VM exits, the PAUSE instruction is legal inside an enclave.
If a VMM receives a VM exit due to the 1-setting of “PAUSE-loop exiting”, it may take action to prevent recurrence 
of the PAUSE loop (e.g., by scheduling another virtual CPU of this virtual machine) and then execute VMRESUME; 
this will result in the enclave executing PAUSE again, but this time the PAUSE loop (and resulting VM exit) will not 
occur.
If a VMM receives a VM exit due to the 1-setting of “PAUSE exiting”, it can do either of two things. It can clear the 
“PAUSE exiting” VM-execution control and execute VMRESUME; this will result in the enclave executing PAUSE 
again, but this time a VM exit will not occur. Alternatively, the VMM might choose to discontinue execution of this 
virtual machine.

NOTE

It is expected that VMMs that virtualize Intel SGX will not set “PAUSE exiting” to 1.

39.6.4 

INT 3 Behavior Inside an Enclave

INT3 is legal inside an enclave, however, the behavior inside an enclave is different from its behavior outside an 
enclave. See Section 43.4.1 for details.

39.6.5 

INVD Handling when Enclaves Are Enabled

Once processor reserved memory protections are activated (see Section 39.5), any execution of INVD will result in 
a #GP(0).