x86-64.net

Leaf function of ENCLU

EDECCSSA

Decrements the index of the current SSA frame (TCS.CSSA) of the enclave thread, from inside the enclave.

Instruction
ENCLU with EAX = 09H
Leaf CPUID
EDECCSSA
CPUID.(EAX=12H,ECX=0):EAX[11]
Encoding
NP 0F 01 D7
Extensions
Data
Intel XED v2026.08.23

Leaf functions of ENCLU

ENCLU performs the leaf function whose number is in EAX. Only applications (CPL 3) may run ENCLU. Intel's SGX SDK gives all ten numbers, Open Enclave the first eight. Intel's future-extensions reference (319433-062) adds EREPORT2 and EGETKEY256, for 256-bit keys, which the manual does not document yet.

EAXLeaf functionSummaryRequires
00HEREPORTCreates a report of the running enclave that a target enclave on the same platform can verify, for local attestation.SGX1
01HEGETKEYReturns a 128-bit key from the processor's key hierarchy, such as a sealing key, as a KEYREQUEST structure asks.SGX1
02HEENTEREnters an enclave through one of its thread control structures (TCS), at the entry point that the TCS gives.SGX1
03HERESUMERe-enters an enclave that an exception or interrupt left, with the state saved in its SSA frame.SGX1
04HEEXITLeaves the running enclave and continues at the address in RBX, outside it.SGX1
05HEACCEPTLets a running enclave accept a change that system software made to one of its pages with EAUG, EMODT or EMODPR.SGX2
06HEMODPEExtends the access rights of a page of the running enclave, which the enclave may do by itself.SGX2
07HEACCEPTCOPYInitializes a page that EAUG added by copying another page of the enclave into it, and accepts it.SGX2
08HEVERIFYREPORT2Checks, inside an enclave, the MAC of a report that a TDX trust domain created with SEAMREPORT.EVERIFYREPORT2
09HEDECCSSADecrements the index of the current SSA frame (TCS.CSSA) of the enclave thread, from inside the enclave.EDECCSSA

CPUID and processors

EDECCSSA needs what ENCLU needs: the processor must report one of the alternatives of its ISA set, and the EDECCSSA bit, CPUID.(EAX=12H,ECX=0):EAX[11], as well.

CPUID requirements and processors of the XED ISA sets above. Alternatives are separated by “or”; processors follow XED’s chip model, whose AMD processors end with Zen 2, and the CPU data of this site for Zen 3 to Zen 6.
ISA setCPUIDProcessors
SGX

SGX
CPUID.(EAX=07H,ECX=0):EBX[2] SGX

Skylake, Comet Lake, Cannon Lake, Ice Lake (client), Tiger Lake, Skylake-SP, Cascade Lake, Cooper Lake, Ice Lake (server), Sapphire Rapids, Emerald Rapids, Granite Rapids, Diamond Rapids, Goldmont Plus

Sources

  1. Intel XED v2026.08.23 (commit 0bcb6237345c): forms, encodings, ISA sets, CPUID bits and chip model.
  2. Intel SGX SDK 2.25: common/inc/internal/inst.h (ENCLU and ENCLS leaf numbers, BSD license)
  3. Open Enclave SDK: include/openenclave/bits/sgx/sgxtypes.h (ENCLU leaf numbers, MIT license)
  4. Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3 (325384-093, September 2026): Volume 3D, page 41-83 (EDECCSSA)
  5. Intel Architecture Instruction Set Extensions and Future Features Programming Reference (319433-062, June 2026)

The tables are derived from Intel XED, Copyright Intel Corporation, licensed under the Apache License 2.0; x86-64.net converted and reformatted them. The text is our own.