ENCLU

sgx1 = cpuid_leaf(0x12, 0)[0] & 1
if in_smm or not sgx1:
    fault(UD)
if cr0 >> 3 & 1:
    fault(NM)                    # CR0.TS
if CPL < 3:
    fault(UD)                    # CPL 3 alone
fc = msr[IA32_FEATURE_CONTROL]
if not fc & 1 or not fc >> 18 & 1:
    fault(GP, 0)                 # SGX not enabled: lock, bit 18
if not leaf_exists(eax):
    fault(GP, 0)
if not cr0 >> 31 & 1 or not cr0 >> 5 & 1:
    fault(GP, 0)                 # paging off, or CR0.NE clear
entry = eax in (2, 3)            # EENTER, ERESUME
if enclave_mode == entry:
    fault(GP, 0)                 # those enter an enclave from
                                 # outside, the others run inside
leaf_function(eax)               # each with its own checks, and
                                 # flags as its page says
# with CET's indirect branch tracking waiting for an ENDBRANCH, any
# leaf but ERESUME first raises #CP