vdso_sgx_enter_enclave_t(9)

🎀 NAME 🎀

okay so bestie, welcome to the vdso_sgx_enter_enclave_t(9) page in the Kernel API Manual — this is literally the prototype for __vdso_sgx_enter_enclave(), the vDSO function that enters an SGX enclave. 🧚✨

---

🌸 SYNOPSIS 🌸

int vdso_sgx_enter_enclave_t (unsigned long rdi , unsigned long rsi , unsigned long rdx , unsigned int function , unsigned long r8 , unsigned long r9 , struct sgx_enclave_run *run );

---

✨ ARGUMENTS ✨

• rdi — pass-through value for RDI 💅
• rsi — pass-through value for RSI
• rdx — pass-through value for RDX
• function — ENCLU function, must be EENTER or ERESUME 👑
• r8 — pass-through value for R8
• r9 — pass-through value for R9
• run — struct sgx_enclave_run, must be non-NULL 🫶

---

💜 NOTE 💜

okay so huge vibe check: __vdso_sgx_enter_enclave does not ensure full compliance with the x86-64 ABI, e.g. it doesn't handle XSAVE state. Except for non-volatile general purpose registers, EFLAGS.DF, and RSP alignment, preserving/setting state in accordance with the x86-64 ABI is the responsibility of the enclave and its runtime. i.e. __vdso_sgx_enter_enclave cannot be called from C code without careful consideration by both the enclave and its runtime. 💀

All general purpose registers except RAX, RBX and RCX are passed as-is to the enclave. RAX, RBX and RCX are consumed by EENTER and ERESUME and are loaded with function, asynchronous exit pointer, and run.tcs respectively. 👑

RBP and the stack are used to anchor __vdso_sgx_enter_enclave to the pre-enclave state, e.g. to retrieve run.exception and run.user_handler after an enclave exit. All other registers are available for use by the enclave and its runtime, e.g. an enclave can push additional data onto the stack (and modify RSP) to pass information to the optional user handler (see below). 🦋

Most exceptions reported on ENCLU, including those that occur within the enclave, are fixed up and reported synchronously instead of being delivered via a standard signal. Debug Exceptions (#DB) and Breakpoints (#BP) are never fixed up and are always delivered via standard signals. On synchronously reported exceptions, -EFAULT is returned and details about the exception are recorded in run.exception, the optional sgx_enclave_exception struct. 😭

---

🦋 RETURN 🦋

the receipts, bestie 💅

• 0: ENCLU function was successfully executed. ✨
• -EINVAL: Invalid ENCL number (neither EENTER nor ERESUME). 🙈

---

🌈 SEE ALSO 🌈

Kernel file ./arch/x86/include/uapi/asm/sgx.h is the hangout spot, and these are the linked besties:

• enum sgx_page_flags(9)
• struct sgx_enclave_create(9)
• struct sgx_enclave_add_pages(9)
• struct sgx_enclave_init(9)
• struct sgx_enclave_provision(9)
• struct sgx_enclave_restrict_permissions(9)
• struct sgx_enclave_modify_types(9)
• struct sgx_enclave_remove_pages(9)
• sgx_enclave_user_handler_t(9)
• struct sgx_enclave_run(9)

---

byeee bestie 🫶 this page comes from source/version ./arch/x86/include/uapi/asm, dated October 2026, and it's vdso_sgx_enter_enclave_t(9) — periodt. 💖