EUPDATESVN

INTEL® SGX INSTRUCTION REFERENCES EUPDATESVN — Update CR_CPUSVN

Opcode/ Instruction	Op/En	64/32 bit Mode Support	CPUID Feature Flag	Description
EAX = 18H ENCLS[EUPDATESVN]	None	V/V	Bit 10	This leaf function updates the CR_CPUSVN if microcode has been updated and EPC is ready.

Description

If EPC is ready for SVN update, this leaf function updates CR_CPUSVN to the currently loaded microcode update SVN and generates new cryptographic assets. The EPC is ready when no page in the EPC is valid. EREMOVE should be used to mark all pages as unused.

It is the responsibility of system software to ensure that no other thread is executing or attempts to execute any ENCLS leaf while executing EUPDATESVN. Concurrency violations between EUPDATESVN and some ENCLS leaves may cause the ENCLS leaf to generate #GP(0) in ways unexpected to legacy software. System software should also prevent unnecessary software from having access to EUPDATESVN. For example, enable ENCLS exiting should be used to prevent VMs that are not part of the management system software from using EUPDATESVN.

The EUPDATESVN leaf function fails if an ENCLS instruction is in progress on any thread, the EPC is not ready for an update, or there is insufficient entropy in the random number generator. The ZF flag will be set to indicate an error and a code returned in RAX. If EUPDATESVN was successful but CR_CPUSVN was already up to date, the CF flag will be set and RAX will indicate that no update occurred.

If insufficient entropy causes a failure, software should repeat the instruction.

The error codes are:

Table 41-44. EUPDATESVN Return Value in RAX

Error Code (see Table 41-3)	Value	Description
No Error	0	EUPDATESVN successful.
SGX_EPC_PAGE_CONFLICT	7	An instruction concurrency rule was violated.
SGX_INSUFFICIENT_ENTROPY	29	RNG contains insufficient entropy.
SGX_EPC_NOT_READY	30	EPC is not ready for SVN update.
SGX_NO_UPDATE	31	EUPDATESVN was successful, but CR_CPUSVN was not updated because the current SVN is older than CR_CPUSVN.

Concurrency Restrictions

Table 41-45. Base Concurrency Restrictions of EUPDATESVN

Leaf	Base Concurrency Restrictions
	Access	On Conflict
EUPDATESVN	Exclusive	SGX_EPC_PAGE_CONFLICT

Table 41-46. Additional Concurrency Restrictions of EUPDATESVN

Leaf	Additional Concurrency Restrictions
	vs. EADD, EAUG, ECREATE, ELDB, EPA, EREMOVE, EWB
	Access	On Conflict
EUPDATESVN	Exclusive	SGX_EPC_PAGE_CONFLICT

Vol. 3D 41-67 INTEL® SGX INSTRUCTION REFERENCES

Operation

Temp Variables in EUPDATESVN Operational Flow

Name	Type	Size (Bytes)	Description
TMP_CPUSVN	CPUSVN	16	Temporary copy of CR_CPUSVN prior to update.
TMP_KEY	Key	16	Temporary copy of new paging key.

RFLAGS.ZF,CF,PF,AF,OF,SF ← 0;
RAX ← 0;
IF (Other logical processor is executing an SGX instruction that accesses EPC) THEN
    RFLAGS.ZF ← 1
    RAX ← SGX_EPC_PAGE_CONFLICT;
    GOTO ERROR_EXIT;
FI
(* Verify EPC is ready *)
IF (the EPC contains any valid pages) THEN
    RFLAGS.ZF ← 1;
    RAX ← SGX_EPC_NOT_READY;
    GOTO ERROR_EXIT;
FI
(* Refresh paging key *)
TMP_KEY = (* Generate a 128-bit cryptographically random number *)
IF (insufficient entropy available) THEN
    RFLAGS.ZF ← 1;
    RAX ← SGX_INSUFFICIENT_ENTROPY;
    GOTO ERROR_EXIT;
FI
(* Commit *)
TMP_CPUSVN ← CR_CPUSVN;
(* Update CR_CPUSVN to reflect current microcode update SVN *)
(* Determine if info status is needed *)
IF (TMP_CPUSVN = CR_CPUSVN) THEN
    RFLAGS.CF ← 1;
    RAX ← SGX_NO_UPDATE;
ELSE
        CR_BASE_PK ← TMP_KEY[127:0];
FI
ERROR_EXIT:

Flags Affected

ZF is set if an error occurs; otherwise, cleared.

CF is set when the instruction is completed successfully and no SVN update was needed.

PF, AF, OF, and SF are cleared.

41-68 Vol. 3D

---

Source: Intel® 64 and IA-32 Architectures Software Developer's Manual, Combined Volumes (Order Number 325462-091US, March 2026)
Generated: 7-6-2026