Intel SGX is an intriguing new technology that will ship as part of upcoming Intel processors. It is designed to enable running software in a secure enclave. Code running in the enclave will be isolated by the hardware from untrusted code running on the same processor, so you can execute security-critical code in the enclave and protect it from attack. While SGX is not supported in currently available processors, Intel suggests that it will be available soon. The hope is that this might provide a strong foundation for certain kinds of isolation: developers will be able to run certain code (e.g., crypto key management code) in a secure enclave, with guarantees that other code won't be able to tamper with it.
A model-specific register (MSR) is a special configuration register that controls the operation of the processor. For instance, MSRs can be used to enable branch tracing, performance counters, hardware watchpoints, and other useful special features. Normally, only privileged code can read and write most MSRs.
My question: How does SGX mode interact with MSRs? What do developers of code that runs in SGX mode need to know about MSRs?
The SGX specification doesn't say how SGX mode interacts with MSRs. However, you could imagine that MSRs could potentially pose a risk to code running in an enclave, depending upon how the two interact. For instance, if untrusted code could enable branch tracing (via a MSR) and then trigger invocation of a secure enclave, and if this setting was retained across the mode switch causing all branches taken by the enclave code to be recorded into memory accessible by untrusted code, then this could allow untrusted code to mount powerful side-channel attacks against enclave code.
So, how do the values of the MSR affect execution of code running in an enclave? Are the MSRs ignored when running in enclave mode? Does code designed to run in an enclave need to clear/reset all the MSRs before doing anything sensitive? What do developers of code that'll run in an enclave need to know about how MSRs work in SGX mode, to write secure code and protect their code from attack?