Intel® Software Guard Extensions (Intel® SGX) enclaves cannot run inside a guest Intel® Trust Domain (Intel® TD).
Unable to run an Intel® Software Guard Extensions (Intel® SGX) enclave from a guest Intel® Trust Domain (Intel® TD).
According to the Intel® Trust Domain Extensions (Intel® TDX) Module Base Architecture Specification version 1.5, Chapter 2's Measurement and Attestation section: "Running Intel SGX enclaves within a guest TD is not supported."
However, Intel TDX uses Intel SGX quoting enclaves and certificate infrastructure to perform Trusted Domain attestation, which is described in detail in Chapter 12's Measurement and Attestation section.
The Intel SGX-Based Attestation section states:
"The Intel SGX attestation architecture is designed to provide facilities for multiple Quoting Enclaves from multiple providers. This is intended to allow the host to instantiate a Quoting Enclave for Intel SGX attestations and another Quoting Enclave for TD attestation without interference -- i.e., each provider can supply its own quoting enclave, and the quoting enclave for Intel SGX and for Intel TDX may be separate, the design does not require the quoting enclave to run inside the TD."