topic We have written a blog on in Intel® Software Guard Extensions (Intel® SGX)

SGX_ERROR_SERVICE_INVALID_PRIVILEDGE How to prepare a SGX project for release version?

Sijie_D_ — Wed, 06 Jan 2016 18:15:06 GMT

Hi, Intel engineers!

I just got a machine with Intel Core i7-6820HQ CPU which support SGX.

I already get my development environment prepared. And right now I'm playing around with the SGX SDK.

The sample codes shipped with the SDK work well under Debug mood, simulation mood as well as prerelease mood on my machine. While, under the release mood, the default configuration doesn’t create a signed enclave file. So, I created a signed enclave file following the instruction on the SDK user’s guide (using two step signing method).

When I execute the release version enclave application, I get this error:

The return value of the API:

sgx_create_enclave is 0x4004, which corresponds to SGX_ERROR_SERVICE_INVALID_PRIVILEDGE.

So, my real question is: what does this error mean and how should I solve it?

Is there any other operations that must be done to make the release version application work?

The SGX SDK provided is an

Derek_B_Intel — Thu, 07 Jan 2016 15:11:06 GMT

The SGX SDK provided is an Evaluation SDK intended for technology evaluation, prototyping and development. Release mode enclaves, or production enclaves, require a production license.

So, what is the current SGX

Sijie_D_ — Sat, 09 Jan 2016 18:19:44 GMT

So, what is the current SGX licensing mechanism for academic research? And How can we request such a license?

In addition, is there any additional intel documents other than the online User Guide and writers Guide that can provide more detailed information about how to prepare an application and enclave for release?

We have written a blog on

Simon_J_Intel — Sat, 09 Jan 2016 22:58:23 GMT

We have written a blog on differences between debug and production enclaves, and the different compiler profiles. You should be able to go a long using the Evaluation SDK.

See https://software.intel.com/en-us/blogs/2016/01/07/intel-sgx-debug-production-prelease-whats-the-difference

Requests for production licensing need to be sent to sgx_program@intel.com

Hi Simon,

sai_s_ — Sun, 13 Mar 2016 10:09:00 GMT

Hi Simon,

Is the error 0x4004 SGX_ERROR_SERVICE_INVALID_PRIVILEDGE due to not having a license? Or is it related to something unrelated to the license?

I am running an SGX program using simulation libraries (by setting them in Linker>input>additional dependencies), the program runs fine. But when I use the HW configuration, the enclave is not created due to 0x4004 error mentioned in the post.

I also would like to mention that I don't meant to hijack the post but I posted here because the it was not answered whether the error 0x4004 is due to not having license.

This error is received when

Derek_B_Intel — Tue, 15 Mar 2016 16:10:15 GMT

This error is received when an enclave is launched as a production enclave without production licensing support. You can launch your enclave in HW mode when the debug flag is set in the call: sgx_create_enclave. (2nd parameter)