Enabling SGX in BIOS for Lenovo S510

[Zigdass]

Hello,

I want to test Intel SGX on my newly acquired Lenovo tower S510 10L3-000JFM with Intel Core i7-6700 CPU.

I checked via a tool found in https://github.com/ayeks/SGX-hardware that this CPU supports Intel SGX but it is not enabled in BIOS.

My BIOS last update date is 01/09/2016 and the CPU microcode last updated on 07/01/2016.

On my OEM site, there is a new update release for the BIOS https://pcsupport.lenovo.com/ae/en/products/desktops-and-all-in-ones/lenovo-s-series-all-in-ones/s510-desktop/10kw/downloads/ds112505.

My question is: is this update support Intel SGX? or Not?

I do not want to proceed to this risky updating operation before being sure.

Any help is welcome.

Thanks

[Hoang_N_Intel]

In general, you need to redirect this type of questions to specific OEMs in this case, Lenovo for details in each BIOS release. A standard assumption that I would make is that if the OEM releases a new BIOS version for a platform supporting enabled SGX, it should maintain the same support in the new release. To be certain, you should check with Lenovo.

[Zigdass]

Thank you Hoang Nguyen for your prompt reply.

Can I understand that when an OEM releases a new BIOS version for a platform not supporting SGX, it also does not support SGX in the new release?

For Lenovo, I have already posted a question in their forums but did not receive any reply, so far.

[Hoang_N_Intel]

I believe that statement is true. The new BIOS version will not add SGX support. The better option is to switch to M710t/s products with SGX support.

[Zigdass]

This is really disappointing. I do not understand why OEMs do not provide necessary support for Intel CPU capabilities as powerful as SGX?

[Zigdass]

Dear Hoang Nguyen,

I return back to tell you that according to a Lenovo BIOS engineer, BIOS does not support Intel SGX for my computer model and does not have a plan for the future. So, may be I can only test programs in simulation mode? May be this is not a reliable solution as it is not guaranteed to work in "real" mode.