Intel NUC10 SGX FLC Support

[Andre7]

I have an Intel NUC10i7FNK2 with BIOS version 0066. I wanted to experiment with Intel SGX and DCAP. As I understand it, in order for a CPU to support DCAP, it must be a recent enough model with Flexible Launch Control (FLC) support, as outlined here: https://www.intel.com/content/www/us/en/support/articles/000057420/software/intel-security-products.html 

To my surprise, after enabling SGX in the BIOS and booting a recent Linux kernel (6.1), I saw the following message in the system logs:

 "SGX disabled: SGX launch control CPU feature is not available, /dev/sgx\_enclave disabled."

This suggests that the CPU (or the CPU/motherboard combination) does not have FLC enabled. Running cpuid confirmed this:

# cpuid | grep -i sgx
      SGX: Software Guard Extensions supported = true
      SGX_LC: SGX launch config supported      = false

I looked through the BIOS settings but couldn’t find any option to enable FLC. I was surprised to discover that an older CPU like the i5-8500T supports FLC, while the newer i7-10710U does not.

Is my understanding correct that FLC is not available on the Intel NUC10i7FNK2?

[Scott_R_Intel]

Hello.

Some older client BIOSs used to have a setting named something similar to "SGX Launch Control Policy".  This setting needs to be set to "Unlocked" to enable FLC.  Can you please check your BIOS to see if you have this setting?

Regards.

[Andre7]

Hello Scott,

I couldn't find such an option in the BIOS. Under "Security -> Security Features", where the other SGX-related settings are located, there is nothing resembling "SGX Launch Control Policy." The only available options are:

• Enable/Disable SGX
• Change the SGX Owner EPOCH
• Configure the SGX reserved memory size

These options can be seen in the following image (there are no other options under this sub-menu):