Intel SGX has two drivers for Linux. Here is a chart that should reduce confusion:
Linux Kernel Module Linux Device Comment
=================== ============ ========
intel_sgx.ko /dev/sgx DCAP Driver (also works with IAS)
isgx.so /dev/isgx IAS Driver (not DCAP aware)
- IAS = Intel Attestation Service. The traditional, centralized server performing Intel SGX attestation
- DCAP = Data Center Attestation Primitives. It allows attestation without using the centralized IAS server, although IAS can still be used
- ACC = Microsoft Azure's Azure Confidential Computing. ACC uses the DCAP driver in its Linux VMs, although it can be removed and downgraded to the IAS driver.
Linux currently has not integrated the Intel SGX driver. But you can download the driver (and separately, the Intel SGX SDK) from
https://01.org/intel-software-guard-extensions/downloads
Switching Between Drivers
If you want to switch from one to the other, make sure you run the uninstall.sh script before even thinking of unzipping/untaring the new driver files (or it will be overwritten):
sudo /opt/intel/sgxdriver/uninstall.sh # The path to uninstall.sh may differ for your system.
If the uninstall.sh script is missing, uninstall as follows:
sudo service aesmd stop
sudo rm -f $(find /lib/modules -name intel_sgx.ko)
sudo /sbin/depmod
sudo sed -i '/^intel_sgx$/d' /etc/modules
sudo rm -f /etc/sysconfig/modules/intel_sgx.modules
sudo rm -f /etc/modules-load.d/intel_sgx.conf
AESM
BTW, for Intel SGX you also need a daemon/service running, aesmd:
- use systemctl status aesmd # to see if aesmd is running
- enable with sudo systemctl enable aesmd
Enabling Intel SGX
You can determine if you have Intel SGX (whether or not it is BIOS enabled) with: cpuid |grep SGX: on Linux (you may need to sudo apt install cpuid).
If you get a SGX is not enabled message in /var/log/syslog, enable SGX in the BIOS (F2 or ESC or ....).
