Intel SGX with i5-6300U processor

[JWong19]

CPUID[07H][EBX][bit 2] reveals that SGX feature is unavailable with the i5-6300U processor I am using, but the specification <http://ark.intel.com/products/88190/Intel-Core-i5-6300U-Processor-3M-Cache-up-to-3_00-GHz> indicates that Intel SGX is available with the processor.

Should I install the evaluation SDK first? I am with Windows 10 Pro now.

CPUID dump

     EAX ECX      EAX      EBX      ECX      EDX
       0   0       15 756e6547 6c65746e 49656e69
       1   0    406e3  1100800 fed87383 bfcbfbff
       4   0 1c004121  1c0003f       3f        0
       4   1 1c004122  1c0003f       3f        0
       4   2 1c004143   c0003f      3ff        0
       4   3 1c03c163  2c0003f      fff        2
       4   4        0        0        0        0
       5   0        0        0        0        0
       6   0      7f3        2        9        0
       7   0        0   1c2bbb        0        0
       9   0        0        0        0        0
       a   0        0        0        0        0
       b   0        1        2      100        1
       b   1        4        4      201        1
       b   2        0        0        2        1
       c   0        0        0        0        0
       d   0        7      340      340        0
       d   1        1        0        0        0
       d   2      100      240        0        0
       f   0        0        0        0        0
       f   1        0        0        0        0
      10   0        0        0        0        0
      10   1        0        0        0        0
      14   0        0        0        0        0
      14   1        0        0        0        0
      15   0        2       d0        0        0
80000000   0 80000008        0        0        0
80000001   0        0        0      121 28100800
80000002   0 65746e49 2952286c 726f4320 4d542865
80000003   0 35692029 3033362d 43205530 40205550
80000004   0 342e3220 7a484730        0        0
80000006   0        0        0  1006040        0
80000007   0        0        0        0      100
80000008   0     3027        0        0        0

[Scott_R_Intel]

Hi Jeremy.

Here's an answer quoted from a previously asked similar question:

"Intel® Software Guard Extensions (Intel® SGX) is introduced with all Skylake processors (which includes the i7-6567U). However, it must be noted that at the system-level it relies on OEM/ODM enabling as well as software that takes advantage of it."

This means, you not only need a CPU that supports SGX, but also a platform/BIOS that has been SGX enabled.

Regards.

Scott

[JWong19]

Hi Scott,

I am uncertain the exact cause of unexpected value (clear bit) in the SGX feature bit with CPUID in my case.

Could you elaborate a little bit more the symptom(s) of OEM/ODM enabling/disabling? Does the software refer to the "Intel SGX evaluation SDK" as at this writing? How can one determine if a platform/BIOS has enabled/disabled SGX?

Regards,

Jeremy

[Simon_J_Intel · Accepted solution]

Please visit you platform manufacturer's website and see if they have a BIOS update for your platform.

[JWong19]

Thanks Simon. The SGX feature bit (CPUID.07H.EBX.SGX[bit 2]) changed from 0 to 1 after applying December firmware update of Microsoft.

     EAX ECX      EAX      EBX      ECX      EDX
       0   0       15 756e6547 6c65746e 49656e69
       1   0    406e3  1100800 fed87383 bfcbfbff
       4   0 1c004121  1c0003f       3f        0
       4   1 1c004122  1c0003f       3f        0
       4   2 1c004143   c0003f      3ff        0
       4   3 1c03c163  2c0003f      fff        2
       4   4        0        0        0        0
       5   0        0        0        0        0
       6   0      7f3        2        9        0
       7   0        0   1c2bbf        0        0
       9   0        0        0        0        0
       a   0        0        0        0        0
       b   0        1        2      100        1
       b   1        4        4      201        1
       b   2        0        0        2        1
       c   0        0        0        0        0
       d   0        7      340      340        0
       d   1        1        0        0        0
       d   2      100      240        0        0
       d   3        0        0        0        0
       d   4        0        0        0        0
       f   0        0        0        0        0
       f   1        0        0        0        0
      10   0        0        0        0        0
      10   1        0        0        0        0
      14   0        0        0        0        0
      14   1        0        0        0        0
      15   0        2       d0        0        0
80000000   0 80000008        0        0        0
80000001   0        0        0      121 28100800
80000002   0 65746e49 2952286c 726f4320 4d542865
80000003   0 35692029 3033362d 43205530 40205550
80000004   0 342e3220 7a484730        0        0
80000006   0        0        0  1006040        0
80000007   0        0        0        0      100
80000008   0     3027        0        0        0
 

[Fredrik_T_]

Jeremy, is it a Microsoft Surface you are using?

[JWong19]

Fredrik,

Microsoft Surface Pro 4 (freeze, flicker, features missing......). How come you make such a good guess?

[Fredrik_T_]

Am I detecting any irony there? :)

Firmware update by Microsoft -> the only computers Microsoft provides are the surface models, right?

[Simon_J_Intel]

So what you have achieved is fixing the processor support for SGX. My internal sources tell me that Surface Pro 4 did not enable SGX in their BIOS (i.e. reserve the memory for SGX use). You will need to confirm this with MSFT.

[JWong19]

Simon, thank you for the further reply. My next question is existing zero result of CPUID.0CH (both sgx1 and sgx2 are zero, but Skylake should support sgx1). I can save it now. I'll try to obtain confirmation from Microsoft Surface support...

Fredrik, I am not aware that Surface is the only computer sold by Microsoft. Thanks for teaching.

[Simon_J_Intel]

I think you meant to say CPUID.12H not CPUID.0CH

Section 37.7.2 of the Software Developer Manual states "A properly configured processor exposes Intel SGX functionality with CPUID.EAX=12H reporting valid information (non-zero content) in three or more sub-leaves, see Table 37-4."

What this means is that once the BIOS has completed the necessary configuration this CPUID leaf is available. All zeros returned in EAX means that your BIOS is probably not configured to support SGX.