Intel® Software Guard Extensions - Software Installation Guide for Linux* OS
5
1. In-kernel Driver (/dev/{sgx_enclave, sgx_provision}): Mainline kernel release 5.11 or higher
includes the SGX In-Kernel driver. The In-Kernel Driver requires the platform to support and to
be configured for Flexible Launch Control.
2. DCAP Driver (/dev/{sgx_enclave, sgx_provision}): The goal of the DCAP driver is to provide an
interface close to the In-kernel Driver in order to provide Intel® SGX support to Linux OSs that do
not have the Intel® SGX driver built into the kernel. This driver also requires the platform to
support and to be configured for Flexible Launch Control. Since this driver supports an out-of-
tree implementation, it does not include new features supported by later kernel releases such
as EDMM, SGX KVM, SGX cgroups, and NUMA aware EPC allocation. This driver is only updated
for necessary security fixes. The in-kernel driver should be used whenever it is possible.
3. Out-of-tree Driver (/dev/isgx): This driver is provided to support running Intel® SGX enclaves on
platforms that only support Legacy Launch Control. It may also be installed on platforms
configured with Flexible Launch Control; however, then these platforms will only load enclaves
that conform to the Legacy Launch Control Policy.
The process of selection and installation of each driver is covered in the following sections.
In-Kernel Driver Module Installation
The In-kernel driver is provided with Linux* kernel beginning with the version 5.11. Developers and
platform owners can install the 5.11 (or higher) kernel binaries provided by their Linux distribution or
build the kernel from source code following the steps described in
https://wiki.ubuntu.com/KernelTeam/GitKernelBuild. SGX option CONFIG_X86_SGX must be enabled in
the make menuconfig step, otherwise the SGX module cannot be built. Other SGX configuration
options such as CONFIG_X86_SGX_KVM might be enabled depending on the user needs. Earlier versions
of the kernel can be adapted with a patch. The latest Intel-SGX Patch to the kernel can be obtained at
https://patchwork.kernel.org/project/intel-sgx/list/. This document does not cover the process of
patching and building a kernel.
DCAP Driver Installation
The DCAP Driver is the recommended driver to use on the Linux kernel version between 4.15 and 5.6
inclusive and on platforms that support and are configured for Flexible Launch Control. Installing DCAP
driver on kernel 5.11 or higher with SGX In-Kernel driver gives the build error message, “Can't install DCAP
SGX driver with in-kernel SGX support”.
Prerequisites
Since the DCAP Driver is built from the driver package, install the required components that support the
Intel® SGX PSW installation. The following procedure is used to install the required components on each
Linux distribution.
Note: This following command lines contain modules that are needed in components described in
subsequent sections of this document
