Integrating Intel Silicon Security Engine Interface (ISSEI) in Linux: A Developer's Guide

By • min read

Overview

Since the introduction of Intel Meteor Lake, the Intel Silicon Security Engine (SSE) has served as a silicon root-of-trust (RoT), managing secure firmware loading, boot measurements, and other critical security operations. This engine is further refined in Lunar Lake and Panther Lake platforms, and its role is set to expand in future Intel hardware. The Intel Silicon Security Engine Interface (ISSEI) is a Linux driver that exposes this RoT functionality to the operating system, enabling developers to integrate hardware-backed security into their applications. This guide provides a comprehensive walkthrough for configuring, compiling, and using the ISSEI driver in a Linux environment.

Prerequisites

Before you begin, ensure your system meets the following requirements:

• Hardware: An Intel platform with the Silicon Security Engine (Meteor Lake or later, including Lunar Lake and Panther Lake). Verify via lspci | grep -i 'security' that the SSE device is present.
• Software: A Linux kernel version that includes the ISSEI driver (or patches to add it). This guide assumes kernel 6.12 or later. You will need the kernel source code and build tools installed (build-essentials, ncurses-dev, flex, bison).
• Access: Root privileges to load kernel modules and modify kernel configuration.
• Knowledge: Familiarity with compiling a custom Linux kernel or kernel modules.

Step-by-Step Instructions

1. Configuring the Kernel for ISSEI

The ISSEI driver is usually built as a module (CONFIG_INTEL_ISSEI=m) or compiled into the kernel (=y). Start by obtaining the kernel source:

git clone https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
cd linux
git checkout v6.12  # or a later release

Configure the kernel:

make menuconfig

Navigate to Device Drivers → Intel Silicon Security Engine Interface and set it to M (module) or Y (built-in). Save and exit. Alternatively, you can edit .config directly:

echo 'CONFIG_INTEL_ISSEI=m' >> .config
echo 'CONFIG_INTEL_ISSEI_DEBUG=n' >> .config  # optional
make olddefconfig

2. Compiling and Installing the ISSEI Driver

Compile the kernel and modules (or just the ISSEI module):

make -j$(nproc) modules_prepare
make M=drivers/platform/x86/intel/issei   # adjust path as per kernel tree

If you built the full kernel, install:

sudo make modules_install
sudo make install

For modular builds, copy the module:

sudo cp drivers/platform/x86/intel/issei/intel_issei.ko /lib/modules/$(uname -r)/kernel/drivers/platform/x86/intel/issei/
sudo depmod -a

3. Loading the Module and Verifying Functionality

Load the ISSEI module:

sudo modprobe intel_issei

Check dmesg for initialization messages:

dmesg | grep -i issei

Expected output includes something like:

intel_issei: Intel Silicon Security Engine Interface loaded
intel_issei 0000:00:1f.5: Device initialized, version 1.0

Verify the device appears in sysfs:

ls /sys/bus/pci/drivers/intel_issei/

If the driver is bound to a PCI device, you'll see a directory like 0000:00:1f.5.

4. Interacting with the ISSEI

The ISSEI driver exposes an interface via /dev/issei character device (major 10, minor assigned dynamically) and sysfs attributes. Use ioctl commands to access root-of-trust functions:

• ISSEI_IOCTL_GET_VERSION – retrieve driver and firmware version.
• ISSEI_IOCTL_MEASURE_BOOT – request boot measurement data.
• ISSEI_IOCTL_VERIFY – verify a firmware image against the RoT.

Example C code snippet to open device and get version:

#include <stdio.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#define ISSEI_IOCTL_GET_VERSION _IOR('I', 0x01, int)

int main() {
    int fd = open("/dev/issei", O_RDWR);
    if (fd < 0) { perror("open"); return 1; }
    int version;
    if (ioctl(fd, ISSEI_IOCTL_GET_VERSION, &version) == 0)
        printf("ISSEI version: %d\n", version);
    close(fd);
    return 0;
}

Compile with gcc -o issei_test issei_test.c and run with sudo ./issei_test.

Common Mistakes and Troubleshooting

Module fails to load: 'Unknown symbol' errors

Ensure your kernel version matches the module's API. Rebuild the module against the running kernel's source. Use modinfo intel_issei to check dependencies.

Device not found in lspci

The SSE may not be enabled in BIOS/UEFI. Reboot, enter firmware settings, and enable 'Intel Silicon Security Engine' or 'Platform Trust Technology' (PTT). Some platforms also require SGX to be active.

/dev/issei not created

The driver creates the device node only if the hardware is detected and the module loads successfully. Check dmesg for errors like intel_issei: probe of 0000:00:1f.5 failed with error -ENODEV. This can indicate missing ACPI tables or incompatible firmware version.

IOCTL calls return -EINVAL

Verify the ioctl command constants are correct. Some kernel versions may use different numbers. Check the driver header in include/uapi/linux/issei.h.

Summary

This guide covered the steps to enable and use the Intel Silicon Security Engine Interface (ISSEI) driver on recent Intel platforms. By integrating the silicon root-of-trust into Linux, developers can leverage hardware-accelerated boot measurement and firmware verification. With proper configuration and module loading, the ISSEI provides a robust foundation for system security.