AESM service returned error 30

[pdavis39]

On Ubuntu 24.04 I had SGX working with Gramine v 1.8 with DCAP

We then added TDX and it works

However when we run SGX we now get this error

sudo -E gramine-sgx python
Gramine is starting. Parsing TOML manifest file, this may take some time...
error: AESM service returned error 30; this may indicate that infrastructure for the DCAP attestation requested by Gramine is missing on this machine
error: load_enclave() failed with error: Operation not permitted (EPERM)

Any thoughts on how to get both TDX and SGX running on the same server

Thanks in advance for your help

Paul

[kailun-qin]

AESM error 30 indicates AESM_SERVICE_UNAVAILABLE.

Have you installed all the required SGX AESM packages? Additionally, are you running Gramine directly on bare metal, or is it through Docker or another special setup?

[pdavis39]

This version is bare metal.

Before we turned on TDX the SGX app worked fine.

Question can the TDX guest host and SGX run at the same time

[kailun-qin]

Question can the TDX guest host and SGX run at the same time

If you mean running both guest TD VMs and SGX on the same bare metal, then yes; if you mean running SGX inside a guest TD VM, then no.

[pdavis39]

SGX Gramine app is running on bare metal and TDX runs in the guest host. It should work. My issue is trouble shooting the AESM 30 error. My hunch is somehow I am pointing to the wrong SGX driver while TDX sees the correct driver.

[woju]

There should be additional info in aesmd's log (journalctl -u aesmd.service). Please paste the log with the error esp. the 4-hex-digit 0xXXXX error number.

[pdavis39]

This hex is below with the error message

[error_driver2api sgx_enclave_common.cpp:280] Enclave not >
[load_qe ../qe_logic.cpp:721] Error, call sgx_create_encla>
Failed to load QE3: 0x4004

[woju]

@pdavis39: The answer to your question is inside the error message cut by systemctl status. I purposefully asked you for the listing from journalctl -u, because it most likely says:

[error_driver2api sgx_enclave_common.cpp:280] Enclave not authorized to run, .e.g. provisioning enclave hosted in app without access rights to /dev/sgx_provision. You need add the user id to group sgx_prv or run t
he app as root.
[load_qe ../qe_logic.cpp:721] Error, call sgx_create_enclave QE fail [load_qe], SGXError:4004.
Failed to load QE3: 0x4004

There's a problem with provisioning your machine, which is outside of the scope of Gramine project. Please consult Intel's documentation about SGX provisioning (either get PCCS running or follow this manual for offline provisioning: https://cc-enabling.trustedservices.intel.com/intel-tdx-enabling-guide/02/infrastructure_setup/#on-offline-manual-multi-platform-local-cache-based-indirect-registration).