From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1758635AbcEFL4G (ORCPT <rfc822;w@1wt.eu>);
	Fri, 6 May 2016 07:56:06 -0400
Received: from www.linutronix.de ([62.245.132.108]:59042 "EHLO
	Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1758269AbcEFL4E (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Fri, 6 May 2016 07:56:04 -0400
Date: Fri, 6 May 2016 13:54:14 +0200 (CEST)
From: Thomas Gleixner <tglx@linutronix.de>
To: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
cc: "Dr. Greg Wettstein" <greg@enjellic.com>,
        "Austin S. Hemmelgarn" <ahferroin7@gmail.com>,
        Pavel Machek <pavel@ucw.cz>, gregkh@linuxfoundation.org,
        Andy Lutomirski <luto@kernel.org>, Borislav Petkov <bp@suse.de>,
        Boris Ostrovsky <boris.ostrovsky@oracle.com>,
        "open list:STAGING SUBSYSTEM" <devel@driverdev.osuosl.org>,
        Ingo Molnar <mingo@kernel.org>,
        Kristen Carlson Accardi <kristen@linux.intel.com>,
        "open list:DOCUMENTATION" <linux-doc@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>,
        Mathias Krause <minipli@googlemail.com>,
        Wan Zongshun <Vincent.Wan@amd.com>
Subject: Re: [PATCH 0/6] Intel Secure Guard Extensions
In-Reply-To: <20160506113944.GE24074@intel.com>
Message-ID: <alpine.DEB.2.11.1605061353290.3540@nanos>
References: <1461605698-12385-1-git-send-email-jarkko.sakkinen@linux.intel.com> <20160426190009.GC8162@amd> <20160429201744.GD27821@intel.com> <142feb98-3a97-0b00-0b17-b029fa2c637f@gmail.com> <20160503090627.GA27301@wind.enjellic.com>
 <20160506113944.GE24074@intel.com>
User-Agent: Alpine 2.11 (DEB 23 2013-08-11)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
X-Linutronix-Spam-Score: -1.0
X-Linutronix-Spam-Level: -
X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required,  ALL_TRUSTED=-1,SHORTCIRCUIT=-0.0001
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, 6 May 2016, Jarkko Sakkinen wrote:

> On Tue, May 03, 2016 at 04:06:27AM -0500, Dr. Greg Wettstein wrote:
> > It would be helpful and instructive for anyone involved in this debate
> > to review the following URL which details Intel's SGX licening
> > program:
> > 
> > https://software.intel.com/en-us/articles/intel-sgx-product-licensing
> 
> I think it would be good  to note that the licensing process is available
> only for Windows. For Linux you can only use debug enclaves at the
> moment. The default LE has "allow-all" policy for debug enclaves.

Which makes the feature pretty useless.
 
> > I think the only way forward to make all of this palatable is to
> > embrace something similar to what has been done with Secure Boot.  The
> > Root Enclave Key will need to be something which can be reconfigured
> > by the Platform Owner through BIOS/EFI.  That model would take Intel
> > off the hook from a security perspective and establish the notion of
> > platform trust to be a bilateral relationship between a service
> > provider and client.
> 
> This concern has been raised many times now. Sadly this did not make
> into Skyle but in future we will have one shot MSRs (can be set only
> once per boot cycle) for defining your own root of trust.

We'll wait for that to happen.

Thanks,

	tglx