From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1758448AbcEFLjx (ORCPT <rfc822;w@1wt.eu>);
	Fri, 6 May 2016 07:39:53 -0400
Received: from mga14.intel.com ([192.55.52.115]:52148 "EHLO mga14.intel.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1757430AbcEFLjv (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Fri, 6 May 2016 07:39:51 -0400
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.24,587,1455004800"; 
   d="scan'208";a="973983128"
Date: Fri, 6 May 2016 14:39:44 +0300
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: "Dr. Greg Wettstein" <greg@enjellic.com>
Cc: "Austin S. Hemmelgarn" <ahferroin7@gmail.com>, Pavel Machek <pavel@ucw.cz>,
        gregkh@linuxfoundation.org, Andy Lutomirski <luto@kernel.org>,
        Borislav Petkov <bp@suse.de>,
        Boris Ostrovsky <boris.ostrovsky@oracle.com>,
        "open list:STAGING SUBSYSTEM" <devel@driverdev.osuosl.org>,
        Ingo Molnar <mingo@kernel.org>,
        Kristen Carlson Accardi <kristen@linux.intel.com>,
        "open list:DOCUMENTATION" <linux-doc@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>,
        Mathias Krause <minipli@googlemail.com>,
        Thomas Gleixner <tglx@linutronix.de>,
        Wan Zongshun <Vincent.Wan@amd.com>
Subject: Re: [PATCH 0/6] Intel Secure Guard Extensions
Message-ID: <20160506113944.GE24074@intel.com>
References: <1461605698-12385-1-git-send-email-jarkko.sakkinen@linux.intel.com>
 <20160426190009.GC8162@amd>
 <20160429201744.GD27821@intel.com>
 <142feb98-3a97-0b00-0b17-b029fa2c637f@gmail.com>
 <20160503090627.GA27301@wind.enjellic.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20160503090627.GA27301@wind.enjellic.com>
Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo
User-Agent: Mutt/1.5.24 (2015-08-30)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, May 03, 2016 at 04:06:27AM -0500, Dr. Greg Wettstein wrote:
> It would be helpful and instructive for anyone involved in this debate
> to review the following URL which details Intel's SGX licening
> program:
> 
> https://software.intel.com/en-us/articles/intel-sgx-product-licensing

I think it would be good  to note that the licensing process is available
only for Windows. For Linux you can only use debug enclaves at the
moment. The default LE has "allow-all" policy for debug enclaves.

> I think the only way forward to make all of this palatable is to
> embrace something similar to what has been done with Secure Boot.  The
> Root Enclave Key will need to be something which can be reconfigured
> by the Platform Owner through BIOS/EFI.  That model would take Intel
> off the hook from a security perspective and establish the notion of
> platform trust to be a bilateral relationship between a service
> provider and client.

This concern has been raised many times now. Sadly this did not make
into Skyle but in future we will have one shot MSRs (can be set only
once per boot cycle) for defining your own root of trust.

/Jarkko