From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751832AbcEIJNs (ORCPT ); Mon, 9 May 2016 05:13:48 -0400 Received: from mga03.intel.com ([134.134.136.65]:46864 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751154AbcEIJNq (ORCPT ); Mon, 9 May 2016 05:13:46 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.24,600,1455004800"; d="scan'208";a="961779033" Date: Mon, 9 May 2016 12:13:38 +0300 From: Jarkko Sakkinen To: Greg KH Cc: Thomas Gleixner , "Dr. Greg Wettstein" , "Austin S. Hemmelgarn" , Pavel Machek , Andy Lutomirski , Borislav Petkov , Boris Ostrovsky , "open list:STAGING SUBSYSTEM" , Ingo Molnar , Kristen Carlson Accardi , "open list:DOCUMENTATION" , open list , Mathias Krause , Wan Zongshun Subject: Re: [PATCH 0/6] Intel Secure Guard Extensions Message-ID: <20160509091338.GA4214@intel.com> References: <1461605698-12385-1-git-send-email-jarkko.sakkinen@linux.intel.com> <20160426190009.GC8162@amd> <20160429201744.GD27821@intel.com> <142feb98-3a97-0b00-0b17-b029fa2c637f@gmail.com> <20160503090627.GA27301@wind.enjellic.com> <20160506113944.GE24074@intel.com> <20160509053825.GA20986@intel.com> <20160509070409.GA13005@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160509070409.GA13005@kroah.com> Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, May 09, 2016 at 09:04:09AM +0200, Greg KH wrote: > On Mon, May 09, 2016 at 08:38:25AM +0300, Jarkko Sakkinen wrote: > > On Fri, May 06, 2016 at 01:54:14PM +0200, Thomas Gleixner wrote: > > > On Fri, 6 May 2016, Jarkko Sakkinen wrote: > > > > > > > On Tue, May 03, 2016 at 04:06:27AM -0500, Dr. Greg Wettstein wrote: > > > > > It would be helpful and instructive for anyone involved in this debate > > > > > to review the following URL which details Intel's SGX licening > > > > > program: > > > > > > > > > > https://software.intel.com/en-us/articles/intel-sgx-product-licensing > > > > > > > > I think it would be good to note that the licensing process is available > > > > only for Windows. For Linux you can only use debug enclaves at the > > > > moment. The default LE has "allow-all" policy for debug enclaves. > > > > > > Which makes the feature pretty useless. > > > > > > > > I think the only way forward to make all of this palatable is to > > > > > embrace something similar to what has been done with Secure Boot. The > > > > > Root Enclave Key will need to be something which can be reconfigured > > > > > by the Platform Owner through BIOS/EFI. That model would take Intel > > > > > off the hook from a security perspective and establish the notion of > > > > > platform trust to be a bilateral relationship between a service > > > > > provider and client. > > > > > > > > This concern has been raised many times now. Sadly this did not make > > > > into Skyle but in future we will have one shot MSRs (can be set only > > > > once per boot cycle) for defining your own root of trust. > > > > > > We'll wait for that to happen. > > > > I fully understand if you (and others) want to keep this standpoint but > > what if we could get it to staging after I've revised it with suggested > > changes and internal changes in my TODO? Then it would not pollute the > > mainline kernel but still would be easily available for experimentation. > > No, staging is not a "dumping ground", it's for code that is not ready > to be merged, and has some work left to do on it and it shows forward > progress on that goal. I don't put things in there that the maintainers > of the subsystems it affects do not want merged. See the many previous > examples of code that has been rejected for staging as examples of this. > > sorry, NP, point taken. > greg k-h /Jarkko