Re: [PATCH v39 15/24] x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION

2020-10-27 Thread Dr. Greg
On Sat, Oct 24, 2020 at 11:23:11PM +0300, Jarkko Sakkinen wrote: Good morning, I hope the day is starting well for everyone. > On Sat, Oct 24, 2020 at 08:47:28AM -0700, Andy Lutomirski wrote: > > On Sat, Oct 24, 2020 at 4:34 AM Jarkko Sakkinen > > wrote: > > > > > > On Fri, Oct 23, 2020 at

Re: [PATCH v39 15/24] x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION

2020-10-24 Thread Jarkko Sakkinen
On Sat, Oct 24, 2020 at 08:47:28AM -0700, Andy Lutomirski wrote: > On Sat, Oct 24, 2020 at 4:34 AM Jarkko Sakkinen wrote: > > > > On Fri, Oct 23, 2020 at 07:19:05AM -0700, Dave Hansen wrote: > > > On 10/23/20 3:17 AM, Jarkko Sakkinen wrote: > > > > On Tue, Oct 20, 2020 at 02:19:26PM -0700, Dave

Re: [PATCH v39 15/24] x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION

2020-10-24 Thread Andy Lutomirski
On Sat, Oct 24, 2020 at 4:34 AM Jarkko Sakkinen wrote: > > On Fri, Oct 23, 2020 at 07:19:05AM -0700, Dave Hansen wrote: > > On 10/23/20 3:17 AM, Jarkko Sakkinen wrote: > > > On Tue, Oct 20, 2020 at 02:19:26PM -0700, Dave Hansen wrote: > > >> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote: > > >>> + *

Re: [PATCH v39 15/24] x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION

2020-10-24 Thread Jarkko Sakkinen
On Fri, Oct 23, 2020 at 04:23:55PM +0200, Jethro Beekman wrote: > On 2020-10-23 12:17, Jarkko Sakkinen wrote: > > On Tue, Oct 20, 2020 at 02:19:26PM -0700, Dave Hansen wrote: > >> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote: > >>> + * Failure to explicitly request access to a restricted attribute

Re: [PATCH v39 15/24] x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION

2020-10-24 Thread Jarkko Sakkinen
On Fri, Oct 23, 2020 at 07:19:05AM -0700, Dave Hansen wrote: > On 10/23/20 3:17 AM, Jarkko Sakkinen wrote: > > On Tue, Oct 20, 2020 at 02:19:26PM -0700, Dave Hansen wrote: > >> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote: > >>> + * Failure to explicitly request access to a restricted attribute will

Re: [PATCH v39 15/24] x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION

2020-10-23 Thread Jethro Beekman
On 2020-10-23 12:17, Jarkko Sakkinen wrote: > On Tue, Oct 20, 2020 at 02:19:26PM -0700, Dave Hansen wrote: >> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote: >>> + * Failure to explicitly request access to a restricted attribute will >>> cause >>> + * sgx_ioc_enclave_init() to fail. Currently, the

Re: [PATCH v39 15/24] x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION

2020-10-23 Thread Dave Hansen
On 10/23/20 3:17 AM, Jarkko Sakkinen wrote: > On Tue, Oct 20, 2020 at 02:19:26PM -0700, Dave Hansen wrote: >> On 10/2/20 9:50 PM, Jarkko Sakkinen wrote: >>> + * Failure to explicitly request access to a restricted attribute will >>> cause >>> + * sgx_ioc_enclave_init() to fail. Currently, the

Re: [PATCH v39 15/24] x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION

2020-10-23 Thread Jarkko Sakkinen
On Tue, Oct 20, 2020 at 02:19:26PM -0700, Dave Hansen wrote: > On 10/2/20 9:50 PM, Jarkko Sakkinen wrote: > > + * Failure to explicitly request access to a restricted attribute will > > cause > > + * sgx_ioc_enclave_init() to fail. Currently, the only restricted > > attribute > > + * is access

Re: [PATCH v39 15/24] x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION

2020-10-23 Thread Jarkko Sakkinen
On Tue, Oct 20, 2020 at 08:48:54AM -0700, Dave Hansen wrote: > > int __init sgx_drv_init(void) > > { > > unsigned int eax, ebx, ecx, edx; > > @@ -181,5 +192,12 @@ int __init sgx_drv_init(void) > > return ret; > > } > > > > + ret = misc_register(_dev_provision); > > + if

Re: [PATCH v39 15/24] x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION

2020-10-20 Thread Dave Hansen
On 10/2/20 9:50 PM, Jarkko Sakkinen wrote: > + * Failure to explicitly request access to a restricted attribute will cause > + * sgx_ioc_enclave_init() to fail. Currently, the only restricted attribute > + * is access to the PROVISION_KEY. Could we also justify why access is restricted, please?

Re: [PATCH v39 15/24] x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION

2020-10-20 Thread Dave Hansen
> int __init sgx_drv_init(void) > { > unsigned int eax, ebx, ecx, edx; > @@ -181,5 +192,12 @@ int __init sgx_drv_init(void) > return ret; > } > > + ret = misc_register(_dev_provision); > + if (ret) { > + pr_err("Creating /dev/sgx/provision failed

[PATCH v39 15/24] x86/sgx: Add SGX_IOC_ENCLAVE_PROVISION

2020-10-02 Thread Jarkko Sakkinen
Provisioning Certification Enclave (PCE), the root of trust for other enclaves, generates a signing key from a fused key called Provisioning Certification Key. PCE can then use this key to certify an attestation key of a Quoting Enclave (QE), e.g. we get the chain of trust down to the hardware if