Messages in this thread | | | Subject | Re: [PATCH] Ability to read the MKTME status from userspace | From | Dave Hansen <> | Date | Fri, 19 Jun 2020 08:36:02 -0700 |
| |
On 6/19/20 8:02 AM, Richard Hughes wrote: >> Someone does 'cat /proc/mktme' (or whatever) and it says "1" or >> whatever, which means yay, encryption is on. What do they do? > I think "is my memory encrypted" for Intel has to be a superset of: > > 1. TME in CPU info > 2. not disabled by the platform > 3. not using unencrypted swap > 4. not using a memory accelerator > 5. entire DRAM area is marked with EFI_MEMORY_CPU_CRYPTO
Also realize that this can all be true at one point in time, but can change if memory is added.
> It seems the only way to answer the questions and make it easy for the > consumer to know the answer is to ask the kernel for each of the 5 > different questions. At the moment we can only get 1, 3, maybe 4, soon > to be 5, but not 2.
Actually, the accelerators I had in mind would show up in the memory map and would have EFI_MEMORY_CPU_CRYPTO properly set by the firmware.
In any case, if we do something like this, I think it fundamentally needs to be more fine-grained than the whole system. It probably needs to be on a per-NUMA-node basis. That's really the only way for us to provide meaningful promises about encryption to end users.
| |