Messages in this thread | | | From | Richard Hughes <> | Date | Fri, 19 Jun 2020 15:09:09 +0100 | Subject | Re: [PATCH] Ability to read the MKTME status from userspace |
| |
On Fri, 19 Jun 2020 at 14:58, Dave Hansen <dave.hansen@intel.com> wrote: > > Right, but for the most part you'd agree that a machine with > > functioning TME and encrypted swap partition is more secure than a > > machine without TME? > > Nope. There might be zero memory connected to the memory controller > that supports TME.
So you're saying that a machine with TME available and enabled is not considered more secure than a machine without TME?
What I want to do is have a sliding scale of TME not available < TME available but disabled < TME available and enabled < TME available, enabled and being used. The extra nugget of data gets me from state 2 to state 3.
> > Can I use TME if the CPU supports it, but the platform has disabled > > it? How do I know that my system is actually *using* the benefits the > > TME feature provides? > > You must have a system with UEFI 2.8, ensure TME is enabled, then make > sure the OS parses EFI_MEMORY_CPU_CRYPTO, then ensure you request that > you data be placed in a region marked with EFI_MEMORY_CPU_CRYPTO, and > that it be *kept* there (hint: NUMA APIs don't do this).
So my take-away from that is that it's currently impossible to actually say if your system is *actually* using TME.
Richard.
| |