Re: [PATCH] Ability to read the MKTME status from userspace

[Borislav Petkov]

On Thu, Jun 18, 2020 at 07:34:21PM -0300, Daniel Gutson wrote:
> Besides being a CPU capability, it has to be enabled by the BIOS, which is
> what the flag represents.

... yes, and if it is disabled in the BIOS, you clear the CPU cap flag.
Something like this untested diff:

---
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index c25a67a34bd3..59d8342f6a64 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -525,6 +525,7 @@ static void detect_tme(struct cpuinfo_x86 *c)
 	if (!TME_ACTIVATE_LOCKED(tme_activate) || !TME_ACTIVATE_ENABLED(tme_activate)) {
 		pr_info_once("x86/tme: not enabled by BIOS\n");
 		mktme_status = MKTME_DISABLED;
+		clear_cpu_cap(c, X86_FEATURE_TME);
 		return;
 	}
 
@@ -553,10 +554,11 @@ static void detect_tme(struct cpuinfo_x86 *c)
 		pr_info_once("x86/mktme: disabled by BIOS\n");
 	}
 
-	if (mktme_status == MKTME_UNINITIALIZED) {
-		/* MKTME is usable */
+	/* MKTME is usable */
+	if (mktme_status == MKTME_UNINITIALIZED)
 		mktme_status = MKTME_ENABLED;
-	}
+	else if (mktme_status == MKTME_DISABLED)
+		clear_cpu_cap(c, X86_FEATURE_TME);
 
 	/*
 	 * KeyID bits effectively lower the number of physical address

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette