Re: [PATCH] Ability to read the MKTME status from userspace

[Dave Hansen]

On 6/19/20 6:25 AM, Richard Hughes wrote:
> On Fri, 19 Jun 2020 at 00:52, Dave Hansen <dave.hansen@xxxxxxxxx> wrote:
>> It doesn't tell you if your data is encrypted.
> Sorry for the perhaps naive question, but I thought MKTME was
> essentially full physical memory encryption?

Nope.

It means there is some encryption available.  But, it doesn't tell you
that your data is encrypted.  There is persistent memory which isn't
protected by TME, or necessarily protected by MKTME.  There can be
memory on accelerators attached by Compute Express Link which isn't
encrypted.  There's even an entire bit in the UEFI memory map to tell
the OS which memory can be encrypted or not.

On top of that, the kernel can just swap data out to unencrypted storage.

So, I really wonder what folks want from this flag in the first place.
It really tells you _nothing_.