From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933224AbdBPTsX (ORCPT ); Thu, 16 Feb 2017 14:48:23 -0500 Received: from mail-dm3nam03on0060.outbound.protection.outlook.com ([104.47.41.60]:62898 "EHLO NAM03-DM3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S932344AbdBPTsS (ORCPT ); Thu, 16 Feb 2017 14:48:18 -0500 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=Thomas.Lendacky@amd.com; Subject: Re: [RFC PATCH v4 01/28] x86: Documentation for AMD Secure Memory Encryption (SME) To: Borislav Petkov References: <20170216154158.19244.66630.stgit@tlendack-t1.amdoffice.net> <20170216154211.19244.76656.stgit@tlendack-t1.amdoffice.net> <20170216175625.imxsvz7fzvlpveze@pd.tnic> CC: , , , , , , , , , Rik van Riel , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Toshimitsu Kani , Arnd Bergmann , Jonathan Corbet , Matt Fleming , "Michael S. Tsirkin" , Joerg Roedel , Konrad Rzeszutek Wilk , Paolo Bonzini , Brijesh Singh , Ingo Molnar , Alexander Potapenko , Andy Lutomirski , "H. Peter Anvin" , Andrey Ryabinin , Thomas Gleixner , Larry Woodman , Dmitry Vyukov From: Tom Lendacky Message-ID: <7dcbe640-4cde-cc28-ab82-2d8517925e93@amd.com> Date: Thu, 16 Feb 2017 13:48:08 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <20170216175625.imxsvz7fzvlpveze@pd.tnic> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-Originating-IP: [165.204.77.1] X-ClientProxiedBy: YTOPR01CA0008.CANPRD01.PROD.OUTLOOK.COM (10.166.147.18) To DM5PR12MB1147.namprd12.prod.outlook.com (10.168.236.142) X-MS-Office365-Filtering-Correlation-Id: 7252a601-9124-4a18-acaf-08d456a4bf11 X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(48565401081);SRVR:DM5PR12MB1147; X-Microsoft-Exchange-Diagnostics: 1;DM5PR12MB1147;3:eyC6GImYDs4wqE8d9XpDm2kUSA8NCpEInk81YEH/7TjVibtrjSHd4v4qpO7zHnsz/yUzRyGb/gyOGzAeK7f0AuHfa7E4iTvFltKLWP2C7lAzZ+55cyY464NjG2nuE6jB0edQ4O7IJFUQp+bJgarBgR8CQ0qvPP0q3Qq5QEa3GMCpZFp3RDPugNrd6h7ft9N0bX0kJP4WwniDYSR+MLle7/1s/G4fUYhvejz+Lk4Wp4OIOyPeFg2jOMNFam5SoF6++1K/x7Fwu9fkMk9aIXHY1gLlPQtSIM54NUTISZZGGwc=;25:noGXXhv9EYcks/ftZFc/m628jxGJcl2+2PQFOo3JTqu2u3rAiTh7/ODzsl/k5zhv+eP5ZPjFJBfFdzxKLyY4VDCC4Ujxpk0GwVmn1v+uqH6XyTBhdYOlOYuIGr97zhcsE02TEryGPqtsySHxIcFo3/vogywaX+AXFTZvisYRzdWOI6flIqcE1hepwGR09FfJFF4kjmWQ05Icy+f29o2RqE5ik9cbRSZZOqiVLCA1tSnICHTqVODIfiFpv7MsLo51Ek16KyEdnbPSGxsHyR+sa/IufxTruhnXkR9dATcd5yCAXJCCoLqADMAvD5s5BY+7pZtU2wVgfGuWYmDrvumj3r8bd2IKTqXOidyATTCUwUiNqAyg6VEAr4qSsKpzh9JMWQ9dcSq/QlcHNCv+olVmFSnRsDrZP8QVJlNInuUQY44AzrEIbAAYTdfSp3vQhJhk+zMtAX5RE2HOwxGo1iIuVA== X-Microsoft-Exchange-Diagnostics: 1;DM5PR12MB1147;31:di2BMmBHw0c9E2x3gfUA97AIfSPnObav5vwQjR4h/lnZG99n5wu0IANuOxIx+Lsllb3ynYOSSRyNe6OSxzB3b/LDOUJssIyGLw/Cc6iCk1BPM1YG4z63v5UAy2qWNH7FZ4xfKQSGye/NF2z/AVspB4F0EQ9La1AH4yOXRsEF4GHFMI11cpGE6HTqZOLTAo5bWxNT5rkNk+Zxvpl3wMhERr0IDwf667Y9XKXkVdf9OM8=;20:kwJb/hoMnvrQC2lZ/Nuo5SNk97O3LnfiD0sQuVzkBsv/+gEpZfOjjFjRjVyyW85xxwdU5vB4I1HBUzmqQQe6odh+orsbJMT/PZ2lvu5sGnGpTvr1Aq1e5CnHSYunmfHT3PY1OOfZJWxPztbeRk0EygV8XzRz/MsQ4b1/lsY3HqSO0JebfkbzrH+Ma5+ydzJq7Bg3J5OVaxaJwG/f0O4iznUOVVvjna6sGj6H1oVFAEWjYEKyPzpcg9SbhM3gWN0iPWnsb1Eofo9Q4WXAwR0tihPHpRxNZgyxj+LXUFijiHpwhJr2fwFRxjG1Y9cJaToa5xOy+ilR0ldVK+vkLJ0QhZnjUVr6E4+6YRcuC0m3v6ziu7qMYnvGHkABZ7DtX3uyZR2hrOOL9HXSicCqiAz+9hIY19xMr9Z226pVqaWs3UCm6dL25Xwa/+f7KXKO18WPMbs/YNGqStKp31yI+wH6gvuzDgX4BQCexHMVrsfK/yejfGzZuOwvmeF3wKZkUWL4 X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(20558992708506)(767451399110); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046)(6055026)(6041248)(20161123564025)(20161123555025)(20161123562025)(20161123558025)(20161123560025)(6072148);SRVR:DM5PR12MB1147;BCL:0;PCL:0;RULEID:;SRVR:DM5PR12MB1147; X-Microsoft-Exchange-Diagnostics: 1;DM5PR12MB1147;4:P2JRc23QLSbQRwznU3w+R/+E8IzipeiUHe6TvN6RrXRYLIacCnAeZCE9uvKUKtFgsUvpsvwiIisWR8V7WGEdBtWQrvhTAAE1FP70Ykvdf/Dn0SmBV9XrQRlISpFneMDxpNStfw9Jrc/jglM7wBDyzoLHYgPzfmnzxrYUm+th4jqG9c3Uoqkwzxwz1WY6WW5SP+MNju/NqXxcrQ7yWr7mwJrJDX45qfMrmKur6J6y9euVkX3LmMe53/v3bQyx2ca+9bhN0jGyusPh7kti9K2H7R3bmwX7uREHchFayqhjepyBJFUtJpcncVTfrLfpN8IrGwkDlupVFCstO5aG7tdY+CHxzurIctxdk2z7TlqTpFs1IYuzZlnOMVTiKPvTha1fFV0cwkPMlpeD3MtdVqV1sdBNWbDyWB/mkpS3v90kTIlgJRc7ec7rGP9Q+J1C+p8wiVKU4sKFZB2cnnB2+vnsp0NjxusuyA48D7m1lvkr6VGM9eputFw0zWkhWZMcVKussjkY8n/971OVJuNkPxWTARVGqez9tdrmDNXYJL85cjKEJGILhE9F7NXxyt3y4Gyj7PplIjOjHW/5bJ2wpvlfUALLJ0Tjzc5m5PzRGq3/sV1RcHMgNklRC3ZUK667SXWIIZmQss5STQ44RUlOiyDoWGJpD1s2cjO0Nzdhr8Qu6zs5gPH6ts5MugC4E3VU1mOiVgj+CuOFfMNVnf0J/u4Rpg== X-Forefront-PRVS: 0220D4B98D X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4630300001)(6049001)(6009001)(7916002)(39840400002)(39860400002)(39410400002)(39450400003)(39850400002)(189002)(377454003)(24454002)(199003)(305945005)(230700001)(4326007)(31696002)(76176999)(23676002)(54356999)(2906002)(7416002)(50986999)(36756003)(92566002)(86362001)(7736002)(31686004)(64126003)(106356001)(105586002)(53546006)(6486002)(42186005)(90366009)(77096006)(81156014)(8676002)(81166006)(229853002)(6666003)(101416001)(6246003)(38730400002)(2950100002)(25786008)(6916009)(65826007)(54906002)(50466002)(83506001)(3846002)(6116002)(65806001)(4001350100001)(189998001)(68736007)(47776003)(33646002)(5660300001)(66066001)(65956001)(97736004)(389900003)(53936002)(110136004)(217873001);DIR:OUT;SFP:1101;SCL:1;SRVR:DM5PR12MB1147;H:[10.236.18.82];FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtETTVQUjEyTUIxMTQ3OzIzOlI0WHJxallsRjVDbzE0REcraTZvWlVEZytX?= =?utf-8?B?TDY4VDdLRVFNVStsc29DMHV4NER1bExPaVpCQThRcVRRMnZyeTJWMkhMK1NM?= =?utf-8?B?NVkxdnlET2NaWDVhVEFvem1MSFNLVkswSnNGNGNENFZVazBMSVdTVXp4NHZo?= =?utf-8?B?RVBWelBXSnM1dEZsbTVpSjJJVkx2Z2F6TVVEZDdncFdvVVFVQVhFTko0bENx?= =?utf-8?B?dEc2K2VIV1RZRGNsMmNwQ21oYWZFK0tQWno5VGJIWWdmQ1pHVmg3RldLSWNM?= =?utf-8?B?UEp6Sm1iQW9NQ1o1b0dmdzlhOWdKa0JrUjhQSDVldVAxN0xjS3N5V045M0lK?= =?utf-8?B?cjcrVXdHaGpOaHMxYjE1YXVvZEg4UEQvWWwvY3RlVXJ3Z1czeG45aWFGeVpl?= =?utf-8?B?SkNZUVNHQ2RpZDU3V09DZWR0N1NTcW9HZ01STXQwUlE0QXZwdHBWUEhyYjRC?= =?utf-8?B?WExjM3B5UmZaUm4xZGpabGIwOElmUXM5SFNRQWNIZFVtcFliT0ptYzRpZWE3?= =?utf-8?B?aHRlZUlqVllSVW9QQlpXMnVZenhQWjZpWWI0bHUyYktaZE43YTQwVHhBMEg0?= =?utf-8?B?SUovUklhTm1vd3M3QnVPa0F0L25yT3crNHQ3cld3ZlhIWW1CZFBORFRZdi85?= =?utf-8?B?NTVqTCszMGNKOXdEMkpjeHBHUWkrbVRGV1dpWUs1ZjdUVjlER1Z5S1ppd1lN?= =?utf-8?B?ZzFlUU1jMFdGTWpELzJjYnJlQ3lHbkNzWktLbjIwc1ZsNVB0KzBJVGQ3bWx3?= =?utf-8?B?bW1ZMDRuS0lYa1c3VWc4K1hLVG1FOWppTHFsMUJGTXhNS05jQSt0VWpwNkY5?= =?utf-8?B?eUxyNW5OcnUreEw4ZjVkczJsL0s3TllvUVR0dURSYW5jR05maWtlTjV4VnlZ?= =?utf-8?B?S0h1eTB2RndVNXE1TGNhNGJiaFR5WVY5SVZjQi81QjlGWmc5MlZZMVRqSGxh?= =?utf-8?B?M1M1MFNqYWNlMWNOL1BEa3Y0aHo3Q2V5VVZuWUpOSU56VTEvKzM2aW05MWFQ?= =?utf-8?B?dEgzc0tGUnV3cTU0YTR4RlJyUDFBcEUyVWpWcnJSVFpuMERUdTJoY0dPQndB?= =?utf-8?B?c05ZVTAwTVBqZlc3SGhpbW1lWnYvaUw5YXoxR2cwcURnRitKa1VMbC9SakF0?= =?utf-8?B?cTN2MlBRY1FjYUQySkw1ZEdWeWgxMWtmSDFiak5ZRGFsMjdScXlDQTBQVkJn?= =?utf-8?B?b0ZkQ0Z6dzBVTU1kMzJka3ZjWEVLcEVOV1Y5R2pncVpqVVVQY09FOUg1QXNY?= =?utf-8?B?WGR3TFFZMDlqVk1SZ2gweVpvSzZsazF4b2R1eWIvTFl1VHQ2b0pKZTZUaEhE?= =?utf-8?B?cm51NzJtS2NKNUV3em5kMkhIVU9BNlpETG5HOU1iS3BnSnJLdG9mcndCV05s?= =?utf-8?B?dW1kSmtQY2RZVkZsMkR0VVFFYy9lVjhOanE0c2pWaG1WZGhPb092ZEZreWhV?= =?utf-8?B?RGo5NnRwZE1Db1k5UEpROGdaV0N2bVpqUmQzdEk3V2NLblhUS0lTazRIMFk2?= =?utf-8?B?Z3d0UWl1Y3FyZEtrMkRQcjlnRWhvOFZKMVJ4eGUvTnN3VHFIZXZPT0lUbWdK?= =?utf-8?B?K2V0SWl5dXpJM1dUMmRzTmlIcEtpaHl6ZndJZHg5VGdIUURtNHFTYjdyam4y?= =?utf-8?B?dmc2NGtjeWVBZE9IWFI2ZG5xWjVyRzNYRHFLbVBKVVd5aFNITjVvODBycmhG?= =?utf-8?B?bmNMeEtic0JFbkZZTVBKSkU3aFJWMWhXOHVWaVBvU09pSmdLV0Y5ekR4d2Uw?= =?utf-8?B?WG8vM0pieitkS3ROQUNGTkQ5ZDB3RTk1OE1tT29GUWt5Zm42N0F6eHYxMHI4?= =?utf-8?B?NVFGYksyTVVJMzJ0bVg3YmRZRXZvcE1LbkN4bUJpcVJldjhhakUzdGpTVEpW?= =?utf-8?B?UTlyUkxrcHhDNjJTcUt5WGRJOVZ6aElNeW0vRldWa1hLTUFQRzFWMDJKSGJS?= =?utf-8?B?SVBrNE95d1FqNWZFc0ZGYUFraUQ0Q2EyUEkrSGhocm1vZm5XRzF6djAxb3Vk?= =?utf-8?B?NFJRcDBER0M0RGVNZnA0bFBjc2k4VVVJVml0LzVyaEJhU3hEM0o3dXYvUzF6?= =?utf-8?B?OVNwU3FaZHRIU0w1YmVhVmVyTW44VHJoRlVzNG1tQy9hNjBuY25HRTBpYzJx?= =?utf-8?Q?tUkfjLs/X1vzAU5/B+TBtYLD4fT+ED9mNGTS1WQfI/Or?= X-Microsoft-Exchange-Diagnostics: 1;DM5PR12MB1147;6:mGwKz/nzR9SfKC2Ytlrmf/Tl4aQT0UedbBXRUFIV2OFAHnkzL11Dq+mKj4MUckDhJtEsZ4y8aIhqeVb1pQdTIxu8TCenj3YvjcHZ9jbHLU0Z/JqiIBvL21If6cCvtS8A8v+IUFi2RPYklV0SrYutuYGNyiAyn6GuYGb4iIc/Oa8e4VuyZmLQgL5BECRb1gtKSSRZ3F5/qZBr6esjJ9QE9ErAI/odXL5W6p5ly9WpIQbQd5uFvD1g7Y5wEL3JFF46BarLHqo2txz1CAUG+rWVuHxXDyBEk41MgspQimAPFOHqbjxNRAlnYqpgyd6X2t3mwzhUsBDjbkG8vvOpxmeM4YDftjSjRbj0GOi5DoNU9SQplP22KQoFDiWFlWXcADgmbuMl4sTw1g9srmmoXVFQfrIskCYGJHZo+an71bpy4x4=;5:lQ1Yt+jMBlmcBm1ybq89PynivdeDu6BLQX3MjTapHDfJ+eT3mHNnhpmCa3GXc2gnDIzx5a5weMeN7c40N3RWQa1A4dwiQROA6YlbGkqDHeBNzpn3zVIX4/UOcb9+K+0pW8RkhjXSxTEvnezWG7x4AQ==;24:/fwu0qYWtQJiX+XM9vGISRjHwU4fjuTozQ530DK7GQnI8xJIRijNZ7B/UU5OKekyLcIklFAVioKbfVyPCio6jyOw4XZCaQUwLvoc27RycpU= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;DM5PR12MB1147;7:NytvI8krDCowy6zhEk1/8s7s2e7VUBNIYX1tk1JSaPow31kAcRXxfe+4zZWX/yXUV1INh2XGVSTvtaHeGkc3QpPQS6vvoDF68eADT+0wQk5ynigZP6zR1OqD+ByjxpAgZxRFn25YjglqldZQvF5/Tp9g+IwQMvWqgi+1ioNQT6T1oaZ2drh5t7xMZX1ZDXIH//Ce5O988aHpuhAb9NBmJCB1j8FbM9MupFDLMlFllYEc1jVXbImsyK3WKf5iKN/VsA6l7XYGABQd1hZ7RBEXMCWCU9QlUZSk9sE9La9g4rSxfmRyO85YJXswHTM8zjPYn4iSCDEjpua+po7JeOyydg==;20:8PMDoVebQ73Lee+0daedr1blaGgrWwOPn8niR32uYMbxQVGf949WUvRzzD4dADA/8qqKIqJXnLowglY0fvwMIun+B3kdQpjX5lnk0iKT/quweKm9C3Jh4BrxhS128VL6/HEVaQW5J9bpRF7Nwa8LcuE8AXMqZowsiH6s8jIsUc47fAswAt9UyBF082G4ffKjtfGrlkMgs7s6Z4sOZjTcGKoW3Bf6c6uarYtTPf469568QPryAbCsSIsvPg6AYbTV X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Feb 2017 19:48:12.3485 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR12MB1147 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 02/16/2017 11:56 AM, Borislav Petkov wrote: > Ok, this time detailed review :-) > > On Thu, Feb 16, 2017 at 09:42:11AM -0600, Tom Lendacky wrote: >> This patch adds a Documenation entry to decribe the AMD Secure Memory >> Encryption (SME) feature. > > Please introduce a spellchecker into your patch creation workflow. I see > two typos in one line. > > Also, never start patch commit messages with "This patch" - we know it > is this patch. Always write a doer-sentences explaining the why, not the > what. Something like: > > "Add a SME and mem_encrypt= kernel parameter documentation." > > for example. Ok, will do. > >> Signed-off-by: Tom Lendacky >> --- >> Documentation/admin-guide/kernel-parameters.txt | 11 ++++ >> Documentation/x86/amd-memory-encryption.txt | 57 +++++++++++++++++++++++ >> 2 files changed, 68 insertions(+) >> create mode 100644 Documentation/x86/amd-memory-encryption.txt >> >> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt >> index 110745e..91c40fa 100644 >> --- a/Documentation/admin-guide/kernel-parameters.txt >> +++ b/Documentation/admin-guide/kernel-parameters.txt >> @@ -2145,6 +2145,17 @@ >> memory contents and reserves bad memory >> regions that are detected. >> >> + mem_encrypt= [X86-64] AMD Secure Memory Encryption (SME) control >> + Valid arguments: on, off >> + Default (depends on kernel configuration option): >> + on (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y) >> + off (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=n) >> + mem_encrypt=on: Activate SME >> + mem_encrypt=off: Do not activate SME >> + >> + Refer to the SME documentation for details on when > > "Refer to Documentation/x86/amd-memory-encryption.txt .." Ok. > >> + memory encryption can be activated. >> + >> mem_sleep_default= [SUSPEND] Default system suspend mode: >> s2idle - Suspend-To-Idle >> shallow - Power-On Suspend or equivalent (if supported) >> diff --git a/Documentation/x86/amd-memory-encryption.txt b/Documentation/x86/amd-memory-encryption.txt >> new file mode 100644 >> index 0000000..0938e89 >> --- /dev/null >> +++ b/Documentation/x86/amd-memory-encryption.txt >> @@ -0,0 +1,57 @@ >> +Secure Memory Encryption (SME) is a feature found on AMD processors. >> + >> +SME provides the ability to mark individual pages of memory as encrypted using >> +the standard x86 page tables. A page that is marked encrypted will be >> +automatically decrypted when read from DRAM and encrypted when written to >> +DRAM. SME can therefore be used to protect the contents of DRAM from physical >> +attacks on the system. >> + >> +A page is encrypted when a page table entry has the encryption bit set (see >> +below how to determine the position of the bit). The encryption bit can be > > "... how to determine its position)." Ok. > >> +specified in the cr3 register, allowing the PGD table to be encrypted. Each >> +successive level of page tables can also be encrypted. >> + >> +Support for SME can be determined through the CPUID instruction. The CPUID >> +function 0x8000001f reports information related to SME: >> + >> + 0x8000001f[eax]: >> + Bit[0] indicates support for SME >> + 0x8000001f[ebx]: >> + Bit[5:0] pagetable bit number used to activate memory >> + encryption > > s/Bit/Bits/ Ok. > >> + Bit[11:6] reduction in physical address space, in bits, when > > Ditto. > >> + memory encryption is enabled (this only affects system >> + physical addresses, not guest physical addresses) >> + >> +If support for SME is present, MSR 0xc00100010 (SYS_CFG) can be used to > > Let's use the kernel's define name MSR_K8_SYSCFG to avoid ambiguity. Will do. > >> +determine if SME is enabled and/or to enable memory encryption: >> + >> + 0xc0010010: >> + Bit[23] 0 = memory encryption features are disabled >> + 1 = memory encryption features are enabled >> + >> +Linux relies on BIOS to set this bit if BIOS has determined that the reduction >> +in the physical address space as a result of enabling memory encryption (see >> +CPUID information above) will not conflict with the address space resource >> +requirements for the system. If this bit is not set upon Linux startup then >> +Linux itself will not set it and memory encryption will not be possible. >> + >> +The state of SME in the Linux kernel can be documented as follows: >> + - Supported: >> + The CPU supports SME (determined through CPUID instruction). >> + >> + - Enabled: >> + Supported and bit 23 of the SYS_CFG MSR is set. > > Ditto. > >> + >> + - Active: >> + Supported, Enabled and the Linux kernel is actively applying >> + the encryption bit to page table entries (the SME mask in the >> + kernel is non-zero). >> + >> +SME can also be enabled and activated in the BIOS. If SME is enabled and >> +activated in the BIOS, then all memory accesses will be encrypted and it will >> +not be necessary to activate the Linux memory encryption support. If the BIOS >> +merely enables SME (sets bit 23 of the SYS_CFG MSR), then Linux can activate >> +memory encryption. > > "... This is done by supplying mem_encrypt=on on the kernel command line. > Alternatively, if the kernel should enable SME by default, set > CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y." Yup, much clearer. > >> However, if BIOS does not enable SME, then Linux will not >> +attempt to activate memory encryption, even if configured to do so by default > > will not attempt or will not be able to? Probably closer to will not be able to right now. I'll update that. Thanks, Tom > >> +or the mem_encrypt=on command line parameter is specified. >