Re: [PATCH v9 0/9] x86: Show in sysfs if a memory node is able to do encryption

[Borislav Petkov]

On Thu, Oct 27, 2022 at 08:21:02AM -0700, Dave Hansen wrote:
> On 10/27/22 01:57, Borislav Petkov wrote:
> > Well, I still think this is not going to work in all cases. SME/TME can
> > be enabled but the kernel can go - and for whatever reason - map a bunch
> > of memory unencrypted.
> 
> For TME on Intel systems, there's no way to make it unencrypted.  The
> memory controller is doing all the encryption behind the back of the OS
> and even devices that are doing DMA.  Nothing outside of the memory
> controller really knows or cares that encryption is happening.

Ok, Tom just confirmed that AMD's TSME thing also encrypts all memory.

So I guess the code should check for TME or TSME. If those are set, then
you can assume that all memory is encrypted.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette