Re: [PATCH v9 0/9] x86: Show in sysfs if a memory node is able to do encryption

On Thu, Oct 27, 2022 at 08:21:02AM -0700, Dave Hansen wrote:

On 10/27/22 01:57, Borislav Petkov wrote:

...

Well, I still think this is not going to work in all cases. SME/TME can be enabled but the kernel can go - and for whatever reason - map a bunch of memory unencrypted.

For TME on Intel systems, there's no way to make it unencrypted. The memory controller is doing all the encryption behind the back of the OS and even devices that are doing DMA. Nothing outside of the memory controller really knows or cares that encryption is happening.

Ok, Tom just confirmed that AMD's TSME thing also encrypts all memory.

So I guess the code should check for TME or TSME. If those are set, then you can assume that all memory is encrypted.