[lkml]   [2018]   [Feb]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCHv3 0/5] x86: Enumerate TME and PCONFIG, add MKTME_KEY_PROG helper

* Kirill A. Shutemov <> wrote:

> Multikey Total Memory Encryption (MKTME)[1] is a technology that allows
> transparent memory encryption in upcoming Intel platforms.
> MKTME is built on top of TME. TME allows encryption of the entirety of
> system memory using a single key. MKTME allows to have multiple encryption
> domains, each having own key -- different memory pages can be encrypted
> with different keys.
> The patchset does some ground work for MKTME enabling:
> - Adds two new cpufeatures: TME and PCONFIG;
> - Detects if BIOS enabled TME and MKTME;
> - Enumerates what PCONFIG targets are supported;
> - Provides helper to program encryption keys into CPU;
> As part of TME enumeration we check out how many bits from physical address
> are claimed for encryption key ID. This may be critical as we or guest VM
> must not use these bits for physical address.

So how will the 'full' patchset look like, roughly - is there a tree or diffstat
we could take a look at perhaps?

I'm also wondering how 'TME' compares to AMD's SME (Secure Memory Encryption) and
SEV features. SME required a number of low level boot code changes - I'm wondering
how much commonality there can be achieved with Intel's TME so that we don't end
up with two sets of interfaces.



 \ /
  Last update: 2018-02-11 20:03    [W:0.080 / U:0.560 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site