arch/x86/amd-memory-encryption.rst

1 .. SPDX-License-Identifier: GPL-2.0
19 memory. Private memory is encrypted with the guest-specific key, while shared
20 memory may be encrypted with hypervisor key. When SME is enabled, the hypervisor
36 When SEV is enabled, instruction pages and guest page tables are always treated
39 is operating in 64-bit or 32-bit PAE mode, in all other modes the SEV hardware
52 			   memory encryption is enabled (this only affects
57 determine if SME is enabled and/or to enable memory encryption::
61 			  1 = memory encryption features are enabled
78 	- Supported:
81 	- Enabled:
84 	- Active:
85 	  Supported, Enabled and the Linux kernel is actively applying
87 	  kernel is non-zero).
89 SME can also be enabled and activated in the BIOS. If SME is enabled and
94 then memory encryption can be enabled by supplying mem_encrypt=on on the
102 SEV-SNP introduces new features (SEV_FEATURES[1:63]) which can be enabled
108 +-----------------+---------------+---------------+------------------+
109 | Feature Enabled | Guest needs   | Guest has     | Guest boot       |
112 |      No         |      No       |      No       |     Boot         |
114 +-----------------+---------------+---------------+------------------+
115 |      No         |      Yes      |      No       |     Boot         |
117 +-----------------+---------------+---------------+------------------+
118 |      No         |      Yes      |      Yes      |     Boot         |
120 +-----------------+---------------+---------------+------------------+
121 |      Yes        |      No       |      No       | Boot with        |
122 |                 |               |               | feature enabled  |
123 +-----------------+---------------+---------------+------------------+
124 |      Yes        |      Yes      |      No       | Graceful boot    |
126 +-----------------+---------------+---------------+------------------+
127 |      Yes        |      Yes      |      Yes      | Boot with        |
128 |                 |               |               | feature enabled  |
129 +-----------------+---------------+---------------+------------------+
152 with it is documented in "Secure VM Service Module for SEV-SNP Guests", docID:
155 (Latest versions of the above-mentioned documents can be found by using
158   site:amd.com "Secure VM Service Module for SEV-SNP Guests", docID: 58019