14. AMD Memory Encryption

Secure Memory Encryption (SME) and Secure Encrypted Virtualization (SEV) arefeatures found on AMD processors.

SME provides the ability to mark individual pages of memory as encrypted usingthe standard x86 page tables. A page that is marked encrypted will beautomatically decrypted when read from DRAM and encrypted when written toDRAM. SME can therefore be used to protect the contents of DRAM from physicalattacks on the system.

SEV enables running encrypted virtual machines (VMs) in which the code and dataof the guest VM are secured so that a decrypted version is available onlywithin the VM itself. SEV guest VMs have the concept of private and sharedmemory. Private memory is encrypted with the guest-specific key, while sharedmemory may be encrypted with hypervisor key. When SME is enabled, the hypervisorkey is the same key which is used in SME.

A page is encrypted when a page table entry has the encryption bit set (seebelow on how to determine its position). The encryption bit can also bespecified in the cr3 register, allowing the PGD table to be encrypted. Eachsuccessive level of page tables can also be encrypted by setting the encryptionbit in the page table entry that points to the next table. This allows the fullpage table hierarchy to be encrypted. Note, this means that just because theencryption bit is set in cr3, doesn’t imply the full hierarchy is encrypted.Each page table entry in the hierarchy needs to have the encryption bit set toachieve that. So, theoretically, you could have the encryption bit set in cr3so that the PGD is encrypted, but not set the encryption bit in the PGD entryfor a PUD which results in the PUD pointed to by that entry to not beencrypted.

When SEV is enabled, instruction pages and guest page tables are always treatedas private. All the DMA operations inside the guest must be performed on sharedmemory. Since the memory encryption bit is controlled by the guest OS when itis operating in 64-bit or 32-bit PAE mode, in all other modes the SEV hardwareforces the memory encryption bit to 1.

Support for SME and SEV can be determined through the CPUID instruction. TheCPUID function 0x8000001f reports information related to SME:

0x8000001f[eax]:        Bit[0] indicates support for SME        Bit[1] indicates support for SEV0x8000001f[ebx]:        Bits[5:0]  pagetable bit number used to activate memory                   encryption        Bits[11:6] reduction in physical address space, in bits, when                   memory encryption is enabled (this only affects                   system physical addresses, not guest physical                   addresses)

If support for SME is present, MSR 0xc00100010 (MSR_K8_SYSCFG) can be used todetermine if SME is enabled and/or to enable memory encryption:

0xc0010010:        Bit[23]   0 = memory encryption features are disabled                  1 = memory encryption features are enabled

If SEV is supported, MSR 0xc0010131 (MSR_AMD64_SEV) can be used to determine ifSEV is active:

0xc0010131:        Bit[0]    0 = memory encryption is not active                  1 = memory encryption is active

Linux relies on BIOS to set this bit if BIOS has determined that the reductionin the physical address space as a result of enabling memory encryption (seeCPUID information above) will not conflict with the address space resourcerequirements for the system. If this bit is not set upon Linux startup thenLinux itself will not set it and memory encryption will not be possible.

The state of SME in the Linux kernel can be documented as follows:

  • Supported:The CPU supports SME (determined through CPUID instruction).
  • Enabled:Supported and bit 23 of MSR_K8_SYSCFG is set.
  • Active:Supported, Enabled and the Linux kernel is actively applyingthe encryption bit to page table entries (the SME mask in thekernel is non-zero).

SME can also be enabled and activated in the BIOS. If SME is enabled andactivated in the BIOS, then all memory accesses will be encrypted and it willnot be necessary to activate the Linux memory encryption support. If the BIOSmerely enables SME (sets bit 23 of the MSR_K8_SYSCFG), then Linux can activatememory encryption by default (CONFIG_AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT=y) orby supplying mem_encrypt=on on the kernel command line. However, if BIOS doesnot enable SME, then Linux will not be able to activate memory encryption, evenif configured to do so by default or the mem_encrypt=on command line parameteris specified.