From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pl1-f198.google.com (mail-pl1-f198.google.com [209.85.214.198]) by kanga.kvack.org (Postfix) with ESMTP id 3ECAA6B79AB for ; Thu, 6 Dec 2018 06:23:02 -0500 (EST) Received: by mail-pl1-f198.google.com with SMTP id a10so43346plp.14 for ; Thu, 06 Dec 2018 03:23:02 -0800 (PST) Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65]) by mx.google.com with SMTPS id v191sor135209pgb.53.2018.12.06.03.23.00 for (Google Transport Security); Thu, 06 Dec 2018 03:23:00 -0800 (PST) Date: Thu, 6 Dec 2018 14:22:55 +0300 From: "Kirill A. Shutemov" Subject: Re: [RFC v2 00/13] Multi-Key Total Memory Encryption API (MKTME) Message-ID: <20181206112255.4bbumbrf5nnz4t2z@kshutemo-mobl1> References: <20181204092550.GT11614@hirez.programming.kicks-ass.net> <20181204094647.tjsvwjgp3zq6yqce@black.fi.intel.com> <063026c66b599ba4ff0b30a5ecc7d2c716e4da5b.camel@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <063026c66b599ba4ff0b30a5ecc7d2c716e4da5b.camel@intel.com> Sender: owner-linux-mm@kvack.org List-ID: To: "Sakkinen, Jarkko" Cc: "kirill.shutemov@linux.intel.com" , "peterz@infradead.org" , "jmorris@namei.org" , "Huang, Kai" , "keyrings@vger.kernel.org" , "tglx@linutronix.de" , "linux-mm@kvack.org" , "dhowells@redhat.com" , "linux-security-module@vger.kernel.org" , "Williams, Dan J" , "x86@kernel.org" , "hpa@zytor.com" , "mingo@redhat.com" , "luto@kernel.org" , "bp@alien8.de" , "Hansen, Dave" , "Schofield, Alison" , "Nakajima, Jun" On Wed, Dec 05, 2018 at 08:32:52PM +0000, Sakkinen, Jarkko wrote: > On Tue, 2018-12-04 at 12:46 +0300, Kirill A. Shutemov wrote: > > On Tue, Dec 04, 2018 at 09:25:50AM +0000, Peter Zijlstra wrote: > > > On Mon, Dec 03, 2018 at 11:39:47PM -0800, Alison Schofield wrote: > > > > (Multi-Key Total Memory Encryption) > > > > > > I think that MKTME is a horrible name, and doesn't appear to accurately > > > describe what it does either. Specifically the 'total' seems out of > > > place, it doesn't require all memory to be encrypted. > > > > MKTME implies TME. TME is enabled by BIOS and it encrypts all memory with > > CPU-generated key. MKTME allows to use other keys or disable encryption > > for a page. > > When you say "disable encryption to a page" does the encryption get > actually disabled or does the CPU just decrypt it transparently i.e. > what happens physically? Yes, it gets disabled. Physically. It overrides TME encryption. -- Kirill A. Shutemov