Git-Mirrors/security-misc
1
0
Fork 0
mirror of https://github.com/Kicksecure/security-misc.git synced 2026-01-04 22:45:33 -05:00
Code Issues Projects Releases Packages Wiki Activity

Merge remote-tracking branch 'raja/amd_encrypt_sev' into arraybolt3/trixie-raja-merge

Browse source
This commit is contained in:
Aaron Rainbolt 2025-12-15 19:41:36 -06:00
commit 2106ed5aa6
No known key found for this signature in database
GPG key ID: A709160D73C79109
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
etc/default/grub.d/40_kernel_hardening.cfg#security-misc-shared
View file

@ -284,7 +284,7 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX erst_disable"
## Both require a compatible AMD CPU and support for SME to first be enabled in the BIOS/UEFI.
## Likely unavailable in consumer-grade AMD CPUs where Transparent SME (TSME) can be enabled in the BIOS/UEFI to achieve SME.
## Note the corresponding Intel Total Memory Encryption (TME) can also be enabled via the BIOS/UEFI.
## May cause boot failure on certain hardware with incompatible DMA masks.
## May cause boot failure on certain hardware with incompatible DMA masks especially if IOMMU is disabled.
##
## https://www.kernel.org/doc/html/next/x86/amd-memory-encryption.html
## https://www.kernel.org/doc/html/latest/virt/kvm/x86/amd-memory-encryption.html
@ -292,9 +292,11 @@ GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX erst_disable"
## https://docs.amd.com/v/u/en-US/SEV-SNP-strengthening-vm-isolation-with-integrity-protection-and-more
## https://github.com/AMDESE/AMDSEV
## https://en.wikichip.org/wiki/x86/sme
## https://lore.kernel.org/all/YWRgN63FOrQGO8jS@zn.tnic/
## https://lore.kernel.org/lkml/YWvy9bSRaC+m1sV+@zn.tnic/T/#m01bcb37040b6b0d119d385d9a34b9c7ac4ce5f84
## https://mricher.fr/post/amd-memory-encryption/
## https://www.kicksecure.com/wiki/Dev/confidential_computing#AMD
## https://github.com/secureblue/secureblue/pull/1631#issuecomment-3655501478
## https://forums.whonix.org/t/enable-secure-memory-encryption-sme-kernel-parameter-mem-encrypt-by-default/10393
##
#GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX mem_encrypt=on"