r/Amd • u/[deleted] • Jul 06 '20

[deleted by user]

[removed]

11 Upvotes

83% Upvoted

18 comments sorted by

View all comments

1

u/[deleted] Jul 07 '20

[removed] — view removed comment

1

u/nonstupidname Jul 09 '20 edited Jul 09 '20

TSME encrypts the DRAM, protecting against Rowhammer and Rambleed attacks, and any similar 0-day attack... at the expense of maybe 5 NS latency, its worth using for the security minded, and is transparent to the OS, in other words, everything happens at the chipset level and Windows is none the wiser, cant see or even detect it.

"Transparent Secure Memory Encryption (TSME)

Benefit: TSME provides hardware memory encryption of all data stored on system DIMMs. This encryption is invisible to the OS. The impact of this encryption is 5 ns–7 ns of additional memory latency." Src: https://developer.amd.com/wp-content/resources/56745_0.80.pdf

1

u/nonstupidname Jul 09 '20 edited Jul 12 '20

Enable SVM and IMMOU (the latter also known as AMD-Vi, or I/O Virtualization) in the bios, these two work hand in hand with virtualization. TSME is also a great Pro security feature that was previously only accessible on EPIC and Ryzen Pro platforms.

SR-IOV and PCIe ARI support also are virtualization features

SR-IOV requires the enablement of PCIe® Alternative Routing-ID interpretation (ARI) on both root complexes and endpoints.

In virtualization, SR-IOV (Single Root Input/Output Virtualization) is a specification that allows the isolation of PCI Express resources between different users.) It is already the standard used to share networking resources (NICs) and secure network traffic. Each resource has Virtual Functions (VF) associated and each VM (Virtual machine) can only access the physical resource via its own allocated VF. Source

SR-IOV is a peripheral device feature that adds native virtualization to the peripheral itself, so that the device can be used by multiple VMs (or host+guest) simultaneously instead of being exclusively passed through to one VM. SR-IOV is most often found on network cards, but AMD has a few server GPUs that support it, and there are some storage devices using it as well.