On: A proposed API for full-memory encryption

[posix_me_less]

> And DMA sees cleartext with (MK)TME.

Could you please translate this into non-expert language? Does it mean DMA granted devices can break IOMMU separation?

[amluto → posix_me_less]

No, I mean that, if the IOMMU is off or if it allows access to an address, then MKTME will treat that access exactly as though it was a normal access from the CPU. So, if the device selects the right key (the key uses some otherwise unused physical address bits), then the device will access the decrypted data.