ASRock B550 Phantom Gaming and AMD SME

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic

   Using
ASRock B550 Phantom Gaming-ITX/ax, BIOS P2.20 08/05/2021
with AMD Ryzen 7 PRO 5750GE with Radeon Graphics (100-000000257)
which have support for AMD Secure Encryption feature called "SME".

To use "SME" at OS level is must be enabled before OS start, hence it cannot be enabled in BIOS yet.

Verification of my statement:

1) CPU in question support "SME" at hardware level

# cpuid -1 -l 0x8000001f1f
CPU:
   AMD Secure Encryption (0x8000001f):
      SME: secure memory encryption support    = true
      SEV: secure encrypted virtualize support = true
      VM page flush MSR support                = true
      SEV-ES: SEV encrypted state support      = true
      SEV-SNP: SEV secure nested paging        = false
      VMPL: VM permission levels               = false
      hardware cache coher across enc domains  = false
      SEV guest exec only from 64-bit host     = true
      restricted injection                     = true
      alternate injection                      = true
      full debug state swap for SEV-ES guests  = true
      disallowing IBS use by host              = false
      encryption bit position in PTE           = 0x0 (0)
      physical address space width reduction   = 0x0 (0)
      number of VM permission levels           = 0x0 (0)
      number of SEV-enabled guests supported   = 0x0 (0)
      minimum SEV guest ASID                   = 0x1 (1)

2) but "SME" support is not enabled sadly
verified by bit 23 (MSR_AMD64_SYSCFG_MEM_ENCRYPT) of MSR 0xC0010010 (MSR_AMD64_SYSCFG)

# rdmsr -f 23:23 -x 0xC0010010
0

double check value

# rdmsr -x 0xC0010010
740000
# printf '%032.0f\n' $(bc <<<"obase=2;ibase=16;740000")
00000000011101000000000000000000
        ^ zero

It should be value 0xf40000

# printf '%032.0f\n' $(bc <<<"obase=2;ibase=16;F40000")
00000000111101000000000000000000
        ^

Also toggling Transparent Secure Memory Encryption (TSME) Feature at BIOS>Advanced tab>AMD CBS>UMC Common Options (DDR4 Common Options)>Security
does not help.

Please provide a BIOS option for enabling SME Feature or enlight me how to enable SME feature flag by current BIOS menu.