> Seems like encryption would disable all DMA That's why encryption is enabled through page table bits: Of course you keep the pages unencrypted in which you d

> Seems like encryption would disable all DMA That's why encryption is enabled through page table bits: Of course you keep the pages unencrypted in which you do DMA. But you're right, a hostile DMA-capable device (eg. thunderbolt, firewire, pci-e) can only read/write garbage to those pages. But since they can still write there (even if it's gibberish once decrypted), IOMMU remains the better solution to protect memory from hostile devices.