Thanks for the response John. I'm pretty sure it is the second case: through the OS. I am not changing any BIOS options, I am only passing mem_encrypt=on to the kernel command line.