On Wed, Sep 16, 2026 at 01:05:39AM -0400, Zack Rusin wrote: > Decrypted per-CPU data is gated by AMD_MEM_ENCRYPT. With > INTEL_TDX_GUEST=y and AMD_MEM_ENCRYPT=n it falls back to ordinary > per-CPU storage, so converting a variable to shared memory can expose > unrelated data on the same page. > > Gate the declarations and linker section on X86_MEM_ENCRYPT, which both > AMD_MEM_ENCRYPT and INTEL_TDX_GUEST select. Existing AMD configurations > are unchanged. > > Keep the decrypted subsection page-aligned at both ends. The per-CPU > template and each allocated per-CPU unit are also page-aligned, so page > conversion cannot expose ordinary per-CPU data. TDX-only configurations > may need additional space for this alignment and isolation. > > Signed-off-by: Zack Rusin <[email protected]> > --- > include/asm-generic/vmlinux.lds.h | 2 +- > include/linux/percpu-defs.h | 2 +- > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/include/asm-generic/vmlinux.lds.h > b/include/asm-generic/vmlinux.lds.h > index b2988aa12f66..1448e791773e 100644 > --- a/include/asm-generic/vmlinux.lds.h > +++ b/include/asm-generic/vmlinux.lds.h > @@ -1013,7 +1013,7 @@ > * Note: We use a separate section so that only this section gets > * decrypted to avoid exposing more than we wish. > */ > -#ifdef CONFIG_AMD_MEM_ENCRYPT > +#ifdef CONFIG_X86_MEM_ENCRYPT > #define PERCPU_DECRYPTED_SECTION \ > . = ALIGN(PAGE_SIZE); \ > *(.data..percpu..decrypted) \ > diff --git a/include/linux/percpu-defs.h b/include/linux/percpu-defs.h > index dbe3267a0a13..54ce1442d918 100644 > --- a/include/linux/percpu-defs.h > +++ b/include/linux/percpu-defs.h > @@ -172,7 +172,7 @@ > * Declaration/definition used for per-CPU variables that should be accessed > * as decrypted when memory encryption is enabled in the guest. > */ > -#ifdef CONFIG_AMD_MEM_ENCRYPT > +#ifdef CONFIG_X86_MEM_ENCRYPT > #define DECLARE_PER_CPU_DECRYPTED(type, name) > \ > DECLARE_PER_CPU_SECTION(type, name, "..decrypted")
DECLARE_PER_CPU_DECRYPTED() is not used anywhere. Do we want to drop it? Otherwise: Acked-by: Kiryl Shutsemau (Meta) <[email protected]> -- Kiryl Shutsemau / Kirill A. Shutemov
