2019-12-13 21:32:51

by David Rientjes

Subject: [patch] percpu: Separate decrypted varaibles anytime encryption can be enabled

From: Erdem Aktas <[email protected]>

CONFIG_VIRTUALIZATION may not be enabled for memory encrypted guests. If
disabled, decrypted per-CPU variables may end up sharing the same page
with variables that should be left encrypted.

Always separate per-CPU variables that should be decrypted into their own
page anytime memory encryption can be enabled in the guest rather than
rely on any other config option that may not be enabled.

Fixes: ac26963a1175 ("percpu: Introduce DEFINE_PER_CPU_DECRYPTED")
Cc: [email protected] # 4.15+
Signed-off-by: Erdem Aktas <[email protected]>
Signed-off-by: David Rientjes <[email protected]>
---
include/linux/percpu-defs.h | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/include/linux/percpu-defs.h b/include/linux/percpu-defs.h
--- a/include/linux/percpu-defs.h
+++ b/include/linux/percpu-defs.h
@@ -175,8 +175,7 @@
* Declaration/definition used for per-CPU variables that should be accessed
* as decrypted when memory encryption is enabled in the guest.
*/
-#if defined(CONFIG_VIRTUALIZATION) && defined(CONFIG_AMD_MEM_ENCRYPT)
-
+#ifdef CONFIG_AMD_MEM_ENCRYPT
#define DECLARE_PER_CPU_DECRYPTED(type, name) \
DECLARE_PER_CPU_SECTION(type, name, "..decrypted")

2019-12-13 23:38:13

by Dennis Zhou

Subject: Re: [patch] percpu: Separate decrypted varaibles anytime encryption can be enabled

Hi David,

On Fri, Dec 13, 2019 at 01:31:46PM -0800, David Rientjes wrote:
> From: Erdem Aktas <[email protected]>
>
> CONFIG_VIRTUALIZATION may not be enabled for memory encrypted guests. If
> disabled, decrypted per-CPU variables may end up sharing the same page
> with variables that should be left encrypted.
>
> Always separate per-CPU variables that should be decrypted into their own
> page anytime memory encryption can be enabled in the guest rather than
> rely on any other config option that may not be enabled.
>
> Fixes: ac26963a1175 ("percpu: Introduce DEFINE_PER_CPU_DECRYPTED")
> Cc: [email protected] # 4.15+
> Signed-off-by: Erdem Aktas <[email protected]>
> Signed-off-by: David Rientjes <[email protected]>
> ---
> include/linux/percpu-defs.h | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/include/linux/percpu-defs.h b/include/linux/percpu-defs.h
> --- a/include/linux/percpu-defs.h
> +++ b/include/linux/percpu-defs.h
> @@ -175,8 +175,7 @@
> * Declaration/definition used for per-CPU variables that should be accessed
> * as decrypted when memory encryption is enabled in the guest.
> */
> -#if defined(CONFIG_VIRTUALIZATION) && defined(CONFIG_AMD_MEM_ENCRYPT)
> -
> +#ifdef CONFIG_AMD_MEM_ENCRYPT
> #define DECLARE_PER_CPU_DECRYPTED(type, name) \
> DECLARE_PER_CPU_SECTION(type, name, "..decrypted")
>

Applied to for-5.6.

Thanks,
Dennis