From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 890D8C5DF81 for ; Thu, 20 Aug 2026 15:01:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:Cc:To:From: Reply-To:Content-Type:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=g/imZYODvRI+39DlFlmv/NPeDn4DhjbDVcvC/4q/gVY=; b=LBRsWciEwpe9FvtBK/3zU/3N0k K8auKSqORIpUTo1dpfiQT5iXedyysgP33I3EwQ0y7O5M69TMwlD9f2zBllQZwb6bt4tmvwOYfY90W RskY0f1RueMWOjYVuA7qQ8MbHyJogt5f18bQygJ9W5MCGKtc+8tQ0Ni73hxx4DBkV57KDB/oOQ2A4 Sx0QyURjvyFz9jcdPFVx5JJI73IYKem2NZkGpesl7XHDC/Gb5u7W8VcX7JNoCIfnllOIkRtVuXvmw 0FY7otsW80J8kkDvU2ltsmNKa5fgt9Z0jXI2jxy+nBVCGjmo1aoG96W++Lm+KOWV8QrPLPtp50uhH /SZFkTnQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wx4GM-0000000BlIB-0wH8; Thu, 20 Aug 2026 15:01:02 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wx4GH-0000000BlG6-0hb6 for linux-arm-kernel@lists.infradead.org; Thu, 20 Aug 2026 15:00:58 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id D630D1BCA; Thu, 20 Aug 2026 08:00:50 -0700 (PDT) Received: from e122027.cambridge.arm.com (e122027.cambridge.arm.com [10.1.25.29]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id CD05F3F85F; Thu, 20 Aug 2026 08:00:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1787238054; bh=yiXHLW2hxd28E7satGbfCpdtNX7Djkd4B3UsK9jXuSY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=X0e4gMfPovvYXck0tTBhHOmJLMstfkUnCnNqiDzYXhSNYcwY3Gug1gjBOr+tjVOJv mxdYYezRnNcKpvJ/DWTDz21EfzV8KUWJN31ZLfCD+LL0EPFY8ZNo1S97Loms+GN+E3 eACpp3CmwR4hNNEJB02ekqu0uQWJK7SBhVMqUZxM= From: Steven Price To: =?UTF-8?q?Christian=20K=C3=B6nig?= , Marc Zyngier , Sumit Semwal , Thomas Gleixner Cc: Steven Price , "T.J. Mercier" , Benjamin Gaignard , Brian Starkey , John Stultz , dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, Jason Gunthorpe , Jiri Pirko , Marek Szyprowski , Suzuki K Poulose , Jason Gunthorpe Subject: [PATCH v2 1/4] irqchip/gic-v3-its: Zero shared pages after conversion Date: Thu, 20 Aug 2026 16:00:30 +0100 Message-ID: <20260820150034.88729-2-steven.price@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260820150034.88729-1-steven.price@arm.com> References: <20260820150034.88729-1-steven.price@arm.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260820_080057_249237_29BB2BEF X-CRM114-Status: GOOD ( 14.66 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org its_alloc_pages_node() passes __GFP_ZERO to the page allocator before calling set_memory_decrypted(). This assumes that converting a page from private to shared preserves its contents. For Arm CCA with MEC (Memory Encryption Contexts) the key used to access the page will change, and so by default the visible data will change. The host could ensure that it zeros the page, but rather than relying on the host's behaviour it's best if the guest simply zeros after the decryption rather than before. Specifically in this case the ITS tables are required to be zeroed. Mask out __GFP_ZERO from the allocation request, and do the zeroing as a separate step after decryption. Reviewed-by: Jason Gunthorpe Fixes: b08e2f42e86b ("irqchip/gic-v3-its: Share ITS tables with a non-trusted hypervisor") Signed-off-by: Steven Price --- drivers/irqchip/irq-gic-v3-its.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 6f5811aae59c..a055837832bc 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -213,16 +213,18 @@ static gfp_t gfp_flags_quirk; static struct page *its_alloc_pages_node(int node, gfp_t gfp, unsigned int order) { + bool want_zero = gfp & __GFP_ZERO; struct page *page; int ret = 0; - page = alloc_pages_node(node, gfp | gfp_flags_quirk, order); + page = alloc_pages_node(node, (gfp & ~__GFP_ZERO) | gfp_flags_quirk, + order); if (!page) return NULL; ret = set_memory_decrypted((unsigned long)page_address(page), - 1 << order); + BIT(order)); /* * If set_memory_decrypted() fails then we don't know what state the * page is in, so we can't free it. Instead we leak it. @@ -231,6 +233,9 @@ static struct page *its_alloc_pages_node(int node, gfp_t gfp, if (ret) return NULL; + if (want_zero) + clear_pages(page_address(page), BIT(order)); + return page; } -- 2.43.0