Re: [PATCH v2 1/4] irqchip/gic-v3-its: Zero shared pages after conversion

[Catalin Marinas <catalin.marinas@arm.com>]

On Thu, Aug 20, 2026 at 02:47:39PM -0300, Jason Gunthorpe wrote:
> On Thu, Aug 20, 2026 at 06:44:43PM +0100, Catalin Marinas wrote:
> > On Thu, Aug 20, 2026 at 04:00:30PM +0100, Steven Price wrote:
> > > diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
> > > index 6f5811aae59c..a055837832bc 100644
> > > --- a/drivers/irqchip/irq-gic-v3-its.c
> > > +++ b/drivers/irqchip/irq-gic-v3-its.c
> > > @@ -213,16 +213,18 @@ static gfp_t gfp_flags_quirk;
> > >  static struct page *its_alloc_pages_node(int node, gfp_t gfp,
> > >  					 unsigned int order)
> > >  {
> > > +	bool want_zero = gfp & __GFP_ZERO;
> > >  	struct page *page;
> > >  	int ret = 0;
> > >  
> > > -	page = alloc_pages_node(node, gfp | gfp_flags_quirk, order);
> > > +	page = alloc_pages_node(node, (gfp & ~__GFP_ZERO) | gfp_flags_quirk,
> > > +				order);
> > 
> > I don't think pKVM does any scrubbing on set_memory_decrypted(), so it
> > potentially exposes confidential guest data before it reaches
> > clear_pages() below.
> 
> IMHO that has got to be handled in the arch code implementing set
> memory decrypted.

I guess that's a better separation. It probably needs to clear the MTE
tags as well, it's not great to leak them (though not as bad as leaking
data).

OTOH, pKVM would no longer need the clear_pages() afterwards since
there's no encryption key changed. Not too bad, it's not a hot path.

> Further pointing that maybe we should have an alloc decrypted so we
> can at least try to minimize the number of times we write to this
> memory. :(

This would be better.

-- 
Catalin