From nobody Sat Sep 26 05:27:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6159F44C678; Fri, 4 Sep 2026 10:35:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518109; cv=none; b=BVntT64bf8AZUaSwVU7h77SKOI1nMAyZFl9jvu0dvq6NS22Xxg235mqNDqPjJwfFqjIzBNR4ewLYb4OxEuDO45fKZ41MZj6G/WfYCvkm3xXnD3jZ5iR0++b2N7HlqorpMSWkUn+4u/d+Txyce6JvojpyMs6+PUEH9c6xuDu88hM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518109; c=relaxed/simple; bh=iZ+S/9LTyfsOPBBzau2MCrsTdSwO0f+hAAmt25eJ+hQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=V/xcz7bc/QZdi++erKC6ck3RMA+h6ip3W3RGInBDHIWwSkyIgn7wNdBCOkLq91TRfVZGyym3gmywme0HN3aU7i8kWwjS/uKrCeVHtoyKmWFvFTxCtoV9gw2vABrxpS7i13Ttd1JWDtxJ6g1C3gj55S5tj8q+qMAdZpX75akqJXA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=n94gtNfO; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="n94gtNfO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A2D771F00A3E; Fri, 4 Sep 2026 10:35:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788518107; bh=9yCa15UdSNTilz8kPcvrpDVJ1NX5mcsjOV3wxcM11SI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=n94gtNfOXVpib0FqSMswq4TJBhowKoamIh5esJxUMOLzRML4Wqd1va+BRLyrw3z2E U7iZ7+4+mSvkdsg+XUxTcqYqdrv0DrxyDD1z/DaqmpozjfuLGwzmO25MIPzaKQ2GRv K1S6acdrKeUdBr8WovRoqksDi1FhGnIexXoMkND7W6o2/sltKmjYduLX2V8kOl3WMU XS3xEmJxv40hNvlY0ZXuyS3nu8mJtmiPFWvXgv5xcFI8LcNjHfW4sfPUCWKlFdg0un 1jyXlYdDI+RIIEOfvHVrW+Wt3/mP2rJ2W3bqQ7nu9NaWkuCigAD/tYQW7+B6PvjVpz nE/SJ2oK8+Kcg== From: "Aneesh Kumar K.V (Arm)" To: linux-coco@lists.linux.dev, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, iommu@lists.linux.dev Cc: "Aneesh Kumar K.V (Arm)" , Catalin Marinas , Jason Gunthorpe , Marc Zyngier , Marek Szyprowski , Robin Murphy , Steven Price , Suzuki K Poulose , Thomas Gleixner , Will Deacon Subject: [PATCH v6 1/9] mm/mem_encrypt: Add helpers for shared-buffer alignment Date: Fri, 4 Sep 2026 16:04:44 +0530 Message-ID: <20260904103452.1197239-2-aneesh.kumar@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260904103452.1197239-1-aneesh.kumar@kernel.org> References: <20260904103452.1197239-1-aneesh.kumar@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" confidential-computing guests may require shared buffers with alignment larger than the guest page size. As these buffers are shared with the host, which may manage shared/private state at a different page-size granularity, the required alignment must account for the host's page size as well. Add helpers for querying the shared-buffer granule size and for rounding sizes up to that granule. The generic implementation defaults to PAGE_SIZE so that existing architectures keep their current behaviour unless they override the granule size. Signed-off-by: Aneesh Kumar K.V (Arm) --- include/linux/mem_encrypt.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/include/linux/mem_encrypt.h b/include/linux/mem_encrypt.h index 07584c5e36fb..5d2a868f8d3d 100644 --- a/include/linux/mem_encrypt.h +++ b/include/linux/mem_encrypt.h @@ -11,6 +11,8 @@ #define __MEM_ENCRYPT_H__ =20 #ifndef __ASSEMBLY__ +#include +#include =20 #ifdef CONFIG_ARCH_HAS_MEM_ENCRYPT =20 @@ -54,6 +56,18 @@ #define dma_addr_canonical(x) (x) #endif =20 +#ifndef mem_cc_shared_granule_size +static inline size_t mem_cc_shared_granule_size(void) +{ + return PAGE_SIZE; +} +#endif + +static inline size_t mem_cc_align_to_shared_granule(size_t size) +{ + return ALIGN(size, mem_cc_shared_granule_size()); +} + #endif /* __ASSEMBLY__ */ =20 #endif /* __MEM_ENCRYPT_H__ */ --=20 2.43.0 From nobody Sat Sep 26 05:27:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C9AEF3AC0EE; Fri, 4 Sep 2026 10:35:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518115; cv=none; b=seBRSl4dZ5srxOLnYkU5cirQ+sbx6fwYYjqaBPxd/PeWp1WifyqBzR/T43DgCWujK3uuwGDRFc8bOyVj6PF1Yqpba1SR3u4j/IMnGBlslubdy3DqaFe2A0KlStaV05ozfyYUxKVOvdJpAkhh9GcsKws3br9mP9zItLKt7DJSYU4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518115; c=relaxed/simple; bh=cS0g/nDD61NS45zqSS8FVqMvbKkUuuYzbwvshF2J/pg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=P4xMn8Zifc30MEMwoIxFW6WWAJz3ZIZFNkDOEZhCQ/XwoGYSsSQPcuzOPnWCVGv55K0ec854K7GEvb8LV8a32O8MjdKFBLO+TaMgSQe3mFdiWdPvQM4HyY/vG6I/2qUIm+DzGJgw/qBqN+OfHC+hjrKaP/u23Q0z1cXqb30gGCI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=erlD1+uD; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="erlD1+uD" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5ED601F00A3D; Fri, 4 Sep 2026 10:35:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788518113; bh=/zkAw0Mk8GkqlqvyS44GmVtI+30wAgQRZHaj1Ir4nIo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=erlD1+uDMTvmkBHPQ5hx5RxALAbZgQ13+Sb+kS0mqKvW7e5jYGpWWh2xzNUnu5uQJ ZSg4GPscYVOTRBVXtgSOMUOVhAXCNypcXz91wqLI6MFAljeyFJMMmQjY9Egjfglg/9 k18YENiUpf1s3FOlaeQIMHjByg4dWZuwV1IIejRmuf0Ci3I4oS3MxKB7jSNR/c/6uK /utYsfZCevfUSnXx8MMabqlPwhTWfy0vzD4LW1mB+OiHQF+YCF0KpnVi7hUs3iLdj5 5jX39qFoUpal0uFMDTOyaYv4Q1U0DERYHFB/cfddGK0X7rl8ubamTFMUByU28RWSEx pKFHjYeYUzPkA== From: "Aneesh Kumar K.V (Arm)" To: linux-coco@lists.linux.dev, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, iommu@lists.linux.dev Cc: "Aneesh Kumar K.V (Arm)" , Catalin Marinas , Jason Gunthorpe , Marc Zyngier , Marek Szyprowski , Robin Murphy , Steven Price , Suzuki K Poulose , Thomas Gleixner , Will Deacon Subject: [PATCH v6 2/9] irqchip/gic-v3-its: Align shared ITS allocations to the CoCo shared granule size Date: Fri, 4 Sep 2026 16:04:45 +0530 Message-ID: <20260904103452.1197239-3-aneesh.kumar@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260904103452.1197239-1-aneesh.kumar@kernel.org> References: <20260904103452.1197239-1-aneesh.kumar@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" ITS tables allocated by the coco guest are shared with the hypervisor. These allocations must satisfy the host shared-buffer granule size so that the full converted range is safe for host access. Allocate ITS pages using a size rounded up to the shared granule size and use the same allocation order when encrypting, decrypting and freeing the memory. Also grow the ITT cache in shared-granule sized chunks instead of assuming PAGE_SIZE is sufficient. Signed-off-by: Aneesh Kumar K.V (Arm) --- drivers/irqchip/irq-gic-v3-its.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-= its.c index e9807af23537..98d8fccbf0f2 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -216,6 +216,7 @@ static struct page *its_alloc_pages_node(int node, gfp_= t gfp, struct page *page; int ret =3D 0; =20 + order =3D get_order(mem_cc_align_to_shared_granule(PAGE_SIZE << order)); page =3D alloc_pages_node(node, gfp | gfp_flags_quirk, order); =20 if (!page) @@ -241,6 +242,8 @@ static struct page *its_alloc_pages(gfp_t gfp, unsigned= int order) =20 static void its_free_pages(void *addr, unsigned int order) { + + order =3D get_order(mem_cc_align_to_shared_granule(PAGE_SIZE << order)); /* * If the memory cannot be encrypted again then we must leak the pages. * set_memory_encrypted() will already have WARNed. @@ -272,7 +275,8 @@ static void *itt_alloc_pool(int node, int size) if (!page) break; =20 - gen_pool_add(itt_pool, (unsigned long)page_address(page), PAGE_SIZE, nod= e); + gen_pool_add(itt_pool, (unsigned long)page_address(page), + mem_cc_align_to_shared_granule(PAGE_SIZE), node); } while (!addr); =20 return (void *)addr; --=20 2.43.0 From nobody Sat Sep 26 05:27:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 43CAB46D2AA; Fri, 4 Sep 2026 10:35:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518120; cv=none; b=twixoS2le3ktEy5qPfVQT/9VCAPqXqe60j4xVzzrWI1dypu4J0XW49vukP5leBmzrLfqz4OYf9MqrwJ2X9woMnLkMq6c+0bL0SJXJ+h2fui1J8JeJLybzxV9L78nSpzYmpFJ8LSLdJd2cJ4Norj1KQvjetLhRPsNggi/CxHYagM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518120; c=relaxed/simple; bh=Vj6OXXdjgKJ5sM3ltq4JfEZvNQze4BsP5SfRniC0FxI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NAIrBjyC6q+W2OQnuUfmtNW9rjNf6fruND+f+SdsNXBe0EP+e3m0EwNwXjWP7JhQiZX9+Oa5BSOs95qmgBFIXbokSNjbX7NJN0CAsEpIs1bFxwo37asLB5tlEqLpQrJo1V9GqDxtAkaaeekNBVe3v4wjUWu0x9Df1sgZD0r7WiY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=JnK/F57N; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="JnK/F57N" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1A0CF1F00A3E; Fri, 4 Sep 2026 10:35:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788518119; bh=deNgVt7ciPtB7l7NDMR4M7LD1BBWC7NklwngiaCMYjA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=JnK/F57NCSLAFS4tb4UmbDOaxP5eAXzT7vbIkby3GOToo7rw1Fn6Cn1dC5TaQvRWu 4wk1swPdEGpIW5oASq9Ozwk8z/SBseM8vKtbh+2EoZE4iFPQm2t5CrduR46udup1Za 5QJ4YShYCmjlBBLyWZaVjYVO8jcHaG3oEj1tJeZ6dAI5YPzzQJndOcR9new3Hp+06x 2jghwWdX3KEM8md2wFtFCM+H5mamEpi7CimSx7RIpceaLRibZ4Wz+naChC2CcdnHzy uysWHmj7iukrGU09X9bZa3cqYd6MGEX0WxSTrabPiG/iAdc08OXBfZ0+67zGmSoUsP Kyr1LBHjkMV+Q== From: "Aneesh Kumar K.V (Arm)" To: linux-coco@lists.linux.dev, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, iommu@lists.linux.dev Cc: "Aneesh Kumar K.V (Arm)" , Catalin Marinas , Jason Gunthorpe , Marc Zyngier , Marek Szyprowski , Robin Murphy , Steven Price , Suzuki K Poulose , Thomas Gleixner , Will Deacon Subject: [PATCH v6 3/9] dma-mapping: Pass allocation attrs to contiguous allocation helpers Date: Fri, 4 Sep 2026 16:04:46 +0530 Message-ID: <20260904103452.1197239-4-aneesh.kumar@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260904103452.1197239-1-aneesh.kumar@kernel.org> References: <20260904103452.1197239-1-aneesh.kumar@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Prepare for handling CoCo shared allocation requirements in the common contiguous allocation path by passing DMA allocation attributes down to the helpers that may allocate from CMA. The next patch uses this to apply shared-granule alignment only to allocations that are actually creating CoCo shared backing pages. Signed-off-by: Aneesh Kumar K.V (Arm) --- drivers/iommu/dma-iommu.c | 2 +- include/linux/dma-map-ops.h | 5 +++-- kernel/dma/contiguous.c | 4 +++- kernel/dma/direct.c | 11 ++++++----- kernel/dma/ops_helpers.c | 3 ++- 5 files changed, 15 insertions(+), 10 deletions(-) diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c index 58c624513cd4..32ed56aff12a 100644 --- a/drivers/iommu/dma-iommu.c +++ b/drivers/iommu/dma-iommu.c @@ -1627,7 +1627,7 @@ static void *iommu_dma_alloc_pages(struct device *dev= , size_t size, struct page *page =3D NULL; void *cpu_addr; =20 - page =3D dma_alloc_contiguous(dev, alloc_size, gfp); + page =3D dma_alloc_contiguous(dev, alloc_size, gfp, attrs); if (!page) page =3D alloc_pages_node(node, gfp, get_order(alloc_size)); if (!page) diff --git a/include/linux/dma-map-ops.h b/include/linux/dma-map-ops.h index 8fae2b7deb20..1849f352fb88 100644 --- a/include/linux/dma-map-ops.h +++ b/include/linux/dma-map-ops.h @@ -102,7 +102,8 @@ struct page *dma_alloc_from_contiguous(struct device *d= ev, size_t count, unsigned int order, bool no_warn); bool dma_release_from_contiguous(struct device *dev, struct page *pages, int count); -struct page *dma_alloc_contiguous(struct device *dev, size_t size, gfp_t g= fp); +struct page *dma_alloc_contiguous(struct device *dev, size_t size, gfp_t g= fp, + unsigned long attrs); void dma_free_contiguous(struct device *dev, struct page *page, size_t siz= e); =20 void dma_contiguous_early_fixup(phys_addr_t base, unsigned long size); @@ -136,7 +137,7 @@ static inline bool dma_release_from_contiguous(struct d= evice *dev, } /* Use fallback alloc() and free() when CONFIG_DMA_CMA=3Dn */ static inline struct page *dma_alloc_contiguous(struct device *dev, size_t= size, - gfp_t gfp) + gfp_t gfp, unsigned long attrs) { return NULL; } diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c index 66093460584e..18cd423fbc67 100644 --- a/kernel/dma/contiguous.c +++ b/kernel/dma/contiguous.c @@ -402,6 +402,7 @@ static struct page *cma_alloc_aligned(struct cma *cma, = size_t size, gfp_t gfp) * @dev: Pointer to device for which the allocation is performed. * @size: Requested allocation size. * @gfp: Allocation flags. + * @attrs: DMA attributes. * * tries to use device specific contiguous memory area if available, or it * tries to use per-numa cma, if the allocation fails, it will fallback to @@ -412,7 +413,8 @@ static struct page *cma_alloc_aligned(struct cma *cma, = size_t size, gfp_t gfp) * there is no need to waste CMA pages for that kind; it also helps reduce * fragmentations. */ -struct page *dma_alloc_contiguous(struct device *dev, size_t size, gfp_t g= fp) +struct page *dma_alloc_contiguous(struct device *dev, size_t size, gfp_t g= fp, + unsigned long attrs) { #ifdef CONFIG_DMA_NUMA_CMA int nid =3D dev_to_node(dev); diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c index da665ca22d5c..fe02e8a3c0bb 100644 --- a/kernel/dma/direct.c +++ b/kernel/dma/direct.c @@ -115,7 +115,7 @@ static struct page *dma_direct_alloc_swiotlb(struct dev= ice *dev, size_t size, } =20 static struct page *__dma_direct_alloc_pages(struct device *dev, size_t si= ze, - gfp_t gfp, bool allow_highmem) + gfp_t gfp, bool allow_highmem, unsigned long attrs) { int node =3D dev_to_node(dev); struct page *page; @@ -124,7 +124,7 @@ static struct page *__dma_direct_alloc_pages(struct dev= ice *dev, size_t size, WARN_ON_ONCE(!PAGE_ALIGNED(size)); =20 gfp |=3D dma_direct_optimal_gfp_mask(dev, &phys_limit); - page =3D dma_alloc_contiguous(dev, size, gfp); + page =3D dma_alloc_contiguous(dev, size, gfp, attrs); if (page) { if (dma_coherent_ok(dev, page_to_phys(page), size) && (allow_highmem || !PageHighMem(page))) @@ -184,7 +184,7 @@ static void *dma_direct_alloc_no_mapping(struct device = *dev, size_t size, { struct page *page; =20 - page =3D __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO, true); + page =3D __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO, true, 0); if (!page) return NULL; =20 @@ -286,7 +286,8 @@ void *dma_direct_alloc(struct device *dev, size_t size, } =20 /* we always manually zero the memory once we are done */ - page =3D __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO, allow_hig= hmem); + page =3D __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO, + allow_highmem, attrs); if (!page) return NULL; =20 @@ -452,7 +453,7 @@ struct page *dma_direct_alloc_pages(struct device *dev,= size_t size, goto setup_page; } =20 - page =3D __dma_direct_alloc_pages(dev, size, gfp, false); + page =3D __dma_direct_alloc_pages(dev, size, gfp, false, attrs); if (!page) return NULL; =20 diff --git a/kernel/dma/ops_helpers.c b/kernel/dma/ops_helpers.c index 6b5f9208d31c..43e5f8008a9c 100644 --- a/kernel/dma/ops_helpers.c +++ b/kernel/dma/ops_helpers.c @@ -66,7 +66,8 @@ struct page *dma_common_alloc_pages(struct device *dev, s= ize_t size, struct page *page; phys_addr_t phys; =20 - page =3D dma_alloc_contiguous(dev, size, gfp); + /* __DMA_ATTR_ALLOC_CC_SHARED is not yet supported here, attrs =3D 0 */ + page =3D dma_alloc_contiguous(dev, size, gfp, 0); if (!page) page =3D alloc_pages_node(dev_to_node(dev), gfp, get_order(size)); if (!page) --=20 2.43.0 From nobody Sat Sep 26 05:27:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3705046D2AA; Fri, 4 Sep 2026 10:35:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518126; cv=none; b=JOa64oSbyrZineebAsu1r8p84MrpLksW2wHif05bN2JutJoxqoTWxSquDdniAtOvg6rclj2JVS9TU+wsF73dAH2K1KMFN/y04tdZ4Ech1HptTRkEDoOCYmYcc4dvOy0o8yQTqR0klceh0ob+MRHb/UdcW974wyibQ0D7OJ2Ht0Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518126; c=relaxed/simple; bh=VxdJYOmkWJoKoUJo2BWt4WULNdnQ/Zoiq0qX9qZ/o64=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kKHd8cjWu9/3PkQSFyfbRw82fuPnqxKUH8QF70yeamZSpyg+2Q1zlpPuzDsbTLSo1KC13COeuX1rwrnvSfX1B4Hlz2krnzxAZ9DpSJfoM/kYYj0/3uZqcyQeuZyL+3WCXmSFlIhCD8QuQnV1iKHs+VGn4KQUiN4Lt3IeG00zPaU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DzJ5y2s2; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DzJ5y2s2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C95B51F00A3D; Fri, 4 Sep 2026 10:35:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788518124; bh=0EuedylNKiE7ESkNTtxpDw1qbH4jeqTmoc4JjBxjnyw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=DzJ5y2s2Lk3yhHg7G8gVHWh8a7mUbxegmFMHbirWwQe6NOpltJ/f+yOKVT2vO+Ppe Arp0qFl/MPEotc+9IVq2D1MnwgsEMwE4BsV44VjXvZyhVnYtyMt+xWMo5/vreWYLWe mmp8gQEaI84XpKo68NpNj4B2SE7G/B8G3JTKlpVA1IBLmD2OYrL9zJ1z1f9OGVO369 QLgB2R+oL94voNlgdwKqvB7kFG45UOkJT8dGVYJMS9SiDs/E5oS6RKiyHjxFv8hij+ jUvTcZbxy9A7CFnX2wAxi/BgLlA3m/BuIwafoPnOFzeGG+E/qIIbq1VDrTbAba/U/N /hJr8CbHJzQUg== From: "Aneesh Kumar K.V (Arm)" To: linux-coco@lists.linux.dev, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, iommu@lists.linux.dev Cc: "Aneesh Kumar K.V (Arm)" , Catalin Marinas , Jason Gunthorpe , Marc Zyngier , Marek Szyprowski , Robin Murphy , Steven Price , Suzuki K Poulose , Thomas Gleixner , Will Deacon Subject: [PATCH v6 4/9] dma-direct: Align CoCo shared DMA allocations to the shared granule size Date: Fri, 4 Sep 2026 16:04:47 +0530 Message-ID: <20260904103452.1197239-5-aneesh.kumar@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260904103452.1197239-1-aneesh.kumar@kernel.org> References: <20260904103452.1197239-1-aneesh.kumar@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" DMA allocations that create shared backing pages for confidential-computing guests are converted between private and shared memory before being used for DMA. On some architecture, the conversion granule may be larger than PAGE_SIZE, so converting only the requested size can leave the rest of the host-managed granule private. Use the internal __DMA_ATTR_ALLOC_CC_SHARED allocation attribute to identify those allocations in the DMA allocation paths. Round the allocated and converted size up to mem_cc_shared_granule_size(), and use the same aligned size when restoring encryption on free. Also reject CMA allocations for CoCo shared backing pages when CMA cannot provide alignment at the required shared granule size, and keep atomic DMA pool expansion from falling below the order needed for shared-buffer conversions. Signed-off-by: Aneesh Kumar K.V (Arm) --- kernel/dma/contiguous.c | 9 +++++++++ kernel/dma/direct.c | 16 ++++++++++++++-- kernel/dma/pool.c | 4 +++- 3 files changed, 26 insertions(+), 3 deletions(-) diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c index 18cd423fbc67..6bdd4f264733 100644 --- a/kernel/dma/contiguous.c +++ b/kernel/dma/contiguous.c @@ -45,6 +45,7 @@ #include #include #include +#include =20 #ifdef CONFIG_CMA_SIZE_MBYTES #define CMA_SIZE_MBYTES CONFIG_CMA_SIZE_MBYTES @@ -419,6 +420,14 @@ struct page *dma_alloc_contiguous(struct device *dev, = size_t size, gfp_t gfp, #ifdef CONFIG_DMA_NUMA_CMA int nid =3D dev_to_node(dev); #endif + /* + * CoCo shared allocations require CMA alignment large enough for the + * architecture's shared-buffer granule. + */ + if (attrs & __DMA_ATTR_ALLOC_CC_SHARED) { + if (get_order(mem_cc_shared_granule_size()) > CONFIG_CMA_ALIGNMENT) + return NULL; + } =20 /* CMA can be used only in the context which permits sleeping */ if (!gfpflags_allow_blocking(gfp)) diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c index fe02e8a3c0bb..82d3ce39db0a 100644 --- a/kernel/dma/direct.c +++ b/kernel/dma/direct.c @@ -285,6 +285,9 @@ void *dma_direct_alloc(struct device *dev, size_t size, return NULL; } =20 + if (mark_mem_decrypt) + size =3D mem_cc_align_to_shared_granule(size); + /* we always manually zero the memory once we are done */ page =3D __dma_direct_alloc_pages(dev, size, gfp & ~__GFP_ZERO, allow_highmem, attrs); @@ -407,6 +410,9 @@ void dma_direct_free(struct device *dev, size_t size, /* Swiotlb doesn't need a page attribute update on free */ mark_mem_encrypted =3D false; =20 + if (mark_mem_encrypted && force_dma_unencrypted(dev)) + size =3D mem_cc_align_to_shared_granule(size); + if (is_vmalloc_addr(cpu_addr)) { vunmap(cpu_addr); } else { @@ -453,6 +459,9 @@ struct page *dma_direct_alloc_pages(struct device *dev,= size_t size, goto setup_page; } =20 + if (attrs & __DMA_ATTR_ALLOC_CC_SHARED) + size =3D mem_cc_align_to_shared_granule(size); + page =3D __dma_direct_alloc_pages(dev, size, gfp, false, attrs); if (!page) return NULL; @@ -493,8 +502,11 @@ void dma_direct_free_pages(struct device *dev, size_t = size, if (swiotlb_pool) mark_mem_encrypted =3D false; =20 - if (mark_mem_encrypted && dma_set_encrypted(dev, vaddr, size)) - return; + if (mark_mem_encrypted) { + size =3D mem_cc_align_to_shared_granule(size); + if (dma_set_encrypted(dev, vaddr, size)) + return; + } =20 if (swiotlb_pool) swiotlb_free_from_pool(dev, phys, swiotlb_pool); diff --git a/kernel/dma/pool.c b/kernel/dma/pool.c index 00f422a1e896..fc4a834aaa14 100644 --- a/kernel/dma/pool.c +++ b/kernel/dma/pool.c @@ -91,7 +91,9 @@ static int atomic_pool_expand(struct dma_gen_pool *dma_po= ol, size_t pool_size, void *addr; int ret =3D -ENOMEM; pgprot_t prot __maybe_unused; + unsigned int min_encrypt_order =3D get_order(mem_cc_shared_granule_size()= ); =20 + pool_size =3D mem_cc_align_to_shared_granule(pool_size); /* Cannot allocate larger than MAX_PAGE_ORDER */ order =3D min(get_order(pool_size), MAX_PAGE_ORDER); =20 @@ -102,7 +104,7 @@ static int atomic_pool_expand(struct dma_gen_pool *dma_= pool, size_t pool_size, order, false); if (!page) page =3D alloc_pages(gfp | __GFP_NOWARN, order); - } while (!page && order-- > 0); + } while (!page && order-- > min_encrypt_order); if (!page) goto out; =20 --=20 2.43.0 From nobody Sat Sep 26 05:27:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E97A146EF61; Fri, 4 Sep 2026 10:35:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518132; cv=none; b=seLvhuOosOv9+v+tqX0M2/NiVrZOpXGpJUUSTCf0APv2sUx3PAKfVrYOKooUG7bLE5zSdnlbKYpFnAPiKC1Tdw6luqHucVVUzc+nUxE2CFbAhWYcyoAelJt34GZqqxz8bG4vvOCs87lUVjcd6jE5YfFsgwxnlxRD403Ye5ZJPU8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518132; c=relaxed/simple; bh=hdresUF1d7ttnmA8Wb/CR7Xjkv0CEyBIqVKr8DLu4r0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=GhCBJlADB6mUgD/EkQKIA+TT70UXVX0VO66xZBuNrbNJc1WZ7rUXdnTNduFDaYfsqQcL/ZunaJNpkbV4D9K4lRgYYMqHud1cG6IDvl4Gk2yxX/TGkSGhFzeR5xY3NKiNd8HB6oLGXLVQ18vbINRTqihEE+oPyIUzFTzcF7GbUGY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=k02l9Yax; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="k02l9Yax" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 844A31F00A3E; Fri, 4 Sep 2026 10:35:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788518130; bh=ESkIGke1iFE9Q6toiTpobF2/Kkn44Z+9eDYKIOwSHmg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=k02l9Yaxmnpzl9kswKAtm4zrmDePBloJ1RK0TJ3W3Sd/TsB0j0MVjfSi1BelD0tx7 82RWtQ9ttePRC7m4TAsTbJwjabh/oSX8Kmv70VA+82SwRr/Z0EZi5nP6eH6S/lgOu1 1Wob4A9K8xTMOaQkiSdliOZAV5nRCdgy+H6NsujCMY1ElEJ40wPe2kvjafAX0lIlft fTre5+z/yfvGWx05PJHIUeHClTOkTC4YUrSDN5GSkbmrQVvr2ygEXR47cUyCEWuDDp 0voGyUvHa6pVctTPcwV/ccAqXxDsVjzZAK5x6+sYMSUQZ4+jnkhaAT+jr25AjceRrH P0s6JOjoNShZw== From: "Aneesh Kumar K.V (Arm)" To: linux-coco@lists.linux.dev, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, iommu@lists.linux.dev Cc: "Aneesh Kumar K.V (Arm)" , Catalin Marinas , Jason Gunthorpe , Marc Zyngier , Marek Szyprowski , Robin Murphy , Steven Price , Suzuki K Poulose , Thomas Gleixner , Will Deacon Subject: [PATCH v6 5/9] swiotlb: Align shared IO TLB pools to the shared granule size Date: Fri, 4 Sep 2026 16:04:48 +0530 Message-ID: <20260904103452.1197239-6-aneesh.kumar@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260904103452.1197239-1-aneesh.kumar@kernel.org> References: <20260904103452.1197239-1-aneesh.kumar@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" swiotlb pools used by confidential-computing guests are shared with the host and therefore must be converted at the host shared-granule size. A PAGE_SIZE-sized or PAGE_SIZE-aligned pool is not sufficient when the host tracks shared state at a larger granularity. Round swiotlb pool sizes to mem_cc_shared_granule_size(), allocate the pools at that alignment, and use the same aligned size when decrypting, encrypting and freeing pool memory. Apply the same rule to dynamically allocated swiotlb pools. Signed-off-by: Aneesh Kumar K.V (Arm) --- kernel/dma/swiotlb.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c index ded7016a46a7..f8936b03d942 100644 --- a/kernel/dma/swiotlb.c +++ b/kernel/dma/swiotlb.c @@ -369,7 +369,8 @@ void __init swiotlb_update_mem_attributes(void) =20 if (!mem->nslabs || mem->late_alloc) return; - bytes =3D PAGE_ALIGN(mem->nslabs << IO_TLB_SHIFT); + + bytes =3D mem_cc_align_to_shared_granule(mem->nslabs << IO_TLB_SHIFT); =20 if (io_tlb_default_mem.cc_shared) { int ret; @@ -436,8 +437,8 @@ static void __init *swiotlb_memblock_alloc(unsigned lon= g nslabs, unsigned int flags, int (*remap)(void *tlb, unsigned long nslabs)) { - size_t bytes =3D PAGE_ALIGN(nslabs << IO_TLB_SHIFT); void *tlb; + size_t bytes =3D mem_cc_align_to_shared_granule(nslabs << IO_TLB_SHIFT); =20 /* * By default allocate the bounce buffer memory from low memory, but @@ -445,9 +446,9 @@ static void __init *swiotlb_memblock_alloc(unsigned lon= g nslabs, * memory encryption. */ if (flags & SWIOTLB_ANY) - tlb =3D memblock_alloc(bytes, PAGE_SIZE); + tlb =3D memblock_alloc(bytes, mem_cc_shared_granule_size()); else - tlb =3D memblock_alloc_low(bytes, PAGE_SIZE); + tlb =3D memblock_alloc_low(bytes, mem_cc_shared_granule_size()); =20 if (!tlb) { pr_warn("%s: Failed to allocate %zu bytes tlb structure\n", @@ -456,7 +457,7 @@ static void __init *swiotlb_memblock_alloc(unsigned lon= g nslabs, } =20 if (remap && remap(tlb, nslabs) < 0) { - memblock_free(tlb, PAGE_ALIGN(bytes)); + memblock_free(tlb, bytes); pr_warn("%s: Failed to remap %zu bytes\n", __func__, bytes); return NULL; } @@ -578,7 +579,7 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask, swiotlb_adjust_nareas(num_possible_cpus()); =20 retry: - order =3D get_order(nslabs << IO_TLB_SHIFT); + order =3D get_order(mem_cc_align_to_shared_granule(nslabs << IO_TLB_SHIFT= )); nslabs =3D SLABS_PER_PAGE << order; =20 while ((SLABS_PER_PAGE << order) > IO_TLB_MIN_SLABS) { @@ -587,6 +588,8 @@ int swiotlb_init_late(size_t size, gfp_t gfp_mask, if (vstart) break; order--; + if (order < get_order(mem_cc_shared_granule_size())) + break; nslabs =3D SLABS_PER_PAGE << order; retried =3D true; } @@ -667,7 +670,7 @@ void __init swiotlb_exit(void) =20 pr_info("tearing down default memory pool\n"); tbl_vaddr =3D (unsigned long)phys_to_virt(mem->start); - tbl_size =3D PAGE_ALIGN(mem->end - mem->start); + tbl_size =3D mem_cc_align_to_shared_granule(mem->end - mem->start); slots_size =3D PAGE_ALIGN(array_size(sizeof(*mem->slots), mem->nslabs)); =20 if (io_tlb_default_mem.cc_shared) { @@ -711,12 +714,14 @@ void __init swiotlb_exit(void) static struct page *alloc_dma_pages(gfp_t gfp, size_t bytes, u64 phys_limit, unsigned long attrs) { - unsigned int order =3D get_order(bytes); bool cc_shared =3D attrs & __DMA_ATTR_ALLOC_CC_SHARED; + unsigned int order; struct page *page; phys_addr_t paddr; void *vaddr; =20 + bytes =3D mem_cc_align_to_shared_granule(bytes); + order =3D get_order(bytes); page =3D alloc_pages(gfp, order); if (!page) return NULL; @@ -807,6 +812,7 @@ static void swiotlb_free_tlb(void *vaddr, size_t bytes,= bool cc_shared) dma_free_from_pool(NULL, vaddr, bytes)) return; =20 + bytes =3D mem_cc_align_to_shared_granule(bytes); /* Intentional leak if pages cannot be encrypted again. */ if (!cc_shared || !set_memory_encrypted((unsigned long)vaddr, PFN_UP(bytes))) --=20 2.43.0 From nobody Sat Sep 26 05:27:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C4722445AC6; Fri, 4 Sep 2026 10:35:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518138; cv=none; b=m2bGtFaJVclUoUXgBwah4pQMzxpRMc5YT0DqieCXMB8pY9fOQ5f4/MCw5sNZZrFk+4Lox5bNruH/+yLleBpVDByJHgGgbifR5lZZrOCLVicyvPCyg31efqsTgaRwcysyDehZ1j51NtTW6Kekpz86SS6mA/ecehn84mACgfNZfDA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518138; c=relaxed/simple; bh=ifGW4IhadanzTNkJq0sUWSJNoZHVkSGpNG64Glyf8lk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=clQfFzUJx6sCHK5z5vt3pHpEEZ1TRSY5GTjQQIg2rSjtLHTdWbweZkSlk0h/LelaKZ2Vr8L3XjSQSQvxzFhR8EUNr74HrJwg0/fAcQIkcKSjYP7+DdfWOZqSzhtbG0NNL6cLs69/G6ADizJV7SfE+6WRp0ow58sUGw4H4h09l+s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=NtwiJQNm; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="NtwiJQNm" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3F5E11F00A3D; Fri, 4 Sep 2026 10:35:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788518136; bh=zdjsjsW7gTao4JGqSdtTZcqDO/daSds2ybCp3eONEAQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=NtwiJQNmBfj5pcFUU1SRjet42Lr3ykAyOTfvl5s/CFq27c/0PRf0StcdZDxH3Jb66 oMa/1VFXy+THz5WtX9Pv5+h/lZn1yVb1miLtQLueNchM3UqjnE8VK+Lrp9l8AdqKG8 bxVd8V1DQEGLD8bexSfbqdXI6iyLTuIH8wDGSAwK8kwaQ9uKl0OHcZEqWNnogotGfr HkMLklu1eRbRSlU9OD4TNxiqb7nuVI7K4we3NHhhEAXsMr/X0F6r/bG8zokaU052sc nUxUgwa4LAVh8ideLSiv7yVMlmqQKLqib2U2W8a7Yeju2fuk3BXmeyM4Mvo2cuQ5sE 3E2H3TV5eC4Sw== From: "Aneesh Kumar K.V (Arm)" To: linux-coco@lists.linux.dev, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, iommu@lists.linux.dev Cc: "Aneesh Kumar K.V (Arm)" , Catalin Marinas , Jason Gunthorpe , Marc Zyngier , Marek Szyprowski , Robin Murphy , Steven Price , Suzuki K Poulose , Thomas Gleixner , Will Deacon Subject: [PATCH v6 6/9] swiotlb: Reject misaligned restricted DMA pools for CoCo guests Date: Fri, 4 Sep 2026 16:04:49 +0530 Message-ID: <20260904103452.1197239-7-aneesh.kumar@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260904103452.1197239-1-aneesh.kumar@kernel.org> References: <20260904103452.1197239-1-aneesh.kumar@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Restricted DMA pools are described by firmware reserved-memory nodes and are not resized or realigned by the kernel. For confidential-computing guests, such pools can only be shared safely when both the base address and size are aligned to the shared-granule size. Reject restricted DMA pools that are not aligned to mem_cc_shared_granule_size() when guest memory encryption is active. Signed-off-by: Aneesh Kumar K.V (Arm) --- kernel/dma/swiotlb.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c index f8936b03d942..d1bd06be628d 100644 --- a/kernel/dma/swiotlb.c +++ b/kernel/dma/swiotlb.c @@ -2037,6 +2037,20 @@ static int rmem_swiotlb_device_init(struct reserved_= mem *rmem, * if platform supports memory encryption, * restricted mem pool is shared by default */ + if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT)) { + size_t cc_shared_granule_size =3D mem_cc_shared_granule_size(); + + if (!IS_ALIGNED(rmem->base, cc_shared_granule_size) || + !IS_ALIGNED(rmem->size, cc_shared_granule_size)) { + dev_err(dev, "Restricted DMA pool must be aligned to %#zx bytes for me= mory encryption\n", + cc_shared_granule_size); + kfree(pool->areas); + kfree(pool->slots); + kfree(mem); + return -EINVAL; + } + } + if (cc_platform_has(CC_ATTR_MEM_ENCRYPT)) { int ret; =20 --=20 2.43.0 From nobody Sat Sep 26 05:27:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6708446AF1B; Fri, 4 Sep 2026 10:35:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518144; cv=none; b=aRT5QukXv2JbG8/3jLr9FKKv/hxB83jBgrW8BJeBWb09G+GQCqB+I3f15lkKJL8sRaMnVQcH+aqp08MnFkRHtzoV5PWyne6Mms4a6AEjh2r2qTrWj3GHjE3VVnh1+AtZNr44HWA0WyuTYW2dlIQoBR2TfbbCWhUcSEWag7tVe4g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518144; c=relaxed/simple; bh=6Emig9//T2dSJ2I19kbsWa5yXWNMzvoSSFCcG6vna6o=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uBUunFeKwQFfWOBZCvadtC7DVJOg7xRSIGQvjnfeHOuw8mRPMc+6Q3ypO3Xt68kAhZAvZ8oeS5x9N5eJuRUrYeyh4He1oJjE0ZsIZ73eENkBc4lLSzwtAImLWcN1rIS0UzBK17ddS8ot7RJOqJODrSqXsCOYQ+Upk4Oo8PfXZSI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=HmBc88Sd; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="HmBc88Sd" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EF3DB1F00A3E; Fri, 4 Sep 2026 10:35:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788518142; bh=SRAlXDC5oqmsaoNnYadnzJXzxvCqL4owp1KVT95a8j0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=HmBc88SdcpB3sLSsxItcqYlx2jCkHAbj9Bncs+n91l+n9B+Stp2LJFgicwO3sQY+o q3ZNLnkrb8TZA/OiFg+s/ASpmDPKvhP1dap1Tw6rHbrSQqu8Mtuq2hadF0l5fNZODj U9o4opHpdRWCrUjRhPgaJ7km1q+9LW58RP0ftAw1jiFbJ0gY/rCDl3xwFaHd9pnhmY 7vwK5pqh+HiXjnPllikjkUPkZ8acS+SSdD0BidBGJa1hZqGoR3edxRSJ4i7qb1Kh7h jEMgZJRCqJEXhzlOgXRAJp2gB6mnsYT01Ouwbqpr+J4H5fr1fsnc5MBylkorftR155 159D+KNtdrmYw== From: "Aneesh Kumar K.V (Arm)" To: linux-coco@lists.linux.dev, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, iommu@lists.linux.dev Cc: "Aneesh Kumar K.V (Arm)" , Catalin Marinas , Jason Gunthorpe , Marc Zyngier , Marek Szyprowski , Robin Murphy , Steven Price , Suzuki K Poulose , Thomas Gleixner , Will Deacon Subject: [PATCH v6 7/9] dma-buf: system_heap: Enforce shared-granule alignment for cc-shared buffers Date: Fri, 4 Sep 2026 16:04:50 +0530 Message-ID: <20260904103452.1197239-8-aneesh.kumar@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260904103452.1197239-1-aneesh.kumar@kernel.org> References: <20260904103452.1197239-1-aneesh.kumar@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The system heap can allocate buffers that are decrypted and shared with the host. For confidential-computing guests, those shared buffers must cover whole shared-buffer granule; otherwise a userspace mmap of the dma-buf may expose only part of a host-managed granule and allow unintended access to adjacent private memory. Require cc-shared system-heap allocations to have a size aligned to mem_cc_shared_granule_size(), and allocate pages at least as large as the required granule. Keep the allocation bounded by the existing heap orders, but fall back to an exact minimum-order allocation when the required granule is not one of the preferred heap orders. Signed-off-by: Aneesh Kumar K.V (Arm) --- drivers/dma-buf/heaps/system_heap.c | 50 +++++++++++++++++++++++------ 1 file changed, 41 insertions(+), 9 deletions(-) diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/sy= stem_heap.c index c8959eadc71d..9cbfcebe2088 100644 --- a/drivers/dma-buf/heaps/system_heap.c +++ b/drivers/dma-buf/heaps/system_heap.c @@ -55,7 +55,6 @@ struct dma_heap_attachment { #define HIGH_ORDER_GFP (((GFP_HIGHUSER | __GFP_ZERO | __GFP_NOWARN \ | __GFP_NORETRY) & ~__GFP_RECLAIM) \ | __GFP_COMP) -static gfp_t order_flags[] =3D {HIGH_ORDER_GFP, HIGH_ORDER_GFP, LOW_ORDER_= GFP}; /* * The selection of the orders used for allocation (1MB, 64K, 4K) is desig= ned * to match with the sizes often found in IOMMUs. Using order 4 pages inst= ead @@ -375,26 +374,44 @@ static const struct dma_buf_ops system_heap_buf_ops = =3D { .release =3D system_heap_dma_buf_release, }; =20 +static struct page *system_heap_alloc_order(unsigned int order) +{ + gfp_t flags =3D order ? HIGH_ORDER_GFP : LOW_ORDER_GFP; + + if (mem_accounting) + flags |=3D __GFP_ACCOUNT; + + return alloc_pages(flags, order); +} + static struct page *alloc_largest_available(unsigned long size, - unsigned int max_order) + unsigned int max_order, + unsigned int min_order) { struct page *page; int i; - gfp_t flags; =20 for (i =3D 0; i < NUM_ORDERS; i++) { if (size < (PAGE_SIZE << orders[i])) continue; - if (max_order < orders[i]) + + if (max_order < orders[i] || orders[i] < min_order) continue; - flags =3D order_flags[i]; - if (mem_accounting) - flags |=3D __GFP_ACCOUNT; - page =3D alloc_pages(flags, orders[i]); + + page =3D system_heap_alloc_order(orders[i]); if (!page) continue; return page; } + /* + * The required minimum order might not be one of the preferred heap + * orders. Allocate exactly min_order when it does not exceed the + * remaining size. + */ + if (min_order && min_order <=3D max_order && + size >=3D (PAGE_SIZE << min_order)) + return system_heap_alloc_order(min_order); + return NULL; } =20 @@ -409,6 +426,8 @@ static struct dma_buf *system_heap_allocate(struct dma_= heap *heap, unsigned int max_order =3D orders[0]; struct system_heap_priv *priv =3D dma_heap_get_drvdata(heap); bool cc_shared =3D priv->cc_shared; + unsigned int min_order =3D 0; + size_t cc_granule_size; struct dma_buf *dmabuf; struct sg_table *table; struct scatterlist *sg; @@ -425,6 +444,18 @@ static struct dma_buf *system_heap_allocate(struct dma= _heap *heap, buffer->heap =3D heap; buffer->len =3D len; buffer->cc_shared =3D cc_shared; + if (cc_shared_buffer(buffer)) { + cc_granule_size =3D mem_cc_shared_granule_size(); + if (!IS_ALIGNED(len, cc_granule_size)) { + ret =3D -EINVAL; + goto free_buffer; + } + min_order =3D get_order(cc_granule_size); + if (min_order > max_order) { + ret =3D -EINVAL; + goto free_buffer; + } + } =20 INIT_LIST_HEAD(&pages); i =3D 0; @@ -438,7 +469,8 @@ static struct dma_buf *system_heap_allocate(struct dma_= heap *heap, goto free_buffer; } =20 - page =3D alloc_largest_available(size_remaining, max_order); + page =3D alloc_largest_available(size_remaining, max_order, + min_order); if (!page) goto free_buffer; =20 --=20 2.43.0 From nobody Sat Sep 26 05:27:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3EA6242B327; Fri, 4 Sep 2026 10:35:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518150; cv=none; b=L1i5CyZcC+/6oKGCnujvEYBgpdHwe7aZNSZfPVXdhq2p8uS5Y6cHE4fDAvTUw2Uvgp3SXAFVOWyn6J5v/pONqpvQZJ7AV8+dNeAeJkkfLQtiz4C4G4knpb4eOU3eWj173cX3Uh78xNe7mSwcRtyQwtgyKYzSAe8KEieTohE4k1g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518150; c=relaxed/simple; bh=SPD7jwCA+0OipeuwCBppuiwCEwdNcIigiEdQ1zr2ctI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BRpUYAQmbOocFQyqfwUIwFREIOMcfZDshYllKd69xjYRPDkZI3Sj5aTlum10Lav5dKVjau7QWiBBy1J4rXHOnPSQP7L6HpSjZD6W6UbsWSZo5Ayxn8cck+A8TyiNPmD9yAhXKChyc7cZXseUW/ZSQgdzsV0JBLb3BetUbft3iZ0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=afAcEPt7; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="afAcEPt7" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AA8701F00A3D; Fri, 4 Sep 2026 10:35:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788518147; bh=ZGmY6QlBMQ2SHa5L+lxqX371JcTBS0qRTbNtw3modBQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=afAcEPt7t2fdenCPFl8yuDLqP8SmdEH9gpHntfCODggDHUt2jjg5qreIkzdmOXlYA x4ews9cAZJ9O6CjUnfOam1vQY8XW1bLQoMaElEYjJfzdeQwdVPo57aMaQ+MYlChkb/ jncSj7jtk42gDhf5YfbIGQoKcLXDMu//IB+ZnaE6FdCfUulrbI7zRbsNHkkNJHD+WN tEzMjDkLTHrxH477gaEEWmumqlAOVuF7yPiFMW93YQOQ7KzLNllD7yjHdOLglOkK7q waPxaRvuNvR1faxdAgrGT1UZ63WzM64kCzi8pg8+2UjETDcJ5i1i+0lJGOoibAt5rf 1EUc3qohWpZBA== From: "Aneesh Kumar K.V (Arm)" To: linux-coco@lists.linux.dev, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, iommu@lists.linux.dev Cc: "Aneesh Kumar K.V (Arm)" , Catalin Marinas , Jason Gunthorpe , Marc Zyngier , Marek Szyprowski , Robin Murphy , Steven Price , Suzuki K Poulose , Thomas Gleixner , Will Deacon Subject: [PATCH v6 8/9] arm64: realm: Add RHI helper to query IPA state change alignment Date: Fri, 4 Sep 2026 16:04:51 +0530 Message-ID: <20260904103452.1197239-9-aneesh.kumar@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260904103452.1197239-1-aneesh.kumar@kernel.org> References: <20260904103452.1197239-1-aneesh.kumar@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Arm CCA guests need to know the granularity at which the host expects IPA state changes to be performed. This can be larger than the guest page size and is needed when deciding the alignment for memory shared with the host. Add the Realm Host Interface host configuration definitions and an get_ipa_state_change_alignment() helper. The helper uses RSI_HOST_CALL to query the supported HostConf version and features, reads the IPA change alignment when available, and falls back to PAGE_SIZE if the interface is unavailable or returns an invalid value. Signed-off-by: Aneesh Kumar K.V (Arm) --- drivers/firmware/arm_rmm/rsi.c | 46 ++++++++++++++++++++++++++++++++++ include/linux/arm-rsi-cmds.h | 10 ++++++++ include/linux/arm-smccc-rhi.h | 25 ++++++++++++++++++ include/linux/arm-smccc-rsi.h | 7 ++++++ 4 files changed, 88 insertions(+) create mode 100644 include/linux/arm-smccc-rhi.h diff --git a/drivers/firmware/arm_rmm/rsi.c b/drivers/firmware/arm_rmm/rsi.c index 52f40256bd78..2cd53f82432f 100644 --- a/drivers/firmware/arm_rmm/rsi.c +++ b/drivers/firmware/arm_rmm/rsi.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include =20 @@ -164,6 +165,51 @@ static int realm_register_memory_enc_ops(void) return arm64_mem_crypt_ops_register(&realm_crypt_ops); } =20 +/* we need an aligned struct for rsi_host_call. slab is not yet ready */ +static struct rsi_host_call hostconf_call __initdata; +static unsigned long __maybe_unused __init get_ipa_state_change_alignment(= void) +{ + long ret; + unsigned long shared_granule_size; + + hostconf_call.imm =3D 0; + hostconf_call.gprs[0] =3D RHI_HOSTCONF_VERSION; + ret =3D rsi_host_call(lm_alias(&hostconf_call)); + if (ret !=3D RSI_SUCCESS) + goto err_out; + + if (hostconf_call.gprs[0] !=3D RHI_HOSTCONF_VER_1_0) + goto err_out; + + hostconf_call.imm =3D 0; + hostconf_call.gprs[0] =3D RHI_HOSTCONF_FEATURES; + ret =3D rsi_host_call(lm_alias(&hostconf_call)); + if (ret !=3D RSI_SUCCESS) + goto err_out; + + if (!(hostconf_call.gprs[0] & __RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT)) + goto err_out; + + hostconf_call.imm =3D 0; + hostconf_call.gprs[0] =3D RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT; + ret =3D rsi_host_call(lm_alias(&hostconf_call)); + if (ret !=3D RSI_SUCCESS) + goto err_out; + + shared_granule_size =3D hostconf_call.gprs[0]; + if (shared_granule_size & (SZ_4K - 1) || + !is_power_of_2(shared_granule_size)) + goto err_out; + + return max(PAGE_SIZE, shared_granule_size); +err_out: + /* + * For failure condition assume host is built with 4K page size + * and hence IPA state change alignment can be guest PAGE_SIZE. + */ + return PAGE_SIZE; +} + void __init arm64_rsi_init(void) { if (arm_smccc_1_1_get_conduit() !=3D SMCCC_CONDUIT_SMC) diff --git a/include/linux/arm-rsi-cmds.h b/include/linux/arm-rsi-cmds.h index 3f7a6a833993..996f1621b996 100644 --- a/include/linux/arm-rsi-cmds.h +++ b/include/linux/arm-rsi-cmds.h @@ -236,4 +236,14 @@ static inline unsigned long rsi_attestation_token_cont= inue(phys_addr_t granule, return res.a0; } =20 +static inline unsigned long rsi_host_call(struct rsi_host_call *rhi_call) +{ + phys_addr_t addr =3D virt_to_phys(rhi_call); + struct arm_smccc_res res; + + arm_smccc_1_1_invoke(SMC_RSI_HOST_CALL, addr, &res); + + return res.a0; +} + #endif /* __LINUX_ARM_RSI_CMDS_H_ */ diff --git a/include/linux/arm-smccc-rhi.h b/include/linux/arm-smccc-rhi.h new file mode 100644 index 000000000000..91a29996d72d --- /dev/null +++ b/include/linux/arm-smccc-rhi.h @@ -0,0 +1,25 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Copyright (C) 2026 ARM Ltd. + */ + +#ifndef __LINUX_ARM_SMCCC_RHI_H_ +#define __LINUX_ARM_SMCCC_RHI_H_ + +#include + +#define SMC_RHI_CALL(func) \ + ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \ + ARM_SMCCC_SMC_64, \ + ARM_SMCCC_OWNER_STANDARD_HYP,\ + (func)) + +#define RHI_HOSTCONF_VER_1_0 0x10000 +#define RHI_HOSTCONF_VERSION SMC_RHI_CALL(0x004E) + +#define __RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT BIT(0) +#define RHI_HOSTCONF_FEATURES SMC_RHI_CALL(0x004F) + +#define RHI_HOSTCONF_GET_IPA_CHANGE_ALIGNMENT SMC_RHI_CALL(0x0050) + +#endif /* __LINUX_ARM_SMCCC_RHI_H_ */ diff --git a/include/linux/arm-smccc-rsi.h b/include/linux/arm-smccc-rsi.h index fddb77986f70..3532a3f08f4e 100644 --- a/include/linux/arm-smccc-rsi.h +++ b/include/linux/arm-smccc-rsi.h @@ -182,6 +182,13 @@ struct realm_config { */ #define SMC_RSI_IPA_STATE_GET SMC_RSI_FID(0x198) =20 +struct rsi_host_call { + union { + u16 imm; + u64 padding0; + }; + u64 gprs[31]; +} __aligned(0x100); /* * Make a Host call. * --=20 2.43.0 From nobody Sat Sep 26 05:27:41 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 25AED47143A; Fri, 4 Sep 2026 10:35:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518156; cv=none; b=Iexdq0BLogUJ3wa4S70iwdAgXwO55IZSUOWJX6/24xXwJSJLF7z+FnAJdTwHLDNFGxtSeWjFktcDzvA8udonY+lGvKxPzzKPi6Qip/VGMb4NcwfmidJh+dCY+YEGHaa3MtfFo+LdqQ3i11e/NL4CvV+uQFj/jet5yI0/y7Q2XJQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788518156; c=relaxed/simple; bh=nd6sf8naTpyYqcNuS3y+EeUYR4Zl5gEmukrd0lFeVSc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=jP00SoZSDtNlRqU0JtMqx/RNrs8upjF/bevVg7NzEGgezgn+CFQTyUGGZegl1tBzjmm8Mx8SONQ2tf3DGgRoHkXVJ1lfe8I0k6P4++nxSui1seV8WlYIyUzvWCfG6RDOxU9t9NL3xhLgnsRcxUTcTSUfdT/h1UEGwvzV1ZUWi7c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Ag3TqrjJ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Ag3TqrjJ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 65AAD1F00A3E; Fri, 4 Sep 2026 10:35:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788518153; bh=u9I2WPocLUacIb6MXv6UW+BXVCGDKNGSQF8ffRh5uJE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Ag3TqrjJK6NyKSY5HFriLni2RYiMqOyiczi4SedYu9aoxcW7VAiIQmq3OgqnuN+lO t48NCzb9u4ItoAs2nwdCm3BWWbyM8Xvcw4b6JOsIo8nyL+wIOL70dofHXvFQelH2ac rn+fVTW4+VlGbZZYilrDNAqmBV+FoOb6MZh3IgTYfl8Q4U4ujL6wxVBM1KCNyVlsKS nK/KT/uyhGZUhQI6zI29x8SiDyrL1zQquaWzefOINBzcZVtLdxb6pPiclH0+ORPito iSkjUKubJh7FuCBbH0uEHgDigwKXqLbpesSLWU023N2AVQpJipCrJ3qgT24kYgyhoC RwplQVNBH5AaQ== From: "Aneesh Kumar K.V (Arm)" To: linux-coco@lists.linux.dev, kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, iommu@lists.linux.dev Cc: "Aneesh Kumar K.V (Arm)" , Catalin Marinas , Jason Gunthorpe , Marc Zyngier , Marek Szyprowski , Robin Murphy , Steven Price , Suzuki K Poulose , Thomas Gleixner , Will Deacon Subject: [PATCH v6 9/9] arm64: realm: Expose the CCA shared granule size through mem_encrypt ops Date: Fri, 4 Sep 2026 16:04:52 +0530 Message-ID: <20260904103452.1197239-10-aneesh.kumar@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260904103452.1197239-1-aneesh.kumar@kernel.org> References: <20260904103452.1197239-1-aneesh.kumar@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" CCA guests must align shared/private memory transitions to the size reported by the host for IPA state changes. This size can be larger than PAGE_SIZE, so allowing a guest to convert only a PAGE_SIZE-sized subrange can leave the remaining part of that host-sized range in the wrong state. Cache the RHI-reported IPA sate change alignment during Realm initialization and expose it through a new arm64 mem_encrypt callback. Use PAGE_SIZE as the default shared granule size when no backend callback is registered. Validate both the address and byte size passed to set_memory_encrypted() and set_memory_decrypted() against mem_cc_shared_granule_size() before calling into the backend. This prevents callers from converting only part of a host-managed page. Signed-off-by: Aneesh Kumar K.V (Arm) Reviewed-by: Suzuki K Poulose --- arch/arm64/include/asm/mem_encrypt.h | 4 ++++ arch/arm64/mm/mem_encrypt.c | 32 ++++++++++++++++++++++++---- drivers/firmware/arm_rmm/rsi.c | 13 ++++++++++- 3 files changed, 44 insertions(+), 5 deletions(-) diff --git a/arch/arm64/include/asm/mem_encrypt.h b/arch/arm64/include/asm/= mem_encrypt.h index ef8b8463e52b..890faeed0eb3 100644 --- a/arch/arm64/include/asm/mem_encrypt.h +++ b/arch/arm64/include/asm/mem_encrypt.h @@ -10,6 +10,7 @@ struct device; struct arm64_mem_crypt_ops { int (*encrypt)(unsigned long addr, int numpages); int (*decrypt)(unsigned long addr, int numpages); + size_t (*cc_shared_granule_size)(void); }; =20 int arm64_mem_crypt_ops_register(const struct arm64_mem_crypt_ops *ops); @@ -18,6 +19,9 @@ int set_memory_encrypted(unsigned long addr, int numpages= ); int set_memory_decrypted(unsigned long addr, int numpages); int __set_memory_enc_dec(unsigned long addr, int numpages, bool encrypt); =20 +#define mem_cc_shared_granule_size mem_cc_shared_granule_size +size_t mem_cc_shared_granule_size(void); + static inline bool force_dma_unencrypted(struct device *dev) { return is_realm_world() || is_protected_kvm_guest(); diff --git a/arch/arm64/mm/mem_encrypt.c b/arch/arm64/mm/mem_encrypt.c index ee3c0ab04384..69783c6a3c08 100644 --- a/arch/arm64/mm/mem_encrypt.c +++ b/arch/arm64/mm/mem_encrypt.c @@ -17,8 +17,7 @@ #include #include #include - -#include +#include =20 static const struct arm64_mem_crypt_ops *crypt_ops; =20 @@ -33,18 +32,43 @@ int arm64_mem_crypt_ops_register(const struct arm64_mem= _crypt_ops *ops) =20 int set_memory_encrypted(unsigned long addr, int numpages) { - if (likely(!crypt_ops) || WARN_ON(!PAGE_ALIGNED(addr))) + unsigned long size =3D (unsigned long)numpages << PAGE_SHIFT; + + if (likely(!crypt_ops)) return 0; =20 + if (WARN_ON(!IS_ALIGNED(addr, mem_cc_shared_granule_size()))) + return -EINVAL; + + if (WARN_ON(!IS_ALIGNED(size, mem_cc_shared_granule_size()))) + return -EINVAL; + return crypt_ops->encrypt(addr, numpages); } EXPORT_SYMBOL_GPL(set_memory_encrypted); =20 int set_memory_decrypted(unsigned long addr, int numpages) { - if (likely(!crypt_ops) || WARN_ON(!PAGE_ALIGNED(addr))) + unsigned long size =3D (unsigned long)numpages << PAGE_SHIFT; + + if (likely(!crypt_ops)) return 0; =20 + if (WARN_ON(!IS_ALIGNED(addr, mem_cc_shared_granule_size()))) + return -EINVAL; + + if (WARN_ON(!IS_ALIGNED(size, mem_cc_shared_granule_size()))) + return -EINVAL; + return crypt_ops->decrypt(addr, numpages); } EXPORT_SYMBOL_GPL(set_memory_decrypted); + +size_t mem_cc_shared_granule_size(void) +{ + if (likely(!crypt_ops) || !crypt_ops->cc_shared_granule_size) + return PAGE_SIZE; + + return crypt_ops->cc_shared_granule_size(); +} +EXPORT_SYMBOL_GPL(mem_cc_shared_granule_size); diff --git a/drivers/firmware/arm_rmm/rsi.c b/drivers/firmware/arm_rmm/rsi.c index 2cd53f82432f..eeb797c6c2c7 100644 --- a/drivers/firmware/arm_rmm/rsi.c +++ b/drivers/firmware/arm_rmm/rsi.c @@ -19,6 +19,7 @@ =20 static struct realm_config config; static struct kobject *cca_kobj; +static unsigned long ipa_state_change_granule_size; =20 unsigned long prot_ns_shared; EXPORT_SYMBOL(prot_ns_shared); @@ -155,9 +156,17 @@ static int realm_set_memory_decrypted(unsigned long ad= dr, int numpages) return ret; } =20 +static size_t realm_cc_shared_granule_size(void) +{ + if (is_realm_world()) + return ipa_state_change_granule_size; + return PAGE_SIZE; +} + static const struct arm64_mem_crypt_ops realm_crypt_ops =3D { .encrypt =3D realm_set_memory_encrypted, .decrypt =3D realm_set_memory_decrypted, + .cc_shared_granule_size =3D realm_cc_shared_granule_size, }; =20 static int realm_register_memory_enc_ops(void) @@ -167,7 +176,7 @@ static int realm_register_memory_enc_ops(void) =20 /* we need an aligned struct for rsi_host_call. slab is not yet ready */ static struct rsi_host_call hostconf_call __initdata; -static unsigned long __maybe_unused __init get_ipa_state_change_alignment(= void) +static unsigned long __init get_ipa_state_change_alignment(void) { long ret; unsigned long shared_granule_size; @@ -218,6 +227,8 @@ void __init arm64_rsi_init(void) return; if (WARN_ON(rsi_get_realm_config(lm_alias(&config)))) return; + + ipa_state_change_granule_size =3D get_ipa_state_change_alignment(); prot_ns_shared =3D __phys_to_pte_val(BIT(config.ipa_bits - 1)); =20 if (arm64_ioremap_prot_hook_register(realm_ioremap_hook)) --=20 2.43.0