On Thu, Aug 20, 2026 at 02:47:39PM -0300, Jason Gunthorpe wrote:
On Thu, Aug 20, 2026 at 06:44:43PM +0100, Catalin Marinas wrote:
On Thu, Aug 20, 2026 at 04:00:30PM +0100, Steven Price wrote:
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 6f5811aae59c..a055837832bc 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -213,16 +213,18 @@ static gfp_t gfp_flags_quirk; static struct page *its_alloc_pages_node(int node, gfp_t gfp, unsigned int order) {
- bool want_zero = gfp & __GFP_ZERO; struct page *page; int ret = 0;
- page = alloc_pages_node(node, gfp | gfp_flags_quirk, order);
- page = alloc_pages_node(node, (gfp & ~__GFP_ZERO) | gfp_flags_quirk,
order);I don't think pKVM does any scrubbing on set_memory_decrypted(), so it potentially exposes confidential guest data before it reaches clear_pages() below.
IMHO that has got to be handled in the arch code implementing set memory decrypted.
I guess that's a better separation. It probably needs to clear the MTE tags as well, it's not great to leak them (though not as bad as leaking data).
OTOH, pKVM would no longer need the clear_pages() afterwards since there's no encryption key changed. Not too bad, it's not a hot path.
Further pointing that maybe we should have an alloc decrypted so we can at least try to minimize the number of times we write to this memory. :(
This would be better.