CCA guests must align shared/private memory transitions to the IPA state change alignment reported by the host. This alignment can be larger than PAGE_SIZE, so transitioning only a PAGE_SIZE-sized subrange may leave part of the host-managed granule in the wrong state.
Cache the RHI-reported alignment during Realm initialization and expose it through the arm64 memory encryption operations. Implement arch_cc_shared_granule_size() so the common CoCo shared-memory allocator uses the same constraint. Use PAGE_SIZE when no suitable backend is registered. The common cc_make_shared() and cc_make_private() wrappers validate both the base and size against the architecture's shared granule size. Remove the PAGE_SIZE-only address checks from the lower-level arm64 transition hooks so that range validation remains in the common wrappers. Signed-off-by: Aneesh Kumar K.V (Arm) <[email protected]> --- arch/arm64/include/asm/mem_encrypt.h | 1 + arch/arm64/mm/mem_encrypt.c | 13 +++++++++++-- drivers/firmware/arm_rmm/rsi.c | 13 ++++++++++++- 3 files changed, 24 insertions(+), 3 deletions(-) diff --git a/arch/arm64/include/asm/mem_encrypt.h b/arch/arm64/include/asm/mem_encrypt.h index ef8b8463e52b..32064338c9b0 100644 --- a/arch/arm64/include/asm/mem_encrypt.h +++ b/arch/arm64/include/asm/mem_encrypt.h @@ -10,6 +10,7 @@ struct device; struct arm64_mem_crypt_ops { int (*encrypt)(unsigned long addr, int numpages); int (*decrypt)(unsigned long addr, int numpages); + size_t (*shared_granule_size)(void); }; int arm64_mem_crypt_ops_register(const struct arm64_mem_crypt_ops *ops); diff --git a/arch/arm64/mm/mem_encrypt.c b/arch/arm64/mm/mem_encrypt.c index ee3c0ab04384..e6c059d20595 100644 --- a/arch/arm64/mm/mem_encrypt.c +++ b/arch/arm64/mm/mem_encrypt.c @@ -16,6 +16,7 @@ #include <linux/bug.h> #include <linux/compiler.h> #include <linux/err.h> +#include <linux/cc_shared.h> #include <linux/mm.h> #include <asm/mem_encrypt.h> @@ -33,7 +34,7 @@ int arm64_mem_crypt_ops_register(const struct arm64_mem_crypt_ops *ops) int set_memory_encrypted(unsigned long addr, int numpages) { - if (likely(!crypt_ops) || WARN_ON(!PAGE_ALIGNED(addr))) + if (likely(!crypt_ops)) return 0; return crypt_ops->encrypt(addr, numpages); @@ -42,9 +43,17 @@ EXPORT_SYMBOL_GPL(set_memory_encrypted); int set_memory_decrypted(unsigned long addr, int numpages) { - if (likely(!crypt_ops) || WARN_ON(!PAGE_ALIGNED(addr))) + if (likely(!crypt_ops)) return 0; return crypt_ops->decrypt(addr, numpages); } EXPORT_SYMBOL_GPL(set_memory_decrypted); + +size_t arch_cc_shared_granule_size(void) +{ + if (likely(!crypt_ops) || !crypt_ops->shared_granule_size) + return PAGE_SIZE; + + return crypt_ops->shared_granule_size(); +} diff --git a/drivers/firmware/arm_rmm/rsi.c b/drivers/firmware/arm_rmm/rsi.c index 883f6091ff95..b59099d1f318 100644 --- a/drivers/firmware/arm_rmm/rsi.c +++ b/drivers/firmware/arm_rmm/rsi.c @@ -18,6 +18,7 @@ #include <asm/pgtable.h> static struct realm_config config; +static size_t ipa_state_change_alignment = PAGE_SIZE; unsigned long prot_ns_shared; EXPORT_SYMBOL(prot_ns_shared); @@ -154,9 +155,17 @@ static int realm_set_memory_decrypted(unsigned long addr, int numpages) return ret; } +static size_t realm_shared_granule_size(void) +{ + if (is_realm_world()) + return ipa_state_change_alignment; + return PAGE_SIZE; +} + static const struct arm64_mem_crypt_ops realm_crypt_ops = { .encrypt = realm_set_memory_encrypted, .decrypt = realm_set_memory_decrypted, + .shared_granule_size = realm_shared_granule_size, }; static int realm_register_memory_enc_ops(void) @@ -166,7 +175,7 @@ static int realm_register_memory_enc_ops(void) /* we need an aligned struct for rsi_host_call. slab is not yet ready */ static struct rsi_host_call hostconf_call __initdata; -static unsigned long __maybe_unused __init get_ipa_state_change_alignment(void) +static unsigned long __init get_ipa_state_change_alignment(void) { long ret; unsigned long shared_granule_size; @@ -217,6 +226,8 @@ void __init arm64_rsi_init(void) return; if (WARN_ON(rsi_get_realm_config(lm_alias(&config)))) return; + + ipa_state_change_alignment = get_ipa_state_change_alignment(); prot_ns_shared = __phys_to_pte_val(BIT(config.ipa_bits - 1)); if (arm64_ioremap_prot_hook_register(realm_ioremap_hook)) -- 2.43.0
