[PATCH v6 7/9] dma-buf: system_heap: Enforce shared-granule alignment for cc-shared buffers

[Aneesh Kumar K.V]

Jason Gunthorpe <jgg at ziepe.ca> writes:

> On Fri, Sep 18, 2026 at 05:23:32PM +0200, Christian König wrote:
>> On 9/18/26 17:16, Catalin Marinas wrote:
>> > First, none of the DMA-BUF maintainers have been cc'ed. It might be fine
>> > for an RFC but this series got to version 6. We need their feedback.
>> 
>> Yeah, thanks for doing this.
>> > On Fri, Sep 04, 2026 at 04:04:50PM +0530, Aneesh Kumar K.V (Arm) wrote:
>> >> The system heap can allocate buffers that are decrypted and shared with the
>> >> host. For confidential-computing guests, those shared buffers must cover
>> >> whole shared-buffer granule; otherwise a userspace mmap of the dma-buf may
>> >> expose only part of a host-managed granule and allow unintended access to
>> >> adjacent private memory.
>> >>
>> >> Require cc-shared system-heap allocations to have a size aligned to
>> >> mem_cc_shared_granule_size(), and allocate pages at least as large as the
>> >> required granule. Keep the allocation bounded by the existing heap orders,
>> >> but fall back to an exact minimum-order allocation when the required
>> >> granule is not one of the preferred heap orders.
>> 
>> Uff, I don't think we can do that.
>> 
>> That is massively platform specific behavior in a non platform
>> specific code.
>
> What we really need is an allocator API that does all this for the caller.
>
> It has been pointed out a few times, Aneesh maybe you need to try to
> tackle that?
>
> dmabuf heap just wants
>
> 'allocate me an array of shared folios totaling XX bytes'
>
> Arch code can figure out how to do it. If some ARM configs only give
> order 4 folios or whatever then dmabuf heap doesn't care.
>
> And solve the double/triple zeroing problem.
>

Agreed. Moving all the CoCo shared-allocation rules into one place makes
this easier to follow.

+static struct page *system_heap_alloc_order(unsigned int order, gfp_t flags,
+					    bool cc_shared)
+{
+	struct cc_shared_pages mem;
+
+	if (!cc_shared)
+		return alloc_pages(flags, order);
+
+	/* The shared granule can raise the actual allocation order. */
+	flags |= __GFP_COMP;
+	if (alloc_cc_shared_pages(flags, PAGE_SIZE << order, &mem))
+		return NULL;
+
+	return mem.page;
+}
+
 static struct page *alloc_largest_available(unsigned long size,
-					    unsigned int max_order)
+					    unsigned int max_order,
+					    bool cc_shared)
 {
 	struct page *page;
	int i;
 	gfp_t flags;
 
 	for (i = 0; i < NUM_ORDERS; i++) {
 		if (size <  (PAGE_SIZE << orders[i]))
 			continue;
 		if (max_order < orders[i])
 			continue;
 		flags = order_flags[i];
 		if (mem_accounting)
 			flags |= __GFP_ACCOUNT;
-		page = alloc_pages(flags, orders[i]);
+		page = system_heap_alloc_order(orders[i], flags, cc_shared);
 		if (!page)
 			continue;
 		return page;


with mm/cc_shared.c having

int alloc_cc_shared_pages_node(int nid, gfp_t gfp, size_t requested,
			       struct cc_shared_pages *mem)
{
	struct cc_shared_layout layout;
	struct page *page;
	unsigned int order;
	bool zero = gfp & __GFP_ZERO;
	int ret;

	if (!mem)
		return -EINVAL;

	ret = cc_shared_calc_layout(requested, &layout);
	if (ret)
		return ret;

	order = get_order(layout.shared_size);
	if (order > MAX_PAGE_ORDER)
		return -EINVAL;

	/*
	 * State transitions require a linear-map address and may modify memory.
	 * Allocate from low memory and defer requested zeroing until afterwards.
	 */
	gfp &= ~(__GFP_HIGHMEM | __GFP_ZERO);
	if (nid == NUMA_NO_NODE)
		page = alloc_pages(gfp, order);
	else
		page = alloc_pages_node(nid, gfp, order);
	if (!page)
		return -ENOMEM;

	ret = cc_make_shared(page_address(page), layout.shared_size);
	if (ret) {
		if (!cc_make_private(page_address(page), layout.shared_size))
			__free_pages(page, order);
		else
			pr_warn_ratelimited("leaking %zu bytes with uncertain shared state\n",
					    layout.shared_size);
		return ret;
	}

	if (zero)
		memset(page_address(page), 0, layout.shared_size);

	mem->page = page;
	mem->shared_size = layout.shared_size;
	return 0;
}

-aneesh