On Mon, Sep 21, 2026 at 08:18:36PM +0530, Aneesh Kumar K.V (Arm) wrote:
> +int alloc_cc_shared_pages_node(int nid, gfp_t gfp,
> + size_t requested, struct cc_shared_pages *mem)
> +{
> + struct cc_shared_layout layout;
> + struct page *page;
> + unsigned int order;
> + bool zero = gfp & __GFP_ZERO;
> + int ret;
> +
> + if (!mem)
> + return -EINVAL;
> +
> + ret = cc_shared_calc_layout(requested, &layout);
> + if (ret)
> + return ret;
> +
> + order = get_order(layout.shared_size);
> + if (order > MAX_PAGE_ORDER)
> + return -EINVAL;
> +
> + /*
> + * State transitions require a linear-map address and may modify memory.
> + * Allocate from low memory and defer requested zeroing until
> afterwards.
> + */
> + gfp &= ~(__GFP_HIGHMEM | __GFP_ZERO);
> + if (nid == NUMA_NO_NODE)
> + page = alloc_pages(gfp, order);
> + else
> + page = alloc_pages_node(nid, gfp, order);
> + if (!page)
> + return -ENOMEM;
> +
> + ret = cc_make_shared(page_address(page), layout.shared_size);
> + if (ret) {
> + if (!cc_make_private(page_address(page), layout.shared_size))
> + __free_pages(page, order);
> + else
> + pr_warn_ratelimited("leaking %zu bytes with uncertain
> shared state\n",
> + layout.shared_size);
> + return ret;
> + }
> +
> + if (zero)
> + memset(page_address(page), 0, layout.shared_size);
Does the memset() post sharing logic work for pKVM as well? If nothing
clears it, we have a small window where guest data is leaked to the
host.
Is there a case where we *do not* need the memory cleared? If not, maybe
we can move the logic in the arch set_memory_decrypted().
--
Catalin
