On Wed, Sep 23, 2026 at 10:42:39AM +0100, Catalin Marinas wrote: > On pKVM, we want set_memory_decrypted() to zero the buffer > before the host can access it (I guess currently relying on __GFP_ZERO > allocations). Since no cryptographic encryption takes place, there's not > much point in memset'ing again after the operation as the content was > already zeroed.
It sounds like this a pkvm unique thing, since RMM always makes the memory hidden, pkvm flow should do it too. Either inside its guest set_memory_decrypted() or inside the hypervisor like RMM. Hypervisor doing it is the right place, hypervisor always needs to ensure guest memory is cleansed whenever the guest gives it up. Either via a private to shared, unmap or just exiting. > I don't think cc_make_shared() has the right information on how to > safely and efficiently do the zeroing. That's only known to the > set_memory_* backend. So you'd have to propagate the flag down. +1 Jason
