[Linaro-mm-sig] Re: [RFC PATCH v7 02/13] mm: Add an allocator for CoCo shared memory

On Mon, Sep 21, 2026 at 08:18:36PM +0530, Aneesh Kumar K.V (Arm) wrote:

+int alloc_cc_shared_pages_node(int nid, gfp_t gfp,

• size_t requested, struct cc_shared_pages *mem)
  

+{

• struct cc_shared_layout layout;
• struct page *page;
• unsigned int order;
• bool zero = gfp & __GFP_ZERO;
• int ret;
• if (!mem)

• return -EINVAL;
  

• ret = cc_shared_calc_layout(requested, &layout);
• if (ret)

• return ret;
  

• order = get_order(layout.shared_size);
• if (order > MAX_PAGE_ORDER)

• return -EINVAL;
  

• /*

• * State transitions require a linear-map address and may modify memory.
  

• * Allocate from low memory and defer requested zeroing until afterwards.
  

• */
  

• gfp &= ~(__GFP_HIGHMEM | __GFP_ZERO);
• if (nid == NUMA_NO_NODE)

• page = alloc_pages(gfp, order);
  

• else

• page = alloc_pages_node(nid, gfp, order);
  

• if (!page)

• return -ENOMEM;
  

• ret = cc_make_shared(page_address(page), layout.shared_size);
• if (ret) {

• if (!cc_make_private(page_address(page), layout.shared_size))
  

• 	__free_pages(page, order);
  

• else
  

• 	pr_warn_ratelimited("leaking %zu bytes with uncertain shared state\n",
  

• 			    layout.shared_size);
  

• return ret;
  

• }
• if (zero)

• memset(page_address(page), 0, layout.shared_size);
  

Does the memset() post sharing logic work for pKVM as well? If nothing clears it, we have a small window where guest data is leaked to the host.

Is there a case where we *do not* need the memory cleared? If not, maybe we can move the logic in the arch set_memory_decrypted().