On Wed, Sep 23, 2026 at 10:42:39AM +0100, Catalin Marinas wrote:
On pKVM, we want set_memory_decrypted() to zero the buffer before the host can access it (I guess currently relying on __GFP_ZERO allocations). Since no cryptographic encryption takes place, there's not much point in memset'ing again after the operation as the content was already zeroed.
It sounds like this a pkvm unique thing, since RMM always makes the memory hidden, pkvm flow should do it too. Either inside its guest set_memory_decrypted() or inside the hypervisor like RMM.
Hypervisor doing it is the right place, hypervisor always needs to ensure guest memory is cleansed whenever the guest gives it up. Either via a private to shared, unmap or just exiting.
I don't think cc_make_shared() has the right information on how to safely and efficiently do the zeroing. That's only known to the set_memory_* backend. So you'd have to propagate the flag down.
+1
Jason