Re: [RFC PATCH v8 02/14] mm: Zero memory during shared memory transitions

[Aneesh Kumar K.V <aneesh.kumar@kernel.org>]

Kiryl Shutsemau <kas@kernel.org> writes:

> On Thu, Sep 24, 2026 at 03:35:17PM +0530, Aneesh Kumar K.V (Arm) wrote:
>> diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
>> index f904a636d449..1f1f39082391 100644
>> --- a/arch/x86/coco/tdx/tdx.c
>> +++ b/arch/x86/coco/tdx/tdx.c
>> @@ -978,6 +978,9 @@ static bool tdx_enc_status_changed(unsigned long vaddr, int numpages, bool enc)
>>  static int tdx_enc_status_change_prepare(unsigned long vaddr, int numpages,
>>  					 bool enc)
>>  {
>> +	if (!enc)
>> +		memset((void *)vaddr, 0, (size_t)numpages << PAGE_SHIFT);
>> +
>>  	/*
>>  	 * Only handle shared->private conversion here.
>>  	 * See the comment in tdx_early_init().
>
> This doesn't make sense to me.
>
> On TDX the memset zeroes a page that is about to be dropped.
> MapGPA(shared) makes the VMM back the GPA with different memory, and
> what the guest reads afterwards through the shared mapping is whatever
> the host has there.
>

Does TDX require the guest contents to be preserved when pages are
converted to shared?

The memset() is done here because CoCo shared-memory allocations now
ignore __GFP_ZERO and instead always zero the memory explicitly. For
CoCo architectures such as CCA, this must be done after the memory is
converted to shared because shared memory uses a different encryption
context.

The full patch avoids zeroing the memory twice. If __GFP_ZERO is used
for a CoCo shared-page allocation, the page is first zeroed during
allocation, then converted to shared, and must be zeroed again. I only
changed Arm CCA  in this series because I was unsure whether the other
architectures required similar changes. Therefore, every CoCo
architecture other than CCA currently performs the memset() before
conversion, while CCA performs it afterward.

If the host expects to see the guest contents from before the conversion
to shared, we will have to pass the allocation flags down to these
helpers and perform the memset() only when __GFP_ZERO was requested,
along the lines of:

https://lore.kernel.org/all/yq5aa4p82sqt.fsf@kernel.org

To keep the changes minimal, the current approach always performs the
memset() rather than passing down a flag.

-aneesh