Re: [RFC PATCH v8 02/14] mm: Zero memory during shared memory transitions

[Kiryl Shutsemau <kas@kernel.org>]

On Tue, Oct 13, 2026 at 10:42:58AM +0530, Aneesh Kumar K.V wrote:
> Kiryl Shutsemau <kas@kernel.org> writes:
> 
> > On Thu, Sep 24, 2026 at 03:35:17PM +0530, Aneesh Kumar K.V (Arm) wrote:
> >> diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
> >> index f904a636d449..1f1f39082391 100644
> >> --- a/arch/x86/coco/tdx/tdx.c
> >> +++ b/arch/x86/coco/tdx/tdx.c
> >> @@ -978,6 +978,9 @@ static bool tdx_enc_status_changed(unsigned long vaddr, int numpages, bool enc)
> >>  static int tdx_enc_status_change_prepare(unsigned long vaddr, int numpages,
> >>  					 bool enc)
> >>  {
> >> +	if (!enc)
> >> +		memset((void *)vaddr, 0, (size_t)numpages << PAGE_SHIFT);
> >> +
> >>  	/*
> >>  	 * Only handle shared->private conversion here.
> >>  	 * See the comment in tdx_early_init().
> >
> > This doesn't make sense to me.
> >
> > On TDX the memset zeroes a page that is about to be dropped.
> > MapGPA(shared) makes the VMM back the GPA with different memory, and
> > what the guest reads afterwards through the shared mapping is whatever
> > the host has there.
> >
> 
> Does TDX require the guest contents to be preserved when pages are
> converted to shared?

No.

From the host perspective, the private page is withdrawn from the TD.
Its contents are encrypted with the TD's key and do not carry over. Then
the host inserts some page (maybe the same one) as shared.

So the memset() in the prepare callback zeroes a page the guest is about
to lose, and it does nothing to what the caller sees. With the
post-conversion memset() gone from dma_direct_alloc(),
dma_alloc_coherent() in a TDX guest returns whatever the host has at
that GPA.

TDX needs the same ordering as CCA: zero in
tdx_enc_status_change_finish() after tdx_enc_status_changed(). No flag
is needed for that.

But, again, shared memory is under host control and you cannot assume it
will stay zeroed.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov