Kiryl Shutsemau kas@kernel.org writes:

On Thu, Sep 24, 2026 at 03:35:17PM +0530, Aneesh Kumar K.V (Arm) wrote:

...

diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c index f904a636d449..1f1f39082391 100644 --- a/arch/x86/coco/tdx/tdx.c +++ b/arch/x86/coco/tdx/tdx.c @@ -978,6 +978,9 @@ static bool tdx_enc_status_changed(unsigned long vaddr, int numpages, bool enc) static int tdx_enc_status_change_prepare(unsigned long vaddr, int numpages, bool enc) {

• if (!enc)

• memset((void *)vaddr, 0, (size_t)numpages << PAGE_SHIFT);
  

• /*
  • Only handle shared->private conversion here.
  • See the comment in tdx_early_init().

This doesn't make sense to me.

On TDX the memset zeroes a page that is about to be dropped. MapGPA(shared) makes the VMM back the GPA with different memory, and what the guest reads afterwards through the shared mapping is whatever the host has there.

Does TDX require the guest contents to be preserved when pages are converted to shared?

The memset() is done here because CoCo shared-memory allocations now ignore __GFP_ZERO and instead always zero the memory explicitly. For CoCo architectures such as CCA, this must be done after the memory is converted to shared because shared memory uses a different encryption context.

The full patch avoids zeroing the memory twice. If __GFP_ZERO is used for a CoCo shared-page allocation, the page is first zeroed during allocation, then converted to shared, and must be zeroed again. I only changed Arm CCA in this series because I was unsure whether the other architectures required similar changes. Therefore, every CoCo architecture other than CCA currently performs the memset() before conversion, while CCA performs it afterward.

If the host expects to see the guest contents from before the conversion to shared, we will have to pass the allocation flags down to these helpers and perform the memset() only when __GFP_ZERO was requested, along the lines of:

https://lore.kernel.org/all/yq5aa4p82sqt.fsf@kernel.org

To keep the changes minimal, the current approach always performs the memset() rather than passing down a flag.

-aneesh