On Tue, Oct 27, 2026 at 06:29:35AM -0400, Michael S. Tsirkin wrote: > On Tue, Oct 27, 2026 at 02:56:03AM +0000, Kevin Loughlin wrote: > > This series enables virtio-balloon free page reporting and memory balloon > > inflation/deflation in Confidential Computing (CoCo) guests, starting > > with architectural hooks implemented for AMD SEV variants, in order to > > support dynamic CoCo guest resizing. > > > > Today, memory ballooning and free page reporting are essentially unusable > > in CoCo guests due to three main roadblocks: > > > For me, the bigger question is not whether we can, but whether we > should. Considerations I would like to see addressed: > > Security, e.g.: does knowing which memory is free leak information from > the guest? If no, why not? > Consider CONFIG_SHUFFLE_PAGE_ALLOCATOR, RANDSTRUCT, etc. > > correctness, e.g.: Linux has init on free (and default on windows), if > initialized pages are dropped and host can not be trusted, they have to be > re-initialized. Is this handled? I don't see it in code. > > Also, performance, e.g.: How much does this re-initialization cost? > > Management: it was simple with balloon off unconditionally. > Now we are in murkier waters with various features offering > various performance/security tradeoffs. > What if some guests want the tradeoffs but others don't? > > Documentation: for all of the above. > > -- > MST
And to give this a bit more perspective, I present: commit ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce Author: Kiryl Shutsemau <[email protected]> Date: Mon Mar 9 23:11:12 2015 +0200 pagemap: do not leak physical addresses to non-privileged userspace As pointed by recent post[1] on exploiting DRAM physical imperfection, /proc/PID/pagemap exposes sensitive information which can be used to do attacks. This disallows anybody without CAP_SYS_ADMIN to read the pagemap. [1] http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html [ Eventually we might want to do anything more finegrained, but for now this is the simple model. - Linus ] Signed-off-by: Kirill A. Shutemov <[email protected]> Acked-by: Konstantin Khlebnikov <[email protected]> Acked-by: Andy Lutomirski <[email protected]> Cc: Pavel Emelyanov <[email protected]> Cc: Andrew Morton <[email protected]> Cc: Mark Seaborn <[email protected]> Cc: [email protected] Signed-off-by: Linus Torvalds <[email protected]> Leaking phys addresses to unpriveleged entities might not be wise. -- MST
