From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E6D693BFE3F for ; Wed, 20 May 2026 22:23:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779315803; cv=none; b=Eins+9bKQ7KUAdnkFHgmBut70Fnsjr8TYSf+NVAQ6nFrgjO81EVbcBIJKgHu4O2tFcHhzd1ihKJb6iyRpsfvg2uHIyN6FbFBkezKXgzBbjIcoLhi2FFrSKcE7ZaEfB8uzVnskm78nsx9s7Q5mskgZALa40GEoRB0T+m/J85PJ5c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779315803; c=relaxed/simple; bh=KQP828o7Oia72X2oJuTNYtM9uBAruxIc45lg9ub3w4U=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=rA28PmJBArNLTlzkOHE+GOAvnj/wQ/FnPsKft+ZIx9sw++kcsPCAkY+Bd+dT7tIhEqkdajEkLJZsZLM28VagCagA7SSrTVv2oywbuPlvk2x2NRB7X9rmqUV8GhoWseMSAID2jvwVADc7nLBhKgRJtbeC68B2Wx2F+QpAGd2yDXs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=LB8j++J8; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=kJ9dJ+Y6; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="LB8j++J8"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="kJ9dJ+Y6" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1779315801; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=3kNatCmWHyttmbkexMBnMmdZ3Q708953lxRldkYnzX4=; b=LB8j++J8kRN7/TDR9UqB7BQ6Rq/+PwznDCN/Mix4r7my3jTxqeyCOFMF3zELmM+iR4ONj0 37xLJzKahMwF/SWkvtQ01q2iKZt/hVEjuG/19ALeckQmEB86ptNnPQ81VkAqVcdvl8Eurz gpqTNLDEURiEbySk3xjw9wQ3bR0+aec= Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-461-sv4xB7JVMAGMnqWZ_c4ISw-1; Wed, 20 May 2026 18:23:19 -0400 X-MC-Unique: sv4xB7JVMAGMnqWZ_c4ISw-1 X-Mimecast-MFC-AGG-ID: sv4xB7JVMAGMnqWZ_c4ISw_1779315799 Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-48feb029961so30577515e9.3 for ; Wed, 20 May 2026 15:23:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1779315798; x=1779920598; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=3kNatCmWHyttmbkexMBnMmdZ3Q708953lxRldkYnzX4=; b=kJ9dJ+Y62WeB1kd+eok8XqSL/9tI8pvZmU5UxcXYsEMhV57y2qdIr/Zts7TRU9Fbqu ZWytuXQyd2NJ7GM98uauc0WKyfuwfES59uO9TGGjdM6mj3BtfClI+aenRHbokjzigTf3 lTr4/Thqtuh2cvWVPEbtUzZqZfVA4XNkwdvOKBgt/K76f4mdSSFNn9syNThCsTuvTIqS 8+CpY+l8F4mAHlrwSNOORp8HpFdtuwbeWgWv1rc7HzWX2ndwa7Rhc5TWVIvApYqYonON NyTuKq4xAwEmjc62QVNVYtpoi4j0YzP53gXO/RNssv0nwFgH8M6zDuOpHuhoPFnM3+03 m8CA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779315798; x=1779920598; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=3kNatCmWHyttmbkexMBnMmdZ3Q708953lxRldkYnzX4=; b=PcYpd543TlQ5Ox3/TsZ8PYF13F4dhK/WRVIAZlo8Cigay1WHIZLPzTkSRNz0slNtzG OHodL1YXrbuCt5dWvy037bsnsoKCR/LAW8PpWNmFznLdESUdEWMM0eceEeCPLxNr/OZU owJGa/YsUgNc8iGB9Plyy6wbLHpFwYQt5B9e/45zAofw05I1uZ1Wyt7qIdup9gRgOTlT qHmM4my+dve/3zH+UiUn01f0AfIJjDxWSx3JpyQ/8kJvU7eufwPDwkWHwjpttHACBJyM 0qgPIucLOo+jbgI7C9+FgfhQmghtBP/0kfgFuQZ88borpyE2JOSodi2VMHcqfA10ddQe j0hg== X-Gm-Message-State: AOJu0YxQXAV8t7DmDavl9veCnnSRjg0crCCGGgTomftsiaoDFXLvkodZ FWM3vpx4QI4Kph4an944zukxs0bG4cLOLjyCJqYB/iaxWUbbpxMpZjxsbifa876eaa2PmJCdTg0 VxYcaeKvk1jz9E4wp9WJ5GtWstEzAd9R9RGCClOk9beVamLdNHPknEns4B0WHvQxq6wlK+sC5Ia u/DhRMdAOEfkctVqOAhr9yzzB72cKuC3Pa04Z7UlUmT0M= X-Gm-Gg: Acq92OHl6o3YgixWrRuCANkqewoQzqs3mwZjKFHnmjmrgSXqDbLjExZ/Ev5JMDeDLlb d0qlFQnzlxMLecKO9Uzu6y/opq5D4esmntYUjEEk8vBmd6lo8qVbVR3SuYirbKmNp8heyeCs9ZK 3XDoIUpteNbRAU2E8Q9MpINmJH47vRFvqv/Y+l9VJUXbz7Y1DQnaMGIr4IVycGHAeD1hN2ULOTB uya5LPqrF2Jq2fsfXRnpK7gjUjUMHVAeLlMdWRJwPDxZBA2qYhMXQ0PIYa9WhWyV7rM0C1SgnrM 9UetYWYNA5c2FD3TPyJkX2pekQkh8TZeA9rwNouc6lYFGC/zvEboznVVkuULexbOqkLSn9Gj4jR pO523zO/TL8irZM+IiWM++yzUKj7l9HnNJVftOnFVGfx+JEgCWdg9AQ== X-Received: by 2002:a05:600c:6211:b0:48f:d1b8:9aa4 with SMTP id 5b1f17b1804b1-4903604cac9mr2998555e9.7.1779315798563; Wed, 20 May 2026 15:23:18 -0700 (PDT) X-Received: by 2002:a05:600c:6211:b0:48f:d1b8:9aa4 with SMTP id 5b1f17b1804b1-4903604cac9mr2997825e9.7.1779315797919; Wed, 20 May 2026 15:23:17 -0700 (PDT) Received: from redhat.com (IGLD-80-230-25-45.inter.net.il. [80.230.25.45]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49033d3f0d1sm23277085e9.5.2026.05.20.15.23.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 20 May 2026 15:23:17 -0700 (PDT) Date: Wed, 20 May 2026 18:23:13 -0400 From: "Michael S. Tsirkin" To: linux-kernel@vger.kernel.org Cc: "David Hildenbrand (Arm)" , Jason Wang , Xuan Zhuo , Eugenio =?utf-8?B?UMOpcmV6?= , Muchun Song , Oscar Salvador , Andrew Morton , Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Brendan Jackman , Johannes Weiner , Zi Yan , Baolin Wang , Nico Pache , Ryan Roberts , Dev Jain , Barry Song , Lance Yang , Hugh Dickins , Matthew Brost , Joshua Hahn , Rakie Kim , Byungchul Park , Gregory Price , Ying Huang , Alistair Popple , Christoph Lameter , David Rientjes , Roman Gushchin , Harry Yoo , Axel Rasmussen , Yuanchu Xie , Wei Xu , Chris Li , Kairui Song , Kemeng Shi , Nhat Pham , Baoquan He , virtualization@lists.linux.dev, linux-mm@kvack.org, Andrea Arcangeli Subject: [PATCH v8 32/37] virtio_balloon: disable reporting zeroed optimization for confidential guests Message-ID: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email 2.27.0.106.g8ac3dc51b1 X-Mutt-Fcc: =sent In confidential computing environments (TDX, SEV-SNP), the host is untrusted and may lie about zeroing reported pages. Clear DEVICE_INIT_REPORTED in validate() so the guest does not skip re-zeroing based on hints from an untrusted device. Note: currently REPORTING remains enabled and VIRTIO_F_ACCESS_PLATFORM is cleared in CC environments. This is known to leak free page physical addresses to the host. Whether that, or ballooning in general, is a security concern in CC is up to the user. This patch only disables our new zeroed-page hints where the host is untrusted. Signed-off-by: Michael S. Tsirkin Assisted-by: Claude:claude-opus-4-6 Assisted-by: cursor-agent:GPT-5.4-xhigh --- drivers/virtio/virtio_balloon.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c index e3afa6f32ba5..bf1172ad5419 100644 --- a/drivers/virtio/virtio_balloon.c +++ b/drivers/virtio/virtio_balloon.c @@ -19,6 +19,7 @@ #include #include #include +#include /* * Balloon device works in 4K page units. So each page is pointed to by @@ -1193,6 +1194,8 @@ static int virtballoon_validate(struct virtio_device *vdev) !want_init_on_free()) __virtio_clear_bit(vdev, VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED); + if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT)) + __virtio_clear_bit(vdev, VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED); /* * Balloon submits 1-2 sg entries max per buffer, virtqueue * sizes are 128+. Disable indirect descriptors to avoid -- MST