mirror of
https://github.com/cloud-hypervisor/cloud-hypervisor.git
synced 2026-08-05 02:19:16 +00:00
When an SEV-SNP guest transitions pages from private to shared via KVM_HC_MAP_GPA_RANGE, punch holes in the corresponding guest_memfd backing it. Without this the balloon driver's `set_memory_decrypted()` path transitions the page attributes but the physical memory stays pinned in guest_memfd, making virtio-balloon ineffective for memory overcommit with confidential VMs. Even without ballooning these pages are unused by the guest so consume resources. This mirrors the hole punching that the balloon device does for releasing pages. The memory_slots Arc is cloned into each KvmVcpu at creation so the punch can happen in the vcpu thread. Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Rob Bradford <rbradford@meta.com>