[PATCH v4 3/3] balloon: add VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE

Add VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE (bit 7): the device
initializes inflated pages and returns a per-page bitmap indicating
which pages were successfully initialized.

Update Security Considerations Data Integrity subsection to cover
both DEVICE_INIT_REPORTED and DEVICE_INIT_ON_INFLATE.

Fixes: https://github.com/oasis-tcs/virtio-spec/issues/242
Signed-off-by: Michael S. Tsirkin <[email protected]>
---
 device-types/balloon/description.tex | 73 +++++++++++++++++++++++++++-
 1 file changed, 71 insertions(+), 2 deletions(-)

diff --git a/device-types/balloon/description.tex b/device-types/balloon/description.tex
index fa33105..7afdb24 100644
--- a/device-types/balloon/description.tex
+++ b/device-types/balloon/description.tex
@@ -52,6 +52,9 @@ \subsection{Feature bits}\label{sec:Device Types / Memory Balloon Device / Featu
 \item[ VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED(6) ] The device initializes
     reported pages.
 
+\item[ VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE(7) ] The device initializes
+    inflated pages.
+
 \end{description}
 
 \subsubsection{Feature bit requirements}\label{sec:Device Types / Memory Balloon Device / Feature bits / Feature bit requirements}
@@ -249,6 +252,10 @@ \subsection{Device Operation}\label{sec:Device Types / Memory Balloon Device / D
 and before detecting its physical number in a deflate request
 and acknowledging the deflate request.
 
+If VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE is negotiated, the
+device MUST NOT modify a page after reporting it as initialized
+in the bitmap.
+
 \paragraph{Legacy Interface: Device Operation}\label{sec:Device
 Types / Memory Balloon Device / Device Operation / Legacy
 Interface: Device Operation}
@@ -672,6 +679,67 @@ \subsubsection{Device Initialized Reported Pages}\label{sec:Device Types / Memor
 If VIRTIO_BALLOON_F_PAGE_POISON is not negotiated, the device
 MUST fill each initialized page with zeros.
 
+\subsubsection{Device Initialized Pages on Inflate}\label{sec:Device Types / Memory Balloon Device / Device Operation / Device Initialized Pages on Inflate}
+
+When VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE is negotiated, the
+device initializes inflated pages and reports which pages were
+successfully initialized via a per-page bitmap.
+
+The driver appends a device-writable bitmap buffer to each inflate
+descriptor chain, after the PFN outbuf. The bitmap contains one
+bit per balloon page (4KB), where bit N corresponds to the Nth PFN
+in the inflate request (0-indexed). Bit N is stored as bit (N mod 8)
+of byte (N / 8), with bit 0 being the least significant bit.
+The device sets a bit to 1 if it successfully initialized the
+corresponding page, or 0 if it did not.
+
+If VIRTIO_BALLOON_F_PAGE_POISON is also negotiated, the device fills
+pages with \field{poison_val}; otherwise, the device fills pages
+with zeros.
+
+When the driver later deflates these pages, it may skip
+initialization for pages that were marked as initialized in the
+inflate bitmap.
+
+\drivernormative{\paragraph}{Device Initialized Pages on Inflate}{Device Types / Memory Balloon Device / Device Operation / Device Initialized Pages on Inflate}
+
+Normative statements in this section apply if the
+VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE feature has been negotiated.
+
+The driver MUST append a device-writable bitmap buffer to each
+inflate descriptor chain. The bitmap buffer MUST be at least
+$\lceil N/8 \rceil$ bytes, where N is the number of PFNs in the
+inflate request.
+
+The driver MUST NOT treat an inflated page as initialized unless
+the corresponding bit in the bitmap is set to 1.
+
+The driver MAY skip initializing a deflated page if the
+corresponding inflate bitmap bit was set to 1. This overrides
+the VIRTIO_BALLOON_F_PAGE_POISON requirement to initialize
+deflated pages with \field{poison_val} for such pages.
+
+\devicenormative{\paragraph}{Device Initialized Pages on Inflate}{Device Types / Memory Balloon Device / Device Operation / Device Initialized Pages on Inflate}
+
+Normative statements in this section apply if the
+VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE feature has been negotiated.
+
+The device MUST provide an inflateq supporting at least 2 buffers.
+
+The device MUST set bit N in the bitmap to 1 if it successfully
+initialized PFN N, or to 0 otherwise. Bits not covered by the
+used length are treated as 0 by the driver.
+
+The device MAY write fewer or more bytes than $\lceil N/8 \rceil$.
+Any bits written beyond those corresponding to PFNs in the request
+MUST be set to 0.
+
+If VIRTIO_BALLOON_F_PAGE_POISON is also negotiated, the device
+MUST fill each successfully initialized page with \field{poison_val}.
+
+If VIRTIO_BALLOON_F_PAGE_POISON is not negotiated, the device
+MUST fill each successfully initialized page with zeros.
+
 \subsection{Security Considerations}\label{sec:Device Types / Memory Balloon Device / Security Considerations}
 
 In environments where the device is not trusted, such as
@@ -697,14 +765,15 @@ \subsubsection{Data Integrity}\label{sec:Device Types / Memory Balloon Device /
 When the device is untrusted, the driver cannot rely on the device
 to correctly initialize pages. An untrusted device can report a
 non-zero used length for VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED
+or set bits in the VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE bitmap
 without actually initializing the corresponding pages. If the
 driver treats such pages as initialized (e.g., marking them as
 zeroed), this could lead to information leakage between guest
 processes or other security violations.
 
 Drivers operating in environments with untrusted devices are
-expected to avoid negotiating
-VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED, and to initialize
+expected to avoid negotiating VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED
+or VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE, and to initialize
 all pages themselves.
 
 \subsubsection{Denial of Service}\label{sec:Device Types / Memory Balloon Device / Security Considerations / Denial of Service}
-- 
MST