Re: [PATCH v4 2/3] balloon: add VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED

On Thu, May 7, 2026 at 10:52=E2=80=AFAM Michael S. Tsirkin <[email protected]>=
 wrote:
>
> Add VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED (bit 6): the device
> initializes reported pages by writing into each byte of the page.
>
> Add Feature bit requirements subsection.
> Add Data Integrity security text for DEVICE_INIT_REPORTED.
>
> Fixes: https://github.com/oasis-tcs/virtio-spec/issues/244
> Signed-off-by: Michael S. Tsirkin <[email protected]>
> ---

Reviewed-by: Manos Pitsidianakis <[email protected]>

>  device-types/balloon/description.tex | 60 ++++++++++++++++++++++++++--
>  1 file changed, 57 insertions(+), 3 deletions(-)
>
> diff --git a/device-types/balloon/description.tex b/device-types/balloon/=
description.tex
> index a2e4a37..fa33105 100644
> --- a/device-types/balloon/description.tex
> +++ b/device-types/balloon/description.tex
> @@ -49,6 +49,18 @@ \subsection{Feature bits}\label{sec:Device Types / Mem=
ory Balloon Device / Featu
>  \item[ VIRTIO_BALLOON_F_PAGE_REPORTING(5) ] The device has support for f=
ree
>      page reporting. A virtqueue for reporting free guest memory is prese=
nt.
>
> +\item[ VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED(6) ] The device initializes
> +    reported pages.
> +
> +\end{description}
> +
> +\subsubsection{Feature bit requirements}\label{sec:Device Types / Memory=
 Balloon Device / Feature bits / Feature bit requirements}
> +
> +Some balloon feature bits require other balloon feature bits
> +(see \ref{drivernormative:Basic Facilities of a Virtio Device / Feature =
Bits}):
> +
> +\begin{description}
> +\item[VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED] Requires VIRTIO_BALLOON_F_P=
AGE_REPORTING.
>  \end{description}
>
>  \drivernormative{\subsubsection}{Feature bits}{Device Types / Memory Bal=
loon Device / Feature bits}
> @@ -61,7 +73,8 @@ \subsection{Feature bits}\label{sec:Device Types / Memo=
ry Balloon Device / Featu
>
>  If the driver is expecting the pages to retain some initialized value,
>  it MUST NOT accept VIRTIO_BALLOON_F_PAGE_REPORTING unless it also
> -negotiates VIRTIO_BALLOON_F_PAGE_POISON.
> +negotiates VIRTIO_BALLOON_F_PAGE_POISON or
> +VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED.
>
>  \devicenormative{\subsubsection}{Feature bits}{Device Types / Memory Bal=
loon Device / Feature bits}
>  If the device offers the VIRTIO_BALLOON_F_MUST_TELL_HOST feature
> @@ -603,7 +616,8 @@ \subsubsection{Free Page Reporting}\label{sec:Device =
Types / Memory Balloon Devi
>  Normative statements in this section apply if the
>  VIRTIO_BALLOON_F_PAGE_REPORTING feature has been negotiated.
>
> -If the VIRTIO_BALLOON_F_PAGE_POISON feature has not been negotiated, the=
n
> +If neither the VIRTIO_BALLOON_F_PAGE_POISON nor
> +VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED feature has been negotiated, then
>  the driver MUST treat all reported pages as uninitialized memory.
>
>  If the VIRTIO_BALLOON_F_PAGE_POISON feature has been negotiated, the
> @@ -625,7 +639,8 @@ \subsubsection{Free Page Reporting}\label{sec:Device =
Types / Memory Balloon Devi
>  Normative statements in this section apply if the
>  VIRTIO_BALLOON_F_PAGE_REPORTING feature has been negotiated.
>
> -If the VIRTIO_BALLOON_F_PAGE_POISON feature has not been negotiated, the
> +If neither the VIRTIO_BALLOON_F_PAGE_POISON nor
> +VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED feature has been negotiated, the
>  device MAY modify the contents of any page supplied in a report request
>  before acknowledging that request by using the reporting_vq descriptor.
>
> @@ -633,6 +648,30 @@ \subsubsection{Free Page Reporting}\label{sec:Device=
 Types / Memory Balloon Devi
>  MUST NOT modify the the content of a reported page to a value other than
>  \field{poison_val}.
>
> +\subsubsection{Device Initialized Reported Pages}\label{sec:Device Types=
 / Memory Balloon Device / Device Operation / Device Initialized Reported P=
ages}
> +
> +When VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED is negotiated, the device
> +initializes reported pages by writing into each byte of the page.
> +
> +\drivernormative{\paragraph}{Device Initialized Reported Pages}{Device T=
ypes / Memory Balloon Device / Device Operation / Device Initialized Report=
ed Pages}
> +
> +Normative statements in this section apply if the
> +VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED feature has been negotiated.
> +
> +The driver MUST NOT treat a reported page as initialized unless
> +the used length covers it.
> +
> +\devicenormative{\paragraph}{Device Initialized Reported Pages}{Device T=
ypes / Memory Balloon Device / Device Operation / Device Initialized Report=
ed Pages}
> +
> +Normative statements in this section apply if the
> +VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED feature has been negotiated.
> +
> +If VIRTIO_BALLOON_F_PAGE_POISON is also negotiated, the device
> +MUST fill each initialized page with \field{poison_val}.
> +
> +If VIRTIO_BALLOON_F_PAGE_POISON is not negotiated, the device
> +MUST fill each initialized page with zeros.
> +
>  \subsection{Security Considerations}\label{sec:Device Types / Memory Bal=
loon Device / Security Considerations}
>
>  In environments where the device is not trusted, such as
> @@ -653,6 +692,21 @@ \subsubsection{Information Leakage}\label{sec:Device=
 Types / Memory Balloon Devi
>  reporting, may make page contents accessible to the device. Memory
>  statistics reporting exposes guest memory usage patterns.
>
> +\subsubsection{Data Integrity}\label{sec:Device Types / Memory Balloon D=
evice / Security Considerations / Data Integrity}
> +
> +When the device is untrusted, the driver cannot rely on the device
> +to correctly initialize pages. An untrusted device can report a
> +non-zero used length for VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED
> +without actually initializing the corresponding pages. If the
> +driver treats such pages as initialized (e.g., marking them as
> +zeroed), this could lead to information leakage between guest
> +processes or other security violations.
> +
> +Drivers operating in environments with untrusted devices are
> +expected to avoid negotiating
> +VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED, and to initialize
> +all pages themselves.
> +
>  \subsubsection{Denial of Service}\label{sec:Device Types / Memory Balloo=
n Device / Security Considerations / Denial of Service}
>
>  A malicious device could set \field{num_pages} to an
> --
> MST
>
>