Re: [PATCH v4 3/3] balloon: add VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE

On Fri, May 15, 2026 at 12:35=E2=80=AFPM Michael S. Tsirkin <[email protected]=
> wrote:
>
> On Fri, May 15, 2026 at 12:28:14PM +0300, Manos Pitsidianakis wrote:
> > On Fri, May 15, 2026 at 12:23=E2=80=AFPM Michael S. Tsirkin <mst@redhat=
.com> wrote:
> > >
> > > On Fri, May 15, 2026 at 12:09:24PM +0300, Manos Pitsidianakis wrote:
> > > > On Thu, May 7, 2026 at 10:52=E2=80=AFAM Michael S. Tsirkin <mst@red=
hat.com> wrote:
> > > > >
> > > > > Add VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE (bit 7): the device
> > > > > initializes inflated pages and returns a per-page bitmap indicati=
ng
> > > > > which pages were successfully initialized.
> > > > >
> > > > > Update Security Considerations Data Integrity subsection to cover
> > > > > both DEVICE_INIT_REPORTED and DEVICE_INIT_ON_INFLATE.
> > > > >
> > > > > Fixes: https://github.com/oasis-tcs/virtio-spec/issues/242
> > > > > Signed-off-by: Michael S. Tsirkin <[email protected]>
> > > > > ---
> > > > >  device-types/balloon/description.tex | 73 ++++++++++++++++++++++=
+++++-
> > > > >  1 file changed, 71 insertions(+), 2 deletions(-)
> > > > >
> > > > > diff --git a/device-types/balloon/description.tex b/device-types/=
balloon/description.tex
> > > > > index fa33105..7afdb24 100644
> > > > > --- a/device-types/balloon/description.tex
> > > > > +++ b/device-types/balloon/description.tex
> > > > > @@ -52,6 +52,9 @@ \subsection{Feature bits}\label{sec:Device Type=
s / Memory Balloon Device / Featu
> > > > >  \item[ VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED(6) ] The device ini=
tializes
> > > > >      reported pages.
> > > > >
> > > > > +\item[ VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE(7) ] The device i=
nitializes
> > > > > +    inflated pages.
> > > > > +
> > > > >  \end{description}
> > > > >
> > > > >  \subsubsection{Feature bit requirements}\label{sec:Device Types =
/ Memory Balloon Device / Feature bits / Feature bit requirements}
> > > > > @@ -249,6 +252,10 @@ \subsection{Device Operation}\label{sec:Devi=
ce Types / Memory Balloon Device / D
> > > > >  and before detecting its physical number in a deflate request
> > > > >  and acknowledging the deflate request.
> > > > >
> > > > > +If VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE is negotiated, the
> > > > > +device MUST NOT modify a page after reporting it as initialized
> > > > > +in the bitmap.
> > > > > +
> > > > >  \paragraph{Legacy Interface: Device Operation}\label{sec:Device
> > > > >  Types / Memory Balloon Device / Device Operation / Legacy
> > > > >  Interface: Device Operation}
> > > > > @@ -672,6 +679,67 @@ \subsubsection{Device Initialized Reported P=
ages}\label{sec:Device Types / Memor
> > > > >  If VIRTIO_BALLOON_F_PAGE_POISON is not negotiated, the device
> > > > >  MUST fill each initialized page with zeros.
> > > > >
> > > > > +\subsubsection{Device Initialized Pages on Inflate}\label{sec:De=
vice Types / Memory Balloon Device / Device Operation / Device Initialized =
Pages on Inflate}
> > > > > +
> > > > > +When VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE is negotiated, the
> > > > > +device initializes inflated pages and reports which pages were
> > > > > +successfully initialized via a per-page bitmap.
> > > > > +
> > > > > +The driver appends a device-writable bitmap buffer to each infla=
te
> > > > > +descriptor chain, after the PFN outbuf.
> > > >
> > > > Maybe we could say "page physical number" instead of PFN to stay
> > > > consistent with the rest of the balloon spec.
> > > >
> > > > > The bitmap contains one
> > > > > +bit per balloon page (4KB), where bit N corresponds to the Nth P=
FN
> > > > > +in the inflate request (0-indexed). Bit N is stored as bit (N mo=
d 8)
> > > > > +of byte (N / 8), with bit 0 being the least significant bit.
> > > > > +The device sets a bit to 1 if it successfully initialized the
> > > > > +corresponding page, or 0 if it did not.
> > > >
> > > > Does this mean page size cannot be larger than 4kb?
> > >
> > > With legacy balloon, pretty much.
> > > This hack of sticking right-shifted PFNs in an outbuf
> > > is a broken interface that can't even support large guests.
> > > If someone worked on a better one, would be great.
> > > But for now, this just supports zero reporting with that.
> >
> > Makes sense. Should we mention it in the traditional balloon device
> > description? Or even put device and driver MUST statements that page
> > size is always 4kb.
> >
> > For this patch:
> >
> > Reviewed-by: Manos Pitsidianakis <[email protected]>
> >
> > >
> > > --
> > > MST
> > >
>
> Well it says:
>
>   \item The driver constructs an array of addresses of unused memory
>     pages. These addresses are divided by 4096\footnote{This is historica=
l, and independent of the guest page size.
> } and the descriptor
>     describing the resulting 32-bit array is added to the inflateq.
>   \end{enumerate}
>
>
> having said that:
>
> - it should be "a device read-only buffer is made available in the
>   inflateq".
>
> - the text mixes "pages as in arbitrary chunks of memory" for page
>   hinting/reporting
> and
> - pages as in 4k chunks for inflate/deflate
>
>
> if there's work to modernize balloon, fixing these might be a
> prerequisite

Agreed