Re: [PATCH v4 3/3] balloon: add VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE

["Michael S. Tsirkin" <mst@redhat.com>]

On Fri, May 15, 2026 at 12:28:14PM +0300, Manos Pitsidianakis wrote:
> On Fri, May 15, 2026 at 12:23 PM Michael S. Tsirkin <mst@redhat.com> wrote:
> >
> > On Fri, May 15, 2026 at 12:09:24PM +0300, Manos Pitsidianakis wrote:
> > > On Thu, May 7, 2026 at 10:52 AM Michael S. Tsirkin <mst@redhat.com> wrote:
> > > >
> > > > Add VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE (bit 7): the device
> > > > initializes inflated pages and returns a per-page bitmap indicating
> > > > which pages were successfully initialized.
> > > >
> > > > Update Security Considerations Data Integrity subsection to cover
> > > > both DEVICE_INIT_REPORTED and DEVICE_INIT_ON_INFLATE.
> > > >
> > > > Fixes: https://github.com/oasis-tcs/virtio-spec/issues/242
> > > > Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> > > > ---
> > > >  device-types/balloon/description.tex | 73 +++++++++++++++++++++++++++-
> > > >  1 file changed, 71 insertions(+), 2 deletions(-)
> > > >
> > > > diff --git a/device-types/balloon/description.tex b/device-types/balloon/description.tex
> > > > index fa33105..7afdb24 100644
> > > > --- a/device-types/balloon/description.tex
> > > > +++ b/device-types/balloon/description.tex
> > > > @@ -52,6 +52,9 @@ \subsection{Feature bits}\label{sec:Device Types / Memory Balloon Device / Featu
> > > >  \item[ VIRTIO_BALLOON_F_DEVICE_INIT_REPORTED(6) ] The device initializes
> > > >      reported pages.
> > > >
> > > > +\item[ VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE(7) ] The device initializes
> > > > +    inflated pages.
> > > > +
> > > >  \end{description}
> > > >
> > > >  \subsubsection{Feature bit requirements}\label{sec:Device Types / Memory Balloon Device / Feature bits / Feature bit requirements}
> > > > @@ -249,6 +252,10 @@ \subsection{Device Operation}\label{sec:Device Types / Memory Balloon Device / D
> > > >  and before detecting its physical number in a deflate request
> > > >  and acknowledging the deflate request.
> > > >
> > > > +If VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE is negotiated, the
> > > > +device MUST NOT modify a page after reporting it as initialized
> > > > +in the bitmap.
> > > > +
> > > >  \paragraph{Legacy Interface: Device Operation}\label{sec:Device
> > > >  Types / Memory Balloon Device / Device Operation / Legacy
> > > >  Interface: Device Operation}
> > > > @@ -672,6 +679,67 @@ \subsubsection{Device Initialized Reported Pages}\label{sec:Device Types / Memor
> > > >  If VIRTIO_BALLOON_F_PAGE_POISON is not negotiated, the device
> > > >  MUST fill each initialized page with zeros.
> > > >
> > > > +\subsubsection{Device Initialized Pages on Inflate}\label{sec:Device Types / Memory Balloon Device / Device Operation / Device Initialized Pages on Inflate}
> > > > +
> > > > +When VIRTIO_BALLOON_F_DEVICE_INIT_ON_INFLATE is negotiated, the
> > > > +device initializes inflated pages and reports which pages were
> > > > +successfully initialized via a per-page bitmap.
> > > > +
> > > > +The driver appends a device-writable bitmap buffer to each inflate
> > > > +descriptor chain, after the PFN outbuf.
> > >
> > > Maybe we could say "page physical number" instead of PFN to stay
> > > consistent with the rest of the balloon spec.
> > >
> > > > The bitmap contains one
> > > > +bit per balloon page (4KB), where bit N corresponds to the Nth PFN
> > > > +in the inflate request (0-indexed). Bit N is stored as bit (N mod 8)
> > > > +of byte (N / 8), with bit 0 being the least significant bit.
> > > > +The device sets a bit to 1 if it successfully initialized the
> > > > +corresponding page, or 0 if it did not.
> > >
> > > Does this mean page size cannot be larger than 4kb?
> >
> > With legacy balloon, pretty much.
> > This hack of sticking right-shifted PFNs in an outbuf
> > is a broken interface that can't even support large guests.
> > If someone worked on a better one, would be great.
> > But for now, this just supports zero reporting with that.
> 
> Makes sense. Should we mention it in the traditional balloon device
> description? Or even put device and driver MUST statements that page
> size is always 4kb.
> 
> For this patch:
> 
> Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
> 
> >
> > --
> > MST
> >

Well it says:

  \item The driver constructs an array of addresses of unused memory
    pages. These addresses are divided by 4096\footnote{This is historical, and independent of the guest page size.
} and the descriptor
    describing the resulting 32-bit array is added to the inflateq.
  \end{enumerate}


having said that:

- it should be "a device read-only buffer is made available in the
  inflateq".

- the text mixes "pages as in arbitrary chunks of memory" for page
  hinting/reporting
and
- pages as in 4k chunks for inflate/deflate


if there's work to modernize balloon, fixing these might be a
prerequisite