hw/virtio/virtio-balloon.c

   1 /*
   2  * Virtio Balloon Device
   3  *
   4  * Copyright IBM, Corp. 2008
   5  * Copyright (C) 2011 Red Hat, Inc.
   6  * Copyright (C) 2011 Amit Shah <amit.shah@redhat.com>
   7  *
   8  * Authors:
   9  *  Anthony Liguori   <aliguori@us.ibm.com>
  10  *
  11  * This work is licensed under the terms of the GNU GPL, version 2.  See
  12  * the COPYING file in the top-level directory.
  13  *
  14  */
  15
  16 #include "qemu/osdep.h"
  17 #include "qemu/iov.h"
  18 #include "qemu/module.h"
  19 #include "qemu/timer.h"
  20 #include "hw/virtio/virtio.h"
  21 #include "hw/mem/pc-dimm.h"
  22 #include "sysemu/balloon.h"
  23 #include "hw/virtio/virtio-balloon.h"
  24 #include "exec/address-spaces.h"
  25 #include "qapi/error.h"
  26 #include "qapi/qapi-events-misc.h"
  27 #include "qapi/visitor.h"
  28 #include "trace.h"
  29 #include "qemu/error-report.h"
  30 #include "migration/misc.h"
  31
  32 #include "hw/virtio/virtio-bus.h"
  33 #include "hw/virtio/virtio-access.h"
  34
  35 #define BALLOON_PAGE_SIZE  (1 << VIRTIO_BALLOON_PFN_SHIFT)
  36
  37 struct PartiallyBalloonedPage {
  38     RAMBlock *rb;
  39     ram_addr_t base;
  40     unsigned long bitmap[];
  41 };
  42
  43 static void balloon_inflate_page(VirtIOBalloon *balloon,
  44                                  MemoryRegion *mr, hwaddr offset)
  45 {
  46     void *addr = memory_region_get_ram_ptr(mr) + offset;
  47     RAMBlock *rb;
  48     size_t rb_page_size;
  49     int subpages;
  50     ram_addr_t ram_offset, host_page_base;
  51
  52     /* XXX is there a better way to get to the RAMBlock than via a
  53      * host address? */
  54     rb = qemu_ram_block_from_host(addr, false, &ram_offset);
  55     rb_page_size = qemu_ram_pagesize(rb);
  56     host_page_base = ram_offset & ~(rb_page_size - 1);
  57
  58     if (rb_page_size == BALLOON_PAGE_SIZE) {
  59         /* Easy case */
  60
  61         ram_block_discard_range(rb, ram_offset, rb_page_size);
  62         /* We ignore errors from ram_block_discard_range(), because it
  63          * has already reported them, and failing to discard a balloon
  64          * page is not fatal */
  65         return;
  66     }
  67
  68     /* Hard case
  69      *
  70      * We've put a piece of a larger host page into the balloon - we
  71      * need to keep track until we have a whole host page to
  72      * discard
  73      */
  74     warn_report_once(
  75 "Balloon used with backing page size > 4kiB, this may not be reliable");
  76
  77     subpages = rb_page_size / BALLOON_PAGE_SIZE;
  78
  79     if (balloon->pbp
  80         && (rb != balloon->pbp->rb
  81             || host_page_base != balloon->pbp->base)) {
  82         /* We've partially ballooned part of a host page, but now
  83          * we're trying to balloon part of a different one.  Too hard,
  84          * give up on the old partial page */
  85         g_free(balloon->pbp);
  86         balloon->pbp = NULL;
  87     }
  88
  89     if (!balloon->pbp) {
  90         /* Starting on a new host page */
  91         size_t bitlen = BITS_TO_LONGS(subpages) * sizeof(unsigned long);
  92         balloon->pbp = g_malloc0(sizeof(PartiallyBalloonedPage) + bitlen);
  93         balloon->pbp->rb = rb;
  94         balloon->pbp->base = host_page_base;
  95     }
  96
  97     bitmap_set(balloon->pbp->bitmap,
  98                (ram_offset - balloon->pbp->base) / BALLOON_PAGE_SIZE,
  99                subpages);
 100
 101     if (bitmap_full(balloon->pbp->bitmap, subpages)) {
 102         /* We've accumulated a full host page, we can actually discard
 103          * it now */
 104
 105         ram_block_discard_range(rb, balloon->pbp->base, rb_page_size);
 106         /* We ignore errors from ram_block_discard_range(), because it
 107          * has already reported them, and failing to discard a balloon
 108          * page is not fatal */
 109
 110         g_free(balloon->pbp);
 111         balloon->pbp = NULL;
 112     }
 113 }
 114
 115 static void balloon_deflate_page(VirtIOBalloon *balloon,
 116                                  MemoryRegion *mr, hwaddr offset)
 117 {
 118     void *addr = memory_region_get_ram_ptr(mr) + offset;
 119     RAMBlock *rb;
 120     size_t rb_page_size;
 121     ram_addr_t ram_offset, host_page_base;
 122     void *host_addr;
 123     int ret;
 124
 125     /* XXX is there a better way to get to the RAMBlock than via a
 126      * host address? */
 127     rb = qemu_ram_block_from_host(addr, false, &ram_offset);
 128     rb_page_size = qemu_ram_pagesize(rb);
 129     host_page_base = ram_offset & ~(rb_page_size - 1);
 130
 131     if (balloon->pbp
 132         && rb == balloon->pbp->rb
 133         && host_page_base == balloon->pbp->base) {
 134         int subpages = rb_page_size / BALLOON_PAGE_SIZE;
 135
 136         /*
 137          * This means the guest has asked to discard some of the 4kiB
 138          * subpages of a host page, but then changed its mind and
 139          * asked to keep them after all.  It's exceedingly unlikely
 140          * for a guest to do this in practice, but handle it anyway,
 141          * since getting it wrong could mean discarding memory the
 142          * guest is still using. */
 143         bitmap_clear(balloon->pbp->bitmap,
 144                      (ram_offset - balloon->pbp->base) / BALLOON_PAGE_SIZE,
 145                      subpages);
 146
 147         if (bitmap_empty(balloon->pbp->bitmap, subpages)) {
 148             g_free(balloon->pbp);
 149             balloon->pbp = NULL;
 150         }
 151     }
 152
 153     host_addr = (void *)((uintptr_t)addr & ~(rb_page_size - 1));
 154
 155     /* When a page is deflated, we hint the whole host page it lives
 156      * on, since we can't do anything smaller */
 157     ret = qemu_madvise(host_addr, rb_page_size, QEMU_MADV_WILLNEED);
 158     if (ret != 0) {
 159         warn_report("Couldn't MADV_WILLNEED on balloon deflate: %s",
 160                     strerror(errno));
 161         /* Otherwise ignore, failing to page hint shouldn't be fatal */
 162     }
 163 }
 164
 165 static const char *balloon_stat_names[] = {
 166    [VIRTIO_BALLOON_S_SWAP_IN] = "stat-swap-in",
 167    [VIRTIO_BALLOON_S_SWAP_OUT] = "stat-swap-out",
 168    [VIRTIO_BALLOON_S_MAJFLT] = "stat-major-faults",
 169    [VIRTIO_BALLOON_S_MINFLT] = "stat-minor-faults",
 170    [VIRTIO_BALLOON_S_MEMFREE] = "stat-free-memory",
 171    [VIRTIO_BALLOON_S_MEMTOT] = "stat-total-memory",
 172    [VIRTIO_BALLOON_S_AVAIL] = "stat-available-memory",
 173    [VIRTIO_BALLOON_S_CACHES] = "stat-disk-caches",
 174    [VIRTIO_BALLOON_S_HTLB_PGALLOC] = "stat-htlb-pgalloc",
 175    [VIRTIO_BALLOON_S_HTLB_PGFAIL] = "stat-htlb-pgfail",
 176    [VIRTIO_BALLOON_S_NR] = NULL
 177 };
 178
 179 /*
 180  * reset_stats - Mark all items in the stats array as unset
 181  *
 182  * This function needs to be called at device initialization and before
 183  * updating to a set of newly-generated stats.  This will ensure that no
 184  * stale values stick around in case the guest reports a subset of the supported
 185  * statistics.
 186  */
 187 static inline void reset_stats(VirtIOBalloon *dev)
 188 {
 189     int i;
 190     for (i = 0; i < VIRTIO_BALLOON_S_NR; dev->stats[i++] = -1);
 191 }
 192
 193 static bool balloon_stats_supported(const VirtIOBalloon *s)
 194 {
 195     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 196     return virtio_vdev_has_feature(vdev, VIRTIO_BALLOON_F_STATS_VQ);
 197 }
 198
 199 static bool balloon_stats_enabled(const VirtIOBalloon *s)
 200 {
 201     return s->stats_poll_interval > 0;
 202 }
 203
 204 static void balloon_stats_destroy_timer(VirtIOBalloon *s)
 205 {
 206     if (balloon_stats_enabled(s)) {
 207         timer_del(s->stats_timer);
 208         timer_free(s->stats_timer);
 209         s->stats_timer = NULL;
 210         s->stats_poll_interval = 0;
 211     }
 212 }
 213
 214 static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs)
 215 {
 216     timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000);
 217 }
 218
 219 static void balloon_stats_poll_cb(void *opaque)
 220 {
 221     VirtIOBalloon *s = opaque;
 222     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 223
 224     if (s->stats_vq_elem == NULL || !balloon_stats_supported(s)) {
 225         /* re-schedule */
 226         balloon_stats_change_timer(s, s->stats_poll_interval);
 227         return;
 228     }
 229
 230     virtqueue_push(s->svq, s->stats_vq_elem, s->stats_vq_offset);
 231     virtio_notify(vdev, s->svq);
 232     g_free(s->stats_vq_elem);
 233     s->stats_vq_elem = NULL;
 234 }
 235
 236 static void balloon_stats_get_all(Object *obj, Visitor *v, const char *name,
 237                                   void *opaque, Error **errp)
 238 {
 239     Error *err = NULL;
 240     VirtIOBalloon *s = opaque;
 241     int i;
 242
 243     visit_start_struct(v, name, NULL, 0, &err);
 244     if (err) {
 245         goto out;
 246     }
 247     visit_type_int(v, "last-update", &s->stats_last_update, &err);
 248     if (err) {
 249         goto out_end;
 250     }
 251
 252     visit_start_struct(v, "stats", NULL, 0, &err);
 253     if (err) {
 254         goto out_end;
 255     }
 256     for (i = 0; i < VIRTIO_BALLOON_S_NR; i++) {
 257         visit_type_uint64(v, balloon_stat_names[i], &s->stats[i], &err);
 258         if (err) {
 259             goto out_nested;
 260         }
 261     }
 262     visit_check_struct(v, &err);
 263 out_nested:
 264     visit_end_struct(v, NULL);
 265
 266     if (!err) {
 267         visit_check_struct(v, &err);
 268     }
 269 out_end:
 270     visit_end_struct(v, NULL);
 271 out:
 272     error_propagate(errp, err);
 273 }
 274
 275 static void balloon_stats_get_poll_interval(Object *obj, Visitor *v,
 276                                             const char *name, void *opaque,
 277                                             Error **errp)
 278 {
 279     VirtIOBalloon *s = opaque;
 280     visit_type_int(v, name, &s->stats_poll_interval, errp);
 281 }
 282
 283 static void balloon_stats_set_poll_interval(Object *obj, Visitor *v,
 284                                             const char *name, void *opaque,
 285                                             Error **errp)
 286 {
 287     VirtIOBalloon *s = opaque;
 288     Error *local_err = NULL;
 289     int64_t value;
 290
 291     visit_type_int(v, name, &value, &local_err);
 292     if (local_err) {
 293         error_propagate(errp, local_err);
 294         return;
 295     }
 296
 297     if (value < 0) {
 298         error_setg(errp, "timer value must be greater than zero");
 299         return;
 300     }
 301
 302     if (value > UINT32_MAX) {
 303         error_setg(errp, "timer value is too big");
 304         return;
 305     }
 306
 307     if (value == s->stats_poll_interval) {
 308         return;
 309     }
 310
 311     if (value == 0) {
 312         /* timer=0 disables the timer */
 313         balloon_stats_destroy_timer(s);
 314         return;
 315     }
 316
 317     if (balloon_stats_enabled(s)) {
 318         /* timer interval change */
 319         s->stats_poll_interval = value;
 320         balloon_stats_change_timer(s, value);
 321         return;
 322     }
 323
 324     /* create a new timer */
 325     g_assert(s->stats_timer == NULL);
 326     s->stats_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, balloon_stats_poll_cb, s);
 327     s->stats_poll_interval = value;
 328     balloon_stats_change_timer(s, 0);
 329 }
 330
 331 static void virtio_balloon_handle_output(VirtIODevice *vdev, VirtQueue *vq)
 332 {
 333     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
 334     VirtQueueElement *elem;
 335     MemoryRegionSection section;
 336
 337     for (;;) {
 338         size_t offset = 0;
 339         uint32_t pfn;
 340         elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
 341         if (!elem) {
 342             return;
 343         }
 344
 345         while (iov_to_buf(elem->out_sg, elem->out_num, offset, &pfn, 4) == 4) {
 346             hwaddr pa;
 347             int p = virtio_ldl_p(vdev, &pfn);
 348
 349             pa = (hwaddr) p << VIRTIO_BALLOON_PFN_SHIFT;
 350             offset += 4;
 351
 352             section = memory_region_find(get_system_memory(), pa,
 353                                          BALLOON_PAGE_SIZE);
 354             if (!section.mr) {
 355                 trace_virtio_balloon_bad_addr(pa);
 356                 continue;
 357             }
 358             if (!memory_region_is_ram(section.mr) ||
 359                 memory_region_is_rom(section.mr) ||
 360                 memory_region_is_romd(section.mr)) {
 361                 trace_virtio_balloon_bad_addr(pa);
 362                 memory_region_unref(section.mr);
 363                 continue;
 364             }
 365
 366             trace_virtio_balloon_handle_output(memory_region_name(section.mr),
 367                                                pa);
 368             if (!qemu_balloon_is_inhibited()) {
 369                 if (vq == s->ivq) {
 370                     balloon_inflate_page(s, section.mr,
 371                                          section.offset_within_region);
 372                 } else if (vq == s->dvq) {
 373                     balloon_deflate_page(s, section.mr, section.offset_within_region);
 374                 } else {
 375                     g_assert_not_reached();
 376                 }
 377             }
 378             memory_region_unref(section.mr);
 379         }
 380
 381         virtqueue_push(vq, elem, offset);
 382         virtio_notify(vdev, vq);
 383         g_free(elem);
 384     }
 385 }
 386
 387 static void virtio_balloon_receive_stats(VirtIODevice *vdev, VirtQueue *vq)
 388 {
 389     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
 390     VirtQueueElement *elem;
 391     VirtIOBalloonStat stat;
 392     size_t offset = 0;
 393     qemu_timeval tv;
 394
 395     elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
 396     if (!elem) {
 397         goto out;
 398     }
 399
 400     if (s->stats_vq_elem != NULL) {
 401         /* This should never happen if the driver follows the spec. */
 402         virtqueue_push(vq, s->stats_vq_elem, 0);
 403         virtio_notify(vdev, vq);
 404         g_free(s->stats_vq_elem);
 405     }
 406
 407     s->stats_vq_elem = elem;
 408
 409     /* Initialize the stats to get rid of any stale values.  This is only
 410      * needed to handle the case where a guest supports fewer stats than it
 411      * used to (ie. it has booted into an old kernel).
 412      */
 413     reset_stats(s);
 414
 415     while (iov_to_buf(elem->out_sg, elem->out_num, offset, &stat, sizeof(stat))
 416            == sizeof(stat)) {
 417         uint16_t tag = virtio_tswap16(vdev, stat.tag);
 418         uint64_t val = virtio_tswap64(vdev, stat.val);
 419
 420         offset += sizeof(stat);
 421         if (tag < VIRTIO_BALLOON_S_NR)
 422             s->stats[tag] = val;
 423     }
 424     s->stats_vq_offset = offset;
 425
 426     if (qemu_gettimeofday(&tv) < 0) {
 427         warn_report("%s: failed to get time of day", __func__);
 428         goto out;
 429     }
 430
 431     s->stats_last_update = tv.tv_sec;
 432
 433 out:
 434     if (balloon_stats_enabled(s)) {
 435         balloon_stats_change_timer(s, s->stats_poll_interval);
 436     }
 437 }
 438
 439 static void virtio_balloon_handle_free_page_vq(VirtIODevice *vdev,
 440                                                VirtQueue *vq)
 441 {
 442     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
 443     qemu_bh_schedule(s->free_page_bh);
 444 }
 445
 446 static bool get_free_page_hints(VirtIOBalloon *dev)
 447 {
 448     VirtQueueElement *elem;
 449     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 450     VirtQueue *vq = dev->free_page_vq;
 451     bool ret = true;
 452
 453     while (dev->block_iothread) {
 454         qemu_cond_wait(&dev->free_page_cond, &dev->free_page_lock);
 455     }
 456
 457     elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
 458     if (!elem) {
 459         return false;
 460     }
 461
 462     if (elem->out_num) {
 463         uint32_t id;
 464         size_t size = iov_to_buf(elem->out_sg, elem->out_num, 0,
 465                                  &id, sizeof(id));
 466
 467         virtio_tswap32s(vdev, &id);
 468         if (unlikely(size != sizeof(id))) {
 469             virtio_error(vdev, "received an incorrect cmd id");
 470             ret = false;
 471             goto out;
 472         }
 473         if (id == dev->free_page_report_cmd_id) {
 474             dev->free_page_report_status = FREE_PAGE_REPORT_S_START;
 475         } else {
 476             /*
 477              * Stop the optimization only when it has started. This
 478              * avoids a stale stop sign for the previous command.
 479              */
 480             if (dev->free_page_report_status == FREE_PAGE_REPORT_S_START) {
 481                 dev->free_page_report_status = FREE_PAGE_REPORT_S_STOP;
 482             }
 483         }
 484     }
 485
 486     if (elem->in_num) {
 487         if (dev->free_page_report_status == FREE_PAGE_REPORT_S_START) {
 488             qemu_guest_free_page_hint(elem->in_sg[0].iov_base,
 489                                       elem->in_sg[0].iov_len);
 490         }
 491     }
 492
 493 out:
 494     virtqueue_push(vq, elem, 1);
 495     g_free(elem);
 496     return ret;
 497 }
 498
 499 static void virtio_ballloon_get_free_page_hints(void *opaque)
 500 {
 501     VirtIOBalloon *dev = opaque;
 502     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 503     VirtQueue *vq = dev->free_page_vq;
 504     bool continue_to_get_hints;
 505
 506     do {
 507         qemu_mutex_lock(&dev->free_page_lock);
 508         virtio_queue_set_notification(vq, 0);
 509         continue_to_get_hints = get_free_page_hints(dev);
 510         qemu_mutex_unlock(&dev->free_page_lock);
 511         virtio_notify(vdev, vq);
 512       /*
 513        * Start to poll the vq once the reporting started. Otherwise, continue
 514        * only when there are entries on the vq, which need to be given back.
 515        */
 516     } while (continue_to_get_hints ||
 517              dev->free_page_report_status == FREE_PAGE_REPORT_S_START);
 518     virtio_queue_set_notification(vq, 1);
 519 }
 520
 521 static bool virtio_balloon_free_page_support(void *opaque)
 522 {
 523     VirtIOBalloon *s = opaque;
 524     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 525
 526     return virtio_vdev_has_feature(vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT);
 527 }
 528
 529 static void virtio_balloon_free_page_start(VirtIOBalloon *s)
 530 {
 531     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 532
 533     /* For the stop and copy phase, we don't need to start the optimization */
 534     if (!vdev->vm_running) {
 535         return;
 536     }
 537
 538     if (s->free_page_report_cmd_id == UINT_MAX) {
 539         s->free_page_report_cmd_id =
 540                        VIRTIO_BALLOON_FREE_PAGE_REPORT_CMD_ID_MIN;
 541     } else {
 542         s->free_page_report_cmd_id++;
 543     }
 544
 545     s->free_page_report_status = FREE_PAGE_REPORT_S_REQUESTED;
 546     virtio_notify_config(vdev);
 547 }
 548
 549 static void virtio_balloon_free_page_stop(VirtIOBalloon *s)
 550 {
 551     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 552
 553     if (s->free_page_report_status != FREE_PAGE_REPORT_S_STOP) {
 554         /*
 555          * The lock also guarantees us that the
 556          * virtio_ballloon_get_free_page_hints exits after the
 557          * free_page_report_status is set to S_STOP.
 558          */
 559         qemu_mutex_lock(&s->free_page_lock);
 560         /*
 561          * The guest hasn't done the reporting, so host sends a notification
 562          * to the guest to actively stop the reporting.
 563          */
 564         s->free_page_report_status = FREE_PAGE_REPORT_S_STOP;
 565         qemu_mutex_unlock(&s->free_page_lock);
 566         virtio_notify_config(vdev);
 567     }
 568 }
 569
 570 static void virtio_balloon_free_page_done(VirtIOBalloon *s)
 571 {
 572     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 573
 574     s->free_page_report_status = FREE_PAGE_REPORT_S_DONE;
 575     virtio_notify_config(vdev);
 576 }
 577
 578 static int
 579 virtio_balloon_free_page_report_notify(NotifierWithReturn *n, void *data)
 580 {
 581     VirtIOBalloon *dev = container_of(n, VirtIOBalloon,
 582                                       free_page_report_notify);
 583     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 584     PrecopyNotifyData *pnd = data;
 585
 586     if (!virtio_balloon_free_page_support(dev)) {
 587         /*
 588          * This is an optimization provided to migration, so just return 0 to
 589          * have the normal migration process not affected when this feature is
 590          * not supported.
 591          */
 592         return 0;
 593     }
 594
 595     switch (pnd->reason) {
 596     case PRECOPY_NOTIFY_SETUP:
 597         precopy_enable_free_page_optimization();
 598         break;
 599     case PRECOPY_NOTIFY_COMPLETE:
 600     case PRECOPY_NOTIFY_CLEANUP:
 601     case PRECOPY_NOTIFY_BEFORE_BITMAP_SYNC:
 602         virtio_balloon_free_page_stop(dev);
 603         break;
 604     case PRECOPY_NOTIFY_AFTER_BITMAP_SYNC:
 605         if (vdev->vm_running) {
 606             virtio_balloon_free_page_start(dev);
 607         } else {
 608             virtio_balloon_free_page_done(dev);
 609         }
 610         break;
 611     default:
 612         virtio_error(vdev, "%s: %d reason unknown", __func__, pnd->reason);
 613     }
 614
 615     return 0;
 616 }
 617
 618 static size_t virtio_balloon_config_size(VirtIOBalloon *s)
 619 {
 620     uint64_t features = s->host_features;
 621
 622     if (s->qemu_4_0_config_size) {
 623         return sizeof(struct virtio_balloon_config);
 624     }
 625     if (virtio_has_feature(features, VIRTIO_BALLOON_F_PAGE_POISON)) {
 626         return sizeof(struct virtio_balloon_config);
 627     }
 628     if (virtio_has_feature(features, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
 629         return offsetof(struct virtio_balloon_config, poison_val);
 630     }
 631     return offsetof(struct virtio_balloon_config, free_page_report_cmd_id);
 632 }
 633
 634 static void virtio_balloon_get_config(VirtIODevice *vdev, uint8_t *config_data)
 635 {
 636     VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
 637     struct virtio_balloon_config config = {};
 638
 639     config.num_pages = cpu_to_le32(dev->num_pages);
 640     config.actual = cpu_to_le32(dev->actual);
 641
 642     if (dev->free_page_report_status == FREE_PAGE_REPORT_S_REQUESTED) {
 643         config.free_page_report_cmd_id =
 644                        cpu_to_le32(dev->free_page_report_cmd_id);
 645     } else if (dev->free_page_report_status == FREE_PAGE_REPORT_S_STOP) {
 646         config.free_page_report_cmd_id =
 647                        cpu_to_le32(VIRTIO_BALLOON_CMD_ID_STOP);
 648     } else if (dev->free_page_report_status == FREE_PAGE_REPORT_S_DONE) {
 649         config.free_page_report_cmd_id =
 650                        cpu_to_le32(VIRTIO_BALLOON_CMD_ID_DONE);
 651     }
 652
 653     trace_virtio_balloon_get_config(config.num_pages, config.actual);
 654     memcpy(config_data, &config, virtio_balloon_config_size(dev));
 655 }
 656
 657 static int build_dimm_list(Object *obj, void *opaque)
 658 {
 659     GSList **list = opaque;
 660
 661     if (object_dynamic_cast(obj, TYPE_PC_DIMM)) {
 662         DeviceState *dev = DEVICE(obj);
 663         if (dev->realized) { /* only realized DIMMs matter */
 664             *list = g_slist_prepend(*list, dev);
 665         }
 666     }
 667
 668     object_child_foreach(obj, build_dimm_list, opaque);
 669     return 0;
 670 }
 671
 672 static ram_addr_t get_current_ram_size(void)
 673 {
 674     GSList *list = NULL, *item;
 675     ram_addr_t size = ram_size;
 676
 677     build_dimm_list(qdev_get_machine(), &list);
 678     for (item = list; item; item = g_slist_next(item)) {
 679         Object *obj = OBJECT(item->data);
 680         if (!strcmp(object_get_typename(obj), TYPE_PC_DIMM)) {
 681             size += object_property_get_int(obj, PC_DIMM_SIZE_PROP,
 682                                             &error_abort);
 683         }
 684     }
 685     g_slist_free(list);
 686
 687     return size;
 688 }
 689
 690 static void virtio_balloon_set_config(VirtIODevice *vdev,
 691                                       const uint8_t *config_data)
 692 {
 693     VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
 694     struct virtio_balloon_config config;
 695     uint32_t oldactual = dev->actual;
 696     ram_addr_t vm_ram_size = get_current_ram_size();
 697
 698     memcpy(&config, config_data, virtio_balloon_config_size(dev));
 699     dev->actual = le32_to_cpu(config.actual);
 700     if (dev->actual != oldactual) {
 701         qapi_event_send_balloon_change(vm_ram_size -
 702                         ((ram_addr_t) dev->actual << VIRTIO_BALLOON_PFN_SHIFT));
 703     }
 704     trace_virtio_balloon_set_config(dev->actual, oldactual);
 705 }
 706
 707 static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
 708                                             Error **errp)
 709 {
 710     VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
 711     f |= dev->host_features;
 712     virtio_add_feature(&f, VIRTIO_BALLOON_F_STATS_VQ);
 713
 714     return f;
 715 }
 716
 717 static void virtio_balloon_stat(void *opaque, BalloonInfo *info)
 718 {
 719     VirtIOBalloon *dev = opaque;
 720     info->actual = get_current_ram_size() - ((uint64_t) dev->actual <<
 721                                              VIRTIO_BALLOON_PFN_SHIFT);
 722 }
 723
 724 static void virtio_balloon_to_target(void *opaque, ram_addr_t target)
 725 {
 726     VirtIOBalloon *dev = VIRTIO_BALLOON(opaque);
 727     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 728     ram_addr_t vm_ram_size = get_current_ram_size();
 729
 730     if (target > vm_ram_size) {
 731         target = vm_ram_size;
 732     }
 733     if (target) {
 734         dev->num_pages = (vm_ram_size - target) >> VIRTIO_BALLOON_PFN_SHIFT;
 735         virtio_notify_config(vdev);
 736     }
 737     trace_virtio_balloon_to_target(target, dev->num_pages);
 738 }
 739
 740 static int virtio_balloon_post_load_device(void *opaque, int version_id)
 741 {
 742     VirtIOBalloon *s = VIRTIO_BALLOON(opaque);
 743
 744     if (balloon_stats_enabled(s)) {
 745         balloon_stats_change_timer(s, s->stats_poll_interval);
 746     }
 747     return 0;
 748 }
 749
 750 static const VMStateDescription vmstate_virtio_balloon_free_page_report = {
 751     .name = "virtio-balloon-device/free-page-report",
 752     .version_id = 1,
 753     .minimum_version_id = 1,
 754     .needed = virtio_balloon_free_page_support,
 755     .fields = (VMStateField[]) {
 756         VMSTATE_UINT32(free_page_report_cmd_id, VirtIOBalloon),
 757         VMSTATE_UINT32(free_page_report_status, VirtIOBalloon),
 758         VMSTATE_END_OF_LIST()
 759     }
 760 };
 761
 762 static const VMStateDescription vmstate_virtio_balloon_device = {
 763     .name = "virtio-balloon-device",
 764     .version_id = 1,
 765     .minimum_version_id = 1,
 766     .post_load = virtio_balloon_post_load_device,
 767     .fields = (VMStateField[]) {
 768         VMSTATE_UINT32(num_pages, VirtIOBalloon),
 769         VMSTATE_UINT32(actual, VirtIOBalloon),
 770         VMSTATE_END_OF_LIST()
 771     },
 772     .subsections = (const VMStateDescription * []) {
 773         &vmstate_virtio_balloon_free_page_report,
 774         NULL
 775     }
 776 };
 777
 778 static void virtio_balloon_device_realize(DeviceState *dev, Error **errp)
 779 {
 780     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 781     VirtIOBalloon *s = VIRTIO_BALLOON(dev);
 782     int ret;
 783
 784     virtio_init(vdev, "virtio-balloon", VIRTIO_ID_BALLOON,
 785                 virtio_balloon_config_size(s));
 786
 787     ret = qemu_add_balloon_handler(virtio_balloon_to_target,
 788                                    virtio_balloon_stat, s);
 789
 790     if (ret < 0) {
 791         error_setg(errp, "Only one balloon device is supported");
 792         virtio_cleanup(vdev);
 793         return;
 794     }
 795
 796     s->ivq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output);
 797     s->dvq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output);
 798     s->svq = virtio_add_queue(vdev, 128, virtio_balloon_receive_stats);
 799
 800     if (virtio_has_feature(s->host_features,
 801                            VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
 802         s->free_page_vq = virtio_add_queue(vdev, VIRTQUEUE_MAX_SIZE,
 803                                            virtio_balloon_handle_free_page_vq);
 804         s->free_page_report_status = FREE_PAGE_REPORT_S_STOP;
 805         s->free_page_report_cmd_id =
 806                            VIRTIO_BALLOON_FREE_PAGE_REPORT_CMD_ID_MIN;
 807         s->free_page_report_notify.notify =
 808                                        virtio_balloon_free_page_report_notify;
 809         precopy_add_notifier(&s->free_page_report_notify);
 810         if (s->iothread) {
 811             object_ref(OBJECT(s->iothread));
 812             s->free_page_bh = aio_bh_new(iothread_get_aio_context(s->iothread),
 813                                        virtio_ballloon_get_free_page_hints, s);
 814             qemu_mutex_init(&s->free_page_lock);
 815             qemu_cond_init(&s->free_page_cond);
 816             s->block_iothread = false;
 817         } else {
 818             /* Simply disable this feature if the iothread wasn't created. */
 819             s->host_features &= ~(1 << VIRTIO_BALLOON_F_FREE_PAGE_HINT);
 820             virtio_error(vdev, "iothread is missing");
 821         }
 822     }
 823     reset_stats(s);
 824 }
 825
 826 static void virtio_balloon_device_unrealize(DeviceState *dev, Error **errp)
 827 {
 828     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 829     VirtIOBalloon *s = VIRTIO_BALLOON(dev);
 830
 831     if (virtio_balloon_free_page_support(s)) {
 832         qemu_bh_delete(s->free_page_bh);
 833         virtio_balloon_free_page_stop(s);
 834         precopy_remove_notifier(&s->free_page_report_notify);
 835     }
 836     balloon_stats_destroy_timer(s);
 837     qemu_remove_balloon_handler(s);
 838     virtio_cleanup(vdev);
 839 }
 840
 841 static void virtio_balloon_device_reset(VirtIODevice *vdev)
 842 {
 843     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
 844
 845     if (virtio_balloon_free_page_support(s)) {
 846         virtio_balloon_free_page_stop(s);
 847     }
 848
 849     if (s->stats_vq_elem != NULL) {
 850         virtqueue_unpop(s->svq, s->stats_vq_elem, 0);
 851         g_free(s->stats_vq_elem);
 852         s->stats_vq_elem = NULL;
 853     }
 854 }
 855
 856 static void virtio_balloon_set_status(VirtIODevice *vdev, uint8_t status)
 857 {
 858     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
 859
 860     if (!s->stats_vq_elem && vdev->vm_running &&
 861         (status & VIRTIO_CONFIG_S_DRIVER_OK) && virtqueue_rewind(s->svq, 1)) {
 862         /* poll stats queue for the element we have discarded when the VM
 863          * was stopped */
 864         virtio_balloon_receive_stats(vdev, s->svq);
 865     }
 866
 867     if (virtio_balloon_free_page_support(s)) {
 868         /*
 869          * The VM is woken up and the iothread was blocked, so signal it to
 870          * continue.
 871          */
 872         if (vdev->vm_running && s->block_iothread) {
 873             qemu_mutex_lock(&s->free_page_lock);
 874             s->block_iothread = false;
 875             qemu_cond_signal(&s->free_page_cond);
 876             qemu_mutex_unlock(&s->free_page_lock);
 877         }
 878
 879         /* The VM is stopped, block the iothread. */
 880         if (!vdev->vm_running) {
 881             qemu_mutex_lock(&s->free_page_lock);
 882             s->block_iothread = true;
 883             qemu_mutex_unlock(&s->free_page_lock);
 884         }
 885     }
 886 }
 887
 888 static void virtio_balloon_instance_init(Object *obj)
 889 {
 890     VirtIOBalloon *s = VIRTIO_BALLOON(obj);
 891
 892     object_property_add(obj, "guest-stats", "guest statistics",
 893                         balloon_stats_get_all, NULL, NULL, s, NULL);
 894
 895     object_property_add(obj, "guest-stats-polling-interval", "int",
 896                         balloon_stats_get_poll_interval,
 897                         balloon_stats_set_poll_interval,
 898                         NULL, s, NULL);
 899 }
 900
 901 static const VMStateDescription vmstate_virtio_balloon = {
 902     .name = "virtio-balloon",
 903     .minimum_version_id = 1,
 904     .version_id = 1,
 905     .fields = (VMStateField[]) {
 906         VMSTATE_VIRTIO_DEVICE,
 907         VMSTATE_END_OF_LIST()
 908     },
 909 };
 910
 911 static Property virtio_balloon_properties[] = {
 912     DEFINE_PROP_BIT("deflate-on-oom", VirtIOBalloon, host_features,
 913                     VIRTIO_BALLOON_F_DEFLATE_ON_OOM, false),
 914     DEFINE_PROP_BIT("free-page-hint", VirtIOBalloon, host_features,
 915                     VIRTIO_BALLOON_F_FREE_PAGE_HINT, false),
 916     /* QEMU 4.0 accidentally changed the config size even when free-page-hint
 917      * is disabled, resulting in QEMU 3.1 migration incompatibility.  This
 918      * property retains this quirk for QEMU 4.1 machine types.
 919      */
 920     DEFINE_PROP_BOOL("qemu-4-0-config-size", VirtIOBalloon,
 921                      qemu_4_0_config_size, false),
 922     DEFINE_PROP_LINK("iothread", VirtIOBalloon, iothread, TYPE_IOTHREAD,
 923                      IOThread *),
 924     DEFINE_PROP_END_OF_LIST(),
 925 };
 926
 927 static void virtio_balloon_class_init(ObjectClass *klass, void *data)
 928 {
 929     DeviceClass *dc = DEVICE_CLASS(klass);
 930     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
 931
 932     dc->props = virtio_balloon_properties;
 933     dc->vmsd = &vmstate_virtio_balloon;
 934     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 935     vdc->realize = virtio_balloon_device_realize;
 936     vdc->unrealize = virtio_balloon_device_unrealize;
 937     vdc->reset = virtio_balloon_device_reset;
 938     vdc->get_config = virtio_balloon_get_config;
 939     vdc->set_config = virtio_balloon_set_config;
 940     vdc->get_features = virtio_balloon_get_features;
 941     vdc->set_status = virtio_balloon_set_status;
 942     vdc->vmsd = &vmstate_virtio_balloon_device;
 943 }
 944
 945 static const TypeInfo virtio_balloon_info = {
 946     .name = TYPE_VIRTIO_BALLOON,
 947     .parent = TYPE_VIRTIO_DEVICE,
 948     .instance_size = sizeof(VirtIOBalloon),
 949     .instance_init = virtio_balloon_instance_init,
 950     .class_init = virtio_balloon_class_init,
 951 };
 952
 953 static void virtio_register_types(void)
 954 {
 955     type_register_static(&virtio_balloon_info);
 956 }
 957
 958 type_init(virtio_register_types)