hw/virtio/virtio-balloon.c

   1 /*
   2  * Virtio Balloon Device
   3  *
   4  * Copyright IBM, Corp. 2008
   5  * Copyright (C) 2011 Red Hat, Inc.
   6  * Copyright (C) 2011 Amit Shah <amit.shah@redhat.com>
   7  *
   8  * Authors:
   9  *  Anthony Liguori   <aliguori@us.ibm.com>
  10  *
  11  * This work is licensed under the terms of the GNU GPL, version 2.  See
  12  * the COPYING file in the top-level directory.
  13  *
  14  */
  15
  16 #include "qemu/osdep.h"
  17 #include "qemu/iov.h"
  18 #include "qemu/module.h"
  19 #include "qemu/timer.h"
  20 #include "hw/virtio/virtio.h"
  21 #include "hw/mem/pc-dimm.h"
  22 #include "hw/qdev-properties.h"
  23 #include "sysemu/balloon.h"
  24 #include "hw/virtio/virtio-balloon.h"
  25 #include "exec/address-spaces.h"
  26 #include "qapi/error.h"
  27 #include "qapi/qapi-events-misc.h"
  28 #include "qapi/visitor.h"
  29 #include "trace.h"
  30 #include "qemu/error-report.h"
  31 #include "migration/misc.h"
  32
  33 #include "hw/virtio/virtio-bus.h"
  34 #include "hw/virtio/virtio-access.h"
  35
  36 #define BALLOON_PAGE_SIZE  (1 << VIRTIO_BALLOON_PFN_SHIFT)
  37
  38 typedef struct PartiallyBalloonedPage {
  39     ram_addr_t base_gpa;
  40     unsigned long *bitmap;
  41 } PartiallyBalloonedPage;
  42
  43 static void virtio_balloon_pbp_free(PartiallyBalloonedPage *pbp)
  44 {
  45     if (!pbp->bitmap) {
  46         return;
  47     }
  48     g_free(pbp->bitmap);
  49     pbp->bitmap = NULL;
  50 }
  51
  52 static void virtio_balloon_pbp_alloc(PartiallyBalloonedPage *pbp,
  53                                      ram_addr_t base_gpa,
  54                                      long subpages)
  55 {
  56     pbp->base_gpa = base_gpa;
  57     pbp->bitmap = bitmap_new(subpages);
  58 }
  59
  60 static bool virtio_balloon_pbp_matches(PartiallyBalloonedPage *pbp,
  61                                        ram_addr_t base_gpa)
  62 {
  63     return pbp->base_gpa == base_gpa;
  64 }
  65
  66 static void balloon_inflate_page(VirtIOBalloon *balloon,
  67                                  MemoryRegion *mr, hwaddr mr_offset,
  68                                  PartiallyBalloonedPage *pbp)
  69 {
  70     void *addr = memory_region_get_ram_ptr(mr) + mr_offset;
  71     ram_addr_t rb_offset, rb_aligned_offset, base_gpa;
  72     RAMBlock *rb;
  73     size_t rb_page_size;
  74     int subpages;
  75
  76     /* XXX is there a better way to get to the RAMBlock than via a
  77      * host address? */
  78     rb = qemu_ram_block_from_host(addr, false, &rb_offset);
  79     rb_page_size = qemu_ram_pagesize(rb);
  80
  81     if (rb_page_size == BALLOON_PAGE_SIZE) {
  82         /* Easy case */
  83
  84         ram_block_discard_range(rb, rb_offset, rb_page_size);
  85         /* We ignore errors from ram_block_discard_range(), because it
  86          * has already reported them, and failing to discard a balloon
  87          * page is not fatal */
  88         return;
  89     }
  90
  91     /* Hard case
  92      *
  93      * We've put a piece of a larger host page into the balloon - we
  94      * need to keep track until we have a whole host page to
  95      * discard
  96      */
  97     warn_report_once(
  98 "Balloon used with backing page size > 4kiB, this may not be reliable");
  99
 100     rb_aligned_offset = QEMU_ALIGN_DOWN(rb_offset, rb_page_size);
 101     subpages = rb_page_size / BALLOON_PAGE_SIZE;
 102     base_gpa = memory_region_get_ram_addr(mr) + mr_offset -
 103                (rb_offset - rb_aligned_offset);
 104
 105     if (pbp->bitmap && !virtio_balloon_pbp_matches(pbp, base_gpa)) {
 106         /* We've partially ballooned part of a host page, but now
 107          * we're trying to balloon part of a different one.  Too hard,
 108          * give up on the old partial page */
 109         virtio_balloon_pbp_free(pbp);
 110     }
 111
 112     if (!pbp->bitmap) {
 113         virtio_balloon_pbp_alloc(pbp, base_gpa, subpages);
 114     }
 115
 116     set_bit((rb_offset - rb_aligned_offset) / BALLOON_PAGE_SIZE,
 117             pbp->bitmap);
 118
 119     if (bitmap_full(pbp->bitmap, subpages)) {
 120         /* We've accumulated a full host page, we can actually discard
 121          * it now */
 122
 123         ram_block_discard_range(rb, rb_aligned_offset, rb_page_size);
 124         /* We ignore errors from ram_block_discard_range(), because it
 125          * has already reported them, and failing to discard a balloon
 126          * page is not fatal */
 127         virtio_balloon_pbp_free(pbp);
 128     }
 129 }
 130
 131 static void balloon_deflate_page(VirtIOBalloon *balloon,
 132                                  MemoryRegion *mr, hwaddr mr_offset)
 133 {
 134     void *addr = memory_region_get_ram_ptr(mr) + mr_offset;
 135     ram_addr_t rb_offset;
 136     RAMBlock *rb;
 137     size_t rb_page_size;
 138     void *host_addr;
 139     int ret;
 140
 141     /* XXX is there a better way to get to the RAMBlock than via a
 142      * host address? */
 143     rb = qemu_ram_block_from_host(addr, false, &rb_offset);
 144     rb_page_size = qemu_ram_pagesize(rb);
 145
 146     host_addr = (void *)((uintptr_t)addr & ~(rb_page_size - 1));
 147
 148     /* When a page is deflated, we hint the whole host page it lives
 149      * on, since we can't do anything smaller */
 150     ret = qemu_madvise(host_addr, rb_page_size, QEMU_MADV_WILLNEED);
 151     if (ret != 0) {
 152         warn_report("Couldn't MADV_WILLNEED on balloon deflate: %s",
 153                     strerror(errno));
 154         /* Otherwise ignore, failing to page hint shouldn't be fatal */
 155     }
 156 }
 157
 158 static const char *balloon_stat_names[] = {
 159    [VIRTIO_BALLOON_S_SWAP_IN] = "stat-swap-in",
 160    [VIRTIO_BALLOON_S_SWAP_OUT] = "stat-swap-out",
 161    [VIRTIO_BALLOON_S_MAJFLT] = "stat-major-faults",
 162    [VIRTIO_BALLOON_S_MINFLT] = "stat-minor-faults",
 163    [VIRTIO_BALLOON_S_MEMFREE] = "stat-free-memory",
 164    [VIRTIO_BALLOON_S_MEMTOT] = "stat-total-memory",
 165    [VIRTIO_BALLOON_S_AVAIL] = "stat-available-memory",
 166    [VIRTIO_BALLOON_S_CACHES] = "stat-disk-caches",
 167    [VIRTIO_BALLOON_S_HTLB_PGALLOC] = "stat-htlb-pgalloc",
 168    [VIRTIO_BALLOON_S_HTLB_PGFAIL] = "stat-htlb-pgfail",
 169    [VIRTIO_BALLOON_S_NR] = NULL
 170 };
 171
 172 /*
 173  * reset_stats - Mark all items in the stats array as unset
 174  *
 175  * This function needs to be called at device initialization and before
 176  * updating to a set of newly-generated stats.  This will ensure that no
 177  * stale values stick around in case the guest reports a subset of the supported
 178  * statistics.
 179  */
 180 static inline void reset_stats(VirtIOBalloon *dev)
 181 {
 182     int i;
 183     for (i = 0; i < VIRTIO_BALLOON_S_NR; dev->stats[i++] = -1);
 184 }
 185
 186 static bool balloon_stats_supported(const VirtIOBalloon *s)
 187 {
 188     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 189     return virtio_vdev_has_feature(vdev, VIRTIO_BALLOON_F_STATS_VQ);
 190 }
 191
 192 static bool balloon_stats_enabled(const VirtIOBalloon *s)
 193 {
 194     return s->stats_poll_interval > 0;
 195 }
 196
 197 static void balloon_stats_destroy_timer(VirtIOBalloon *s)
 198 {
 199     if (balloon_stats_enabled(s)) {
 200         timer_del(s->stats_timer);
 201         timer_free(s->stats_timer);
 202         s->stats_timer = NULL;
 203         s->stats_poll_interval = 0;
 204     }
 205 }
 206
 207 static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs)
 208 {
 209     timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000);
 210 }
 211
 212 static void balloon_stats_poll_cb(void *opaque)
 213 {
 214     VirtIOBalloon *s = opaque;
 215     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 216
 217     if (s->stats_vq_elem == NULL || !balloon_stats_supported(s)) {
 218         /* re-schedule */
 219         balloon_stats_change_timer(s, s->stats_poll_interval);
 220         return;
 221     }
 222
 223     virtqueue_push(s->svq, s->stats_vq_elem, s->stats_vq_offset);
 224     virtio_notify(vdev, s->svq);
 225     g_free(s->stats_vq_elem);
 226     s->stats_vq_elem = NULL;
 227 }
 228
 229 static void balloon_stats_get_all(Object *obj, Visitor *v, const char *name,
 230                                   void *opaque, Error **errp)
 231 {
 232     Error *err = NULL;
 233     VirtIOBalloon *s = opaque;
 234     int i;
 235
 236     visit_start_struct(v, name, NULL, 0, &err);
 237     if (err) {
 238         goto out;
 239     }
 240     visit_type_int(v, "last-update", &s->stats_last_update, &err);
 241     if (err) {
 242         goto out_end;
 243     }
 244
 245     visit_start_struct(v, "stats", NULL, 0, &err);
 246     if (err) {
 247         goto out_end;
 248     }
 249     for (i = 0; i < VIRTIO_BALLOON_S_NR; i++) {
 250         visit_type_uint64(v, balloon_stat_names[i], &s->stats[i], &err);
 251         if (err) {
 252             goto out_nested;
 253         }
 254     }
 255     visit_check_struct(v, &err);
 256 out_nested:
 257     visit_end_struct(v, NULL);
 258
 259     if (!err) {
 260         visit_check_struct(v, &err);
 261     }
 262 out_end:
 263     visit_end_struct(v, NULL);
 264 out:
 265     error_propagate(errp, err);
 266 }
 267
 268 static void balloon_stats_get_poll_interval(Object *obj, Visitor *v,
 269                                             const char *name, void *opaque,
 270                                             Error **errp)
 271 {
 272     VirtIOBalloon *s = opaque;
 273     visit_type_int(v, name, &s->stats_poll_interval, errp);
 274 }
 275
 276 static void balloon_stats_set_poll_interval(Object *obj, Visitor *v,
 277                                             const char *name, void *opaque,
 278                                             Error **errp)
 279 {
 280     VirtIOBalloon *s = opaque;
 281     Error *local_err = NULL;
 282     int64_t value;
 283
 284     visit_type_int(v, name, &value, &local_err);
 285     if (local_err) {
 286         error_propagate(errp, local_err);
 287         return;
 288     }
 289
 290     if (value < 0) {
 291         error_setg(errp, "timer value must be greater than zero");
 292         return;
 293     }
 294
 295     if (value > UINT32_MAX) {
 296         error_setg(errp, "timer value is too big");
 297         return;
 298     }
 299
 300     if (value == s->stats_poll_interval) {
 301         return;
 302     }
 303
 304     if (value == 0) {
 305         /* timer=0 disables the timer */
 306         balloon_stats_destroy_timer(s);
 307         return;
 308     }
 309
 310     if (balloon_stats_enabled(s)) {
 311         /* timer interval change */
 312         s->stats_poll_interval = value;
 313         balloon_stats_change_timer(s, value);
 314         return;
 315     }
 316
 317     /* create a new timer */
 318     g_assert(s->stats_timer == NULL);
 319     s->stats_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, balloon_stats_poll_cb, s);
 320     s->stats_poll_interval = value;
 321     balloon_stats_change_timer(s, 0);
 322 }
 323
 324 static void virtio_balloon_handle_output(VirtIODevice *vdev, VirtQueue *vq)
 325 {
 326     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
 327     VirtQueueElement *elem;
 328     MemoryRegionSection section;
 329
 330     for (;;) {
 331         PartiallyBalloonedPage pbp = {};
 332         size_t offset = 0;
 333         uint32_t pfn;
 334
 335         elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
 336         if (!elem) {
 337             break;
 338         }
 339
 340         while (iov_to_buf(elem->out_sg, elem->out_num, offset, &pfn, 4) == 4) {
 341             unsigned int p = virtio_ldl_p(vdev, &pfn);
 342             hwaddr pa;
 343
 344             pa = (hwaddr) p << VIRTIO_BALLOON_PFN_SHIFT;
 345             offset += 4;
 346
 347             section = memory_region_find(get_system_memory(), pa,
 348                                          BALLOON_PAGE_SIZE);
 349             if (!section.mr) {
 350                 trace_virtio_balloon_bad_addr(pa);
 351                 continue;
 352             }
 353             if (!memory_region_is_ram(section.mr) ||
 354                 memory_region_is_rom(section.mr) ||
 355                 memory_region_is_romd(section.mr)) {
 356                 trace_virtio_balloon_bad_addr(pa);
 357                 memory_region_unref(section.mr);
 358                 continue;
 359             }
 360
 361             trace_virtio_balloon_handle_output(memory_region_name(section.mr),
 362                                                pa);
 363             if (!qemu_balloon_is_inhibited()) {
 364                 if (vq == s->ivq) {
 365                     balloon_inflate_page(s, section.mr,
 366                                          section.offset_within_region, &pbp);
 367                 } else if (vq == s->dvq) {
 368                     balloon_deflate_page(s, section.mr, section.offset_within_region);
 369                 } else {
 370                     g_assert_not_reached();
 371                 }
 372             }
 373             memory_region_unref(section.mr);
 374         }
 375
 376         virtqueue_push(vq, elem, offset);
 377         virtio_notify(vdev, vq);
 378         g_free(elem);
 379         virtio_balloon_pbp_free(&pbp);
 380     }
 381 }
 382
 383 static void virtio_balloon_receive_stats(VirtIODevice *vdev, VirtQueue *vq)
 384 {
 385     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
 386     VirtQueueElement *elem;
 387     VirtIOBalloonStat stat;
 388     size_t offset = 0;
 389     qemu_timeval tv;
 390
 391     elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
 392     if (!elem) {
 393         goto out;
 394     }
 395
 396     if (s->stats_vq_elem != NULL) {
 397         /* This should never happen if the driver follows the spec. */
 398         virtqueue_push(vq, s->stats_vq_elem, 0);
 399         virtio_notify(vdev, vq);
 400         g_free(s->stats_vq_elem);
 401     }
 402
 403     s->stats_vq_elem = elem;
 404
 405     /* Initialize the stats to get rid of any stale values.  This is only
 406      * needed to handle the case where a guest supports fewer stats than it
 407      * used to (ie. it has booted into an old kernel).
 408      */
 409     reset_stats(s);
 410
 411     while (iov_to_buf(elem->out_sg, elem->out_num, offset, &stat, sizeof(stat))
 412            == sizeof(stat)) {
 413         uint16_t tag = virtio_tswap16(vdev, stat.tag);
 414         uint64_t val = virtio_tswap64(vdev, stat.val);
 415
 416         offset += sizeof(stat);
 417         if (tag < VIRTIO_BALLOON_S_NR)
 418             s->stats[tag] = val;
 419     }
 420     s->stats_vq_offset = offset;
 421
 422     if (qemu_gettimeofday(&tv) < 0) {
 423         warn_report("%s: failed to get time of day", __func__);
 424         goto out;
 425     }
 426
 427     s->stats_last_update = tv.tv_sec;
 428
 429 out:
 430     if (balloon_stats_enabled(s)) {
 431         balloon_stats_change_timer(s, s->stats_poll_interval);
 432     }
 433 }
 434
 435 static void virtio_balloon_handle_free_page_vq(VirtIODevice *vdev,
 436                                                VirtQueue *vq)
 437 {
 438     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
 439     qemu_bh_schedule(s->free_page_bh);
 440 }
 441
 442 static bool get_free_page_hints(VirtIOBalloon *dev)
 443 {
 444     VirtQueueElement *elem;
 445     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 446     VirtQueue *vq = dev->free_page_vq;
 447     bool ret = true;
 448
 449     while (dev->block_iothread) {
 450         qemu_cond_wait(&dev->free_page_cond, &dev->free_page_lock);
 451     }
 452
 453     elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
 454     if (!elem) {
 455         return false;
 456     }
 457
 458     if (elem->out_num) {
 459         uint32_t id;
 460         size_t size = iov_to_buf(elem->out_sg, elem->out_num, 0,
 461                                  &id, sizeof(id));
 462
 463         virtio_tswap32s(vdev, &id);
 464         if (unlikely(size != sizeof(id))) {
 465             virtio_error(vdev, "received an incorrect cmd id");
 466             ret = false;
 467             goto out;
 468         }
 469         if (id == dev->free_page_report_cmd_id) {
 470             dev->free_page_report_status = FREE_PAGE_REPORT_S_START;
 471         } else {
 472             /*
 473              * Stop the optimization only when it has started. This
 474              * avoids a stale stop sign for the previous command.
 475              */
 476             if (dev->free_page_report_status == FREE_PAGE_REPORT_S_START) {
 477                 dev->free_page_report_status = FREE_PAGE_REPORT_S_STOP;
 478             }
 479         }
 480     }
 481
 482     if (elem->in_num) {
 483         if (dev->free_page_report_status == FREE_PAGE_REPORT_S_START) {
 484             qemu_guest_free_page_hint(elem->in_sg[0].iov_base,
 485                                       elem->in_sg[0].iov_len);
 486         }
 487     }
 488
 489 out:
 490     virtqueue_push(vq, elem, 1);
 491     g_free(elem);
 492     return ret;
 493 }
 494
 495 static void virtio_ballloon_get_free_page_hints(void *opaque)
 496 {
 497     VirtIOBalloon *dev = opaque;
 498     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 499     VirtQueue *vq = dev->free_page_vq;
 500     bool continue_to_get_hints;
 501
 502     do {
 503         qemu_mutex_lock(&dev->free_page_lock);
 504         virtio_queue_set_notification(vq, 0);
 505         continue_to_get_hints = get_free_page_hints(dev);
 506         qemu_mutex_unlock(&dev->free_page_lock);
 507         virtio_notify(vdev, vq);
 508       /*
 509        * Start to poll the vq once the reporting started. Otherwise, continue
 510        * only when there are entries on the vq, which need to be given back.
 511        */
 512     } while (continue_to_get_hints ||
 513              dev->free_page_report_status == FREE_PAGE_REPORT_S_START);
 514     virtio_queue_set_notification(vq, 1);
 515 }
 516
 517 static bool virtio_balloon_free_page_support(void *opaque)
 518 {
 519     VirtIOBalloon *s = opaque;
 520     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 521
 522     return virtio_vdev_has_feature(vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT);
 523 }
 524
 525 static void virtio_balloon_free_page_start(VirtIOBalloon *s)
 526 {
 527     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 528
 529     /* For the stop and copy phase, we don't need to start the optimization */
 530     if (!vdev->vm_running) {
 531         return;
 532     }
 533
 534     if (s->free_page_report_cmd_id == UINT_MAX) {
 535         s->free_page_report_cmd_id =
 536                        VIRTIO_BALLOON_FREE_PAGE_REPORT_CMD_ID_MIN;
 537     } else {
 538         s->free_page_report_cmd_id++;
 539     }
 540
 541     s->free_page_report_status = FREE_PAGE_REPORT_S_REQUESTED;
 542     virtio_notify_config(vdev);
 543 }
 544
 545 static void virtio_balloon_free_page_stop(VirtIOBalloon *s)
 546 {
 547     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 548
 549     if (s->free_page_report_status != FREE_PAGE_REPORT_S_STOP) {
 550         /*
 551          * The lock also guarantees us that the
 552          * virtio_ballloon_get_free_page_hints exits after the
 553          * free_page_report_status is set to S_STOP.
 554          */
 555         qemu_mutex_lock(&s->free_page_lock);
 556         /*
 557          * The guest hasn't done the reporting, so host sends a notification
 558          * to the guest to actively stop the reporting.
 559          */
 560         s->free_page_report_status = FREE_PAGE_REPORT_S_STOP;
 561         qemu_mutex_unlock(&s->free_page_lock);
 562         virtio_notify_config(vdev);
 563     }
 564 }
 565
 566 static void virtio_balloon_free_page_done(VirtIOBalloon *s)
 567 {
 568     VirtIODevice *vdev = VIRTIO_DEVICE(s);
 569
 570     s->free_page_report_status = FREE_PAGE_REPORT_S_DONE;
 571     virtio_notify_config(vdev);
 572 }
 573
 574 static int
 575 virtio_balloon_free_page_report_notify(NotifierWithReturn *n, void *data)
 576 {
 577     VirtIOBalloon *dev = container_of(n, VirtIOBalloon,
 578                                       free_page_report_notify);
 579     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 580     PrecopyNotifyData *pnd = data;
 581
 582     if (!virtio_balloon_free_page_support(dev)) {
 583         /*
 584          * This is an optimization provided to migration, so just return 0 to
 585          * have the normal migration process not affected when this feature is
 586          * not supported.
 587          */
 588         return 0;
 589     }
 590
 591     switch (pnd->reason) {
 592     case PRECOPY_NOTIFY_SETUP:
 593         precopy_enable_free_page_optimization();
 594         break;
 595     case PRECOPY_NOTIFY_COMPLETE:
 596     case PRECOPY_NOTIFY_CLEANUP:
 597     case PRECOPY_NOTIFY_BEFORE_BITMAP_SYNC:
 598         virtio_balloon_free_page_stop(dev);
 599         break;
 600     case PRECOPY_NOTIFY_AFTER_BITMAP_SYNC:
 601         if (vdev->vm_running) {
 602             virtio_balloon_free_page_start(dev);
 603         } else {
 604             virtio_balloon_free_page_done(dev);
 605         }
 606         break;
 607     default:
 608         virtio_error(vdev, "%s: %d reason unknown", __func__, pnd->reason);
 609     }
 610
 611     return 0;
 612 }
 613
 614 static size_t virtio_balloon_config_size(VirtIOBalloon *s)
 615 {
 616     uint64_t features = s->host_features;
 617
 618     if (s->qemu_4_0_config_size) {
 619         return sizeof(struct virtio_balloon_config);
 620     }
 621     if (virtio_has_feature(features, VIRTIO_BALLOON_F_PAGE_POISON)) {
 622         return sizeof(struct virtio_balloon_config);
 623     }
 624     if (virtio_has_feature(features, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
 625         return offsetof(struct virtio_balloon_config, poison_val);
 626     }
 627     return offsetof(struct virtio_balloon_config, free_page_report_cmd_id);
 628 }
 629
 630 static void virtio_balloon_get_config(VirtIODevice *vdev, uint8_t *config_data)
 631 {
 632     VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
 633     struct virtio_balloon_config config = {};
 634
 635     config.num_pages = cpu_to_le32(dev->num_pages);
 636     config.actual = cpu_to_le32(dev->actual);
 637
 638     if (dev->free_page_report_status == FREE_PAGE_REPORT_S_REQUESTED) {
 639         config.free_page_report_cmd_id =
 640                        cpu_to_le32(dev->free_page_report_cmd_id);
 641     } else if (dev->free_page_report_status == FREE_PAGE_REPORT_S_STOP) {
 642         config.free_page_report_cmd_id =
 643                        cpu_to_le32(VIRTIO_BALLOON_CMD_ID_STOP);
 644     } else if (dev->free_page_report_status == FREE_PAGE_REPORT_S_DONE) {
 645         config.free_page_report_cmd_id =
 646                        cpu_to_le32(VIRTIO_BALLOON_CMD_ID_DONE);
 647     }
 648
 649     trace_virtio_balloon_get_config(config.num_pages, config.actual);
 650     memcpy(config_data, &config, virtio_balloon_config_size(dev));
 651 }
 652
 653 static int build_dimm_list(Object *obj, void *opaque)
 654 {
 655     GSList **list = opaque;
 656
 657     if (object_dynamic_cast(obj, TYPE_PC_DIMM)) {
 658         DeviceState *dev = DEVICE(obj);
 659         if (dev->realized) { /* only realized DIMMs matter */
 660             *list = g_slist_prepend(*list, dev);
 661         }
 662     }
 663
 664     object_child_foreach(obj, build_dimm_list, opaque);
 665     return 0;
 666 }
 667
 668 static ram_addr_t get_current_ram_size(void)
 669 {
 670     GSList *list = NULL, *item;
 671     ram_addr_t size = ram_size;
 672
 673     build_dimm_list(qdev_get_machine(), &list);
 674     for (item = list; item; item = g_slist_next(item)) {
 675         Object *obj = OBJECT(item->data);
 676         if (!strcmp(object_get_typename(obj), TYPE_PC_DIMM)) {
 677             size += object_property_get_int(obj, PC_DIMM_SIZE_PROP,
 678                                             &error_abort);
 679         }
 680     }
 681     g_slist_free(list);
 682
 683     return size;
 684 }
 685
 686 static void virtio_balloon_set_config(VirtIODevice *vdev,
 687                                       const uint8_t *config_data)
 688 {
 689     VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
 690     struct virtio_balloon_config config;
 691     uint32_t oldactual = dev->actual;
 692     ram_addr_t vm_ram_size = get_current_ram_size();
 693
 694     memcpy(&config, config_data, virtio_balloon_config_size(dev));
 695     dev->actual = le32_to_cpu(config.actual);
 696     if (dev->actual != oldactual) {
 697         qapi_event_send_balloon_change(vm_ram_size -
 698                         ((ram_addr_t) dev->actual << VIRTIO_BALLOON_PFN_SHIFT));
 699     }
 700     trace_virtio_balloon_set_config(dev->actual, oldactual);
 701 }
 702
 703 static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
 704                                             Error **errp)
 705 {
 706     VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
 707     f |= dev->host_features;
 708     virtio_add_feature(&f, VIRTIO_BALLOON_F_STATS_VQ);
 709
 710     return f;
 711 }
 712
 713 static void virtio_balloon_stat(void *opaque, BalloonInfo *info)
 714 {
 715     VirtIOBalloon *dev = opaque;
 716     info->actual = get_current_ram_size() - ((uint64_t) dev->actual <<
 717                                              VIRTIO_BALLOON_PFN_SHIFT);
 718 }
 719
 720 static void virtio_balloon_to_target(void *opaque, ram_addr_t target)
 721 {
 722     VirtIOBalloon *dev = VIRTIO_BALLOON(opaque);
 723     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 724     ram_addr_t vm_ram_size = get_current_ram_size();
 725
 726     if (target > vm_ram_size) {
 727         target = vm_ram_size;
 728     }
 729     if (target) {
 730         dev->num_pages = (vm_ram_size - target) >> VIRTIO_BALLOON_PFN_SHIFT;
 731         virtio_notify_config(vdev);
 732     }
 733     trace_virtio_balloon_to_target(target, dev->num_pages);
 734 }
 735
 736 static int virtio_balloon_post_load_device(void *opaque, int version_id)
 737 {
 738     VirtIOBalloon *s = VIRTIO_BALLOON(opaque);
 739
 740     if (balloon_stats_enabled(s)) {
 741         balloon_stats_change_timer(s, s->stats_poll_interval);
 742     }
 743     return 0;
 744 }
 745
 746 static const VMStateDescription vmstate_virtio_balloon_free_page_report = {
 747     .name = "virtio-balloon-device/free-page-report",
 748     .version_id = 1,
 749     .minimum_version_id = 1,
 750     .needed = virtio_balloon_free_page_support,
 751     .fields = (VMStateField[]) {
 752         VMSTATE_UINT32(free_page_report_cmd_id, VirtIOBalloon),
 753         VMSTATE_UINT32(free_page_report_status, VirtIOBalloon),
 754         VMSTATE_END_OF_LIST()
 755     }
 756 };
 757
 758 static const VMStateDescription vmstate_virtio_balloon_device = {
 759     .name = "virtio-balloon-device",
 760     .version_id = 1,
 761     .minimum_version_id = 1,
 762     .post_load = virtio_balloon_post_load_device,
 763     .fields = (VMStateField[]) {
 764         VMSTATE_UINT32(num_pages, VirtIOBalloon),
 765         VMSTATE_UINT32(actual, VirtIOBalloon),
 766         VMSTATE_END_OF_LIST()
 767     },
 768     .subsections = (const VMStateDescription * []) {
 769         &vmstate_virtio_balloon_free_page_report,
 770         NULL
 771     }
 772 };
 773
 774 static void virtio_balloon_device_realize(DeviceState *dev, Error **errp)
 775 {
 776     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 777     VirtIOBalloon *s = VIRTIO_BALLOON(dev);
 778     int ret;
 779
 780     virtio_init(vdev, "virtio-balloon", VIRTIO_ID_BALLOON,
 781                 virtio_balloon_config_size(s));
 782
 783     ret = qemu_add_balloon_handler(virtio_balloon_to_target,
 784                                    virtio_balloon_stat, s);
 785
 786     if (ret < 0) {
 787         error_setg(errp, "Only one balloon device is supported");
 788         virtio_cleanup(vdev);
 789         return;
 790     }
 791
 792     s->ivq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output);
 793     s->dvq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output);
 794     s->svq = virtio_add_queue(vdev, 128, virtio_balloon_receive_stats);
 795
 796     if (virtio_has_feature(s->host_features,
 797                            VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
 798         s->free_page_vq = virtio_add_queue(vdev, VIRTQUEUE_MAX_SIZE,
 799                                            virtio_balloon_handle_free_page_vq);
 800         s->free_page_report_status = FREE_PAGE_REPORT_S_STOP;
 801         s->free_page_report_cmd_id =
 802                            VIRTIO_BALLOON_FREE_PAGE_REPORT_CMD_ID_MIN;
 803         s->free_page_report_notify.notify =
 804                                        virtio_balloon_free_page_report_notify;
 805         precopy_add_notifier(&s->free_page_report_notify);
 806         if (s->iothread) {
 807             object_ref(OBJECT(s->iothread));
 808             s->free_page_bh = aio_bh_new(iothread_get_aio_context(s->iothread),
 809                                        virtio_ballloon_get_free_page_hints, s);
 810             qemu_mutex_init(&s->free_page_lock);
 811             qemu_cond_init(&s->free_page_cond);
 812             s->block_iothread = false;
 813         } else {
 814             /* Simply disable this feature if the iothread wasn't created. */
 815             s->host_features &= ~(1 << VIRTIO_BALLOON_F_FREE_PAGE_HINT);
 816             virtio_error(vdev, "iothread is missing");
 817         }
 818     }
 819     reset_stats(s);
 820 }
 821
 822 static void virtio_balloon_device_unrealize(DeviceState *dev, Error **errp)
 823 {
 824     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
 825     VirtIOBalloon *s = VIRTIO_BALLOON(dev);
 826
 827     if (virtio_balloon_free_page_support(s)) {
 828         qemu_bh_delete(s->free_page_bh);
 829         virtio_balloon_free_page_stop(s);
 830         precopy_remove_notifier(&s->free_page_report_notify);
 831     }
 832     balloon_stats_destroy_timer(s);
 833     qemu_remove_balloon_handler(s);
 834     virtio_cleanup(vdev);
 835 }
 836
 837 static void virtio_balloon_device_reset(VirtIODevice *vdev)
 838 {
 839     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
 840
 841     if (virtio_balloon_free_page_support(s)) {
 842         virtio_balloon_free_page_stop(s);
 843     }
 844
 845     if (s->stats_vq_elem != NULL) {
 846         virtqueue_unpop(s->svq, s->stats_vq_elem, 0);
 847         g_free(s->stats_vq_elem);
 848         s->stats_vq_elem = NULL;
 849     }
 850 }
 851
 852 static void virtio_balloon_set_status(VirtIODevice *vdev, uint8_t status)
 853 {
 854     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
 855
 856     if (!s->stats_vq_elem && vdev->vm_running &&
 857         (status & VIRTIO_CONFIG_S_DRIVER_OK) && virtqueue_rewind(s->svq, 1)) {
 858         /* poll stats queue for the element we have discarded when the VM
 859          * was stopped */
 860         virtio_balloon_receive_stats(vdev, s->svq);
 861     }
 862
 863     if (virtio_balloon_free_page_support(s)) {
 864         /*
 865          * The VM is woken up and the iothread was blocked, so signal it to
 866          * continue.
 867          */
 868         if (vdev->vm_running && s->block_iothread) {
 869             qemu_mutex_lock(&s->free_page_lock);
 870             s->block_iothread = false;
 871             qemu_cond_signal(&s->free_page_cond);
 872             qemu_mutex_unlock(&s->free_page_lock);
 873         }
 874
 875         /* The VM is stopped, block the iothread. */
 876         if (!vdev->vm_running) {
 877             qemu_mutex_lock(&s->free_page_lock);
 878             s->block_iothread = true;
 879             qemu_mutex_unlock(&s->free_page_lock);
 880         }
 881     }
 882 }
 883
 884 static void virtio_balloon_instance_init(Object *obj)
 885 {
 886     VirtIOBalloon *s = VIRTIO_BALLOON(obj);
 887
 888     object_property_add(obj, "guest-stats", "guest statistics",
 889                         balloon_stats_get_all, NULL, NULL, s, NULL);
 890
 891     object_property_add(obj, "guest-stats-polling-interval", "int",
 892                         balloon_stats_get_poll_interval,
 893                         balloon_stats_set_poll_interval,
 894                         NULL, s, NULL);
 895 }
 896
 897 static const VMStateDescription vmstate_virtio_balloon = {
 898     .name = "virtio-balloon",
 899     .minimum_version_id = 1,
 900     .version_id = 1,
 901     .fields = (VMStateField[]) {
 902         VMSTATE_VIRTIO_DEVICE,
 903         VMSTATE_END_OF_LIST()
 904     },
 905 };
 906
 907 static Property virtio_balloon_properties[] = {
 908     DEFINE_PROP_BIT("deflate-on-oom", VirtIOBalloon, host_features,
 909                     VIRTIO_BALLOON_F_DEFLATE_ON_OOM, false),
 910     DEFINE_PROP_BIT("free-page-hint", VirtIOBalloon, host_features,
 911                     VIRTIO_BALLOON_F_FREE_PAGE_HINT, false),
 912     /* QEMU 4.0 accidentally changed the config size even when free-page-hint
 913      * is disabled, resulting in QEMU 3.1 migration incompatibility.  This
 914      * property retains this quirk for QEMU 4.1 machine types.
 915      */
 916     DEFINE_PROP_BOOL("qemu-4-0-config-size", VirtIOBalloon,
 917                      qemu_4_0_config_size, false),
 918     DEFINE_PROP_LINK("iothread", VirtIOBalloon, iothread, TYPE_IOTHREAD,
 919                      IOThread *),
 920     DEFINE_PROP_END_OF_LIST(),
 921 };
 922
 923 static void virtio_balloon_class_init(ObjectClass *klass, void *data)
 924 {
 925     DeviceClass *dc = DEVICE_CLASS(klass);
 926     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
 927
 928     dc->props = virtio_balloon_properties;
 929     dc->vmsd = &vmstate_virtio_balloon;
 930     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
 931     vdc->realize = virtio_balloon_device_realize;
 932     vdc->unrealize = virtio_balloon_device_unrealize;
 933     vdc->reset = virtio_balloon_device_reset;
 934     vdc->get_config = virtio_balloon_get_config;
 935     vdc->set_config = virtio_balloon_set_config;
 936     vdc->get_features = virtio_balloon_get_features;
 937     vdc->set_status = virtio_balloon_set_status;
 938     vdc->vmsd = &vmstate_virtio_balloon_device;
 939 }
 940
 941 static const TypeInfo virtio_balloon_info = {
 942     .name = TYPE_VIRTIO_BALLOON,
 943     .parent = TYPE_VIRTIO_DEVICE,
 944     .instance_size = sizeof(VirtIOBalloon),
 945     .instance_init = virtio_balloon_instance_init,
 946     .class_init = virtio_balloon_class_init,
 947 };
 948
 949 static void virtio_register_types(void)
 950 {
 951     type_register_static(&virtio_balloon_info);
 952 }
 953
 954 type_init(virtio_register_types)