1/*
2 * Virtio Balloon Device
3 *
4 * Copyright IBM, Corp. 2008
5 * Copyright (C) 2011 Red Hat, Inc.
6 * Copyright (C) 2011 Amit Shah <amit.shah@redhat.com>
7 *
8 * Authors:
9 * Anthony Liguori <aliguori@us.ibm.com>
10 *
11 * This work is licensed under the terms of the GNU GPL, version 2. See
12 * the COPYING file in the top-level directory.
13 *
14 */
15
16#include "qemu/osdep.h"
17#include "qemu/iov.h"
18#include "qemu/module.h"
19#include "qemu/timer.h"
20#include "hw/virtio/virtio.h"
21#include "hw/mem/pc-dimm.h"
22#include "hw/qdev-properties.h"
23#include "sysemu/balloon.h"
24#include "hw/virtio/virtio-balloon.h"
25#include "exec/address-spaces.h"
26#include "qapi/error.h"
27#include "qapi/qapi-events-misc.h"
28#include "qapi/visitor.h"
29#include "trace.h"
30#include "qemu/error-report.h"
31#include "migration/misc.h"
32
33#include "hw/virtio/virtio-bus.h"
34#include "hw/virtio/virtio-access.h"
35
36#define BALLOON_PAGE_SIZE (1 << VIRTIO_BALLOON_PFN_SHIFT)
37
38typedef struct PartiallyBalloonedPage {
39 ram_addr_t base_gpa;
40 unsigned long *bitmap;
41} PartiallyBalloonedPage;
42
43static void virtio_balloon_pbp_free(PartiallyBalloonedPage *pbp)
44{
45 if (!pbp->bitmap) {
46 return;
47 }
48 g_free(pbp->bitmap);
49 pbp->bitmap = NULL;
50}
51
52static void virtio_balloon_pbp_alloc(PartiallyBalloonedPage *pbp,
53 ram_addr_t base_gpa,
54 long subpages)
55{
56 pbp->base_gpa = base_gpa;
57 pbp->bitmap = bitmap_new(subpages);
58}
59
60static bool virtio_balloon_pbp_matches(PartiallyBalloonedPage *pbp,
61 ram_addr_t base_gpa)
62{
63 return pbp->base_gpa == base_gpa;
64}
65
66static void balloon_inflate_page(VirtIOBalloon *balloon,
67 MemoryRegion *mr, hwaddr mr_offset,
68 PartiallyBalloonedPage *pbp)
69{
70 void *addr = memory_region_get_ram_ptr(mr) + mr_offset;
71 ram_addr_t rb_offset, rb_aligned_offset, base_gpa;
72 RAMBlock *rb;
73 size_t rb_page_size;
74 int subpages;
75
76 /* XXX is there a better way to get to the RAMBlock than via a
77 * host address? */
78 rb = qemu_ram_block_from_host(addr, false, &rb_offset);
79 rb_page_size = qemu_ram_pagesize(rb);
80
81 if (rb_page_size == BALLOON_PAGE_SIZE) {
82 /* Easy case */
83
84 ram_block_discard_range(rb, rb_offset, rb_page_size);
85 /* We ignore errors from ram_block_discard_range(), because it
86 * has already reported them, and failing to discard a balloon
87 * page is not fatal */
88 return;
89 }
90
91 /* Hard case
92 *
93 * We've put a piece of a larger host page into the balloon - we
94 * need to keep track until we have a whole host page to
95 * discard
96 */
97 warn_report_once(
98"Balloon used with backing page size > 4kiB, this may not be reliable");
99
100 rb_aligned_offset = QEMU_ALIGN_DOWN(rb_offset, rb_page_size);
101 subpages = rb_page_size / BALLOON_PAGE_SIZE;
102 base_gpa = memory_region_get_ram_addr(mr) + mr_offset -
103 (rb_offset - rb_aligned_offset);
104
105 if (pbp->bitmap && !virtio_balloon_pbp_matches(pbp, base_gpa)) {
106 /* We've partially ballooned part of a host page, but now
107 * we're trying to balloon part of a different one. Too hard,
108 * give up on the old partial page */
109 virtio_balloon_pbp_free(pbp);
110 }
111
112 if (!pbp->bitmap) {
113 virtio_balloon_pbp_alloc(pbp, base_gpa, subpages);
114 }
115
116 set_bit((rb_offset - rb_aligned_offset) / BALLOON_PAGE_SIZE,
117 pbp->bitmap);
118
119 if (bitmap_full(pbp->bitmap, subpages)) {
120 /* We've accumulated a full host page, we can actually discard
121 * it now */
122
123 ram_block_discard_range(rb, rb_aligned_offset, rb_page_size);
124 /* We ignore errors from ram_block_discard_range(), because it
125 * has already reported them, and failing to discard a balloon
126 * page is not fatal */
127 virtio_balloon_pbp_free(pbp);
128 }
129}
130
131static void balloon_deflate_page(VirtIOBalloon *balloon,
132 MemoryRegion *mr, hwaddr mr_offset)
133{
134 void *addr = memory_region_get_ram_ptr(mr) + mr_offset;
135 ram_addr_t rb_offset;
136 RAMBlock *rb;
137 size_t rb_page_size;
138 void *host_addr;
139 int ret;
140
141 /* XXX is there a better way to get to the RAMBlock than via a
142 * host address? */
143 rb = qemu_ram_block_from_host(addr, false, &rb_offset);
144 rb_page_size = qemu_ram_pagesize(rb);
145
146 host_addr = (void *)((uintptr_t)addr & ~(rb_page_size - 1));
147
148 /* When a page is deflated, we hint the whole host page it lives
149 * on, since we can't do anything smaller */
150 ret = qemu_madvise(host_addr, rb_page_size, QEMU_MADV_WILLNEED);
151 if (ret != 0) {
152 warn_report("Couldn't MADV_WILLNEED on balloon deflate: %s",
153 strerror(errno));
154 /* Otherwise ignore, failing to page hint shouldn't be fatal */
155 }
156}
157
158static const char *balloon_stat_names[] = {
159 [VIRTIO_BALLOON_S_SWAP_IN] = "stat-swap-in",
160 [VIRTIO_BALLOON_S_SWAP_OUT] = "stat-swap-out",
161 [VIRTIO_BALLOON_S_MAJFLT] = "stat-major-faults",
162 [VIRTIO_BALLOON_S_MINFLT] = "stat-minor-faults",
163 [VIRTIO_BALLOON_S_MEMFREE] = "stat-free-memory",
164 [VIRTIO_BALLOON_S_MEMTOT] = "stat-total-memory",
165 [VIRTIO_BALLOON_S_AVAIL] = "stat-available-memory",
166 [VIRTIO_BALLOON_S_CACHES] = "stat-disk-caches",
167 [VIRTIO_BALLOON_S_HTLB_PGALLOC] = "stat-htlb-pgalloc",
168 [VIRTIO_BALLOON_S_HTLB_PGFAIL] = "stat-htlb-pgfail",
169 [VIRTIO_BALLOON_S_NR] = NULL
170};
171
172/*
173 * reset_stats - Mark all items in the stats array as unset
174 *
175 * This function needs to be called at device initialization and before
176 * updating to a set of newly-generated stats. This will ensure that no
177 * stale values stick around in case the guest reports a subset of the supported
178 * statistics.
179 */
180static inline void reset_stats(VirtIOBalloon *dev)
181{
182 int i;
183 for (i = 0; i < VIRTIO_BALLOON_S_NR; dev->stats[i++] = -1);
184}
185
186static bool balloon_stats_supported(const VirtIOBalloon *s)
187{
188 VirtIODevice *vdev = VIRTIO_DEVICE(s);
189 return virtio_vdev_has_feature(vdev, VIRTIO_BALLOON_F_STATS_VQ);
190}
191
192static bool balloon_stats_enabled(const VirtIOBalloon *s)
193{
194 return s->stats_poll_interval > 0;
195}
196
197static void balloon_stats_destroy_timer(VirtIOBalloon *s)
198{
199 if (balloon_stats_enabled(s)) {
200 timer_del(s->stats_timer);
201 timer_free(s->stats_timer);
202 s->stats_timer = NULL;
203 s->stats_poll_interval = 0;
204 }
205}
206
207static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs)
208{
209 timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000);
210}
211
212static void balloon_stats_poll_cb(void *opaque)
213{
214 VirtIOBalloon *s = opaque;
215 VirtIODevice *vdev = VIRTIO_DEVICE(s);
216
217 if (s->stats_vq_elem == NULL || !balloon_stats_supported(s)) {
218 /* re-schedule */
219 balloon_stats_change_timer(s, s->stats_poll_interval);
220 return;
221 }
222
223 virtqueue_push(s->svq, s->stats_vq_elem, s->stats_vq_offset);
224 virtio_notify(vdev, s->svq);
225 g_free(s->stats_vq_elem);
226 s->stats_vq_elem = NULL;
227}
228
229static void balloon_stats_get_all(Object *obj, Visitor *v, const char *name,
230 void *opaque, Error **errp)
231{
232 Error *err = NULL;
233 VirtIOBalloon *s = opaque;
234 int i;
235
236 visit_start_struct(v, name, NULL, 0, &err);
237 if (err) {
238 goto out;
239 }
240 visit_type_int(v, "last-update", &s->stats_last_update, &err);
241 if (err) {
242 goto out_end;
243 }
244
245 visit_start_struct(v, "stats", NULL, 0, &err);
246 if (err) {
247 goto out_end;
248 }
249 for (i = 0; i < VIRTIO_BALLOON_S_NR; i++) {
250 visit_type_uint64(v, balloon_stat_names[i], &s->stats[i], &err);
251 if (err) {
252 goto out_nested;
253 }
254 }
255 visit_check_struct(v, &err);
256out_nested:
257 visit_end_struct(v, NULL);
258
259 if (!err) {
260 visit_check_struct(v, &err);
261 }
262out_end:
263 visit_end_struct(v, NULL);
264out:
265 error_propagate(errp, err);
266}
267
268static void balloon_stats_get_poll_interval(Object *obj, Visitor *v,
269 const char *name, void *opaque,
270 Error **errp)
271{
272 VirtIOBalloon *s = opaque;
273 visit_type_int(v, name, &s->stats_poll_interval, errp);
274}
275
276static void balloon_stats_set_poll_interval(Object *obj, Visitor *v,
277 const char *name, void *opaque,
278 Error **errp)
279{
280 VirtIOBalloon *s = opaque;
281 Error *local_err = NULL;
282 int64_t value;
283
284 visit_type_int(v, name, &value, &local_err);
285 if (local_err) {
286 error_propagate(errp, local_err);
287 return;
288 }
289
290 if (value < 0) {
291 error_setg(errp, "timer value must be greater than zero");
292 return;
293 }
294
295 if (value > UINT32_MAX) {
296 error_setg(errp, "timer value is too big");
297 return;
298 }
299
300 if (value == s->stats_poll_interval) {
301 return;
302 }
303
304 if (value == 0) {
305 /* timer=0 disables the timer */
306 balloon_stats_destroy_timer(s);
307 return;
308 }
309
310 if (balloon_stats_enabled(s)) {
311 /* timer interval change */
312 s->stats_poll_interval = value;
313 balloon_stats_change_timer(s, value);
314 return;
315 }
316
317 /* create a new timer */
318 g_assert(s->stats_timer == NULL);
319 s->stats_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, balloon_stats_poll_cb, s);
320 s->stats_poll_interval = value;
321 balloon_stats_change_timer(s, 0);
322}
323
324static void virtio_balloon_handle_output(VirtIODevice *vdev, VirtQueue *vq)
325{
326 VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
327 VirtQueueElement *elem;
328 MemoryRegionSection section;
329
330 for (;;) {
331 PartiallyBalloonedPage pbp = {};
332 size_t offset = 0;
333 uint32_t pfn;
334
335 elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
336 if (!elem) {
337 break;
338 }
339
340 while (iov_to_buf(elem->out_sg, elem->out_num, offset, &pfn, 4) == 4) {
341 unsigned int p = virtio_ldl_p(vdev, &pfn);
342 hwaddr pa;
343
344 pa = (hwaddr) p << VIRTIO_BALLOON_PFN_SHIFT;
345 offset += 4;
346
347 section = memory_region_find(get_system_memory(), pa,
348 BALLOON_PAGE_SIZE);
349 if (!section.mr) {
350 trace_virtio_balloon_bad_addr(pa);
351 continue;
352 }
353 if (!memory_region_is_ram(section.mr) ||
354 memory_region_is_rom(section.mr) ||
355 memory_region_is_romd(section.mr)) {
356 trace_virtio_balloon_bad_addr(pa);
357 memory_region_unref(section.mr);
358 continue;
359 }
360
361 trace_virtio_balloon_handle_output(memory_region_name(section.mr),
362 pa);
363 if (!qemu_balloon_is_inhibited()) {
364 if (vq == s->ivq) {
365 balloon_inflate_page(s, section.mr,
366 section.offset_within_region, &pbp);
367 } else if (vq == s->dvq) {
368 balloon_deflate_page(s, section.mr, section.offset_within_region);
369 } else {
370 g_assert_not_reached();
371 }
372 }
373 memory_region_unref(section.mr);
374 }
375
376 virtqueue_push(vq, elem, offset);
377 virtio_notify(vdev, vq);
378 g_free(elem);
379 virtio_balloon_pbp_free(&pbp);
380 }
381}
382
383static void virtio_balloon_receive_stats(VirtIODevice *vdev, VirtQueue *vq)
384{
385 VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
386 VirtQueueElement *elem;
387 VirtIOBalloonStat stat;
388 size_t offset = 0;
389 qemu_timeval tv;
390
391 elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
392 if (!elem) {
393 goto out;
394 }
395
396 if (s->stats_vq_elem != NULL) {
397 /* This should never happen if the driver follows the spec. */
398 virtqueue_push(vq, s->stats_vq_elem, 0);
399 virtio_notify(vdev, vq);
400 g_free(s->stats_vq_elem);
401 }
402
403 s->stats_vq_elem = elem;
404
405 /* Initialize the stats to get rid of any stale values. This is only
406 * needed to handle the case where a guest supports fewer stats than it
407 * used to (ie. it has booted into an old kernel).
408 */
409 reset_stats(s);
410
411 while (iov_to_buf(elem->out_sg, elem->out_num, offset, &stat, sizeof(stat))
412 == sizeof(stat)) {
413 uint16_t tag = virtio_tswap16(vdev, stat.tag);
414 uint64_t val = virtio_tswap64(vdev, stat.val);
415
416 offset += sizeof(stat);
417 if (tag < VIRTIO_BALLOON_S_NR)
418 s->stats[tag] = val;
419 }
420 s->stats_vq_offset = offset;
421
422 if (qemu_gettimeofday(&tv) < 0) {
423 warn_report("%s: failed to get time of day", __func__);
424 goto out;
425 }
426
427 s->stats_last_update = tv.tv_sec;
428
429out:
430 if (balloon_stats_enabled(s)) {
431 balloon_stats_change_timer(s, s->stats_poll_interval);
432 }
433}
434
435static void virtio_balloon_handle_free_page_vq(VirtIODevice *vdev,
436 VirtQueue *vq)
437{
438 VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
439 qemu_bh_schedule(s->free_page_bh);
440}
441
442static bool get_free_page_hints(VirtIOBalloon *dev)
443{
444 VirtQueueElement *elem;
445 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
446 VirtQueue *vq = dev->free_page_vq;
447 bool ret = true;
448
449 while (dev->block_iothread) {
450 qemu_cond_wait(&dev->free_page_cond, &dev->free_page_lock);
451 }
452
453 elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
454 if (!elem) {
455 return false;
456 }
457
458 if (elem->out_num) {
459 uint32_t id;
460 size_t size = iov_to_buf(elem->out_sg, elem->out_num, 0,
461 &id, sizeof(id));
462
463 virtio_tswap32s(vdev, &id);
464 if (unlikely(size != sizeof(id))) {
465 virtio_error(vdev, "received an incorrect cmd id");
466 ret = false;
467 goto out;
468 }
469 if (id == dev->free_page_report_cmd_id) {
470 dev->free_page_report_status = FREE_PAGE_REPORT_S_START;
471 } else {
472 /*
473 * Stop the optimization only when it has started. This
474 * avoids a stale stop sign for the previous command.
475 */
476 if (dev->free_page_report_status == FREE_PAGE_REPORT_S_START) {
477 dev->free_page_report_status = FREE_PAGE_REPORT_S_STOP;
478 }
479 }
480 }
481
482 if (elem->in_num) {
483 if (dev->free_page_report_status == FREE_PAGE_REPORT_S_START) {
484 qemu_guest_free_page_hint(elem->in_sg[0].iov_base,
485 elem->in_sg[0].iov_len);
486 }
487 }
488
489out:
490 virtqueue_push(vq, elem, 1);
491 g_free(elem);
492 return ret;
493}
494
495static void virtio_ballloon_get_free_page_hints(void *opaque)
496{
497 VirtIOBalloon *dev = opaque;
498 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
499 VirtQueue *vq = dev->free_page_vq;
500 bool continue_to_get_hints;
501
502 do {
503 qemu_mutex_lock(&dev->free_page_lock);
504 virtio_queue_set_notification(vq, 0);
505 continue_to_get_hints = get_free_page_hints(dev);
506 qemu_mutex_unlock(&dev->free_page_lock);
507 virtio_notify(vdev, vq);
508 /*
509 * Start to poll the vq once the reporting started. Otherwise, continue
510 * only when there are entries on the vq, which need to be given back.
511 */
512 } while (continue_to_get_hints ||
513 dev->free_page_report_status == FREE_PAGE_REPORT_S_START);
514 virtio_queue_set_notification(vq, 1);
515}
516
517static bool virtio_balloon_free_page_support(void *opaque)
518{
519 VirtIOBalloon *s = opaque;
520 VirtIODevice *vdev = VIRTIO_DEVICE(s);
521
522 return virtio_vdev_has_feature(vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT);
523}
524
525static void virtio_balloon_free_page_start(VirtIOBalloon *s)
526{
527 VirtIODevice *vdev = VIRTIO_DEVICE(s);
528
529 /* For the stop and copy phase, we don't need to start the optimization */
530 if (!vdev->vm_running) {
531 return;
532 }
533
534 if (s->free_page_report_cmd_id == UINT_MAX) {
535 s->free_page_report_cmd_id =
536 VIRTIO_BALLOON_FREE_PAGE_REPORT_CMD_ID_MIN;
537 } else {
538 s->free_page_report_cmd_id++;
539 }
540
541 s->free_page_report_status = FREE_PAGE_REPORT_S_REQUESTED;
542 virtio_notify_config(vdev);
543}
544
545static void virtio_balloon_free_page_stop(VirtIOBalloon *s)
546{
547 VirtIODevice *vdev = VIRTIO_DEVICE(s);
548
549 if (s->free_page_report_status != FREE_PAGE_REPORT_S_STOP) {
550 /*
551 * The lock also guarantees us that the
552 * virtio_ballloon_get_free_page_hints exits after the
553 * free_page_report_status is set to S_STOP.
554 */
555 qemu_mutex_lock(&s->free_page_lock);
556 /*
557 * The guest hasn't done the reporting, so host sends a notification
558 * to the guest to actively stop the reporting.
559 */
560 s->free_page_report_status = FREE_PAGE_REPORT_S_STOP;
561 qemu_mutex_unlock(&s->free_page_lock);
562 virtio_notify_config(vdev);
563 }
564}
565
566static void virtio_balloon_free_page_done(VirtIOBalloon *s)
567{
568 VirtIODevice *vdev = VIRTIO_DEVICE(s);
569
570 s->free_page_report_status = FREE_PAGE_REPORT_S_DONE;
571 virtio_notify_config(vdev);
572}
573
574static int
575virtio_balloon_free_page_report_notify(NotifierWithReturn *n, void *data)
576{
577 VirtIOBalloon *dev = container_of(n, VirtIOBalloon,
578 free_page_report_notify);
579 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
580 PrecopyNotifyData *pnd = data;
581
582 if (!virtio_balloon_free_page_support(dev)) {
583 /*
584 * This is an optimization provided to migration, so just return 0 to
585 * have the normal migration process not affected when this feature is
586 * not supported.
587 */
588 return 0;
589 }
590
591 switch (pnd->reason) {
592 case PRECOPY_NOTIFY_SETUP:
593 precopy_enable_free_page_optimization();
594 break;
595 case PRECOPY_NOTIFY_COMPLETE:
596 case PRECOPY_NOTIFY_CLEANUP:
597 case PRECOPY_NOTIFY_BEFORE_BITMAP_SYNC:
598 virtio_balloon_free_page_stop(dev);
599 break;
600 case PRECOPY_NOTIFY_AFTER_BITMAP_SYNC:
601 if (vdev->vm_running) {
602 virtio_balloon_free_page_start(dev);
603 } else {
604 virtio_balloon_free_page_done(dev);
605 }
606 break;
607 default:
608 virtio_error(vdev, "%s: %d reason unknown", __func__, pnd->reason);
609 }
610
611 return 0;
612}
613
614static size_t virtio_balloon_config_size(VirtIOBalloon *s)
615{
616 uint64_t features = s->host_features;
617
618 if (s->qemu_4_0_config_size) {
619 return sizeof(struct virtio_balloon_config);
620 }
621 if (virtio_has_feature(features, VIRTIO_BALLOON_F_PAGE_POISON)) {
622 return sizeof(struct virtio_balloon_config);
623 }
624 if (virtio_has_feature(features, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
625 return offsetof(struct virtio_balloon_config, poison_val);
626 }
627 return offsetof(struct virtio_balloon_config, free_page_report_cmd_id);
628}
629
630static void virtio_balloon_get_config(VirtIODevice *vdev, uint8_t *config_data)
631{
632 VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
633 struct virtio_balloon_config config = {};
634
635 config.num_pages = cpu_to_le32(dev->num_pages);
636 config.actual = cpu_to_le32(dev->actual);
637
638 if (dev->free_page_report_status == FREE_PAGE_REPORT_S_REQUESTED) {
639 config.free_page_report_cmd_id =
640 cpu_to_le32(dev->free_page_report_cmd_id);
641 } else if (dev->free_page_report_status == FREE_PAGE_REPORT_S_STOP) {
642 config.free_page_report_cmd_id =
643 cpu_to_le32(VIRTIO_BALLOON_CMD_ID_STOP);
644 } else if (dev->free_page_report_status == FREE_PAGE_REPORT_S_DONE) {
645 config.free_page_report_cmd_id =
646 cpu_to_le32(VIRTIO_BALLOON_CMD_ID_DONE);
647 }
648
649 trace_virtio_balloon_get_config(config.num_pages, config.actual);
650 memcpy(config_data, &config, virtio_balloon_config_size(dev));
651}
652
653static int build_dimm_list(Object *obj, void *opaque)
654{
655 GSList **list = opaque;
656
657 if (object_dynamic_cast(obj, TYPE_PC_DIMM)) {
658 DeviceState *dev = DEVICE(obj);
659 if (dev->realized) { /* only realized DIMMs matter */
660 *list = g_slist_prepend(*list, dev);
661 }
662 }
663
664 object_child_foreach(obj, build_dimm_list, opaque);
665 return 0;
666}
667
668static ram_addr_t get_current_ram_size(void)
669{
670 GSList *list = NULL, *item;
671 ram_addr_t size = ram_size;
672
673 build_dimm_list(qdev_get_machine(), &list);
674 for (item = list; item; item = g_slist_next(item)) {
675 Object *obj = OBJECT(item->data);
676 if (!strcmp(object_get_typename(obj), TYPE_PC_DIMM)) {
677 size += object_property_get_int(obj, PC_DIMM_SIZE_PROP,
678 &error_abort);
679 }
680 }
681 g_slist_free(list);
682
683 return size;
684}
685
686static void virtio_balloon_set_config(VirtIODevice *vdev,
687 const uint8_t *config_data)
688{
689 VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
690 struct virtio_balloon_config config;
691 uint32_t oldactual = dev->actual;
692 ram_addr_t vm_ram_size = get_current_ram_size();
693
694 memcpy(&config, config_data, virtio_balloon_config_size(dev));
695 dev->actual = le32_to_cpu(config.actual);
696 if (dev->actual != oldactual) {
697 qapi_event_send_balloon_change(vm_ram_size -
698 ((ram_addr_t) dev->actual << VIRTIO_BALLOON_PFN_SHIFT));
699 }
700 trace_virtio_balloon_set_config(dev->actual, oldactual);
701}
702
703static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
704 Error **errp)
705{
706 VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
707 f |= dev->host_features;
708 virtio_add_feature(&f, VIRTIO_BALLOON_F_STATS_VQ);
709
710 return f;
711}
712
713static void virtio_balloon_stat(void *opaque, BalloonInfo *info)
714{
715 VirtIOBalloon *dev = opaque;
716 info->actual = get_current_ram_size() - ((uint64_t) dev->actual <<
717 VIRTIO_BALLOON_PFN_SHIFT);
718}
719
720static void virtio_balloon_to_target(void *opaque, ram_addr_t target)
721{
722 VirtIOBalloon *dev = VIRTIO_BALLOON(opaque);
723 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
724 ram_addr_t vm_ram_size = get_current_ram_size();
725
726 if (target > vm_ram_size) {
727 target = vm_ram_size;
728 }
729 if (target) {
730 dev->num_pages = (vm_ram_size - target) >> VIRTIO_BALLOON_PFN_SHIFT;
731 virtio_notify_config(vdev);
732 }
733 trace_virtio_balloon_to_target(target, dev->num_pages);
734}
735
736static int virtio_balloon_post_load_device(void *opaque, int version_id)
737{
738 VirtIOBalloon *s = VIRTIO_BALLOON(opaque);
739
740 if (balloon_stats_enabled(s)) {
741 balloon_stats_change_timer(s, s->stats_poll_interval);
742 }
743 return 0;
744}
745
746static const VMStateDescription vmstate_virtio_balloon_free_page_report = {
747 .name = "virtio-balloon-device/free-page-report",
748 .version_id = 1,
749 .minimum_version_id = 1,
750 .needed = virtio_balloon_free_page_support,
751 .fields = (VMStateField[]) {
752 VMSTATE_UINT32(free_page_report_cmd_id, VirtIOBalloon),
753 VMSTATE_UINT32(free_page_report_status, VirtIOBalloon),
754 VMSTATE_END_OF_LIST()
755 }
756};
757
758static const VMStateDescription vmstate_virtio_balloon_device = {
759 .name = "virtio-balloon-device",
760 .version_id = 1,
761 .minimum_version_id = 1,
762 .post_load = virtio_balloon_post_load_device,
763 .fields = (VMStateField[]) {
764 VMSTATE_UINT32(num_pages, VirtIOBalloon),
765 VMSTATE_UINT32(actual, VirtIOBalloon),
766 VMSTATE_END_OF_LIST()
767 },
768 .subsections = (const VMStateDescription * []) {
769 &vmstate_virtio_balloon_free_page_report,
770 NULL
771 }
772};
773
774static void virtio_balloon_device_realize(DeviceState *dev, Error **errp)
775{
776 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
777 VirtIOBalloon *s = VIRTIO_BALLOON(dev);
778 int ret;
779
780 virtio_init(vdev, "virtio-balloon", VIRTIO_ID_BALLOON,
781 virtio_balloon_config_size(s));
782
783 ret = qemu_add_balloon_handler(virtio_balloon_to_target,
784 virtio_balloon_stat, s);
785
786 if (ret < 0) {
787 error_setg(errp, "Only one balloon device is supported");
788 virtio_cleanup(vdev);
789 return;
790 }
791
792 s->ivq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output);
793 s->dvq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output);
794 s->svq = virtio_add_queue(vdev, 128, virtio_balloon_receive_stats);
795
796 if (virtio_has_feature(s->host_features,
797 VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
798 s->free_page_vq = virtio_add_queue(vdev, VIRTQUEUE_MAX_SIZE,
799 virtio_balloon_handle_free_page_vq);
800 s->free_page_report_status = FREE_PAGE_REPORT_S_STOP;
801 s->free_page_report_cmd_id =
802 VIRTIO_BALLOON_FREE_PAGE_REPORT_CMD_ID_MIN;
803 s->free_page_report_notify.notify =
804 virtio_balloon_free_page_report_notify;
805 precopy_add_notifier(&s->free_page_report_notify);
806 if (s->iothread) {
807 object_ref(OBJECT(s->iothread));
808 s->free_page_bh = aio_bh_new(iothread_get_aio_context(s->iothread),
809 virtio_ballloon_get_free_page_hints, s);
810 qemu_mutex_init(&s->free_page_lock);
811 qemu_cond_init(&s->free_page_cond);
812 s->block_iothread = false;
813 } else {
814 /* Simply disable this feature if the iothread wasn't created. */
815 s->host_features &= ~(1 << VIRTIO_BALLOON_F_FREE_PAGE_HINT);
816 virtio_error(vdev, "iothread is missing");
817 }
818 }
819 reset_stats(s);
820}
821
822static void virtio_balloon_device_unrealize(DeviceState *dev, Error **errp)
823{
824 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
825 VirtIOBalloon *s = VIRTIO_BALLOON(dev);
826
827 if (virtio_balloon_free_page_support(s)) {
828 qemu_bh_delete(s->free_page_bh);
829 virtio_balloon_free_page_stop(s);
830 precopy_remove_notifier(&s->free_page_report_notify);
831 }
832 balloon_stats_destroy_timer(s);
833 qemu_remove_balloon_handler(s);
834 virtio_cleanup(vdev);
835}
836
837static void virtio_balloon_device_reset(VirtIODevice *vdev)
838{
839 VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
840
841 if (virtio_balloon_free_page_support(s)) {
842 virtio_balloon_free_page_stop(s);
843 }
844
845 if (s->stats_vq_elem != NULL) {
846 virtqueue_unpop(s->svq, s->stats_vq_elem, 0);
847 g_free(s->stats_vq_elem);
848 s->stats_vq_elem = NULL;
849 }
850}
851
852static void virtio_balloon_set_status(VirtIODevice *vdev, uint8_t status)
853{
854 VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
855
856 if (!s->stats_vq_elem && vdev->vm_running &&
857 (status & VIRTIO_CONFIG_S_DRIVER_OK) && virtqueue_rewind(s->svq, 1)) {
858 /* poll stats queue for the element we have discarded when the VM
859 * was stopped */
860 virtio_balloon_receive_stats(vdev, s->svq);
861 }
862
863 if (virtio_balloon_free_page_support(s)) {
864 /*
865 * The VM is woken up and the iothread was blocked, so signal it to
866 * continue.
867 */
868 if (vdev->vm_running && s->block_iothread) {
869 qemu_mutex_lock(&s->free_page_lock);
870 s->block_iothread = false;
871 qemu_cond_signal(&s->free_page_cond);
872 qemu_mutex_unlock(&s->free_page_lock);
873 }
874
875 /* The VM is stopped, block the iothread. */
876 if (!vdev->vm_running) {
877 qemu_mutex_lock(&s->free_page_lock);
878 s->block_iothread = true;
879 qemu_mutex_unlock(&s->free_page_lock);
880 }
881 }
882}
883
884static void virtio_balloon_instance_init(Object *obj)
885{
886 VirtIOBalloon *s = VIRTIO_BALLOON(obj);
887
888 object_property_add(obj, "guest-stats", "guest statistics",
889 balloon_stats_get_all, NULL, NULL, s, NULL);
890
891 object_property_add(obj, "guest-stats-polling-interval", "int",
892 balloon_stats_get_poll_interval,
893 balloon_stats_set_poll_interval,
894 NULL, s, NULL);
895}
896
897static const VMStateDescription vmstate_virtio_balloon = {
898 .name = "virtio-balloon",
899 .minimum_version_id = 1,
900 .version_id = 1,
901 .fields = (VMStateField[]) {
902 VMSTATE_VIRTIO_DEVICE,
903 VMSTATE_END_OF_LIST()
904 },
905};
906
907static Property virtio_balloon_properties[] = {
908 DEFINE_PROP_BIT("deflate-on-oom", VirtIOBalloon, host_features,
909 VIRTIO_BALLOON_F_DEFLATE_ON_OOM, false),
910 DEFINE_PROP_BIT("free-page-hint", VirtIOBalloon, host_features,
911 VIRTIO_BALLOON_F_FREE_PAGE_HINT, false),
912 /* QEMU 4.0 accidentally changed the config size even when free-page-hint
913 * is disabled, resulting in QEMU 3.1 migration incompatibility. This
914 * property retains this quirk for QEMU 4.1 machine types.
915 */
916 DEFINE_PROP_BOOL("qemu-4-0-config-size", VirtIOBalloon,
917 qemu_4_0_config_size, false),
918 DEFINE_PROP_LINK("iothread", VirtIOBalloon, iothread, TYPE_IOTHREAD,
919 IOThread *),
920 DEFINE_PROP_END_OF_LIST(),
921};
922
923static void virtio_balloon_class_init(ObjectClass *klass, void *data)
924{
925 DeviceClass *dc = DEVICE_CLASS(klass);
926 VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
927
928 dc->props = virtio_balloon_properties;
929 dc->vmsd = &vmstate_virtio_balloon;
930 set_bit(DEVICE_CATEGORY_MISC, dc->categories);
931 vdc->realize = virtio_balloon_device_realize;
932 vdc->unrealize = virtio_balloon_device_unrealize;
933 vdc->reset = virtio_balloon_device_reset;
934 vdc->get_config = virtio_balloon_get_config;
935 vdc->set_config = virtio_balloon_set_config;
936 vdc->get_features = virtio_balloon_get_features;
937 vdc->set_status = virtio_balloon_set_status;
938 vdc->vmsd = &vmstate_virtio_balloon_device;
939}
940
941static const TypeInfo virtio_balloon_info = {
942 .name = TYPE_VIRTIO_BALLOON,
943 .parent = TYPE_VIRTIO_DEVICE,
944 .instance_size = sizeof(VirtIOBalloon),
945 .instance_init = virtio_balloon_instance_init,
946 .class_init = virtio_balloon_class_init,
947};
948
949static void virtio_register_types(void)
950{
951 type_register_static(&virtio_balloon_info);
952}
953
954type_init(virtio_register_types)
955