1 /* 2 * Virtio Balloon Device 3 * 4 * Copyright IBM, Corp. 2008 5 * Copyright (C) 2011 Red Hat, Inc. 6 * Copyright (C) 2011 Amit Shah <amit.shah@redhat.com> 7 * 8 * Authors: 9 * Anthony Liguori <aliguori@us.ibm.com> 10 * 11 * This work is licensed under the terms of the GNU GPL, version 2. See 12 * the COPYING file in the top-level directory. 13 * 14 */ 15 16 #include "qemu/osdep.h" 17 #include "qemu/iov.h" 18 #include "qemu/module.h" 19 #include "qemu/timer.h" 20 #include "hw/virtio/virtio.h" 21 #include "hw/mem/pc-dimm.h" 22 #include "hw/qdev-properties.h" 23 #include "sysemu/balloon.h" 24 #include "hw/virtio/virtio-balloon.h" 25 #include "exec/address-spaces.h" 26 #include "qapi/error.h" 27 #include "qapi/qapi-events-misc.h" 28 #include "qapi/visitor.h" 29 #include "trace.h" 30 #include "qemu/error-report.h" 31 #include "migration/misc.h" 32 33 #include "hw/virtio/virtio-bus.h" 34 #include "hw/virtio/virtio-access.h" 35 36 #define BALLOON_PAGE_SIZE (1 << VIRTIO_BALLOON_PFN_SHIFT) 37 38 typedef struct PartiallyBalloonedPage { 39 ram_addr_t base_gpa; 40 unsigned long *bitmap; 41 } PartiallyBalloonedPage; 42 43 static void virtio_balloon_pbp_free(PartiallyBalloonedPage *pbp) 44 { 45 if (!pbp->bitmap) { 46 return; 47 } 48 g_free(pbp->bitmap); 49 pbp->bitmap = NULL; 50 } 51 52 static void virtio_balloon_pbp_alloc(PartiallyBalloonedPage *pbp, 53 ram_addr_t base_gpa, 54 long subpages) 55 { 56 pbp->base_gpa = base_gpa; 57 pbp->bitmap = bitmap_new(subpages); 58 } 59 60 static bool virtio_balloon_pbp_matches(PartiallyBalloonedPage *pbp, 61 ram_addr_t base_gpa) 62 { 63 return pbp->base_gpa == base_gpa; 64 } 65 66 static bool virtio_balloon_inhibited(void) 67 { 68 /* Postcopy cannot deal with concurrent discards, so it's special. */ 69 return ram_block_discard_is_disabled() || migration_in_incoming_postcopy(); 70 } 71 72 static void balloon_inflate_page(VirtIOBalloon *balloon, 73 MemoryRegion *mr, hwaddr mr_offset, 74 PartiallyBalloonedPage *pbp) 75 { 76 void *addr = memory_region_get_ram_ptr(mr) + mr_offset; 77 ram_addr_t rb_offset, rb_aligned_offset, base_gpa; 78 RAMBlock *rb; 79 size_t rb_page_size; 80 int subpages; 81 82 /* XXX is there a better way to get to the RAMBlock than via a 83 * host address? */ 84 rb = qemu_ram_block_from_host(addr, false, &rb_offset); 85 rb_page_size = qemu_ram_pagesize(rb); 86 87 if (rb_page_size == BALLOON_PAGE_SIZE) { 88 /* Easy case */ 89 90 ram_block_discard_range(rb, rb_offset, rb_page_size); 91 /* We ignore errors from ram_block_discard_range(), because it 92 * has already reported them, and failing to discard a balloon 93 * page is not fatal */ 94 return; 95 } 96 97 /* Hard case 98 * 99 * We've put a piece of a larger host page into the balloon - we 100 * need to keep track until we have a whole host page to 101 * discard 102 */ 103 warn_report_once( 104 "Balloon used with backing page size > 4kiB, this may not be reliable"); 105 106 rb_aligned_offset = QEMU_ALIGN_DOWN(rb_offset, rb_page_size); 107 subpages = rb_page_size / BALLOON_PAGE_SIZE; 108 base_gpa = memory_region_get_ram_addr(mr) + mr_offset - 109 (rb_offset - rb_aligned_offset); 110 111 if (pbp->bitmap && !virtio_balloon_pbp_matches(pbp, base_gpa)) { 112 /* We've partially ballooned part of a host page, but now 113 * we're trying to balloon part of a different one. Too hard, 114 * give up on the old partial page */ 115 virtio_balloon_pbp_free(pbp); 116 } 117 118 if (!pbp->bitmap) { 119 virtio_balloon_pbp_alloc(pbp, base_gpa, subpages); 120 } 121 122 set_bit((rb_offset - rb_aligned_offset) / BALLOON_PAGE_SIZE, 123 pbp->bitmap); 124 125 if (bitmap_full(pbp->bitmap, subpages)) { 126 /* We've accumulated a full host page, we can actually discard 127 * it now */ 128 129 ram_block_discard_range(rb, rb_aligned_offset, rb_page_size); 130 /* We ignore errors from ram_block_discard_range(), because it 131 * has already reported them, and failing to discard a balloon 132 * page is not fatal */ 133 virtio_balloon_pbp_free(pbp); 134 } 135 } 136 137 static void balloon_deflate_page(VirtIOBalloon *balloon, 138 MemoryRegion *mr, hwaddr mr_offset) 139 { 140 void *addr = memory_region_get_ram_ptr(mr) + mr_offset; 141 ram_addr_t rb_offset; 142 RAMBlock *rb; 143 size_t rb_page_size; 144 void *host_addr; 145 int ret; 146 147 /* XXX is there a better way to get to the RAMBlock than via a 148 * host address? */ 149 rb = qemu_ram_block_from_host(addr, false, &rb_offset); 150 rb_page_size = qemu_ram_pagesize(rb); 151 152 host_addr = (void *)((uintptr_t)addr & ~(rb_page_size - 1)); 153 154 /* When a page is deflated, we hint the whole host page it lives 155 * on, since we can't do anything smaller */ 156 ret = qemu_madvise(host_addr, rb_page_size, QEMU_MADV_WILLNEED); 157 if (ret != 0) { 158 warn_report("Couldn't MADV_WILLNEED on balloon deflate: %s", 159 strerror(errno)); 160 /* Otherwise ignore, failing to page hint shouldn't be fatal */ 161 } 162 } 163 164 static const char *balloon_stat_names[] = { 165 [VIRTIO_BALLOON_S_SWAP_IN] = "stat-swap-in", 166 [VIRTIO_BALLOON_S_SWAP_OUT] = "stat-swap-out", 167 [VIRTIO_BALLOON_S_MAJFLT] = "stat-major-faults", 168 [VIRTIO_BALLOON_S_MINFLT] = "stat-minor-faults", 169 [VIRTIO_BALLOON_S_MEMFREE] = "stat-free-memory", 170 [VIRTIO_BALLOON_S_MEMTOT] = "stat-total-memory", 171 [VIRTIO_BALLOON_S_AVAIL] = "stat-available-memory", 172 [VIRTIO_BALLOON_S_CACHES] = "stat-disk-caches", 173 [VIRTIO_BALLOON_S_HTLB_PGALLOC] = "stat-htlb-pgalloc", 174 [VIRTIO_BALLOON_S_HTLB_PGFAIL] = "stat-htlb-pgfail", 175 [VIRTIO_BALLOON_S_NR] = NULL 176 }; 177 178 /* 179 * reset_stats - Mark all items in the stats array as unset 180 * 181 * This function needs to be called at device initialization and before 182 * updating to a set of newly-generated stats. This will ensure that no 183 * stale values stick around in case the guest reports a subset of the supported 184 * statistics. 185 */ 186 static inline void reset_stats(VirtIOBalloon *dev) 187 { 188 int i; 189 for (i = 0; i < VIRTIO_BALLOON_S_NR; dev->stats[i++] = -1); 190 } 191 192 static bool balloon_stats_supported(const VirtIOBalloon *s) 193 { 194 VirtIODevice *vdev = VIRTIO_DEVICE(s); 195 return virtio_vdev_has_feature(vdev, VIRTIO_BALLOON_F_STATS_VQ); 196 } 197 198 static bool balloon_stats_enabled(const VirtIOBalloon *s) 199 { 200 return s->stats_poll_interval > 0; 201 } 202 203 static void balloon_stats_destroy_timer(VirtIOBalloon *s) 204 { 205 if (balloon_stats_enabled(s)) { 206 timer_del(s->stats_timer); 207 timer_free(s->stats_timer); 208 s->stats_timer = NULL; 209 s->stats_poll_interval = 0; 210 } 211 } 212 213 static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs) 214 { 215 timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000); 216 } 217 218 static void balloon_stats_poll_cb(void *opaque) 219 { 220 VirtIOBalloon *s = opaque; 221 VirtIODevice *vdev = VIRTIO_DEVICE(s); 222 223 if (s->stats_vq_elem == NULL || !balloon_stats_supported(s)) { 224 /* re-schedule */ 225 balloon_stats_change_timer(s, s->stats_poll_interval); 226 return; 227 } 228 229 virtqueue_push(s->svq, s->stats_vq_elem, s->stats_vq_offset); 230 virtio_notify(vdev, s->svq); 231 g_free(s->stats_vq_elem); 232 s->stats_vq_elem = NULL; 233 } 234 235 static void balloon_stats_get_all(Object *obj, Visitor *v, const char *name, 236 void *opaque, Error **errp) 237 { 238 Error *err = NULL; 239 VirtIOBalloon *s = opaque; 240 int i; 241 242 if (!visit_start_struct(v, name, NULL, 0, &err)) { 243 goto out; 244 } 245 if (!visit_type_int(v, "last-update", &s->stats_last_update, &err)) { 246 goto out_end; 247 } 248 249 if (!visit_start_struct(v, "stats", NULL, 0, &err)) { 250 goto out_end; 251 } 252 for (i = 0; i < VIRTIO_BALLOON_S_NR; i++) { 253 if (!visit_type_uint64(v, balloon_stat_names[i], &s->stats[i], &err)) { 254 goto out_nested; 255 } 256 } 257 visit_check_struct(v, &err); 258 out_nested: 259 visit_end_struct(v, NULL); 260 261 if (!err) { 262 visit_check_struct(v, &err); 263 } 264 out_end: 265 visit_end_struct(v, NULL); 266 out: 267 error_propagate(errp, err); 268 } 269 270 static void balloon_stats_get_poll_interval(Object *obj, Visitor *v, 271 const char *name, void *opaque, 272 Error **errp) 273 { 274 VirtIOBalloon *s = opaque; 275 visit_type_int(v, name, &s->stats_poll_interval, errp); 276 } 277 278 static void balloon_stats_set_poll_interval(Object *obj, Visitor *v, 279 const char *name, void *opaque, 280 Error **errp) 281 { 282 VirtIOBalloon *s = opaque; 283 int64_t value; 284 285 if (!visit_type_int(v, name, &value, errp)) { 286 return; 287 } 288 289 if (value < 0) { 290 error_setg(errp, "timer value must be greater than zero"); 291 return; 292 } 293 294 if (value > UINT32_MAX) { 295 error_setg(errp, "timer value is too big"); 296 return; 297 } 298 299 if (value == s->stats_poll_interval) { 300 return; 301 } 302 303 if (value == 0) { 304 /* timer=0 disables the timer */ 305 balloon_stats_destroy_timer(s); 306 return; 307 } 308 309 if (balloon_stats_enabled(s)) { 310 /* timer interval change */ 311 s->stats_poll_interval = value; 312 balloon_stats_change_timer(s, value); 313 return; 314 } 315 316 /* create a new timer */ 317 g_assert(s->stats_timer == NULL); 318 s->stats_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, balloon_stats_poll_cb, s); 319 s->stats_poll_interval = value; 320 balloon_stats_change_timer(s, 0); 321 } 322 323 static void virtio_balloon_handle_report(VirtIODevice *vdev, VirtQueue *vq) 324 { 325 VirtIOBalloon *dev = VIRTIO_BALLOON(vdev); 326 VirtQueueElement *elem; 327 328 while ((elem = virtqueue_pop(vq, sizeof(VirtQueueElement)))) { 329 unsigned int i; 330 331 /* 332 * When we discard the page it has the effect of removing the page 333 * from the hypervisor itself and causing it to be zeroed when it 334 * is returned to us. So we must not discard the page if it is 335 * accessible by another device or process, or if the guest is 336 * expecting it to retain a non-zero value. 337 */ 338 if (virtio_balloon_inhibited() || dev->poison_val) { 339 goto skip_element; 340 } 341 342 for (i = 0; i < elem->in_num; i++) { 343 void *addr = elem->in_sg[i].iov_base; 344 size_t size = elem->in_sg[i].iov_len; 345 ram_addr_t ram_offset; 346 RAMBlock *rb; 347 348 /* 349 * There is no need to check the memory section to see if 350 * it is ram/readonly/romd like there is for handle_output 351 * below. If the region is not meant to be written to then 352 * address_space_map will have allocated a bounce buffer 353 * and it will be freed in address_space_unmap and trigger 354 * and unassigned_mem_write before failing to copy over the 355 * buffer. If more than one bad descriptor is provided it 356 * will return NULL after the first bounce buffer and fail 357 * to map any resources. 358 */ 359 rb = qemu_ram_block_from_host(addr, false, &ram_offset); 360 if (!rb) { 361 trace_virtio_balloon_bad_addr(elem->in_addr[i]); 362 continue; 363 } 364 365 /* 366 * For now we will simply ignore unaligned memory regions, or 367 * regions that overrun the end of the RAMBlock. 368 */ 369 if (!QEMU_IS_ALIGNED(ram_offset | size, qemu_ram_pagesize(rb)) || 370 (ram_offset + size) > qemu_ram_get_used_length(rb)) { 371 continue; 372 } 373 374 ram_block_discard_range(rb, ram_offset, size); 375 } 376 377 skip_element: 378 virtqueue_push(vq, elem, 0); 379 virtio_notify(vdev, vq); 380 g_free(elem); 381 } 382 } 383 384 static void virtio_balloon_handle_output(VirtIODevice *vdev, VirtQueue *vq) 385 { 386 VirtIOBalloon *s = VIRTIO_BALLOON(vdev); 387 VirtQueueElement *elem; 388 MemoryRegionSection section; 389 390 for (;;) { 391 PartiallyBalloonedPage pbp = {}; 392 size_t offset = 0; 393 uint32_t pfn; 394 395 elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); 396 if (!elem) { 397 break; 398 } 399 400 while (iov_to_buf(elem->out_sg, elem->out_num, offset, &pfn, 4) == 4) { 401 unsigned int p = virtio_ldl_p(vdev, &pfn); 402 hwaddr pa; 403 404 pa = (hwaddr) p << VIRTIO_BALLOON_PFN_SHIFT; 405 offset += 4; 406 407 section = memory_region_find(get_system_memory(), pa, 408 BALLOON_PAGE_SIZE); 409 if (!section.mr) { 410 trace_virtio_balloon_bad_addr(pa); 411 continue; 412 } 413 if (!memory_region_is_ram(section.mr) || 414 memory_region_is_rom(section.mr) || 415 memory_region_is_romd(section.mr)) { 416 trace_virtio_balloon_bad_addr(pa); 417 memory_region_unref(section.mr); 418 continue; 419 } 420 421 trace_virtio_balloon_handle_output(memory_region_name(section.mr), 422 pa); 423 if (!virtio_balloon_inhibited()) { 424 if (vq == s->ivq) { 425 balloon_inflate_page(s, section.mr, 426 section.offset_within_region, &pbp); 427 } else if (vq == s->dvq) { 428 balloon_deflate_page(s, section.mr, section.offset_within_region); 429 } else { 430 g_assert_not_reached(); 431 } 432 } 433 memory_region_unref(section.mr); 434 } 435 436 virtqueue_push(vq, elem, offset); 437 virtio_notify(vdev, vq); 438 g_free(elem); 439 virtio_balloon_pbp_free(&pbp); 440 } 441 } 442 443 static void virtio_balloon_receive_stats(VirtIODevice *vdev, VirtQueue *vq) 444 { 445 VirtIOBalloon *s = VIRTIO_BALLOON(vdev); 446 VirtQueueElement *elem; 447 VirtIOBalloonStat stat; 448 size_t offset = 0; 449 qemu_timeval tv; 450 451 elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); 452 if (!elem) { 453 goto out; 454 } 455 456 if (s->stats_vq_elem != NULL) { 457 /* This should never happen if the driver follows the spec. */ 458 virtqueue_push(vq, s->stats_vq_elem, 0); 459 virtio_notify(vdev, vq); 460 g_free(s->stats_vq_elem); 461 } 462 463 s->stats_vq_elem = elem; 464 465 /* Initialize the stats to get rid of any stale values. This is only 466 * needed to handle the case where a guest supports fewer stats than it 467 * used to (ie. it has booted into an old kernel). 468 */ 469 reset_stats(s); 470 471 while (iov_to_buf(elem->out_sg, elem->out_num, offset, &stat, sizeof(stat)) 472 == sizeof(stat)) { 473 uint16_t tag = virtio_tswap16(vdev, stat.tag); 474 uint64_t val = virtio_tswap64(vdev, stat.val); 475 476 offset += sizeof(stat); 477 if (tag < VIRTIO_BALLOON_S_NR) 478 s->stats[tag] = val; 479 } 480 s->stats_vq_offset = offset; 481 482 if (qemu_gettimeofday(&tv) < 0) { 483 warn_report("%s: failed to get time of day", __func__); 484 goto out; 485 } 486 487 s->stats_last_update = tv.tv_sec; 488 489 out: 490 if (balloon_stats_enabled(s)) { 491 balloon_stats_change_timer(s, s->stats_poll_interval); 492 } 493 } 494 495 static void virtio_balloon_handle_free_page_vq(VirtIODevice *vdev, 496 VirtQueue *vq) 497 { 498 VirtIOBalloon *s = VIRTIO_BALLOON(vdev); 499 qemu_bh_schedule(s->free_page_bh); 500 } 501 502 static bool get_free_page_hints(VirtIOBalloon *dev) 503 { 504 VirtQueueElement *elem; 505 VirtIODevice *vdev = VIRTIO_DEVICE(dev); 506 VirtQueue *vq = dev->free_page_vq; 507 bool ret = true; 508 509 while (dev->block_iothread) { 510 qemu_cond_wait(&dev->free_page_cond, &dev->free_page_lock); 511 } 512 513 elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); 514 if (!elem) { 515 return false; 516 } 517 518 if (elem->out_num) { 519 uint32_t id; 520 size_t size = iov_to_buf(elem->out_sg, elem->out_num, 0, 521 &id, sizeof(id)); 522 523 virtio_tswap32s(vdev, &id); 524 if (unlikely(size != sizeof(id))) { 525 virtio_error(vdev, "received an incorrect cmd id"); 526 ret = false; 527 goto out; 528 } 529 if (dev->free_page_report_status == FREE_PAGE_REPORT_S_REQUESTED && 530 id == dev->free_page_report_cmd_id) { 531 dev->free_page_report_status = FREE_PAGE_REPORT_S_START; 532 } else { 533 /* 534 * Stop the optimization only when it has started. This 535 * avoids a stale stop sign for the previous command. 536 */ 537 if (dev->free_page_report_status == FREE_PAGE_REPORT_S_START) { 538 dev->free_page_report_status = FREE_PAGE_REPORT_S_STOP; 539 } 540 } 541 } 542 543 if (elem->in_num) { 544 if (dev->free_page_report_status == FREE_PAGE_REPORT_S_START) { 545 qemu_guest_free_page_hint(elem->in_sg[0].iov_base, 546 elem->in_sg[0].iov_len); 547 } 548 } 549 550 out: 551 virtqueue_push(vq, elem, 1); 552 g_free(elem); 553 return ret; 554 } 555 556 static void virtio_ballloon_get_free_page_hints(void *opaque) 557 { 558 VirtIOBalloon *dev = opaque; 559 VirtIODevice *vdev = VIRTIO_DEVICE(dev); 560 VirtQueue *vq = dev->free_page_vq; 561 bool continue_to_get_hints; 562 563 do { 564 qemu_mutex_lock(&dev->free_page_lock); 565 virtio_queue_set_notification(vq, 0); 566 continue_to_get_hints = get_free_page_hints(dev); 567 qemu_mutex_unlock(&dev->free_page_lock); 568 virtio_notify(vdev, vq); 569 /* 570 * Start to poll the vq once the reporting started. Otherwise, continue 571 * only when there are entries on the vq, which need to be given back. 572 */ 573 } while (continue_to_get_hints || 574 dev->free_page_report_status == FREE_PAGE_REPORT_S_START); 575 virtio_queue_set_notification(vq, 1); 576 } 577 578 static bool virtio_balloon_free_page_support(void *opaque) 579 { 580 VirtIOBalloon *s = opaque; 581 VirtIODevice *vdev = VIRTIO_DEVICE(s); 582 583 return virtio_vdev_has_feature(vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT); 584 } 585 586 static void virtio_balloon_free_page_start(VirtIOBalloon *s) 587 { 588 VirtIODevice *vdev = VIRTIO_DEVICE(s); 589 590 /* For the stop and copy phase, we don't need to start the optimization */ 591 if (!vdev->vm_running) { 592 return; 593 } 594 595 if (s->free_page_report_cmd_id == UINT_MAX) { 596 s->free_page_report_cmd_id = 597 VIRTIO_BALLOON_FREE_PAGE_REPORT_CMD_ID_MIN; 598 } else { 599 s->free_page_report_cmd_id++; 600 } 601 602 s->free_page_report_status = FREE_PAGE_REPORT_S_REQUESTED; 603 virtio_notify_config(vdev); 604 } 605 606 static void virtio_balloon_free_page_stop(VirtIOBalloon *s) 607 { 608 VirtIODevice *vdev = VIRTIO_DEVICE(s); 609 610 if (s->free_page_report_status != FREE_PAGE_REPORT_S_STOP) { 611 /* 612 * The lock also guarantees us that the 613 * virtio_ballloon_get_free_page_hints exits after the 614 * free_page_report_status is set to S_STOP. 615 */ 616 qemu_mutex_lock(&s->free_page_lock); 617 /* 618 * The guest hasn't done the reporting, so host sends a notification 619 * to the guest to actively stop the reporting. 620 */ 621 s->free_page_report_status = FREE_PAGE_REPORT_S_STOP; 622 qemu_mutex_unlock(&s->free_page_lock); 623 virtio_notify_config(vdev); 624 } 625 } 626 627 static void virtio_balloon_free_page_done(VirtIOBalloon *s) 628 { 629 VirtIODevice *vdev = VIRTIO_DEVICE(s); 630 631 if (s->free_page_report_status != FREE_PAGE_REPORT_S_DONE) { 632 /* See virtio_balloon_free_page_stop() */ 633 qemu_mutex_lock(&s->free_page_lock); 634 s->free_page_report_status = FREE_PAGE_REPORT_S_DONE; 635 qemu_mutex_unlock(&s->free_page_lock); 636 virtio_notify_config(vdev); 637 } 638 } 639 640 static int 641 virtio_balloon_free_page_report_notify(NotifierWithReturn *n, void *data) 642 { 643 VirtIOBalloon *dev = container_of(n, VirtIOBalloon, 644 free_page_report_notify); 645 VirtIODevice *vdev = VIRTIO_DEVICE(dev); 646 PrecopyNotifyData *pnd = data; 647 648 if (!virtio_balloon_free_page_support(dev)) { 649 /* 650 * This is an optimization provided to migration, so just return 0 to 651 * have the normal migration process not affected when this feature is 652 * not supported. 653 */ 654 return 0; 655 } 656 657 switch (pnd->reason) { 658 case PRECOPY_NOTIFY_SETUP: 659 precopy_enable_free_page_optimization(); 660 break; 661 case PRECOPY_NOTIFY_BEFORE_BITMAP_SYNC: 662 virtio_balloon_free_page_stop(dev); 663 break; 664 case PRECOPY_NOTIFY_AFTER_BITMAP_SYNC: 665 if (vdev->vm_running) { 666 virtio_balloon_free_page_start(dev); 667 break; 668 } 669 /* 670 * Set S_DONE before migrating the vmstate, so the guest will reuse 671 * all hinted pages once running on the destination. Fall through. 672 */ 673 case PRECOPY_NOTIFY_CLEANUP: 674 /* 675 * Especially, if something goes wrong during precopy or if migration 676 * is canceled, we have to properly communicate S_DONE to the VM. 677 */ 678 virtio_balloon_free_page_done(dev); 679 break; 680 case PRECOPY_NOTIFY_COMPLETE: 681 break; 682 default: 683 virtio_error(vdev, "%s: %d reason unknown", __func__, pnd->reason); 684 } 685 686 return 0; 687 } 688 689 static size_t virtio_balloon_config_size(VirtIOBalloon *s) 690 { 691 uint64_t features = s->host_features; 692 693 if (s->qemu_4_0_config_size) { 694 return sizeof(struct virtio_balloon_config); 695 } 696 if (virtio_has_feature(features, VIRTIO_BALLOON_F_PAGE_POISON)) { 697 return sizeof(struct virtio_balloon_config); 698 } 699 if (virtio_has_feature(features, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) { 700 return offsetof(struct virtio_balloon_config, poison_val); 701 } 702 return offsetof(struct virtio_balloon_config, free_page_report_cmd_id); 703 } 704 705 static void virtio_balloon_get_config(VirtIODevice *vdev, uint8_t *config_data) 706 { 707 VirtIOBalloon *dev = VIRTIO_BALLOON(vdev); 708 struct virtio_balloon_config config = {}; 709 710 config.num_pages = cpu_to_le32(dev->num_pages); 711 config.actual = cpu_to_le32(dev->actual); 712 config.poison_val = cpu_to_le32(dev->poison_val); 713 714 if (dev->free_page_report_status == FREE_PAGE_REPORT_S_REQUESTED) { 715 config.free_page_report_cmd_id = 716 cpu_to_le32(dev->free_page_report_cmd_id); 717 } else if (dev->free_page_report_status == FREE_PAGE_REPORT_S_STOP) { 718 config.free_page_report_cmd_id = 719 cpu_to_le32(VIRTIO_BALLOON_CMD_ID_STOP); 720 } else if (dev->free_page_report_status == FREE_PAGE_REPORT_S_DONE) { 721 config.free_page_report_cmd_id = 722 cpu_to_le32(VIRTIO_BALLOON_CMD_ID_DONE); 723 } 724 725 trace_virtio_balloon_get_config(config.num_pages, config.actual); 726 memcpy(config_data, &config, virtio_balloon_config_size(dev)); 727 } 728 729 static int build_dimm_list(Object *obj, void *opaque) 730 { 731 GSList **list = opaque; 732 733 if (object_dynamic_cast(obj, TYPE_PC_DIMM)) { 734 DeviceState *dev = DEVICE(obj); 735 if (dev->realized) { /* only realized DIMMs matter */ 736 *list = g_slist_prepend(*list, dev); 737 } 738 } 739 740 object_child_foreach(obj, build_dimm_list, opaque); 741 return 0; 742 } 743 744 static ram_addr_t get_current_ram_size(void) 745 { 746 GSList *list = NULL, *item; 747 ram_addr_t size = ram_size; 748 749 build_dimm_list(qdev_get_machine(), &list); 750 for (item = list; item; item = g_slist_next(item)) { 751 Object *obj = OBJECT(item->data); 752 if (!strcmp(object_get_typename(obj), TYPE_PC_DIMM)) { 753 size += object_property_get_int(obj, PC_DIMM_SIZE_PROP, 754 &error_abort); 755 } 756 } 757 g_slist_free(list); 758 759 return size; 760 } 761 762 static bool virtio_balloon_page_poison_support(void *opaque) 763 { 764 VirtIOBalloon *s = opaque; 765 VirtIODevice *vdev = VIRTIO_DEVICE(s); 766 767 return virtio_vdev_has_feature(vdev, VIRTIO_BALLOON_F_PAGE_POISON); 768 } 769 770 static void virtio_balloon_set_config(VirtIODevice *vdev, 771 const uint8_t *config_data) 772 { 773 VirtIOBalloon *dev = VIRTIO_BALLOON(vdev); 774 struct virtio_balloon_config config; 775 uint32_t oldactual = dev->actual; 776 ram_addr_t vm_ram_size = get_current_ram_size(); 777 778 memcpy(&config, config_data, virtio_balloon_config_size(dev)); 779 dev->actual = le32_to_cpu(config.actual); 780 if (dev->actual != oldactual) { 781 qapi_event_send_balloon_change(vm_ram_size - 782 ((ram_addr_t) dev->actual << VIRTIO_BALLOON_PFN_SHIFT)); 783 } 784 dev->poison_val = 0; 785 if (virtio_balloon_page_poison_support(dev)) { 786 dev->poison_val = le32_to_cpu(config.poison_val); 787 } 788 trace_virtio_balloon_set_config(dev->actual, oldactual); 789 } 790 791 static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f, 792 Error **errp) 793 { 794 VirtIOBalloon *dev = VIRTIO_BALLOON(vdev); 795 f |= dev->host_features; 796 virtio_add_feature(&f, VIRTIO_BALLOON_F_STATS_VQ); 797 798 return f; 799 } 800 801 static void virtio_balloon_stat(void *opaque, BalloonInfo *info) 802 { 803 VirtIOBalloon *dev = opaque; 804 info->actual = get_current_ram_size() - ((uint64_t) dev->actual << 805 VIRTIO_BALLOON_PFN_SHIFT); 806 } 807 808 static void virtio_balloon_to_target(void *opaque, ram_addr_t target) 809 { 810 VirtIOBalloon *dev = VIRTIO_BALLOON(opaque); 811 VirtIODevice *vdev = VIRTIO_DEVICE(dev); 812 ram_addr_t vm_ram_size = get_current_ram_size(); 813 814 if (target > vm_ram_size) { 815 target = vm_ram_size; 816 } 817 if (target) { 818 dev->num_pages = (vm_ram_size - target) >> VIRTIO_BALLOON_PFN_SHIFT; 819 virtio_notify_config(vdev); 820 } 821 trace_virtio_balloon_to_target(target, dev->num_pages); 822 } 823 824 static int virtio_balloon_post_load_device(void *opaque, int version_id) 825 { 826 VirtIOBalloon *s = VIRTIO_BALLOON(opaque); 827 828 if (balloon_stats_enabled(s)) { 829 balloon_stats_change_timer(s, s->stats_poll_interval); 830 } 831 return 0; 832 } 833 834 static const VMStateDescription vmstate_virtio_balloon_free_page_report = { 835 .name = "virtio-balloon-device/free-page-report", 836 .version_id = 1, 837 .minimum_version_id = 1, 838 .needed = virtio_balloon_free_page_support, 839 .fields = (VMStateField[]) { 840 VMSTATE_UINT32(free_page_report_cmd_id, VirtIOBalloon), 841 VMSTATE_UINT32(free_page_report_status, VirtIOBalloon), 842 VMSTATE_END_OF_LIST() 843 } 844 }; 845 846 static const VMStateDescription vmstate_virtio_balloon_page_poison = { 847 .name = "vitio-balloon-device/page-poison", 848 .version_id = 1, 849 .minimum_version_id = 1, 850 .needed = virtio_balloon_page_poison_support, 851 .fields = (VMStateField[]) { 852 VMSTATE_UINT32(poison_val, VirtIOBalloon), 853 VMSTATE_END_OF_LIST() 854 } 855 }; 856 857 static const VMStateDescription vmstate_virtio_balloon_device = { 858 .name = "virtio-balloon-device", 859 .version_id = 1, 860 .minimum_version_id = 1, 861 .post_load = virtio_balloon_post_load_device, 862 .fields = (VMStateField[]) { 863 VMSTATE_UINT32(num_pages, VirtIOBalloon), 864 VMSTATE_UINT32(actual, VirtIOBalloon), 865 VMSTATE_END_OF_LIST() 866 }, 867 .subsections = (const VMStateDescription * []) { 868 &vmstate_virtio_balloon_free_page_report, 869 &vmstate_virtio_balloon_page_poison, 870 NULL 871 } 872 }; 873 874 static void virtio_balloon_device_realize(DeviceState *dev, Error **errp) 875 { 876 VirtIODevice *vdev = VIRTIO_DEVICE(dev); 877 VirtIOBalloon *s = VIRTIO_BALLOON(dev); 878 int ret; 879 880 virtio_init(vdev, "virtio-balloon", VIRTIO_ID_BALLOON, 881 virtio_balloon_config_size(s)); 882 883 ret = qemu_add_balloon_handler(virtio_balloon_to_target, 884 virtio_balloon_stat, s); 885 886 if (ret < 0) { 887 error_setg(errp, "Only one balloon device is supported"); 888 virtio_cleanup(vdev); 889 return; 890 } 891 892 if (virtio_has_feature(s->host_features, VIRTIO_BALLOON_F_FREE_PAGE_HINT) && 893 !s->iothread) { 894 error_setg(errp, "'free-page-hint' requires 'iothread' to be set"); 895 virtio_cleanup(vdev); 896 return; 897 } 898 899 s->ivq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output); 900 s->dvq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output); 901 s->svq = virtio_add_queue(vdev, 128, virtio_balloon_receive_stats); 902 903 if (virtio_has_feature(s->host_features, 904 VIRTIO_BALLOON_F_FREE_PAGE_HINT)) { 905 s->free_page_vq = virtio_add_queue(vdev, VIRTQUEUE_MAX_SIZE, 906 virtio_balloon_handle_free_page_vq); 907 precopy_add_notifier(&s->free_page_report_notify); 908 909 object_ref(OBJECT(s->iothread)); 910 s->free_page_bh = aio_bh_new(iothread_get_aio_context(s->iothread), 911 virtio_ballloon_get_free_page_hints, s); 912 } 913 914 if (virtio_has_feature(s->host_features, VIRTIO_BALLOON_F_REPORTING)) { 915 s->reporting_vq = virtio_add_queue(vdev, 32, 916 virtio_balloon_handle_report); 917 } 918 919 reset_stats(s); 920 } 921 922 static void virtio_balloon_device_unrealize(DeviceState *dev) 923 { 924 VirtIODevice *vdev = VIRTIO_DEVICE(dev); 925 VirtIOBalloon *s = VIRTIO_BALLOON(dev); 926 927 if (s->free_page_bh) { 928 qemu_bh_delete(s->free_page_bh); 929 object_unref(OBJECT(s->iothread)); 930 virtio_balloon_free_page_stop(s); 931 precopy_remove_notifier(&s->free_page_report_notify); 932 } 933 balloon_stats_destroy_timer(s); 934 qemu_remove_balloon_handler(s); 935 936 virtio_delete_queue(s->ivq); 937 virtio_delete_queue(s->dvq); 938 virtio_delete_queue(s->svq); 939 if (s->free_page_vq) { 940 virtio_delete_queue(s->free_page_vq); 941 } 942 if (s->reporting_vq) { 943 virtio_delete_queue(s->reporting_vq); 944 } 945 virtio_cleanup(vdev); 946 } 947 948 static void virtio_balloon_device_reset(VirtIODevice *vdev) 949 { 950 VirtIOBalloon *s = VIRTIO_BALLOON(vdev); 951 952 if (virtio_balloon_free_page_support(s)) { 953 virtio_balloon_free_page_stop(s); 954 } 955 956 if (s->stats_vq_elem != NULL) { 957 virtqueue_unpop(s->svq, s->stats_vq_elem, 0); 958 g_free(s->stats_vq_elem); 959 s->stats_vq_elem = NULL; 960 } 961 962 s->poison_val = 0; 963 } 964 965 static void virtio_balloon_set_status(VirtIODevice *vdev, uint8_t status) 966 { 967 VirtIOBalloon *s = VIRTIO_BALLOON(vdev); 968 969 if (!s->stats_vq_elem && vdev->vm_running && 970 (status & VIRTIO_CONFIG_S_DRIVER_OK) && virtqueue_rewind(s->svq, 1)) { 971 /* poll stats queue for the element we have discarded when the VM 972 * was stopped */ 973 virtio_balloon_receive_stats(vdev, s->svq); 974 } 975 976 if (virtio_balloon_free_page_support(s)) { 977 /* 978 * The VM is woken up and the iothread was blocked, so signal it to 979 * continue. 980 */ 981 if (vdev->vm_running && s->block_iothread) { 982 qemu_mutex_lock(&s->free_page_lock); 983 s->block_iothread = false; 984 qemu_cond_signal(&s->free_page_cond); 985 qemu_mutex_unlock(&s->free_page_lock); 986 } 987 988 /* The VM is stopped, block the iothread. */ 989 if (!vdev->vm_running) { 990 qemu_mutex_lock(&s->free_page_lock); 991 s->block_iothread = true; 992 qemu_mutex_unlock(&s->free_page_lock); 993 } 994 } 995 } 996 997 static void virtio_balloon_instance_init(Object *obj) 998 { 999 VirtIOBalloon *s = VIRTIO_BALLOON(obj); 1000 1001 qemu_mutex_init(&s->free_page_lock); 1002 qemu_cond_init(&s->free_page_cond); 1003 s->free_page_report_cmd_id = VIRTIO_BALLOON_FREE_PAGE_REPORT_CMD_ID_MIN; 1004 s->free_page_report_notify.notify = virtio_balloon_free_page_report_notify; 1005 1006 object_property_add(obj, "guest-stats", "guest statistics", 1007 balloon_stats_get_all, NULL, NULL, s); 1008 1009 object_property_add(obj, "guest-stats-polling-interval", "int", 1010 balloon_stats_get_poll_interval, 1011 balloon_stats_set_poll_interval, 1012 NULL, s); 1013 } 1014 1015 static const VMStateDescription vmstate_virtio_balloon = { 1016 .name = "virtio-balloon", 1017 .minimum_version_id = 1, 1018 .version_id = 1, 1019 .fields = (VMStateField[]) { 1020 VMSTATE_VIRTIO_DEVICE, 1021 VMSTATE_END_OF_LIST() 1022 }, 1023 }; 1024 1025 static Property virtio_balloon_properties[] = { 1026 DEFINE_PROP_BIT("deflate-on-oom", VirtIOBalloon, host_features, 1027 VIRTIO_BALLOON_F_DEFLATE_ON_OOM, false), 1028 DEFINE_PROP_BIT("free-page-hint", VirtIOBalloon, host_features, 1029 VIRTIO_BALLOON_F_FREE_PAGE_HINT, false), 1030 DEFINE_PROP_BIT("page-poison", VirtIOBalloon, host_features, 1031 VIRTIO_BALLOON_F_PAGE_POISON, true), 1032 DEFINE_PROP_BIT("free-page-reporting", VirtIOBalloon, host_features, 1033 VIRTIO_BALLOON_F_REPORTING, false), 1034 /* QEMU 4.0 accidentally changed the config size even when free-page-hint 1035 * is disabled, resulting in QEMU 3.1 migration incompatibility. This 1036 * property retains this quirk for QEMU 4.1 machine types. 1037 */ 1038 DEFINE_PROP_BOOL("qemu-4-0-config-size", VirtIOBalloon, 1039 qemu_4_0_config_size, false), 1040 DEFINE_PROP_LINK("iothread", VirtIOBalloon, iothread, TYPE_IOTHREAD, 1041 IOThread *), 1042 DEFINE_PROP_END_OF_LIST(), 1043 }; 1044 1045 static void virtio_balloon_class_init(ObjectClass *klass, void *data) 1046 { 1047 DeviceClass *dc = DEVICE_CLASS(klass); 1048 VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass); 1049 1050 device_class_set_props(dc, virtio_balloon_properties); 1051 dc->vmsd = &vmstate_virtio_balloon; 1052 set_bit(DEVICE_CATEGORY_MISC, dc->categories); 1053 vdc->realize = virtio_balloon_device_realize; 1054 vdc->unrealize = virtio_balloon_device_unrealize; 1055 vdc->reset = virtio_balloon_device_reset; 1056 vdc->get_config = virtio_balloon_get_config; 1057 vdc->set_config = virtio_balloon_set_config; 1058 vdc->get_features = virtio_balloon_get_features; 1059 vdc->set_status = virtio_balloon_set_status; 1060 vdc->vmsd = &vmstate_virtio_balloon_device; 1061 } 1062 1063 static const TypeInfo virtio_balloon_info = { 1064 .name = TYPE_VIRTIO_BALLOON, 1065 .parent = TYPE_VIRTIO_DEVICE, 1066 .instance_size = sizeof(VirtIOBalloon), 1067 .instance_init = virtio_balloon_instance_init, 1068 .class_init = virtio_balloon_class_init, 1069 }; 1070 1071 static void virtio_register_types(void) 1072 { 1073 type_register_static(&virtio_balloon_info); 1074 } 1075 1076 type_init(virtio_register_types) 1077