xref: /qemu/hw/virtio/virtio-balloon.c (revision ae440bd14c002f3a5528bd38e8a285ea625c04ca)
1 /*
2  * Virtio Balloon Device
3  *
4  * Copyright IBM, Corp. 2008
5  * Copyright (C) 2011 Red Hat, Inc.
6  * Copyright (C) 2011 Amit Shah <amit.shah@redhat.com>
7  *
8  * Authors:
9  *  Anthony Liguori   <aliguori@us.ibm.com>
10  *
11  * This work is licensed under the terms of the GNU GPL, version 2.  See
12  * the COPYING file in the top-level directory.
13  *
14  */
15 
16 #include "qemu/osdep.h"
17 #include "qemu/iov.h"
18 #include "qemu/timer.h"
19 #include "qemu-common.h"
20 #include "hw/virtio/virtio.h"
21 #include "hw/mem/pc-dimm.h"
22 #include "sysemu/balloon.h"
23 #include "hw/virtio/virtio-balloon.h"
24 #include "exec/address-spaces.h"
25 #include "qapi/error.h"
26 #include "qapi/qapi-events-misc.h"
27 #include "qapi/visitor.h"
28 #include "trace.h"
29 #include "qemu/error-report.h"
30 #include "migration/misc.h"
31 
32 #include "hw/virtio/virtio-bus.h"
33 #include "hw/virtio/virtio-access.h"
34 
35 #define BALLOON_PAGE_SIZE  (1 << VIRTIO_BALLOON_PFN_SHIFT)
36 
37 struct PartiallyBalloonedPage {
38     RAMBlock *rb;
39     ram_addr_t base;
40     unsigned long bitmap[];
41 };
42 
43 static void balloon_inflate_page(VirtIOBalloon *balloon,
44                                  MemoryRegion *mr, hwaddr offset)
45 {
46     void *addr = memory_region_get_ram_ptr(mr) + offset;
47     RAMBlock *rb;
48     size_t rb_page_size;
49     int subpages;
50     ram_addr_t ram_offset, host_page_base;
51 
52     /* XXX is there a better way to get to the RAMBlock than via a
53      * host address? */
54     rb = qemu_ram_block_from_host(addr, false, &ram_offset);
55     rb_page_size = qemu_ram_pagesize(rb);
56     host_page_base = ram_offset & ~(rb_page_size - 1);
57 
58     if (rb_page_size == BALLOON_PAGE_SIZE) {
59         /* Easy case */
60 
61         ram_block_discard_range(rb, ram_offset, rb_page_size);
62         /* We ignore errors from ram_block_discard_range(), because it
63          * has already reported them, and failing to discard a balloon
64          * page is not fatal */
65         return;
66     }
67 
68     /* Hard case
69      *
70      * We've put a piece of a larger host page into the balloon - we
71      * need to keep track until we have a whole host page to
72      * discard
73      */
74     warn_report_once(
75 "Balloon used with backing page size > 4kiB, this may not be reliable");
76 
77     subpages = rb_page_size / BALLOON_PAGE_SIZE;
78 
79     if (balloon->pbp
80         && (rb != balloon->pbp->rb
81             || host_page_base != balloon->pbp->base)) {
82         /* We've partially ballooned part of a host page, but now
83          * we're trying to balloon part of a different one.  Too hard,
84          * give up on the old partial page */
85         free(balloon->pbp);
86         balloon->pbp = NULL;
87     }
88 
89     if (!balloon->pbp) {
90         /* Starting on a new host page */
91         size_t bitlen = BITS_TO_LONGS(subpages) * sizeof(unsigned long);
92         balloon->pbp = g_malloc0(sizeof(PartiallyBalloonedPage) + bitlen);
93         balloon->pbp->rb = rb;
94         balloon->pbp->base = host_page_base;
95     }
96 
97     bitmap_set(balloon->pbp->bitmap,
98                (ram_offset - balloon->pbp->base) / BALLOON_PAGE_SIZE,
99                subpages);
100 
101     if (bitmap_full(balloon->pbp->bitmap, subpages)) {
102         /* We've accumulated a full host page, we can actually discard
103          * it now */
104 
105         ram_block_discard_range(rb, balloon->pbp->base, rb_page_size);
106         /* We ignore errors from ram_block_discard_range(), because it
107          * has already reported them, and failing to discard a balloon
108          * page is not fatal */
109 
110         free(balloon->pbp);
111         balloon->pbp = NULL;
112     }
113 }
114 
115 static const char *balloon_stat_names[] = {
116    [VIRTIO_BALLOON_S_SWAP_IN] = "stat-swap-in",
117    [VIRTIO_BALLOON_S_SWAP_OUT] = "stat-swap-out",
118    [VIRTIO_BALLOON_S_MAJFLT] = "stat-major-faults",
119    [VIRTIO_BALLOON_S_MINFLT] = "stat-minor-faults",
120    [VIRTIO_BALLOON_S_MEMFREE] = "stat-free-memory",
121    [VIRTIO_BALLOON_S_MEMTOT] = "stat-total-memory",
122    [VIRTIO_BALLOON_S_AVAIL] = "stat-available-memory",
123    [VIRTIO_BALLOON_S_CACHES] = "stat-disk-caches",
124    [VIRTIO_BALLOON_S_HTLB_PGALLOC] = "stat-htlb-pgalloc",
125    [VIRTIO_BALLOON_S_HTLB_PGFAIL] = "stat-htlb-pgfail",
126    [VIRTIO_BALLOON_S_NR] = NULL
127 };
128 
129 /*
130  * reset_stats - Mark all items in the stats array as unset
131  *
132  * This function needs to be called at device initialization and before
133  * updating to a set of newly-generated stats.  This will ensure that no
134  * stale values stick around in case the guest reports a subset of the supported
135  * statistics.
136  */
137 static inline void reset_stats(VirtIOBalloon *dev)
138 {
139     int i;
140     for (i = 0; i < VIRTIO_BALLOON_S_NR; dev->stats[i++] = -1);
141 }
142 
143 static bool balloon_stats_supported(const VirtIOBalloon *s)
144 {
145     VirtIODevice *vdev = VIRTIO_DEVICE(s);
146     return virtio_vdev_has_feature(vdev, VIRTIO_BALLOON_F_STATS_VQ);
147 }
148 
149 static bool balloon_stats_enabled(const VirtIOBalloon *s)
150 {
151     return s->stats_poll_interval > 0;
152 }
153 
154 static void balloon_stats_destroy_timer(VirtIOBalloon *s)
155 {
156     if (balloon_stats_enabled(s)) {
157         timer_del(s->stats_timer);
158         timer_free(s->stats_timer);
159         s->stats_timer = NULL;
160         s->stats_poll_interval = 0;
161     }
162 }
163 
164 static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs)
165 {
166     timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000);
167 }
168 
169 static void balloon_stats_poll_cb(void *opaque)
170 {
171     VirtIOBalloon *s = opaque;
172     VirtIODevice *vdev = VIRTIO_DEVICE(s);
173 
174     if (s->stats_vq_elem == NULL || !balloon_stats_supported(s)) {
175         /* re-schedule */
176         balloon_stats_change_timer(s, s->stats_poll_interval);
177         return;
178     }
179 
180     virtqueue_push(s->svq, s->stats_vq_elem, s->stats_vq_offset);
181     virtio_notify(vdev, s->svq);
182     g_free(s->stats_vq_elem);
183     s->stats_vq_elem = NULL;
184 }
185 
186 static void balloon_stats_get_all(Object *obj, Visitor *v, const char *name,
187                                   void *opaque, Error **errp)
188 {
189     Error *err = NULL;
190     VirtIOBalloon *s = opaque;
191     int i;
192 
193     visit_start_struct(v, name, NULL, 0, &err);
194     if (err) {
195         goto out;
196     }
197     visit_type_int(v, "last-update", &s->stats_last_update, &err);
198     if (err) {
199         goto out_end;
200     }
201 
202     visit_start_struct(v, "stats", NULL, 0, &err);
203     if (err) {
204         goto out_end;
205     }
206     for (i = 0; i < VIRTIO_BALLOON_S_NR; i++) {
207         visit_type_uint64(v, balloon_stat_names[i], &s->stats[i], &err);
208         if (err) {
209             goto out_nested;
210         }
211     }
212     visit_check_struct(v, &err);
213 out_nested:
214     visit_end_struct(v, NULL);
215 
216     if (!err) {
217         visit_check_struct(v, &err);
218     }
219 out_end:
220     visit_end_struct(v, NULL);
221 out:
222     error_propagate(errp, err);
223 }
224 
225 static void balloon_stats_get_poll_interval(Object *obj, Visitor *v,
226                                             const char *name, void *opaque,
227                                             Error **errp)
228 {
229     VirtIOBalloon *s = opaque;
230     visit_type_int(v, name, &s->stats_poll_interval, errp);
231 }
232 
233 static void balloon_stats_set_poll_interval(Object *obj, Visitor *v,
234                                             const char *name, void *opaque,
235                                             Error **errp)
236 {
237     VirtIOBalloon *s = opaque;
238     Error *local_err = NULL;
239     int64_t value;
240 
241     visit_type_int(v, name, &value, &local_err);
242     if (local_err) {
243         error_propagate(errp, local_err);
244         return;
245     }
246 
247     if (value < 0) {
248         error_setg(errp, "timer value must be greater than zero");
249         return;
250     }
251 
252     if (value > UINT32_MAX) {
253         error_setg(errp, "timer value is too big");
254         return;
255     }
256 
257     if (value == s->stats_poll_interval) {
258         return;
259     }
260 
261     if (value == 0) {
262         /* timer=0 disables the timer */
263         balloon_stats_destroy_timer(s);
264         return;
265     }
266 
267     if (balloon_stats_enabled(s)) {
268         /* timer interval change */
269         s->stats_poll_interval = value;
270         balloon_stats_change_timer(s, value);
271         return;
272     }
273 
274     /* create a new timer */
275     g_assert(s->stats_timer == NULL);
276     s->stats_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, balloon_stats_poll_cb, s);
277     s->stats_poll_interval = value;
278     balloon_stats_change_timer(s, 0);
279 }
280 
281 static void virtio_balloon_handle_output(VirtIODevice *vdev, VirtQueue *vq)
282 {
283     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
284     VirtQueueElement *elem;
285     MemoryRegionSection section;
286 
287     for (;;) {
288         size_t offset = 0;
289         uint32_t pfn;
290         elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
291         if (!elem) {
292             return;
293         }
294 
295         while (iov_to_buf(elem->out_sg, elem->out_num, offset, &pfn, 4) == 4) {
296             hwaddr pa;
297             int p = virtio_ldl_p(vdev, &pfn);
298 
299             pa = (hwaddr) p << VIRTIO_BALLOON_PFN_SHIFT;
300             offset += 4;
301 
302             section = memory_region_find(get_system_memory(), pa,
303                                          BALLOON_PAGE_SIZE);
304             if (!section.mr) {
305                 trace_virtio_balloon_bad_addr(pa);
306                 continue;
307             }
308             if (!memory_region_is_ram(section.mr) ||
309                 memory_region_is_rom(section.mr) ||
310                 memory_region_is_romd(section.mr)) {
311                 trace_virtio_balloon_bad_addr(pa);
312                 memory_region_unref(section.mr);
313                 continue;
314             }
315 
316             trace_virtio_balloon_handle_output(memory_region_name(section.mr),
317                                                pa);
318             if (!qemu_balloon_is_inhibited() && vq != s->dvq) {
319                 balloon_inflate_page(s, section.mr, section.offset_within_region);
320             }
321             memory_region_unref(section.mr);
322         }
323 
324         virtqueue_push(vq, elem, offset);
325         virtio_notify(vdev, vq);
326         g_free(elem);
327     }
328 }
329 
330 static void virtio_balloon_receive_stats(VirtIODevice *vdev, VirtQueue *vq)
331 {
332     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
333     VirtQueueElement *elem;
334     VirtIOBalloonStat stat;
335     size_t offset = 0;
336     qemu_timeval tv;
337 
338     elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
339     if (!elem) {
340         goto out;
341     }
342 
343     if (s->stats_vq_elem != NULL) {
344         /* This should never happen if the driver follows the spec. */
345         virtqueue_push(vq, s->stats_vq_elem, 0);
346         virtio_notify(vdev, vq);
347         g_free(s->stats_vq_elem);
348     }
349 
350     s->stats_vq_elem = elem;
351 
352     /* Initialize the stats to get rid of any stale values.  This is only
353      * needed to handle the case where a guest supports fewer stats than it
354      * used to (ie. it has booted into an old kernel).
355      */
356     reset_stats(s);
357 
358     while (iov_to_buf(elem->out_sg, elem->out_num, offset, &stat, sizeof(stat))
359            == sizeof(stat)) {
360         uint16_t tag = virtio_tswap16(vdev, stat.tag);
361         uint64_t val = virtio_tswap64(vdev, stat.val);
362 
363         offset += sizeof(stat);
364         if (tag < VIRTIO_BALLOON_S_NR)
365             s->stats[tag] = val;
366     }
367     s->stats_vq_offset = offset;
368 
369     if (qemu_gettimeofday(&tv) < 0) {
370         warn_report("%s: failed to get time of day", __func__);
371         goto out;
372     }
373 
374     s->stats_last_update = tv.tv_sec;
375 
376 out:
377     if (balloon_stats_enabled(s)) {
378         balloon_stats_change_timer(s, s->stats_poll_interval);
379     }
380 }
381 
382 static void virtio_balloon_handle_free_page_vq(VirtIODevice *vdev,
383                                                VirtQueue *vq)
384 {
385     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
386     qemu_bh_schedule(s->free_page_bh);
387 }
388 
389 static bool get_free_page_hints(VirtIOBalloon *dev)
390 {
391     VirtQueueElement *elem;
392     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
393     VirtQueue *vq = dev->free_page_vq;
394     bool ret = true;
395 
396     while (dev->block_iothread) {
397         qemu_cond_wait(&dev->free_page_cond, &dev->free_page_lock);
398     }
399 
400     elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
401     if (!elem) {
402         return false;
403     }
404 
405     if (elem->out_num) {
406         uint32_t id;
407         size_t size = iov_to_buf(elem->out_sg, elem->out_num, 0,
408                                  &id, sizeof(id));
409 
410         virtio_tswap32s(vdev, &id);
411         if (unlikely(size != sizeof(id))) {
412             virtio_error(vdev, "received an incorrect cmd id");
413             ret = false;
414             goto out;
415         }
416         if (id == dev->free_page_report_cmd_id) {
417             dev->free_page_report_status = FREE_PAGE_REPORT_S_START;
418         } else {
419             /*
420              * Stop the optimization only when it has started. This
421              * avoids a stale stop sign for the previous command.
422              */
423             if (dev->free_page_report_status == FREE_PAGE_REPORT_S_START) {
424                 dev->free_page_report_status = FREE_PAGE_REPORT_S_STOP;
425             }
426         }
427     }
428 
429     if (elem->in_num) {
430         if (dev->free_page_report_status == FREE_PAGE_REPORT_S_START) {
431             qemu_guest_free_page_hint(elem->in_sg[0].iov_base,
432                                       elem->in_sg[0].iov_len);
433         }
434     }
435 
436 out:
437     virtqueue_push(vq, elem, 1);
438     g_free(elem);
439     return ret;
440 }
441 
442 static void virtio_ballloon_get_free_page_hints(void *opaque)
443 {
444     VirtIOBalloon *dev = opaque;
445     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
446     VirtQueue *vq = dev->free_page_vq;
447     bool continue_to_get_hints;
448 
449     do {
450         qemu_mutex_lock(&dev->free_page_lock);
451         virtio_queue_set_notification(vq, 0);
452         continue_to_get_hints = get_free_page_hints(dev);
453         qemu_mutex_unlock(&dev->free_page_lock);
454         virtio_notify(vdev, vq);
455       /*
456        * Start to poll the vq once the reporting started. Otherwise, continue
457        * only when there are entries on the vq, which need to be given back.
458        */
459     } while (continue_to_get_hints ||
460              dev->free_page_report_status == FREE_PAGE_REPORT_S_START);
461     virtio_queue_set_notification(vq, 1);
462 }
463 
464 static bool virtio_balloon_free_page_support(void *opaque)
465 {
466     VirtIOBalloon *s = opaque;
467     VirtIODevice *vdev = VIRTIO_DEVICE(s);
468 
469     return virtio_vdev_has_feature(vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT);
470 }
471 
472 static void virtio_balloon_free_page_start(VirtIOBalloon *s)
473 {
474     VirtIODevice *vdev = VIRTIO_DEVICE(s);
475 
476     /* For the stop and copy phase, we don't need to start the optimization */
477     if (!vdev->vm_running) {
478         return;
479     }
480 
481     if (s->free_page_report_cmd_id == UINT_MAX) {
482         s->free_page_report_cmd_id =
483                        VIRTIO_BALLOON_FREE_PAGE_REPORT_CMD_ID_MIN;
484     } else {
485         s->free_page_report_cmd_id++;
486     }
487 
488     s->free_page_report_status = FREE_PAGE_REPORT_S_REQUESTED;
489     virtio_notify_config(vdev);
490 }
491 
492 static void virtio_balloon_free_page_stop(VirtIOBalloon *s)
493 {
494     VirtIODevice *vdev = VIRTIO_DEVICE(s);
495 
496     if (s->free_page_report_status != FREE_PAGE_REPORT_S_STOP) {
497         /*
498          * The lock also guarantees us that the
499          * virtio_ballloon_get_free_page_hints exits after the
500          * free_page_report_status is set to S_STOP.
501          */
502         qemu_mutex_lock(&s->free_page_lock);
503         /*
504          * The guest hasn't done the reporting, so host sends a notification
505          * to the guest to actively stop the reporting.
506          */
507         s->free_page_report_status = FREE_PAGE_REPORT_S_STOP;
508         qemu_mutex_unlock(&s->free_page_lock);
509         virtio_notify_config(vdev);
510     }
511 }
512 
513 static void virtio_balloon_free_page_done(VirtIOBalloon *s)
514 {
515     VirtIODevice *vdev = VIRTIO_DEVICE(s);
516 
517     s->free_page_report_status = FREE_PAGE_REPORT_S_DONE;
518     virtio_notify_config(vdev);
519 }
520 
521 static int
522 virtio_balloon_free_page_report_notify(NotifierWithReturn *n, void *data)
523 {
524     VirtIOBalloon *dev = container_of(n, VirtIOBalloon,
525                                       free_page_report_notify);
526     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
527     PrecopyNotifyData *pnd = data;
528 
529     if (!virtio_balloon_free_page_support(dev)) {
530         /*
531          * This is an optimization provided to migration, so just return 0 to
532          * have the normal migration process not affected when this feature is
533          * not supported.
534          */
535         return 0;
536     }
537 
538     switch (pnd->reason) {
539     case PRECOPY_NOTIFY_SETUP:
540         precopy_enable_free_page_optimization();
541         break;
542     case PRECOPY_NOTIFY_COMPLETE:
543     case PRECOPY_NOTIFY_CLEANUP:
544     case PRECOPY_NOTIFY_BEFORE_BITMAP_SYNC:
545         virtio_balloon_free_page_stop(dev);
546         break;
547     case PRECOPY_NOTIFY_AFTER_BITMAP_SYNC:
548         if (vdev->vm_running) {
549             virtio_balloon_free_page_start(dev);
550         } else {
551             virtio_balloon_free_page_done(dev);
552         }
553         break;
554     default:
555         virtio_error(vdev, "%s: %d reason unknown", __func__, pnd->reason);
556     }
557 
558     return 0;
559 }
560 
561 static void virtio_balloon_get_config(VirtIODevice *vdev, uint8_t *config_data)
562 {
563     VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
564     struct virtio_balloon_config config = {};
565 
566     config.num_pages = cpu_to_le32(dev->num_pages);
567     config.actual = cpu_to_le32(dev->actual);
568 
569     if (dev->free_page_report_status == FREE_PAGE_REPORT_S_REQUESTED) {
570         config.free_page_report_cmd_id =
571                        cpu_to_le32(dev->free_page_report_cmd_id);
572     } else if (dev->free_page_report_status == FREE_PAGE_REPORT_S_STOP) {
573         config.free_page_report_cmd_id =
574                        cpu_to_le32(VIRTIO_BALLOON_CMD_ID_STOP);
575     } else if (dev->free_page_report_status == FREE_PAGE_REPORT_S_DONE) {
576         config.free_page_report_cmd_id =
577                        cpu_to_le32(VIRTIO_BALLOON_CMD_ID_DONE);
578     }
579 
580     trace_virtio_balloon_get_config(config.num_pages, config.actual);
581     memcpy(config_data, &config, sizeof(struct virtio_balloon_config));
582 }
583 
584 static int build_dimm_list(Object *obj, void *opaque)
585 {
586     GSList **list = opaque;
587 
588     if (object_dynamic_cast(obj, TYPE_PC_DIMM)) {
589         DeviceState *dev = DEVICE(obj);
590         if (dev->realized) { /* only realized DIMMs matter */
591             *list = g_slist_prepend(*list, dev);
592         }
593     }
594 
595     object_child_foreach(obj, build_dimm_list, opaque);
596     return 0;
597 }
598 
599 static ram_addr_t get_current_ram_size(void)
600 {
601     GSList *list = NULL, *item;
602     ram_addr_t size = ram_size;
603 
604     build_dimm_list(qdev_get_machine(), &list);
605     for (item = list; item; item = g_slist_next(item)) {
606         Object *obj = OBJECT(item->data);
607         if (!strcmp(object_get_typename(obj), TYPE_PC_DIMM)) {
608             size += object_property_get_int(obj, PC_DIMM_SIZE_PROP,
609                                             &error_abort);
610         }
611     }
612     g_slist_free(list);
613 
614     return size;
615 }
616 
617 static void virtio_balloon_set_config(VirtIODevice *vdev,
618                                       const uint8_t *config_data)
619 {
620     VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
621     struct virtio_balloon_config config;
622     uint32_t oldactual = dev->actual;
623     ram_addr_t vm_ram_size = get_current_ram_size();
624 
625     memcpy(&config, config_data, sizeof(struct virtio_balloon_config));
626     dev->actual = le32_to_cpu(config.actual);
627     if (dev->actual != oldactual) {
628         qapi_event_send_balloon_change(vm_ram_size -
629                         ((ram_addr_t) dev->actual << VIRTIO_BALLOON_PFN_SHIFT));
630     }
631     trace_virtio_balloon_set_config(dev->actual, oldactual);
632 }
633 
634 static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
635                                             Error **errp)
636 {
637     VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
638     f |= dev->host_features;
639     virtio_add_feature(&f, VIRTIO_BALLOON_F_STATS_VQ);
640 
641     return f;
642 }
643 
644 static void virtio_balloon_stat(void *opaque, BalloonInfo *info)
645 {
646     VirtIOBalloon *dev = opaque;
647     info->actual = get_current_ram_size() - ((uint64_t) dev->actual <<
648                                              VIRTIO_BALLOON_PFN_SHIFT);
649 }
650 
651 static void virtio_balloon_to_target(void *opaque, ram_addr_t target)
652 {
653     VirtIOBalloon *dev = VIRTIO_BALLOON(opaque);
654     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
655     ram_addr_t vm_ram_size = get_current_ram_size();
656 
657     if (target > vm_ram_size) {
658         target = vm_ram_size;
659     }
660     if (target) {
661         dev->num_pages = (vm_ram_size - target) >> VIRTIO_BALLOON_PFN_SHIFT;
662         virtio_notify_config(vdev);
663     }
664     trace_virtio_balloon_to_target(target, dev->num_pages);
665 }
666 
667 static int virtio_balloon_post_load_device(void *opaque, int version_id)
668 {
669     VirtIOBalloon *s = VIRTIO_BALLOON(opaque);
670 
671     if (balloon_stats_enabled(s)) {
672         balloon_stats_change_timer(s, s->stats_poll_interval);
673     }
674     return 0;
675 }
676 
677 static const VMStateDescription vmstate_virtio_balloon_free_page_report = {
678     .name = "virtio-balloon-device/free-page-report",
679     .version_id = 1,
680     .minimum_version_id = 1,
681     .needed = virtio_balloon_free_page_support,
682     .fields = (VMStateField[]) {
683         VMSTATE_UINT32(free_page_report_cmd_id, VirtIOBalloon),
684         VMSTATE_UINT32(free_page_report_status, VirtIOBalloon),
685         VMSTATE_END_OF_LIST()
686     }
687 };
688 
689 static const VMStateDescription vmstate_virtio_balloon_device = {
690     .name = "virtio-balloon-device",
691     .version_id = 1,
692     .minimum_version_id = 1,
693     .post_load = virtio_balloon_post_load_device,
694     .fields = (VMStateField[]) {
695         VMSTATE_UINT32(num_pages, VirtIOBalloon),
696         VMSTATE_UINT32(actual, VirtIOBalloon),
697         VMSTATE_END_OF_LIST()
698     },
699     .subsections = (const VMStateDescription * []) {
700         &vmstate_virtio_balloon_free_page_report,
701         NULL
702     }
703 };
704 
705 static void virtio_balloon_device_realize(DeviceState *dev, Error **errp)
706 {
707     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
708     VirtIOBalloon *s = VIRTIO_BALLOON(dev);
709     int ret;
710 
711     virtio_init(vdev, "virtio-balloon", VIRTIO_ID_BALLOON,
712                 sizeof(struct virtio_balloon_config));
713 
714     ret = qemu_add_balloon_handler(virtio_balloon_to_target,
715                                    virtio_balloon_stat, s);
716 
717     if (ret < 0) {
718         error_setg(errp, "Only one balloon device is supported");
719         virtio_cleanup(vdev);
720         return;
721     }
722 
723     s->ivq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output);
724     s->dvq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output);
725     s->svq = virtio_add_queue(vdev, 128, virtio_balloon_receive_stats);
726 
727     if (virtio_has_feature(s->host_features,
728                            VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
729         s->free_page_vq = virtio_add_queue(vdev, VIRTQUEUE_MAX_SIZE,
730                                            virtio_balloon_handle_free_page_vq);
731         s->free_page_report_status = FREE_PAGE_REPORT_S_STOP;
732         s->free_page_report_cmd_id =
733                            VIRTIO_BALLOON_FREE_PAGE_REPORT_CMD_ID_MIN;
734         s->free_page_report_notify.notify =
735                                        virtio_balloon_free_page_report_notify;
736         precopy_add_notifier(&s->free_page_report_notify);
737         if (s->iothread) {
738             object_ref(OBJECT(s->iothread));
739             s->free_page_bh = aio_bh_new(iothread_get_aio_context(s->iothread),
740                                        virtio_ballloon_get_free_page_hints, s);
741             qemu_mutex_init(&s->free_page_lock);
742             qemu_cond_init(&s->free_page_cond);
743             s->block_iothread = false;
744         } else {
745             /* Simply disable this feature if the iothread wasn't created. */
746             s->host_features &= ~(1 << VIRTIO_BALLOON_F_FREE_PAGE_HINT);
747             virtio_error(vdev, "iothread is missing");
748         }
749     }
750     reset_stats(s);
751 }
752 
753 static void virtio_balloon_device_unrealize(DeviceState *dev, Error **errp)
754 {
755     VirtIODevice *vdev = VIRTIO_DEVICE(dev);
756     VirtIOBalloon *s = VIRTIO_BALLOON(dev);
757 
758     if (virtio_balloon_free_page_support(s)) {
759         qemu_bh_delete(s->free_page_bh);
760         virtio_balloon_free_page_stop(s);
761         precopy_remove_notifier(&s->free_page_report_notify);
762     }
763     balloon_stats_destroy_timer(s);
764     qemu_remove_balloon_handler(s);
765     virtio_cleanup(vdev);
766 }
767 
768 static void virtio_balloon_device_reset(VirtIODevice *vdev)
769 {
770     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
771 
772     if (virtio_balloon_free_page_support(s)) {
773         virtio_balloon_free_page_stop(s);
774     }
775 
776     if (s->stats_vq_elem != NULL) {
777         virtqueue_unpop(s->svq, s->stats_vq_elem, 0);
778         g_free(s->stats_vq_elem);
779         s->stats_vq_elem = NULL;
780     }
781 }
782 
783 static void virtio_balloon_set_status(VirtIODevice *vdev, uint8_t status)
784 {
785     VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
786 
787     if (!s->stats_vq_elem && vdev->vm_running &&
788         (status & VIRTIO_CONFIG_S_DRIVER_OK) && virtqueue_rewind(s->svq, 1)) {
789         /* poll stats queue for the element we have discarded when the VM
790          * was stopped */
791         virtio_balloon_receive_stats(vdev, s->svq);
792     }
793 
794     if (virtio_balloon_free_page_support(s)) {
795         /*
796          * The VM is woken up and the iothread was blocked, so signal it to
797          * continue.
798          */
799         if (vdev->vm_running && s->block_iothread) {
800             qemu_mutex_lock(&s->free_page_lock);
801             s->block_iothread = false;
802             qemu_cond_signal(&s->free_page_cond);
803             qemu_mutex_unlock(&s->free_page_lock);
804         }
805 
806         /* The VM is stopped, block the iothread. */
807         if (!vdev->vm_running) {
808             qemu_mutex_lock(&s->free_page_lock);
809             s->block_iothread = true;
810             qemu_mutex_unlock(&s->free_page_lock);
811         }
812     }
813 }
814 
815 static void virtio_balloon_instance_init(Object *obj)
816 {
817     VirtIOBalloon *s = VIRTIO_BALLOON(obj);
818 
819     object_property_add(obj, "guest-stats", "guest statistics",
820                         balloon_stats_get_all, NULL, NULL, s, NULL);
821 
822     object_property_add(obj, "guest-stats-polling-interval", "int",
823                         balloon_stats_get_poll_interval,
824                         balloon_stats_set_poll_interval,
825                         NULL, s, NULL);
826 }
827 
828 static const VMStateDescription vmstate_virtio_balloon = {
829     .name = "virtio-balloon",
830     .minimum_version_id = 1,
831     .version_id = 1,
832     .fields = (VMStateField[]) {
833         VMSTATE_VIRTIO_DEVICE,
834         VMSTATE_END_OF_LIST()
835     },
836 };
837 
838 static Property virtio_balloon_properties[] = {
839     DEFINE_PROP_BIT("deflate-on-oom", VirtIOBalloon, host_features,
840                     VIRTIO_BALLOON_F_DEFLATE_ON_OOM, false),
841     DEFINE_PROP_BIT("free-page-hint", VirtIOBalloon, host_features,
842                     VIRTIO_BALLOON_F_FREE_PAGE_HINT, false),
843     DEFINE_PROP_LINK("iothread", VirtIOBalloon, iothread, TYPE_IOTHREAD,
844                      IOThread *),
845     DEFINE_PROP_END_OF_LIST(),
846 };
847 
848 static void virtio_balloon_class_init(ObjectClass *klass, void *data)
849 {
850     DeviceClass *dc = DEVICE_CLASS(klass);
851     VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
852 
853     dc->props = virtio_balloon_properties;
854     dc->vmsd = &vmstate_virtio_balloon;
855     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
856     vdc->realize = virtio_balloon_device_realize;
857     vdc->unrealize = virtio_balloon_device_unrealize;
858     vdc->reset = virtio_balloon_device_reset;
859     vdc->get_config = virtio_balloon_get_config;
860     vdc->set_config = virtio_balloon_set_config;
861     vdc->get_features = virtio_balloon_get_features;
862     vdc->set_status = virtio_balloon_set_status;
863     vdc->vmsd = &vmstate_virtio_balloon_device;
864 }
865 
866 static const TypeInfo virtio_balloon_info = {
867     .name = TYPE_VIRTIO_BALLOON,
868     .parent = TYPE_VIRTIO_DEVICE,
869     .instance_size = sizeof(VirtIOBalloon),
870     .instance_init = virtio_balloon_instance_init,
871     .class_init = virtio_balloon_class_init,
872 };
873 
874 static void virtio_register_types(void)
875 {
876     type_register_static(&virtio_balloon_info);
877 }
878 
879 type_init(virtio_register_types)
880