1 /*
2 * Virtio Balloon Device
3 *
4 * Copyright IBM, Corp. 2008
5 * Copyright (C) 2011 Red Hat, Inc.
6 * Copyright (C) 2011 Amit Shah <amit.shah@redhat.com>
7 *
8 * Authors:
9 * Anthony Liguori <aliguori@us.ibm.com>
10 *
11 * This work is licensed under the terms of the GNU GPL, version 2. See
12 * the COPYING file in the top-level directory.
13 *
14 */
15
16 #include "qemu/osdep.h"
17 #include "qemu/iov.h"
18 #include "qemu/module.h"
19 #include "qemu/timer.h"
20 #include "hw/virtio/virtio.h"
21 #include "hw/mem/pc-dimm.h"
22 #include "hw/qdev-properties.h"
23 #include "hw/boards.h"
24 #include "sysemu/balloon.h"
25 #include "hw/virtio/virtio-balloon.h"
26 #include "exec/address-spaces.h"
27 #include "qapi/error.h"
28 #include "qapi/qapi-events-machine.h"
29 #include "qapi/visitor.h"
30 #include "trace.h"
31 #include "qemu/error-report.h"
32 #include "migration/misc.h"
33 #include "migration/migration.h"
34
35 #include "hw/virtio/virtio-bus.h"
36 #include "hw/virtio/virtio-access.h"
37
38 #define BALLOON_PAGE_SIZE (1 << VIRTIO_BALLOON_PFN_SHIFT)
39
40 typedef struct PartiallyBalloonedPage {
41 ram_addr_t base_gpa;
42 unsigned long *bitmap;
43 } PartiallyBalloonedPage;
44
virtio_balloon_pbp_free(PartiallyBalloonedPage * pbp)45 static void virtio_balloon_pbp_free(PartiallyBalloonedPage *pbp)
46 {
47 if (!pbp->bitmap) {
48 return;
49 }
50 g_free(pbp->bitmap);
51 pbp->bitmap = NULL;
52 }
53
virtio_balloon_pbp_alloc(PartiallyBalloonedPage * pbp,ram_addr_t base_gpa,long subpages)54 static void virtio_balloon_pbp_alloc(PartiallyBalloonedPage *pbp,
55 ram_addr_t base_gpa,
56 long subpages)
57 {
58 pbp->base_gpa = base_gpa;
59 pbp->bitmap = bitmap_new(subpages);
60 }
61
virtio_balloon_pbp_matches(PartiallyBalloonedPage * pbp,ram_addr_t base_gpa)62 static bool virtio_balloon_pbp_matches(PartiallyBalloonedPage *pbp,
63 ram_addr_t base_gpa)
64 {
65 return pbp->base_gpa == base_gpa;
66 }
67
virtio_balloon_inhibited(void)68 static bool virtio_balloon_inhibited(void)
69 {
70 /*
71 * Postcopy cannot deal with concurrent discards,
72 * so it's special, as well as background snapshots.
73 */
74 return ram_block_discard_is_disabled() || migration_in_incoming_postcopy() ||
75 migration_in_bg_snapshot();
76 }
77
balloon_inflate_page(VirtIOBalloon * balloon,MemoryRegion * mr,hwaddr mr_offset,PartiallyBalloonedPage * pbp)78 static void balloon_inflate_page(VirtIOBalloon *balloon,
79 MemoryRegion *mr, hwaddr mr_offset,
80 PartiallyBalloonedPage *pbp)
81 {
82 void *addr = memory_region_get_ram_ptr(mr) + mr_offset;
83 ram_addr_t rb_offset, rb_aligned_offset, base_gpa;
84 RAMBlock *rb;
85 size_t rb_page_size;
86 int subpages;
87
88 /* XXX is there a better way to get to the RAMBlock than via a
89 * host address? */
90 rb = qemu_ram_block_from_host(addr, false, &rb_offset);
91 rb_page_size = qemu_ram_pagesize(rb);
92
93 if (rb_page_size == BALLOON_PAGE_SIZE) {
94 /* Easy case */
95
96 ram_block_discard_range(rb, rb_offset, rb_page_size);
97 /* We ignore errors from ram_block_discard_range(), because it
98 * has already reported them, and failing to discard a balloon
99 * page is not fatal */
100 return;
101 }
102
103 /* Hard case
104 *
105 * We've put a piece of a larger host page into the balloon - we
106 * need to keep track until we have a whole host page to
107 * discard
108 */
109 warn_report_once(
110 "Balloon used with backing page size > 4kiB, this may not be reliable");
111
112 rb_aligned_offset = QEMU_ALIGN_DOWN(rb_offset, rb_page_size);
113 subpages = rb_page_size / BALLOON_PAGE_SIZE;
114 base_gpa = memory_region_get_ram_addr(mr) + mr_offset -
115 (rb_offset - rb_aligned_offset);
116
117 if (pbp->bitmap && !virtio_balloon_pbp_matches(pbp, base_gpa)) {
118 /* We've partially ballooned part of a host page, but now
119 * we're trying to balloon part of a different one. Too hard,
120 * give up on the old partial page */
121 virtio_balloon_pbp_free(pbp);
122 }
123
124 if (!pbp->bitmap) {
125 virtio_balloon_pbp_alloc(pbp, base_gpa, subpages);
126 }
127
128 set_bit((rb_offset - rb_aligned_offset) / BALLOON_PAGE_SIZE,
129 pbp->bitmap);
130
131 if (bitmap_full(pbp->bitmap, subpages)) {
132 /* We've accumulated a full host page, we can actually discard
133 * it now */
134
135 ram_block_discard_range(rb, rb_aligned_offset, rb_page_size);
136 /* We ignore errors from ram_block_discard_range(), because it
137 * has already reported them, and failing to discard a balloon
138 * page is not fatal */
139 virtio_balloon_pbp_free(pbp);
140 }
141 }
142
balloon_deflate_page(VirtIOBalloon * balloon,MemoryRegion * mr,hwaddr mr_offset)143 static void balloon_deflate_page(VirtIOBalloon *balloon,
144 MemoryRegion *mr, hwaddr mr_offset)
145 {
146 void *addr = memory_region_get_ram_ptr(mr) + mr_offset;
147 ram_addr_t rb_offset;
148 RAMBlock *rb;
149 size_t rb_page_size;
150 void *host_addr;
151 int ret;
152
153 /* XXX is there a better way to get to the RAMBlock than via a
154 * host address? */
155 rb = qemu_ram_block_from_host(addr, false, &rb_offset);
156 rb_page_size = qemu_ram_pagesize(rb);
157
158 host_addr = (void *)((uintptr_t)addr & ~(rb_page_size - 1));
159
160 /* When a page is deflated, we hint the whole host page it lives
161 * on, since we can't do anything smaller */
162 ret = qemu_madvise(host_addr, rb_page_size, QEMU_MADV_WILLNEED);
163 if (ret != 0) {
164 warn_report("Couldn't MADV_WILLNEED on balloon deflate: %s",
165 strerror(errno));
166 /* Otherwise ignore, failing to page hint shouldn't be fatal */
167 }
168 }
169
170 static const char *balloon_stat_names[] = {
171 [VIRTIO_BALLOON_S_SWAP_IN] = "stat-swap-in",
172 [VIRTIO_BALLOON_S_SWAP_OUT] = "stat-swap-out",
173 [VIRTIO_BALLOON_S_MAJFLT] = "stat-major-faults",
174 [VIRTIO_BALLOON_S_MINFLT] = "stat-minor-faults",
175 [VIRTIO_BALLOON_S_MEMFREE] = "stat-free-memory",
176 [VIRTIO_BALLOON_S_MEMTOT] = "stat-total-memory",
177 [VIRTIO_BALLOON_S_AVAIL] = "stat-available-memory",
178 [VIRTIO_BALLOON_S_CACHES] = "stat-disk-caches",
179 [VIRTIO_BALLOON_S_HTLB_PGALLOC] = "stat-htlb-pgalloc",
180 [VIRTIO_BALLOON_S_HTLB_PGFAIL] = "stat-htlb-pgfail",
181 [VIRTIO_BALLOON_S_NR] = NULL
182 };
183
184 /*
185 * reset_stats - Mark all items in the stats array as unset
186 *
187 * This function needs to be called at device initialization and before
188 * updating to a set of newly-generated stats. This will ensure that no
189 * stale values stick around in case the guest reports a subset of the supported
190 * statistics.
191 */
reset_stats(VirtIOBalloon * dev)192 static inline void reset_stats(VirtIOBalloon *dev)
193 {
194 int i;
195 for (i = 0; i < VIRTIO_BALLOON_S_NR; dev->stats[i++] = -1);
196 }
197
balloon_stats_supported(const VirtIOBalloon * s)198 static bool balloon_stats_supported(const VirtIOBalloon *s)
199 {
200 VirtIODevice *vdev = VIRTIO_DEVICE(s);
201 return virtio_vdev_has_feature(vdev, VIRTIO_BALLOON_F_STATS_VQ);
202 }
203
balloon_stats_enabled(const VirtIOBalloon * s)204 static bool balloon_stats_enabled(const VirtIOBalloon *s)
205 {
206 return s->stats_poll_interval > 0;
207 }
208
balloon_stats_destroy_timer(VirtIOBalloon * s)209 static void balloon_stats_destroy_timer(VirtIOBalloon *s)
210 {
211 if (balloon_stats_enabled(s)) {
212 timer_free(s->stats_timer);
213 s->stats_timer = NULL;
214 s->stats_poll_interval = 0;
215 }
216 }
217
balloon_stats_change_timer(VirtIOBalloon * s,int64_t secs)218 static void balloon_stats_change_timer(VirtIOBalloon *s, int64_t secs)
219 {
220 timer_mod(s->stats_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + secs * 1000);
221 }
222
balloon_stats_poll_cb(void * opaque)223 static void balloon_stats_poll_cb(void *opaque)
224 {
225 VirtIOBalloon *s = opaque;
226 VirtIODevice *vdev = VIRTIO_DEVICE(s);
227
228 if (s->stats_vq_elem == NULL || !balloon_stats_supported(s)) {
229 /* re-schedule */
230 balloon_stats_change_timer(s, s->stats_poll_interval);
231 return;
232 }
233
234 virtqueue_push(s->svq, s->stats_vq_elem, s->stats_vq_offset);
235 virtio_notify(vdev, s->svq);
236 g_free(s->stats_vq_elem);
237 s->stats_vq_elem = NULL;
238 }
239
balloon_stats_get_all(Object * obj,Visitor * v,const char * name,void * opaque,Error ** errp)240 static void balloon_stats_get_all(Object *obj, Visitor *v, const char *name,
241 void *opaque, Error **errp)
242 {
243 Error *err = NULL;
244 VirtIOBalloon *s = opaque;
245 int i;
246
247 if (!visit_start_struct(v, name, NULL, 0, &err)) {
248 goto out;
249 }
250 if (!visit_type_int(v, "last-update", &s->stats_last_update, &err)) {
251 goto out_end;
252 }
253
254 if (!visit_start_struct(v, "stats", NULL, 0, &err)) {
255 goto out_end;
256 }
257 for (i = 0; i < VIRTIO_BALLOON_S_NR; i++) {
258 if (!visit_type_uint64(v, balloon_stat_names[i], &s->stats[i], &err)) {
259 goto out_nested;
260 }
261 }
262 visit_check_struct(v, &err);
263 out_nested:
264 visit_end_struct(v, NULL);
265
266 if (!err) {
267 visit_check_struct(v, &err);
268 }
269 out_end:
270 visit_end_struct(v, NULL);
271 out:
272 error_propagate(errp, err);
273 }
274
balloon_stats_get_poll_interval(Object * obj,Visitor * v,const char * name,void * opaque,Error ** errp)275 static void balloon_stats_get_poll_interval(Object *obj, Visitor *v,
276 const char *name, void *opaque,
277 Error **errp)
278 {
279 VirtIOBalloon *s = opaque;
280 visit_type_int(v, name, &s->stats_poll_interval, errp);
281 }
282
balloon_stats_set_poll_interval(Object * obj,Visitor * v,const char * name,void * opaque,Error ** errp)283 static void balloon_stats_set_poll_interval(Object *obj, Visitor *v,
284 const char *name, void *opaque,
285 Error **errp)
286 {
287 VirtIOBalloon *s = opaque;
288 int64_t value;
289
290 if (!visit_type_int(v, name, &value, errp)) {
291 return;
292 }
293
294 if (value < 0) {
295 error_setg(errp, "timer value must be greater than zero");
296 return;
297 }
298
299 if (value > UINT32_MAX) {
300 error_setg(errp, "timer value is too big");
301 return;
302 }
303
304 if (value == s->stats_poll_interval) {
305 return;
306 }
307
308 if (value == 0) {
309 /* timer=0 disables the timer */
310 balloon_stats_destroy_timer(s);
311 return;
312 }
313
314 if (balloon_stats_enabled(s)) {
315 /* timer interval change */
316 s->stats_poll_interval = value;
317 balloon_stats_change_timer(s, value);
318 return;
319 }
320
321 /* create a new timer */
322 g_assert(s->stats_timer == NULL);
323 s->stats_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, balloon_stats_poll_cb, s);
324 s->stats_poll_interval = value;
325 balloon_stats_change_timer(s, 0);
326 }
327
virtio_balloon_handle_report(VirtIODevice * vdev,VirtQueue * vq)328 static void virtio_balloon_handle_report(VirtIODevice *vdev, VirtQueue *vq)
329 {
330 VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
331 VirtQueueElement *elem;
332
333 while ((elem = virtqueue_pop(vq, sizeof(VirtQueueElement)))) {
334 unsigned int i;
335
336 /*
337 * When we discard the page it has the effect of removing the page
338 * from the hypervisor itself and causing it to be zeroed when it
339 * is returned to us. So we must not discard the page if it is
340 * accessible by another device or process, or if the guest is
341 * expecting it to retain a non-zero value.
342 */
343 if (virtio_balloon_inhibited() || dev->poison_val) {
344 goto skip_element;
345 }
346
347 for (i = 0; i < elem->in_num; i++) {
348 void *addr = elem->in_sg[i].iov_base;
349 size_t size = elem->in_sg[i].iov_len;
350 ram_addr_t ram_offset;
351 RAMBlock *rb;
352
353 /*
354 * There is no need to check the memory section to see if
355 * it is ram/readonly/romd like there is for handle_output
356 * below. If the region is not meant to be written to then
357 * address_space_map will have allocated a bounce buffer
358 * and it will be freed in address_space_unmap and trigger
359 * and unassigned_mem_write before failing to copy over the
360 * buffer. If more than one bad descriptor is provided it
361 * will return NULL after the first bounce buffer and fail
362 * to map any resources.
363 */
364 rb = qemu_ram_block_from_host(addr, false, &ram_offset);
365 if (!rb) {
366 trace_virtio_balloon_bad_addr(elem->in_addr[i]);
367 continue;
368 }
369
370 /*
371 * For now we will simply ignore unaligned memory regions, or
372 * regions that overrun the end of the RAMBlock.
373 */
374 if (!QEMU_IS_ALIGNED(ram_offset | size, qemu_ram_pagesize(rb)) ||
375 (ram_offset + size) > qemu_ram_get_used_length(rb)) {
376 continue;
377 }
378
379 ram_block_discard_range(rb, ram_offset, size);
380 }
381
382 skip_element:
383 virtqueue_push(vq, elem, 0);
384 virtio_notify(vdev, vq);
385 g_free(elem);
386 }
387 }
388
virtio_balloon_handle_output(VirtIODevice * vdev,VirtQueue * vq)389 static void virtio_balloon_handle_output(VirtIODevice *vdev, VirtQueue *vq)
390 {
391 VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
392 VirtQueueElement *elem;
393 MemoryRegionSection section;
394
395 for (;;) {
396 PartiallyBalloonedPage pbp = {};
397 size_t offset = 0;
398 uint32_t pfn;
399
400 elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
401 if (!elem) {
402 break;
403 }
404
405 while (iov_to_buf(elem->out_sg, elem->out_num, offset, &pfn, 4) == 4) {
406 unsigned int p = virtio_ldl_p(vdev, &pfn);
407 hwaddr pa;
408
409 pa = (hwaddr) p << VIRTIO_BALLOON_PFN_SHIFT;
410 offset += 4;
411
412 section = memory_region_find(get_system_memory(), pa,
413 BALLOON_PAGE_SIZE);
414 if (!section.mr) {
415 trace_virtio_balloon_bad_addr(pa);
416 continue;
417 }
418 if (!memory_region_is_ram(section.mr) ||
419 memory_region_is_rom(section.mr) ||
420 memory_region_is_romd(section.mr)) {
421 trace_virtio_balloon_bad_addr(pa);
422 memory_region_unref(section.mr);
423 continue;
424 }
425
426 trace_virtio_balloon_handle_output(memory_region_name(section.mr),
427 pa);
428 if (!virtio_balloon_inhibited()) {
429 if (vq == s->ivq) {
430 balloon_inflate_page(s, section.mr,
431 section.offset_within_region, &pbp);
432 } else if (vq == s->dvq) {
433 balloon_deflate_page(s, section.mr, section.offset_within_region);
434 } else {
435 g_assert_not_reached();
436 }
437 }
438 memory_region_unref(section.mr);
439 }
440
441 virtqueue_push(vq, elem, offset);
442 virtio_notify(vdev, vq);
443 g_free(elem);
444 virtio_balloon_pbp_free(&pbp);
445 }
446 }
447
virtio_balloon_receive_stats(VirtIODevice * vdev,VirtQueue * vq)448 static void virtio_balloon_receive_stats(VirtIODevice *vdev, VirtQueue *vq)
449 {
450 VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
451 VirtQueueElement *elem;
452 VirtIOBalloonStat stat;
453 size_t offset = 0;
454 qemu_timeval tv;
455
456 elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
457 if (!elem) {
458 goto out;
459 }
460
461 if (s->stats_vq_elem != NULL) {
462 /* This should never happen if the driver follows the spec. */
463 virtqueue_push(vq, s->stats_vq_elem, 0);
464 virtio_notify(vdev, vq);
465 g_free(s->stats_vq_elem);
466 }
467
468 s->stats_vq_elem = elem;
469
470 /* Initialize the stats to get rid of any stale values. This is only
471 * needed to handle the case where a guest supports fewer stats than it
472 * used to (ie. it has booted into an old kernel).
473 */
474 reset_stats(s);
475
476 while (iov_to_buf(elem->out_sg, elem->out_num, offset, &stat, sizeof(stat))
477 == sizeof(stat)) {
478 uint16_t tag = virtio_tswap16(vdev, stat.tag);
479 uint64_t val = virtio_tswap64(vdev, stat.val);
480
481 offset += sizeof(stat);
482 if (tag < VIRTIO_BALLOON_S_NR)
483 s->stats[tag] = val;
484 }
485 s->stats_vq_offset = offset;
486
487 if (qemu_gettimeofday(&tv) < 0) {
488 warn_report("%s: failed to get time of day", __func__);
489 goto out;
490 }
491
492 s->stats_last_update = tv.tv_sec;
493
494 out:
495 if (balloon_stats_enabled(s)) {
496 balloon_stats_change_timer(s, s->stats_poll_interval);
497 }
498 }
499
virtio_balloon_handle_free_page_vq(VirtIODevice * vdev,VirtQueue * vq)500 static void virtio_balloon_handle_free_page_vq(VirtIODevice *vdev,
501 VirtQueue *vq)
502 {
503 VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
504 qemu_bh_schedule(s->free_page_bh);
505 }
506
get_free_page_hints(VirtIOBalloon * dev)507 static bool get_free_page_hints(VirtIOBalloon *dev)
508 {
509 VirtQueueElement *elem;
510 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
511 VirtQueue *vq = dev->free_page_vq;
512 bool ret = true;
513
514 while (dev->block_iothread) {
515 qemu_cond_wait(&dev->free_page_cond, &dev->free_page_lock);
516 }
517
518 elem = virtqueue_pop(vq, sizeof(VirtQueueElement));
519 if (!elem) {
520 return false;
521 }
522
523 if (elem->out_num) {
524 uint32_t id;
525 size_t size = iov_to_buf(elem->out_sg, elem->out_num, 0,
526 &id, sizeof(id));
527
528 virtio_tswap32s(vdev, &id);
529 if (unlikely(size != sizeof(id))) {
530 virtio_error(vdev, "received an incorrect cmd id");
531 ret = false;
532 goto out;
533 }
534 if (dev->free_page_hint_status == FREE_PAGE_HINT_S_REQUESTED &&
535 id == dev->free_page_hint_cmd_id) {
536 dev->free_page_hint_status = FREE_PAGE_HINT_S_START;
537 } else if (dev->free_page_hint_status == FREE_PAGE_HINT_S_START) {
538 /*
539 * Stop the optimization only when it has started. This
540 * avoids a stale stop sign for the previous command.
541 */
542 dev->free_page_hint_status = FREE_PAGE_HINT_S_STOP;
543 }
544 }
545
546 if (elem->in_num && dev->free_page_hint_status == FREE_PAGE_HINT_S_START) {
547 qemu_guest_free_page_hint(elem->in_sg[0].iov_base,
548 elem->in_sg[0].iov_len);
549 }
550
551 out:
552 virtqueue_push(vq, elem, 1);
553 g_free(elem);
554 return ret;
555 }
556
virtio_ballloon_get_free_page_hints(void * opaque)557 static void virtio_ballloon_get_free_page_hints(void *opaque)
558 {
559 VirtIOBalloon *dev = opaque;
560 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
561 VirtQueue *vq = dev->free_page_vq;
562 bool continue_to_get_hints;
563
564 do {
565 qemu_mutex_lock(&dev->free_page_lock);
566 virtio_queue_set_notification(vq, 0);
567 continue_to_get_hints = get_free_page_hints(dev);
568 qemu_mutex_unlock(&dev->free_page_lock);
569 virtio_notify(vdev, vq);
570 /*
571 * Start to poll the vq once the hinting started. Otherwise, continue
572 * only when there are entries on the vq, which need to be given back.
573 */
574 } while (continue_to_get_hints ||
575 dev->free_page_hint_status == FREE_PAGE_HINT_S_START);
576 virtio_queue_set_notification(vq, 1);
577 }
578
virtio_balloon_free_page_support(void * opaque)579 static bool virtio_balloon_free_page_support(void *opaque)
580 {
581 VirtIOBalloon *s = opaque;
582 VirtIODevice *vdev = VIRTIO_DEVICE(s);
583
584 return virtio_vdev_has_feature(vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT);
585 }
586
virtio_balloon_free_page_start(VirtIOBalloon * s)587 static void virtio_balloon_free_page_start(VirtIOBalloon *s)
588 {
589 VirtIODevice *vdev = VIRTIO_DEVICE(s);
590
591 qemu_mutex_lock(&s->free_page_lock);
592
593 if (s->free_page_hint_cmd_id == UINT_MAX) {
594 s->free_page_hint_cmd_id = VIRTIO_BALLOON_FREE_PAGE_HINT_CMD_ID_MIN;
595 } else {
596 s->free_page_hint_cmd_id++;
597 }
598
599 s->free_page_hint_status = FREE_PAGE_HINT_S_REQUESTED;
600 qemu_mutex_unlock(&s->free_page_lock);
601
602 virtio_notify_config(vdev);
603 }
604
virtio_balloon_free_page_stop(VirtIOBalloon * s)605 static void virtio_balloon_free_page_stop(VirtIOBalloon *s)
606 {
607 VirtIODevice *vdev = VIRTIO_DEVICE(s);
608
609 if (s->free_page_hint_status != FREE_PAGE_HINT_S_STOP) {
610 /*
611 * The lock also guarantees us that the
612 * virtio_ballloon_get_free_page_hints exits after the
613 * free_page_hint_status is set to S_STOP.
614 */
615 qemu_mutex_lock(&s->free_page_lock);
616 /*
617 * The guest isn't done hinting, so send a notification
618 * to the guest to actively stop the hinting.
619 */
620 s->free_page_hint_status = FREE_PAGE_HINT_S_STOP;
621 qemu_mutex_unlock(&s->free_page_lock);
622 virtio_notify_config(vdev);
623 }
624 }
625
virtio_balloon_free_page_done(VirtIOBalloon * s)626 static void virtio_balloon_free_page_done(VirtIOBalloon *s)
627 {
628 VirtIODevice *vdev = VIRTIO_DEVICE(s);
629
630 if (s->free_page_hint_status != FREE_PAGE_HINT_S_DONE) {
631 /* See virtio_balloon_free_page_stop() */
632 qemu_mutex_lock(&s->free_page_lock);
633 s->free_page_hint_status = FREE_PAGE_HINT_S_DONE;
634 qemu_mutex_unlock(&s->free_page_lock);
635 virtio_notify_config(vdev);
636 }
637 }
638
639 static int
virtio_balloon_free_page_hint_notify(NotifierWithReturn * n,void * data)640 virtio_balloon_free_page_hint_notify(NotifierWithReturn *n, void *data)
641 {
642 VirtIOBalloon *dev = container_of(n, VirtIOBalloon, free_page_hint_notify);
643 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
644 PrecopyNotifyData *pnd = data;
645
646 if (!virtio_balloon_free_page_support(dev)) {
647 /*
648 * This is an optimization provided to migration, so just return 0 to
649 * have the normal migration process not affected when this feature is
650 * not supported.
651 */
652 return 0;
653 }
654
655 /*
656 * Pages hinted via qemu_guest_free_page_hint() are cleared from the dirty
657 * bitmap and will not get migrated, especially also not when the postcopy
658 * destination starts using them and requests migration from the source; the
659 * faulting thread will stall until postcopy migration finishes and
660 * all threads are woken up. Let's not start free page hinting if postcopy
661 * is possible.
662 */
663 if (migrate_postcopy_ram()) {
664 return 0;
665 }
666
667 switch (pnd->reason) {
668 case PRECOPY_NOTIFY_BEFORE_BITMAP_SYNC:
669 virtio_balloon_free_page_stop(dev);
670 break;
671 case PRECOPY_NOTIFY_AFTER_BITMAP_SYNC:
672 if (vdev->vm_running) {
673 virtio_balloon_free_page_start(dev);
674 break;
675 }
676 /*
677 * Set S_DONE before migrating the vmstate, so the guest will reuse
678 * all hinted pages once running on the destination. Fall through.
679 */
680 case PRECOPY_NOTIFY_CLEANUP:
681 /*
682 * Especially, if something goes wrong during precopy or if migration
683 * is canceled, we have to properly communicate S_DONE to the VM.
684 */
685 virtio_balloon_free_page_done(dev);
686 break;
687 case PRECOPY_NOTIFY_SETUP:
688 case PRECOPY_NOTIFY_COMPLETE:
689 break;
690 default:
691 virtio_error(vdev, "%s: %d reason unknown", __func__, pnd->reason);
692 }
693
694 return 0;
695 }
696
virtio_balloon_config_size(VirtIOBalloon * s)697 static size_t virtio_balloon_config_size(VirtIOBalloon *s)
698 {
699 uint64_t features = s->host_features;
700
701 if (s->qemu_4_0_config_size) {
702 return sizeof(struct virtio_balloon_config);
703 }
704 if (virtio_has_feature(features, VIRTIO_BALLOON_F_PAGE_POISON)) {
705 return sizeof(struct virtio_balloon_config);
706 }
707 if (virtio_has_feature(features, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
708 return offsetof(struct virtio_balloon_config, poison_val);
709 }
710 return offsetof(struct virtio_balloon_config, free_page_hint_cmd_id);
711 }
712
virtio_balloon_get_config(VirtIODevice * vdev,uint8_t * config_data)713 static void virtio_balloon_get_config(VirtIODevice *vdev, uint8_t *config_data)
714 {
715 VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
716 struct virtio_balloon_config config = {};
717
718 config.num_pages = cpu_to_le32(dev->num_pages);
719 config.actual = cpu_to_le32(dev->actual);
720 config.poison_val = cpu_to_le32(dev->poison_val);
721
722 if (dev->free_page_hint_status == FREE_PAGE_HINT_S_REQUESTED) {
723 config.free_page_hint_cmd_id =
724 cpu_to_le32(dev->free_page_hint_cmd_id);
725 } else if (dev->free_page_hint_status == FREE_PAGE_HINT_S_STOP) {
726 config.free_page_hint_cmd_id =
727 cpu_to_le32(VIRTIO_BALLOON_CMD_ID_STOP);
728 } else if (dev->free_page_hint_status == FREE_PAGE_HINT_S_DONE) {
729 config.free_page_hint_cmd_id =
730 cpu_to_le32(VIRTIO_BALLOON_CMD_ID_DONE);
731 }
732
733 trace_virtio_balloon_get_config(config.num_pages, config.actual);
734 memcpy(config_data, &config, virtio_balloon_config_size(dev));
735 }
736
build_dimm_list(Object * obj,void * opaque)737 static int build_dimm_list(Object *obj, void *opaque)
738 {
739 GSList **list = opaque;
740
741 if (object_dynamic_cast(obj, TYPE_PC_DIMM)) {
742 DeviceState *dev = DEVICE(obj);
743 if (dev->realized) { /* only realized DIMMs matter */
744 *list = g_slist_prepend(*list, dev);
745 }
746 }
747
748 object_child_foreach(obj, build_dimm_list, opaque);
749 return 0;
750 }
751
get_current_ram_size(void)752 static ram_addr_t get_current_ram_size(void)
753 {
754 GSList *list = NULL, *item;
755 ram_addr_t size = current_machine->ram_size;
756
757 build_dimm_list(qdev_get_machine(), &list);
758 for (item = list; item; item = g_slist_next(item)) {
759 Object *obj = OBJECT(item->data);
760 if (!strcmp(object_get_typename(obj), TYPE_PC_DIMM)) {
761 size += object_property_get_int(obj, PC_DIMM_SIZE_PROP,
762 &error_abort);
763 }
764 }
765 g_slist_free(list);
766
767 return size;
768 }
769
virtio_balloon_page_poison_support(void * opaque)770 static bool virtio_balloon_page_poison_support(void *opaque)
771 {
772 VirtIOBalloon *s = opaque;
773 VirtIODevice *vdev = VIRTIO_DEVICE(s);
774
775 return virtio_vdev_has_feature(vdev, VIRTIO_BALLOON_F_PAGE_POISON);
776 }
777
virtio_balloon_set_config(VirtIODevice * vdev,const uint8_t * config_data)778 static void virtio_balloon_set_config(VirtIODevice *vdev,
779 const uint8_t *config_data)
780 {
781 VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
782 struct virtio_balloon_config config;
783 uint32_t oldactual = dev->actual;
784 ram_addr_t vm_ram_size = get_current_ram_size();
785
786 memcpy(&config, config_data, virtio_balloon_config_size(dev));
787 dev->actual = le32_to_cpu(config.actual);
788 if (dev->actual != oldactual) {
789 qapi_event_send_balloon_change(vm_ram_size -
790 ((ram_addr_t) dev->actual << VIRTIO_BALLOON_PFN_SHIFT));
791 }
792 dev->poison_val = 0;
793 if (virtio_balloon_page_poison_support(dev)) {
794 dev->poison_val = le32_to_cpu(config.poison_val);
795 }
796 trace_virtio_balloon_set_config(dev->actual, oldactual);
797 }
798
virtio_balloon_get_features(VirtIODevice * vdev,uint64_t f,Error ** errp)799 static uint64_t virtio_balloon_get_features(VirtIODevice *vdev, uint64_t f,
800 Error **errp)
801 {
802 VirtIOBalloon *dev = VIRTIO_BALLOON(vdev);
803 f |= dev->host_features;
804 virtio_add_feature(&f, VIRTIO_BALLOON_F_STATS_VQ);
805
806 return f;
807 }
808
virtio_balloon_stat(void * opaque,BalloonInfo * info)809 static void virtio_balloon_stat(void *opaque, BalloonInfo *info)
810 {
811 VirtIOBalloon *dev = opaque;
812 info->actual = get_current_ram_size() - ((uint64_t) dev->actual <<
813 VIRTIO_BALLOON_PFN_SHIFT);
814 }
815
virtio_balloon_to_target(void * opaque,ram_addr_t target)816 static void virtio_balloon_to_target(void *opaque, ram_addr_t target)
817 {
818 VirtIOBalloon *dev = VIRTIO_BALLOON(opaque);
819 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
820 ram_addr_t vm_ram_size = get_current_ram_size();
821
822 if (target > vm_ram_size) {
823 target = vm_ram_size;
824 }
825 if (target) {
826 dev->num_pages = (vm_ram_size - target) >> VIRTIO_BALLOON_PFN_SHIFT;
827 virtio_notify_config(vdev);
828 }
829 trace_virtio_balloon_to_target(target, dev->num_pages);
830 }
831
virtio_balloon_post_load_device(void * opaque,int version_id)832 static int virtio_balloon_post_load_device(void *opaque, int version_id)
833 {
834 VirtIOBalloon *s = VIRTIO_BALLOON(opaque);
835
836 if (balloon_stats_enabled(s)) {
837 balloon_stats_change_timer(s, s->stats_poll_interval);
838 }
839 return 0;
840 }
841
842 static const VMStateDescription vmstate_virtio_balloon_free_page_hint = {
843 .name = "virtio-balloon-device/free-page-report",
844 .version_id = 1,
845 .minimum_version_id = 1,
846 .needed = virtio_balloon_free_page_support,
847 .fields = (VMStateField[]) {
848 VMSTATE_UINT32(free_page_hint_cmd_id, VirtIOBalloon),
849 VMSTATE_UINT32(free_page_hint_status, VirtIOBalloon),
850 VMSTATE_END_OF_LIST()
851 }
852 };
853
854 static const VMStateDescription vmstate_virtio_balloon_page_poison = {
855 .name = "vitio-balloon-device/page-poison",
856 .version_id = 1,
857 .minimum_version_id = 1,
858 .needed = virtio_balloon_page_poison_support,
859 .fields = (VMStateField[]) {
860 VMSTATE_UINT32(poison_val, VirtIOBalloon),
861 VMSTATE_END_OF_LIST()
862 }
863 };
864
865 static const VMStateDescription vmstate_virtio_balloon_device = {
866 .name = "virtio-balloon-device",
867 .version_id = 1,
868 .minimum_version_id = 1,
869 .post_load = virtio_balloon_post_load_device,
870 .fields = (VMStateField[]) {
871 VMSTATE_UINT32(num_pages, VirtIOBalloon),
872 VMSTATE_UINT32(actual, VirtIOBalloon),
873 VMSTATE_END_OF_LIST()
874 },
875 .subsections = (const VMStateDescription * []) {
876 &vmstate_virtio_balloon_free_page_hint,
877 &vmstate_virtio_balloon_page_poison,
878 NULL
879 }
880 };
881
virtio_balloon_device_realize(DeviceState * dev,Error ** errp)882 static void virtio_balloon_device_realize(DeviceState *dev, Error **errp)
883 {
884 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
885 VirtIOBalloon *s = VIRTIO_BALLOON(dev);
886 int ret;
887
888 virtio_init(vdev, "virtio-balloon", VIRTIO_ID_BALLOON,
889 virtio_balloon_config_size(s));
890
891 ret = qemu_add_balloon_handler(virtio_balloon_to_target,
892 virtio_balloon_stat, s);
893
894 if (ret < 0) {
895 error_setg(errp, "Only one balloon device is supported");
896 virtio_cleanup(vdev);
897 return;
898 }
899
900 if (virtio_has_feature(s->host_features, VIRTIO_BALLOON_F_FREE_PAGE_HINT) &&
901 !s->iothread) {
902 error_setg(errp, "'free-page-hint' requires 'iothread' to be set");
903 virtio_cleanup(vdev);
904 return;
905 }
906
907 s->ivq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output);
908 s->dvq = virtio_add_queue(vdev, 128, virtio_balloon_handle_output);
909 s->svq = virtio_add_queue(vdev, 128, virtio_balloon_receive_stats);
910
911 if (virtio_has_feature(s->host_features, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) {
912 s->free_page_vq = virtio_add_queue(vdev, VIRTQUEUE_MAX_SIZE,
913 virtio_balloon_handle_free_page_vq);
914 precopy_add_notifier(&s->free_page_hint_notify);
915
916 object_ref(OBJECT(s->iothread));
917 s->free_page_bh = aio_bh_new(iothread_get_aio_context(s->iothread),
918 virtio_ballloon_get_free_page_hints, s);
919 }
920
921 if (virtio_has_feature(s->host_features, VIRTIO_BALLOON_F_REPORTING)) {
922 s->reporting_vq = virtio_add_queue(vdev, 32,
923 virtio_balloon_handle_report);
924 }
925
926 reset_stats(s);
927 }
928
virtio_balloon_device_unrealize(DeviceState * dev)929 static void virtio_balloon_device_unrealize(DeviceState *dev)
930 {
931 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
932 VirtIOBalloon *s = VIRTIO_BALLOON(dev);
933
934 if (s->free_page_bh) {
935 qemu_bh_delete(s->free_page_bh);
936 object_unref(OBJECT(s->iothread));
937 virtio_balloon_free_page_stop(s);
938 precopy_remove_notifier(&s->free_page_hint_notify);
939 }
940 balloon_stats_destroy_timer(s);
941 qemu_remove_balloon_handler(s);
942
943 virtio_delete_queue(s->ivq);
944 virtio_delete_queue(s->dvq);
945 virtio_delete_queue(s->svq);
946 if (s->free_page_vq) {
947 virtio_delete_queue(s->free_page_vq);
948 }
949 if (s->reporting_vq) {
950 virtio_delete_queue(s->reporting_vq);
951 }
952 virtio_cleanup(vdev);
953 }
954
virtio_balloon_device_reset(VirtIODevice * vdev)955 static void virtio_balloon_device_reset(VirtIODevice *vdev)
956 {
957 VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
958
959 if (virtio_balloon_free_page_support(s)) {
960 virtio_balloon_free_page_stop(s);
961 }
962
963 if (s->stats_vq_elem != NULL) {
964 virtqueue_unpop(s->svq, s->stats_vq_elem, 0);
965 g_free(s->stats_vq_elem);
966 s->stats_vq_elem = NULL;
967 }
968
969 s->poison_val = 0;
970 }
971
virtio_balloon_set_status(VirtIODevice * vdev,uint8_t status)972 static void virtio_balloon_set_status(VirtIODevice *vdev, uint8_t status)
973 {
974 VirtIOBalloon *s = VIRTIO_BALLOON(vdev);
975
976 if (!s->stats_vq_elem && vdev->vm_running &&
977 (status & VIRTIO_CONFIG_S_DRIVER_OK) && virtqueue_rewind(s->svq, 1)) {
978 /* poll stats queue for the element we have discarded when the VM
979 * was stopped */
980 virtio_balloon_receive_stats(vdev, s->svq);
981 }
982
983 if (virtio_balloon_free_page_support(s)) {
984 /*
985 * The VM is woken up and the iothread was blocked, so signal it to
986 * continue.
987 */
988 if (vdev->vm_running && s->block_iothread) {
989 qemu_mutex_lock(&s->free_page_lock);
990 s->block_iothread = false;
991 qemu_cond_signal(&s->free_page_cond);
992 qemu_mutex_unlock(&s->free_page_lock);
993 }
994
995 /* The VM is stopped, block the iothread. */
996 if (!vdev->vm_running) {
997 qemu_mutex_lock(&s->free_page_lock);
998 s->block_iothread = true;
999 qemu_mutex_unlock(&s->free_page_lock);
1000 }
1001 }
1002 }
1003
virtio_balloon_instance_init(Object * obj)1004 static void virtio_balloon_instance_init(Object *obj)
1005 {
1006 VirtIOBalloon *s = VIRTIO_BALLOON(obj);
1007
1008 qemu_mutex_init(&s->free_page_lock);
1009 qemu_cond_init(&s->free_page_cond);
1010 s->free_page_hint_cmd_id = VIRTIO_BALLOON_FREE_PAGE_HINT_CMD_ID_MIN;
1011 s->free_page_hint_notify.notify = virtio_balloon_free_page_hint_notify;
1012
1013 object_property_add(obj, "guest-stats", "guest statistics",
1014 balloon_stats_get_all, NULL, NULL, s);
1015
1016 object_property_add(obj, "guest-stats-polling-interval", "int",
1017 balloon_stats_get_poll_interval,
1018 balloon_stats_set_poll_interval,
1019 NULL, s);
1020 }
1021
1022 static const VMStateDescription vmstate_virtio_balloon = {
1023 .name = "virtio-balloon",
1024 .minimum_version_id = 1,
1025 .version_id = 1,
1026 .fields = (VMStateField[]) {
1027 VMSTATE_VIRTIO_DEVICE,
1028 VMSTATE_END_OF_LIST()
1029 },
1030 };
1031
1032 static Property virtio_balloon_properties[] = {
1033 DEFINE_PROP_BIT("deflate-on-oom", VirtIOBalloon, host_features,
1034 VIRTIO_BALLOON_F_DEFLATE_ON_OOM, false),
1035 DEFINE_PROP_BIT("free-page-hint", VirtIOBalloon, host_features,
1036 VIRTIO_BALLOON_F_FREE_PAGE_HINT, false),
1037 DEFINE_PROP_BIT("page-poison", VirtIOBalloon, host_features,
1038 VIRTIO_BALLOON_F_PAGE_POISON, true),
1039 DEFINE_PROP_BIT("free-page-reporting", VirtIOBalloon, host_features,
1040 VIRTIO_BALLOON_F_REPORTING, false),
1041 /* QEMU 4.0 accidentally changed the config size even when free-page-hint
1042 * is disabled, resulting in QEMU 3.1 migration incompatibility. This
1043 * property retains this quirk for QEMU 4.1 machine types.
1044 */
1045 DEFINE_PROP_BOOL("qemu-4-0-config-size", VirtIOBalloon,
1046 qemu_4_0_config_size, false),
1047 DEFINE_PROP_LINK("iothread", VirtIOBalloon, iothread, TYPE_IOTHREAD,
1048 IOThread *),
1049 DEFINE_PROP_END_OF_LIST(),
1050 };
1051
virtio_balloon_class_init(ObjectClass * klass,void * data)1052 static void virtio_balloon_class_init(ObjectClass *klass, void *data)
1053 {
1054 DeviceClass *dc = DEVICE_CLASS(klass);
1055 VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
1056
1057 device_class_set_props(dc, virtio_balloon_properties);
1058 dc->vmsd = &vmstate_virtio_balloon;
1059 set_bit(DEVICE_CATEGORY_MISC, dc->categories);
1060 vdc->realize = virtio_balloon_device_realize;
1061 vdc->unrealize = virtio_balloon_device_unrealize;
1062 vdc->reset = virtio_balloon_device_reset;
1063 vdc->get_config = virtio_balloon_get_config;
1064 vdc->set_config = virtio_balloon_set_config;
1065 vdc->get_features = virtio_balloon_get_features;
1066 vdc->set_status = virtio_balloon_set_status;
1067 vdc->vmsd = &vmstate_virtio_balloon_device;
1068 }
1069
1070 static const TypeInfo virtio_balloon_info = {
1071 .name = TYPE_VIRTIO_BALLOON,
1072 .parent = TYPE_VIRTIO_DEVICE,
1073 .instance_size = sizeof(VirtIOBalloon),
1074 .instance_init = virtio_balloon_instance_init,
1075 .class_init = virtio_balloon_class_init,
1076 };
1077
virtio_register_types(void)1078 static void virtio_register_types(void)
1079 {
1080 type_register_static(&virtio_balloon_info);
1081 }
1082
1083 type_init(virtio_register_types)
1084