xref: /openbmc/qemu/hw/hyperv/hv-balloon.c (revision f2202be2)
1 /*
2  * QEMU Hyper-V Dynamic Memory Protocol driver
3  *
4  * Copyright (C) 2020-2023 Oracle and/or its affiliates.
5  *
6  * This work is licensed under the terms of the GNU GPL, version 2 or later.
7  * See the COPYING file in the top-level directory.
8  */
9 
10 #include "qemu/osdep.h"
11 #include "hv-balloon-internal.h"
12 
13 #include "exec/address-spaces.h"
14 #include "exec/cpu-common.h"
15 #include "exec/ramblock.h"
16 #include "hw/boards.h"
17 #include "hw/hyperv/dynmem-proto.h"
18 #include "hw/hyperv/hv-balloon.h"
19 #include "hw/hyperv/vmbus.h"
20 #include "hw/mem/memory-device.h"
21 #include "hw/mem/pc-dimm.h"
22 #include "hw/qdev-core.h"
23 #include "hw/qdev-properties.h"
24 #include "monitor/qdev.h"
25 #include "qapi/error.h"
26 #include "qapi/qapi-commands-machine.h"
27 #include "qapi/qapi-events-machine.h"
28 #include "qapi/qapi-types-machine.h"
29 #include "qapi/qmp/qdict.h"
30 #include "qapi/visitor.h"
31 #include "qemu/error-report.h"
32 #include "qemu/module.h"
33 #include "qemu/units.h"
34 #include "qemu/timer.h"
35 #include "sysemu/balloon.h"
36 #include "sysemu/hostmem.h"
37 #include "sysemu/reset.h"
38 #include "hv-balloon-our_range_memslots.h"
39 #include "hv-balloon-page_range_tree.h"
40 #include "trace.h"
41 
42 #define HV_BALLOON_ADDR_PROP "addr"
43 #define HV_BALLOON_MEMDEV_PROP "memdev"
44 #define HV_BALLOON_GUID "525074DC-8985-46e2-8057-A307DC18A502"
45 
46 /*
47  * Some Windows versions (at least Server 2019) will crash with various
48  * error codes when receiving DM protocol requests (at least
49  * DM_MEM_HOT_ADD_REQUEST) immediately after boot.
50  *
51  * It looks like Hyper-V from Server 2016 uses a 50-second after-boot
52  * delay, probably to workaround this issue, so we'll use this value, too.
53  */
54 #define HV_BALLOON_POST_INIT_WAIT (50 * 1000)
55 
56 #define HV_BALLOON_HA_CHUNK_SIZE (2 * GiB)
57 #define HV_BALLOON_HA_CHUNK_PAGES (HV_BALLOON_HA_CHUNK_SIZE / HV_BALLOON_PAGE_SIZE)
58 
59 #define HV_BALLOON_HA_MEMSLOT_SIZE_ALIGN (128 * MiB)
60 
61 #define HV_BALLOON_HR_CHUNK_PAGES 585728
62 /*
63  *                                ^ that's the maximum number of pages
64  * that Windows returns in one hot remove response
65  *
66  * If the number requested is too high Windows will no longer honor
67  * these requests
68  */
69 
70 struct HvBalloonClass {
71     VMBusDeviceClass parent_class;
72 } HvBalloonClass;
73 
74 typedef enum State {
75     /* not a real state */
76     S_NO_CHANGE = 0,
77 
78     S_WAIT_RESET,
79     S_POST_RESET_CLOSED,
80 
81     /* init flow */
82     S_VERSION,
83     S_CAPS,
84     S_POST_INIT_WAIT,
85 
86     S_IDLE,
87 
88     /* balloon op flow */
89     S_BALLOON_POSTING,
90     S_BALLOON_RB_WAIT,
91     S_BALLOON_REPLY_WAIT,
92 
93     /* unballoon + hot add ops flow */
94     S_UNBALLOON_POSTING,
95     S_UNBALLOON_RB_WAIT,
96     S_UNBALLOON_REPLY_WAIT,
97     S_HOT_ADD_SETUP,
98     S_HOT_ADD_RB_WAIT,
99     S_HOT_ADD_POSTING,
100     S_HOT_ADD_REPLY_WAIT,
101 } State;
102 
103 typedef struct StateDesc {
104     State state;
105     const char *desc;
106 } StateDesc;
107 
108 typedef struct HvBalloon {
109     VMBusDevice parent;
110     State state;
111 
112     union dm_version version;
113     union dm_caps caps;
114 
115     QEMUTimer post_init_timer;
116 
117     unsigned int trans_id;
118 
119     struct {
120         bool enabled;
121         bool received;
122         uint64_t committed;
123         uint64_t available;
124     } status_report;
125 
126     /* Guest target size */
127     uint64_t target;
128     bool target_changed;
129 
130     /* Current (un)balloon / hot-add operation parameters */
131     union {
132         uint64_t balloon_diff;
133 
134         struct {
135             uint64_t unballoon_diff;
136             uint64_t hot_add_diff;
137         };
138 
139         struct {
140             PageRange hot_add_range;
141             uint64_t ha_current_count;
142         };
143     };
144 
145     OurRangeMemslots *our_range;
146 
147     /* Count of memslots covering our memory */
148     unsigned int memslot_count;
149 
150     /* Nominal size of each memslot (the last one might be smaller) */
151     uint64_t memslot_size;
152 
153     /* Non-ours removed memory */
154     PageRangeTree removed_guest, removed_both;
155 
156     /* Grand totals of removed memory (both ours and non-ours) */
157     uint64_t removed_guest_ctr, removed_both_ctr;
158 
159     /* MEMORY_DEVICE props */
160     uint64_t addr;
161     HostMemoryBackend *hostmem;
162     MemoryRegion *mr;
163 } HvBalloon;
164 
165 OBJECT_DEFINE_TYPE_WITH_INTERFACES(HvBalloon, hv_balloon, HV_BALLOON, VMBUS_DEVICE, \
166                                    { TYPE_MEMORY_DEVICE }, { })
167 
168 #define HV_BALLOON_SET_STATE(hvb, news)             \
169     do {                                            \
170         assert(news != S_NO_CHANGE);                \
171         hv_balloon_state_set(hvb, news, # news);    \
172     } while (0)
173 
174 #define HV_BALLOON_STATE_DESC_SET(stdesc, news)         \
175     _hv_balloon_state_desc_set(stdesc, news, # news)
176 
177 #define HV_BALLOON_STATE_DESC_INIT \
178     {                              \
179         .state = S_NO_CHANGE,      \
180     }
181 
182 typedef struct HvBalloonReq {
183     VMBusChanReq vmreq;
184 } HvBalloonReq;
185 
186 /* total our memory includes parts currently removed from the guest */
187 static uint64_t hv_balloon_total_our_ram(HvBalloon *balloon)
188 {
189     if (!balloon->our_range) {
190         return 0;
191     }
192 
193     return balloon->our_range->range.added;
194 }
195 
196 /* TODO: unify the code below with virtio-balloon and cache the value */
197 static int build_dimm_list(Object *obj, void *opaque)
198 {
199     GSList **list = opaque;
200 
201     if (object_dynamic_cast(obj, TYPE_PC_DIMM)) {
202         DeviceState *dev = DEVICE(obj);
203         if (dev->realized) { /* only realized DIMMs matter */
204             *list = g_slist_prepend(*list, dev);
205         }
206     }
207 
208     object_child_foreach(obj, build_dimm_list, opaque);
209     return 0;
210 }
211 
212 static ram_addr_t get_current_ram_size(void)
213 {
214     GSList *list = NULL, *item;
215     ram_addr_t size = current_machine->ram_size;
216 
217     build_dimm_list(qdev_get_machine(), &list);
218     for (item = list; item; item = g_slist_next(item)) {
219         Object *obj = OBJECT(item->data);
220         if (!strcmp(object_get_typename(obj), TYPE_PC_DIMM))
221             size += object_property_get_int(obj, PC_DIMM_SIZE_PROP,
222                                             &error_abort);
223     }
224     g_slist_free(list);
225 
226     return size;
227 }
228 
229 /* total RAM includes memory currently removed from the guest */
230 static uint64_t hv_balloon_total_ram(HvBalloon *balloon)
231 {
232     ram_addr_t ram_size = get_current_ram_size();
233     uint64_t ram_size_pages = ram_size >> HV_BALLOON_PFN_SHIFT;
234     uint64_t our_ram_size_pages = hv_balloon_total_our_ram(balloon);
235 
236     assert(ram_size_pages > 0);
237 
238     return SUM_SATURATE_U64(ram_size_pages, our_ram_size_pages);
239 }
240 
241 /*
242  * calculating the total RAM size is a slow operation,
243  * avoid it as much as possible
244  */
245 static uint64_t hv_balloon_total_removed_rs(HvBalloon *balloon,
246                                             uint64_t ram_size_pages)
247 {
248     uint64_t total_removed;
249 
250     total_removed = SUM_SATURATE_U64(balloon->removed_guest_ctr,
251                                      balloon->removed_both_ctr);
252 
253     /* possible if guest returns pages outside actual RAM */
254     if (total_removed > ram_size_pages) {
255         total_removed = ram_size_pages;
256     }
257 
258     return total_removed;
259 }
260 
261 /* Returns whether the state has actually changed */
262 static bool hv_balloon_state_set(HvBalloon *balloon,
263                                  State newst, const char *newststr)
264 {
265     if (newst == S_NO_CHANGE || balloon->state == newst) {
266         return false;
267     }
268 
269     balloon->state = newst;
270     trace_hv_balloon_state_change(newststr);
271     return true;
272 }
273 
274 static void _hv_balloon_state_desc_set(StateDesc *stdesc,
275                                        State newst, const char *newststr)
276 {
277     /* state setting is only permitted on a freshly init desc */
278     assert(stdesc->state == S_NO_CHANGE);
279 
280     assert(newst != S_NO_CHANGE);
281 
282     stdesc->state = newst;
283     stdesc->desc = newststr;
284 }
285 
286 static VMBusChannel *hv_balloon_get_channel_maybe(HvBalloon *balloon)
287 {
288     return vmbus_device_channel(&balloon->parent, 0);
289 }
290 
291 static VMBusChannel *hv_balloon_get_channel(HvBalloon *balloon)
292 {
293     VMBusChannel *chan;
294 
295     chan = hv_balloon_get_channel_maybe(balloon);
296     assert(chan != NULL);
297     return chan;
298 }
299 
300 static ssize_t hv_balloon_send_packet(VMBusChannel *chan,
301                                       struct dm_message *msg)
302 {
303     int ret;
304 
305     ret = vmbus_channel_reserve(chan, 0, msg->hdr.size);
306     if (ret < 0) {
307         return ret;
308     }
309 
310     return vmbus_channel_send(chan, VMBUS_PACKET_DATA_INBAND,
311                               NULL, 0, msg, msg->hdr.size, false,
312                               msg->hdr.trans_id);
313 }
314 
315 static bool hv_balloon_unballoon_get_source(HvBalloon *balloon,
316                                             PageRangeTree *dtree,
317                                             uint64_t **dctr,
318                                             bool *is_our_range)
319 {
320     OurRange *our_range = OUR_RANGE(balloon->our_range);
321 
322     /* Try the boot memory first */
323     if (g_tree_nnodes(balloon->removed_guest.t) > 0) {
324         *dtree = balloon->removed_guest;
325         *dctr = &balloon->removed_guest_ctr;
326         *is_our_range = false;
327     } else if (g_tree_nnodes(balloon->removed_both.t) > 0) {
328         *dtree = balloon->removed_both;
329         *dctr = &balloon->removed_both_ctr;
330         *is_our_range = false;
331     } else if (!our_range) {
332         return false;
333     } else if (!our_range_is_removed_tree_empty(our_range, false)) {
334         *dtree = our_range_get_removed_tree(our_range, false);
335         *dctr = &balloon->removed_guest_ctr;
336         *is_our_range = true;
337     } else if (!our_range_is_removed_tree_empty(our_range, true)) {
338         *dtree = our_range_get_removed_tree(our_range, true);
339         *dctr = &balloon->removed_both_ctr;
340         *is_our_range = true;
341     } else {
342         return false;
343     }
344 
345     return true;
346 }
347 
348 static void hv_balloon_unballoon_rb_wait(HvBalloon *balloon, StateDesc *stdesc)
349 {
350     VMBusChannel *chan = hv_balloon_get_channel(balloon);
351     struct dm_unballoon_request *ur;
352     size_t ur_size = sizeof(*ur) + sizeof(ur->range_array[0]);
353 
354     assert(balloon->state == S_UNBALLOON_RB_WAIT);
355 
356     if (vmbus_channel_reserve(chan, 0, ur_size) < 0) {
357         return;
358     }
359 
360     HV_BALLOON_STATE_DESC_SET(stdesc, S_UNBALLOON_POSTING);
361 }
362 
363 static void hv_balloon_unballoon_posting(HvBalloon *balloon, StateDesc *stdesc)
364 {
365     VMBusChannel *chan = hv_balloon_get_channel(balloon);
366     PageRangeTree dtree;
367     uint64_t *dctr;
368     bool our_range;
369     g_autofree struct dm_unballoon_request *ur = NULL;
370     size_t ur_size = sizeof(*ur) + sizeof(ur->range_array[0]);
371     PageRange range;
372     bool bret;
373     ssize_t ret;
374 
375     assert(balloon->state == S_UNBALLOON_POSTING);
376     assert(balloon->unballoon_diff > 0);
377 
378     if (!hv_balloon_unballoon_get_source(balloon, &dtree, &dctr, &our_range)) {
379         error_report("trying to unballoon but nothing seems to be ballooned");
380         /*
381          * there is little we can do as we might have already
382          * sent the guest a partial request we can't cancel
383          */
384         return;
385     }
386 
387     assert(balloon->our_range || !our_range);
388     assert(dtree.t);
389     assert(dctr);
390 
391     ur = g_malloc0(ur_size);
392     ur->hdr.type = DM_UNBALLOON_REQUEST;
393     ur->hdr.size = ur_size;
394     ur->hdr.trans_id = balloon->trans_id;
395 
396     bret = hvb_page_range_tree_pop(dtree, &range, MIN(balloon->unballoon_diff,
397                                                       HV_BALLOON_HA_CHUNK_PAGES));
398     assert(bret);
399     /* TODO: madvise? */
400 
401     *dctr -= range.count;
402     balloon->unballoon_diff -= range.count;
403 
404     ur->range_count = 1;
405     ur->range_array[0].finfo.start_page = range.start;
406     ur->range_array[0].finfo.page_cnt = range.count;
407     ur->more_pages = balloon->unballoon_diff > 0;
408 
409     trace_hv_balloon_outgoing_unballoon(ur->hdr.trans_id,
410                                         range.count, range.start,
411                                         balloon->unballoon_diff);
412 
413     if (ur->more_pages) {
414         HV_BALLOON_STATE_DESC_SET(stdesc, S_UNBALLOON_RB_WAIT);
415     } else {
416         HV_BALLOON_STATE_DESC_SET(stdesc, S_UNBALLOON_REPLY_WAIT);
417     }
418 
419     ret = vmbus_channel_send(chan, VMBUS_PACKET_DATA_INBAND,
420                              NULL, 0, ur, ur_size, false,
421                              ur->hdr.trans_id);
422     if (ret <= 0) {
423         error_report("error %zd when posting unballoon msg, expect problems",
424                      ret);
425     }
426 }
427 
428 static bool hv_balloon_our_range_ensure(HvBalloon *balloon)
429 {
430     uint64_t align;
431     MemoryRegion *hostmem_mr;
432     g_autoptr(OurRangeMemslots) our_range_memslots = NULL;
433     OurRange *our_range;
434 
435     if (balloon->our_range) {
436         return true;
437     }
438 
439     if (!balloon->hostmem) {
440         return false;
441     }
442 
443     align = (1 << balloon->caps.cap_bits.hot_add_alignment) * MiB;
444     assert(QEMU_IS_ALIGNED(balloon->addr, align));
445 
446     hostmem_mr = host_memory_backend_get_memory(balloon->hostmem);
447 
448     our_range_memslots = hvb_our_range_memslots_new(balloon->addr,
449                                                     balloon->mr, hostmem_mr,
450                                                     OBJECT(balloon),
451                                                     balloon->memslot_count,
452                                                     balloon->memslot_size);
453     our_range = OUR_RANGE(our_range_memslots);
454 
455     if (hvb_page_range_tree_intree_any(balloon->removed_guest,
456                                        our_range->range.start,
457                                        our_range->range.count) ||
458         hvb_page_range_tree_intree_any(balloon->removed_both,
459                                        our_range->range.start,
460                                        our_range->range.count)) {
461         error_report("some parts of the memory backend were already returned by the guest. this should not happen, please reboot the guest and try again");
462         return false;
463     }
464 
465     trace_hv_balloon_our_range_add(our_range->range.count,
466                                    our_range->range.start);
467 
468     balloon->our_range = g_steal_pointer(&our_range_memslots);
469     return true;
470 }
471 
472 static void hv_balloon_hot_add_setup(HvBalloon *balloon, StateDesc *stdesc)
473 {
474     /* need to make copy since it is in union with hot_add_range */
475     uint64_t hot_add_diff = balloon->hot_add_diff;
476     PageRange *hot_add_range = &balloon->hot_add_range;
477     uint64_t align, our_range_remaining;
478     OurRange *our_range;
479 
480     assert(balloon->state == S_HOT_ADD_SETUP);
481     assert(hot_add_diff > 0);
482 
483     if (!hv_balloon_our_range_ensure(balloon)) {
484         goto ret_idle;
485     }
486 
487     our_range = OUR_RANGE(balloon->our_range);
488 
489     align = (1 << balloon->caps.cap_bits.hot_add_alignment) *
490         (MiB / HV_BALLOON_PAGE_SIZE);
491 
492     /* Absolute GPA in pages */
493     hot_add_range->start = our_range_get_remaining_start(our_range);
494     assert(QEMU_IS_ALIGNED(hot_add_range->start, align));
495 
496     our_range_remaining = our_range_get_remaining_size(our_range);
497     hot_add_range->count = MIN(our_range_remaining, hot_add_diff);
498     hot_add_range->count = QEMU_ALIGN_DOWN(hot_add_range->count, align);
499     if (hot_add_range->count == 0) {
500         goto ret_idle;
501     }
502 
503     hvb_our_range_memslots_ensure_mapped_additional(balloon->our_range,
504                                                     hot_add_range->count);
505 
506     HV_BALLOON_STATE_DESC_SET(stdesc, S_HOT_ADD_RB_WAIT);
507     return;
508 
509 ret_idle:
510     HV_BALLOON_STATE_DESC_SET(stdesc, S_IDLE);
511 }
512 
513 static void hv_balloon_hot_add_rb_wait(HvBalloon *balloon, StateDesc *stdesc)
514 {
515     VMBusChannel *chan = hv_balloon_get_channel(balloon);
516     struct dm_hot_add_with_region *ha;
517     size_t ha_size = sizeof(*ha);
518 
519     assert(balloon->state == S_HOT_ADD_RB_WAIT);
520 
521     if (vmbus_channel_reserve(chan, 0, ha_size) < 0) {
522         return;
523     }
524 
525     HV_BALLOON_STATE_DESC_SET(stdesc, S_HOT_ADD_POSTING);
526 }
527 
528 static void hv_balloon_hot_add_posting(HvBalloon *balloon, StateDesc *stdesc)
529 {
530     PageRange *hot_add_range = &balloon->hot_add_range;
531     uint64_t *current_count = &balloon->ha_current_count;
532     VMBusChannel *chan = hv_balloon_get_channel(balloon);
533     g_autofree struct dm_hot_add_with_region *ha = NULL;
534     size_t ha_size = sizeof(*ha);
535     union dm_mem_page_range *ha_region;
536     uint64_t align, chunk_max_size;
537     ssize_t ret;
538 
539     assert(balloon->state == S_HOT_ADD_POSTING);
540     assert(hot_add_range->count > 0);
541 
542     align = (1 << balloon->caps.cap_bits.hot_add_alignment) *
543         (MiB / HV_BALLOON_PAGE_SIZE);
544     if (align >= HV_BALLOON_HA_CHUNK_PAGES) {
545         /*
546          * If the required alignment is higher than the chunk size we let it
547          * override that size.
548          */
549         chunk_max_size = align;
550     } else {
551         chunk_max_size = QEMU_ALIGN_DOWN(HV_BALLOON_HA_CHUNK_PAGES, align);
552     }
553 
554     /*
555      * hot_add_range->count starts aligned in hv_balloon_hot_add_setup(),
556      * then it is either reduced by subtracting aligned current_count or
557      * further hot-adds are prevented by marking the whole remaining our range
558      * as unusable in hv_balloon_handle_hot_add_response().
559      */
560     *current_count = MIN(hot_add_range->count, chunk_max_size);
561 
562     ha = g_malloc0(ha_size);
563     ha_region = &ha->region;
564     ha->hdr.type = DM_MEM_HOT_ADD_REQUEST;
565     ha->hdr.size = ha_size;
566     ha->hdr.trans_id = balloon->trans_id;
567 
568     ha->range.finfo.start_page = hot_add_range->start;
569     ha->range.finfo.page_cnt = *current_count;
570     ha_region->finfo.start_page = hot_add_range->start;
571     ha_region->finfo.page_cnt = ha->range.finfo.page_cnt;
572 
573     trace_hv_balloon_outgoing_hot_add(ha->hdr.trans_id,
574                                       *current_count, hot_add_range->start);
575 
576     ret = vmbus_channel_send(chan, VMBUS_PACKET_DATA_INBAND,
577                              NULL, 0, ha, ha_size, false,
578                              ha->hdr.trans_id);
579     if (ret <= 0) {
580         error_report("error %zd when posting hot add msg, expect problems",
581                      ret);
582     }
583 
584     HV_BALLOON_STATE_DESC_SET(stdesc, S_HOT_ADD_REPLY_WAIT);
585 }
586 
587 static void hv_balloon_balloon_rb_wait(HvBalloon *balloon, StateDesc *stdesc)
588 {
589     VMBusChannel *chan = hv_balloon_get_channel(balloon);
590     size_t bl_size = sizeof(struct dm_balloon);
591 
592     assert(balloon->state == S_BALLOON_RB_WAIT);
593 
594     if (vmbus_channel_reserve(chan, 0, bl_size) < 0) {
595         return;
596     }
597 
598     HV_BALLOON_STATE_DESC_SET(stdesc, S_BALLOON_POSTING);
599 }
600 
601 static void hv_balloon_balloon_posting(HvBalloon *balloon, StateDesc *stdesc)
602 {
603     VMBusChannel *chan = hv_balloon_get_channel(balloon);
604     struct dm_balloon bl;
605     size_t bl_size = sizeof(bl);
606     ssize_t ret;
607 
608     assert(balloon->state == S_BALLOON_POSTING);
609     assert(balloon->balloon_diff > 0);
610 
611     memset(&bl, 0, sizeof(bl));
612     bl.hdr.type = DM_BALLOON_REQUEST;
613     bl.hdr.size = bl_size;
614     bl.hdr.trans_id = balloon->trans_id;
615     bl.num_pages = MIN(balloon->balloon_diff, HV_BALLOON_HR_CHUNK_PAGES);
616 
617     trace_hv_balloon_outgoing_balloon(bl.hdr.trans_id, bl.num_pages,
618                                       balloon->balloon_diff);
619 
620     ret = vmbus_channel_send(chan, VMBUS_PACKET_DATA_INBAND,
621                              NULL, 0, &bl, bl_size, false,
622                              bl.hdr.trans_id);
623     if (ret <= 0) {
624         error_report("error %zd when posting balloon msg, expect problems",
625                      ret);
626     }
627 
628     HV_BALLOON_STATE_DESC_SET(stdesc, S_BALLOON_REPLY_WAIT);
629 }
630 
631 static void hv_balloon_idle_state_process_target(HvBalloon *balloon,
632                                                  StateDesc *stdesc)
633 {
634     bool can_balloon = balloon->caps.cap_bits.balloon;
635     uint64_t ram_size_pages, total_removed;
636 
637     ram_size_pages = hv_balloon_total_ram(balloon);
638     total_removed = hv_balloon_total_removed_rs(balloon, ram_size_pages);
639 
640     /*
641      * we need to cache the values computed from the balloon target value when
642      * starting the adjustment procedure in case someone changes the target when
643      * the procedure is in progress
644      */
645     if (balloon->target > ram_size_pages - total_removed) {
646         bool can_hot_add = balloon->caps.cap_bits.hot_add;
647         uint64_t target_diff = balloon->target -
648             (ram_size_pages - total_removed);
649 
650         balloon->unballoon_diff = MIN(target_diff, total_removed);
651 
652         if (can_hot_add) {
653             balloon->hot_add_diff = target_diff - balloon->unballoon_diff;
654         } else {
655             balloon->hot_add_diff = 0;
656         }
657 
658         if (balloon->unballoon_diff > 0) {
659             assert(can_balloon);
660             HV_BALLOON_STATE_DESC_SET(stdesc, S_UNBALLOON_RB_WAIT);
661         } else if (balloon->hot_add_diff > 0) {
662             HV_BALLOON_STATE_DESC_SET(stdesc, S_HOT_ADD_SETUP);
663         }
664     } else if (can_balloon &&
665                balloon->target < ram_size_pages - total_removed) {
666         balloon->balloon_diff = ram_size_pages - total_removed -
667             balloon->target;
668         HV_BALLOON_STATE_DESC_SET(stdesc, S_BALLOON_RB_WAIT);
669     }
670 }
671 
672 static void hv_balloon_idle_state(HvBalloon *balloon,
673                                   StateDesc *stdesc)
674 {
675     assert(balloon->state == S_IDLE);
676 
677     if (balloon->target_changed) {
678         balloon->target_changed = false;
679         hv_balloon_idle_state_process_target(balloon, stdesc);
680         return;
681     }
682 }
683 
684 static const struct {
685     void (*handler)(HvBalloon *balloon, StateDesc *stdesc);
686 } state_handlers[] = {
687     [S_IDLE].handler = hv_balloon_idle_state,
688     [S_BALLOON_POSTING].handler = hv_balloon_balloon_posting,
689     [S_BALLOON_RB_WAIT].handler = hv_balloon_balloon_rb_wait,
690     [S_UNBALLOON_POSTING].handler = hv_balloon_unballoon_posting,
691     [S_UNBALLOON_RB_WAIT].handler = hv_balloon_unballoon_rb_wait,
692     [S_HOT_ADD_SETUP].handler = hv_balloon_hot_add_setup,
693     [S_HOT_ADD_RB_WAIT].handler = hv_balloon_hot_add_rb_wait,
694     [S_HOT_ADD_POSTING].handler = hv_balloon_hot_add_posting,
695 };
696 
697 static void hv_balloon_handle_state(HvBalloon *balloon, StateDesc *stdesc)
698 {
699     if (balloon->state >= ARRAY_SIZE(state_handlers) ||
700         !state_handlers[balloon->state].handler) {
701         return;
702     }
703 
704     state_handlers[balloon->state].handler(balloon, stdesc);
705 }
706 
707 static void hv_balloon_remove_response_insert_range(PageRangeTree tree,
708                                                     const PageRange *range,
709                                                     uint64_t *ctr1,
710                                                     uint64_t *ctr2,
711                                                     uint64_t *ctr3)
712 {
713     uint64_t dupcount, effcount;
714 
715     if (range->count == 0) {
716         return;
717     }
718 
719     dupcount = 0;
720     hvb_page_range_tree_insert(tree, range->start, range->count, &dupcount);
721 
722     assert(dupcount <= range->count);
723     effcount = range->count - dupcount;
724 
725     *ctr1 += effcount;
726     *ctr2 += effcount;
727     if (ctr3) {
728         *ctr3 += effcount;
729     }
730 }
731 
732 static void hv_balloon_remove_response_handle_range(HvBalloon *balloon,
733                                                     PageRange *range,
734                                                     bool both,
735                                                     uint64_t *removedctr)
736 {
737     OurRange *our_range = OUR_RANGE(balloon->our_range);
738     PageRangeTree globaltree =
739         both ? balloon->removed_both : balloon->removed_guest;
740     uint64_t *globalctr =
741         both ? &balloon->removed_both_ctr : &balloon->removed_guest_ctr;
742     PageRange rangeeff;
743 
744     if (range->count == 0) {
745         return;
746     }
747 
748     trace_hv_balloon_remove_response(range->count, range->start, both);
749 
750     if (our_range) {
751         /* Includes the not-yet-hot-added and unusable parts. */
752         rangeeff = our_range->range;
753     } else {
754         rangeeff.start = rangeeff.count = 0;
755     }
756 
757     if (page_range_intersection_size(range, rangeeff.start, rangeeff.count) > 0) {
758         PageRangeTree ourtree = our_range_get_removed_tree(our_range, both);
759         PageRange rangehole, rangecommon;
760         uint64_t ourremoved = 0;
761 
762         /* process the hole before our range, if it exists */
763         page_range_part_before(range, rangeeff.start, &rangehole);
764         hv_balloon_remove_response_insert_range(globaltree, &rangehole,
765                                                 globalctr, removedctr, NULL);
766         if (rangehole.count > 0) {
767             trace_hv_balloon_remove_response_hole(rangehole.count,
768                                                   rangehole.start,
769                                                   range->count, range->start,
770                                                   rangeeff.start, both);
771         }
772 
773         /* process our part */
774         page_range_intersect(range, rangeeff.start, rangeeff.count,
775                              &rangecommon);
776         hv_balloon_remove_response_insert_range(ourtree, &rangecommon,
777                                                 globalctr, removedctr,
778                                                 &ourremoved);
779         if (rangecommon.count > 0) {
780             trace_hv_balloon_remove_response_common(rangecommon.count,
781                                                     rangecommon.start,
782                                                     range->count, range->start,
783                                                     rangeeff.count,
784                                                     rangeeff.start, ourremoved,
785                                                     both);
786         }
787 
788         /* calculate what's left after our range */
789         rangecommon = *range;
790         page_range_part_after(&rangecommon, rangeeff.start, rangeeff.count,
791                               range);
792     }
793 
794     /* process the remainder of the range that lies after our range */
795     if (range->count > 0) {
796         hv_balloon_remove_response_insert_range(globaltree, range,
797                                                 globalctr, removedctr, NULL);
798         trace_hv_balloon_remove_response_remainder(range->count, range->start,
799                                                    both);
800         range->count = 0;
801     }
802 }
803 
804 static void hv_balloon_remove_response_handle_pages(HvBalloon *balloon,
805                                                     PageRange *range,
806                                                     uint64_t start,
807                                                     uint64_t count,
808                                                     bool both,
809                                                     uint64_t *removedctr)
810 {
811     assert(count > 0);
812 
813     /*
814      * if there is an existing range that the new range can't be joined to
815      * dump it into tree(s)
816      */
817     if (range->count > 0 && !page_range_joinable(range, start, count)) {
818         hv_balloon_remove_response_handle_range(balloon, range, both,
819                                                 removedctr);
820     }
821 
822     if (range->count == 0) {
823         range->start = start;
824         range->count = count;
825     } else if (page_range_joinable_left(range, start, count)) {
826         range->start = start;
827         range->count += count;
828     } else { /* page_range_joinable_right() */
829         range->count += count;
830     }
831 }
832 
833 static gboolean hv_balloon_handle_remove_host_addr_node(gpointer key,
834                                                         gpointer value,
835                                                         gpointer data)
836 {
837     PageRange *range = value;
838     uint64_t pageoff;
839 
840     for (pageoff = 0; pageoff < range->count; ) {
841         uint64_t addr_64 = (range->start + pageoff) * HV_BALLOON_PAGE_SIZE;
842         void *addr;
843         RAMBlock *rb;
844         ram_addr_t rb_offset;
845         size_t rb_page_size;
846         size_t discard_size;
847 
848         assert(addr_64 <= UINTPTR_MAX);
849         addr = (void *)((uintptr_t)addr_64);
850         rb = qemu_ram_block_from_host(addr, false, &rb_offset);
851         rb_page_size = qemu_ram_pagesize(rb);
852 
853         if (rb_page_size != HV_BALLOON_PAGE_SIZE) {
854             /* TODO: these should end in "removed_guest" */
855             warn_report("guest reported removed page backed by unsupported page size %zu",
856                         rb_page_size);
857             pageoff++;
858             continue;
859         }
860 
861         discard_size = MIN(range->count - pageoff,
862                            (rb->max_length - rb_offset) /
863                            HV_BALLOON_PAGE_SIZE);
864         discard_size = MAX(discard_size, 1);
865 
866         if (ram_block_discard_range(rb, rb_offset, discard_size *
867                                     HV_BALLOON_PAGE_SIZE) != 0) {
868             warn_report("guest reported removed page failed discard");
869         }
870 
871         pageoff += discard_size;
872     }
873 
874     return false;
875 }
876 
877 static void hv_balloon_handle_remove_host_addr_tree(PageRangeTree tree)
878 {
879     g_tree_foreach(tree.t, hv_balloon_handle_remove_host_addr_node, NULL);
880 }
881 
882 static int hv_balloon_handle_remove_section(PageRangeTree tree,
883                                             const MemoryRegionSection *section,
884                                             uint64_t count)
885 {
886     void *addr = memory_region_get_ram_ptr(section->mr) +
887         section->offset_within_region;
888     uint64_t addr_page;
889 
890     assert(count > 0);
891 
892     if ((uintptr_t)addr % HV_BALLOON_PAGE_SIZE) {
893         warn_report("guest reported removed pages at an unaligned host addr %p",
894                     addr);
895         return -EINVAL;
896     }
897 
898     addr_page = (uintptr_t)addr / HV_BALLOON_PAGE_SIZE;
899     hvb_page_range_tree_insert(tree, addr_page, count, NULL);
900 
901     return 0;
902 }
903 
904 static void hv_balloon_handle_remove_ranges(HvBalloon *balloon,
905                                             union dm_mem_page_range ranges[],
906                                             uint32_t count)
907 {
908     uint64_t removedcnt;
909     PageRangeTree removed_host_addr;
910     PageRange range_guest, range_both;
911 
912     hvb_page_range_tree_init(&removed_host_addr);
913     range_guest.count = range_both.count = removedcnt = 0;
914     for (unsigned int ctr = 0; ctr < count; ctr++) {
915         union dm_mem_page_range *mr = &ranges[ctr];
916         hwaddr pa;
917         MemoryRegionSection section;
918 
919         for (unsigned int offset = 0; offset < mr->finfo.page_cnt; ) {
920             int ret;
921             uint64_t pageno = mr->finfo.start_page + offset;
922             uint64_t pagecnt = 1;
923 
924             pa = (hwaddr)pageno << HV_BALLOON_PFN_SHIFT;
925             section = memory_region_find(get_system_memory(), pa,
926                                          (mr->finfo.page_cnt - offset) *
927                                          HV_BALLOON_PAGE_SIZE);
928             if (!section.mr) {
929                 warn_report("guest reported removed page %"PRIu64" not found in RAM",
930                             pageno);
931                 ret = -EINVAL;
932                 goto finish_page;
933             }
934 
935             pagecnt = int128_get64(section.size) / HV_BALLOON_PAGE_SIZE;
936             if (pagecnt <= 0) {
937                 warn_report("guest reported removed page %"PRIu64" in a section smaller than page size",
938                             pageno);
939                 pagecnt = 1; /* skip the whole page */
940                 ret = -EINVAL;
941                 goto finish_page;
942             }
943 
944             if (!memory_region_is_ram(section.mr) ||
945                 memory_region_is_rom(section.mr) ||
946                 memory_region_is_romd(section.mr)) {
947                 warn_report("guest reported removed page %"PRIu64" in a section that is not an ordinary RAM",
948                             pageno);
949                 ret = -EINVAL;
950                 goto finish_page;
951             }
952 
953             ret = hv_balloon_handle_remove_section(removed_host_addr, &section,
954                                                    pagecnt);
955 
956         finish_page:
957             if (ret == 0) {
958                 hv_balloon_remove_response_handle_pages(balloon,
959                                                         &range_both,
960                                                         pageno, pagecnt,
961                                                         true, &removedcnt);
962             } else {
963                 hv_balloon_remove_response_handle_pages(balloon,
964                                                         &range_guest,
965                                                         pageno, pagecnt,
966                                                         false, &removedcnt);
967             }
968 
969             if (section.mr) {
970                 memory_region_unref(section.mr);
971             }
972 
973             offset += pagecnt;
974         }
975     }
976 
977     hv_balloon_remove_response_handle_range(balloon, &range_both, true,
978                                             &removedcnt);
979     hv_balloon_remove_response_handle_range(balloon, &range_guest, false,
980                                             &removedcnt);
981 
982     hv_balloon_handle_remove_host_addr_tree(removed_host_addr);
983     hvb_page_range_tree_destroy(&removed_host_addr);
984 
985     if (removedcnt > balloon->balloon_diff) {
986         warn_report("guest reported more pages removed than currently pending (%"PRIu64" vs %"PRIu64")",
987                     removedcnt, balloon->balloon_diff);
988         balloon->balloon_diff = 0;
989     } else {
990         balloon->balloon_diff -= removedcnt;
991     }
992 }
993 
994 static bool hv_balloon_handle_msg_size(HvBalloonReq *req, size_t minsize,
995                                        const char *msgname)
996 {
997     VMBusChanReq *vmreq = &req->vmreq;
998     uint32_t msglen = vmreq->msglen;
999 
1000     if (msglen >= minsize) {
1001         return true;
1002     }
1003 
1004     warn_report("%s message too short (%u vs %zu), ignoring", msgname,
1005                 (unsigned int)msglen, minsize);
1006     return false;
1007 }
1008 
1009 static void hv_balloon_handle_version_request(HvBalloon *balloon,
1010                                               HvBalloonReq *req,
1011                                               StateDesc *stdesc)
1012 {
1013     VMBusChanReq *vmreq = &req->vmreq;
1014     struct dm_version_request *msgVr = vmreq->msg;
1015     struct dm_version_response respVr;
1016 
1017     if (balloon->state != S_VERSION) {
1018         warn_report("unexpected DM_VERSION_REQUEST in %d state",
1019                     balloon->state);
1020         return;
1021     }
1022 
1023     if (!hv_balloon_handle_msg_size(req, sizeof(*msgVr),
1024                                     "DM_VERSION_REQUEST")) {
1025         return;
1026     }
1027 
1028     trace_hv_balloon_incoming_version(msgVr->version.major_version,
1029                                       msgVr->version.minor_version);
1030 
1031     memset(&respVr, 0, sizeof(respVr));
1032     respVr.hdr.type = DM_VERSION_RESPONSE;
1033     respVr.hdr.size = sizeof(respVr);
1034     respVr.hdr.trans_id = msgVr->hdr.trans_id;
1035     respVr.is_accepted = msgVr->version.version >= DYNMEM_PROTOCOL_VERSION_1 &&
1036         msgVr->version.version <= DYNMEM_PROTOCOL_VERSION_3;
1037 
1038     hv_balloon_send_packet(vmreq->chan, (struct dm_message *)&respVr);
1039 
1040     if (respVr.is_accepted) {
1041         HV_BALLOON_STATE_DESC_SET(stdesc, S_CAPS);
1042     }
1043 }
1044 
1045 static void hv_balloon_handle_caps_report(HvBalloon *balloon,
1046                                           HvBalloonReq *req,
1047                                           StateDesc *stdesc)
1048 {
1049     VMBusChanReq *vmreq = &req->vmreq;
1050     struct dm_capabilities *msgCap = vmreq->msg;
1051     struct dm_capabilities_resp_msg respCap;
1052 
1053     if (balloon->state != S_CAPS) {
1054         warn_report("unexpected DM_CAPABILITIES_REPORT in %d state",
1055                     balloon->state);
1056         return;
1057     }
1058 
1059     if (!hv_balloon_handle_msg_size(req, sizeof(*msgCap),
1060                                     "DM_CAPABILITIES_REPORT")) {
1061         return;
1062     }
1063 
1064     trace_hv_balloon_incoming_caps(msgCap->caps.caps);
1065     balloon->caps = msgCap->caps;
1066 
1067     memset(&respCap, 0, sizeof(respCap));
1068     respCap.hdr.type = DM_CAPABILITIES_RESPONSE;
1069     respCap.hdr.size = sizeof(respCap);
1070     respCap.hdr.trans_id = msgCap->hdr.trans_id;
1071     respCap.is_accepted = 1;
1072     respCap.hot_remove = 1;
1073     respCap.suppress_pressure_reports = !balloon->status_report.enabled;
1074     hv_balloon_send_packet(vmreq->chan, (struct dm_message *)&respCap);
1075 
1076     timer_mod(&balloon->post_init_timer,
1077               qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
1078               HV_BALLOON_POST_INIT_WAIT);
1079 
1080     HV_BALLOON_STATE_DESC_SET(stdesc, S_POST_INIT_WAIT);
1081 }
1082 
1083 static void hv_balloon_handle_status_report(HvBalloon *balloon,
1084                                             HvBalloonReq *req)
1085 {
1086     VMBusChanReq *vmreq = &req->vmreq;
1087     struct dm_status *msgStatus = vmreq->msg;
1088 
1089     if (!hv_balloon_handle_msg_size(req, sizeof(*msgStatus),
1090                                     "DM_STATUS_REPORT")) {
1091         return;
1092     }
1093 
1094     if (!balloon->status_report.enabled) {
1095         return;
1096     }
1097 
1098     balloon->status_report.committed = msgStatus->num_committed;
1099     balloon->status_report.committed *= HV_BALLOON_PAGE_SIZE;
1100     balloon->status_report.available = msgStatus->num_avail;
1101     balloon->status_report.available *= HV_BALLOON_PAGE_SIZE;
1102     balloon->status_report.received = true;
1103 
1104     qapi_event_send_hv_balloon_status_report(balloon->status_report.committed,
1105                                              balloon->status_report.available);
1106 }
1107 
1108 HvBalloonInfo *qmp_query_hv_balloon_status_report(Error **errp)
1109 {
1110     HvBalloon *balloon;
1111     HvBalloonInfo *info;
1112 
1113     balloon = HV_BALLOON(object_resolve_path_type("", TYPE_HV_BALLOON, NULL));
1114     if (!balloon) {
1115         error_setg(errp, "no %s device present", TYPE_HV_BALLOON);
1116         return NULL;
1117     }
1118 
1119     if (!balloon->status_report.enabled) {
1120         error_setg(errp, "guest memory status reporting not enabled");
1121         return NULL;
1122     }
1123 
1124     if (!balloon->status_report.received) {
1125         error_setg(errp, "no guest memory status report received yet");
1126         return NULL;
1127     }
1128 
1129     info = g_malloc0(sizeof(*info));
1130     info->committed = balloon->status_report.committed;
1131     info->available = balloon->status_report.available;
1132     return info;
1133 }
1134 
1135 static void hv_balloon_handle_unballoon_response(HvBalloon *balloon,
1136                                                  HvBalloonReq *req,
1137                                                  StateDesc *stdesc)
1138 {
1139     VMBusChanReq *vmreq = &req->vmreq;
1140     struct dm_unballoon_response *msgUrR = vmreq->msg;
1141 
1142     if (balloon->state != S_UNBALLOON_REPLY_WAIT) {
1143         warn_report("unexpected DM_UNBALLOON_RESPONSE in %d state",
1144                     balloon->state);
1145         return;
1146     }
1147 
1148     if (!hv_balloon_handle_msg_size(req, sizeof(*msgUrR),
1149                                     "DM_UNBALLOON_RESPONSE"))
1150         return;
1151 
1152     trace_hv_balloon_incoming_unballoon(msgUrR->hdr.trans_id);
1153 
1154     balloon->trans_id++;
1155 
1156     if (balloon->hot_add_diff > 0) {
1157         bool can_hot_add = balloon->caps.cap_bits.hot_add;
1158 
1159         assert(can_hot_add);
1160         HV_BALLOON_STATE_DESC_SET(stdesc, S_HOT_ADD_SETUP);
1161     } else {
1162         HV_BALLOON_STATE_DESC_SET(stdesc, S_IDLE);
1163     }
1164 }
1165 
1166 static void hv_balloon_handle_hot_add_response(HvBalloon *balloon,
1167                                                HvBalloonReq *req,
1168                                                StateDesc *stdesc)
1169 {
1170     PageRange *hot_add_range = &balloon->hot_add_range;
1171     VMBusChanReq *vmreq = &req->vmreq;
1172     struct dm_hot_add_response *msgHaR = vmreq->msg;
1173     OurRange *our_range;
1174 
1175     if (balloon->state != S_HOT_ADD_REPLY_WAIT) {
1176         warn_report("unexpected DM_HOT_ADD_RESPONSE in %d state",
1177                     balloon->state);
1178         return;
1179     }
1180 
1181     assert(balloon->our_range);
1182     our_range = OUR_RANGE(balloon->our_range);
1183 
1184     if (!hv_balloon_handle_msg_size(req, sizeof(*msgHaR),
1185                                     "DM_HOT_ADD_RESPONSE"))
1186         return;
1187 
1188     trace_hv_balloon_incoming_hot_add(msgHaR->hdr.trans_id, msgHaR->result,
1189                                       msgHaR->page_count);
1190 
1191     balloon->trans_id++;
1192 
1193     if (msgHaR->result) {
1194         if (msgHaR->page_count > balloon->ha_current_count) {
1195             warn_report("DM_HOT_ADD_RESPONSE page count higher than requested (%"PRIu32" vs %"PRIu64")",
1196                         msgHaR->page_count, balloon->ha_current_count);
1197             msgHaR->page_count = balloon->ha_current_count;
1198         }
1199 
1200         hvb_our_range_mark_added(our_range, msgHaR->page_count);
1201         hot_add_range->start += msgHaR->page_count;
1202         hot_add_range->count -= msgHaR->page_count;
1203     }
1204 
1205     if (!msgHaR->result || msgHaR->page_count < balloon->ha_current_count) {
1206         /*
1207          * the current planned range was only partially hot-added, take note
1208          * how much of it remains and don't attempt any further hot adds
1209          */
1210         our_range_mark_remaining_unusable(our_range);
1211 
1212         goto ret_idle;
1213     }
1214 
1215     /* any pages remaining to hot-add in our range? */
1216     if (hot_add_range->count > 0) {
1217         HV_BALLOON_STATE_DESC_SET(stdesc, S_HOT_ADD_RB_WAIT);
1218         return;
1219     }
1220 
1221 ret_idle:
1222     HV_BALLOON_STATE_DESC_SET(stdesc, S_IDLE);
1223 }
1224 
1225 static void hv_balloon_handle_balloon_response(HvBalloon *balloon,
1226                                                HvBalloonReq *req,
1227                                                StateDesc *stdesc)
1228 {
1229     VMBusChanReq *vmreq = &req->vmreq;
1230     struct dm_balloon_response *msgBR = vmreq->msg;
1231 
1232     if (balloon->state != S_BALLOON_REPLY_WAIT) {
1233         warn_report("unexpected DM_BALLOON_RESPONSE in %d state",
1234                     balloon->state);
1235         return;
1236     }
1237 
1238     if (!hv_balloon_handle_msg_size(req, sizeof(*msgBR),
1239                                     "DM_BALLOON_RESPONSE"))
1240         return;
1241 
1242     trace_hv_balloon_incoming_balloon(msgBR->hdr.trans_id, msgBR->range_count,
1243                                       msgBR->more_pages);
1244 
1245     if (vmreq->msglen < sizeof(*msgBR) +
1246         (uint64_t)sizeof(msgBR->range_array[0]) * msgBR->range_count) {
1247         warn_report("DM_BALLOON_RESPONSE too short for the range count");
1248         return;
1249     }
1250 
1251     if (msgBR->range_count == 0) {
1252         /* The guest is already at its minimum size */
1253         balloon->balloon_diff = 0;
1254         goto ret_end_trans;
1255     } else {
1256         hv_balloon_handle_remove_ranges(balloon,
1257                                         msgBR->range_array,
1258                                         msgBR->range_count);
1259     }
1260 
1261     /* More responses expected? */
1262     if (msgBR->more_pages) {
1263         return;
1264     }
1265 
1266 ret_end_trans:
1267     balloon->trans_id++;
1268 
1269     if (balloon->balloon_diff > 0) {
1270         HV_BALLOON_STATE_DESC_SET(stdesc, S_BALLOON_RB_WAIT);
1271     } else {
1272         HV_BALLOON_STATE_DESC_SET(stdesc, S_IDLE);
1273     }
1274 }
1275 
1276 static void hv_balloon_handle_packet(HvBalloon *balloon, HvBalloonReq *req,
1277                                      StateDesc *stdesc)
1278 {
1279     VMBusChanReq *vmreq = &req->vmreq;
1280     struct dm_message *msg = vmreq->msg;
1281 
1282     if (vmreq->msglen < sizeof(msg->hdr)) {
1283         return;
1284     }
1285 
1286     switch (msg->hdr.type) {
1287     case DM_VERSION_REQUEST:
1288         hv_balloon_handle_version_request(balloon, req, stdesc);
1289         break;
1290 
1291     case DM_CAPABILITIES_REPORT:
1292         hv_balloon_handle_caps_report(balloon, req, stdesc);
1293         break;
1294 
1295     case DM_STATUS_REPORT:
1296         hv_balloon_handle_status_report(balloon, req);
1297         break;
1298 
1299     case DM_MEM_HOT_ADD_RESPONSE:
1300         hv_balloon_handle_hot_add_response(balloon, req, stdesc);
1301         break;
1302 
1303     case DM_UNBALLOON_RESPONSE:
1304         hv_balloon_handle_unballoon_response(balloon, req, stdesc);
1305         break;
1306 
1307     case DM_BALLOON_RESPONSE:
1308         hv_balloon_handle_balloon_response(balloon, req, stdesc);
1309         break;
1310 
1311     default:
1312         warn_report("unknown DM message %u", msg->hdr.type);
1313         break;
1314     }
1315 }
1316 
1317 static bool hv_balloon_recv_channel(HvBalloon *balloon, StateDesc *stdesc)
1318 {
1319     VMBusChannel *chan;
1320     HvBalloonReq *req;
1321 
1322     if (balloon->state == S_WAIT_RESET ||
1323         balloon->state == S_POST_RESET_CLOSED) {
1324         return false;
1325     }
1326 
1327     chan = hv_balloon_get_channel(balloon);
1328     if (vmbus_channel_recv_start(chan)) {
1329         return false;
1330     }
1331 
1332     while ((req = vmbus_channel_recv_peek(chan, sizeof(*req)))) {
1333         hv_balloon_handle_packet(balloon, req, stdesc);
1334         vmbus_free_req(req);
1335         vmbus_channel_recv_pop(chan);
1336 
1337         if (stdesc->state != S_NO_CHANGE) {
1338             break;
1339         }
1340     }
1341 
1342     return vmbus_channel_recv_done(chan) > 0;
1343 }
1344 
1345 /* old state handler -> new state transition (potential) */
1346 static bool hv_balloon_event_loop_state(HvBalloon *balloon)
1347 {
1348     StateDesc state_new = HV_BALLOON_STATE_DESC_INIT;
1349 
1350     hv_balloon_handle_state(balloon, &state_new);
1351     return hv_balloon_state_set(balloon, state_new.state, state_new.desc);
1352 }
1353 
1354 /* VMBus message -> new state transition (potential) */
1355 static bool hv_balloon_event_loop_recv(HvBalloon *balloon)
1356 {
1357     StateDesc state_new = HV_BALLOON_STATE_DESC_INIT;
1358     bool any_recv, state_changed;
1359 
1360     any_recv = hv_balloon_recv_channel(balloon, &state_new);
1361     state_changed = hv_balloon_state_set(balloon,
1362                                          state_new.state, state_new.desc);
1363 
1364     return state_changed || any_recv;
1365 }
1366 
1367 static void hv_balloon_event_loop(HvBalloon *balloon)
1368 {
1369     bool state_repeat, recv_repeat;
1370 
1371     do {
1372         state_repeat = hv_balloon_event_loop_state(balloon);
1373         recv_repeat = hv_balloon_event_loop_recv(balloon);
1374     } while (state_repeat || recv_repeat);
1375 }
1376 
1377 static void hv_balloon_vmdev_chan_notify(VMBusChannel *chan)
1378 {
1379     HvBalloon *balloon = HV_BALLOON(vmbus_channel_device(chan));
1380 
1381     hv_balloon_event_loop(balloon);
1382 }
1383 
1384 static void hv_balloon_stat(void *opaque, BalloonInfo *info)
1385 {
1386     HvBalloon *balloon = opaque;
1387     info->actual = (hv_balloon_total_ram(balloon) - balloon->removed_both_ctr)
1388         << HV_BALLOON_PFN_SHIFT;
1389 }
1390 
1391 static void hv_balloon_to_target(void *opaque, ram_addr_t target)
1392 {
1393     HvBalloon *balloon = opaque;
1394     uint64_t target_pages = target >> HV_BALLOON_PFN_SHIFT;
1395 
1396     if (!target_pages) {
1397         return;
1398     }
1399 
1400     /*
1401      * always set target_changed, even with unchanged target, as the user
1402      * might be asking us to try again reaching it
1403      */
1404     balloon->target = target_pages;
1405     balloon->target_changed = true;
1406 
1407     hv_balloon_event_loop(balloon);
1408 }
1409 
1410 static int hv_balloon_vmdev_open_channel(VMBusChannel *chan)
1411 {
1412     HvBalloon *balloon = HV_BALLOON(vmbus_channel_device(chan));
1413 
1414     if (balloon->state != S_POST_RESET_CLOSED) {
1415         warn_report("guest trying to open a DM channel in invalid %d state",
1416                     balloon->state);
1417         return -EINVAL;
1418     }
1419 
1420     HV_BALLOON_SET_STATE(balloon, S_VERSION);
1421     hv_balloon_event_loop(balloon);
1422 
1423     return 0;
1424 }
1425 
1426 static void hv_balloon_vmdev_close_channel(VMBusChannel *chan)
1427 {
1428     HvBalloon *balloon = HV_BALLOON(vmbus_channel_device(chan));
1429 
1430     timer_del(&balloon->post_init_timer);
1431 
1432     /* Don't report stale data */
1433     balloon->status_report.received = false;
1434 
1435     HV_BALLOON_SET_STATE(balloon, S_WAIT_RESET);
1436     hv_balloon_event_loop(balloon);
1437 }
1438 
1439 static void hv_balloon_post_init_timer(void *opaque)
1440 {
1441     HvBalloon *balloon = opaque;
1442 
1443     if (balloon->state != S_POST_INIT_WAIT) {
1444         return;
1445     }
1446 
1447     HV_BALLOON_SET_STATE(balloon, S_IDLE);
1448     hv_balloon_event_loop(balloon);
1449 }
1450 
1451 static void hv_balloon_system_reset_unrealize_common(HvBalloon *balloon)
1452 {
1453     g_clear_pointer(&balloon->our_range, hvb_our_range_memslots_free);
1454 }
1455 
1456 static void hv_balloon_system_reset(void *opaque)
1457 {
1458     HvBalloon *balloon = HV_BALLOON(opaque);
1459 
1460     hv_balloon_system_reset_unrealize_common(balloon);
1461 }
1462 
1463 static void hv_balloon_ensure_mr(HvBalloon *balloon)
1464 {
1465     MemoryRegion *hostmem_mr;
1466 
1467     assert(balloon->hostmem);
1468 
1469     if (balloon->mr) {
1470         return;
1471     }
1472 
1473     hostmem_mr = host_memory_backend_get_memory(balloon->hostmem);
1474 
1475     balloon->mr = g_new0(MemoryRegion, 1);
1476     memory_region_init(balloon->mr, OBJECT(balloon), TYPE_HV_BALLOON,
1477                        memory_region_size(hostmem_mr));
1478     balloon->mr->align = memory_region_get_alignment(hostmem_mr);
1479 }
1480 
1481 static void hv_balloon_free_mr(HvBalloon *balloon)
1482 {
1483     if (!balloon->mr) {
1484         return;
1485     }
1486 
1487     object_unparent(OBJECT(balloon->mr));
1488     g_clear_pointer(&balloon->mr, g_free);
1489 }
1490 
1491 static void hv_balloon_vmdev_realize(VMBusDevice *vdev, Error **errp)
1492 {
1493     ERRP_GUARD();
1494     HvBalloon *balloon = HV_BALLOON(vdev);
1495     int ret;
1496 
1497     balloon->state = S_WAIT_RESET;
1498 
1499     ret = qemu_add_balloon_handler(hv_balloon_to_target, hv_balloon_stat,
1500                                    balloon);
1501     if (ret < 0) {
1502         /* This also protects against having multiple hv-balloon instances */
1503         error_setg(errp, "Only one balloon device is supported");
1504         return;
1505     }
1506 
1507     if (balloon->hostmem) {
1508         if (host_memory_backend_is_mapped(balloon->hostmem)) {
1509             Object *obj = OBJECT(balloon->hostmem);
1510 
1511             error_setg(errp, "'%s' property specifies a busy memdev: %s",
1512                        HV_BALLOON_MEMDEV_PROP,
1513                        object_get_canonical_path_component(obj));
1514             goto out_balloon_handler;
1515         }
1516 
1517         hv_balloon_ensure_mr(balloon);
1518 
1519         /* This is rather unlikely to happen, but let's still check for it. */
1520         if (!QEMU_IS_ALIGNED(memory_region_size(balloon->mr),
1521                              HV_BALLOON_PAGE_SIZE)) {
1522             error_setg(errp, "'%s' property memdev size has to be a multiple of 0x%" PRIx64,
1523                        HV_BALLOON_MEMDEV_PROP, (uint64_t)HV_BALLOON_PAGE_SIZE);
1524             goto out_balloon_handler;
1525         }
1526 
1527         host_memory_backend_set_mapped(balloon->hostmem, true);
1528         vmstate_register_ram(host_memory_backend_get_memory(balloon->hostmem),
1529                              DEVICE(balloon));
1530     } else if (balloon->addr) {
1531         error_setg(errp, "'%s' property must not be set without a memdev",
1532                    HV_BALLOON_MEMDEV_PROP);
1533         goto out_balloon_handler;
1534     }
1535 
1536     timer_init_ms(&balloon->post_init_timer, QEMU_CLOCK_VIRTUAL,
1537                   hv_balloon_post_init_timer, balloon);
1538 
1539     qemu_register_reset(hv_balloon_system_reset, balloon);
1540 
1541     return;
1542 
1543 out_balloon_handler:
1544     qemu_remove_balloon_handler(balloon);
1545 }
1546 
1547 /*
1548  * VMBus device reset has to be implemented in case the guest decides to
1549  * disconnect and reconnect to the VMBus without rebooting the whole system.
1550  *
1551  * However, the hot-added memory can't be removed here as Windows keeps on using
1552  * it until the system is restarted, even after disconnecting from the VMBus.
1553  */
1554 static void hv_balloon_vmdev_reset(VMBusDevice *vdev)
1555 {
1556     HvBalloon *balloon = HV_BALLOON(vdev);
1557 
1558     if (balloon->state == S_POST_RESET_CLOSED) {
1559         return;
1560     }
1561 
1562     if (balloon->our_range) {
1563         hvb_our_range_clear_removed_trees(OUR_RANGE(balloon->our_range));
1564     }
1565 
1566     hvb_page_range_tree_destroy(&balloon->removed_guest);
1567     hvb_page_range_tree_destroy(&balloon->removed_both);
1568     hvb_page_range_tree_init(&balloon->removed_guest);
1569     hvb_page_range_tree_init(&balloon->removed_both);
1570 
1571     balloon->trans_id = 0;
1572     balloon->removed_guest_ctr = 0;
1573     balloon->removed_both_ctr = 0;
1574 
1575     HV_BALLOON_SET_STATE(balloon, S_POST_RESET_CLOSED);
1576     hv_balloon_event_loop(balloon);
1577 }
1578 
1579 /*
1580  * Clean up things that were (possibly) allocated pre-realization, for example
1581  * from memory_device_pre_plug(), so we don't leak them if the device don't
1582  * actually get realized in the end.
1583  */
1584 static void hv_balloon_unrealize_finalize_common(HvBalloon *balloon)
1585 {
1586     hv_balloon_free_mr(balloon);
1587     balloon->addr = 0;
1588 
1589     balloon->memslot_count = 0;
1590 }
1591 
1592 static void hv_balloon_vmdev_unrealize(VMBusDevice *vdev)
1593 {
1594     HvBalloon *balloon = HV_BALLOON(vdev);
1595 
1596     qemu_unregister_reset(hv_balloon_system_reset, balloon);
1597 
1598     hv_balloon_system_reset_unrealize_common(balloon);
1599 
1600     qemu_remove_balloon_handler(balloon);
1601 
1602     if (balloon->hostmem) {
1603         vmstate_unregister_ram(host_memory_backend_get_memory(balloon->hostmem),
1604                                DEVICE(balloon));
1605         host_memory_backend_set_mapped(balloon->hostmem, false);
1606     }
1607 
1608     hvb_page_range_tree_destroy(&balloon->removed_guest);
1609     hvb_page_range_tree_destroy(&balloon->removed_both);
1610 
1611     hv_balloon_unrealize_finalize_common(balloon);
1612 }
1613 
1614 static uint64_t hv_balloon_md_get_addr(const MemoryDeviceState *md)
1615 {
1616     return object_property_get_uint(OBJECT(md), HV_BALLOON_ADDR_PROP,
1617                                     &error_abort);
1618 }
1619 
1620 static void hv_balloon_md_set_addr(MemoryDeviceState *md, uint64_t addr,
1621                                    Error **errp)
1622 {
1623     object_property_set_uint(OBJECT(md), HV_BALLOON_ADDR_PROP, addr, errp);
1624 }
1625 
1626 static MemoryRegion *hv_balloon_md_get_memory_region(MemoryDeviceState *md,
1627                                                      Error **errp)
1628 {
1629     HvBalloon *balloon = HV_BALLOON(md);
1630 
1631     if (!balloon->hostmem) {
1632         return NULL;
1633     }
1634 
1635     hv_balloon_ensure_mr(balloon);
1636 
1637     return balloon->mr;
1638 }
1639 
1640 static uint64_t hv_balloon_md_get_min_alignment(const MemoryDeviceState *md)
1641 {
1642     /*
1643      * The VM can indicate an alignment up to 32 GiB. Memory device core can
1644      * usually only handle/guarantee 1 GiB alignment. The user will have to
1645      * specify a larger maxmem eventually.
1646      *
1647      * The memory device core will warn the user in case maxmem might have to be
1648      * increased and will fail plugging the device if there is not sufficient
1649      * space after alignment.
1650      *
1651      * TODO: we could do the alignment ourselves in a slightly bigger region.
1652      * But this feels better, although the warning might be annoying. Maybe
1653      * we can optimize that in the future (e.g., with such a device on the
1654      * cmdline place/size the device memory region differently.
1655      */
1656     return 32 * GiB;
1657 }
1658 
1659 static void hv_balloon_md_fill_device_info(const MemoryDeviceState *md,
1660                                            MemoryDeviceInfo *info)
1661 {
1662     HvBalloonDeviceInfo *hi = g_new0(HvBalloonDeviceInfo, 1);
1663     const HvBalloon *balloon = HV_BALLOON(md);
1664     DeviceState *dev = DEVICE(md);
1665 
1666     if (dev->id) {
1667         hi->id = g_strdup(dev->id);
1668     }
1669 
1670     if (balloon->hostmem) {
1671         hi->memdev = object_get_canonical_path(OBJECT(balloon->hostmem));
1672         hi->memaddr = balloon->addr;
1673         hi->has_memaddr = true;
1674         hi->max_size = memory_region_size(balloon->mr);
1675         /* TODO: expose current provided size or something else? */
1676     } else {
1677         hi->max_size = 0;
1678     }
1679 
1680     info->u.hv_balloon.data = hi;
1681     info->type = MEMORY_DEVICE_INFO_KIND_HV_BALLOON;
1682 }
1683 
1684 static void hv_balloon_decide_memslots(MemoryDeviceState *md,
1685                                        unsigned int limit)
1686 {
1687     HvBalloon *balloon = HV_BALLOON(md);
1688     MemoryRegion *hostmem_mr;
1689     uint64_t region_size, memslot_size, memslots;
1690 
1691     /* We're called exactly once, before realizing the device. */
1692     assert(!balloon->memslot_count);
1693 
1694     /* We should not be called if we don't have a memory backend */
1695     assert(balloon->hostmem);
1696 
1697     hostmem_mr = host_memory_backend_get_memory(balloon->hostmem);
1698     region_size = memory_region_size(hostmem_mr);
1699 
1700     assert(region_size > 0);
1701     memslot_size = QEMU_ALIGN_UP(region_size / limit,
1702                                  HV_BALLOON_HA_MEMSLOT_SIZE_ALIGN);
1703     memslots = QEMU_ALIGN_UP(region_size, memslot_size) / memslot_size;
1704 
1705     if (memslots > 1) {
1706         balloon->memslot_size = memslot_size;
1707     } else {
1708         balloon->memslot_size = region_size;
1709     }
1710 
1711     assert(memslots <= UINT_MAX);
1712     balloon->memslot_count = memslots;
1713 }
1714 
1715 static unsigned int hv_balloon_get_memslots(MemoryDeviceState *md)
1716 {
1717     const HvBalloon *balloon = HV_BALLOON(md);
1718 
1719     /* We're called after setting the suggested limit. */
1720     assert(balloon->memslot_count > 0);
1721 
1722     return balloon->memslot_count;
1723 }
1724 
1725 static void hv_balloon_init(Object *obj)
1726 {
1727 }
1728 
1729 static void hv_balloon_finalize(Object *obj)
1730 {
1731     HvBalloon *balloon = HV_BALLOON(obj);
1732 
1733     hv_balloon_unrealize_finalize_common(balloon);
1734 }
1735 
1736 static Property hv_balloon_properties[] = {
1737     DEFINE_PROP_BOOL("status-report", HvBalloon,
1738                      status_report.enabled, false),
1739 
1740     /* MEMORY_DEVICE props */
1741     DEFINE_PROP_LINK(HV_BALLOON_MEMDEV_PROP, HvBalloon, hostmem,
1742                      TYPE_MEMORY_BACKEND, HostMemoryBackend *),
1743     DEFINE_PROP_UINT64(HV_BALLOON_ADDR_PROP, HvBalloon, addr, 0),
1744 
1745     DEFINE_PROP_END_OF_LIST(),
1746 };
1747 
1748 static void hv_balloon_class_init(ObjectClass *klass, void *data)
1749 {
1750     DeviceClass *dc = DEVICE_CLASS(klass);
1751     VMBusDeviceClass *vdc = VMBUS_DEVICE_CLASS(klass);
1752     MemoryDeviceClass *mdc = MEMORY_DEVICE_CLASS(klass);
1753 
1754     device_class_set_props(dc, hv_balloon_properties);
1755     qemu_uuid_parse(HV_BALLOON_GUID, &vdc->classid);
1756     set_bit(DEVICE_CATEGORY_MISC, dc->categories);
1757 
1758     vdc->vmdev_realize = hv_balloon_vmdev_realize;
1759     vdc->vmdev_unrealize = hv_balloon_vmdev_unrealize;
1760     vdc->vmdev_reset = hv_balloon_vmdev_reset;
1761     vdc->open_channel = hv_balloon_vmdev_open_channel;
1762     vdc->close_channel = hv_balloon_vmdev_close_channel;
1763     vdc->chan_notify_cb = hv_balloon_vmdev_chan_notify;
1764 
1765     mdc->get_addr = hv_balloon_md_get_addr;
1766     mdc->set_addr = hv_balloon_md_set_addr;
1767     mdc->get_plugged_size = memory_device_get_region_size;
1768     mdc->get_memory_region = hv_balloon_md_get_memory_region;
1769     mdc->decide_memslots = hv_balloon_decide_memslots;
1770     mdc->get_memslots = hv_balloon_get_memslots;
1771     mdc->get_min_alignment = hv_balloon_md_get_min_alignment;
1772     mdc->fill_device_info = hv_balloon_md_fill_device_info;
1773 }
1774