hw/virtio-balloon.c - third_party/qemu - Git at Google

 /*
  * Virtio Balloon Device
  *
  * Copyright IBM, Corp. 2008
  * Copyright (C) 2011 Red Hat, Inc.
  * Copyright (C) 2011 Amit Shah <amit.shah@redhat.com>
  *
  * Authors:
  *  Anthony Liguori   <aliguori@us.ibm.com>
  *
  * This work is licensed under the terms of the GNU GPL, version 2.  See
  * the COPYING file in the top-level directory.
  *
  */

 #include "qemu/iov.h"
 #include "qemu/timer.h"
 #include "qemu-common.h"
 #include "virtio.h"
 #include "pc.h"
 #include "cpu.h"
 #include "sysemu/balloon.h"
 #include "virtio-balloon.h"
 #include "sysemu/kvm.h"
 #include "exec/address-spaces.h"
 #include "qapi/visitor.h"

 #if defined(__linux__)
 #include <sys/mman.h>
 #endif

 typedef struct VirtIOBalloon
 {
     VirtIODevice vdev;
     VirtQueue *ivq, *dvq, *svq;
     uint32_t num_pages;
     uint32_t actual;
     uint64_t stats[VIRTIO_BALLOON_S_NR];
     VirtQueueElement stats_vq_elem;
     size_t stats_vq_offset;
     QEMUTimer *stats_timer;
     int64_t stats_last_update;
     int64_t stats_poll_interval;
     DeviceState *qdev;
 } VirtIOBalloon;

 static VirtIOBalloon *to_virtio_balloon(VirtIODevice *vdev)
 {
     return (VirtIOBalloon *)vdev;
 }

 static void balloon_page(void *addr, int deflate)
 {
 #if defined(__linux__)
     if (!kvm_enabled() || kvm_has_sync_mmu())
         qemu_madvise(addr, TARGET_PAGE_SIZE,
                 deflate ? QEMU_MADV_WILLNEED : QEMU_MADV_DONTNEED);
 #endif
 }

 static const char *balloon_stat_names[] = {
    [VIRTIO_BALLOON_S_SWAP_IN] = "stat-swap-in",
    [VIRTIO_BALLOON_S_SWAP_OUT] = "stat-swap-out",
    [VIRTIO_BALLOON_S_MAJFLT] = "stat-major-faults",
    [VIRTIO_BALLOON_S_MINFLT] = "stat-minor-faults",
    [VIRTIO_BALLOON_S_MEMFREE] = "stat-free-memory",
    [VIRTIO_BALLOON_S_MEMTOT] = "stat-total-memory",
    [VIRTIO_BALLOON_S_NR] = NULL
 };

 /*
  * reset_stats - Mark all items in the stats array as unset
  *
  * This function needs to be called at device intialization and before
  * before updating to a set of newly-generated stats.  This will ensure that no
  * stale values stick around in case the guest reports a subset of the supported
  * statistics.
  */
 static inline void reset_stats(VirtIOBalloon *dev)
 {
     int i;
     for (i = 0; i < VIRTIO_BALLOON_S_NR; dev->stats[i++] = -1);
 }

 static bool balloon_stats_supported(const VirtIOBalloon *s)
 {
     return s->vdev.guest_features & (1 << VIRTIO_BALLOON_F_STATS_VQ);
 }

 static bool balloon_stats_enabled(const VirtIOBalloon *s)
 {
     return s->stats_poll_interval > 0;
 }

 static void balloon_stats_destroy_timer(VirtIOBalloon *s)
 {
     if (balloon_stats_enabled(s)) {
         qemu_del_timer(s->stats_timer);
         qemu_free_timer(s->stats_timer);
         s->stats_timer = NULL;
         s->stats_poll_interval = 0;
     }
 }

 static void balloon_stats_change_timer(VirtIOBalloon *s, int secs)
 {
     qemu_mod_timer(s->stats_timer, qemu_get_clock_ms(vm_clock) + secs * 1000);
 }

 static void balloon_stats_poll_cb(void *opaque)
 {
     VirtIOBalloon *s = opaque;

     if (!balloon_stats_supported(s)) {
         /* re-schedule */
         balloon_stats_change_timer(s, s->stats_poll_interval);
         return;
     }

     virtqueue_push(s->svq, &s->stats_vq_elem, s->stats_vq_offset);
     virtio_notify(&s->vdev, s->svq);
 }

 static void balloon_stats_get_all(Object *obj, struct Visitor *v,
                                   void *opaque, const char *name, Error **errp)
 {
     VirtIOBalloon *s = opaque;
     int i;

     if (!s->stats_last_update) {
         error_setg(errp, "guest hasn't updated any stats yet");
         return;
     }

     visit_start_struct(v, NULL, "guest-stats", name, 0, errp);
     visit_type_int(v, &s->stats_last_update, "last-update", errp);

     visit_start_struct(v, NULL, NULL, "stats", 0, errp);
     for (i = 0; i < VIRTIO_BALLOON_S_NR; i++) {
         visit_type_int64(v, (int64_t *) &s->stats[i], balloon_stat_names[i],
                          errp);
     }
     visit_end_struct(v, errp);

     visit_end_struct(v, errp);
 }

 static void balloon_stats_get_poll_interval(Object *obj, struct Visitor *v,
                                             void *opaque, const char *name,
                                             Error **errp)
 {
     VirtIOBalloon *s = opaque;
     visit_type_int(v, &s->stats_poll_interval, name, errp);
 }

 static void balloon_stats_set_poll_interval(Object *obj, struct Visitor *v,
                                             void *opaque, const char *name,
                                             Error **errp)
 {
     VirtIOBalloon *s = opaque;
     int64_t value;

     visit_type_int(v, &value, name, errp);
     if (error_is_set(errp)) {
         return;
     }

     if (value < 0) {
         error_setg(errp, "timer value must be greater than zero");
         return;
     }

     if (value == s->stats_poll_interval) {
         return;
     }

     if (value == 0) {
         /* timer=0 disables the timer */
         balloon_stats_destroy_timer(s);
         return;
     }

     if (balloon_stats_enabled(s)) {
         /* timer interval change */
         s->stats_poll_interval = value;
         balloon_stats_change_timer(s, value);
         return;
     }

     /* create a new timer */
     g_assert(s->stats_timer == NULL);
     s->stats_timer = qemu_new_timer_ms(vm_clock, balloon_stats_poll_cb, s);
     s->stats_poll_interval = value;
     balloon_stats_change_timer(s, 0);
 }

 static void virtio_balloon_handle_output(VirtIODevice *vdev, VirtQueue *vq)
 {
     VirtIOBalloon *s = to_virtio_balloon(vdev);
     VirtQueueElement elem;
     MemoryRegionSection section;

     while (virtqueue_pop(vq, &elem)) {
         size_t offset = 0;
         uint32_t pfn;

         while (iov_to_buf(elem.out_sg, elem.out_num, offset, &pfn, 4) == 4) {
             ram_addr_t pa;
             ram_addr_t addr;

             pa = (ram_addr_t)ldl_p(&pfn) << VIRTIO_BALLOON_PFN_SHIFT;
             offset += 4;

             /* FIXME: remove get_system_memory(), but how? */
             section = memory_region_find(get_system_memory(), pa, 1);
             if (!section.size || !memory_region_is_ram(section.mr))
                 continue;

             /* Using memory_region_get_ram_ptr is bending the rules a bit, but
                should be OK because we only want a single page.  */
             addr = section.offset_within_region;
             balloon_page(memory_region_get_ram_ptr(section.mr) + addr,
                          !!(vq == s->dvq));
         }

         virtqueue_push(vq, &elem, offset);
         virtio_notify(vdev, vq);
     }
 }

 static void virtio_balloon_receive_stats(VirtIODevice *vdev, VirtQueue *vq)
 {
     VirtIOBalloon *s = DO_UPCAST(VirtIOBalloon, vdev, vdev);
     VirtQueueElement *elem = &s->stats_vq_elem;
     VirtIOBalloonStat stat;
     size_t offset = 0;
     qemu_timeval tv;

     if (!virtqueue_pop(vq, elem)) {
         goto out;
     }

     /* Initialize the stats to get rid of any stale values.  This is only
      * needed to handle the case where a guest supports fewer stats than it
      * used to (ie. it has booted into an old kernel).
      */
     reset_stats(s);

     while (iov_to_buf(elem->out_sg, elem->out_num, offset, &stat, sizeof(stat))
            == sizeof(stat)) {
         uint16_t tag = tswap16(stat.tag);
         uint64_t val = tswap64(stat.val);

         offset += sizeof(stat);
         if (tag < VIRTIO_BALLOON_S_NR)
             s->stats[tag] = val;
     }
     s->stats_vq_offset = offset;

     if (qemu_gettimeofday(&tv) < 0) {
         fprintf(stderr, "warning: %s: failed to get time of day\n", __func__);
         goto out;
     }

     s->stats_last_update = tv.tv_sec;

 out:
     if (balloon_stats_enabled(s)) {
         balloon_stats_change_timer(s, s->stats_poll_interval);
     }
 }

 static void virtio_balloon_get_config(VirtIODevice *vdev, uint8_t *config_data)
 {
     VirtIOBalloon *dev = to_virtio_balloon(vdev);
     struct virtio_balloon_config config;

     config.num_pages = cpu_to_le32(dev->num_pages);
     config.actual = cpu_to_le32(dev->actual);

     memcpy(config_data, &config, 8);
 }

 static void virtio_balloon_set_config(VirtIODevice *vdev,
                                       const uint8_t *config_data)
 {
     VirtIOBalloon *dev = to_virtio_balloon(vdev);
     struct virtio_balloon_config config;
     uint32_t oldactual = dev->actual;
     memcpy(&config, config_data, 8);
     dev->actual = le32_to_cpu(config.actual);
     if (dev->actual != oldactual) {
         qemu_balloon_changed(ram_size -
                        ((ram_addr_t) dev->actual << VIRTIO_BALLOON_PFN_SHIFT));
     }
 }

 static uint32_t virtio_balloon_get_features(VirtIODevice *vdev, uint32_t f)
 {
     f |= (1 << VIRTIO_BALLOON_F_STATS_VQ);
     return f;
 }

 static void virtio_balloon_stat(void *opaque, BalloonInfo *info)
 {
     VirtIOBalloon *dev = opaque;
     info->actual = ram_size - ((uint64_t) dev->actual <<
                                VIRTIO_BALLOON_PFN_SHIFT);
 }

 static void virtio_balloon_to_target(void *opaque, ram_addr_t target)
 {
     VirtIOBalloon *dev = opaque;

     if (target > ram_size) {
         target = ram_size;
     }
     if (target) {
         dev->num_pages = (ram_size - target) >> VIRTIO_BALLOON_PFN_SHIFT;
         virtio_notify_config(&dev->vdev);
     }
 }

 static void virtio_balloon_save(QEMUFile *f, void *opaque)
 {
     VirtIOBalloon *s = opaque;

     virtio_save(&s->vdev, f);

     qemu_put_be32(f, s->num_pages);
     qemu_put_be32(f, s->actual);
 }

 static int virtio_balloon_load(QEMUFile *f, void *opaque, int version_id)
 {
     VirtIOBalloon *s = opaque;
     int ret;

     if (version_id != 1)
         return -EINVAL;

     ret = virtio_load(&s->vdev, f);
     if (ret) {
         return ret;
     }

     s->num_pages = qemu_get_be32(f);
     s->actual = qemu_get_be32(f);
     return 0;
 }

 VirtIODevice *virtio_balloon_init(DeviceState *dev)
 {
     VirtIOBalloon *s;
     int ret;

     s = (VirtIOBalloon *)virtio_common_init("virtio-balloon",
                                             VIRTIO_ID_BALLOON,
                                             8, sizeof(VirtIOBalloon));

     s->vdev.get_config = virtio_balloon_get_config;
     s->vdev.set_config = virtio_balloon_set_config;
     s->vdev.get_features = virtio_balloon_get_features;

     ret = qemu_add_balloon_handler(virtio_balloon_to_target,
                                    virtio_balloon_stat, s);
     if (ret < 0) {
         virtio_cleanup(&s->vdev);
         return NULL;
     }

     s->ivq = virtio_add_queue(&s->vdev, 128, virtio_balloon_handle_output);
     s->dvq = virtio_add_queue(&s->vdev, 128, virtio_balloon_handle_output);
     s->svq = virtio_add_queue(&s->vdev, 128, virtio_balloon_receive_stats);

     s->qdev = dev;
     register_savevm(dev, "virtio-balloon", -1, 1,
                     virtio_balloon_save, virtio_balloon_load, s);

     object_property_add(OBJECT(dev), "guest-stats", "guest statistics",
                         balloon_stats_get_all, NULL, NULL, s, NULL);

     object_property_add(OBJECT(dev), "guest-stats-polling-interval", "int",
                         balloon_stats_get_poll_interval,
                         balloon_stats_set_poll_interval,
                         NULL, s, NULL);

     return &s->vdev;
 }

 void virtio_balloon_exit(VirtIODevice *vdev)
 {
     VirtIOBalloon *s = DO_UPCAST(VirtIOBalloon, vdev, vdev);

     balloon_stats_destroy_timer(s);
     qemu_remove_balloon_handler(s);
     unregister_savevm(s->qdev, "virtio-balloon", s);
     virtio_cleanup(vdev);
 }
	/*
	* Virtio Balloon Device
	*
	* Copyright IBM, Corp. 2008
	* Copyright (C) 2011 Red Hat, Inc.
	* Copyright (C) 2011 Amit Shah <amit.shah@redhat.com>
	*
	* Authors:
	* Anthony Liguori <aliguori@us.ibm.com>
	*
	* This work is licensed under the terms of the GNU GPL, version 2. See
	* the COPYING file in the top-level directory.
	*
	*/

	#include "qemu/iov.h"
	#include "qemu/timer.h"
	#include "qemu-common.h"
	#include "virtio.h"
	#include "pc.h"
	#include "cpu.h"
	#include "sysemu/balloon.h"
	#include "virtio-balloon.h"
	#include "sysemu/kvm.h"
	#include "exec/address-spaces.h"
	#include "qapi/visitor.h"

	#if defined(__linux__)
	#include <sys/mman.h>
	#endif

	typedef struct VirtIOBalloon
	{
	VirtIODevice vdev;
	VirtQueue ivq, dvq, *svq;
	uint32_t num_pages;
	uint32_t actual;
	uint64_t stats[VIRTIO_BALLOON_S_NR];
	VirtQueueElement stats_vq_elem;
	size_t stats_vq_offset;
	QEMUTimer *stats_timer;
	int64_t stats_last_update;
	int64_t stats_poll_interval;
	DeviceState *qdev;
	} VirtIOBalloon;

	static VirtIOBalloon to_virtio_balloon(VirtIODevice vdev)
	{
	return (VirtIOBalloon *)vdev;
	}

	static void balloon_page(void *addr, int deflate)
	{
	#if defined(__linux__)
	if (!kvm_enabled() \|\| kvm_has_sync_mmu())
	qemu_madvise(addr, TARGET_PAGE_SIZE,
	deflate ? QEMU_MADV_WILLNEED : QEMU_MADV_DONTNEED);
	#endif
	}

	static const char *balloon_stat_names[] = {
	[VIRTIO_BALLOON_S_SWAP_IN] = "stat-swap-in",
	[VIRTIO_BALLOON_S_SWAP_OUT] = "stat-swap-out",
	[VIRTIO_BALLOON_S_MAJFLT] = "stat-major-faults",
	[VIRTIO_BALLOON_S_MINFLT] = "stat-minor-faults",
	[VIRTIO_BALLOON_S_MEMFREE] = "stat-free-memory",
	[VIRTIO_BALLOON_S_MEMTOT] = "stat-total-memory",
	[VIRTIO_BALLOON_S_NR] = NULL
	};

	/*
	* reset_stats - Mark all items in the stats array as unset
	*
	* This function needs to be called at device intialization and before
	* before updating to a set of newly-generated stats. This will ensure that no
	* stale values stick around in case the guest reports a subset of the supported
	* statistics.
	*/
	static inline void reset_stats(VirtIOBalloon *dev)
	{
	int i;
	for (i = 0; i < VIRTIO_BALLOON_S_NR; dev->stats[i++] = -1);
	}

	static bool balloon_stats_supported(const VirtIOBalloon *s)
	{
	return s->vdev.guest_features & (1 << VIRTIO_BALLOON_F_STATS_VQ);
	}

	static bool balloon_stats_enabled(const VirtIOBalloon *s)
	{
	return s->stats_poll_interval > 0;
	}

	static void balloon_stats_destroy_timer(VirtIOBalloon *s)
	{
	if (balloon_stats_enabled(s)) {
	qemu_del_timer(s->stats_timer);
	qemu_free_timer(s->stats_timer);
	s->stats_timer = NULL;
	s->stats_poll_interval = 0;
	}
	}

	static void balloon_stats_change_timer(VirtIOBalloon *s, int secs)
	{
	qemu_mod_timer(s->stats_timer, qemu_get_clock_ms(vm_clock) + secs * 1000);
	}

	static void balloon_stats_poll_cb(void *opaque)
	{
	VirtIOBalloon *s = opaque;

	if (!balloon_stats_supported(s)) {
	/* re-schedule */
	balloon_stats_change_timer(s, s->stats_poll_interval);
	return;
	}

	virtqueue_push(s->svq, &s->stats_vq_elem, s->stats_vq_offset);
	virtio_notify(&s->vdev, s->svq);
	}

	static void balloon_stats_get_all(Object obj, struct Visitor v,
	void opaque, const char name, Error **errp)
	{
	VirtIOBalloon *s = opaque;
	int i;

	if (!s->stats_last_update) {
	error_setg(errp, "guest hasn't updated any stats yet");
	return;
	}

	visit_start_struct(v, NULL, "guest-stats", name, 0, errp);
	visit_type_int(v, &s->stats_last_update, "last-update", errp);

	visit_start_struct(v, NULL, NULL, "stats", 0, errp);
	for (i = 0; i < VIRTIO_BALLOON_S_NR; i++) {
	visit_type_int64(v, (int64_t *) &s->stats[i], balloon_stat_names[i],
	errp);
	}
	visit_end_struct(v, errp);

	visit_end_struct(v, errp);
	}

	static void balloon_stats_get_poll_interval(Object obj, struct Visitor v,
	void opaque, const char name,
	Error **errp)
	{
	VirtIOBalloon *s = opaque;
	visit_type_int(v, &s->stats_poll_interval, name, errp);
	}

	static void balloon_stats_set_poll_interval(Object obj, struct Visitor v,
	void opaque, const char name,
	Error **errp)
	{
	VirtIOBalloon *s = opaque;
	int64_t value;

	visit_type_int(v, &value, name, errp);
	if (error_is_set(errp)) {
	return;
	}

	if (value < 0) {
	error_setg(errp, "timer value must be greater than zero");
	return;
	}

	if (value == s->stats_poll_interval) {
	return;
	}

	if (value == 0) {
	/* timer=0 disables the timer */
	balloon_stats_destroy_timer(s);
	return;
	}

	if (balloon_stats_enabled(s)) {
	/* timer interval change */
	s->stats_poll_interval = value;
	balloon_stats_change_timer(s, value);
	return;
	}

	/* create a new timer */
	g_assert(s->stats_timer == NULL);
	s->stats_timer = qemu_new_timer_ms(vm_clock, balloon_stats_poll_cb, s);
	s->stats_poll_interval = value;
	balloon_stats_change_timer(s, 0);
	}

	static void virtio_balloon_handle_output(VirtIODevice vdev, VirtQueue vq)
	{
	VirtIOBalloon *s = to_virtio_balloon(vdev);
	VirtQueueElement elem;
	MemoryRegionSection section;

	while (virtqueue_pop(vq, &elem)) {
	size_t offset = 0;
	uint32_t pfn;

	while (iov_to_buf(elem.out_sg, elem.out_num, offset, &pfn, 4) == 4) {
	ram_addr_t pa;
	ram_addr_t addr;

	pa = (ram_addr_t)ldl_p(&pfn) << VIRTIO_BALLOON_PFN_SHIFT;
	offset += 4;

	/* FIXME: remove get_system_memory(), but how? */
	section = memory_region_find(get_system_memory(), pa, 1);
	if (!section.size \|\| !memory_region_is_ram(section.mr))
	continue;

	/* Using memory_region_get_ram_ptr is bending the rules a bit, but
	should be OK because we only want a single page. */
	addr = section.offset_within_region;
	balloon_page(memory_region_get_ram_ptr(section.mr) + addr,
	!!(vq == s->dvq));
	}

	virtqueue_push(vq, &elem, offset);
	virtio_notify(vdev, vq);
	}
	}

	static void virtio_balloon_receive_stats(VirtIODevice vdev, VirtQueue vq)
	{
	VirtIOBalloon *s = DO_UPCAST(VirtIOBalloon, vdev, vdev);
	VirtQueueElement *elem = &s->stats_vq_elem;
	VirtIOBalloonStat stat;
	size_t offset = 0;
	qemu_timeval tv;

	if (!virtqueue_pop(vq, elem)) {
	goto out;
	}

	/* Initialize the stats to get rid of any stale values. This is only
	* needed to handle the case where a guest supports fewer stats than it
	* used to (ie. it has booted into an old kernel).
	*/
	reset_stats(s);

	while (iov_to_buf(elem->out_sg, elem->out_num, offset, &stat, sizeof(stat))
	== sizeof(stat)) {
	uint16_t tag = tswap16(stat.tag);
	uint64_t val = tswap64(stat.val);

	offset += sizeof(stat);
	if (tag < VIRTIO_BALLOON_S_NR)
	s->stats[tag] = val;
	}
	s->stats_vq_offset = offset;

	if (qemu_gettimeofday(&tv) < 0) {
	fprintf(stderr, "warning: %s: failed to get time of day\n", __func__);
	goto out;
	}

	s->stats_last_update = tv.tv_sec;

	out:
	if (balloon_stats_enabled(s)) {
	balloon_stats_change_timer(s, s->stats_poll_interval);
	}
	}

	static void virtio_balloon_get_config(VirtIODevice vdev, uint8_t config_data)
	{
	VirtIOBalloon *dev = to_virtio_balloon(vdev);
	struct virtio_balloon_config config;

	config.num_pages = cpu_to_le32(dev->num_pages);
	config.actual = cpu_to_le32(dev->actual);

	memcpy(config_data, &config, 8);
	}

	static void virtio_balloon_set_config(VirtIODevice *vdev,
	const uint8_t *config_data)
	{
	VirtIOBalloon *dev = to_virtio_balloon(vdev);
	struct virtio_balloon_config config;
	uint32_t oldactual = dev->actual;
	memcpy(&config, config_data, 8);
	dev->actual = le32_to_cpu(config.actual);
	if (dev->actual != oldactual) {
	qemu_balloon_changed(ram_size -
	((ram_addr_t) dev->actual << VIRTIO_BALLOON_PFN_SHIFT));
	}
	}

	static uint32_t virtio_balloon_get_features(VirtIODevice *vdev, uint32_t f)
	{
	f \|= (1 << VIRTIO_BALLOON_F_STATS_VQ);
	return f;
	}

	static void virtio_balloon_stat(void opaque, BalloonInfo info)
	{
	VirtIOBalloon *dev = opaque;
	info->actual = ram_size - ((uint64_t) dev->actual <<
	VIRTIO_BALLOON_PFN_SHIFT);
	}

	static void virtio_balloon_to_target(void *opaque, ram_addr_t target)
	{
	VirtIOBalloon *dev = opaque;

	if (target > ram_size) {
	target = ram_size;
	}
	if (target) {
	dev->num_pages = (ram_size - target) >> VIRTIO_BALLOON_PFN_SHIFT;
	virtio_notify_config(&dev->vdev);
	}
	}

	static void virtio_balloon_save(QEMUFile f, void opaque)
	{
	VirtIOBalloon *s = opaque;

	virtio_save(&s->vdev, f);

	qemu_put_be32(f, s->num_pages);
	qemu_put_be32(f, s->actual);
	}

	static int virtio_balloon_load(QEMUFile f, void opaque, int version_id)
	{
	VirtIOBalloon *s = opaque;
	int ret;

	if (version_id != 1)
	return -EINVAL;

	ret = virtio_load(&s->vdev, f);
	if (ret) {
	return ret;
	}

	s->num_pages = qemu_get_be32(f);
	s->actual = qemu_get_be32(f);
	return 0;
	}

	VirtIODevice virtio_balloon_init(DeviceState dev)
	{
	VirtIOBalloon *s;
	int ret;

	s = (VirtIOBalloon *)virtio_common_init("virtio-balloon",
	VIRTIO_ID_BALLOON,
	8, sizeof(VirtIOBalloon));

	s->vdev.get_config = virtio_balloon_get_config;
	s->vdev.set_config = virtio_balloon_set_config;
	s->vdev.get_features = virtio_balloon_get_features;

	ret = qemu_add_balloon_handler(virtio_balloon_to_target,
	virtio_balloon_stat, s);
	if (ret < 0) {
	virtio_cleanup(&s->vdev);
	return NULL;
	}

	s->ivq = virtio_add_queue(&s->vdev, 128, virtio_balloon_handle_output);
	s->dvq = virtio_add_queue(&s->vdev, 128, virtio_balloon_handle_output);
	s->svq = virtio_add_queue(&s->vdev, 128, virtio_balloon_receive_stats);

	s->qdev = dev;
	register_savevm(dev, "virtio-balloon", -1, 1,
	virtio_balloon_save, virtio_balloon_load, s);

	object_property_add(OBJECT(dev), "guest-stats", "guest statistics",
	balloon_stats_get_all, NULL, NULL, s, NULL);

	object_property_add(OBJECT(dev), "guest-stats-polling-interval", "int",
	balloon_stats_get_poll_interval,
	balloon_stats_set_poll_interval,
	NULL, s, NULL);

	return &s->vdev;
	}

	void virtio_balloon_exit(VirtIODevice *vdev)
	{
	VirtIOBalloon *s = DO_UPCAST(VirtIOBalloon, vdev, vdev);

	balloon_stats_destroy_timer(s);
	qemu_remove_balloon_handler(s);
	unregister_savevm(s->qdev, "virtio-balloon", s);
	virtio_cleanup(vdev);
	}