1 /* 2 * Postcopy migration for RAM 3 * 4 * Copyright 2013-2015 Red Hat, Inc. and/or its affiliates 5 * 6 * Authors: 7 * Dave Gilbert <dgilbert@redhat.com> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 * 12 */ 13 14 /* 15 * Postcopy is a migration technique where the execution flips from the 16 * source to the destination before all the data has been copied. 17 */ 18 19 #include "qemu/osdep.h" 20 #include "qemu/madvise.h" 21 #include "exec/target_page.h" 22 #include "migration.h" 23 #include "qemu-file.h" 24 #include "savevm.h" 25 #include "postcopy-ram.h" 26 #include "ram.h" 27 #include "qapi/error.h" 28 #include "qemu/notify.h" 29 #include "qemu/rcu.h" 30 #include "sysemu/sysemu.h" 31 #include "qemu/error-report.h" 32 #include "trace.h" 33 #include "hw/boards.h" 34 #include "exec/ramblock.h" 35 #include "socket.h" 36 #include "yank_functions.h" 37 #include "tls.h" 38 #include "qemu/userfaultfd.h" 39 #include "qemu/mmap-alloc.h" 40 #include "options.h" 41 42 /* Arbitrary limit on size of each discard command, 43 * keeps them around ~200 bytes 44 */ 45 #define MAX_DISCARDS_PER_COMMAND 12 46 47 struct PostcopyDiscardState { 48 const char *ramblock_name; 49 uint16_t cur_entry; 50 /* 51 * Start and length of a discard range (bytes) 52 */ 53 uint64_t start_list[MAX_DISCARDS_PER_COMMAND]; 54 uint64_t length_list[MAX_DISCARDS_PER_COMMAND]; 55 unsigned int nsentwords; 56 unsigned int nsentcmds; 57 }; 58 59 static NotifierWithReturnList postcopy_notifier_list; 60 61 void postcopy_infrastructure_init(void) 62 { 63 notifier_with_return_list_init(&postcopy_notifier_list); 64 } 65 66 void postcopy_add_notifier(NotifierWithReturn *nn) 67 { 68 notifier_with_return_list_add(&postcopy_notifier_list, nn); 69 } 70 71 void postcopy_remove_notifier(NotifierWithReturn *n) 72 { 73 notifier_with_return_remove(n); 74 } 75 76 int postcopy_notify(enum PostcopyNotifyReason reason, Error **errp) 77 { 78 struct PostcopyNotifyData pnd; 79 pnd.reason = reason; 80 pnd.errp = errp; 81 82 return notifier_with_return_list_notify(&postcopy_notifier_list, 83 &pnd); 84 } 85 86 /* 87 * NOTE: this routine is not thread safe, we can't call it concurrently. But it 88 * should be good enough for migration's purposes. 89 */ 90 void postcopy_thread_create(MigrationIncomingState *mis, 91 QemuThread *thread, const char *name, 92 void *(*fn)(void *), int joinable) 93 { 94 qemu_sem_init(&mis->thread_sync_sem, 0); 95 qemu_thread_create(thread, name, fn, mis, joinable); 96 qemu_sem_wait(&mis->thread_sync_sem); 97 qemu_sem_destroy(&mis->thread_sync_sem); 98 } 99 100 /* Postcopy needs to detect accesses to pages that haven't yet been copied 101 * across, and efficiently map new pages in, the techniques for doing this 102 * are target OS specific. 103 */ 104 #if defined(__linux__) 105 106 #include <poll.h> 107 #include <sys/ioctl.h> 108 #include <sys/syscall.h> 109 #include <asm/types.h> /* for __u64 */ 110 #endif 111 112 #if defined(__linux__) && defined(__NR_userfaultfd) && defined(CONFIG_EVENTFD) 113 #include <sys/eventfd.h> 114 #include <linux/userfaultfd.h> 115 116 typedef struct PostcopyBlocktimeContext { 117 /* time when page fault initiated per vCPU */ 118 uint32_t *page_fault_vcpu_time; 119 /* page address per vCPU */ 120 uintptr_t *vcpu_addr; 121 uint32_t total_blocktime; 122 /* blocktime per vCPU */ 123 uint32_t *vcpu_blocktime; 124 /* point in time when last page fault was initiated */ 125 uint32_t last_begin; 126 /* number of vCPU are suspended */ 127 int smp_cpus_down; 128 uint64_t start_time; 129 130 /* 131 * Handler for exit event, necessary for 132 * releasing whole blocktime_ctx 133 */ 134 Notifier exit_notifier; 135 } PostcopyBlocktimeContext; 136 137 static void destroy_blocktime_context(struct PostcopyBlocktimeContext *ctx) 138 { 139 g_free(ctx->page_fault_vcpu_time); 140 g_free(ctx->vcpu_addr); 141 g_free(ctx->vcpu_blocktime); 142 g_free(ctx); 143 } 144 145 static void migration_exit_cb(Notifier *n, void *data) 146 { 147 PostcopyBlocktimeContext *ctx = container_of(n, PostcopyBlocktimeContext, 148 exit_notifier); 149 destroy_blocktime_context(ctx); 150 } 151 152 static struct PostcopyBlocktimeContext *blocktime_context_new(void) 153 { 154 MachineState *ms = MACHINE(qdev_get_machine()); 155 unsigned int smp_cpus = ms->smp.cpus; 156 PostcopyBlocktimeContext *ctx = g_new0(PostcopyBlocktimeContext, 1); 157 ctx->page_fault_vcpu_time = g_new0(uint32_t, smp_cpus); 158 ctx->vcpu_addr = g_new0(uintptr_t, smp_cpus); 159 ctx->vcpu_blocktime = g_new0(uint32_t, smp_cpus); 160 161 ctx->exit_notifier.notify = migration_exit_cb; 162 ctx->start_time = qemu_clock_get_ms(QEMU_CLOCK_REALTIME); 163 qemu_add_exit_notifier(&ctx->exit_notifier); 164 return ctx; 165 } 166 167 static uint32List *get_vcpu_blocktime_list(PostcopyBlocktimeContext *ctx) 168 { 169 MachineState *ms = MACHINE(qdev_get_machine()); 170 uint32List *list = NULL; 171 int i; 172 173 for (i = ms->smp.cpus - 1; i >= 0; i--) { 174 QAPI_LIST_PREPEND(list, ctx->vcpu_blocktime[i]); 175 } 176 177 return list; 178 } 179 180 /* 181 * This function just populates MigrationInfo from postcopy's 182 * blocktime context. It will not populate MigrationInfo, 183 * unless postcopy-blocktime capability was set. 184 * 185 * @info: pointer to MigrationInfo to populate 186 */ 187 void fill_destination_postcopy_migration_info(MigrationInfo *info) 188 { 189 MigrationIncomingState *mis = migration_incoming_get_current(); 190 PostcopyBlocktimeContext *bc = mis->blocktime_ctx; 191 192 if (!bc) { 193 return; 194 } 195 196 info->has_postcopy_blocktime = true; 197 info->postcopy_blocktime = bc->total_blocktime; 198 info->has_postcopy_vcpu_blocktime = true; 199 info->postcopy_vcpu_blocktime = get_vcpu_blocktime_list(bc); 200 } 201 202 static uint32_t get_postcopy_total_blocktime(void) 203 { 204 MigrationIncomingState *mis = migration_incoming_get_current(); 205 PostcopyBlocktimeContext *bc = mis->blocktime_ctx; 206 207 if (!bc) { 208 return 0; 209 } 210 211 return bc->total_blocktime; 212 } 213 214 /** 215 * receive_ufd_features: check userfault fd features, to request only supported 216 * features in the future. 217 * 218 * Returns: true on success 219 * 220 * __NR_userfaultfd - should be checked before 221 * @features: out parameter will contain uffdio_api.features provided by kernel 222 * in case of success 223 */ 224 static bool receive_ufd_features(uint64_t *features) 225 { 226 struct uffdio_api api_struct = {0}; 227 int ufd; 228 bool ret = true; 229 230 ufd = uffd_open(O_CLOEXEC); 231 if (ufd == -1) { 232 error_report("%s: uffd_open() failed: %s", __func__, strerror(errno)); 233 return false; 234 } 235 236 /* ask features */ 237 api_struct.api = UFFD_API; 238 api_struct.features = 0; 239 if (ioctl(ufd, UFFDIO_API, &api_struct)) { 240 error_report("%s: UFFDIO_API failed: %s", __func__, 241 strerror(errno)); 242 ret = false; 243 goto release_ufd; 244 } 245 246 *features = api_struct.features; 247 248 release_ufd: 249 close(ufd); 250 return ret; 251 } 252 253 /** 254 * request_ufd_features: this function should be called only once on a newly 255 * opened ufd, subsequent calls will lead to error. 256 * 257 * Returns: true on success 258 * 259 * @ufd: fd obtained from userfaultfd syscall 260 * @features: bit mask see UFFD_API_FEATURES 261 */ 262 static bool request_ufd_features(int ufd, uint64_t features) 263 { 264 struct uffdio_api api_struct = {0}; 265 uint64_t ioctl_mask; 266 267 api_struct.api = UFFD_API; 268 api_struct.features = features; 269 if (ioctl(ufd, UFFDIO_API, &api_struct)) { 270 error_report("%s failed: UFFDIO_API failed: %s", __func__, 271 strerror(errno)); 272 return false; 273 } 274 275 ioctl_mask = (__u64)1 << _UFFDIO_REGISTER | 276 (__u64)1 << _UFFDIO_UNREGISTER; 277 if ((api_struct.ioctls & ioctl_mask) != ioctl_mask) { 278 error_report("Missing userfault features: %" PRIx64, 279 (uint64_t)(~api_struct.ioctls & ioctl_mask)); 280 return false; 281 } 282 283 return true; 284 } 285 286 static bool ufd_check_and_apply(int ufd, MigrationIncomingState *mis) 287 { 288 uint64_t asked_features = 0; 289 static uint64_t supported_features; 290 291 /* 292 * it's not possible to 293 * request UFFD_API twice per one fd 294 * userfault fd features is persistent 295 */ 296 if (!supported_features) { 297 if (!receive_ufd_features(&supported_features)) { 298 error_report("%s failed", __func__); 299 return false; 300 } 301 } 302 303 #ifdef UFFD_FEATURE_THREAD_ID 304 if (UFFD_FEATURE_THREAD_ID & supported_features) { 305 asked_features |= UFFD_FEATURE_THREAD_ID; 306 if (migrate_postcopy_blocktime()) { 307 if (!mis->blocktime_ctx) { 308 mis->blocktime_ctx = blocktime_context_new(); 309 } 310 } 311 } 312 #endif 313 314 /* 315 * request features, even if asked_features is 0, due to 316 * kernel expects UFFD_API before UFFDIO_REGISTER, per 317 * userfault file descriptor 318 */ 319 if (!request_ufd_features(ufd, asked_features)) { 320 error_report("%s failed: features %" PRIu64, __func__, 321 asked_features); 322 return false; 323 } 324 325 if (qemu_real_host_page_size() != ram_pagesize_summary()) { 326 bool have_hp = false; 327 /* We've got a huge page */ 328 #ifdef UFFD_FEATURE_MISSING_HUGETLBFS 329 have_hp = supported_features & UFFD_FEATURE_MISSING_HUGETLBFS; 330 #endif 331 if (!have_hp) { 332 error_report("Userfault on this host does not support huge pages"); 333 return false; 334 } 335 } 336 return true; 337 } 338 339 /* Callback from postcopy_ram_supported_by_host block iterator. 340 */ 341 static int test_ramblock_postcopiable(RAMBlock *rb) 342 { 343 const char *block_name = qemu_ram_get_idstr(rb); 344 ram_addr_t length = qemu_ram_get_used_length(rb); 345 size_t pagesize = qemu_ram_pagesize(rb); 346 QemuFsType fs; 347 348 if (length % pagesize) { 349 error_report("Postcopy requires RAM blocks to be a page size multiple," 350 " block %s is 0x" RAM_ADDR_FMT " bytes with a " 351 "page size of 0x%zx", block_name, length, pagesize); 352 return 1; 353 } 354 355 if (rb->fd >= 0) { 356 fs = qemu_fd_getfs(rb->fd); 357 if (fs != QEMU_FS_TYPE_TMPFS && fs != QEMU_FS_TYPE_HUGETLBFS) { 358 error_report("Host backend files need to be TMPFS or HUGETLBFS only"); 359 return 1; 360 } 361 } 362 363 return 0; 364 } 365 366 /* 367 * Note: This has the side effect of munlock'ing all of RAM, that's 368 * normally fine since if the postcopy succeeds it gets turned back on at the 369 * end. 370 */ 371 bool postcopy_ram_supported_by_host(MigrationIncomingState *mis) 372 { 373 long pagesize = qemu_real_host_page_size(); 374 int ufd = -1; 375 bool ret = false; /* Error unless we change it */ 376 void *testarea = NULL; 377 struct uffdio_register reg_struct; 378 struct uffdio_range range_struct; 379 uint64_t feature_mask; 380 Error *local_err = NULL; 381 RAMBlock *block; 382 383 if (qemu_target_page_size() > pagesize) { 384 error_report("Target page size bigger than host page size"); 385 goto out; 386 } 387 388 ufd = uffd_open(O_CLOEXEC); 389 if (ufd == -1) { 390 error_report("%s: userfaultfd not available: %s", __func__, 391 strerror(errno)); 392 goto out; 393 } 394 395 /* Give devices a chance to object */ 396 if (postcopy_notify(POSTCOPY_NOTIFY_PROBE, &local_err)) { 397 error_report_err(local_err); 398 goto out; 399 } 400 401 /* Version and features check */ 402 if (!ufd_check_and_apply(ufd, mis)) { 403 goto out; 404 } 405 406 /* 407 * We don't support postcopy with some type of ramblocks. 408 * 409 * NOTE: we explicitly ignored ramblock_is_ignored() instead we checked 410 * all possible ramblocks. This is because this function can be called 411 * when creating the migration object, during the phase RAM_MIGRATABLE 412 * is not even properly set for all the ramblocks. 413 * 414 * A side effect of this is we'll also check against RAM_SHARED 415 * ramblocks even if migrate_ignore_shared() is set (in which case 416 * we'll never migrate RAM_SHARED at all), but normally this shouldn't 417 * affect in reality, or we can revisit. 418 */ 419 RAMBLOCK_FOREACH(block) { 420 if (test_ramblock_postcopiable(block)) { 421 goto out; 422 } 423 } 424 425 /* 426 * userfault and mlock don't go together; we'll put it back later if 427 * it was enabled. 428 */ 429 if (munlockall()) { 430 error_report("%s: munlockall: %s", __func__, strerror(errno)); 431 goto out; 432 } 433 434 /* 435 * We need to check that the ops we need are supported on anon memory 436 * To do that we need to register a chunk and see the flags that 437 * are returned. 438 */ 439 testarea = mmap(NULL, pagesize, PROT_READ | PROT_WRITE, MAP_PRIVATE | 440 MAP_ANONYMOUS, -1, 0); 441 if (testarea == MAP_FAILED) { 442 error_report("%s: Failed to map test area: %s", __func__, 443 strerror(errno)); 444 goto out; 445 } 446 g_assert(QEMU_PTR_IS_ALIGNED(testarea, pagesize)); 447 448 reg_struct.range.start = (uintptr_t)testarea; 449 reg_struct.range.len = pagesize; 450 reg_struct.mode = UFFDIO_REGISTER_MODE_MISSING; 451 452 if (ioctl(ufd, UFFDIO_REGISTER, ®_struct)) { 453 error_report("%s userfault register: %s", __func__, strerror(errno)); 454 goto out; 455 } 456 457 range_struct.start = (uintptr_t)testarea; 458 range_struct.len = pagesize; 459 if (ioctl(ufd, UFFDIO_UNREGISTER, &range_struct)) { 460 error_report("%s userfault unregister: %s", __func__, strerror(errno)); 461 goto out; 462 } 463 464 feature_mask = (__u64)1 << _UFFDIO_WAKE | 465 (__u64)1 << _UFFDIO_COPY | 466 (__u64)1 << _UFFDIO_ZEROPAGE; 467 if ((reg_struct.ioctls & feature_mask) != feature_mask) { 468 error_report("Missing userfault map features: %" PRIx64, 469 (uint64_t)(~reg_struct.ioctls & feature_mask)); 470 goto out; 471 } 472 473 /* Success! */ 474 ret = true; 475 out: 476 if (testarea) { 477 munmap(testarea, pagesize); 478 } 479 if (ufd != -1) { 480 close(ufd); 481 } 482 return ret; 483 } 484 485 /* 486 * Setup an area of RAM so that it *can* be used for postcopy later; this 487 * must be done right at the start prior to pre-copy. 488 * opaque should be the MIS. 489 */ 490 static int init_range(RAMBlock *rb, void *opaque) 491 { 492 const char *block_name = qemu_ram_get_idstr(rb); 493 void *host_addr = qemu_ram_get_host_addr(rb); 494 ram_addr_t offset = qemu_ram_get_offset(rb); 495 ram_addr_t length = qemu_ram_get_used_length(rb); 496 trace_postcopy_init_range(block_name, host_addr, offset, length); 497 498 /* 499 * Save the used_length before running the guest. In case we have to 500 * resize RAM blocks when syncing RAM block sizes from the source during 501 * precopy, we'll update it manually via the ram block notifier. 502 */ 503 rb->postcopy_length = length; 504 505 /* 506 * We need the whole of RAM to be truly empty for postcopy, so things 507 * like ROMs and any data tables built during init must be zero'd 508 * - we're going to get the copy from the source anyway. 509 * (Precopy will just overwrite this data, so doesn't need the discard) 510 */ 511 if (ram_discard_range(block_name, 0, length)) { 512 return -1; 513 } 514 515 return 0; 516 } 517 518 /* 519 * At the end of migration, undo the effects of init_range 520 * opaque should be the MIS. 521 */ 522 static int cleanup_range(RAMBlock *rb, void *opaque) 523 { 524 const char *block_name = qemu_ram_get_idstr(rb); 525 void *host_addr = qemu_ram_get_host_addr(rb); 526 ram_addr_t offset = qemu_ram_get_offset(rb); 527 ram_addr_t length = rb->postcopy_length; 528 MigrationIncomingState *mis = opaque; 529 struct uffdio_range range_struct; 530 trace_postcopy_cleanup_range(block_name, host_addr, offset, length); 531 532 /* 533 * We turned off hugepage for the precopy stage with postcopy enabled 534 * we can turn it back on now. 535 */ 536 qemu_madvise(host_addr, length, QEMU_MADV_HUGEPAGE); 537 538 /* 539 * We can also turn off userfault now since we should have all the 540 * pages. It can be useful to leave it on to debug postcopy 541 * if you're not sure it's always getting every page. 542 */ 543 range_struct.start = (uintptr_t)host_addr; 544 range_struct.len = length; 545 546 if (ioctl(mis->userfault_fd, UFFDIO_UNREGISTER, &range_struct)) { 547 error_report("%s: userfault unregister %s", __func__, strerror(errno)); 548 549 return -1; 550 } 551 552 return 0; 553 } 554 555 /* 556 * Initialise postcopy-ram, setting the RAM to a state where we can go into 557 * postcopy later; must be called prior to any precopy. 558 * called from arch_init's similarly named ram_postcopy_incoming_init 559 */ 560 int postcopy_ram_incoming_init(MigrationIncomingState *mis) 561 { 562 if (foreach_not_ignored_block(init_range, NULL)) { 563 return -1; 564 } 565 566 return 0; 567 } 568 569 static void postcopy_temp_pages_cleanup(MigrationIncomingState *mis) 570 { 571 int i; 572 573 if (mis->postcopy_tmp_pages) { 574 for (i = 0; i < mis->postcopy_channels; i++) { 575 if (mis->postcopy_tmp_pages[i].tmp_huge_page) { 576 munmap(mis->postcopy_tmp_pages[i].tmp_huge_page, 577 mis->largest_page_size); 578 mis->postcopy_tmp_pages[i].tmp_huge_page = NULL; 579 } 580 } 581 g_free(mis->postcopy_tmp_pages); 582 mis->postcopy_tmp_pages = NULL; 583 } 584 585 if (mis->postcopy_tmp_zero_page) { 586 munmap(mis->postcopy_tmp_zero_page, mis->largest_page_size); 587 mis->postcopy_tmp_zero_page = NULL; 588 } 589 } 590 591 /* 592 * At the end of a migration where postcopy_ram_incoming_init was called. 593 */ 594 int postcopy_ram_incoming_cleanup(MigrationIncomingState *mis) 595 { 596 trace_postcopy_ram_incoming_cleanup_entry(); 597 598 if (mis->preempt_thread_status == PREEMPT_THREAD_CREATED) { 599 /* Notify the fast load thread to quit */ 600 mis->preempt_thread_status = PREEMPT_THREAD_QUIT; 601 if (mis->postcopy_qemufile_dst) { 602 qemu_file_shutdown(mis->postcopy_qemufile_dst); 603 } 604 qemu_thread_join(&mis->postcopy_prio_thread); 605 mis->preempt_thread_status = PREEMPT_THREAD_NONE; 606 } 607 608 if (mis->have_fault_thread) { 609 Error *local_err = NULL; 610 611 /* Let the fault thread quit */ 612 qatomic_set(&mis->fault_thread_quit, 1); 613 postcopy_fault_thread_notify(mis); 614 trace_postcopy_ram_incoming_cleanup_join(); 615 qemu_thread_join(&mis->fault_thread); 616 617 if (postcopy_notify(POSTCOPY_NOTIFY_INBOUND_END, &local_err)) { 618 error_report_err(local_err); 619 return -1; 620 } 621 622 if (foreach_not_ignored_block(cleanup_range, mis)) { 623 return -1; 624 } 625 626 trace_postcopy_ram_incoming_cleanup_closeuf(); 627 close(mis->userfault_fd); 628 close(mis->userfault_event_fd); 629 mis->have_fault_thread = false; 630 } 631 632 if (enable_mlock) { 633 if (os_mlock() < 0) { 634 error_report("mlock: %s", strerror(errno)); 635 /* 636 * It doesn't feel right to fail at this point, we have a valid 637 * VM state. 638 */ 639 } 640 } 641 642 postcopy_temp_pages_cleanup(mis); 643 644 trace_postcopy_ram_incoming_cleanup_blocktime( 645 get_postcopy_total_blocktime()); 646 647 trace_postcopy_ram_incoming_cleanup_exit(); 648 return 0; 649 } 650 651 /* 652 * Disable huge pages on an area 653 */ 654 static int nhp_range(RAMBlock *rb, void *opaque) 655 { 656 const char *block_name = qemu_ram_get_idstr(rb); 657 void *host_addr = qemu_ram_get_host_addr(rb); 658 ram_addr_t offset = qemu_ram_get_offset(rb); 659 ram_addr_t length = rb->postcopy_length; 660 trace_postcopy_nhp_range(block_name, host_addr, offset, length); 661 662 /* 663 * Before we do discards we need to ensure those discards really 664 * do delete areas of the page, even if THP thinks a hugepage would 665 * be a good idea, so force hugepages off. 666 */ 667 qemu_madvise(host_addr, length, QEMU_MADV_NOHUGEPAGE); 668 669 return 0; 670 } 671 672 /* 673 * Userfault requires us to mark RAM as NOHUGEPAGE prior to discard 674 * however leaving it until after precopy means that most of the precopy 675 * data is still THPd 676 */ 677 int postcopy_ram_prepare_discard(MigrationIncomingState *mis) 678 { 679 if (foreach_not_ignored_block(nhp_range, mis)) { 680 return -1; 681 } 682 683 postcopy_state_set(POSTCOPY_INCOMING_DISCARD); 684 685 return 0; 686 } 687 688 /* 689 * Mark the given area of RAM as requiring notification to unwritten areas 690 * Used as a callback on foreach_not_ignored_block. 691 * host_addr: Base of area to mark 692 * offset: Offset in the whole ram arena 693 * length: Length of the section 694 * opaque: MigrationIncomingState pointer 695 * Returns 0 on success 696 */ 697 static int ram_block_enable_notify(RAMBlock *rb, void *opaque) 698 { 699 MigrationIncomingState *mis = opaque; 700 struct uffdio_register reg_struct; 701 702 reg_struct.range.start = (uintptr_t)qemu_ram_get_host_addr(rb); 703 reg_struct.range.len = rb->postcopy_length; 704 reg_struct.mode = UFFDIO_REGISTER_MODE_MISSING; 705 706 /* Now tell our userfault_fd that it's responsible for this area */ 707 if (ioctl(mis->userfault_fd, UFFDIO_REGISTER, ®_struct)) { 708 error_report("%s userfault register: %s", __func__, strerror(errno)); 709 return -1; 710 } 711 if (!(reg_struct.ioctls & ((__u64)1 << _UFFDIO_COPY))) { 712 error_report("%s userfault: Region doesn't support COPY", __func__); 713 return -1; 714 } 715 if (reg_struct.ioctls & ((__u64)1 << _UFFDIO_ZEROPAGE)) { 716 qemu_ram_set_uf_zeroable(rb); 717 } 718 719 return 0; 720 } 721 722 int postcopy_wake_shared(struct PostCopyFD *pcfd, 723 uint64_t client_addr, 724 RAMBlock *rb) 725 { 726 size_t pagesize = qemu_ram_pagesize(rb); 727 struct uffdio_range range; 728 int ret; 729 trace_postcopy_wake_shared(client_addr, qemu_ram_get_idstr(rb)); 730 range.start = ROUND_DOWN(client_addr, pagesize); 731 range.len = pagesize; 732 ret = ioctl(pcfd->fd, UFFDIO_WAKE, &range); 733 if (ret) { 734 error_report("%s: Failed to wake: %zx in %s (%s)", 735 __func__, (size_t)client_addr, qemu_ram_get_idstr(rb), 736 strerror(errno)); 737 } 738 return ret; 739 } 740 741 static int postcopy_request_page(MigrationIncomingState *mis, RAMBlock *rb, 742 ram_addr_t start, uint64_t haddr) 743 { 744 void *aligned = (void *)(uintptr_t)ROUND_DOWN(haddr, qemu_ram_pagesize(rb)); 745 746 /* 747 * Discarded pages (via RamDiscardManager) are never migrated. On unlikely 748 * access, place a zeropage, which will also set the relevant bits in the 749 * recv_bitmap accordingly, so we won't try placing a zeropage twice. 750 * 751 * Checking a single bit is sufficient to handle pagesize > TPS as either 752 * all relevant bits are set or not. 753 */ 754 assert(QEMU_IS_ALIGNED(start, qemu_ram_pagesize(rb))); 755 if (ramblock_page_is_discarded(rb, start)) { 756 bool received = ramblock_recv_bitmap_test_byte_offset(rb, start); 757 758 return received ? 0 : postcopy_place_page_zero(mis, aligned, rb); 759 } 760 761 return migrate_send_rp_req_pages(mis, rb, start, haddr); 762 } 763 764 /* 765 * Callback from shared fault handlers to ask for a page, 766 * the page must be specified by a RAMBlock and an offset in that rb 767 * Note: Only for use by shared fault handlers (in fault thread) 768 */ 769 int postcopy_request_shared_page(struct PostCopyFD *pcfd, RAMBlock *rb, 770 uint64_t client_addr, uint64_t rb_offset) 771 { 772 uint64_t aligned_rbo = ROUND_DOWN(rb_offset, qemu_ram_pagesize(rb)); 773 MigrationIncomingState *mis = migration_incoming_get_current(); 774 775 trace_postcopy_request_shared_page(pcfd->idstr, qemu_ram_get_idstr(rb), 776 rb_offset); 777 if (ramblock_recv_bitmap_test_byte_offset(rb, aligned_rbo)) { 778 trace_postcopy_request_shared_page_present(pcfd->idstr, 779 qemu_ram_get_idstr(rb), rb_offset); 780 return postcopy_wake_shared(pcfd, client_addr, rb); 781 } 782 postcopy_request_page(mis, rb, aligned_rbo, client_addr); 783 return 0; 784 } 785 786 static int get_mem_fault_cpu_index(uint32_t pid) 787 { 788 CPUState *cpu_iter; 789 790 CPU_FOREACH(cpu_iter) { 791 if (cpu_iter->thread_id == pid) { 792 trace_get_mem_fault_cpu_index(cpu_iter->cpu_index, pid); 793 return cpu_iter->cpu_index; 794 } 795 } 796 trace_get_mem_fault_cpu_index(-1, pid); 797 return -1; 798 } 799 800 static uint32_t get_low_time_offset(PostcopyBlocktimeContext *dc) 801 { 802 int64_t start_time_offset = qemu_clock_get_ms(QEMU_CLOCK_REALTIME) - 803 dc->start_time; 804 return start_time_offset < 1 ? 1 : start_time_offset & UINT32_MAX; 805 } 806 807 /* 808 * This function is being called when pagefault occurs. It 809 * tracks down vCPU blocking time. 810 * 811 * @addr: faulted host virtual address 812 * @ptid: faulted process thread id 813 * @rb: ramblock appropriate to addr 814 */ 815 static void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid, 816 RAMBlock *rb) 817 { 818 int cpu, already_received; 819 MigrationIncomingState *mis = migration_incoming_get_current(); 820 PostcopyBlocktimeContext *dc = mis->blocktime_ctx; 821 uint32_t low_time_offset; 822 823 if (!dc || ptid == 0) { 824 return; 825 } 826 cpu = get_mem_fault_cpu_index(ptid); 827 if (cpu < 0) { 828 return; 829 } 830 831 low_time_offset = get_low_time_offset(dc); 832 if (dc->vcpu_addr[cpu] == 0) { 833 qatomic_inc(&dc->smp_cpus_down); 834 } 835 836 qatomic_xchg(&dc->last_begin, low_time_offset); 837 qatomic_xchg(&dc->page_fault_vcpu_time[cpu], low_time_offset); 838 qatomic_xchg(&dc->vcpu_addr[cpu], addr); 839 840 /* 841 * check it here, not at the beginning of the function, 842 * due to, check could occur early than bitmap_set in 843 * qemu_ufd_copy_ioctl 844 */ 845 already_received = ramblock_recv_bitmap_test(rb, (void *)addr); 846 if (already_received) { 847 qatomic_xchg(&dc->vcpu_addr[cpu], 0); 848 qatomic_xchg(&dc->page_fault_vcpu_time[cpu], 0); 849 qatomic_dec(&dc->smp_cpus_down); 850 } 851 trace_mark_postcopy_blocktime_begin(addr, dc, dc->page_fault_vcpu_time[cpu], 852 cpu, already_received); 853 } 854 855 /* 856 * This function just provide calculated blocktime per cpu and trace it. 857 * Total blocktime is calculated in mark_postcopy_blocktime_end. 858 * 859 * 860 * Assume we have 3 CPU 861 * 862 * S1 E1 S1 E1 863 * -----***********------------xxx***************------------------------> CPU1 864 * 865 * S2 E2 866 * ------------****************xxx---------------------------------------> CPU2 867 * 868 * S3 E3 869 * ------------------------****xxx********-------------------------------> CPU3 870 * 871 * We have sequence S1,S2,E1,S3,S1,E2,E3,E1 872 * S2,E1 - doesn't match condition due to sequence S1,S2,E1 doesn't include CPU3 873 * S3,S1,E2 - sequence includes all CPUs, in this case overlap will be S1,E2 - 874 * it's a part of total blocktime. 875 * S1 - here is last_begin 876 * Legend of the picture is following: 877 * * - means blocktime per vCPU 878 * x - means overlapped blocktime (total blocktime) 879 * 880 * @addr: host virtual address 881 */ 882 static void mark_postcopy_blocktime_end(uintptr_t addr) 883 { 884 MigrationIncomingState *mis = migration_incoming_get_current(); 885 PostcopyBlocktimeContext *dc = mis->blocktime_ctx; 886 MachineState *ms = MACHINE(qdev_get_machine()); 887 unsigned int smp_cpus = ms->smp.cpus; 888 int i, affected_cpu = 0; 889 bool vcpu_total_blocktime = false; 890 uint32_t read_vcpu_time, low_time_offset; 891 892 if (!dc) { 893 return; 894 } 895 896 low_time_offset = get_low_time_offset(dc); 897 /* lookup cpu, to clear it, 898 * that algorithm looks straightforward, but it's not 899 * optimal, more optimal algorithm is keeping tree or hash 900 * where key is address value is a list of */ 901 for (i = 0; i < smp_cpus; i++) { 902 uint32_t vcpu_blocktime = 0; 903 904 read_vcpu_time = qatomic_fetch_add(&dc->page_fault_vcpu_time[i], 0); 905 if (qatomic_fetch_add(&dc->vcpu_addr[i], 0) != addr || 906 read_vcpu_time == 0) { 907 continue; 908 } 909 qatomic_xchg(&dc->vcpu_addr[i], 0); 910 vcpu_blocktime = low_time_offset - read_vcpu_time; 911 affected_cpu += 1; 912 /* we need to know is that mark_postcopy_end was due to 913 * faulted page, another possible case it's prefetched 914 * page and in that case we shouldn't be here */ 915 if (!vcpu_total_blocktime && 916 qatomic_fetch_add(&dc->smp_cpus_down, 0) == smp_cpus) { 917 vcpu_total_blocktime = true; 918 } 919 /* continue cycle, due to one page could affect several vCPUs */ 920 dc->vcpu_blocktime[i] += vcpu_blocktime; 921 } 922 923 qatomic_sub(&dc->smp_cpus_down, affected_cpu); 924 if (vcpu_total_blocktime) { 925 dc->total_blocktime += low_time_offset - qatomic_fetch_add( 926 &dc->last_begin, 0); 927 } 928 trace_mark_postcopy_blocktime_end(addr, dc, dc->total_blocktime, 929 affected_cpu); 930 } 931 932 static void postcopy_pause_fault_thread(MigrationIncomingState *mis) 933 { 934 trace_postcopy_pause_fault_thread(); 935 qemu_sem_wait(&mis->postcopy_pause_sem_fault); 936 trace_postcopy_pause_fault_thread_continued(); 937 } 938 939 /* 940 * Handle faults detected by the USERFAULT markings 941 */ 942 static void *postcopy_ram_fault_thread(void *opaque) 943 { 944 MigrationIncomingState *mis = opaque; 945 struct uffd_msg msg; 946 int ret; 947 size_t index; 948 RAMBlock *rb = NULL; 949 950 trace_postcopy_ram_fault_thread_entry(); 951 rcu_register_thread(); 952 mis->last_rb = NULL; /* last RAMBlock we sent part of */ 953 qemu_sem_post(&mis->thread_sync_sem); 954 955 struct pollfd *pfd; 956 size_t pfd_len = 2 + mis->postcopy_remote_fds->len; 957 958 pfd = g_new0(struct pollfd, pfd_len); 959 960 pfd[0].fd = mis->userfault_fd; 961 pfd[0].events = POLLIN; 962 pfd[1].fd = mis->userfault_event_fd; 963 pfd[1].events = POLLIN; /* Waiting for eventfd to go positive */ 964 trace_postcopy_ram_fault_thread_fds_core(pfd[0].fd, pfd[1].fd); 965 for (index = 0; index < mis->postcopy_remote_fds->len; index++) { 966 struct PostCopyFD *pcfd = &g_array_index(mis->postcopy_remote_fds, 967 struct PostCopyFD, index); 968 pfd[2 + index].fd = pcfd->fd; 969 pfd[2 + index].events = POLLIN; 970 trace_postcopy_ram_fault_thread_fds_extra(2 + index, pcfd->idstr, 971 pcfd->fd); 972 } 973 974 while (true) { 975 ram_addr_t rb_offset; 976 int poll_result; 977 978 /* 979 * We're mainly waiting for the kernel to give us a faulting HVA, 980 * however we can be told to quit via userfault_quit_fd which is 981 * an eventfd 982 */ 983 984 poll_result = poll(pfd, pfd_len, -1 /* Wait forever */); 985 if (poll_result == -1) { 986 error_report("%s: userfault poll: %s", __func__, strerror(errno)); 987 break; 988 } 989 990 if (!mis->to_src_file) { 991 /* 992 * Possibly someone tells us that the return path is 993 * broken already using the event. We should hold until 994 * the channel is rebuilt. 995 */ 996 postcopy_pause_fault_thread(mis); 997 } 998 999 if (pfd[1].revents) { 1000 uint64_t tmp64 = 0; 1001 1002 /* Consume the signal */ 1003 if (read(mis->userfault_event_fd, &tmp64, 8) != 8) { 1004 /* Nothing obviously nicer than posting this error. */ 1005 error_report("%s: read() failed", __func__); 1006 } 1007 1008 if (qatomic_read(&mis->fault_thread_quit)) { 1009 trace_postcopy_ram_fault_thread_quit(); 1010 break; 1011 } 1012 } 1013 1014 if (pfd[0].revents) { 1015 poll_result--; 1016 ret = read(mis->userfault_fd, &msg, sizeof(msg)); 1017 if (ret != sizeof(msg)) { 1018 if (errno == EAGAIN) { 1019 /* 1020 * if a wake up happens on the other thread just after 1021 * the poll, there is nothing to read. 1022 */ 1023 continue; 1024 } 1025 if (ret < 0) { 1026 error_report("%s: Failed to read full userfault " 1027 "message: %s", 1028 __func__, strerror(errno)); 1029 break; 1030 } else { 1031 error_report("%s: Read %d bytes from userfaultfd " 1032 "expected %zd", 1033 __func__, ret, sizeof(msg)); 1034 break; /* Lost alignment, don't know what we'd read next */ 1035 } 1036 } 1037 if (msg.event != UFFD_EVENT_PAGEFAULT) { 1038 error_report("%s: Read unexpected event %ud from userfaultfd", 1039 __func__, msg.event); 1040 continue; /* It's not a page fault, shouldn't happen */ 1041 } 1042 1043 rb = qemu_ram_block_from_host( 1044 (void *)(uintptr_t)msg.arg.pagefault.address, 1045 true, &rb_offset); 1046 if (!rb) { 1047 error_report("postcopy_ram_fault_thread: Fault outside guest: %" 1048 PRIx64, (uint64_t)msg.arg.pagefault.address); 1049 break; 1050 } 1051 1052 rb_offset = ROUND_DOWN(rb_offset, qemu_ram_pagesize(rb)); 1053 trace_postcopy_ram_fault_thread_request(msg.arg.pagefault.address, 1054 qemu_ram_get_idstr(rb), 1055 rb_offset, 1056 msg.arg.pagefault.feat.ptid); 1057 mark_postcopy_blocktime_begin( 1058 (uintptr_t)(msg.arg.pagefault.address), 1059 msg.arg.pagefault.feat.ptid, rb); 1060 1061 retry: 1062 /* 1063 * Send the request to the source - we want to request one 1064 * of our host page sizes (which is >= TPS) 1065 */ 1066 ret = postcopy_request_page(mis, rb, rb_offset, 1067 msg.arg.pagefault.address); 1068 if (ret) { 1069 /* May be network failure, try to wait for recovery */ 1070 postcopy_pause_fault_thread(mis); 1071 goto retry; 1072 } 1073 } 1074 1075 /* Now handle any requests from external processes on shared memory */ 1076 /* TODO: May need to handle devices deregistering during postcopy */ 1077 for (index = 2; index < pfd_len && poll_result; index++) { 1078 if (pfd[index].revents) { 1079 struct PostCopyFD *pcfd = 1080 &g_array_index(mis->postcopy_remote_fds, 1081 struct PostCopyFD, index - 2); 1082 1083 poll_result--; 1084 if (pfd[index].revents & POLLERR) { 1085 error_report("%s: POLLERR on poll %zd fd=%d", 1086 __func__, index, pcfd->fd); 1087 pfd[index].events = 0; 1088 continue; 1089 } 1090 1091 ret = read(pcfd->fd, &msg, sizeof(msg)); 1092 if (ret != sizeof(msg)) { 1093 if (errno == EAGAIN) { 1094 /* 1095 * if a wake up happens on the other thread just after 1096 * the poll, there is nothing to read. 1097 */ 1098 continue; 1099 } 1100 if (ret < 0) { 1101 error_report("%s: Failed to read full userfault " 1102 "message: %s (shared) revents=%d", 1103 __func__, strerror(errno), 1104 pfd[index].revents); 1105 /*TODO: Could just disable this sharer */ 1106 break; 1107 } else { 1108 error_report("%s: Read %d bytes from userfaultfd " 1109 "expected %zd (shared)", 1110 __func__, ret, sizeof(msg)); 1111 /*TODO: Could just disable this sharer */ 1112 break; /*Lost alignment,don't know what we'd read next*/ 1113 } 1114 } 1115 if (msg.event != UFFD_EVENT_PAGEFAULT) { 1116 error_report("%s: Read unexpected event %ud " 1117 "from userfaultfd (shared)", 1118 __func__, msg.event); 1119 continue; /* It's not a page fault, shouldn't happen */ 1120 } 1121 /* Call the device handler registered with us */ 1122 ret = pcfd->handler(pcfd, &msg); 1123 if (ret) { 1124 error_report("%s: Failed to resolve shared fault on %zd/%s", 1125 __func__, index, pcfd->idstr); 1126 /* TODO: Fail? Disable this sharer? */ 1127 } 1128 } 1129 } 1130 } 1131 rcu_unregister_thread(); 1132 trace_postcopy_ram_fault_thread_exit(); 1133 g_free(pfd); 1134 return NULL; 1135 } 1136 1137 static int postcopy_temp_pages_setup(MigrationIncomingState *mis) 1138 { 1139 PostcopyTmpPage *tmp_page; 1140 int err, i, channels; 1141 void *temp_page; 1142 1143 if (migrate_postcopy_preempt()) { 1144 /* If preemption enabled, need extra channel for urgent requests */ 1145 mis->postcopy_channels = RAM_CHANNEL_MAX; 1146 } else { 1147 /* Both precopy/postcopy on the same channel */ 1148 mis->postcopy_channels = 1; 1149 } 1150 1151 channels = mis->postcopy_channels; 1152 mis->postcopy_tmp_pages = g_malloc0_n(sizeof(PostcopyTmpPage), channels); 1153 1154 for (i = 0; i < channels; i++) { 1155 tmp_page = &mis->postcopy_tmp_pages[i]; 1156 temp_page = mmap(NULL, mis->largest_page_size, PROT_READ | PROT_WRITE, 1157 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 1158 if (temp_page == MAP_FAILED) { 1159 err = errno; 1160 error_report("%s: Failed to map postcopy_tmp_pages[%d]: %s", 1161 __func__, i, strerror(err)); 1162 /* Clean up will be done later */ 1163 return -err; 1164 } 1165 tmp_page->tmp_huge_page = temp_page; 1166 /* Initialize default states for each tmp page */ 1167 postcopy_temp_page_reset(tmp_page); 1168 } 1169 1170 /* 1171 * Map large zero page when kernel can't use UFFDIO_ZEROPAGE for hugepages 1172 */ 1173 mis->postcopy_tmp_zero_page = mmap(NULL, mis->largest_page_size, 1174 PROT_READ | PROT_WRITE, 1175 MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 1176 if (mis->postcopy_tmp_zero_page == MAP_FAILED) { 1177 err = errno; 1178 mis->postcopy_tmp_zero_page = NULL; 1179 error_report("%s: Failed to map large zero page %s", 1180 __func__, strerror(err)); 1181 return -err; 1182 } 1183 1184 memset(mis->postcopy_tmp_zero_page, '\0', mis->largest_page_size); 1185 1186 return 0; 1187 } 1188 1189 int postcopy_ram_incoming_setup(MigrationIncomingState *mis) 1190 { 1191 /* Open the fd for the kernel to give us userfaults */ 1192 mis->userfault_fd = uffd_open(O_CLOEXEC | O_NONBLOCK); 1193 if (mis->userfault_fd == -1) { 1194 error_report("%s: Failed to open userfault fd: %s", __func__, 1195 strerror(errno)); 1196 return -1; 1197 } 1198 1199 /* 1200 * Although the host check already tested the API, we need to 1201 * do the check again as an ABI handshake on the new fd. 1202 */ 1203 if (!ufd_check_and_apply(mis->userfault_fd, mis)) { 1204 return -1; 1205 } 1206 1207 /* Now an eventfd we use to tell the fault-thread to quit */ 1208 mis->userfault_event_fd = eventfd(0, EFD_CLOEXEC); 1209 if (mis->userfault_event_fd == -1) { 1210 error_report("%s: Opening userfault_event_fd: %s", __func__, 1211 strerror(errno)); 1212 close(mis->userfault_fd); 1213 return -1; 1214 } 1215 1216 postcopy_thread_create(mis, &mis->fault_thread, "fault-default", 1217 postcopy_ram_fault_thread, QEMU_THREAD_JOINABLE); 1218 mis->have_fault_thread = true; 1219 1220 /* Mark so that we get notified of accesses to unwritten areas */ 1221 if (foreach_not_ignored_block(ram_block_enable_notify, mis)) { 1222 error_report("ram_block_enable_notify failed"); 1223 return -1; 1224 } 1225 1226 if (postcopy_temp_pages_setup(mis)) { 1227 /* Error dumped in the sub-function */ 1228 return -1; 1229 } 1230 1231 if (migrate_postcopy_preempt()) { 1232 /* 1233 * This thread needs to be created after the temp pages because 1234 * it'll fetch RAM_CHANNEL_POSTCOPY PostcopyTmpPage immediately. 1235 */ 1236 postcopy_thread_create(mis, &mis->postcopy_prio_thread, "fault-fast", 1237 postcopy_preempt_thread, QEMU_THREAD_JOINABLE); 1238 mis->preempt_thread_status = PREEMPT_THREAD_CREATED; 1239 } 1240 1241 trace_postcopy_ram_enable_notify(); 1242 1243 return 0; 1244 } 1245 1246 static int qemu_ufd_copy_ioctl(MigrationIncomingState *mis, void *host_addr, 1247 void *from_addr, uint64_t pagesize, RAMBlock *rb) 1248 { 1249 int userfault_fd = mis->userfault_fd; 1250 int ret; 1251 1252 if (from_addr) { 1253 struct uffdio_copy copy_struct; 1254 copy_struct.dst = (uint64_t)(uintptr_t)host_addr; 1255 copy_struct.src = (uint64_t)(uintptr_t)from_addr; 1256 copy_struct.len = pagesize; 1257 copy_struct.mode = 0; 1258 ret = ioctl(userfault_fd, UFFDIO_COPY, ©_struct); 1259 } else { 1260 struct uffdio_zeropage zero_struct; 1261 zero_struct.range.start = (uint64_t)(uintptr_t)host_addr; 1262 zero_struct.range.len = pagesize; 1263 zero_struct.mode = 0; 1264 ret = ioctl(userfault_fd, UFFDIO_ZEROPAGE, &zero_struct); 1265 } 1266 if (!ret) { 1267 qemu_mutex_lock(&mis->page_request_mutex); 1268 ramblock_recv_bitmap_set_range(rb, host_addr, 1269 pagesize / qemu_target_page_size()); 1270 /* 1271 * If this page resolves a page fault for a previous recorded faulted 1272 * address, take a special note to maintain the requested page list. 1273 */ 1274 if (g_tree_lookup(mis->page_requested, host_addr)) { 1275 g_tree_remove(mis->page_requested, host_addr); 1276 mis->page_requested_count--; 1277 trace_postcopy_page_req_del(host_addr, mis->page_requested_count); 1278 } 1279 qemu_mutex_unlock(&mis->page_request_mutex); 1280 mark_postcopy_blocktime_end((uintptr_t)host_addr); 1281 } 1282 return ret; 1283 } 1284 1285 int postcopy_notify_shared_wake(RAMBlock *rb, uint64_t offset) 1286 { 1287 int i; 1288 MigrationIncomingState *mis = migration_incoming_get_current(); 1289 GArray *pcrfds = mis->postcopy_remote_fds; 1290 1291 for (i = 0; i < pcrfds->len; i++) { 1292 struct PostCopyFD *cur = &g_array_index(pcrfds, struct PostCopyFD, i); 1293 int ret = cur->waker(cur, rb, offset); 1294 if (ret) { 1295 return ret; 1296 } 1297 } 1298 return 0; 1299 } 1300 1301 /* 1302 * Place a host page (from) at (host) atomically 1303 * returns 0 on success 1304 */ 1305 int postcopy_place_page(MigrationIncomingState *mis, void *host, void *from, 1306 RAMBlock *rb) 1307 { 1308 size_t pagesize = qemu_ram_pagesize(rb); 1309 1310 /* copy also acks to the kernel waking the stalled thread up 1311 * TODO: We can inhibit that ack and only do it if it was requested 1312 * which would be slightly cheaper, but we'd have to be careful 1313 * of the order of updating our page state. 1314 */ 1315 if (qemu_ufd_copy_ioctl(mis, host, from, pagesize, rb)) { 1316 int e = errno; 1317 error_report("%s: %s copy host: %p from: %p (size: %zd)", 1318 __func__, strerror(e), host, from, pagesize); 1319 1320 return -e; 1321 } 1322 1323 trace_postcopy_place_page(host); 1324 return postcopy_notify_shared_wake(rb, 1325 qemu_ram_block_host_offset(rb, host)); 1326 } 1327 1328 /* 1329 * Place a zero page at (host) atomically 1330 * returns 0 on success 1331 */ 1332 int postcopy_place_page_zero(MigrationIncomingState *mis, void *host, 1333 RAMBlock *rb) 1334 { 1335 size_t pagesize = qemu_ram_pagesize(rb); 1336 trace_postcopy_place_page_zero(host); 1337 1338 /* Normal RAMBlocks can zero a page using UFFDIO_ZEROPAGE 1339 * but it's not available for everything (e.g. hugetlbpages) 1340 */ 1341 if (qemu_ram_is_uf_zeroable(rb)) { 1342 if (qemu_ufd_copy_ioctl(mis, host, NULL, pagesize, rb)) { 1343 int e = errno; 1344 error_report("%s: %s zero host: %p", 1345 __func__, strerror(e), host); 1346 1347 return -e; 1348 } 1349 return postcopy_notify_shared_wake(rb, 1350 qemu_ram_block_host_offset(rb, 1351 host)); 1352 } else { 1353 return postcopy_place_page(mis, host, mis->postcopy_tmp_zero_page, rb); 1354 } 1355 } 1356 1357 #else 1358 /* No target OS support, stubs just fail */ 1359 void fill_destination_postcopy_migration_info(MigrationInfo *info) 1360 { 1361 } 1362 1363 bool postcopy_ram_supported_by_host(MigrationIncomingState *mis) 1364 { 1365 error_report("%s: No OS support", __func__); 1366 return false; 1367 } 1368 1369 int postcopy_ram_incoming_init(MigrationIncomingState *mis) 1370 { 1371 error_report("postcopy_ram_incoming_init: No OS support"); 1372 return -1; 1373 } 1374 1375 int postcopy_ram_incoming_cleanup(MigrationIncomingState *mis) 1376 { 1377 assert(0); 1378 return -1; 1379 } 1380 1381 int postcopy_ram_prepare_discard(MigrationIncomingState *mis) 1382 { 1383 assert(0); 1384 return -1; 1385 } 1386 1387 int postcopy_request_shared_page(struct PostCopyFD *pcfd, RAMBlock *rb, 1388 uint64_t client_addr, uint64_t rb_offset) 1389 { 1390 assert(0); 1391 return -1; 1392 } 1393 1394 int postcopy_ram_incoming_setup(MigrationIncomingState *mis) 1395 { 1396 assert(0); 1397 return -1; 1398 } 1399 1400 int postcopy_place_page(MigrationIncomingState *mis, void *host, void *from, 1401 RAMBlock *rb) 1402 { 1403 assert(0); 1404 return -1; 1405 } 1406 1407 int postcopy_place_page_zero(MigrationIncomingState *mis, void *host, 1408 RAMBlock *rb) 1409 { 1410 assert(0); 1411 return -1; 1412 } 1413 1414 int postcopy_wake_shared(struct PostCopyFD *pcfd, 1415 uint64_t client_addr, 1416 RAMBlock *rb) 1417 { 1418 assert(0); 1419 return -1; 1420 } 1421 #endif 1422 1423 /* ------------------------------------------------------------------------- */ 1424 void postcopy_temp_page_reset(PostcopyTmpPage *tmp_page) 1425 { 1426 tmp_page->target_pages = 0; 1427 tmp_page->host_addr = NULL; 1428 /* 1429 * This is set to true when reset, and cleared as long as we received any 1430 * of the non-zero small page within this huge page. 1431 */ 1432 tmp_page->all_zero = true; 1433 } 1434 1435 void postcopy_fault_thread_notify(MigrationIncomingState *mis) 1436 { 1437 uint64_t tmp64 = 1; 1438 1439 /* 1440 * Wakeup the fault_thread. It's an eventfd that should currently 1441 * be at 0, we're going to increment it to 1 1442 */ 1443 if (write(mis->userfault_event_fd, &tmp64, 8) != 8) { 1444 /* Not much we can do here, but may as well report it */ 1445 error_report("%s: incrementing failed: %s", __func__, 1446 strerror(errno)); 1447 } 1448 } 1449 1450 /** 1451 * postcopy_discard_send_init: Called at the start of each RAMBlock before 1452 * asking to discard individual ranges. 1453 * 1454 * @ms: The current migration state. 1455 * @offset: the bitmap offset of the named RAMBlock in the migration bitmap. 1456 * @name: RAMBlock that discards will operate on. 1457 */ 1458 static PostcopyDiscardState pds = {0}; 1459 void postcopy_discard_send_init(MigrationState *ms, const char *name) 1460 { 1461 pds.ramblock_name = name; 1462 pds.cur_entry = 0; 1463 pds.nsentwords = 0; 1464 pds.nsentcmds = 0; 1465 } 1466 1467 /** 1468 * postcopy_discard_send_range: Called by the bitmap code for each chunk to 1469 * discard. May send a discard message, may just leave it queued to 1470 * be sent later. 1471 * 1472 * @ms: Current migration state. 1473 * @start,@length: a range of pages in the migration bitmap in the 1474 * RAM block passed to postcopy_discard_send_init() (length=1 is one page) 1475 */ 1476 void postcopy_discard_send_range(MigrationState *ms, unsigned long start, 1477 unsigned long length) 1478 { 1479 size_t tp_size = qemu_target_page_size(); 1480 /* Convert to byte offsets within the RAM block */ 1481 pds.start_list[pds.cur_entry] = start * tp_size; 1482 pds.length_list[pds.cur_entry] = length * tp_size; 1483 trace_postcopy_discard_send_range(pds.ramblock_name, start, length); 1484 pds.cur_entry++; 1485 pds.nsentwords++; 1486 1487 if (pds.cur_entry == MAX_DISCARDS_PER_COMMAND) { 1488 /* Full set, ship it! */ 1489 qemu_savevm_send_postcopy_ram_discard(ms->to_dst_file, 1490 pds.ramblock_name, 1491 pds.cur_entry, 1492 pds.start_list, 1493 pds.length_list); 1494 pds.nsentcmds++; 1495 pds.cur_entry = 0; 1496 } 1497 } 1498 1499 /** 1500 * postcopy_discard_send_finish: Called at the end of each RAMBlock by the 1501 * bitmap code. Sends any outstanding discard messages, frees the PDS 1502 * 1503 * @ms: Current migration state. 1504 */ 1505 void postcopy_discard_send_finish(MigrationState *ms) 1506 { 1507 /* Anything unsent? */ 1508 if (pds.cur_entry) { 1509 qemu_savevm_send_postcopy_ram_discard(ms->to_dst_file, 1510 pds.ramblock_name, 1511 pds.cur_entry, 1512 pds.start_list, 1513 pds.length_list); 1514 pds.nsentcmds++; 1515 } 1516 1517 trace_postcopy_discard_send_finish(pds.ramblock_name, pds.nsentwords, 1518 pds.nsentcmds); 1519 } 1520 1521 /* 1522 * Current state of incoming postcopy; note this is not part of 1523 * MigrationIncomingState since it's state is used during cleanup 1524 * at the end as MIS is being freed. 1525 */ 1526 static PostcopyState incoming_postcopy_state; 1527 1528 PostcopyState postcopy_state_get(void) 1529 { 1530 return qatomic_load_acquire(&incoming_postcopy_state); 1531 } 1532 1533 /* Set the state and return the old state */ 1534 PostcopyState postcopy_state_set(PostcopyState new_state) 1535 { 1536 return qatomic_xchg(&incoming_postcopy_state, new_state); 1537 } 1538 1539 /* Register a handler for external shared memory postcopy 1540 * called on the destination. 1541 */ 1542 void postcopy_register_shared_ufd(struct PostCopyFD *pcfd) 1543 { 1544 MigrationIncomingState *mis = migration_incoming_get_current(); 1545 1546 mis->postcopy_remote_fds = g_array_append_val(mis->postcopy_remote_fds, 1547 *pcfd); 1548 } 1549 1550 /* Unregister a handler for external shared memory postcopy 1551 */ 1552 void postcopy_unregister_shared_ufd(struct PostCopyFD *pcfd) 1553 { 1554 guint i; 1555 MigrationIncomingState *mis = migration_incoming_get_current(); 1556 GArray *pcrfds = mis->postcopy_remote_fds; 1557 1558 if (!pcrfds) { 1559 /* migration has already finished and freed the array */ 1560 return; 1561 } 1562 for (i = 0; i < pcrfds->len; i++) { 1563 struct PostCopyFD *cur = &g_array_index(pcrfds, struct PostCopyFD, i); 1564 if (cur->fd == pcfd->fd) { 1565 mis->postcopy_remote_fds = g_array_remove_index(pcrfds, i); 1566 return; 1567 } 1568 } 1569 } 1570 1571 void postcopy_preempt_new_channel(MigrationIncomingState *mis, QEMUFile *file) 1572 { 1573 /* 1574 * The new loading channel has its own threads, so it needs to be 1575 * blocked too. It's by default true, just be explicit. 1576 */ 1577 qemu_file_set_blocking(file, true); 1578 mis->postcopy_qemufile_dst = file; 1579 qemu_sem_post(&mis->postcopy_qemufile_dst_done); 1580 trace_postcopy_preempt_new_channel(); 1581 } 1582 1583 /* 1584 * Setup the postcopy preempt channel with the IOC. If ERROR is specified, 1585 * setup the error instead. This helper will free the ERROR if specified. 1586 */ 1587 static void 1588 postcopy_preempt_send_channel_done(MigrationState *s, 1589 QIOChannel *ioc, Error *local_err) 1590 { 1591 if (local_err) { 1592 migrate_set_error(s, local_err); 1593 error_free(local_err); 1594 } else { 1595 migration_ioc_register_yank(ioc); 1596 s->postcopy_qemufile_src = qemu_file_new_output(ioc); 1597 trace_postcopy_preempt_new_channel(); 1598 } 1599 1600 /* 1601 * Kick the waiter in all cases. The waiter should check upon 1602 * postcopy_qemufile_src to know whether it failed or not. 1603 */ 1604 qemu_sem_post(&s->postcopy_qemufile_src_sem); 1605 } 1606 1607 static void 1608 postcopy_preempt_tls_handshake(QIOTask *task, gpointer opaque) 1609 { 1610 g_autoptr(QIOChannel) ioc = QIO_CHANNEL(qio_task_get_source(task)); 1611 MigrationState *s = opaque; 1612 Error *local_err = NULL; 1613 1614 qio_task_propagate_error(task, &local_err); 1615 postcopy_preempt_send_channel_done(s, ioc, local_err); 1616 } 1617 1618 static void 1619 postcopy_preempt_send_channel_new(QIOTask *task, gpointer opaque) 1620 { 1621 g_autoptr(QIOChannel) ioc = QIO_CHANNEL(qio_task_get_source(task)); 1622 MigrationState *s = opaque; 1623 QIOChannelTLS *tioc; 1624 Error *local_err = NULL; 1625 1626 if (qio_task_propagate_error(task, &local_err)) { 1627 goto out; 1628 } 1629 1630 if (migrate_channel_requires_tls_upgrade(ioc)) { 1631 tioc = migration_tls_client_create(s, ioc, s->hostname, &local_err); 1632 if (!tioc) { 1633 goto out; 1634 } 1635 trace_postcopy_preempt_tls_handshake(); 1636 qio_channel_set_name(QIO_CHANNEL(tioc), "migration-tls-preempt"); 1637 qio_channel_tls_handshake(tioc, postcopy_preempt_tls_handshake, 1638 s, NULL, NULL); 1639 /* Setup the channel until TLS handshake finished */ 1640 return; 1641 } 1642 1643 out: 1644 /* This handles both good and error cases */ 1645 postcopy_preempt_send_channel_done(s, ioc, local_err); 1646 } 1647 1648 /* 1649 * This function will kick off an async task to establish the preempt 1650 * channel, and wait until the connection setup completed. Returns 0 if 1651 * channel established, -1 for error. 1652 */ 1653 int postcopy_preempt_establish_channel(MigrationState *s) 1654 { 1655 /* If preempt not enabled, no need to wait */ 1656 if (!migrate_postcopy_preempt()) { 1657 return 0; 1658 } 1659 1660 /* 1661 * Kick off async task to establish preempt channel. Only do so with 1662 * 8.0+ machines, because 7.1/7.2 require the channel to be created in 1663 * setup phase of migration (even if racy in an unreliable network). 1664 */ 1665 if (!s->preempt_pre_7_2) { 1666 postcopy_preempt_setup(s); 1667 } 1668 1669 /* 1670 * We need the postcopy preempt channel to be established before 1671 * starting doing anything. 1672 */ 1673 qemu_sem_wait(&s->postcopy_qemufile_src_sem); 1674 1675 return s->postcopy_qemufile_src ? 0 : -1; 1676 } 1677 1678 void postcopy_preempt_setup(MigrationState *s) 1679 { 1680 /* Kick an async task to connect */ 1681 socket_send_channel_create(postcopy_preempt_send_channel_new, s); 1682 } 1683 1684 static void postcopy_pause_ram_fast_load(MigrationIncomingState *mis) 1685 { 1686 trace_postcopy_pause_fast_load(); 1687 qemu_mutex_unlock(&mis->postcopy_prio_thread_mutex); 1688 qemu_sem_wait(&mis->postcopy_pause_sem_fast_load); 1689 qemu_mutex_lock(&mis->postcopy_prio_thread_mutex); 1690 trace_postcopy_pause_fast_load_continued(); 1691 } 1692 1693 static bool preempt_thread_should_run(MigrationIncomingState *mis) 1694 { 1695 return mis->preempt_thread_status != PREEMPT_THREAD_QUIT; 1696 } 1697 1698 void *postcopy_preempt_thread(void *opaque) 1699 { 1700 MigrationIncomingState *mis = opaque; 1701 int ret; 1702 1703 trace_postcopy_preempt_thread_entry(); 1704 1705 rcu_register_thread(); 1706 1707 qemu_sem_post(&mis->thread_sync_sem); 1708 1709 /* 1710 * The preempt channel is established in asynchronous way. Wait 1711 * for its completion. 1712 */ 1713 qemu_sem_wait(&mis->postcopy_qemufile_dst_done); 1714 1715 /* Sending RAM_SAVE_FLAG_EOS to terminate this thread */ 1716 qemu_mutex_lock(&mis->postcopy_prio_thread_mutex); 1717 while (preempt_thread_should_run(mis)) { 1718 ret = ram_load_postcopy(mis->postcopy_qemufile_dst, 1719 RAM_CHANNEL_POSTCOPY); 1720 /* If error happened, go into recovery routine */ 1721 if (ret && preempt_thread_should_run(mis)) { 1722 postcopy_pause_ram_fast_load(mis); 1723 } else { 1724 /* We're done */ 1725 break; 1726 } 1727 } 1728 qemu_mutex_unlock(&mis->postcopy_prio_thread_mutex); 1729 1730 rcu_unregister_thread(); 1731 1732 trace_postcopy_preempt_thread_exit(); 1733 1734 return NULL; 1735 } 1736