target/ppc: Implement the rest of gen_ld_atomic
[qemu.git] / migration / postcopy-ram.c
blob932f18894990261384d286c432a98ab2cb2b57dd
1 /*
2 * Postcopy migration for RAM
4 * Copyright 2013-2015 Red Hat, Inc. and/or its affiliates
6 * Authors:
7 * Dave Gilbert <dgilbert@redhat.com>
9 * This work is licensed under the terms of the GNU GPL, version 2 or later.
10 * See the COPYING file in the top-level directory.
15 * Postcopy is a migration technique where the execution flips from the
16 * source to the destination before all the data has been copied.
19 #include "qemu/osdep.h"
20 #include "exec/target_page.h"
21 #include "migration.h"
22 #include "qemu-file.h"
23 #include "savevm.h"
24 #include "postcopy-ram.h"
25 #include "ram.h"
26 #include "qapi/error.h"
27 #include "qemu/notify.h"
28 #include "sysemu/sysemu.h"
29 #include "sysemu/balloon.h"
30 #include "qemu/error-report.h"
31 #include "trace.h"
33 /* Arbitrary limit on size of each discard command,
34 * keeps them around ~200 bytes
36 #define MAX_DISCARDS_PER_COMMAND 12
38 struct PostcopyDiscardState {
39 const char *ramblock_name;
40 uint16_t cur_entry;
42 * Start and length of a discard range (bytes)
44 uint64_t start_list[MAX_DISCARDS_PER_COMMAND];
45 uint64_t length_list[MAX_DISCARDS_PER_COMMAND];
46 unsigned int nsentwords;
47 unsigned int nsentcmds;
50 static NotifierWithReturnList postcopy_notifier_list;
52 void postcopy_infrastructure_init(void)
54 notifier_with_return_list_init(&postcopy_notifier_list);
57 void postcopy_add_notifier(NotifierWithReturn *nn)
59 notifier_with_return_list_add(&postcopy_notifier_list, nn);
62 void postcopy_remove_notifier(NotifierWithReturn *n)
64 notifier_with_return_remove(n);
67 int postcopy_notify(enum PostcopyNotifyReason reason, Error **errp)
69 struct PostcopyNotifyData pnd;
70 pnd.reason = reason;
71 pnd.errp = errp;
73 return notifier_with_return_list_notify(&postcopy_notifier_list,
74 &pnd);
77 /* Postcopy needs to detect accesses to pages that haven't yet been copied
78 * across, and efficiently map new pages in, the techniques for doing this
79 * are target OS specific.
81 #if defined(__linux__)
83 #include <poll.h>
84 #include <sys/ioctl.h>
85 #include <sys/syscall.h>
86 #include <asm/types.h> /* for __u64 */
87 #endif
89 #if defined(__linux__) && defined(__NR_userfaultfd) && defined(CONFIG_EVENTFD)
90 #include <sys/eventfd.h>
91 #include <linux/userfaultfd.h>
93 typedef struct PostcopyBlocktimeContext {
94 /* time when page fault initiated per vCPU */
95 uint32_t *page_fault_vcpu_time;
96 /* page address per vCPU */
97 uintptr_t *vcpu_addr;
98 uint32_t total_blocktime;
99 /* blocktime per vCPU */
100 uint32_t *vcpu_blocktime;
101 /* point in time when last page fault was initiated */
102 uint32_t last_begin;
103 /* number of vCPU are suspended */
104 int smp_cpus_down;
105 uint64_t start_time;
108 * Handler for exit event, necessary for
109 * releasing whole blocktime_ctx
111 Notifier exit_notifier;
112 } PostcopyBlocktimeContext;
114 static void destroy_blocktime_context(struct PostcopyBlocktimeContext *ctx)
116 g_free(ctx->page_fault_vcpu_time);
117 g_free(ctx->vcpu_addr);
118 g_free(ctx->vcpu_blocktime);
119 g_free(ctx);
122 static void migration_exit_cb(Notifier *n, void *data)
124 PostcopyBlocktimeContext *ctx = container_of(n, PostcopyBlocktimeContext,
125 exit_notifier);
126 destroy_blocktime_context(ctx);
129 static struct PostcopyBlocktimeContext *blocktime_context_new(void)
131 PostcopyBlocktimeContext *ctx = g_new0(PostcopyBlocktimeContext, 1);
132 ctx->page_fault_vcpu_time = g_new0(uint32_t, smp_cpus);
133 ctx->vcpu_addr = g_new0(uintptr_t, smp_cpus);
134 ctx->vcpu_blocktime = g_new0(uint32_t, smp_cpus);
136 ctx->exit_notifier.notify = migration_exit_cb;
137 ctx->start_time = qemu_clock_get_ms(QEMU_CLOCK_REALTIME);
138 qemu_add_exit_notifier(&ctx->exit_notifier);
139 return ctx;
142 static uint32List *get_vcpu_blocktime_list(PostcopyBlocktimeContext *ctx)
144 uint32List *list = NULL, *entry = NULL;
145 int i;
147 for (i = smp_cpus - 1; i >= 0; i--) {
148 entry = g_new0(uint32List, 1);
149 entry->value = ctx->vcpu_blocktime[i];
150 entry->next = list;
151 list = entry;
154 return list;
158 * This function just populates MigrationInfo from postcopy's
159 * blocktime context. It will not populate MigrationInfo,
160 * unless postcopy-blocktime capability was set.
162 * @info: pointer to MigrationInfo to populate
164 void fill_destination_postcopy_migration_info(MigrationInfo *info)
166 MigrationIncomingState *mis = migration_incoming_get_current();
167 PostcopyBlocktimeContext *bc = mis->blocktime_ctx;
169 if (!bc) {
170 return;
173 info->has_postcopy_blocktime = true;
174 info->postcopy_blocktime = bc->total_blocktime;
175 info->has_postcopy_vcpu_blocktime = true;
176 info->postcopy_vcpu_blocktime = get_vcpu_blocktime_list(bc);
179 static uint32_t get_postcopy_total_blocktime(void)
181 MigrationIncomingState *mis = migration_incoming_get_current();
182 PostcopyBlocktimeContext *bc = mis->blocktime_ctx;
184 if (!bc) {
185 return 0;
188 return bc->total_blocktime;
192 * receive_ufd_features: check userfault fd features, to request only supported
193 * features in the future.
195 * Returns: true on success
197 * __NR_userfaultfd - should be checked before
198 * @features: out parameter will contain uffdio_api.features provided by kernel
199 * in case of success
201 static bool receive_ufd_features(uint64_t *features)
203 struct uffdio_api api_struct = {0};
204 int ufd;
205 bool ret = true;
207 /* if we are here __NR_userfaultfd should exists */
208 ufd = syscall(__NR_userfaultfd, O_CLOEXEC);
209 if (ufd == -1) {
210 error_report("%s: syscall __NR_userfaultfd failed: %s", __func__,
211 strerror(errno));
212 return false;
215 /* ask features */
216 api_struct.api = UFFD_API;
217 api_struct.features = 0;
218 if (ioctl(ufd, UFFDIO_API, &api_struct)) {
219 error_report("%s: UFFDIO_API failed: %s", __func__,
220 strerror(errno));
221 ret = false;
222 goto release_ufd;
225 *features = api_struct.features;
227 release_ufd:
228 close(ufd);
229 return ret;
233 * request_ufd_features: this function should be called only once on a newly
234 * opened ufd, subsequent calls will lead to error.
236 * Returns: true on succes
238 * @ufd: fd obtained from userfaultfd syscall
239 * @features: bit mask see UFFD_API_FEATURES
241 static bool request_ufd_features(int ufd, uint64_t features)
243 struct uffdio_api api_struct = {0};
244 uint64_t ioctl_mask;
246 api_struct.api = UFFD_API;
247 api_struct.features = features;
248 if (ioctl(ufd, UFFDIO_API, &api_struct)) {
249 error_report("%s failed: UFFDIO_API failed: %s", __func__,
250 strerror(errno));
251 return false;
254 ioctl_mask = (__u64)1 << _UFFDIO_REGISTER |
255 (__u64)1 << _UFFDIO_UNREGISTER;
256 if ((api_struct.ioctls & ioctl_mask) != ioctl_mask) {
257 error_report("Missing userfault features: %" PRIx64,
258 (uint64_t)(~api_struct.ioctls & ioctl_mask));
259 return false;
262 return true;
265 static bool ufd_check_and_apply(int ufd, MigrationIncomingState *mis)
267 uint64_t asked_features = 0;
268 static uint64_t supported_features;
271 * it's not possible to
272 * request UFFD_API twice per one fd
273 * userfault fd features is persistent
275 if (!supported_features) {
276 if (!receive_ufd_features(&supported_features)) {
277 error_report("%s failed", __func__);
278 return false;
282 #ifdef UFFD_FEATURE_THREAD_ID
283 if (migrate_postcopy_blocktime() && mis &&
284 UFFD_FEATURE_THREAD_ID & supported_features) {
285 /* kernel supports that feature */
286 /* don't create blocktime_context if it exists */
287 if (!mis->blocktime_ctx) {
288 mis->blocktime_ctx = blocktime_context_new();
291 asked_features |= UFFD_FEATURE_THREAD_ID;
293 #endif
296 * request features, even if asked_features is 0, due to
297 * kernel expects UFFD_API before UFFDIO_REGISTER, per
298 * userfault file descriptor
300 if (!request_ufd_features(ufd, asked_features)) {
301 error_report("%s failed: features %" PRIu64, __func__,
302 asked_features);
303 return false;
306 if (getpagesize() != ram_pagesize_summary()) {
307 bool have_hp = false;
308 /* We've got a huge page */
309 #ifdef UFFD_FEATURE_MISSING_HUGETLBFS
310 have_hp = supported_features & UFFD_FEATURE_MISSING_HUGETLBFS;
311 #endif
312 if (!have_hp) {
313 error_report("Userfault on this host does not support huge pages");
314 return false;
317 return true;
320 /* Callback from postcopy_ram_supported_by_host block iterator.
322 static int test_ramblock_postcopiable(const char *block_name, void *host_addr,
323 ram_addr_t offset, ram_addr_t length, void *opaque)
325 RAMBlock *rb = qemu_ram_block_by_name(block_name);
326 size_t pagesize = qemu_ram_pagesize(rb);
328 if (length % pagesize) {
329 error_report("Postcopy requires RAM blocks to be a page size multiple,"
330 " block %s is 0x" RAM_ADDR_FMT " bytes with a "
331 "page size of 0x%zx", block_name, length, pagesize);
332 return 1;
334 return 0;
338 * Note: This has the side effect of munlock'ing all of RAM, that's
339 * normally fine since if the postcopy succeeds it gets turned back on at the
340 * end.
342 bool postcopy_ram_supported_by_host(MigrationIncomingState *mis)
344 long pagesize = getpagesize();
345 int ufd = -1;
346 bool ret = false; /* Error unless we change it */
347 void *testarea = NULL;
348 struct uffdio_register reg_struct;
349 struct uffdio_range range_struct;
350 uint64_t feature_mask;
351 Error *local_err = NULL;
353 if (qemu_target_page_size() > pagesize) {
354 error_report("Target page size bigger than host page size");
355 goto out;
358 ufd = syscall(__NR_userfaultfd, O_CLOEXEC);
359 if (ufd == -1) {
360 error_report("%s: userfaultfd not available: %s", __func__,
361 strerror(errno));
362 goto out;
365 /* Give devices a chance to object */
366 if (postcopy_notify(POSTCOPY_NOTIFY_PROBE, &local_err)) {
367 error_report_err(local_err);
368 goto out;
371 /* Version and features check */
372 if (!ufd_check_and_apply(ufd, mis)) {
373 goto out;
376 /* We don't support postcopy with shared RAM yet */
377 if (qemu_ram_foreach_migratable_block(test_ramblock_postcopiable, NULL)) {
378 goto out;
382 * userfault and mlock don't go together; we'll put it back later if
383 * it was enabled.
385 if (munlockall()) {
386 error_report("%s: munlockall: %s", __func__, strerror(errno));
387 return -1;
391 * We need to check that the ops we need are supported on anon memory
392 * To do that we need to register a chunk and see the flags that
393 * are returned.
395 testarea = mmap(NULL, pagesize, PROT_READ | PROT_WRITE, MAP_PRIVATE |
396 MAP_ANONYMOUS, -1, 0);
397 if (testarea == MAP_FAILED) {
398 error_report("%s: Failed to map test area: %s", __func__,
399 strerror(errno));
400 goto out;
402 g_assert(((size_t)testarea & (pagesize-1)) == 0);
404 reg_struct.range.start = (uintptr_t)testarea;
405 reg_struct.range.len = pagesize;
406 reg_struct.mode = UFFDIO_REGISTER_MODE_MISSING;
408 if (ioctl(ufd, UFFDIO_REGISTER, &reg_struct)) {
409 error_report("%s userfault register: %s", __func__, strerror(errno));
410 goto out;
413 range_struct.start = (uintptr_t)testarea;
414 range_struct.len = pagesize;
415 if (ioctl(ufd, UFFDIO_UNREGISTER, &range_struct)) {
416 error_report("%s userfault unregister: %s", __func__, strerror(errno));
417 goto out;
420 feature_mask = (__u64)1 << _UFFDIO_WAKE |
421 (__u64)1 << _UFFDIO_COPY |
422 (__u64)1 << _UFFDIO_ZEROPAGE;
423 if ((reg_struct.ioctls & feature_mask) != feature_mask) {
424 error_report("Missing userfault map features: %" PRIx64,
425 (uint64_t)(~reg_struct.ioctls & feature_mask));
426 goto out;
429 /* Success! */
430 ret = true;
431 out:
432 if (testarea) {
433 munmap(testarea, pagesize);
435 if (ufd != -1) {
436 close(ufd);
438 return ret;
442 * Setup an area of RAM so that it *can* be used for postcopy later; this
443 * must be done right at the start prior to pre-copy.
444 * opaque should be the MIS.
446 static int init_range(const char *block_name, void *host_addr,
447 ram_addr_t offset, ram_addr_t length, void *opaque)
449 trace_postcopy_init_range(block_name, host_addr, offset, length);
452 * We need the whole of RAM to be truly empty for postcopy, so things
453 * like ROMs and any data tables built during init must be zero'd
454 * - we're going to get the copy from the source anyway.
455 * (Precopy will just overwrite this data, so doesn't need the discard)
457 if (ram_discard_range(block_name, 0, length)) {
458 return -1;
461 return 0;
465 * At the end of migration, undo the effects of init_range
466 * opaque should be the MIS.
468 static int cleanup_range(const char *block_name, void *host_addr,
469 ram_addr_t offset, ram_addr_t length, void *opaque)
471 MigrationIncomingState *mis = opaque;
472 struct uffdio_range range_struct;
473 trace_postcopy_cleanup_range(block_name, host_addr, offset, length);
476 * We turned off hugepage for the precopy stage with postcopy enabled
477 * we can turn it back on now.
479 qemu_madvise(host_addr, length, QEMU_MADV_HUGEPAGE);
482 * We can also turn off userfault now since we should have all the
483 * pages. It can be useful to leave it on to debug postcopy
484 * if you're not sure it's always getting every page.
486 range_struct.start = (uintptr_t)host_addr;
487 range_struct.len = length;
489 if (ioctl(mis->userfault_fd, UFFDIO_UNREGISTER, &range_struct)) {
490 error_report("%s: userfault unregister %s", __func__, strerror(errno));
492 return -1;
495 return 0;
499 * Initialise postcopy-ram, setting the RAM to a state where we can go into
500 * postcopy later; must be called prior to any precopy.
501 * called from arch_init's similarly named ram_postcopy_incoming_init
503 int postcopy_ram_incoming_init(MigrationIncomingState *mis)
505 if (qemu_ram_foreach_migratable_block(init_range, NULL)) {
506 return -1;
509 return 0;
513 * At the end of a migration where postcopy_ram_incoming_init was called.
515 int postcopy_ram_incoming_cleanup(MigrationIncomingState *mis)
517 trace_postcopy_ram_incoming_cleanup_entry();
519 if (mis->have_fault_thread) {
520 Error *local_err = NULL;
522 if (postcopy_notify(POSTCOPY_NOTIFY_INBOUND_END, &local_err)) {
523 error_report_err(local_err);
524 return -1;
527 if (qemu_ram_foreach_migratable_block(cleanup_range, mis)) {
528 return -1;
530 /* Let the fault thread quit */
531 atomic_set(&mis->fault_thread_quit, 1);
532 postcopy_fault_thread_notify(mis);
533 trace_postcopy_ram_incoming_cleanup_join();
534 qemu_thread_join(&mis->fault_thread);
536 trace_postcopy_ram_incoming_cleanup_closeuf();
537 close(mis->userfault_fd);
538 close(mis->userfault_event_fd);
539 mis->have_fault_thread = false;
542 qemu_balloon_inhibit(false);
544 if (enable_mlock) {
545 if (os_mlock() < 0) {
546 error_report("mlock: %s", strerror(errno));
548 * It doesn't feel right to fail at this point, we have a valid
549 * VM state.
554 postcopy_state_set(POSTCOPY_INCOMING_END);
556 if (mis->postcopy_tmp_page) {
557 munmap(mis->postcopy_tmp_page, mis->largest_page_size);
558 mis->postcopy_tmp_page = NULL;
560 if (mis->postcopy_tmp_zero_page) {
561 munmap(mis->postcopy_tmp_zero_page, mis->largest_page_size);
562 mis->postcopy_tmp_zero_page = NULL;
564 trace_postcopy_ram_incoming_cleanup_blocktime(
565 get_postcopy_total_blocktime());
567 trace_postcopy_ram_incoming_cleanup_exit();
568 return 0;
572 * Disable huge pages on an area
574 static int nhp_range(const char *block_name, void *host_addr,
575 ram_addr_t offset, ram_addr_t length, void *opaque)
577 trace_postcopy_nhp_range(block_name, host_addr, offset, length);
580 * Before we do discards we need to ensure those discards really
581 * do delete areas of the page, even if THP thinks a hugepage would
582 * be a good idea, so force hugepages off.
584 qemu_madvise(host_addr, length, QEMU_MADV_NOHUGEPAGE);
586 return 0;
590 * Userfault requires us to mark RAM as NOHUGEPAGE prior to discard
591 * however leaving it until after precopy means that most of the precopy
592 * data is still THPd
594 int postcopy_ram_prepare_discard(MigrationIncomingState *mis)
596 if (qemu_ram_foreach_migratable_block(nhp_range, mis)) {
597 return -1;
600 postcopy_state_set(POSTCOPY_INCOMING_DISCARD);
602 return 0;
606 * Mark the given area of RAM as requiring notification to unwritten areas
607 * Used as a callback on qemu_ram_foreach_migratable_block.
608 * host_addr: Base of area to mark
609 * offset: Offset in the whole ram arena
610 * length: Length of the section
611 * opaque: MigrationIncomingState pointer
612 * Returns 0 on success
614 static int ram_block_enable_notify(const char *block_name, void *host_addr,
615 ram_addr_t offset, ram_addr_t length,
616 void *opaque)
618 MigrationIncomingState *mis = opaque;
619 struct uffdio_register reg_struct;
621 reg_struct.range.start = (uintptr_t)host_addr;
622 reg_struct.range.len = length;
623 reg_struct.mode = UFFDIO_REGISTER_MODE_MISSING;
625 /* Now tell our userfault_fd that it's responsible for this area */
626 if (ioctl(mis->userfault_fd, UFFDIO_REGISTER, &reg_struct)) {
627 error_report("%s userfault register: %s", __func__, strerror(errno));
628 return -1;
630 if (!(reg_struct.ioctls & ((__u64)1 << _UFFDIO_COPY))) {
631 error_report("%s userfault: Region doesn't support COPY", __func__);
632 return -1;
634 if (reg_struct.ioctls & ((__u64)1 << _UFFDIO_ZEROPAGE)) {
635 RAMBlock *rb = qemu_ram_block_by_name(block_name);
636 qemu_ram_set_uf_zeroable(rb);
639 return 0;
642 int postcopy_wake_shared(struct PostCopyFD *pcfd,
643 uint64_t client_addr,
644 RAMBlock *rb)
646 size_t pagesize = qemu_ram_pagesize(rb);
647 struct uffdio_range range;
648 int ret;
649 trace_postcopy_wake_shared(client_addr, qemu_ram_get_idstr(rb));
650 range.start = client_addr & ~(pagesize - 1);
651 range.len = pagesize;
652 ret = ioctl(pcfd->fd, UFFDIO_WAKE, &range);
653 if (ret) {
654 error_report("%s: Failed to wake: %zx in %s (%s)",
655 __func__, (size_t)client_addr, qemu_ram_get_idstr(rb),
656 strerror(errno));
658 return ret;
662 * Callback from shared fault handlers to ask for a page,
663 * the page must be specified by a RAMBlock and an offset in that rb
664 * Note: Only for use by shared fault handlers (in fault thread)
666 int postcopy_request_shared_page(struct PostCopyFD *pcfd, RAMBlock *rb,
667 uint64_t client_addr, uint64_t rb_offset)
669 size_t pagesize = qemu_ram_pagesize(rb);
670 uint64_t aligned_rbo = rb_offset & ~(pagesize - 1);
671 MigrationIncomingState *mis = migration_incoming_get_current();
673 trace_postcopy_request_shared_page(pcfd->idstr, qemu_ram_get_idstr(rb),
674 rb_offset);
675 if (ramblock_recv_bitmap_test_byte_offset(rb, aligned_rbo)) {
676 trace_postcopy_request_shared_page_present(pcfd->idstr,
677 qemu_ram_get_idstr(rb), rb_offset);
678 return postcopy_wake_shared(pcfd, client_addr, rb);
680 if (rb != mis->last_rb) {
681 mis->last_rb = rb;
682 migrate_send_rp_req_pages(mis, qemu_ram_get_idstr(rb),
683 aligned_rbo, pagesize);
684 } else {
685 /* Save some space */
686 migrate_send_rp_req_pages(mis, NULL, aligned_rbo, pagesize);
688 return 0;
691 static int get_mem_fault_cpu_index(uint32_t pid)
693 CPUState *cpu_iter;
695 CPU_FOREACH(cpu_iter) {
696 if (cpu_iter->thread_id == pid) {
697 trace_get_mem_fault_cpu_index(cpu_iter->cpu_index, pid);
698 return cpu_iter->cpu_index;
701 trace_get_mem_fault_cpu_index(-1, pid);
702 return -1;
705 static uint32_t get_low_time_offset(PostcopyBlocktimeContext *dc)
707 int64_t start_time_offset = qemu_clock_get_ms(QEMU_CLOCK_REALTIME) -
708 dc->start_time;
709 return start_time_offset < 1 ? 1 : start_time_offset & UINT32_MAX;
713 * This function is being called when pagefault occurs. It
714 * tracks down vCPU blocking time.
716 * @addr: faulted host virtual address
717 * @ptid: faulted process thread id
718 * @rb: ramblock appropriate to addr
720 static void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
721 RAMBlock *rb)
723 int cpu, already_received;
724 MigrationIncomingState *mis = migration_incoming_get_current();
725 PostcopyBlocktimeContext *dc = mis->blocktime_ctx;
726 uint32_t low_time_offset;
728 if (!dc || ptid == 0) {
729 return;
731 cpu = get_mem_fault_cpu_index(ptid);
732 if (cpu < 0) {
733 return;
736 low_time_offset = get_low_time_offset(dc);
737 if (dc->vcpu_addr[cpu] == 0) {
738 atomic_inc(&dc->smp_cpus_down);
741 atomic_xchg(&dc->last_begin, low_time_offset);
742 atomic_xchg(&dc->page_fault_vcpu_time[cpu], low_time_offset);
743 atomic_xchg(&dc->vcpu_addr[cpu], addr);
745 /* check it here, not at the begining of the function,
746 * due to, check could accur early than bitmap_set in
747 * qemu_ufd_copy_ioctl */
748 already_received = ramblock_recv_bitmap_test(rb, (void *)addr);
749 if (already_received) {
750 atomic_xchg(&dc->vcpu_addr[cpu], 0);
751 atomic_xchg(&dc->page_fault_vcpu_time[cpu], 0);
752 atomic_dec(&dc->smp_cpus_down);
754 trace_mark_postcopy_blocktime_begin(addr, dc, dc->page_fault_vcpu_time[cpu],
755 cpu, already_received);
759 * This function just provide calculated blocktime per cpu and trace it.
760 * Total blocktime is calculated in mark_postcopy_blocktime_end.
763 * Assume we have 3 CPU
765 * S1 E1 S1 E1
766 * -----***********------------xxx***************------------------------> CPU1
768 * S2 E2
769 * ------------****************xxx---------------------------------------> CPU2
771 * S3 E3
772 * ------------------------****xxx********-------------------------------> CPU3
774 * We have sequence S1,S2,E1,S3,S1,E2,E3,E1
775 * S2,E1 - doesn't match condition due to sequence S1,S2,E1 doesn't include CPU3
776 * S3,S1,E2 - sequence includes all CPUs, in this case overlap will be S1,E2 -
777 * it's a part of total blocktime.
778 * S1 - here is last_begin
779 * Legend of the picture is following:
780 * * - means blocktime per vCPU
781 * x - means overlapped blocktime (total blocktime)
783 * @addr: host virtual address
785 static void mark_postcopy_blocktime_end(uintptr_t addr)
787 MigrationIncomingState *mis = migration_incoming_get_current();
788 PostcopyBlocktimeContext *dc = mis->blocktime_ctx;
789 int i, affected_cpu = 0;
790 bool vcpu_total_blocktime = false;
791 uint32_t read_vcpu_time, low_time_offset;
793 if (!dc) {
794 return;
797 low_time_offset = get_low_time_offset(dc);
798 /* lookup cpu, to clear it,
799 * that algorithm looks straighforward, but it's not
800 * optimal, more optimal algorithm is keeping tree or hash
801 * where key is address value is a list of */
802 for (i = 0; i < smp_cpus; i++) {
803 uint32_t vcpu_blocktime = 0;
805 read_vcpu_time = atomic_fetch_add(&dc->page_fault_vcpu_time[i], 0);
806 if (atomic_fetch_add(&dc->vcpu_addr[i], 0) != addr ||
807 read_vcpu_time == 0) {
808 continue;
810 atomic_xchg(&dc->vcpu_addr[i], 0);
811 vcpu_blocktime = low_time_offset - read_vcpu_time;
812 affected_cpu += 1;
813 /* we need to know is that mark_postcopy_end was due to
814 * faulted page, another possible case it's prefetched
815 * page and in that case we shouldn't be here */
816 if (!vcpu_total_blocktime &&
817 atomic_fetch_add(&dc->smp_cpus_down, 0) == smp_cpus) {
818 vcpu_total_blocktime = true;
820 /* continue cycle, due to one page could affect several vCPUs */
821 dc->vcpu_blocktime[i] += vcpu_blocktime;
824 atomic_sub(&dc->smp_cpus_down, affected_cpu);
825 if (vcpu_total_blocktime) {
826 dc->total_blocktime += low_time_offset - atomic_fetch_add(
827 &dc->last_begin, 0);
829 trace_mark_postcopy_blocktime_end(addr, dc, dc->total_blocktime,
830 affected_cpu);
833 static bool postcopy_pause_fault_thread(MigrationIncomingState *mis)
835 trace_postcopy_pause_fault_thread();
837 qemu_sem_wait(&mis->postcopy_pause_sem_fault);
839 trace_postcopy_pause_fault_thread_continued();
841 return true;
845 * Handle faults detected by the USERFAULT markings
847 static void *postcopy_ram_fault_thread(void *opaque)
849 MigrationIncomingState *mis = opaque;
850 struct uffd_msg msg;
851 int ret;
852 size_t index;
853 RAMBlock *rb = NULL;
855 trace_postcopy_ram_fault_thread_entry();
856 mis->last_rb = NULL; /* last RAMBlock we sent part of */
857 qemu_sem_post(&mis->fault_thread_sem);
859 struct pollfd *pfd;
860 size_t pfd_len = 2 + mis->postcopy_remote_fds->len;
862 pfd = g_new0(struct pollfd, pfd_len);
864 pfd[0].fd = mis->userfault_fd;
865 pfd[0].events = POLLIN;
866 pfd[1].fd = mis->userfault_event_fd;
867 pfd[1].events = POLLIN; /* Waiting for eventfd to go positive */
868 trace_postcopy_ram_fault_thread_fds_core(pfd[0].fd, pfd[1].fd);
869 for (index = 0; index < mis->postcopy_remote_fds->len; index++) {
870 struct PostCopyFD *pcfd = &g_array_index(mis->postcopy_remote_fds,
871 struct PostCopyFD, index);
872 pfd[2 + index].fd = pcfd->fd;
873 pfd[2 + index].events = POLLIN;
874 trace_postcopy_ram_fault_thread_fds_extra(2 + index, pcfd->idstr,
875 pcfd->fd);
878 while (true) {
879 ram_addr_t rb_offset;
880 int poll_result;
883 * We're mainly waiting for the kernel to give us a faulting HVA,
884 * however we can be told to quit via userfault_quit_fd which is
885 * an eventfd
888 poll_result = poll(pfd, pfd_len, -1 /* Wait forever */);
889 if (poll_result == -1) {
890 error_report("%s: userfault poll: %s", __func__, strerror(errno));
891 break;
894 if (!mis->to_src_file) {
896 * Possibly someone tells us that the return path is
897 * broken already using the event. We should hold until
898 * the channel is rebuilt.
900 if (postcopy_pause_fault_thread(mis)) {
901 mis->last_rb = NULL;
902 /* Continue to read the userfaultfd */
903 } else {
904 error_report("%s: paused but don't allow to continue",
905 __func__);
906 break;
910 if (pfd[1].revents) {
911 uint64_t tmp64 = 0;
913 /* Consume the signal */
914 if (read(mis->userfault_event_fd, &tmp64, 8) != 8) {
915 /* Nothing obviously nicer than posting this error. */
916 error_report("%s: read() failed", __func__);
919 if (atomic_read(&mis->fault_thread_quit)) {
920 trace_postcopy_ram_fault_thread_quit();
921 break;
925 if (pfd[0].revents) {
926 poll_result--;
927 ret = read(mis->userfault_fd, &msg, sizeof(msg));
928 if (ret != sizeof(msg)) {
929 if (errno == EAGAIN) {
931 * if a wake up happens on the other thread just after
932 * the poll, there is nothing to read.
934 continue;
936 if (ret < 0) {
937 error_report("%s: Failed to read full userfault "
938 "message: %s",
939 __func__, strerror(errno));
940 break;
941 } else {
942 error_report("%s: Read %d bytes from userfaultfd "
943 "expected %zd",
944 __func__, ret, sizeof(msg));
945 break; /* Lost alignment, don't know what we'd read next */
948 if (msg.event != UFFD_EVENT_PAGEFAULT) {
949 error_report("%s: Read unexpected event %ud from userfaultfd",
950 __func__, msg.event);
951 continue; /* It's not a page fault, shouldn't happen */
954 rb = qemu_ram_block_from_host(
955 (void *)(uintptr_t)msg.arg.pagefault.address,
956 true, &rb_offset);
957 if (!rb) {
958 error_report("postcopy_ram_fault_thread: Fault outside guest: %"
959 PRIx64, (uint64_t)msg.arg.pagefault.address);
960 break;
963 rb_offset &= ~(qemu_ram_pagesize(rb) - 1);
964 trace_postcopy_ram_fault_thread_request(msg.arg.pagefault.address,
965 qemu_ram_get_idstr(rb),
966 rb_offset,
967 msg.arg.pagefault.feat.ptid);
968 mark_postcopy_blocktime_begin(
969 (uintptr_t)(msg.arg.pagefault.address),
970 msg.arg.pagefault.feat.ptid, rb);
972 retry:
974 * Send the request to the source - we want to request one
975 * of our host page sizes (which is >= TPS)
977 if (rb != mis->last_rb) {
978 mis->last_rb = rb;
979 ret = migrate_send_rp_req_pages(mis,
980 qemu_ram_get_idstr(rb),
981 rb_offset,
982 qemu_ram_pagesize(rb));
983 } else {
984 /* Save some space */
985 ret = migrate_send_rp_req_pages(mis,
986 NULL,
987 rb_offset,
988 qemu_ram_pagesize(rb));
991 if (ret) {
992 /* May be network failure, try to wait for recovery */
993 if (ret == -EIO && postcopy_pause_fault_thread(mis)) {
994 /* We got reconnected somehow, try to continue */
995 mis->last_rb = NULL;
996 goto retry;
997 } else {
998 /* This is a unavoidable fault */
999 error_report("%s: migrate_send_rp_req_pages() get %d",
1000 __func__, ret);
1001 break;
1006 /* Now handle any requests from external processes on shared memory */
1007 /* TODO: May need to handle devices deregistering during postcopy */
1008 for (index = 2; index < pfd_len && poll_result; index++) {
1009 if (pfd[index].revents) {
1010 struct PostCopyFD *pcfd =
1011 &g_array_index(mis->postcopy_remote_fds,
1012 struct PostCopyFD, index - 2);
1014 poll_result--;
1015 if (pfd[index].revents & POLLERR) {
1016 error_report("%s: POLLERR on poll %zd fd=%d",
1017 __func__, index, pcfd->fd);
1018 pfd[index].events = 0;
1019 continue;
1022 ret = read(pcfd->fd, &msg, sizeof(msg));
1023 if (ret != sizeof(msg)) {
1024 if (errno == EAGAIN) {
1026 * if a wake up happens on the other thread just after
1027 * the poll, there is nothing to read.
1029 continue;
1031 if (ret < 0) {
1032 error_report("%s: Failed to read full userfault "
1033 "message: %s (shared) revents=%d",
1034 __func__, strerror(errno),
1035 pfd[index].revents);
1036 /*TODO: Could just disable this sharer */
1037 break;
1038 } else {
1039 error_report("%s: Read %d bytes from userfaultfd "
1040 "expected %zd (shared)",
1041 __func__, ret, sizeof(msg));
1042 /*TODO: Could just disable this sharer */
1043 break; /*Lost alignment,don't know what we'd read next*/
1046 if (msg.event != UFFD_EVENT_PAGEFAULT) {
1047 error_report("%s: Read unexpected event %ud "
1048 "from userfaultfd (shared)",
1049 __func__, msg.event);
1050 continue; /* It's not a page fault, shouldn't happen */
1052 /* Call the device handler registered with us */
1053 ret = pcfd->handler(pcfd, &msg);
1054 if (ret) {
1055 error_report("%s: Failed to resolve shared fault on %zd/%s",
1056 __func__, index, pcfd->idstr);
1057 /* TODO: Fail? Disable this sharer? */
1062 trace_postcopy_ram_fault_thread_exit();
1063 g_free(pfd);
1064 return NULL;
1067 int postcopy_ram_enable_notify(MigrationIncomingState *mis)
1069 /* Open the fd for the kernel to give us userfaults */
1070 mis->userfault_fd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK);
1071 if (mis->userfault_fd == -1) {
1072 error_report("%s: Failed to open userfault fd: %s", __func__,
1073 strerror(errno));
1074 return -1;
1078 * Although the host check already tested the API, we need to
1079 * do the check again as an ABI handshake on the new fd.
1081 if (!ufd_check_and_apply(mis->userfault_fd, mis)) {
1082 return -1;
1085 /* Now an eventfd we use to tell the fault-thread to quit */
1086 mis->userfault_event_fd = eventfd(0, EFD_CLOEXEC);
1087 if (mis->userfault_event_fd == -1) {
1088 error_report("%s: Opening userfault_event_fd: %s", __func__,
1089 strerror(errno));
1090 close(mis->userfault_fd);
1091 return -1;
1094 qemu_sem_init(&mis->fault_thread_sem, 0);
1095 qemu_thread_create(&mis->fault_thread, "postcopy/fault",
1096 postcopy_ram_fault_thread, mis, QEMU_THREAD_JOINABLE);
1097 qemu_sem_wait(&mis->fault_thread_sem);
1098 qemu_sem_destroy(&mis->fault_thread_sem);
1099 mis->have_fault_thread = true;
1101 /* Mark so that we get notified of accesses to unwritten areas */
1102 if (qemu_ram_foreach_migratable_block(ram_block_enable_notify, mis)) {
1103 return -1;
1107 * Ballooning can mark pages as absent while we're postcopying
1108 * that would cause false userfaults.
1110 qemu_balloon_inhibit(true);
1112 trace_postcopy_ram_enable_notify();
1114 return 0;
1117 static int qemu_ufd_copy_ioctl(int userfault_fd, void *host_addr,
1118 void *from_addr, uint64_t pagesize, RAMBlock *rb)
1120 int ret;
1121 if (from_addr) {
1122 struct uffdio_copy copy_struct;
1123 copy_struct.dst = (uint64_t)(uintptr_t)host_addr;
1124 copy_struct.src = (uint64_t)(uintptr_t)from_addr;
1125 copy_struct.len = pagesize;
1126 copy_struct.mode = 0;
1127 ret = ioctl(userfault_fd, UFFDIO_COPY, &copy_struct);
1128 } else {
1129 struct uffdio_zeropage zero_struct;
1130 zero_struct.range.start = (uint64_t)(uintptr_t)host_addr;
1131 zero_struct.range.len = pagesize;
1132 zero_struct.mode = 0;
1133 ret = ioctl(userfault_fd, UFFDIO_ZEROPAGE, &zero_struct);
1135 if (!ret) {
1136 ramblock_recv_bitmap_set_range(rb, host_addr,
1137 pagesize / qemu_target_page_size());
1138 mark_postcopy_blocktime_end((uintptr_t)host_addr);
1141 return ret;
1144 int postcopy_notify_shared_wake(RAMBlock *rb, uint64_t offset)
1146 int i;
1147 MigrationIncomingState *mis = migration_incoming_get_current();
1148 GArray *pcrfds = mis->postcopy_remote_fds;
1150 for (i = 0; i < pcrfds->len; i++) {
1151 struct PostCopyFD *cur = &g_array_index(pcrfds, struct PostCopyFD, i);
1152 int ret = cur->waker(cur, rb, offset);
1153 if (ret) {
1154 return ret;
1157 return 0;
1161 * Place a host page (from) at (host) atomically
1162 * returns 0 on success
1164 int postcopy_place_page(MigrationIncomingState *mis, void *host, void *from,
1165 RAMBlock *rb)
1167 size_t pagesize = qemu_ram_pagesize(rb);
1169 /* copy also acks to the kernel waking the stalled thread up
1170 * TODO: We can inhibit that ack and only do it if it was requested
1171 * which would be slightly cheaper, but we'd have to be careful
1172 * of the order of updating our page state.
1174 if (qemu_ufd_copy_ioctl(mis->userfault_fd, host, from, pagesize, rb)) {
1175 int e = errno;
1176 error_report("%s: %s copy host: %p from: %p (size: %zd)",
1177 __func__, strerror(e), host, from, pagesize);
1179 return -e;
1182 trace_postcopy_place_page(host);
1183 return postcopy_notify_shared_wake(rb,
1184 qemu_ram_block_host_offset(rb, host));
1188 * Place a zero page at (host) atomically
1189 * returns 0 on success
1191 int postcopy_place_page_zero(MigrationIncomingState *mis, void *host,
1192 RAMBlock *rb)
1194 size_t pagesize = qemu_ram_pagesize(rb);
1195 trace_postcopy_place_page_zero(host);
1197 /* Normal RAMBlocks can zero a page using UFFDIO_ZEROPAGE
1198 * but it's not available for everything (e.g. hugetlbpages)
1200 if (qemu_ram_is_uf_zeroable(rb)) {
1201 if (qemu_ufd_copy_ioctl(mis->userfault_fd, host, NULL, pagesize, rb)) {
1202 int e = errno;
1203 error_report("%s: %s zero host: %p",
1204 __func__, strerror(e), host);
1206 return -e;
1208 return postcopy_notify_shared_wake(rb,
1209 qemu_ram_block_host_offset(rb,
1210 host));
1211 } else {
1212 /* The kernel can't use UFFDIO_ZEROPAGE for hugepages */
1213 if (!mis->postcopy_tmp_zero_page) {
1214 mis->postcopy_tmp_zero_page = mmap(NULL, mis->largest_page_size,
1215 PROT_READ | PROT_WRITE,
1216 MAP_PRIVATE | MAP_ANONYMOUS,
1217 -1, 0);
1218 if (mis->postcopy_tmp_zero_page == MAP_FAILED) {
1219 int e = errno;
1220 mis->postcopy_tmp_zero_page = NULL;
1221 error_report("%s: %s mapping large zero page",
1222 __func__, strerror(e));
1223 return -e;
1225 memset(mis->postcopy_tmp_zero_page, '\0', mis->largest_page_size);
1227 return postcopy_place_page(mis, host, mis->postcopy_tmp_zero_page,
1228 rb);
1233 * Returns a target page of memory that can be mapped at a later point in time
1234 * using postcopy_place_page
1235 * The same address is used repeatedly, postcopy_place_page just takes the
1236 * backing page away.
1237 * Returns: Pointer to allocated page
1240 void *postcopy_get_tmp_page(MigrationIncomingState *mis)
1242 if (!mis->postcopy_tmp_page) {
1243 mis->postcopy_tmp_page = mmap(NULL, mis->largest_page_size,
1244 PROT_READ | PROT_WRITE, MAP_PRIVATE |
1245 MAP_ANONYMOUS, -1, 0);
1246 if (mis->postcopy_tmp_page == MAP_FAILED) {
1247 mis->postcopy_tmp_page = NULL;
1248 error_report("%s: %s", __func__, strerror(errno));
1249 return NULL;
1253 return mis->postcopy_tmp_page;
1256 #else
1257 /* No target OS support, stubs just fail */
1258 void fill_destination_postcopy_migration_info(MigrationInfo *info)
1262 bool postcopy_ram_supported_by_host(MigrationIncomingState *mis)
1264 error_report("%s: No OS support", __func__);
1265 return false;
1268 int postcopy_ram_incoming_init(MigrationIncomingState *mis)
1270 error_report("postcopy_ram_incoming_init: No OS support");
1271 return -1;
1274 int postcopy_ram_incoming_cleanup(MigrationIncomingState *mis)
1276 assert(0);
1277 return -1;
1280 int postcopy_ram_prepare_discard(MigrationIncomingState *mis)
1282 assert(0);
1283 return -1;
1286 int postcopy_request_shared_page(struct PostCopyFD *pcfd, RAMBlock *rb,
1287 uint64_t client_addr, uint64_t rb_offset)
1289 assert(0);
1290 return -1;
1293 int postcopy_ram_enable_notify(MigrationIncomingState *mis)
1295 assert(0);
1296 return -1;
1299 int postcopy_place_page(MigrationIncomingState *mis, void *host, void *from,
1300 RAMBlock *rb)
1302 assert(0);
1303 return -1;
1306 int postcopy_place_page_zero(MigrationIncomingState *mis, void *host,
1307 RAMBlock *rb)
1309 assert(0);
1310 return -1;
1313 void *postcopy_get_tmp_page(MigrationIncomingState *mis)
1315 assert(0);
1316 return NULL;
1319 int postcopy_wake_shared(struct PostCopyFD *pcfd,
1320 uint64_t client_addr,
1321 RAMBlock *rb)
1323 assert(0);
1324 return -1;
1326 #endif
1328 /* ------------------------------------------------------------------------- */
1330 void postcopy_fault_thread_notify(MigrationIncomingState *mis)
1332 uint64_t tmp64 = 1;
1335 * Wakeup the fault_thread. It's an eventfd that should currently
1336 * be at 0, we're going to increment it to 1
1338 if (write(mis->userfault_event_fd, &tmp64, 8) != 8) {
1339 /* Not much we can do here, but may as well report it */
1340 error_report("%s: incrementing failed: %s", __func__,
1341 strerror(errno));
1346 * postcopy_discard_send_init: Called at the start of each RAMBlock before
1347 * asking to discard individual ranges.
1349 * @ms: The current migration state.
1350 * @offset: the bitmap offset of the named RAMBlock in the migration
1351 * bitmap.
1352 * @name: RAMBlock that discards will operate on.
1354 * returns: a new PDS.
1356 PostcopyDiscardState *postcopy_discard_send_init(MigrationState *ms,
1357 const char *name)
1359 PostcopyDiscardState *res = g_malloc0(sizeof(PostcopyDiscardState));
1361 if (res) {
1362 res->ramblock_name = name;
1365 return res;
1369 * postcopy_discard_send_range: Called by the bitmap code for each chunk to
1370 * discard. May send a discard message, may just leave it queued to
1371 * be sent later.
1373 * @ms: Current migration state.
1374 * @pds: Structure initialised by postcopy_discard_send_init().
1375 * @start,@length: a range of pages in the migration bitmap in the
1376 * RAM block passed to postcopy_discard_send_init() (length=1 is one page)
1378 void postcopy_discard_send_range(MigrationState *ms, PostcopyDiscardState *pds,
1379 unsigned long start, unsigned long length)
1381 size_t tp_size = qemu_target_page_size();
1382 /* Convert to byte offsets within the RAM block */
1383 pds->start_list[pds->cur_entry] = start * tp_size;
1384 pds->length_list[pds->cur_entry] = length * tp_size;
1385 trace_postcopy_discard_send_range(pds->ramblock_name, start, length);
1386 pds->cur_entry++;
1387 pds->nsentwords++;
1389 if (pds->cur_entry == MAX_DISCARDS_PER_COMMAND) {
1390 /* Full set, ship it! */
1391 qemu_savevm_send_postcopy_ram_discard(ms->to_dst_file,
1392 pds->ramblock_name,
1393 pds->cur_entry,
1394 pds->start_list,
1395 pds->length_list);
1396 pds->nsentcmds++;
1397 pds->cur_entry = 0;
1402 * postcopy_discard_send_finish: Called at the end of each RAMBlock by the
1403 * bitmap code. Sends any outstanding discard messages, frees the PDS
1405 * @ms: Current migration state.
1406 * @pds: Structure initialised by postcopy_discard_send_init().
1408 void postcopy_discard_send_finish(MigrationState *ms, PostcopyDiscardState *pds)
1410 /* Anything unsent? */
1411 if (pds->cur_entry) {
1412 qemu_savevm_send_postcopy_ram_discard(ms->to_dst_file,
1413 pds->ramblock_name,
1414 pds->cur_entry,
1415 pds->start_list,
1416 pds->length_list);
1417 pds->nsentcmds++;
1420 trace_postcopy_discard_send_finish(pds->ramblock_name, pds->nsentwords,
1421 pds->nsentcmds);
1423 g_free(pds);
1427 * Current state of incoming postcopy; note this is not part of
1428 * MigrationIncomingState since it's state is used during cleanup
1429 * at the end as MIS is being freed.
1431 static PostcopyState incoming_postcopy_state;
1433 PostcopyState postcopy_state_get(void)
1435 return atomic_mb_read(&incoming_postcopy_state);
1438 /* Set the state and return the old state */
1439 PostcopyState postcopy_state_set(PostcopyState new_state)
1441 return atomic_xchg(&incoming_postcopy_state, new_state);
1444 /* Register a handler for external shared memory postcopy
1445 * called on the destination.
1447 void postcopy_register_shared_ufd(struct PostCopyFD *pcfd)
1449 MigrationIncomingState *mis = migration_incoming_get_current();
1451 mis->postcopy_remote_fds = g_array_append_val(mis->postcopy_remote_fds,
1452 *pcfd);
1455 /* Unregister a handler for external shared memory postcopy
1457 void postcopy_unregister_shared_ufd(struct PostCopyFD *pcfd)
1459 guint i;
1460 MigrationIncomingState *mis = migration_incoming_get_current();
1461 GArray *pcrfds = mis->postcopy_remote_fds;
1463 for (i = 0; i < pcrfds->len; i++) {
1464 struct PostCopyFD *cur = &g_array_index(pcrfds, struct PostCopyFD, i);
1465 if (cur->fd == pcfd->fd) {
1466 mis->postcopy_remote_fds = g_array_remove_index(pcrfds, i);
1467 return;