Use mincore(2) to create diff snapshots without dirty page tracking

Currently, Firecracker only supports creation of diff snapshots if dirty
page tracking is explicitly enabled. Allow creation of diff snapshots
even if it is not enabled, through the use of mincore(2). The mincore(2)
syscalls determines which pages of a VMA are "in core". For anonymous
mappings (as used by booted VMs without vhost-user devices), this refers
to all pages that are currently faulted in. For memfd (as used by booted
vms with vhost-user devices), this means all
pages that have been allocated into the memfd, regardless of whether
they were allocated through the VMA on which mincore(2) was called
(meaning creation of mincore-diff-snapshots will correctly account for
pages that were only touched by the vhost-user backend, but not by
Firecracker or KVM). For restored VMs, this means all pages of the
underlying snapshot file that have been faulted in.

Note that this only works if swap has been disabled, as pages currently
swapped to disk do not count as "in-core", yet obviously should be
included in a diff snapshot. If swap is used, dirty page tracking MUST
be enabled for diff snapshots to work correctly.

Compared to diff snapshots based on dirty page tracking, mincore-based
diff snapshots will be slightly larger. This is because dirty page
tracked diff snapshots only include pages that were actually written to,
while mincore-based snapshots will contain all pages that were accessed
at all, e.g. even if only for reading.

Signed-off-by: Patrick Roy <[email protected]>

Author: roypat

CHANGELOG.md

@@ -16,6 +16,10 @@ and this project adheres to
 - [#5175](https://github.com/firecracker-microvm/firecracker/pull/5175): Allow
   including a custom cpu template directly in the json configuration file passed
   to `--config-file` under the `cpu_config` key.
+- [#5274](https://github.com/firecracker-microvm/firecracker/pull/5274): Allow
+  taking diff snapshots even if dirty page tracking is disabled, by using
+  `mincore(2)` to overapproximate the set of dirty pages. Only works if swap is
+  disabled.
 
 ### Changed
 

resources/seccomp/aarch64-unknown-linux-musl.json

@@ -28,6 +28,9 @@
             {
                 "syscall": "write"
             },
+            {
+                "syscall": "mincore"
+            },
             {
                 "syscall": "writev",
                 "comment": "Used by the VirtIO net device to write to tap"

resources/seccomp/x86_64-unknown-linux-musl.json

@@ -28,6 +28,9 @@
             {
                 "syscall": "write"
             },
+            {
+                "syscall": "mincore"
+            },
             {
                 "syscall": "writev",
                 "comment": "Used by the VirtIO net device to write to tap"

src/vmm/src/rpc_interface.rs

@@ -747,13 +747,6 @@ impl RuntimeApiController {
     ) -> Result<VmmData, VmmActionError> {
         if create_params.snapshot_type == SnapshotType::Diff {
             log_dev_preview_warning("Virtual machine diff snapshots", None);
-
-            if !self.vm_resources.machine_config.track_dirty_pages {
-                return Err(VmmActionError::NotSupported(
-                    "Diff snapshots are not allowed on uVMs with dirty page tracking disabled."
-                        .to_string(),
-                ));
-            }
         }
 
         let mut locked_vmm = self.vmm.lock().unwrap();

src/vmm/src/test_utils/mod.rs

@@ -113,7 +113,6 @@ pub fn default_vmm_no_boot(kernel_image: Option<&str>) -> (Arc<Mutex<Vmm>>, Even
     create_vmm(kernel_image, false, false)
 }
 
-#[cfg(target_arch = "x86_64")]
 pub fn dirty_tracking_vmm(kernel_image: Option<&str>) -> (Arc<Mutex<Vmm>>, EventManager) {
     create_vmm(kernel_image, true, true)
 }

src/vmm/src/vstate/vm.rs

@@ -15,6 +15,7 @@ use kvm_bindings::{KVM_MEM_LOG_DIRTY_PAGES, kvm_userspace_memory_region};
 use kvm_ioctls::VmFd;
 use vmm_sys_util::eventfd::EventFd;
 
+use crate::arch::host_page_size;
 pub use crate::arch::{ArchVm as Vm, ArchVmError, VmState};
 use crate::logger::info;
 use crate::persist::CreateSnapshotError;
@@ -204,6 +205,9 @@ impl Vm {
             .try_for_each(|(region, slot)| {
                 self.fd()
                     .get_dirty_log(slot, u64_to_usize(region.len()))
+                    // Getting the dirty log failed. This is probably because dirty page tracking
+                    // was disabled. Fall back to mincore in this case.
+                    .or_else(|_| mincore_bitmap(region))
                     .map(|bitmap_region| _ = bitmap.insert(slot, bitmap_region))
             })?;
         Ok(bitmap)
@@ -278,6 +282,41 @@ impl Vm {
     }
 }
 
+/// Use `mincore(2)` to overapproximate the dirty bitmap for the given memslot. To be used
+/// if a diff snapshot is requested, but dirty page tracking wasn't enabled.
+fn mincore_bitmap(region: &GuestRegionMmap) -> Result<Vec<u64>, vmm_sys_util::errno::Error> {
+    // Mincore always works at PAGE_SIZE granularity, even if the VMA we are dealing with
+    // is a hugetlbfs VMA (e.g. to report a single hugepage as "present", mincore will
+    // give us 512 4k markers with the lowest bit set).
+    let page_size = host_page_size();
+    let mut mincore_bitmap = vec![0u8; u64_to_usize(region.len()) / page_size];
+    let mut bitmap = vec![0u64; u64_to_usize(region.len()) / page_size];
+
+    // SAFETY: The safety invariants of GuestRegionMmap ensure that region.as_ptr() is a valid
+    // userspace mapping of size region.len() bytes. The bitmap has exactly one byte for each
+    // page in this userspace mapping. Note that mincore does not operate on bitmaps like
+    // KVM_MEM_LOG_DIRTY_PAGES, but rather it uses 8 bits per page (e.g. 1 byte), setting the
+    // least significant bit to 1 if the page corresponding to a byte is in core (available in
+    // the page cache and resolvable via just a minor page fault).
+    let r = unsafe {
+        libc::mincore(
+            region.as_ptr().cast::<libc::c_void>(),
+            u64_to_usize(region.len()),
+            mincore_bitmap.as_mut_ptr(),
+        )
+    };
+
+    if r != 0 {
+        return vmm_sys_util::errno::errno_result();
+    }
+
+    for (page_idx, b) in mincore_bitmap.iter().enumerate() {
+        bitmap[page_idx / 64] |= (*b as u64 & 0x1) << (page_idx as u64 % 64);
+    }
+
+    Ok(bitmap)
+}
+
 #[cfg(test)]
 pub(crate) mod tests {
     use vm_memory::GuestAddress;

src/vmm/tests/integration_tests.rs

@@ -100,47 +100,30 @@ fn test_pause_resume_microvm() {
     vmm.lock().unwrap().stop(FcExitCode::Ok);
 }
 
-#[test]
-fn test_dirty_bitmap_error() {
-    // Error case: dirty tracking disabled.
-    let (vmm, _) = default_vmm(None);
-
-    // The vmm will start with dirty page tracking = OFF.
-    // With dirty tracking disabled, the underlying KVM_GET_DIRTY_LOG ioctl will fail
-    // with errno 2 (ENOENT) because KVM can't find any guest memory regions with dirty
-    // page tracking enabled.
-    assert_eq!(
-        vmm.lock()
-            .unwrap()
-            .vm
-            .get_dirty_bitmap()
-            .unwrap_err()
-            .errno(),
-        2
-    );
-    vmm.lock().unwrap().stop(FcExitCode::Ok);
-}
-
 #[test]
 #[cfg(target_arch = "x86_64")]
 fn test_dirty_bitmap_success() {
-    // The vmm will start with dirty page tracking = ON.
-    let (vmm, _) = vmm::test_utils::dirty_tracking_vmm(Some(NOISY_KERNEL_IMAGE));
-
-    // Let it churn for a while and dirty some pages...
-    thread::sleep(Duration::from_millis(100));
-    let bitmap = vmm.lock().unwrap().vm.get_dirty_bitmap().unwrap();
-    let num_dirty_pages: u32 = bitmap
-        .values()
-        .map(|bitmap_per_region| {
-            // Gently coerce to u32
-            let num_dirty_pages_per_region: u32 =
-                bitmap_per_region.iter().map(|n| n.count_ones()).sum();
-            num_dirty_pages_per_region
-        })
-        .sum();
-    assert!(num_dirty_pages > 0);
-    vmm.lock().unwrap().stop(FcExitCode::Ok);
+    let vms = [
+        vmm::test_utils::dirty_tracking_vmm(Some(NOISY_KERNEL_IMAGE)),
+        default_vmm(Some(NOISY_KERNEL_IMAGE)),
+    ];
+
+    for (vmm, _) in vms {
+        // Let it churn for a while and dirty some pages...
+        thread::sleep(Duration::from_millis(100));
+        let bitmap = vmm.lock().unwrap().vm.get_dirty_bitmap().unwrap();
+        let num_dirty_pages: u32 = bitmap
+            .values()
+            .map(|bitmap_per_region| {
+                // Gently coerce to u32
+                let num_dirty_pages_per_region: u32 =
+                    bitmap_per_region.iter().map(|n| n.count_ones()).sum();
+                num_dirty_pages_per_region
+            })
+            .sum();
+        assert!(num_dirty_pages > 0);
+        vmm.lock().unwrap().stop(FcExitCode::Ok);
+    }
 }
 
 #[test]

tests/integration_tests/functional/test_snapshot_basic.py

@@ -76,6 +76,7 @@ def test_resume(uvm_nano, microvm_factory, resume_at_restore):
         assert restored_vm.state == "Paused"
         restored_vm.resume()
     assert restored_vm.state == "Running"
+    restored_vm.ssh.check_output("true")
 
 
 def test_snapshot_current_version(uvm_nano):
@@ -390,21 +391,6 @@ def test_negative_snapshot_create(uvm_nano):
             mem_file_path="memfile", snapshot_path="statefile", snapshot_type="Full"
         )
 
-    vm.api.vm.patch(state="Paused")
-
-    # Try diff with dirty pages tracking disabled.
-    expected_msg = (
-        "Diff snapshots are not allowed on uVMs with dirty page tracking disabled"
-    )
-    with pytest.raises(RuntimeError, match=expected_msg):
-        vm.api.snapshot_create.put(
-            mem_file_path="memfile", snapshot_path="statefile", snapshot_type="Diff"
-        )
-    assert not os.path.exists("statefile")
-    assert not os.path.exists("memfile")
-
-    vm.kill()
-
 
 def test_create_large_diff_snapshot(uvm_plain):
     """