In fast snapshot load, we would like to serve faults as soon as possible
hence loading pages directly instead of requesting a source
Add postcopy_mapped_ram_load_page() function which serves single page
fault by reading the snapshot file. It uses bitmap_test_and_clear_atomic
on pending_bmap to coordinate between threads so each page is loaded
exactly once. Non-zero pages are read using qemu_get_buffer_at into a
temporary page (for loading page atomically), which is then placed using
postcopy_place_page. Zero pages are placed directly using
postcopy_place_page_zero.
Update postcopy_ram_fault_thread to call postcopy_mapped_ram_load_page
instead of requesting source in case of fast snapshot load. to_src_file
check is bypassed in fast snapshot load case as there is no source.
Call try_mark_postcopy_blocktime_begin on every page fault to support
postcopy-blocktime.
Allocate another channel in postcopy_temp_pages_setup(like the preempt
case), for both the fault thread and eager thread to load pages
independently.
Add function ramblock_file_bitmap_page_is_nonzero() which searches a
range of bits corresponding to a page for a set bit. This is just a bit
check for normal pages but for hugepages it checks the range to see if
any part of page is non zero.
Signed-off-by: Aadeshveer Singh <aadeshveer07@gmail.com>
---
migration/postcopy-ram.c | 121 +++++++++++++++++++++++++++++++++------
migration/ram.c | 11 +++-
migration/ram.h | 2 +
3 files changed, 116 insertions(+), 18 deletions(-)
diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 2e2c9fae10..723070b5cd 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -949,6 +949,68 @@ int postcopy_wake_shared(struct PostCopyFD *pcfd,
pagesize);
}
+/**
+ * postcopy_mapped_ram_load_page() - Load a page to given host address.
+ * @mis: Migration Incoming State.
+ * @rb: RAMBlock from where page is loaded.
+ * @rb_offset: Offset of page in RAMBlock.
+ * @haddr: Base of page where to load in page.
+ * @channel: Used to identify between threads and use corresponding temp.
+ * @errp: Set error in case of failure
+ *
+ * Load a page from RAMBlock at offset at given host address. Used by postcopy
+ * ram fault thread and eager thread in fast snapshot load case.
+ *
+ * Return: True on success.
+ */
+static bool postcopy_mapped_ram_load_page(MigrationIncomingState *mis,
+ RAMBlock *rb, ram_addr_t rb_offset,
+ uint64_t haddr, int channel,
+ Error **errp)
+{
+ void *place_source = mis->postcopy_tmp_pages[channel].tmp_huge_page;
+ size_t page;
+ size_t read;
+
+ page = rb_offset / qemu_ram_pagesize(rb);
+
+ if (bitmap_test_and_clear_atomic(rb->pending_bmap, page, 1)) {
+ if (ramblock_file_bitmap_page_is_nonzero(rb, page)) {
+ /*
+ * This can happen concurrently, but it's thread-safe because
+ * qemu_get_buffer_at() is thread-safe, and the caller will be using
+ * different temporary buffers.
+ */
+ read = qemu_get_buffer_at(mis->from_src_file, place_source,
+ qemu_ram_pagesize(rb),
+ rb->pages_offset + rb_offset, errp);
+
+ if (read != qemu_ram_pagesize(rb)) {
+ error_prepend(errp, "Could not read page %zu from RAM Block %s",
+ page, rb->idstr);
+ return false;
+ }
+
+ if (postcopy_place_page(mis, (void *)haddr, place_source, rb)) {
+ error_setg(errp,
+ "Failed to place page %zu from RAM Block %s at "
+ "address %" PRIu64,
+ page, rb->idstr, haddr);
+ return false;
+ }
+ } else {
+ if (postcopy_place_page_zero(mis, (void *)haddr, rb)) {
+ error_setg(errp,
+ "Failed to place zero page %zu from RAM Block %s at "
+ "address %" PRIu64,
+ page, rb->idstr, haddr);
+ return false;
+ }
+ }
+ }
+ return true;
+}
+
/*
* NOTE: @tid is only used when postcopy-blocktime feature is enabled, and
* also optional: when zero is provided, the fault accounting will be ignored.
@@ -1310,6 +1372,7 @@ static void *postcopy_ram_fault_thread(void *opaque)
int ret;
size_t index;
RAMBlock *rb = NULL;
+ Error *local_err = NULL;
trace_postcopy_ram_fault_thread_entry();
rcu_register_thread();
@@ -1351,11 +1414,13 @@ static void *postcopy_ram_fault_thread(void *opaque)
break;
}
- if (!mis->to_src_file) {
+ if (!migrate_mapped_ram() && !mis->to_src_file) {
/*
- * Possibly someone tells us that the return path is
- * broken already using the event. We should hold until
- * the channel is rebuilt.
+ * Possibly someone tells us that the return path is broken already
+ * using the event. We should hold until the channel is rebuilt.
+ * Fast snapshot load doesn't support pause and recover, because
+ * it's not necessary: we can fail right away when QEMU just booted
+ * with nothing to lose.
*/
postcopy_pause_fault_thread(mis);
}
@@ -1418,18 +1483,37 @@ static void *postcopy_ram_fault_thread(void *opaque)
qemu_ram_get_idstr(rb),
rb_offset,
msg.arg.pagefault.feat.ptid);
+
+ if (migrate_mapped_ram()) {
+ /* Load page directly in case of fast snapshot load */
+
+ uintptr_t aligned = (uintptr_t)ROUND_DOWN(
+ msg.arg.pagefault.address, qemu_ram_pagesize(rb));
+
+ if (try_mark_postcopy_blocktime_begin(
+ mis, rb, rb_offset, (uintptr_t)aligned,
+ msg.arg.pagefault.feat.ptid)) {
+ if (!postcopy_mapped_ram_load_page(
+ mis, rb, rb_offset, aligned, RAM_CHANNEL_POSTCOPY,
+ &local_err)) {
+ error_report_err(local_err);
+ break;
+ }
+ }
+ } else {
retry:
- /*
- * Send the request to the source - we want to request one
- * of our host page sizes (which is >= TPS)
- */
- ret = postcopy_request_page(mis, rb, rb_offset,
- msg.arg.pagefault.address,
- msg.arg.pagefault.feat.ptid);
- if (ret) {
- /* May be network failure, try to wait for recovery */
- postcopy_pause_fault_thread(mis);
- goto retry;
+ /*
+ * Send the request to the source - we want to request one
+ * of our host page sizes (which is >= TPS)
+ */
+ ret = postcopy_request_page(mis, rb, rb_offset,
+ msg.arg.pagefault.address,
+ msg.arg.pagefault.feat.ptid);
+ if (ret) {
+ /* May be network failure, try to wait for recovery */
+ postcopy_pause_fault_thread(mis);
+ goto retry;
+ }
}
}
@@ -1501,8 +1585,11 @@ static int postcopy_temp_pages_setup(MigrationIncomingState *mis, Error **errp)
unsigned i, channels;
void *temp_page;
- if (migrate_postcopy_preempt()) {
- /* If preemption enabled, need extra channel for urgent requests */
+ if (migrate_postcopy_preempt() || migrate_mapped_ram()) {
+ /*
+ * If preemption enabled or it is fast snapshot load, need extra channel
+ * for urgent requests/faults
+ */
mis->postcopy_channels = RAM_CHANNEL_MAX;
} else {
/* Both precopy/postcopy on the same channel */
diff --git a/migration/ram.c b/migration/ram.c
index 330fceaa43..4ab8e0e750 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -269,12 +269,21 @@ static void ramblock_pending_bmap_init(void)
RAMBLOCK_FOREACH_NOT_IGNORED(rb) {
assert(!rb->pending_bmap);
- size_t size = rb->max_length >> qemu_target_page_bits();
+ size_t size = rb->max_length / qemu_ram_pagesize(rb);
rb->pending_bmap = bitmap_new(size);
bitmap_set(rb->pending_bmap, 0, size);
}
}
+bool ramblock_file_bitmap_page_is_nonzero(RAMBlock *rb, uint64_t page_idx)
+{
+ int page_bits = qemu_ram_pagesize(rb) / qemu_target_page_size();
+ uint64_t bmap_page_start = page_idx * page_bits;
+ uint64_t bmap_page_end = bmap_page_start + page_bits;
+ return find_next_bit(rb->file_bmap, bmap_page_end, bmap_page_start) !=
+ bmap_page_end;
+}
+
static void ramblock_recv_map_init(void)
{
RAMBlock *rb;
diff --git a/migration/ram.h b/migration/ram.h
index 41697a7599..7e2eac58d3 100644
--- a/migration/ram.h
+++ b/migration/ram.h
@@ -95,6 +95,8 @@ void ram_handle_zero(void *host, uint64_t size);
void ram_transferred_add(uint64_t bytes);
void ram_release_page(const char *rbname, uint64_t offset);
+bool ramblock_file_bitmap_page_is_nonzero(RAMBlock *rb, uint64_t page_idx);
+
int ramblock_recv_bitmap_test(RAMBlock *rb, void *host_addr);
bool ramblock_recv_bitmap_test_byte_offset(RAMBlock *rb, uint64_t byte_offset);
void ramblock_recv_bitmap_set(RAMBlock *rb, void *host_addr);
--
2.55.0On Tue, Jul 14, 2026 at 07:45:43PM +0530, Aadeshveer Singh wrote:
> In fast snapshot load, we would like to serve faults as soon as possible
> hence loading pages directly instead of requesting a source
>
> Add postcopy_mapped_ram_load_page() function which serves single page
> fault by reading the snapshot file. It uses bitmap_test_and_clear_atomic
> on pending_bmap to coordinate between threads so each page is loaded
> exactly once. Non-zero pages are read using qemu_get_buffer_at into a
> temporary page (for loading page atomically), which is then placed using
> postcopy_place_page. Zero pages are placed directly using
> postcopy_place_page_zero.
>
> Update postcopy_ram_fault_thread to call postcopy_mapped_ram_load_page
> instead of requesting source in case of fast snapshot load. to_src_file
> check is bypassed in fast snapshot load case as there is no source.
>
> Call try_mark_postcopy_blocktime_begin on every page fault to support
> postcopy-blocktime.
>
> Allocate another channel in postcopy_temp_pages_setup(like the preempt
> case), for both the fault thread and eager thread to load pages
> independently.
>
> Add function ramblock_file_bitmap_page_is_nonzero() which searches a
> range of bits corresponding to a page for a set bit. This is just a bit
> check for normal pages but for hugepages it checks the range to see if
> any part of page is non zero.
>
> Signed-off-by: Aadeshveer Singh <aadeshveer07@gmail.com>
> ---
> migration/postcopy-ram.c | 121 +++++++++++++++++++++++++++++++++------
> migration/ram.c | 11 +++-
> migration/ram.h | 2 +
> 3 files changed, 116 insertions(+), 18 deletions(-)
>
> diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
> index 2e2c9fae10..723070b5cd 100644
> --- a/migration/postcopy-ram.c
> +++ b/migration/postcopy-ram.c
> @@ -949,6 +949,68 @@ int postcopy_wake_shared(struct PostCopyFD *pcfd,
> pagesize);
> }
>
> +/**
> + * postcopy_mapped_ram_load_page() - Load a page to given host address.
> + * @mis: Migration Incoming State.
> + * @rb: RAMBlock from where page is loaded.
> + * @rb_offset: Offset of page in RAMBlock.
> + * @haddr: Base of page where to load in page.
> + * @channel: Used to identify between threads and use corresponding temp.
> + * @errp: Set error in case of failure
> + *
> + * Load a page from RAMBlock at offset at given host address. Used by postcopy
> + * ram fault thread and eager thread in fast snapshot load case.
> + *
> + * Return: True on success.
> + */
> +static bool postcopy_mapped_ram_load_page(MigrationIncomingState *mis,
> + RAMBlock *rb, ram_addr_t rb_offset,
> + uint64_t haddr, int channel,
> + Error **errp)
> +{
> + void *place_source = mis->postcopy_tmp_pages[channel].tmp_huge_page;
> + size_t page;
> + size_t read;
> +
> + page = rb_offset / qemu_ram_pagesize(rb);
> +
> + if (bitmap_test_and_clear_atomic(rb->pending_bmap, page, 1)) {
> + if (ramblock_file_bitmap_page_is_nonzero(rb, page)) {
I discussed this part previously I think, but maybe not with details. This
is fine but it is less optimal in two things:
- It relies on the mapped-ram pre-fill all zero pages to be zeros in the
image, otherwise if you see a huge page having some but not all non-zero
page, it'll fallback to always copy from image, then we start to read
data from "zero page" ranges, which we never do before (in vanilla
mapped-ram logic, we always skip ranges that represent zero pages).
- It is slightly less efficient, because we need to copy the zeros from the
image even if we know they're zeros
IIUC it's better to loop over all guest pages on this specific host page
when preparing the place_source buffer, then do a one-shot place page.
NOTE: I believe in all paths you touched, you assumed host psize is always
>= guest psize. Just to mention it's actually possible to have host psize
< guest psize. One case is ARM64 using 4K host psize to emulate 64K guest
psize. But that's less of a problem; normally production users rarely use
such setup, IIUC, so I think we can put it aside for now (however I believe
migration core should work with such setup right now in general). But if
you can take that into account it'll be even better.
> + /*
> + * This can happen concurrently, but it's thread-safe because
> + * qemu_get_buffer_at() is thread-safe, and the caller will be using
> + * different temporary buffers.
> + */
> + read = qemu_get_buffer_at(mis->from_src_file, place_source,
> + qemu_ram_pagesize(rb),
> + rb->pages_offset + rb_offset, errp);
> +
> + if (read != qemu_ram_pagesize(rb)) {
> + error_prepend(errp, "Could not read page %zu from RAM Block %s",
> + page, rb->idstr);
> + return false;
> + }
> +
> + if (postcopy_place_page(mis, (void *)haddr, place_source, rb)) {
> + error_setg(errp,
> + "Failed to place page %zu from RAM Block %s at "
> + "address %" PRIu64,
> + page, rb->idstr, haddr);
> + return false;
> + }
> + } else {
> + if (postcopy_place_page_zero(mis, (void *)haddr, rb)) {
> + error_setg(errp,
> + "Failed to place zero page %zu from RAM Block %s at "
> + "address %" PRIu64,
> + page, rb->idstr, haddr);
> + return false;
> + }
> + }
> + }
> + return true;
> +}
> +
> /*
> * NOTE: @tid is only used when postcopy-blocktime feature is enabled, and
> * also optional: when zero is provided, the fault accounting will be ignored.
> @@ -1310,6 +1372,7 @@ static void *postcopy_ram_fault_thread(void *opaque)
> int ret;
> size_t index;
> RAMBlock *rb = NULL;
> + Error *local_err = NULL;
>
> trace_postcopy_ram_fault_thread_entry();
> rcu_register_thread();
> @@ -1351,11 +1414,13 @@ static void *postcopy_ram_fault_thread(void *opaque)
> break;
> }
>
> - if (!mis->to_src_file) {
> + if (!migrate_mapped_ram() && !mis->to_src_file) {
> /*
> - * Possibly someone tells us that the return path is
> - * broken already using the event. We should hold until
> - * the channel is rebuilt.
> + * Possibly someone tells us that the return path is broken already
> + * using the event. We should hold until the channel is rebuilt.
> + * Fast snapshot load doesn't support pause and recover, because
> + * it's not necessary: we can fail right away when QEMU just booted
> + * with nothing to lose.
> */
> postcopy_pause_fault_thread(mis);
> }
> @@ -1418,18 +1483,37 @@ static void *postcopy_ram_fault_thread(void *opaque)
> qemu_ram_get_idstr(rb),
> rb_offset,
> msg.arg.pagefault.feat.ptid);
> +
> + if (migrate_mapped_ram()) {
> + /* Load page directly in case of fast snapshot load */
> +
> + uintptr_t aligned = (uintptr_t)ROUND_DOWN(
> + msg.arg.pagefault.address, qemu_ram_pagesize(rb));
> +
> + if (try_mark_postcopy_blocktime_begin(
> + mis, rb, rb_offset, (uintptr_t)aligned,
> + msg.arg.pagefault.feat.ptid)) {
> + if (!postcopy_mapped_ram_load_page(
> + mis, rb, rb_offset, aligned, RAM_CHANNEL_POSTCOPY,
> + &local_err)) {
> + error_report_err(local_err);
> + break;
> + }
> + }
> + } else {
> retry:
> - /*
> - * Send the request to the source - we want to request one
> - * of our host page sizes (which is >= TPS)
> - */
> - ret = postcopy_request_page(mis, rb, rb_offset,
> - msg.arg.pagefault.address,
> - msg.arg.pagefault.feat.ptid);
> - if (ret) {
> - /* May be network failure, try to wait for recovery */
> - postcopy_pause_fault_thread(mis);
> - goto retry;
> + /*
> + * Send the request to the source - we want to request one
> + * of our host page sizes (which is >= TPS)
> + */
> + ret = postcopy_request_page(mis, rb, rb_offset,
> + msg.arg.pagefault.address,
> + msg.arg.pagefault.feat.ptid);
> + if (ret) {
> + /* May be network failure, try to wait for recovery */
> + postcopy_pause_fault_thread(mis);
> + goto retry;
> + }
> }
> }
>
> @@ -1501,8 +1585,11 @@ static int postcopy_temp_pages_setup(MigrationIncomingState *mis, Error **errp)
> unsigned i, channels;
> void *temp_page;
>
> - if (migrate_postcopy_preempt()) {
> - /* If preemption enabled, need extra channel for urgent requests */
> + if (migrate_postcopy_preempt() || migrate_mapped_ram()) {
> + /*
> + * If preemption enabled or it is fast snapshot load, need extra channel
> + * for urgent requests/faults
> + */
> mis->postcopy_channels = RAM_CHANNEL_MAX;
> } else {
> /* Both precopy/postcopy on the same channel */
> diff --git a/migration/ram.c b/migration/ram.c
> index 330fceaa43..4ab8e0e750 100644
> --- a/migration/ram.c
> +++ b/migration/ram.c
> @@ -269,12 +269,21 @@ static void ramblock_pending_bmap_init(void)
>
> RAMBLOCK_FOREACH_NOT_IGNORED(rb) {
> assert(!rb->pending_bmap);
> - size_t size = rb->max_length >> qemu_target_page_bits();
> + size_t size = rb->max_length / qemu_ram_pagesize(rb);
Oh here is the change.. let's move this to that patch directly (or squash
three patches).
Other than that this patch looks good.
Thanks,
> rb->pending_bmap = bitmap_new(size);
> bitmap_set(rb->pending_bmap, 0, size);
> }
> }
>
> +bool ramblock_file_bitmap_page_is_nonzero(RAMBlock *rb, uint64_t page_idx)
> +{
> + int page_bits = qemu_ram_pagesize(rb) / qemu_target_page_size();
> + uint64_t bmap_page_start = page_idx * page_bits;
> + uint64_t bmap_page_end = bmap_page_start + page_bits;
> + return find_next_bit(rb->file_bmap, bmap_page_end, bmap_page_start) !=
> + bmap_page_end;
> +}
> +
> static void ramblock_recv_map_init(void)
> {
> RAMBlock *rb;
> diff --git a/migration/ram.h b/migration/ram.h
> index 41697a7599..7e2eac58d3 100644
> --- a/migration/ram.h
> +++ b/migration/ram.h
> @@ -95,6 +95,8 @@ void ram_handle_zero(void *host, uint64_t size);
> void ram_transferred_add(uint64_t bytes);
> void ram_release_page(const char *rbname, uint64_t offset);
>
> +bool ramblock_file_bitmap_page_is_nonzero(RAMBlock *rb, uint64_t page_idx);
> +
> int ramblock_recv_bitmap_test(RAMBlock *rb, void *host_addr);
> bool ramblock_recv_bitmap_test_byte_offset(RAMBlock *rb, uint64_t byte_offset);
> void ramblock_recv_bitmap_set(RAMBlock *rb, void *host_addr);
> --
> 2.55.0
>
--
Peter Xu
On Tue, Jul 21, 2026 at 12:34 AM Peter Xu <peterx@redhat.com> wrote:
>
> On Tue, Jul 14, 2026 at 07:45:43PM +0530, Aadeshveer Singh wrote:
> > In fast snapshot load, we would like to serve faults as soon as possible
> > hence loading pages directly instead of requesting a source
> >
> > Add postcopy_mapped_ram_load_page() function which serves single page
> > fault by reading the snapshot file. It uses bitmap_test_and_clear_atomic
> > on pending_bmap to coordinate between threads so each page is loaded
> > exactly once. Non-zero pages are read using qemu_get_buffer_at into a
> > temporary page (for loading page atomically), which is then placed using
> > postcopy_place_page. Zero pages are placed directly using
> > postcopy_place_page_zero.
> >
> > Update postcopy_ram_fault_thread to call postcopy_mapped_ram_load_page
> > instead of requesting source in case of fast snapshot load. to_src_file
> > check is bypassed in fast snapshot load case as there is no source.
> >
> > Call try_mark_postcopy_blocktime_begin on every page fault to support
> > postcopy-blocktime.
> >
> > Allocate another channel in postcopy_temp_pages_setup(like the preempt
> > case), for both the fault thread and eager thread to load pages
> > independently.
> >
> > Add function ramblock_file_bitmap_page_is_nonzero() which searches a
> > range of bits corresponding to a page for a set bit. This is just a bit
> > check for normal pages but for hugepages it checks the range to see if
> > any part of page is non zero.
> >
> > Signed-off-by: Aadeshveer Singh <aadeshveer07@gmail.com>
> > ---
> > migration/postcopy-ram.c | 121 +++++++++++++++++++++++++++++++++------
> > migration/ram.c | 11 +++-
> > migration/ram.h | 2 +
> > 3 files changed, 116 insertions(+), 18 deletions(-)
> >
> > diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
> > index 2e2c9fae10..723070b5cd 100644
> > --- a/migration/postcopy-ram.c
> > +++ b/migration/postcopy-ram.c
> > @@ -949,6 +949,68 @@ int postcopy_wake_shared(struct PostCopyFD *pcfd,
> > pagesize);
> > }
> >
> > +/**
> > + * postcopy_mapped_ram_load_page() - Load a page to given host address.
> > + * @mis: Migration Incoming State.
> > + * @rb: RAMBlock from where page is loaded.
> > + * @rb_offset: Offset of page in RAMBlock.
> > + * @haddr: Base of page where to load in page.
> > + * @channel: Used to identify between threads and use corresponding temp.
> > + * @errp: Set error in case of failure
> > + *
> > + * Load a page from RAMBlock at offset at given host address. Used by postcopy
> > + * ram fault thread and eager thread in fast snapshot load case.
> > + *
> > + * Return: True on success.
> > + */
> > +static bool postcopy_mapped_ram_load_page(MigrationIncomingState *mis,
> > + RAMBlock *rb, ram_addr_t rb_offset,
> > + uint64_t haddr, int channel,
> > + Error **errp)
> > +{
> > + void *place_source = mis->postcopy_tmp_pages[channel].tmp_huge_page;
> > + size_t page;
> > + size_t read;
> > +
> > + page = rb_offset / qemu_ram_pagesize(rb);
> > +
> > + if (bitmap_test_and_clear_atomic(rb->pending_bmap, page, 1)) {
> > + if (ramblock_file_bitmap_page_is_nonzero(rb, page)) {
>
> I discussed this part previously I think, but maybe not with details. This
> is fine but it is less optimal in two things:
>
> - It relies on the mapped-ram pre-fill all zero pages to be zeros in the
> image, otherwise if you see a huge page having some but not all non-zero
> page, it'll fallback to always copy from image, then we start to read
> data from "zero page" ranges, which we never do before (in vanilla
> mapped-ram logic, we always skip ranges that represent zero pages).
>
> - It is slightly less efficient, because we need to copy the zeros from the
> image even if we know they're zeros
>
> IIUC it's better to loop over all guest pages on this specific host page
> when preparing the place_source buffer, then do a one-shot place page.
>
> NOTE: I believe in all paths you touched, you assumed host psize is always
> >= guest psize. Just to mention it's actually possible to have host psize
> < guest psize. One case is ARM64 using 4K host psize to emulate 64K guest
> psize. But that's less of a problem; normally production users rarely use
> such setup, IIUC, so I think we can put it aside for now (however I believe
> migration core should work with such setup right now in general). But if
> you can take that into account it'll be even better.
>
I agree with the looping over and loading pages into the buffer. That
would be more efficient and would get rid of the assumption I had that
zero ranges in hugepages should always be zero. I will look into how
to generalize this for differences between host and guest page sizes.
That depends on how mapped-ram handles those cases. I might have to
look into that.
> > + /*
> > + * This can happen concurrently, but it's thread-safe because
> > + * qemu_get_buffer_at() is thread-safe, and the caller will be using
> > + * different temporary buffers.
> > + */
> > + read = qemu_get_buffer_at(mis->from_src_file, place_source,
> > + qemu_ram_pagesize(rb),
> > + rb->pages_offset + rb_offset, errp);
> > +
> > + if (read != qemu_ram_pagesize(rb)) {
> > + error_prepend(errp, "Could not read page %zu from RAM Block %s",
> > + page, rb->idstr);
> > + return false;
> > + }
> > +
> > + if (postcopy_place_page(mis, (void *)haddr, place_source, rb)) {
> > + error_setg(errp,
> > + "Failed to place page %zu from RAM Block %s at "
> > + "address %" PRIu64,
> > + page, rb->idstr, haddr);
> > + return false;
> > + }
> > + } else {
> > + if (postcopy_place_page_zero(mis, (void *)haddr, rb)) {
> > + error_setg(errp,
> > + "Failed to place zero page %zu from RAM Block %s at "
> > + "address %" PRIu64,
> > + page, rb->idstr, haddr);
> > + return false;
> > + }
> > + }
> > + }
> > + return true;
> > +}
> > +
> > /*
> > * NOTE: @tid is only used when postcopy-blocktime feature is enabled, and
> > * also optional: when zero is provided, the fault accounting will be ignored.
> > @@ -1310,6 +1372,7 @@ static void *postcopy_ram_fault_thread(void *opaque)
> > int ret;
> > size_t index;
> > RAMBlock *rb = NULL;
> > + Error *local_err = NULL;
> >
> > trace_postcopy_ram_fault_thread_entry();
> > rcu_register_thread();
> > @@ -1351,11 +1414,13 @@ static void *postcopy_ram_fault_thread(void *opaque)
> > break;
> > }
> >
> > - if (!mis->to_src_file) {
> > + if (!migrate_mapped_ram() && !mis->to_src_file) {
> > /*
> > - * Possibly someone tells us that the return path is
> > - * broken already using the event. We should hold until
> > - * the channel is rebuilt.
> > + * Possibly someone tells us that the return path is broken already
> > + * using the event. We should hold until the channel is rebuilt.
> > + * Fast snapshot load doesn't support pause and recover, because
> > + * it's not necessary: we can fail right away when QEMU just booted
> > + * with nothing to lose.
> > */
> > postcopy_pause_fault_thread(mis);
> > }
> > @@ -1418,18 +1483,37 @@ static void *postcopy_ram_fault_thread(void *opaque)
> > qemu_ram_get_idstr(rb),
> > rb_offset,
> > msg.arg.pagefault.feat.ptid);
> > +
> > + if (migrate_mapped_ram()) {
> > + /* Load page directly in case of fast snapshot load */
> > +
> > + uintptr_t aligned = (uintptr_t)ROUND_DOWN(
> > + msg.arg.pagefault.address, qemu_ram_pagesize(rb));
> > +
> > + if (try_mark_postcopy_blocktime_begin(
> > + mis, rb, rb_offset, (uintptr_t)aligned,
> > + msg.arg.pagefault.feat.ptid)) {
> > + if (!postcopy_mapped_ram_load_page(
> > + mis, rb, rb_offset, aligned, RAM_CHANNEL_POSTCOPY,
> > + &local_err)) {
> > + error_report_err(local_err);
> > + break;
> > + }
> > + }
> > + } else {
> > retry:
> > - /*
> > - * Send the request to the source - we want to request one
> > - * of our host page sizes (which is >= TPS)
> > - */
> > - ret = postcopy_request_page(mis, rb, rb_offset,
> > - msg.arg.pagefault.address,
> > - msg.arg.pagefault.feat.ptid);
> > - if (ret) {
> > - /* May be network failure, try to wait for recovery */
> > - postcopy_pause_fault_thread(mis);
> > - goto retry;
> > + /*
> > + * Send the request to the source - we want to request one
> > + * of our host page sizes (which is >= TPS)
> > + */
> > + ret = postcopy_request_page(mis, rb, rb_offset,
> > + msg.arg.pagefault.address,
> > + msg.arg.pagefault.feat.ptid);
> > + if (ret) {
> > + /* May be network failure, try to wait for recovery */
> > + postcopy_pause_fault_thread(mis);
> > + goto retry;
> > + }
> > }
> > }
> >
> > @@ -1501,8 +1585,11 @@ static int postcopy_temp_pages_setup(MigrationIncomingState *mis, Error **errp)
> > unsigned i, channels;
> > void *temp_page;
> >
> > - if (migrate_postcopy_preempt()) {
> > - /* If preemption enabled, need extra channel for urgent requests */
> > + if (migrate_postcopy_preempt() || migrate_mapped_ram()) {
> > + /*
> > + * If preemption enabled or it is fast snapshot load, need extra channel
> > + * for urgent requests/faults
> > + */
> > mis->postcopy_channels = RAM_CHANNEL_MAX;
> > } else {
> > /* Both precopy/postcopy on the same channel */
> > diff --git a/migration/ram.c b/migration/ram.c
> > index 330fceaa43..4ab8e0e750 100644
> > --- a/migration/ram.c
> > +++ b/migration/ram.c
> > @@ -269,12 +269,21 @@ static void ramblock_pending_bmap_init(void)
> >
> > RAMBLOCK_FOREACH_NOT_IGNORED(rb) {
> > assert(!rb->pending_bmap);
> > - size_t size = rb->max_length >> qemu_target_page_bits();
> > + size_t size = rb->max_length / qemu_ram_pagesize(rb);
>
> Oh here is the change.. let's move this to that patch directly (or squash
> three patches).
I think I messed up this change. Moved it to the previous patch for
following version.
>
> Other than that this patch looks good.
>
> Thanks,
>
> > rb->pending_bmap = bitmap_new(size);
> > bitmap_set(rb->pending_bmap, 0, size);
> > }
> > }
> >
> > +bool ramblock_file_bitmap_page_is_nonzero(RAMBlock *rb, uint64_t page_idx)
> > +{
> > + int page_bits = qemu_ram_pagesize(rb) / qemu_target_page_size();
> > + uint64_t bmap_page_start = page_idx * page_bits;
> > + uint64_t bmap_page_end = bmap_page_start + page_bits;
> > + return find_next_bit(rb->file_bmap, bmap_page_end, bmap_page_start) !=
> > + bmap_page_end;
> > +}
> > +
> > static void ramblock_recv_map_init(void)
> > {
> > RAMBlock *rb;
> > diff --git a/migration/ram.h b/migration/ram.h
> > index 41697a7599..7e2eac58d3 100644
> > --- a/migration/ram.h
> > +++ b/migration/ram.h
> > @@ -95,6 +95,8 @@ void ram_handle_zero(void *host, uint64_t size);
> > void ram_transferred_add(uint64_t bytes);
> > void ram_release_page(const char *rbname, uint64_t offset);
> >
> > +bool ramblock_file_bitmap_page_is_nonzero(RAMBlock *rb, uint64_t page_idx);
> > +
> > int ramblock_recv_bitmap_test(RAMBlock *rb, void *host_addr);
> > bool ramblock_recv_bitmap_test_byte_offset(RAMBlock *rb, uint64_t byte_offset);
> > void ramblock_recv_bitmap_set(RAMBlock *rb, void *host_addr);
> > --
> > 2.55.0
> >
>
> --
> Peter Xu
>
On Wed, Jul 22, 2026 at 07:24:29PM +0530, Aadeshveer Singh wrote:
> > NOTE: I believe in all paths you touched, you assumed host psize is always
> > >= guest psize. Just to mention it's actually possible to have host psize
> > < guest psize. One case is ARM64 using 4K host psize to emulate 64K guest
> > psize. But that's less of a problem; normally production users rarely use
> > such setup, IIUC, so I think we can put it aside for now (however I believe
> > migration core should work with such setup right now in general). But if
> > you can take that into account it'll be even better.
> >
>
> I agree with the looping over and loading pages into the buffer. That
> would be more efficient and would get rid of the assumption I had that
> zero ranges in hugepages should always be zero. I will look into how
> to generalize this for differences between host and guest page sizes.
> That depends on how mapped-ram handles those cases. I might have to
> look into that.
For host/guest psize, it's actually easier for vanilla mapped-ram, and your
feature is slightly more complex.
It used to be non-issue because mapped-ram only cares about guest psize.
It does not care about the size of host pages, being huge or not.
IOW, mapped-ram sync mode directly manipuates the HVA pointer, ignoring
what is underneath, when requesting IOs from qemu_get_buffer_at() from the
snapshot images. Since VM isn't running, destination QEMU doesn't care
about e.g. prepopulation of a huge page with partially filled data when the
first HVA access happens.
Your work will need to consider this though, because in async faults your
feature will depend on userfaultfd, which is host-page aware, and the VM is
running, so we can't populate some host page partially, we can only
populate it always atomically. This is the same to network-based postcopy.
When I said on normal migration code will work with various guest/host page
setups, I meant more on the iteration logic of when we iterate over RAMs.
For example, on the source / saving side (where your series didn't yet
touch, but you will need to start looking into if you want to enable
multifd + postcopy..), we have a loop structure like this:
ram_save_iterate() (NOTE, for complete(), it's the same)
ram_find_and_save_block()
ram_save_host_page() <-------------- [1]
ram_save_target_page() <-------------- [2]
So someone who read the code first may think that QEMU only supports host
psize >= guest psize, because loop [1] is higher in stack, looping over
smaller guest psizes when they don't match. But in reality what happens
is, in loop [2] when guest psize is even larger than host psize, what will
happen is (take example of host psize 4K, guest psize 64K):
- Loop [1], find a host page (e.g. start at address 1M, which is 4K on
the host), try to migrate the "page" (pointed by pss->page)
- At [2], migrate the whole guest "page" (pointed by pss->page), which is
64K (> 4K) return to loop [1].
- Loop [1], found that after sending the guest page, we've already
covered the host psize range (4K), fallbck to ram_find_and_save_block()
to find another dirty host page
- In ram_find_and_save_block(), it'll find the next dirty (e.g. 1M+64K,
rather than 1M+4K, because ramblock->bmap is guest psize based).
You can take time to reference to above (also comments in
pss_host_page_prepare()).
Thanks,
--
Peter Xu
© 2016 - 2026 Red Hat, Inc.