checkpoint: add pre-dump support

CRIU supports the concept of pre-copy migration. Instead of creating a
complete checkpoint of a process it is possible to only write the memory
of the process to disk while the process keeps on running. The first
memory only checkpoint can then be transferred to the migration
destination. During the transfer time it is possible take a second
checkpoint which will only write the memory pages to disk that have
changed since the previous checkpoint. This way it can be possible that
the second checkpoint is much smaller while the process keeps on running
which also means that the amount of data which needs to be transferred
to the migration destination might be smaller and thus the migration
downtime can be reduced. This only makes sense if the number of memory
pages which are changing is rather small. There is no limit on the
number pre-copy iterations.

This commit takes the interface as implemented in runc and implements it
for crun. Podman already uses the pre-dump as implemented by runc.

This commit also makes sure that the underlying software stack supports
the pre-dump mechanism. CRIU uses the kernel's dirty page tracking and
it is not available on all architectures (aarch64 does not implement it)
or might not be enabled in the kernel. If the user wants to use pre-dump
on a system without dirty page tracking crun will fail early and inform
the user.

This crun pre-dump implementation relies on libcriu interfaces which are
not yet part of the latest release (3.16.1). So at least 3.16.2 or 3.17
is required to use pre-dump in combination with crun.

Signed-off-by: Adrian Reber <areber@redhat.com>

Author: adrianreber

configure.ac

@@ -133,12 +133,20 @@ AC_ARG_ENABLE([criu], AS_HELP_STRING([--disable-criu], [Disable CRIU based check
 AS_IF([test "x$enable_criu" != "xno"], [
 	PKG_CHECK_MODULES([CRIU], [criu >= 3.15], [have_criu="yes"], [have_criu="no"
 		AC_MSG_NOTICE([CRIU headers not found, building without CRIU support])])
-	PKG_CHECK_MODULES([CRIU], [criu > 3.16], [have_criu_join_ns="yes"], [have_criu_join_ns="no"
-		AC_MSG_NOTICE([CRIU version doesn't support join-ns API])])
-		AS_IF([test "$have_criu" = "yes"], [
-			AC_DEFINE([HAVE_CRIU], 1, [Define if CRIU is available])
-			AC_SEARCH_LIBS(criu_init_opts, [criu])
-		])
+	PKG_CHECK_MODULES([CRIU_JOIN_NS], [criu > 3.16], [have_criu_join_ns="yes"], [have_criu_join_ns="no"
+	        AC_MSG_NOTICE([CRIU version doesn't support join-ns API])])
+	PKG_CHECK_MODULES([CRIU_PRE_DUMP], [criu > 3.16.1], [have_criu_pre_dump="yes"], [have_criu_pre_dump="no"
+	        AC_MSG_NOTICE([CRIU version doesn't support for pre-dumping])])
+	AS_IF([test "$have_criu" = "yes"], [
+		AC_DEFINE([HAVE_CRIU], 1, [Define if CRIU is available])
+		AC_SEARCH_LIBS(criu_init_opts, [criu])
+	])
+	AS_IF([test "$have_criu_join_ns" = "yes"], [
+		AC_DEFINE([CRIU_JOIN_NS_SUPPORT], 1, [Define if CRIU join NS support is available])
+	])
+	AS_IF([test "$have_criu_pre_dump" = "yes"], [
+		AC_DEFINE([CRIU_PRE_DUMP_SUPPORT], 1, [Define if CRIU pre-dump support is available])
+	])
 ], [AC_MSG_NOTICE([CRIU support disabled per user request])])
 
 FOUND_LIBS=$LIBS
@@ -183,7 +191,6 @@ AC_SEARCH_LIBS([argp_parse], [argp], [], [AC_MSG_ERROR([*** argp functions not f
 
 AM_CONDITIONAL([PYTHON_BINDINGS], [test "x$with_python_bindings" = "xyes"])
 AM_CONDITIONAL([CRIU_SUPPORT], [test "x$have_criu" = "xyes"])
-AM_CONDITIONAL([CRIU_JOIN_NS_SUPPORT], [test "x$have_criu_join_ns" = "xyes"])
 
 AC_CONFIG_FILES([Makefile rpm/crun.spec])
 

src/checkpoint.c

@@ -41,6 +41,8 @@ enum
   OPTION_SHELL_JOB,
   OPTION_EXT_UNIX_SK,
   OPTION_FILE_LOCKS,
+  OPTION_PARENT_PATH,
+  OPTION_PRE_DUMP,
 };
 
 static char doc[] = "OCI runtime";
@@ -55,6 +57,10 @@ static struct argp_option options[]
         { "ext-unix-sk", OPTION_EXT_UNIX_SK, 0, 0, "allow external unix sockets", 0 },
         { "shell-job", OPTION_SHELL_JOB, 0, 0, "allow shell jobs", 0 },
         { "file-locks", OPTION_FILE_LOCKS, 0, 0, "allow file locks", 0 },
+#ifdef CRIU_PRE_DUMP_SUPPORT
+        { "parent-path", OPTION_PARENT_PATH, "DIR", 0, "path for previous criu image files in pre-dump", 0 },
+        { "pre-dump", OPTION_PRE_DUMP, 0, 0, "dump container's memory information only, leave the container running after this", 0 },
+#endif
         {
             0,
         } };
@@ -77,6 +83,14 @@ parse_opt (int key, char *arg arg_unused, struct argp_state *state arg_unused)
       cr_options.work_path = argp_mandatory_argument (arg, state);
       break;
 
+    case OPTION_PARENT_PATH:
+      cr_options.parent_path = argp_mandatory_argument (arg, state);
+      break;
+
+    case OPTION_PRE_DUMP:
+      cr_options.pre_dump = true;
+      break;
+
     case OPTION_LEAVE_RUNNING:
       cr_options.leave_running = true;
       break;

src/libcrun/container.c

@@ -3563,7 +3563,7 @@ libcrun_container_checkpoint (libcrun_context_t *context, const char *id, libcru
   if (UNLIKELY (ret < 0))
     return ret;
 
-  if (! cr_options->leave_running)
+  if (! (cr_options->leave_running || cr_options->pre_dump))
     return container_delete_internal (context, NULL, id, true, true, err);
 
   return 0;

src/libcrun/container.h

@@ -96,6 +96,8 @@ struct libcrun_checkpoint_restore_s
   bool detach;
   bool file_locks;
   const char *console_socket;
+  char *parent_path;
+  bool pre_dump;
 };
 typedef struct libcrun_checkpoint_restore_s libcrun_checkpoint_restore_t;
 

src/libcrun/criu.c

@@ -75,6 +75,39 @@ criu_notify (char *action, __attribute__ ((unused)) criu_notify_arg_t na)
   return 0;
 }
 
+#  ifdef CRIU_PRE_DUMP_SUPPORT
+
+static int
+criu_check_mem_track (char *work_path, libcrun_error_t *err)
+{
+  struct criu_feature_check features = { 0 };
+  int ret;
+
+  /* Right now we are only interested in checking memory tracking.
+   * Memory tracking can be disabled at different levels. aarch64
+   * for example has memory tracking not implemented. It could also
+   * be not enabled on other architectures. Just ask CRIU if that
+   * features exists. */
+
+  features.mem_track = true;
+
+  ret = criu_feature_check (&features, sizeof (features));
+
+  if (UNLIKELY (ret < 0))
+    return crun_make_error (err, 0,
+                            "CRIU feature checking failed %d.  Please check CRIU logfile %s/%s",
+                            ret, work_path, CRIU_CHECKPOINT_LOG_FILE);
+
+  if (features.mem_track == true)
+    return 1;
+
+  return crun_make_error (err, 0,
+                          "Memory tracking not supported. Please check CRIU logfile %s/%s",
+                          work_path, CRIU_CHECKPOINT_LOG_FILE);
+}
+
+#  endif
+
 static int
 restore_cgroup_v1_mount (runtime_spec_schema_config_schema *def, libcrun_error_t *err)
 {
@@ -265,15 +298,14 @@ libcrun_container_checkpoint_linux_criu (libcrun_container_status_t *status, lib
 
   criu_set_images_dir_fd (image_fd);
 
-  /* descriptors.json is needed during restore to correctly
-   * reconnect stdin, stdout, stderr. */
-  ret = append_paths (&descriptors_path, err, cr_options->image_path, DESCRIPTORS_FILENAME, NULL);
-  if (UNLIKELY (ret < 0))
-    return ret;
-
-  ret = write_file (descriptors_path, status->external_descriptors, strlen (status->external_descriptors), err);
-  if (UNLIKELY (ret < 0))
-    return crun_error_wrap (err, "error saving CRIU descriptors file");
+  /* Set up logging. */
+  criu_set_log_level (4);
+  criu_set_log_file (CRIU_CHECKPOINT_LOG_FILE);
+  /* Setting the pid early as we can skip a lot of checkpoint setup if
+   * we just do a pre-dump. The PID needs to be set always. Do it here.
+   * The main process of the container is the process CRIU will checkpoint
+   * and all of its children. */
+  criu_set_pid (status->pid);
 
   /* work_dir is the place CRIU will put its logfiles. If not explicitly set,
    * CRIU will put the logfiles into the images_dir from above. No need for
@@ -292,9 +324,54 @@ libcrun_container_checkpoint_linux_criu (libcrun_container_status_t *status, lib
       cr_options->work_path = cr_options->image_path;
     }
 
-  /* The main process of the container is the process CRIU will checkpoint
-   * and all of its children. */
-  criu_set_pid (status->pid);
+#  ifdef CRIU_PRE_DUMP_SUPPORT
+
+  {
+    int criu_can_mem_track = 0;
+    /* If the user uses --pre-dump for the second time or does
+     * a final dump from a previous pre-dump, setting parent_path
+     * is necessary so that CRIU can find which pages have not
+     * changed compared to the previous dump. */
+    if (cr_options->parent_path != NULL)
+      {
+        criu_can_mem_track = criu_check_mem_track (cr_options->work_path, err);
+        if (UNLIKELY (criu_can_mem_track == -1))
+          return -1;
+        criu_set_track_mem (true);
+        /* The parent path needs to be a relative path. CRIU will fail
+         * if the path is not in the right format. Usually something like
+         * ../previous-dump */
+        criu_set_parent_images (cr_options->parent_path);
+      }
+
+    if (cr_options->pre_dump)
+      {
+        if (criu_can_mem_track != 1)
+          {
+            criu_can_mem_track = criu_check_mem_track (cr_options->work_path, err);
+            if (UNLIKELY (criu_can_mem_track == -1))
+              return -1;
+          }
+        criu_set_track_mem (true);
+        ret = criu_pre_dump ();
+        if (UNLIKELY (ret != 0))
+          return crun_make_error (err, 0,
+                                  "CRIU pre-dump failed %d.  Please check CRIU logfile %s/%s",
+                                  ret, cr_options->work_path, CRIU_CHECKPOINT_LOG_FILE);
+        return 0;
+      }
+  }
+#  endif
+
+  /* descriptors.json is needed during restore to correctly
+   * reconnect stdin, stdout, stderr. */
+  ret = append_paths (&descriptors_path, err, cr_options->image_path, DESCRIPTORS_FILENAME, NULL);
+  if (UNLIKELY (ret < 0))
+    return ret;
+
+  ret = write_file (descriptors_path, status->external_descriptors, strlen (status->external_descriptors), err);
+  if (UNLIKELY (ret < 0))
+    return crun_error_wrap (err, "error saving CRIU descriptors file");
 
   ret = append_paths (&path, err, status->bundle, status->rootfs, NULL);
   if (UNLIKELY (ret < 0))
@@ -413,9 +490,6 @@ libcrun_container_checkpoint_linux_criu (libcrun_container_status_t *status, lib
   criu_set_orphan_pts_master (true);
   criu_set_manage_cgroups (true);
 
-  /* Set up logging. */
-  criu_set_log_level (4);
-  criu_set_log_file (CRIU_CHECKPOINT_LOG_FILE);
   ret = criu_dump ();
   if (UNLIKELY (ret != 0))
     return crun_make_error (err, 0,