[PATCH] Swapless page migration: add R/W migration entries

Implement read/write migration ptes

We take the upper two swapfiles for the two types of migration ptes and define
a series of macros in swapops.h.

The VM is modified to handle the migration entries.  migration entries can
only be encountered when the page they are pointing to is locked.  This limits
the number of places one has to fix.  We also check in copy_pte_range and in
mprotect_pte_range() for migration ptes.

We check for migration ptes in do_swap_cache and call a function that will
then wait on the page lock.  This allows us to effectively stop all accesses
to apge.

Migration entries are created by try_to_unmap if called for migration and
removed by local functions in migrate.c

From: Hugh Dickins <hugh@veritas.com>

  Several times while testing swapless page migration (I've no NUMA, just
  hacking it up to migrate recklessly while running load), I've hit the
  BUG_ON(!PageLocked(p)) in migration_entry_to_page.

  This comes from an orphaned migration entry, unrelated to the current
  correctly locked migration, but hit by remove_anon_migration_ptes as it
  checks an address in each vma of the anon_vma list.

  Such an orphan may be left behind if an earlier migration raced with fork:
  copy_one_pte can duplicate a migration entry from parent to child, after
  remove_anon_migration_ptes has checked the child vma, but before it has
  removed it from the parent vma.  (If the process were later to fault on this
  orphaned entry, it would hit the same BUG from migration_entry_wait.)

  This could be fixed by locking anon_vma in copy_one_pte, but we'd rather
  not.  There's no such problem with file pages, because vma_prio_tree_add
  adds child vma after parent vma, and the page table locking at each end is
  enough to serialize.  Follow that example with anon_vma: add new vmas to the
  tail instead of the head.

  (There's no corresponding problem when inserting migration entries,
  because a missed pte will leave the page count and mapcount high, which is
  allowed for.  And there's no corresponding problem when migrating via swap,
  because a leftover swap entry will be correctly faulted.  But the swapless
  method has no refcounting of its entries.)

From: Ingo Molnar <mingo@elte.hu>

  pte_unmap_unlock() takes the pte pointer as an argument.

From: Hugh Dickins <hugh@veritas.com>

  Several times while testing swapless page migration, gcc has tried to exec
  a pointer instead of a string: smells like COW mappings are not being
  properly write-protected on fork.

  The protection in copy_one_pte looks very convincing, until at last you
  realize that the second arg to make_migration_entry is a boolean "write",
  and SWP_MIGRATION_READ is 30.

  Anyway, it's better done like in change_pte_range, using
  is_write_migration_entry and make_migration_entry_read.

From: Hugh Dickins <hugh@veritas.com>

  Remove unnecessary obfuscation from sys_swapon's range check on swap type,
  which blew up causing memory corruption once swapless migration made
  MAX_SWAPFILES no longer 2 ^ MAX_SWAPFILES_SHIFT.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
Acked-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Christoph Lameter <clameter@engr.sgi.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
From: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

1 files changed, 127 insertions, 1 deletions

diff --git a/mm/migrate.c b/mm/migrate.c
index 5a340f4ca212..0a011e421bb4 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -15,6 +15,7 @@
 #include <linux/migrate.h>
 #include <linux/module.h>
 #include <linux/swap.h>
+#include <linux/swapops.h>
 #include <linux/pagemap.h>
 #include <linux/buffer_head.h>
 #include <linux/mm_inline.h>
@@ -23,7 +24,6 @@
 #include <linux/topology.h>
 #include <linux/cpu.h>
 #include <linux/cpuset.h>
-#include <linux/swapops.h>
 
 #include "internal.h"
 
@@ -119,6 +119,132 @@ int putback_lru_pages(struct list_head *l)
         return count;
 }
 
+static inline int is_swap_pte(pte_t pte)
+{
+        return !pte_none(pte) && !pte_present(pte) && !pte_file(pte);
+}
+
+/*
+ * Restore a potential migration pte to a working pte entry
+ */
+static void remove_migration_pte(struct vm_area_struct *vma, unsigned long addr,
+                struct page *old, struct page *new)
+{
+        struct mm_struct *mm = vma->vm_mm;
+        swp_entry_t entry;
+        pgd_t *pgd;
+        pud_t *pud;
+        pmd_t *pmd;
+        pte_t *ptep, pte;
+        spinlock_t *ptl;
+
+        pgd = pgd_offset(mm, addr);
+        if (!pgd_present(*pgd))
+                return;
+
+        pud = pud_offset(pgd, addr);
+        if (!pud_present(*pud))
+                return;
+
+        pmd = pmd_offset(pud, addr);
+        if (!pmd_present(*pmd))
+                return;
+
+        ptep = pte_offset_map(pmd, addr);
+
+        if (!is_swap_pte(*ptep)) {
+                pte_unmap(ptep);
+                return;
+        }
+
+        ptl = pte_lockptr(mm, pmd);
+        spin_lock(ptl);
+        pte = *ptep;
+        if (!is_swap_pte(pte))
+                goto out;
+
+        entry = pte_to_swp_entry(pte);
+
+        if (!is_migration_entry(entry) || migration_entry_to_page(entry) != old)
+                goto out;
+
+        inc_mm_counter(mm, anon_rss);
+        get_page(new);
+        pte = pte_mkold(mk_pte(new, vma->vm_page_prot));
+        if (is_write_migration_entry(entry))
+                pte = pte_mkwrite(pte);
+        set_pte_at(mm, addr, ptep, pte);
+        page_add_anon_rmap(new, vma, addr);
+out:
+        pte_unmap_unlock(ptep, ptl);
+}
+
+/*
+ * Get rid of all migration entries and replace them by
+ * references to the indicated page.
+ *
+ * Must hold mmap_sem lock on at least one of the vmas containing
+ * the page so that the anon_vma cannot vanish.
+ */
+static void remove_migration_ptes(struct page *old, struct page *new)
+{
+        struct anon_vma *anon_vma;
+        struct vm_area_struct *vma;
+        unsigned long mapping;
+
+        mapping = (unsigned long)new->mapping;
+
+        if (!mapping || (mapping & PAGE_MAPPING_ANON) == 0)
+                return;
+
+        /*
+         * We hold the mmap_sem lock. So no need to call page_lock_anon_vma.
+         */
+        anon_vma = (struct anon_vma *) (mapping - PAGE_MAPPING_ANON);
+        spin_lock(&anon_vma->lock);
+
+        list_for_each_entry(vma, &anon_vma->head, anon_vma_node)
+                remove_migration_pte(vma, page_address_in_vma(new, vma),
+                                        old, new);
+
+        spin_unlock(&anon_vma->lock);
+}
+
+/*
+ * Something used the pte of a page under migration. We need to
+ * get to the page and wait until migration is finished.
+ * When we return from this function the fault will be retried.
+ *
+ * This function is called from do_swap_page().
+ */
+void migration_entry_wait(struct mm_struct *mm, pmd_t *pmd,
+                                unsigned long address)
+{
+        pte_t *ptep, pte;
+        spinlock_t *ptl;
+        swp_entry_t entry;
+        struct page *page;
+
+        ptep = pte_offset_map_lock(mm, pmd, address, &ptl);
+        pte = *ptep;
+        if (!is_swap_pte(pte))
+                goto out;
+
+        entry = pte_to_swp_entry(pte);
+        if (!is_migration_entry(entry))
+                goto out;
+
+        page = migration_entry_to_page(entry);
+
+        get_page(page);
+        pte_unmap_unlock(ptep, ptl);
+        wait_on_page_locked(page);
+        put_page(page);
+        return;
+out:
+        pte_unmap_unlock(ptep, ptl);
+}
+
 /*
  * swapout a single page
  * page is locked upon entry, unlocked on exit