2 * In-kernel transcendent memory (generic implementation)
4 * Copyright (c) 2009-2011, Dan Magenheimer, Oracle Corp.
6 * The primary purpose of Transcedent Memory ("tmem") is to map object-oriented
7 * "handles" (triples containing a pool id, and object id, and an index), to
8 * pages in a page-accessible memory (PAM). Tmem references the PAM pages via
9 * an abstract "pampd" (PAM page-descriptor), which can be operated on by a
10 * set of functions (pamops). Each pampd contains some representation of
11 * PAGE_SIZE bytes worth of data. Tmem must support potentially millions of
12 * pages and must be able to insert, find, and delete these pages at a
13 * potential frequency of thousands per second concurrently across many CPUs,
14 * (and, if used with KVM, across many vcpus across many guests).
15 * Tmem is tracked with a hierarchy of data structures, organized by
16 * the elements in a handle-tuple: pool_id, object_id, and page index.
17 * One or more "clients" (e.g. guests) each provide one or more tmem_pools.
18 * Each pool, contains a hash table of rb_trees of tmem_objs. Each
19 * tmem_obj contains a radix-tree-like tree of pointers, with intermediate
20 * nodes called tmem_objnodes. Each leaf pointer in this tree points to
21 * a pampd, which is accessible only through a small set of callbacks
22 * registered by the PAM implementation (see tmem_register_pamops). Tmem
23 * does all memory allocation via a set of callbacks registered by the tmem
24 * host implementation (e.g. see tmem_register_hostops).
27 #include <linux/list.h>
28 #include <linux/spinlock.h>
29 #include <linux/atomic.h>
33 /* data structure sentinels used for debugging... see tmem.h */
34 #define POOL_SENTINEL 0x87658765
35 #define OBJ_SENTINEL 0x12345678
36 #define OBJNODE_SENTINEL 0xfedcba09
39 * A tmem host implementation must use this function to register callbacks
40 * for memory allocation.
42 static struct tmem_hostops tmem_hostops;
44 static void tmem_objnode_tree_init(void);
46 void tmem_register_hostops(struct tmem_hostops *m)
48 tmem_objnode_tree_init();
53 * A tmem host implementation must use this function to register
54 * callbacks for a page-accessible memory (PAM) implementation
56 static struct tmem_pamops tmem_pamops;
58 void tmem_register_pamops(struct tmem_pamops *m)
64 * Oid's are potentially very sparse and tmem_objs may have an indeterminately
65 * short life, being added and deleted at a relatively high frequency.
66 * So an rb_tree is an ideal data structure to manage tmem_objs. But because
67 * of the potentially huge number of tmem_objs, each pool manages a hashtable
68 * of rb_trees to reduce search, insert, delete, and rebalancing time.
69 * Each hashbucket also has a lock to manage concurrent access.
71 * The following routines manage tmem_objs. When any tmem_obj is accessed,
72 * the hashbucket lock must be held.
75 static struct tmem_obj
76 *__tmem_obj_find(struct tmem_hashbucket*hb, struct tmem_oid *oidp,
77 struct rb_node **parent, struct rb_node ***link)
79 struct rb_node *_parent = NULL, **rbnode;
80 struct tmem_obj *obj = NULL;
82 rbnode = &hb->obj_rb_root.rb_node;
84 BUG_ON(RB_EMPTY_NODE(*rbnode));
86 obj = rb_entry(*rbnode, struct tmem_obj,
88 switch (tmem_oid_compare(oidp, &obj->oid)) {
92 rbnode = &(*rbnode)->rb_left;
95 rbnode = &(*rbnode)->rb_right;
111 /* searches for object==oid in pool, returns locked object if found */
112 static struct tmem_obj *tmem_obj_find(struct tmem_hashbucket *hb,
113 struct tmem_oid *oidp)
115 return __tmem_obj_find(hb, oidp, NULL, NULL);
118 static void tmem_pampd_destroy_all_in_obj(struct tmem_obj *);
120 /* free an object that has no more pampds in it */
121 static void tmem_obj_free(struct tmem_obj *obj, struct tmem_hashbucket *hb)
123 struct tmem_pool *pool;
126 ASSERT_SENTINEL(obj, OBJ);
127 BUG_ON(obj->pampd_count > 0);
129 BUG_ON(pool == NULL);
130 if (obj->objnode_tree_root != NULL) /* may be "stump" with no leaves */
131 tmem_pampd_destroy_all_in_obj(obj);
132 BUG_ON(obj->objnode_tree_root != NULL);
133 BUG_ON((long)obj->objnode_count != 0);
134 atomic_dec(&pool->obj_count);
135 BUG_ON(atomic_read(&pool->obj_count) < 0);
136 INVERT_SENTINEL(obj, OBJ);
138 tmem_oid_set_invalid(&obj->oid);
139 rb_erase(&obj->rb_tree_node, &hb->obj_rb_root);
143 * initialize, and insert an tmem_object_root (called only if find failed)
145 static void tmem_obj_init(struct tmem_obj *obj, struct tmem_hashbucket *hb,
146 struct tmem_pool *pool,
147 struct tmem_oid *oidp)
149 struct rb_root *root = &hb->obj_rb_root;
150 struct rb_node **new = NULL, *parent = NULL;
152 BUG_ON(pool == NULL);
153 atomic_inc(&pool->obj_count);
154 obj->objnode_tree_height = 0;
155 obj->objnode_tree_root = NULL;
158 obj->objnode_count = 0;
159 obj->pampd_count = 0;
160 (*tmem_pamops.new_obj)(obj);
161 SET_SENTINEL(obj, OBJ);
163 if (__tmem_obj_find(hb, oidp, &parent, &new))
166 rb_link_node(&obj->rb_tree_node, parent, new);
167 rb_insert_color(&obj->rb_tree_node, root);
171 * Tmem is managed as a set of tmem_pools with certain attributes, such as
172 * "ephemeral" vs "persistent". These attributes apply to all tmem_objs
173 * and all pampds that belong to a tmem_pool. A tmem_pool is created
174 * or deleted relatively rarely (for example, when a filesystem is
175 * mounted or unmounted.
178 /* flush all data from a pool and, optionally, free it */
179 static void tmem_pool_flush(struct tmem_pool *pool, bool destroy)
181 struct rb_node *rbnode;
182 struct tmem_obj *obj;
183 struct tmem_hashbucket *hb = &pool->hashbucket[0];
186 BUG_ON(pool == NULL);
187 for (i = 0; i < TMEM_HASH_BUCKETS; i++, hb++) {
188 spin_lock(&hb->lock);
189 rbnode = rb_first(&hb->obj_rb_root);
190 while (rbnode != NULL) {
191 obj = rb_entry(rbnode, struct tmem_obj, rb_tree_node);
192 rbnode = rb_next(rbnode);
193 tmem_pampd_destroy_all_in_obj(obj);
194 tmem_obj_free(obj, hb);
195 (*tmem_hostops.obj_free)(obj, pool);
197 spin_unlock(&hb->lock);
200 list_del(&pool->pool_list);
204 * A tmem_obj contains a radix-tree-like tree in which the intermediate
205 * nodes are called tmem_objnodes. (The kernel lib/radix-tree.c implementation
206 * is very specialized and tuned for specific uses and is not particularly
207 * suited for use from this code, though some code from the core algorithms has
208 * been reused, thus the copyright notices below). Each tmem_objnode contains
209 * a set of pointers which point to either a set of intermediate tmem_objnodes
210 * or a set of of pampds.
212 * Portions Copyright (C) 2001 Momchil Velikov
213 * Portions Copyright (C) 2001 Christoph Hellwig
217 struct tmem_objnode_tree_path {
218 struct tmem_objnode *objnode;
222 /* objnode height_to_maxindex translation */
223 static unsigned long tmem_objnode_tree_h2max[OBJNODE_TREE_MAX_PATH + 1];
225 static void tmem_objnode_tree_init(void)
227 unsigned int ht, tmp;
229 for (ht = 0; ht < ARRAY_SIZE(tmem_objnode_tree_h2max); ht++) {
230 tmp = ht * OBJNODE_TREE_MAP_SHIFT;
231 if (tmp >= OBJNODE_TREE_INDEX_BITS)
232 tmem_objnode_tree_h2max[ht] = ~0UL;
234 tmem_objnode_tree_h2max[ht] =
235 (~0UL >> (OBJNODE_TREE_INDEX_BITS - tmp - 1)) >> 1;
239 static struct tmem_objnode *tmem_objnode_alloc(struct tmem_obj *obj)
241 struct tmem_objnode *objnode;
243 ASSERT_SENTINEL(obj, OBJ);
244 BUG_ON(obj->pool == NULL);
245 ASSERT_SENTINEL(obj->pool, POOL);
246 objnode = (*tmem_hostops.objnode_alloc)(obj->pool);
247 if (unlikely(objnode == NULL))
250 SET_SENTINEL(objnode, OBJNODE);
251 memset(&objnode->slots, 0, sizeof(objnode->slots));
252 objnode->slots_in_use = 0;
253 obj->objnode_count++;
258 static void tmem_objnode_free(struct tmem_objnode *objnode)
260 struct tmem_pool *pool;
263 BUG_ON(objnode == NULL);
264 for (i = 0; i < OBJNODE_TREE_MAP_SIZE; i++)
265 BUG_ON(objnode->slots[i] != NULL);
266 ASSERT_SENTINEL(objnode, OBJNODE);
267 INVERT_SENTINEL(objnode, OBJNODE);
268 BUG_ON(objnode->obj == NULL);
269 ASSERT_SENTINEL(objnode->obj, OBJ);
270 pool = objnode->obj->pool;
271 BUG_ON(pool == NULL);
272 ASSERT_SENTINEL(pool, POOL);
273 objnode->obj->objnode_count--;
275 (*tmem_hostops.objnode_free)(objnode, pool);
279 * lookup index in object and return associated pampd (or NULL if not found)
281 static void **__tmem_pampd_lookup_in_obj(struct tmem_obj *obj, uint32_t index)
283 unsigned int height, shift;
284 struct tmem_objnode **slot = NULL;
287 ASSERT_SENTINEL(obj, OBJ);
288 BUG_ON(obj->pool == NULL);
289 ASSERT_SENTINEL(obj->pool, POOL);
291 height = obj->objnode_tree_height;
292 if (index > tmem_objnode_tree_h2max[obj->objnode_tree_height])
294 if (height == 0 && obj->objnode_tree_root) {
295 slot = &obj->objnode_tree_root;
298 shift = (height-1) * OBJNODE_TREE_MAP_SHIFT;
299 slot = &obj->objnode_tree_root;
303 slot = (struct tmem_objnode **)
305 ((index >> shift) & OBJNODE_TREE_MAP_MASK));
306 shift -= OBJNODE_TREE_MAP_SHIFT;
310 return slot != NULL ? (void **)slot : NULL;
313 static void *tmem_pampd_lookup_in_obj(struct tmem_obj *obj, uint32_t index)
315 struct tmem_objnode **slot;
317 slot = (struct tmem_objnode **)__tmem_pampd_lookup_in_obj(obj, index);
318 return slot != NULL ? *slot : NULL;
321 static void *tmem_pampd_replace_in_obj(struct tmem_obj *obj, uint32_t index,
324 struct tmem_objnode **slot;
327 slot = (struct tmem_objnode **)__tmem_pampd_lookup_in_obj(obj, index);
328 if ((slot != NULL) && (*slot != NULL)) {
329 void *old_pampd = *(void **)slot;
330 *(void **)slot = new_pampd;
331 (*tmem_pamops.free)(old_pampd, obj->pool, NULL, 0);
337 static int tmem_pampd_add_to_obj(struct tmem_obj *obj, uint32_t index,
341 struct tmem_objnode *objnode = NULL, *newnode, *slot;
342 unsigned int height, shift;
345 /* if necessary, extend the tree to be higher */
346 if (index > tmem_objnode_tree_h2max[obj->objnode_tree_height]) {
347 height = obj->objnode_tree_height + 1;
348 if (index > tmem_objnode_tree_h2max[height])
349 while (index > tmem_objnode_tree_h2max[height])
351 if (obj->objnode_tree_root == NULL) {
352 obj->objnode_tree_height = height;
356 newnode = tmem_objnode_alloc(obj);
361 newnode->slots[0] = obj->objnode_tree_root;
362 newnode->slots_in_use = 1;
363 obj->objnode_tree_root = newnode;
364 obj->objnode_tree_height++;
365 } while (height > obj->objnode_tree_height);
368 slot = obj->objnode_tree_root;
369 height = obj->objnode_tree_height;
370 shift = (height-1) * OBJNODE_TREE_MAP_SHIFT;
373 /* add a child objnode. */
374 slot = tmem_objnode_alloc(obj);
381 objnode->slots[offset] = slot;
382 objnode->slots_in_use++;
384 obj->objnode_tree_root = slot;
386 /* go down a level */
387 offset = (index >> shift) & OBJNODE_TREE_MAP_MASK;
389 slot = objnode->slots[offset];
390 shift -= OBJNODE_TREE_MAP_SHIFT;
393 BUG_ON(slot != NULL);
395 objnode->slots_in_use++;
396 objnode->slots[offset] = pampd;
398 obj->objnode_tree_root = pampd;
404 static void *tmem_pampd_delete_from_obj(struct tmem_obj *obj, uint32_t index)
406 struct tmem_objnode_tree_path path[OBJNODE_TREE_MAX_PATH + 1];
407 struct tmem_objnode_tree_path *pathp = path;
408 struct tmem_objnode *slot = NULL;
409 unsigned int height, shift;
413 ASSERT_SENTINEL(obj, OBJ);
414 BUG_ON(obj->pool == NULL);
415 ASSERT_SENTINEL(obj->pool, POOL);
416 height = obj->objnode_tree_height;
417 if (index > tmem_objnode_tree_h2max[height])
419 slot = obj->objnode_tree_root;
420 if (height == 0 && obj->objnode_tree_root) {
421 obj->objnode_tree_root = NULL;
424 shift = (height - 1) * OBJNODE_TREE_MAP_SHIFT;
425 pathp->objnode = NULL;
430 offset = (index >> shift) & OBJNODE_TREE_MAP_MASK;
431 pathp->offset = offset;
432 pathp->objnode = slot;
433 slot = slot->slots[offset];
434 shift -= OBJNODE_TREE_MAP_SHIFT;
436 } while (height > 0);
439 while (pathp->objnode) {
440 pathp->objnode->slots[pathp->offset] = NULL;
441 pathp->objnode->slots_in_use--;
442 if (pathp->objnode->slots_in_use) {
443 if (pathp->objnode == obj->objnode_tree_root) {
444 while (obj->objnode_tree_height > 0 &&
445 obj->objnode_tree_root->slots_in_use == 1 &&
446 obj->objnode_tree_root->slots[0]) {
447 struct tmem_objnode *to_free =
448 obj->objnode_tree_root;
450 obj->objnode_tree_root =
452 obj->objnode_tree_height--;
453 to_free->slots[0] = NULL;
454 to_free->slots_in_use = 0;
455 tmem_objnode_free(to_free);
460 tmem_objnode_free(pathp->objnode); /* 0 slots used, free it */
463 obj->objnode_tree_height = 0;
464 obj->objnode_tree_root = NULL;
469 BUG_ON(obj->pampd_count < 0);
473 /* recursively walk the objnode_tree destroying pampds and objnodes */
474 static void tmem_objnode_node_destroy(struct tmem_obj *obj,
475 struct tmem_objnode *objnode,
482 for (i = 0; i < OBJNODE_TREE_MAP_SIZE; i++) {
483 if (objnode->slots[i]) {
486 (*tmem_pamops.free)(objnode->slots[i],
488 objnode->slots[i] = NULL;
491 tmem_objnode_node_destroy(obj, objnode->slots[i], ht-1);
492 tmem_objnode_free(objnode->slots[i]);
493 objnode->slots[i] = NULL;
498 static void tmem_pampd_destroy_all_in_obj(struct tmem_obj *obj)
500 if (obj->objnode_tree_root == NULL)
502 if (obj->objnode_tree_height == 0) {
504 (*tmem_pamops.free)(obj->objnode_tree_root, obj->pool, NULL, 0);
506 tmem_objnode_node_destroy(obj, obj->objnode_tree_root,
507 obj->objnode_tree_height);
508 tmem_objnode_free(obj->objnode_tree_root);
509 obj->objnode_tree_height = 0;
511 obj->objnode_tree_root = NULL;
512 (*tmem_pamops.free_obj)(obj->pool, obj);
516 * Tmem is operated on by a set of well-defined actions:
517 * "put", "get", "flush", "flush_object", "new pool" and "destroy pool".
518 * (The tmem ABI allows for subpages and exchanges but these operations
519 * are not included in this implementation.)
521 * These "tmem core" operations are implemented in the following functions.
525 * "Put" a page, e.g. copy a page from the kernel into newly allocated
526 * PAM space (if such space is available). Tmem_put is complicated by
527 * a corner case: What if a page with matching handle already exists in
528 * tmem? To guarantee coherency, one of two actions is necessary: Either
529 * the data for the page must be overwritten, or the page must be
530 * "flushed" so that the data is not accessible to a subsequent "get".
531 * Since these "duplicate puts" are relatively rare, this implementation
532 * always flushes for simplicity.
534 int tmem_put(struct tmem_pool *pool, struct tmem_oid *oidp, uint32_t index,
535 char *data, size_t size, bool raw, bool ephemeral)
537 struct tmem_obj *obj = NULL, *objfound = NULL, *objnew = NULL;
538 void *pampd = NULL, *pampd_del = NULL;
540 struct tmem_hashbucket *hb;
542 hb = &pool->hashbucket[tmem_oid_hash(oidp)];
543 spin_lock(&hb->lock);
544 obj = objfound = tmem_obj_find(hb, oidp);
546 pampd = tmem_pampd_lookup_in_obj(objfound, index);
548 /* if found, is a dup put, flush the old one */
549 pampd_del = tmem_pampd_delete_from_obj(obj, index);
550 BUG_ON(pampd_del != pampd);
551 (*tmem_pamops.free)(pampd, pool, oidp, index);
552 if (obj->pampd_count == 0) {
559 obj = objnew = (*tmem_hostops.obj_alloc)(pool);
560 if (unlikely(obj == NULL)) {
564 tmem_obj_init(obj, hb, pool, oidp);
567 BUG_ON(((objnew != obj) && (objfound != obj)) || (objnew == objfound));
568 pampd = (*tmem_pamops.create)(data, size, raw, ephemeral,
569 obj->pool, &obj->oid, index);
570 if (unlikely(pampd == NULL))
572 ret = tmem_pampd_add_to_obj(obj, index, pampd);
573 if (unlikely(ret == -ENOMEM))
574 /* may have partially built objnode tree ("stump") */
575 goto delete_and_free;
579 (void)tmem_pampd_delete_from_obj(obj, index);
582 (*tmem_pamops.free)(pampd, pool, NULL, 0);
584 tmem_obj_free(objnew, hb);
585 (*tmem_hostops.obj_free)(objnew, pool);
588 spin_unlock(&hb->lock);
593 * "Get" a page, e.g. if one can be found, copy the tmem page with the
594 * matching handle from PAM space to the kernel. By tmem definition,
595 * when a "get" is successful on an ephemeral page, the page is "flushed",
596 * and when a "get" is successful on a persistent page, the page is retained
597 * in tmem. Note that to preserve
598 * coherency, "get" can never be skipped if tmem contains the data.
599 * That is, if a get is done with a certain handle and fails, any
600 * subsequent "get" must also fail (unless of course there is a
601 * "put" done with the same handle).
604 int tmem_get(struct tmem_pool *pool, struct tmem_oid *oidp, uint32_t index,
605 char *data, size_t *size, bool raw, int get_and_free)
607 struct tmem_obj *obj;
609 bool ephemeral = is_ephemeral(pool);
611 struct tmem_hashbucket *hb;
612 bool free = (get_and_free == 1) || ((get_and_free == 0) && ephemeral);
613 bool lock_held = false;
615 hb = &pool->hashbucket[tmem_oid_hash(oidp)];
616 spin_lock(&hb->lock);
618 obj = tmem_obj_find(hb, oidp);
622 pampd = tmem_pampd_delete_from_obj(obj, index);
624 pampd = tmem_pampd_lookup_in_obj(obj, index);
628 if (obj->pampd_count == 0) {
629 tmem_obj_free(obj, hb);
630 (*tmem_hostops.obj_free)(obj, pool);
634 if (tmem_pamops.is_remote(pampd)) {
636 spin_unlock(&hb->lock);
639 ret = (*tmem_pamops.get_data_and_free)(
640 data, size, raw, pampd, pool, oidp, index);
642 ret = (*tmem_pamops.get_data)(
643 data, size, raw, pampd, pool, oidp, index);
649 spin_unlock(&hb->lock);
654 * If a page in tmem matches the handle, "flush" this page from tmem such
655 * that any subsequent "get" does not succeed (unless, of course, there
656 * was another "put" with the same handle).
658 int tmem_flush_page(struct tmem_pool *pool,
659 struct tmem_oid *oidp, uint32_t index)
661 struct tmem_obj *obj;
664 struct tmem_hashbucket *hb;
666 hb = &pool->hashbucket[tmem_oid_hash(oidp)];
667 spin_lock(&hb->lock);
668 obj = tmem_obj_find(hb, oidp);
671 pampd = tmem_pampd_delete_from_obj(obj, index);
674 (*tmem_pamops.free)(pampd, pool, oidp, index);
675 if (obj->pampd_count == 0) {
676 tmem_obj_free(obj, hb);
677 (*tmem_hostops.obj_free)(obj, pool);
682 spin_unlock(&hb->lock);
687 * If a page in tmem matches the handle, replace the page so that any
688 * subsequent "get" gets the new page. Returns 0 if
689 * there was a page to replace, else returns -1.
691 int tmem_replace(struct tmem_pool *pool, struct tmem_oid *oidp,
692 uint32_t index, void *new_pampd)
694 struct tmem_obj *obj;
696 struct tmem_hashbucket *hb;
698 hb = &pool->hashbucket[tmem_oid_hash(oidp)];
699 spin_lock(&hb->lock);
700 obj = tmem_obj_find(hb, oidp);
703 new_pampd = tmem_pampd_replace_in_obj(obj, index, new_pampd);
704 ret = (*tmem_pamops.replace_in_obj)(new_pampd, obj);
706 spin_unlock(&hb->lock);
711 * "Flush" all pages in tmem matching this oid.
713 int tmem_flush_object(struct tmem_pool *pool, struct tmem_oid *oidp)
715 struct tmem_obj *obj;
716 struct tmem_hashbucket *hb;
719 hb = &pool->hashbucket[tmem_oid_hash(oidp)];
720 spin_lock(&hb->lock);
721 obj = tmem_obj_find(hb, oidp);
724 tmem_pampd_destroy_all_in_obj(obj);
725 tmem_obj_free(obj, hb);
726 (*tmem_hostops.obj_free)(obj, pool);
730 spin_unlock(&hb->lock);
735 * "Flush" all pages (and tmem_objs) from this tmem_pool and disable
736 * all subsequent access to this tmem_pool.
738 int tmem_destroy_pool(struct tmem_pool *pool)
744 tmem_pool_flush(pool, 1);
750 static LIST_HEAD(tmem_global_pool_list);
753 * Create a new tmem_pool with the provided flag and return
754 * a pool id provided by the tmem host implementation.
756 void tmem_new_pool(struct tmem_pool *pool, uint32_t flags)
758 int persistent = flags & TMEM_POOL_PERSIST;
759 int shared = flags & TMEM_POOL_SHARED;
760 struct tmem_hashbucket *hb = &pool->hashbucket[0];
763 for (i = 0; i < TMEM_HASH_BUCKETS; i++, hb++) {
764 hb->obj_rb_root = RB_ROOT;
765 spin_lock_init(&hb->lock);
767 INIT_LIST_HEAD(&pool->pool_list);
768 atomic_set(&pool->obj_count, 0);
769 SET_SENTINEL(pool, POOL);
770 list_add_tail(&pool->pool_list, &tmem_global_pool_list);
771 pool->persistent = persistent;
772 pool->shared = shared;