Hi Mike, On Tue, Nov 08, 2022 at 01:27:31PM +0200, Mike Rapoport wrote: > Hi Song, > > On Mon, Nov 07, 2022 at 02:39:16PM -0800, Song Liu wrote: > > This patchset tries to address the following issues: > > > > 1. Direct map fragmentation > > > > On x86, STRICT_*_RWX requires the direct map of any RO+X memory to be also > > RO+X. These set_memory_* calls cause 1GB page table entries to be split > > into 2MB and 4kB ones. This fragmentation in direct map results in bigger > > and slower page table, and pressure for both instruction and data TLB. > > > > Our previous work in bpf_prog_pack tries to address this issue from BPF > > program side. Based on the experiments by Aaron Lu [4], bpf_prog_pack has > > greatly reduced direct map fragmentation from BPF programs. > > Usage of set_memory_* APIs with memory allocated from vmalloc/modules > virtual range does not change the direct map, but only updates the > permissions in vmalloc range. The direct map splits occur in > vm_remove_mappings() when the memory is *freed*. set_memory_nx/x() on a vmalloced range will not affect direct map but set_memory_ro/rw() will. set_memory_ro/rw() cares about other alias mappings and will do the same permission change for that alias mapping, e.g. direct mapping. For this reason, the bpf prog load can trigger a direct map split. A sample callstack on x86_64 VM looks like this: [ 40.602450] address=0xffffffffc01e2000 numpages=1 set=0x0 clr=0x2 alias=1 [ 40.614566] address=0xffff88816ee1e000 numpages=1 set=0x0 clr=0x2 alias=0 [ 40.627641] split: address=0xffff88816ee1e000, level=2 [ 40.627981] CPU: 15 PID: 534 Comm: sockex1 Not tainted 5.17.0-dirty #28 [ 40.628421] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014 [ 40.628996] Call Trace: [ 40.629161] <TASK> [ 40.629304] dump_stack_lvl+0x45/0x59 [ 40.629550] __change_page_attr_set_clr+0x718/0x8d4 [ 40.629872] ? static_protections+0x1c8/0x1fd [ 40.630160] ? dump_stack_lvl+0x54/0x59 [ 40.630418] __change_page_attr_set_clr+0x7ff/0x8d4 [ 40.630739] ? _raw_spin_unlock+0x14/0x30 [ 40.631004] ? __purge_vmap_area_lazy+0x323/0x720 [ 40.631316] ? _raw_spin_unlock_irqrestore+0x18/0x40 [ 40.631646] change_page_attr_set_clr.cold+0x2f/0x164 [ 40.631979] set_memory_ro+0x26/0x30 [ 40.632215] bpf_int_jit_compile+0x4a1/0x4e0 [ 40.632502] bpf_prog_select_runtime+0xad/0xf0 [ 40.632794] bpf_prog_load+0x6a1/0xa20 [ 40.633044] ? _raw_spin_trylock_bh+0x1/0x50 [ 40.633328] ? _raw_spin_unlock_irqrestore+0x23/0x40 [ 40.633656] ? free_debug_processing+0x1f8/0x2c0 [ 40.633964] ? __slab_free+0x2f0/0x4f0 [ 40.634214] ? trace_hardirqs_on+0x2b/0xf0 [ 40.634492] __sys_bpf+0xb20/0x2750 [ 40.634726] ? __might_fault+0x1e/0x20 [ 40.634978] __x64_sys_bpf+0x1c/0x20 [ 40.635216] do_syscall_64+0x38/0x90 [ 40.635457] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 40.635792] RIP: 0033:0x7fd4f2cacfbd [ 40.636030] Code: 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 33 ce 0e 00 f7 d8 64 89 01 48 [ 40.637253] RSP: 002b:00007ffddf20b2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 40.637752] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fd4f2cacfbd [ 40.638220] RDX: 0000000000000080 RSI: 00007ffddf20b360 RDI: 0000000000000005 [ 40.638689] RBP: 0000000000436c48 R08: 0000000000000000 R09: 0000000000000000 [ 40.639156] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000080 [ 40.639627] R13: 00007ffddf20b360 R14: 0000000000000000 R15: 0000000000000000 [ 40.640096] </TASK> Regards, Aaron
