lkml.org 
[lkml]   [2021]   [Feb]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH v16 07/11] secretmem: use PMD-size pages to amortize direct map fragmentation
    Date
    On 02.02.21 13:48, Mike Rapoport wrote:
    > On Tue, Feb 02, 2021 at 10:35:05AM +0100, Michal Hocko wrote:
    >> On Mon 01-02-21 08:56:19, James Bottomley wrote:
    >>
    >> I have also proposed potential ways out of this. Either the pool is not
    >> fixed sized and you make it a regular unevictable memory (if direct map
    >> fragmentation is not considered a major problem)
    >
    > I think that the direct map fragmentation is not a major problem, and the
    > data we have confirms it, so I'd be more than happy to entirely drop the
    > pool, allocate memory page by page and remove each page from the direct
    > map.
    >
    > Still, we cannot prove negative and it could happen that there is a
    > workload that would suffer a lot from the direct map fragmentation, so
    > having a pool of large pages upfront is better than trying to fix it
    > afterwards. As we get more confidence that the direct map fragmentation is
    > not an issue as it is common to believe we may remove the pool altogether.
    >
    > I think that using PMD_ORDER allocations for the pool with a fallback to
    > order 0 will do the job, but unfortunately I doubt we'll reach a consensus
    > about this because dogmatic beliefs are hard to shake...
    >
    > A more restrictive possibility is to still use plain PMD_ORDER allocations
    > to fill the pool, without relying on CMA. In this case there will be no
    > global secretmem specific pool to exhaust, but then it's possible to drain
    > high order free blocks in a system, so CMA has an advantage of limiting
    > secretmem pools to certain amount of memory with somewhat higher
    > probability for high order allocation to succeed.

    I am not really concerned about fragmenting/breaking up the direct map
    as long as the feature has to be explicitly enabled (similar to
    fragmenting the vmemmap).

    As already expressed, I dislike allowing user space to consume an
    unlimited number unmovable/unmigratable allocations. We already have
    that in some cases with huge pages (when the arch does not support
    migration) - but there we can at least manage the consumption using the
    whole max/reserved/free/... infrastructure. In addition, adding arch
    support for migration shouldn't be too complicated.

    The idea of using CMA is quite good IMHO, because there we can locally
    limit the direct map fragmentation and don't have to bother about
    migration at all. We own the area, so we can place as many unmovable
    allocations on it as we can fit.

    But it sounds like, we would also need some kind of reservation
    mechanism in either scenario (CMA vs. no CMA).

    If we don't want to go full-circle on max/reserved/free/..., allowing
    for migration of secretmem pages would make sense. Then, these pages
    become "less special". Map source, copy, unmap destination. The security
    implementations are the ugly part. I wonder if we could temporarily map
    somewhere else, so avoiding to touch the direct map during migration.

    --
    Thanks,

    David / dhildenb

    \
     
     \ /
      Last update: 2021-02-02 14:21    [W:4.245 / U:0.248 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site