Skip to contentSkip to conversation

VM strict overcommit

PATCH In review Robert Love 4 participants 13 messages Jul 20, 2002 – Jul 21, 2002

Subsystems (9)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 VM strict overcommit

Linus and Andrew,

The following patch implements VM strict overcommit for rmap. Strict overcommit couples address space accounting with a strict commit rule to ensure all allocated memory is backed and consequently we never OOM. All memory failures should be pushed into the allocation routines - a page access should never result in a process kill.

The new strict overcommit policies are implemented via sysctl.

This is relatively low-impact on other code and does not change the behavior of the system in the default overcommit policy. Rik has given his approval.

This is based on Alan Cox's work in 2.4-ac with some cleanup and a new overcommit mode for swapless machines. Hugh Dickins also contributed some fixes for shmfs.

Patch is against 2.5.27, please apply.

Robert Love

Documentation/sysctl/vm.txt +5 -1
diff -urN linux-2.5.27/Documentation/sysctl/vm.txt linux/Documentation/sysctl/vm.txt
@@ -78,7 +78,11 @@
 programs that malloc() huge amounts of memory "just-in-case"
 and don't use much of it.
 
-Look at: mm/mmap.c::vm_enough_memory() for more information.
+Flag values of 2 - 4 introduce a new "strict overcommit"
+policy that attempt to prevent any overcommit of memory.
+
+See Documentation/vm/overcommit-accounting and
+mm/mmap.c::vm_enough_memory() for more information.
 
 ==============================================================
 
Documentation/vm/overcommit-accounting +77 -0

77 lines not on this page · raw message

fs/exec.c +7 -2
diff -urN linux-2.5.27/fs/exec.c linux/fs/exec.c
@@ -313,8 +313,13 @@
 
 	mpnt = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
 	if (!mpnt) 
-		return -ENOMEM; 
-	
+		return -ENOMEM;
+
+	if (!vm_enough_memory((STACK_TOP - (PAGE_MASK & (unsigned long) bprm->p))>>PAGE_SHIFT)) {
+		kmem_cache_free(vm_area_cachep, mpnt);
+		return -ENOMEM;
+	}
+
 	down_write(&current->mm->mmap_sem);
 	{
 		mpnt->vm_mm = current->mm;
fs/proc/proc_misc.c +6 -1
diff -urN linux-2.5.27/fs/proc/proc_misc.c linux/fs/proc/proc_misc.c
@@ -126,11 +126,13 @@
 	return proc_calc_metrics(page, start, off, count, eof, len);
 }
 
+extern atomic_t vm_committed_space;
+
 static int meminfo_read_proc(char *page, char **start, off_t off,
 				 int count, int *eof, void *data)
 {
 	struct sysinfo i;
-	int len;
+	int len, committed;
 	struct page_state ps;
 
 	get_page_state(&ps);
@@ -140,6 +142,7 @@
 #define K(x) ((x) << (PAGE_SHIFT - 10))
 	si_meminfo(&i);
 	si_swapinfo(&i);
+	committed = atomic_read(&vm_committed_space);
 
 	/*
 	 * Tagged format, for easy grepping and expansion.
@@ -160,6 +163,7 @@
 		"SwapFree:     %8lu kB\n"
 		"Dirty:        %8lu kB\n"
 		"Writeback:    %8lu kB\n"
+		"Committed_AS: %8u kB\n"
 		"PageTables:   %8lu kB\n"
 		"PteChainTot:  %8lu kB\n"
 		"PteChainUsed: %8lu kB\n",
@@ -178,6 +182,7 @@
 		K(i.freeswap),
 		K(ps.nr_dirty),
 		K(ps.nr_writeback),
+		K(committed),
 		K(ps.nr_page_table_pages),
 		K(ps.nr_pte_chain_pages),
 		ps.used_pte_chains_bytes >> 10
include/linux/mm.h +5 -27
diff -urN linux-2.5.27/include/linux/mm.h linux/include/linux/mm.h
@@ -103,8 +103,9 @@
 #define VM_DONTCOPY	0x00020000      /* Do not copy this vma on fork */
 #define VM_DONTEXPAND	0x00040000	/* Cannot expand with mremap() */
 #define VM_RESERVED	0x00080000	/* Don't unmap it from swap_out */
+#define VM_ACCOUNT	0x00100000	/* Is a VM accounted object */
 
-#define VM_STACK_FLAGS	(0x00000100 | VM_DATA_DEFAULT_FLAGS)
+#define VM_STACK_FLAGS	(0x00000100 | VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT)
 
 #define VM_READHINTMASK			(VM_SEQ_READ | VM_RAND_READ)
 #define VM_ClearReadHint(v)		(v)->vm_flags &= ~VM_READHINTMASK
@@ -430,7 +431,7 @@
 	return ret;
 }
 
-extern int do_munmap(struct mm_struct *, unsigned long, size_t);
+extern int do_munmap(struct mm_struct *, unsigned long, size_t, int);
 
 extern unsigned long do_brk(unsigned long, unsigned long);
 
@@ -472,31 +473,8 @@
 void page_cache_readaround(struct file *file, unsigned long offset);
 void handle_ra_miss(struct file *file);
 
-/* vma is the first one with  address < vma->vm_end,
- * and even  address < vma->vm_start. Have to extend vma. */
-static inline int expand_stack(struct vm_area_struct * vma, unsigned long address)
-{
-	unsigned long grow;
-
-	/*
-	 * vma->vm_start/vm_end cannot change under us because the caller is required
-	 * to hold the mmap_sem in write mode. We need to get the spinlock only
-	 * before relocating the vma range ourself.
-	 */
-	address &= PAGE_MASK;
-	grow = (vma->vm_start - address) >> PAGE_SHIFT;
-	if (vma->vm_end - address > current->rlim[RLIMIT_STACK].rlim_cur ||
-	    ((vma->vm_mm->total_vm + grow) << PAGE_SHIFT) > current->rlim[RLIMIT_AS].rlim_cur)
-		return -ENOMEM;
-	spin_lock(&vma->vm_mm->page_table_lock);
-	vma->vm_start = address;
-	vma->vm_pgoff -= grow;
-	vma->vm_mm->total_vm += grow;
-	if (vma->vm_flags & VM_LOCKED)
-		vma->vm_mm->locked_vm += grow;
-	spin_unlock(&vma->vm_mm->page_table_lock);
-	return 0;
-}
+/* Do stack extension */
+extern int expand_stack(struct vm_area_struct * vma, unsigned long address);
 
 /* Look up the first VMA which satisfies  addr < vm_end,  NULL if none. */
 extern struct vm_area_struct * find_vma(struct mm_struct * mm, unsigned long addr);
include/linux/mman.h +3 -0
diff -urN linux-2.5.27/include/linux/mman.h linux/include/linux/mman.h
@@ -6,4 +6,7 @@
 #define MREMAP_MAYMOVE	1
 #define MREMAP_FIXED	2
 
+extern int vm_enough_memory(long pages);
+extern void vm_unacct_memory(long pages);
+
 #endif /* _LINUX_MMAN_H */
ipc/shm.c +1 -1
diff -urN linux-2.5.27/ipc/shm.c linux/ipc/shm.c
@@ -670,7 +670,7 @@
 		shmdnext = shmd->vm_next;
 		if (shmd->vm_ops == &shm_vm_ops
 		    && shmd->vm_start - (shmd->vm_pgoff << PAGE_SHIFT) == (ulong) shmaddr) {
-			do_munmap(mm, shmd->vm_start, shmd->vm_end - shmd->vm_start);
+			do_munmap(mm, shmd->vm_start, shmd->vm_end - shmd->vm_start, 1);
 			retval = 0;
 		}
 	}
kernel/fork.c +17 -1
diff -urN linux-2.5.27/kernel/fork.c linux/kernel/fork.c
@@ -23,6 +23,7 @@
 #include <linux/personality.h>
 #include <linux/file.h>
 #include <linux/binfmts.h>
+#include <linux/mman.h>
 #include <linux/fs.h>
 #include <linux/security.h>
 
@@ -181,6 +182,7 @@
 {
 	struct vm_area_struct * mpnt, *tmp, **pprev;
 	int retval;
+	unsigned long charge = 0;
 
 	flush_cache_mm(current->mm);
 	mm->locked_vm = 0;
@@ -208,6 +210,17 @@
 		retval = -ENOMEM;
 		if(mpnt->vm_flags & VM_DONTCOPY)
 			continue;
+
+		/*
+		 * FIXME: shared writable map accounting should be one off
+		 */
+		if (mpnt->vm_flags & VM_ACCOUNT) {
+			unsigned int len = (mpnt->vm_end - mpnt->vm_start) >> PAGE_SHIFT;
+			if (!vm_enough_memory(len))
+				goto fail_nomem;
+			charge += len;
+		}
+
 		tmp = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);
 		if (!tmp)
 			goto fail_nomem;
@@ -248,9 +261,12 @@
 	retval = 0;
 	build_mmap_rb(mm);
 
-fail_nomem:
+out:
 	flush_tlb_mm(current->mm);
 	return retval;
+fail_nomem:
+	vm_unacct_memory(charge);
+	goto out;
 }
 
 spinlock_t mmlist_lock __cacheline_aligned_in_smp = SPIN_LOCK_UNLOCKED;
mm/mmap.c +166 -59

369 lines not on this page · raw message

mm/mprotect.c +15 -2
diff -urN linux-2.5.27/mm/mprotect.c linux/mm/mprotect.c
@@ -1,7 +1,10 @@
 /*
- *	linux/mm/mprotect.c
+ *  mm/mprotect.c
  *
  *  (C) Copyright 1994 Linus Torvalds
+ *
+ *  Address space accounting code	<[email protected]>
+ *  (C) Copyright 2002 Red Hat Inc, All Rights Reserved
  */
 #include <linux/mm.h>
 #include <linux/slab.h>
@@ -247,6 +250,7 @@
 {
 	pgprot_t newprot;
 	int error;
+	unsigned long charged = 0;
 
 	if (newflags == vma->vm_flags) {
 		*pprev = vma;
@@ -263,9 +267,18 @@
 	else
 		error = mprotect_fixup_middle(vma, pprev, start, end, newflags, newprot);
 
-	if (error)
+	if (error) {
+		if (newflags & PROT_WRITE)
+			vm_unacct_memory(charged);
 		return error;
+	}
 
+	/*
+	 * Delayed accounting for reduction of memory use - done last to
+	 * avoid allocation races
+	 */
+	if (charged && !(newflags & PROT_WRITE))
+		vm_unacct_memory(charged);
 	change_protection(vma, start, end, newprot);
 	return 0;
 }
mm/mremap.c +26 -11
diff -urN linux-2.5.27/mm/mremap.c linux/mm/mremap.c
@@ -1,7 +1,10 @@
 /*
- *	linux/mm/remap.c
+ *	mm/remap.c
  *
  *	(C) Copyright 1996 Linus Torvalds
+ *
+ *	Address space accounting code	<[email protected]>
+ *	(C) Copyright 2002 Red Hat Inc, All Rights Reserved
  */
 
 #include <linux/mm.h>
@@ -18,8 +21,6 @@
 #include <asm/cacheflush.h>
 #include <asm/tlbflush.h>
 
-extern int vm_enough_memory(long pages);
-
 static inline pte_t *get_one_pte_map_nested(struct mm_struct *mm, unsigned long addr)
 {
 	pgd_t * pgd;
@@ -209,7 +210,11 @@
 				new_vma->vm_ops->open(new_vma);
 			insert_vm_struct(current->mm, new_vma);
 		}
-		do_munmap(current->mm, addr, old_len);
+		/*
+		 * The old VMA has been accounted for,
+		 * don't double account
+		 */
+		do_munmap(current->mm, addr, old_len, 0);
 		current->mm->total_vm += new_len >> PAGE_SHIFT;
 		if (new_vma->vm_flags & VM_LOCKED) {
 			current->mm->locked_vm += new_len >> PAGE_SHIFT;
@@ -224,6 +229,8 @@
 	return -ENOMEM;
 }
 
+extern int sysctl_overcommit_memory;	/* FIXME!! */
+
 /*
  * Expand (or shrink) an existing mapping, potentially moving it at the
  * same time (controlled by the MREMAP_MAYMOVE flag and available VM space)
@@ -237,6 +244,7 @@
 {
 	struct vm_area_struct *vma;
 	unsigned long ret = -EINVAL;
+	unsigned long charged = 0;
 
 	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
 		goto out;
@@ -266,16 +274,17 @@
 		if ((addr <= new_addr) && (addr+old_len) > new_addr)
 			goto out;
 
-		do_munmap(current->mm, new_addr, new_len);
+		do_munmap(current->mm, new_addr, new_len, 1);
 	}
 
 	/*
 	 * Always allow a shrinking remap: that just unmaps
 	 * the unnecessary pages..
+	 * do_munmap does all the needed commit accounting
 	 */
 	ret = addr;
 	if (old_len >= new_len) {
-		do_munmap(current->mm, addr+new_len, old_len - new_len);
+		do_munmap(current->mm, addr+new_len, old_len - new_len, 1);
 		if (!(flags & MREMAP_FIXED) || (new_addr == addr))
 			goto out;
 	}
@@ -305,11 +314,14 @@
 	if ((current->mm->total_vm << PAGE_SHIFT) + (new_len - old_len)
 	    > current->rlim[RLIMIT_AS].rlim_cur)
 		goto out;
-	/* Private writable mapping? Check memory availability.. */
-	if ((vma->vm_flags & (VM_SHARED | VM_WRITE)) == VM_WRITE &&
-	    !(flags & MAP_NORESERVE)				 &&
-	    !vm_enough_memory((new_len - old_len) >> PAGE_SHIFT))
-		goto out;
+
+	if (sysctl_overcommit_memory > 1)
+		flags &= ~MAP_NORESERVE;
+	if (vma->vm_flags & VM_ACCOUNT) {
+		charged = (new_len - old_len) >> PAGE_SHIFT;
+		if (!vm_enough_memory(charged))
+			goto out_nc;
+	}
 
 	/* old_len exactly to the end of the area..
 	 * And we're not relocating the area.
@@ -356,6 +368,9 @@
 		ret = move_vma(vma, addr, old_len, new_len, new_addr);
 	}
 out:
+	if (ret & ~PAGE_MASK)
+		vm_unacct_memory(charged);
+out_nc:
 	return ret;
 }
 
mm/shmem.c +71 -16

203 lines not on this page · raw message

#1 lore raw

wapless strict overcommit. The total address space

Documentation/vm/overcommit-accounting line 13

Quoted 2 lines
Documentation/vm/overcommit-accounting +2 -0
+		commit for the system is not permitted to exceed 95% of
+		free memory. This mode utilizes the new stricter accounting

Robert. If you are going to submit changes based on my code please understand the code first. Your changes are bogus. Think about PTE table overhead. Go do some simulation runs on a 2Gb box running Oracle.

The original code implements modes where the overcommit rules are

0. Heuristic

1. Never refuse

2. Never overcommit above swap for anonymous pages

3. Overcommit on the basis the kernel will never use > 50% of RAM

Your 95% mode is pure crap. I tried various values and I can assure you that your code will fail dismally to do anything useful unless you are below 65% when running Oracle for example.

I took the time to *measure* this stuff and test it in real world setups. Please don't randomly frob with it unless you are going to repeat the oracle test sets.

Linus can you either drop this patch out or take the original version. These changes will simply confuse people into thinking they have the feature when they do not.

#2 lore raw
Quoted 3 lines · Alan Cox

Your 95% mode is pure crap. I tried various values and I can assure you that your code will fail dismally to do anything useful unless you are below 65% when running Oracle for example.

Relax Alan. Nothing is set in stone and we need to pick some number to start playing with.

My test suite was _not_ Oracle (and who would run Oracle on a swapless machine?) and I was not able to OOM the machine with my tests. I in no way contend 95% is perfect. Even your 50% mode is not (nothing but solely backing store can make any guarantees).

But "works for me" is a start and we can work on tuning it. No "swapless" mode will be perfect and while 65% may work for, another load with gross overhead may need more room.

I sent you an email and told you I was doing this and asked your opinion on a percentage. Why are you picking on me now?

Robert Love

#3 lore raw
Quoted 6 lines · Robert Love

But "works for me" is a start and we can work on tuning it. No "swapless" mode will be perfect and while 65% may work for, another load with gross overhead may need more room.

I sent you an email and told you I was doing this and asked your opinion on a percentage. Why are you picking on me now?

When did you send me mail - I certainly never saw it.

In terms of percentages I measured real world workloads. Its easy to fail at apparently low values because the kernel has no kernel resource management (beancounter never got merged) and because a process can consume substantial real resources that are not its own address space (page tables, kernel structures, file buffers and so forth)

Its also important to remember that executable pages are mapped read-only and thus free. This means that the magic 50 value works on a swapless ipaq in real use just as well as it does on a giant server.

If its actually a serious concern, eg for some of the weirder embedded stuff you guys run at Montavista then I'd suggest changing it to have three modes

0 and 1 as before

2 - some percentage of memory (default 50), and expose the percentage setting by sysctl too.

That allows people to experiment, handles weird cases and deals with the problem.

BTW: The oracle tests were not swapless, they were on a system with lots of swap. The kernel overhead in some cases is just plain scary as I suspect the IBM folks who have been working on large oracle setups can testify..

#4 lore raw
Quoted 4 lines · Alan Cox
Quoted 2 lines

I sent you an email and told you I was doing this and asked your opinion on a percentage. Why are you picking on me now?

When did you send me mail - I certainly never saw it.

Ok I take that back. It merely never got as far into my brain as to stay stuck.

Lets go with a sysctl tuned value and see what the 2.5 world finds the best numbers to be ?

#5 lore raw
Quoted 2 lines · Alan Cox

Ok I take that back. It merely never got as far into my brain as to stay stuck.

No problem.

Quoted 2 lines

Lets go with a sysctl tuned value and see what the 2.5 world finds the best numbers to be ?

Great idea. This allows pedants with swap to use 0, others to use 50, and those without swap to pick whatever works for them (e.g. 65% as you suggest).

Robert Love

#6 lore raw
Quoted 7 lines · Robert Love

No problem.

Quoted 2 lines

Lets go with a sysctl tuned value and see what the 2.5 world finds the best numbers to be ?

Great idea. This allows pedants with swap to use 0, others to use 50, and those without swap to pick whatever works for them (e.g. 65% as you

On a swapless box you are unlikely to ever achieve 65% used by anonymous pages in real world applications. Its suprising how much of memory is file backed when you actually try it out. One exception in the future might be a system with extensive amounts of XIP, where very little of the binaries is actually pulled into RAM and thus counted into the figures.

#7 lore raw
In reply to Alan Cox
Quoted 1 line · Alan Cox

When did you send me mail - I certainly never saw it.

I can forward you the email if you like. Same goes for your reply :)

Quoted 11 lines

If its actually a serious concern, eg for some of the weirder embedded stuff you guys run at Montavista then I'd suggest changing it to have three modes

0 and 1 as before

2 - some percentage of memory (default 50), and expose the percentage setting by sysctl too.

That allows people to experiment, handles weird cases and deals with the problem.

This is the way to go -- we should do this. Good idea.

Robert Love

#8 lore raw
In reply to Robert Love

mm/mremap.c line 7

Quoted 12 lines

diff -urN linux-2.5.27/mm/mremap.c linux/mm/mremap.c

mm/mremap.c +4 -1
@@ -1,7 +1,10 @@
 /*
- *	linux/mm/remap.c
+ *	mm/remap.c
  *
  *	(C) Copyright 1996 Linus Torvalds
+ *
+ *	Address space accounting code	<[email protected]>
+ *	(C) Copyright 2002 Red Hat Inc, All Rights Reserved

Second item, which may well not have been obvious from the original. The change on the mm/*.c headers for the files changes to include the GPL statement is part of my patch. The code submissions by Red Hat are GPL and the no warranty clauses are applicable. When you resubmit them please include the correct GPL headers I added, or a written guarantee that you will personally take liability for all defects, errors and so on. Also since you changed the code please credit yourself too.

The GPL no warranty clauses were added directly to the file because they are suppsed to be there.

#9 lore raw
Quoted 3 lines · Alan Cox

The GPL no warranty clauses were added directly to the file because they are suppsed to be there.

That's a load of bull. They are _NOT_ supposed to be there.

If you want legal disclaimers etc, do them in files you created and you own 100%, not in places that others started and work on. Or put them to the bottom of the file where they aren't in the way. Or add a "read teh GPL in the COPYING file", but don't start adding a ton of crap to core kernel files.

There is no "goodness" in being a lawyer in .c files.

Linus

#10 lore raw
Quoted 5 lines

If you want legal disclaimers etc, do them in files you created and you own 100%, not in places that others started and work on. Or put them to the bottom of the file where they aren't in the way. Or add a "read teh GPL in the COPYING file", but don't start adding a ton of crap to core kernel files.

Thats fine be me too. I just grabbed the usual boilerplate but see COPYING is just fine

#11 lore raw
Quoted 3 lines · Alan Cox

Thats fine be me too. I just grabbed the usual boilerplate but see COPYING is just fine

Good. I hate the fact that so many people seem to think that adding 15 lines of copyright notice to a file somehow makes it "more legal". All it does is to give some corporate lawyer a bone, and take up precious real-estate on the first thing you see when you open the file that could be used to actually say what the file does (and who has worked on it).

Slightly off-topic, but in the same vein: I also dislike having tons of changelogs that relate to matters that aren't relevant to the sources any more (because the changes _changed_ them, duh!). The changelogs are valid as a way to show who worked on what, of course, but some people seem to take them to be the beginning of their Great Novel.

I'm hoping that one of the things BK does is to make people less inclined to write change stories in the C files, and more inclined to explain them to me in email when they send the changes in. At which point they are there in a format where you can actually see the "before and after" picture, not just get a feeling that "it looked different before" - well, DUH!

Linus

#12 lore raw
Quoted 5 lines · Linus Torvalds

Good. I hate the fact that so many people seem to think that adding 15 lines of copyright notice to a file somehow makes it "more legal". All it does is to give some corporate lawyer a bone, and take up precious real-estate on the first thing you see when you open the file that could be used to actually say what the file does (and who has worked on it).

On a related note, it would be nice if files had a one- (or two-)line description near the top saying what the code in this file is supposed to do.

That should cut down on the time people spend searching the kernel for code and maybe even reduce code duplication...

Would a series of small documentation patches adding small descriptions to the top of files be welcome ?

regards,

Rik

Signature · 3 lines
Bravely reimplemented by the knights who say "NIH".

http://www.surriel.com/		http://distro.conectiva.com/