UBC: user resource beancounters

The following patch set presents base of User Resource Beancounters (UBC).
UBC allows to account and control consumption of kernel resources used by group of processes.

The full UBC patch set allows to control:
- kernel memory. All the kernel objects allocatable on user demand should be accounted and limited for DoS protection.
E.g. page tables, task structs, vmas etc.

- virtual memory pages. UBC allows to limit a container to some amount of memory and introduces 2-level OOM killer taking into account container's consumption.
pages shared between containers are correctly charged as fractions (tunable).

- network buffers. These includes TCP/IP rcv/snd buffers, dgram snd buffers, unix, netlinks and other buffers.

- minor resources accounted/limited by number:
tasks, files, flocks, ptys, siginfo, pinned dcache mem, sockets, iptentries (for containers with virtualized networking)

As the first step we want to propose for discussion the most complicated parts of resource management:
kernel memory and virtual memory.
The patch set to be sent provides core for UBC and management of kernel memory only. Virtual memory management will be sent in a couple of days.

The patches in these series are:
diff-ubc-kconfig.patch:
Adds kernel/ub/Kconfig file with UBC options and includes it into arch Kconfigs

diff-ubc-core.patch:
Contains core functionality and interfaces of UBC:
find/create beancounter, initialization, charge/uncharge of resource, core objects' declarations.

diff-ubc-task.patch:
Contains code responsible for setting UB on task, it's inheriting and setting host context in interrupts.

Task contains three beancounters:
1. exec_ub - current context. all resources are charged to this beancounter.
2. task_ub - beancounter to which task_struct is charged itself.
3. fork_sub - beancounter which is inherited by task's children on fork

diff-ubc-syscalls.patch:
Patch adds system calls for UB management:
1. sys_getluid - get current UB id
2. sys_setluid - changes exec_ and fork_ UBs on current
3. sys_setublimit - set limits for resources consumtions

diff-ubc-kmem-core.patch:
Introduces UB_KMEMSIZE resource which accounts kernel objects allocated by task's request.

Objects are accounted via struct page and slab objects. For the latter ones each slab contains a set of pointers corresponding object is charged to.

Allocation charge rules:
1. Pages - if allocation is performed with __GFP_UBC flag - page is charged to current's exec_ub.
2. Slabs - kmem_cache may be created with SLAB_UBC flag - in this case each allocation is charged. Caches used by kmalloc are created with SLAB_UBC | SLAB_UBC_NOCHARGE flags. In this case only __GFP_UBC allocations are charged.

diff-ubc-kmem-charge.patch:
Adds SLAB_UBC and __GFP_UBC flags in appropriate places to cause charging/limiting of specified resources.

diff-ubc-proc.patch:
Adds two proc entries user_beancounters and user_beancounters_sub allowing to see current state (usage/limits/fails for each UB). Implemented via seq files.

Patch set is applicable to 2.6.18-rc4-mm1

Thanks,
Kirill

Add kernel/ub/Kconfig file with UBC options and
includes it into arch Kconfigs

---

arch/i386/Kconfig    |    2 ++
arch/ia64/Kconfig    |    2 ++
arch/powerpc/Kconfig |    2 ++
arch/ppc/Kconfig     |    2 ++
arch/sparc/Kconfig   |    2 ++
arch/sparc64/Kconfig |    2 ++
arch/x86_64/Kconfig  |    2 ++
kernel/ub/Kconfig    |   25 +++++++++++++++++++++++++
8 files changed, 39 insertions(+)

@@ -1146,6 +1146,8 @@ source "crypto/Kconfig"
 

source "lib/Kconfig"

+source "kernel/ub/Kconfig"
+
#
# Use the generic interrupt handling code in kernel/irq/:
#

@@ -481,6 +481,8 @@ source "fs/Kconfig"
 

source "lib/Kconfig"

+source "kernel/ub/Kconfig"
+
#
# Use the generic interrupt handling code in kernel/irq/:
#

@@ -1038,6 +1038,8 @@ source "arch/powerpc/platforms/iseries/K
 

source "lib/Kconfig"

+source "ub/Kconfig"
+
menu "Instrumentation Support"
depends on EXPERIMENTAL

@@ -1414,6 +1414,8 @@ endmenu
 

source "lib/Kconfig"

+source "ub/Kconfig"
+
source "arch/powerpc/oprofile/Kconfig"

source "arch/ppc/Kconfig.debug"

@@ -296,3 +296,5 @@ source "security/Kconfig"

source "crypto/Kconfig"

source "lib/Kconfig"
+
+source "ub/Kconfig"

@@ -432,3 +432,5 @@ source "security/Kconfig"

source "crypto/Kconfig"

source "lib/Kconfig"
+
+source "lib/Kconfig"

@@ -655,3 +655,5 @@ source "security/Kconfig"

source "crypto/Kconfig"

source "lib/Kconfig"
+
+source "kernel/ub/Kconfig"

@@ -0,0 +1,25 @@
+#
+# User resources part (UBC)
+#
+# Copyright (C) 2006 OpenVZ. SWsoft Inc
+
+menu "User resources"
+
+config USER_RESOURCE
+	bool "Enable user resource accounting"
+	default y
+	help +          This patch provides accounting and allows to configure
+          limits for user's consumption of exhaustible system resources.
+          The most important resource controlled by this patch is unswappable +          memory (either mlock'ed or used by internal kernel structures and +          buffers). The main goal of this patch is to protect processes
+          from running short of important resources because of an accidental
+          misbehavior of processes or malicious activity aiming to ``kill'' +          the system. It's worth to mention that resource limits configured +          by setrlimit(2) do not give an acceptable level of protection +          because they cover only small fraction of resources and work on a +          per-process basis.  Per-process accounting doesn't prevent malicious
+          users from spawning a lot of resource-consuming processes.
+
+endmenu

Core functionality and interfaces of UBC:
find/create beancounter, initialization, charge/uncharge of resource, core objects' declarations.

Basic structures:
ubparm - resource description
user_beancounter - set of resources, id, lock

---

include/ub/beancounter.h |  157 ++++++++++++++++++
init/main.c              |    4
kernel/Makefile          |    1
kernel/ub/Makefile       |    7
kernel/ub/beancounter.c  |  398 +++++++++++++++++++++++++++++++++++++++++++++++
5 files changed, 567 insertions(+)

@@ -0,0 +1,157 @@
+/*
+ *  include/ub/beancounter.h
+ *
+ *  Copyright (C) 2006 OpenVZ. SWsoft Inc
+ *
+ */
+
+#ifndef _LINUX_BEANCOUNTER_H
+#define _LINUX_BEANCOUNTER_H
+
+/*
+ *	Resource list.
+ */
+
+#define UB_RESOURCES	0
+
+struct ubparm {
+	/*
+	 * A barrier over which resource allocations are failed gracefully.
+	 * e.g. if the amount of consumed memory is over the barrier further
+	 * sbrk() or mmap() calls fail, the existing processes are not killed.
+	 */
+	unsigned long	barrier;
+	/* hard resource limit */
+	unsigned long	limit;
+	/* consumed resources */
+	unsigned long	held;
+	/* maximum amount of consumed resources through the last period */
+	unsigned long	maxheld;
+	/* minimum amount of consumed resources through the last period */
+	unsigned long	minheld;
+	/* count of failed charges */
+	unsigned long	failcnt;
+};
+
+/*
+ * Kernel internal part.
+ */
+
+#ifdef __KERNEL__
+
+#include <linux/config.h>
+#include <linux/spinlock.h>
+#include <linux/list.h>
+#include <asm/atomic.h>
+
+/*
+ * UB_MAXVALUE is essentially LONG_MAX declared in a cross-compiling safe form.
+ */
+#define UB_MAXVALUE	( (1UL << (sizeof(unsigned long)*8-1)) - 1)
+
+
+/*
+ *	Resource management structures
+ * Serialization issues:
+ *   beancounter list management is protected via ub_hash_lock
+ *   task pointers are set only for current task and only once
+ *   refcount is managed atomically
+ *   value and limit comparison and change are protected by per-ub spinlock
+ */
+
+struct user_beancounter
+{
+	atomic_t		ub_refcount;
+	spinlock_t		ub_lock;
+	uid_t			ub_uid;
+	struct hlist_node	hash;
+
+	struct user_beancounter	*parent;
+	void			*private_data;
+
+	/* resources statistics and settings */
+	struct ubparm		ub_parms[UB_RESOURCES];
+};
+
+enum severity { UB_BARRIER, UB_LIMIT, UB_FORCE };
+
+/* Flags passed to beancounter_findcreate() */
+#define UB_LOOKUP_SUB		0x01 /* Lookup subbeancounter */
+#define UB_ALLOC		0x02 /* May allocate new one */
+#define UB_ALLOC_ATOMIC		0x04 /* Allocate with GFP_ATOMIC */
+
+#define UB_HASH_SIZE		256
+
+#ifdef CONFIG_USER_RESOURCE
+extern struct hlist_head ub_hash[];
+extern spinlock_t ub_hash_lock;
+
+static inline void ub_adjust_held_minmax(struct user_beancounter *ub,
+		int resource)
+{
+	if (ub->ub_parms[resource].maxheld < ub->ub_parms[resource].held)
+		ub->ub_parms[resource].maxheld = ub->ub_parms[resource].held;
+	if (ub->ub_parms[resource].minheld > ub->ub_parms[resource].held)
+		ub->ub_parms[resource].minheld = ub->ub_parms[resource].held;
+}
+
+void ub_print_resource_warning(struct user_beancounter *ub, int res,
+		char *str, unsigned long val, unsigned long held);
+void ub_print_uid(struct user_beancounter *ub, char *str, int size);
+
+int  __charge_beancounter_locked(struct user_beancounter *ub,
+		int resource, unsigned long val, enum severity strict);
+void charge_beancounter_notop(struct user_beancounter *ub,
+		int resource, unsigned long val);
+int  charge_beancounter(struct user_beancounter *ub,
+		int resource, unsigned long val, enum severity strict);
+
+void __uncharge_beancounter_locked(struct user_beancounter *ub,
+		int resource, unsigned long val);
+void uncharge_beancounter_notop(struct user_beancounter *ub,
+		int resource, unsigned long val);
+void uncharge_beancounter(struct user_beancounter *ub,
+		int resource, unsigned long val);
+
+struct user_beancounter *beancounter_findcreate(uid_t uid,
+		struct user_beancounter *parent, int flags);
+
+static inline struct user_beancounter *get_beancounter(
+		struct user_beancounter *ub)
+{
+	atomic_inc(&ub->ub_refcount);
+	return ub;
+}
+
+void __put_beancounter(struct user_beancounter *ub);
+static inline void put_beancounter(struct user_beancounter *ub)
+{
+	__put_beancounter(ub);
+}
+
+void ub_init_early(void);
+void ub_init_late(void);
+void ub_init_proc(void);
+
+extern struct user_beancounter ub0;
+extern const char *ub_rnames[];
+
+#else /* CONFIG_USER_RESOURCE */
+
+#define beancounter_findcreate(id, p, f)		(NULL)
+#define get_beancounter(ub)				(NULL)
+#define put_beancounter(ub)				do { } while (0)
+#define __charge_beancounter_locked(ub, r, v, s)	(0)
+#define charge_beancounter(ub, r, v, s)			(0)
+#define charge_beancounter_notop(ub, r, v)		do { } while (0)
+#define __uncharge_beancounter_locked(ub, r, v)		do { } while (0)
+#define uncharge_beancounter(ub, r, v)			do { } while (0)
+#define uncharge_beancounter_notop(ub, r, v)		do { } while (0)
+#define ub_init_early()					do { } while (0)
+#define ub_init_late()					do { } while (0)
+#define ub_init_proc()					do { } while (0)
+
+#endif /* CONFIG_USER_RESOURCE */
+#endif /* __KERNEL__ */
+
+#endif /* _LINUX_BEANCOUNTER_H */

@@ -52,6 +52,8 @@

#include <linux/debug_locks.h>
#include <linux/lockdep.h>

+#include <ub/beancounter.h>
+
#include <asm/io.h>
#include <asm/bugs.h>
#include <asm/setup.h>
@@ -470,6 +472,7 @@ asmlinkage void __init start_kernel(void

	early_boot_irqs_off();
	early_init_irq_lock_class();

+ ub_init_early();
/*
* Interrupts are still disabled. Do necessary setups, then
* enable them
@@ -563,6 +566,7 @@ asmlinkage void __init start_kernel(void

#endif
	fork_init(num_physpages);
	proc_caches_init();
+	ub_init_late();
	buffer_init();
	unnamed_dev_init();
	key_init();

@@ -12,6 +12,7 @@ obj-y     = sched.o fork.o exec_domain.o
 

obj-$(CONFIG_STACKTRACE) += stacktrace.o
obj-y += time/
+obj-y += ub/
obj-$(CONFIG_DEBUG_MUTEXES) += mutex-debug.o
obj-$(CONFIG_LOCKDEP) += lockdep.o
ifeq ($(CONFIG_PROC_FS),y)

@@ -0,0 +1,7 @@
+#
+# User resources part (UBC)
+#
+# Copyright (C) 2006 OpenVZ. SWsoft Inc
+#
+
+obj-$(CONFIG_USER_RESOURCE) += beancounter.o

Contains code responsible for setting UB on task, it's inheriting and setting host context in interrupts.

Task references three beancounters:
1. exec_ub current context. all resources are
charged to this beancounter.
2. task_ub beancounter to which task_struct is
charged itself.
3. fork_sub beancounter which is inherited by
task's children on fork

---

include/linux/sched.h   |    5 +++++
include/ub/task.h       |   42 ++++++++++++++++++++++++++++++++++++++++++
kernel/fork.c           |   21 ++++++++++++++++-----
kernel/irq/handle.c     |    9 +++++++++
kernel/softirq.c        |    8 ++++++++
kernel/ub/Makefile      |    1 +
kernel/ub/beancounter.c |    4 ++++
kernel/ub/misc.c        |   34 ++++++++++++++++++++++++++++++++++
8 files changed, 119 insertions(+), 5 deletions(-)

@@ -81,6 +81,8 @@ struct sched_param {

#include <linux/timer.h>
#include <linux/hrtimer.h>

+#include <ub/task.h>
+
#include <asm/processor.h>

struct exec_domain;

@@ -997,6 +999,9 @@ struct task_struct {
	spinlock_t delays_lock;
	struct task_delay_info *delays;

#endif
+#ifdef CONFIG_USER_RESOURCE
+ struct task_beancounter task_bc;
+#endif
};

static inline pid_t process_group(struct task_struct *tsk)

@@ -16,6 +16,9 @@

#include <linux/interrupt.h>
#include <linux/kernel_stat.h>

+#include <ub/beancounter.h>
+#include <ub/task.h>
+
#include "internals.h"

/**
@@ -166,6 +169,9 @@ fastcall unsigned int __do_IRQ(unsigned

	struct irq_desc *desc = irq_desc + irq;
	struct irqaction *action;
	unsigned int status;

+ struct user_beancounter *ub;
+
+ ub = set_exec_ub(&ub0);

	kstat_this_cpu.irqs[irq]++;
	if (CHECK_IRQ_PER_CPU(desc->status)) {
@@ -178,6 +184,8 @@ fastcall unsigned int __do_IRQ(unsigned 
			desc->chip->ack(irq);
		action_ret = handle_IRQ_event(irq, regs, desc->action);
		desc->chip->end(irq);
+
+		(void) set_exec_ub(ub);
		return 1;
	}

@@ -246,6 +254,7 @@ out:

	desc->chip->end(irq);
	spin_unlock(&desc->lock);

+	(void) set_exec_ub(ub);
	return 1;
}

@@ -18,6 +18,9 @@

#include <linux/rcupdate.h>
#include <linux/smp.h>

+#include <ub/beancounter.h>
+#include <ub/task.h>
+
#include <asm/irq.h>
/*
- No shared variables, all the data are CPU local.
@@ -191,6 +194,9 @@ asmlinkage void __do_softirq(void)

	__u32 pending;
	int max_restart = MAX_SOFTIRQ_RESTART;
	int cpu;

+ struct user_beancounter *ub;
+
+ ub = set_exec_ub(&ub0);

	pending = local_softirq_pending();
	account_system_vtime(current);

@@ -229,6 +235,8 @@ restart:

	account_system_vtime(current);
	_local_bh_enable();

+
+ (void) set_exec_ub(ub);
}

#ifndef __ARCH_HAS_DO_SOFTIRQ

@@ -46,6 +46,8 @@

#include <linux/delayacct.h>
#include <linux/taskstats_kern.h>

+#include <ub/task.h>
+
#include <asm/pgtable.h>
#include <asm/pgalloc.h>
#include <asm/uaccess.h>
@@ -102,6 +104,7 @@ static kmem_cache_t *mm_cachep;

void free_task(struct task_struct *tsk)
{

+	ub_task_uncharge(tsk);
	free_thread_info(tsk->thread_info);
	rt_mutex_debug_task_free(tsk);
	free_task_struct(tsk);

@@ -162,18 +165,19 @@ static struct task_struct *dup_task_stru

	tsk = alloc_task_struct();
	if (!tsk)

- return NULL;
+ goto out;

	ti = alloc_thread_info(tsk);

- if (!ti) {
- free_task_struct(tsk);
- return NULL;
- }
+ if (!ti)
+ goto out_tsk;

	*tsk = *orig;
	tsk->thread_info = ti;
	setup_thread_stack(tsk, orig);

+ if (ub_task_charge(orig, tsk))
+ goto out_ti;
+

	/* One for us, one for whoever does the "release_task()" (usually parent) */
	atomic_set(&tsk->usage,2);
	atomic_set(&tsk->fs_excl, 0);
@@ -180,6 +184,13 @@ static struct task_struct *dup_task_stru
#endif
	tsk->splice_pipe = NULL;
	return tsk;

+
+out_ti:
+ free_thread_info(ti);
+out_tsk:
+ free_task_struct(tsk);
+out:
+ return NULL;
}

#ifdef CONFIG_MMU

@@ -5,3 +5,4 @@

#

obj-$(CONFIG_USER_RESOURCE) += beancounter.o
+obj-$(CONFIG_USER_RESOURCE) += misc.o

@@ -395,6 +395,10 @@

	spin_lock_init(&ub_hash_lock);
	slot = &ub_hash[ub_hash_fun(ub->ub_uid)];
	hlist_add_head(&ub->hash, slot);

+
+ current->task_bc.exec_ub = ub;
+ current->task_bc.task_ub = get_beancounter(ub);
+ current->task_bc.fork_sub = get_beancounter(ub);
}

void __init ub_init_late(void)

@@ -0,0 +1,34 @@
+/*
+ * kernel/ub/misc.c
+ *
+ * Copyright (C) 2006 OpenVZ. SWsoft Inc.
+ *
+ */
+
+#include <linux/sched.h>
+
+#include <ub/beancounter.h>
+#include <ub/task.h>
+
+int ub_task_charge(struct task_struct *parent, struct task_struct *new)
+{
+	struct task_beancounter *old_bc;
+	struct task_beancounter *new_bc;
+	struct user_beancounter *ub;
+
+	old_bc = &parent->task_bc;
+	new_bc = &new->task_bc;
+
+	ub = old_bc->fork_sub;
+	new_bc->exec_ub = get_beancounter(ub);
+	new_bc->task_ub = get_beancounter(ub);
+	new_bc->fork_sub = get_beancounter(ub);
+	return 0;
+}
+
+void ub_task_uncharge(struct task_struct *tsk)
+{
+	put_beancounter(tsk->task_bc.exec_ub);
+	put_beancounter(tsk->task_bc.task_ub);
+	put_beancounter(tsk->task_bc.fork_sub);
+}

Add the following system calls for UB management:
1. sys_getluid - get current UB id
2. sys_setluid - changes exec_ and fork_ UBs on current
3. sys_setublimit - set limits for resources consumtions

---

arch/i386/kernel/syscall_table.S |    3
arch/ia64/kernel/entry.S         |    3
arch/sparc/kernel/systbls.S      |    2
arch/sparc64/kernel/systbls.S    |    2
include/asm-i386/unistd.h        |    5 +
include/asm-ia64/unistd.h        |    5 +
include/asm-powerpc/systbl.h     |    3
include/asm-powerpc/unistd.h     |    5 +
include/asm-sparc/unistd.h       |    3
include/asm-sparc64/unistd.h     |    3
include/asm-x86_64/unistd.h      |    8 ++
kernel/ub/Makefile               |    1
kernel/ub/sys.c                  |  126 +++++++++++++++++++++++++++++++++++++++
13 files changed, 163 insertions(+), 6 deletions(-)

@@ -317,3 +317,6 @@ ENTRY(sys_call_table)

.long sys_vmsplice
.long sys_move_pages
.long sys_getcpu
+ .long sys_getluid
+ .long sys_setluid
+ .long sys_setublimit /* 320 */

@@ -1610,5 +1610,8 @@ sys_call_table:

	data8 sys_sync_file_range		// 1300
	data8 sys_tee
	data8 sys_vmsplice

+ daat8 sys_getluid
+ data8 sys_setluid
+ data8 sys_setublimit // 1305

.org sys_call_table + 8*NR_syscalls // guard against failures to increase NR_syscalls

@@ -78,7 +78,7 @@ sys_call_table:

/*285*/ .long sys_mkdirat, sys_mknodat, sys_fchownat, sys_futimesat, sys_fstatat64
/*290*/ .long sys_unlinkat, sys_renameat, sys_linkat, sys_symlinkat, sys_readlinkat
/*295*/ .long sys_fchmodat, sys_faccessat, sys_pselect6, sys_ppoll, sys_unshare
-/*300*/ .long sys_set_robust_list, sys_get_robust_list
+/*300*/ .long sys_set_robust_list, sys_get_robust_list, sys_getluid, sys_setluid, sys_setublimit

#ifdef CONFIG_SUNOS_EMUL
	/* Now the SunOS syscall table. */

@@ -79,7 +79,7 @@ sys_call_table32:

.word sys_mkdirat, sys_mknodat, sys_fchownat, compat_sys_futimesat, compat_sys_fstatat64
/*290*/ .word sys_unlinkat, sys_renameat, sys_linkat, sys_symlinkat, sys_readlinkat
.word sys_fchmodat, sys_faccessat, compat_sys_pselect6, compat_sys_ppoll, sys_unshare
-/*300*/ .word compat_sys_set_robust_list, compat_sys_get_robust_list
+/*300*/ .word compat_sys_set_robust_list, compat_sys_get_robust_list, sys_getluid, sys_setluid, sys_setublimit

#endif /* CONFIG_COMPAT */

@@ -323,10 +323,13 @@

#define __NR_vmsplice 316
#define __NR_move_pages 317
#define __NR_getcpu 318
+#define __NR_getluid 319
+#define __NR_setluid 320
+#define __NR_setublimit 321

#ifdef __KERNEL__

-#define NR_syscalls 318
+#define NR_syscalls 322
#include <linux/err.h>

/*

@@ -291,11 +291,14 @@

#define __NR_sync_file_range 1300
#define __NR_tee 1301
#define __NR_vmsplice 1302
+#define __NR_getluid 1303
+#define __NR_setluid 1304
+#define __NR_setublimit 1305

#ifdef __KERNEL__

-#define NR_syscalls 279 /* length of syscall table */
+#define NR_syscalls 282 /* length of syscall table */

#define __ARCH_WANT_SYS_RT_SIGACTION

@@ -304,3 +304,6 @@ SYSCALL_SPU(fchmodat)

SYSCALL_SPU(faccessat)
COMPAT_SYS_SPU(get_robust_list)
COMPAT_SYS_SPU(set_robust_list)
+SYSCALL(sys_getluid)
+SYSCALL(sys_setluid)
+SYSCALL(sys_setublimit)

@@ -323,10 +323,13 @@

#define __NR_faccessat 298
#define __NR_get_robust_list 299
#define __NR_set_robust_list 300
+#define __NR_getluid 301
+#define __NR_setluid 302
+#define __NR_setublimit 303

#ifdef __KERNEL__

-#define __NR_syscalls 301
+#define __NR_syscalls 304

#define __NR__exit __NR_exit
#define NR_syscalls __NR_syscalls

@@ -318,6 +318,9 @@

#define __NR_unshare 299
#define __NR_set_robust_list 300
#define __NR_get_robust_list 301
+#define __NR_getluid 302
+#define __NR_setluid 303
+#define __NR_setublimit 304

#ifdef __KERNEL__
/* WARNING: You MAY NOT add syscall numbers larger than 301, since

@@ -320,6 +320,9 @@

#define __NR_unshare 299
#define __NR_set_robust_list 300
#define __NR_get_robust_list 301
+#define __NR_getluid 302
+#define __NR_setluid 303
+#define __NR_setublimit 304

#ifdef __KERNEL__
/* WARNING: You MAY NOT add syscall numbers larger than 301, since

@@ -619,10 +619,16 @@ __SYSCALL(__NR_sync_file_range, sys_sync

__SYSCALL(__NR_vmsplice, sys_vmsplice)
#define __NR_move_pages 279
__SYSCALL(__NR_move_pages, sys_move_pages)
+#define __NR_getluid 280
+__SYSCALL(__NR_getluid, sys_getluid)
+#define __NR_setluid 281
+__SYSCALL(__NR_setluid, sys_setluid)
+#define __NR_setublimit 282
+__SYSCALL(__NR_setublimit, sys_setublimit)

#ifdef __KERNEL__

-#define __NR_syscall_max __NR_move_pages
+#define __NR_syscall_max __NR_setublimit
#include <linux/err.h>

#ifndef __NO_STUBS

@@ -6,3 +6,4 @@
 

obj-$(CONFIG_USER_RESOURCE) += beancounter.o
obj-$(CONFIG_USER_RESOURCE) += misc.o
+obj-y += sys.o

Introduce UB_KMEMSIZE resource which accounts kernel objects allocated by task's request.

Reference to UB is kept on struct page or slab object. For slabs each struct slab contains a set of pointers corresponding objects are charged to.

Allocation charge rules:
1. Pages - if allocation is performed with __GFP_UBC flag - page is charged to current's exec_ub.
2. Slabs - kmem_cache may be created with SLAB_UBC flag - in this case each allocation is charged. Caches used by kmalloc are created with SLAB_UBC | SLAB_UBC_NOCHARGE flags. In this case only __GFP_UBC allocations are charged.

---

include/linux/gfp.h      |    8 ++-
include/linux/mm.h       |    6 ++
include/linux/slab.h     |    4 +
include/linux/vmalloc.h  |    1
include/ub/beancounter.h |    4 +
include/ub/kmem.h        |   33 ++++++++++++
kernel/ub/Makefile       |    1
kernel/ub/beancounter.c  |    3 +
kernel/ub/kmem.c         |   89 ++++++++++++++++++++++++++++++++++
mm/mempool.c             |    2
mm/page_alloc.c          |   11 ++++
mm/slab.c                |  121 ++++++++++++++++++++++++++++++++++++++---------
mm/vmalloc.c             |    6 ++
13 files changed, 264 insertions(+), 25 deletions(-)

@@ -46,15 +46,18 @@ struct vm_area_struct;

#define __GFP_NOMEMALLOC ((__force gfp_t)0x10000u) /* Don't use emergency reserves */
#define __GFP_HARDWALL ((__force gfp_t)0x20000u) /* Enforce hardwall cpuset memory allocs */
#define __GFP_THISNODE ((__force gfp_t)0x40000u)/* No fallback, no policies */
+#define __GFP_UBC ((__force gfp_t)0x80000u) /* Charge allocation with UB */
+#define __GFP_UBC_LIMIT ((__force gfp_t)0x100000u) /* Charge against UB limit */

-#define __GFP_BITS_SHIFT 20 /* Room for 20 __GFP_FOO bits */
+#define __GFP_BITS_SHIFT 21 /* Room for 20 __GFP_FOO bits */
#define __GFP_BITS_MASK ((__force gfp_t)((1 << __GFP_BITS_SHIFT) - 1))

/* if you forget to add the bitmask here kernel will crash, period */

#define GFP_LEVEL_MASK (__GFP_WAIT|__GFP_HIGH|__GFP_IO|__GFP_FS| \
			__GFP_COLD|__GFP_NOWARN|__GFP_REPEAT| \
			__GFP_NOFAIL|__GFP_NORETRY|__GFP_NO_GROW|__GFP_COMP| \
-			__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_THISNODE)
+			__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_THISNODE| \

+ __GFP_UBC|__GFP_UBC_LIMIT)

/* This equals 0, but use constants in case they ever change */
#define GFP_NOWAIT (GFP_ATOMIC & ~__GFP_HIGH)
@@ -63,6 +66,7 @@ struct vm_area_struct;
#define GFP_NOIO (__GFP_WAIT)
#define GFP_NOFS (__GFP_WAIT | __GFP_IO)
#define GFP_KERNEL (__GFP_WAIT | __GFP_IO | __GFP_FS)
+#define GFP_KERNEL_UBC (__GFP_WAIT | __GFP_IO | __GFP_FS | __GFP_UBC)
#define GFP_USER (__GFP_WAIT | __GFP_IO | __GFP_FS | __GFP_HARDWALL)

#define GFP_HIGHUSER	(__GFP_WAIT | __GFP_IO | __GFP_FS | __GFP_HARDWALL | \
			 __GFP_HIGHMEM)

@@ -274,8 +274,14 @@ struct page {

	unsigned int gfp_mask;
	unsigned long trace[8];

#endif
+#ifdef CONFIG_USER_RESOURCE
+ union {
+ struct user_beancounter *page_ub;
+ } bc;
+#endif
};

+#define page_ub(page) ((page)->bc.page_ub)
#define page_private(page) ((page)->private)
#define set_page_private(page, v) ((page)->private = (v))

@@ -46,6 +46,8 @@ typedef struct kmem_cache kmem_cache_t;

#define SLAB_PANIC 0x00040000UL /* panic if kmem_cache_create() fails */
#define SLAB_DESTROY_BY_RCU 0x00080000UL /* defer freeing pages to RCU */
#define SLAB_MEM_SPREAD 0x00100000UL /* Spread some memory over cpuset */
+#define SLAB_UBC 0x00200000UL /* Account with UB */
+#define SLAB_UBC_NOCHARGE 0x00400000UL /* Explicit accounting */

/* flags passed to a constructor func */
#define SLAB_CTOR_CONSTRUCTOR 0x001UL /* if not set, then deconstructor */
@@ -293,6 +295,8 @@ extern kmem_cache_t *bio_cachep;

extern atomic_t slab_reclaim_pages;

+struct user_beancounter;
+struct user_beancounter **kmem_cache_ubp(kmem_cache_t *cachep, void *obj);
#endif /* __KERNEL__ */

#endif /* _LINUX_SLAB_H */

@@ -36,6 +36,7 @@ struct vm_struct {
 *	Highlevel APIs for driver use
 */

extern void *vmalloc(unsigned long size); +extern void *vmalloc_ub(unsigned long size); extern void *vmalloc_user(unsigned long size); extern void *vmalloc_node(unsigned long size, int node); extern void *vmalloc_exec(unsigned long size);

@@ -12,7 +12,9 @@
 *	Resource list.
 */
 
-#define UB_RESOURCES	0
+#define UB_KMEMSIZE	0
+
+#define UB_RESOURCES	1
 

struct ubparm {
	/*

@@ -0,0 +1,33 @@
+/*
+ *  include/ub/kmem.h
+ *
+ *  Copyright (C) 2006 OpenVZ. SWsoft Inc
+ *
+ */
+
+#ifndef __UB_KMEM_H_
+#define __UB_KMEM_H_
+
+#include <linux/config.h>
+
+/*
+ * UB_KMEMSIZE accounting
+ */
+
+struct mm_struct;
+struct page;
+struct user_beancounter;
+
+#ifdef CONFIG_USER_RESOURCE
+int  ub_page_charge(struct page *page, int order, gfp_t flags);
+void ub_page_uncharge(struct page *page, int order);
+
+int ub_slab_charge(kmem_cache_t *cachep, void *obj, gfp_t flags);
+void ub_slab_uncharge(kmem_cache_t *cachep, void *obj);
+#else
+#define ub_page_charge(pg, o, mask)	(0)
+#define ub_page_uncharge(pg, o)		do { } while (0)
+#define ub_slab_charge(cachep, o)	(0)
+#define ub_slab_uncharge(cachep, o)	do { } while (0)
+#endif
+#endif /* __UB_SLAB_H_ */

@@ -7,3 +7,4 @@

obj-$(CONFIG_USER_RESOURCE) += beancounter.o obj-$(CONFIG_USER_RESOURCE) += misc.o
obj-y += sys.o
+obj-$(CONFIG_USER_RESOURCE) += kmem.o

@@ -20,6 +20,7 @@ static void init_beancounter_struct(stru

struct user_beancounter ub0;

const char *ub_rnames[] = {
+ "kmemsize", /* 0 */
};

#define ub_hash_fun(x) ((((x) >> 8) ^ (x)) & (UB_HASH_SIZE - 1)) @@ -356,6 +357,8 @@ static void init_beancounter_syslimits(s

{
	int k;

+ ub->ub_parms[UB_KMEMSIZE].limit = 32 * 1024 * 1024;
+

	for (k = 0; k < UB_RESOURCES; k++)
		ub->ub_parms[k].barrier = ub->ub_parms[k].limit;
}

@@ -119,6 +119,7 @@ int mempool_resize(mempool_t *pool, int 

	unsigned long flags;

	BUG_ON(new_min_nr <= 0);

+ gfp_mask &= ~__GFP_UBC;

	spin_lock_irqsave(&pool->lock, flags);
	if (new_min_nr <= pool->min_nr) {
@@ -212,6 +213,7 @@ void * mempool_alloc(mempool_t *pool, gf
	gfp_mask |= __GFP_NOMEMALLOC;	/* don't allocate emergency reserves */
	gfp_mask |= __GFP_NORETRY;	/* don't loop in __alloc_pages */
	gfp_mask |= __GFP_NOWARN;	/* failures are OK */

+ gfp_mask &= ~__GFP_UBC; /* do not charge */

	gfp_temp = gfp_mask & ~(__GFP_WAIT|__GFP_IO);

@@ -38,6 +38,8 @@

#include <linux/mempolicy.h>
#include <linux/stop_machine.h>

+#include <ub/kmem.h>
+
#include <asm/tlbflush.h>
#include <asm/div64.h>
#include "internal.h"
@@ -484,6 +486,8 @@ static void __free_pages_ok(struct page

	if (reserved)
		return;

+ ub_page_uncharge(page, order);
+

	kernel_map_pages(page, 1 << order, 0);
	local_irq_save(flags);
	__count_vm_events(PGFREE, 1 << order);
@@ -764,6 +768,8 @@ static void fastcall free_hot_cold_page(
	if (free_pages_check(page))
		return;

+ ub_page_uncharge(page, 0);
+

	kernel_map_pages(page, 1, 0);

	pcp = &zone_pcp(zone, get_cpu())->pcp[cold];
@@ -1153,6 +1159,11 @@ nopage:
		show_mem();
	}

got_pg:
+ if ((gfp_mask & __GFP_UBC) &&
+ ub_page_charge(page, order, gfp_mask)) {
+ __free_pages(page, order);
+ page = NULL;
+ }

#ifdef CONFIG_PAGE_OWNER
	if (page)
		set_page_owner(page, order, gfp_mask);

@@ -108,6 +108,8 @@

#include <linux/mutex.h>
#include <linux/rtmutex.h>

+#include <ub/kmem.h>
+
#include <asm/uaccess.h>
#include <asm/cacheflush.h>
#include <asm/tlbflush.h>
@@ -175,11 +177,13 @@

			 SLAB_CACHE_DMA | \
			 SLAB_MUST_HWCACHE_ALIGN | SLAB_STORE_USER | \
			 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
+			 SLAB_UBC | SLAB_UBC_NOCHARGE | \
			 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD)
#else
# define CREATE_MASK	(SLAB_HWCACHE_ALIGN | \
			 SLAB_CACHE_DMA | SLAB_MUST_HWCACHE_ALIGN | \
			 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
+			 SLAB_UBC | SLAB_UBC_NOCHARGE | \
			 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD)
#endif

@@ -801,9 +805,33 @@ static struct kmem_cache *kmem_find_gene

	return __find_general_cachep(size, gfpflags);
}

-static size_t slab_mgmt_size(size_t nr_objs, size_t align) +static size_t slab_mgmt_size_raw(size_t nr_objs)
+{
+ return sizeof(struct slab) + nr_objs * sizeof(kmem_bufctl_t);
+}
+
+#ifdef CONFIG_USER_RESOURCE
+#define UB_EXTRASIZE sizeof(struct user_beancounter *)
+static inline size_t slab_mgmt_size_noalign(int flags, size_t nr_objs) +{
+ size_t size;
+
+ size = slab_mgmt_size_raw(nr_objs);
+ if (flags & SLAB_UBC)
+ size = ALIGN(size, UB_EXTRASIZE) + nr_objs * UB_EXTRASIZE;
+ return size;
+}
+#else
+#define UB_EXTRASIZE 0
+static inline size_t slab_mgmt_size_noalign(int flags, size_t nr_objs) +{
+ return slab_mgmt_size_raw(nr_objs);
+}
+#endif
+
+static inline size_t slab_mgmt_size(int flags, size_t nr_objs, size_t align) {
- return ALIGN(sizeof(struct slab)+nr_objs*sizeof(kmem_bufctl_t), align);
+ return ALIGN(slab_mgmt_size_noalign(flags, nr_objs), align);
}

/*
@@ -848,20 +876,21 @@ static void cache_estimate(unsigned long
* into account.
*/
nr_objs = (slab_size - sizeof(struct slab)) /

-			  (buffer_size + sizeof(kmem_bufctl_t));
+			  (buffer_size + sizeof(kmem_bufctl_t) +
+			  (flags & SLAB_UBC ? UB_EXTRASIZE : 0));

		/*
		 * This calculated number will be either the right
		 * amount, or one greater than what we want.
		 */
-		if (slab_mgmt_size(nr_objs, align) + nr_objs*buffer_size
+		if (slab_mgmt_size(flags, nr_objs, align) + nr_objs*buffer_size
		       > slab_size)
			nr_objs--;

		if (nr_objs > SLAB_LIMIT)
			nr_objs = SLAB_LIMIT;

- mgmt_size = slab_mgmt_size(nr_objs, align);

+		mgmt_size = slab_mgmt_size(flags, nr_objs, align);
	}
	*num = nr_objs;
	*left_over = slab_size - nr_objs*buffer_size - mgmt_size;

@@ -1420,7 +1449,8 @@ void __init kmem_cache_init(void)
sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
sizes[INDEX_AC].cs_size, ARCH_KMALLOC_MINALIGN,
- ARCH_KMALLOC_FLAGS|SLAB_PANIC,
+ ARCH_KMALLOC_FLAGS | SLAB_UBC |
+ SLAB_UBC_NOCHARGE | SLAB_PANIC,

					NULL, NULL);

	if (INDEX_AC != INDEX_L3) {
@@ -1428,7 +1458,8 @@ void __init kmem_cache_init(void)
			kmem_cache_create(names[INDEX_L3].name,
				sizes[INDEX_L3].cs_size,
				ARCH_KMALLOC_MINALIGN,
-				ARCH_KMALLOC_FLAGS|SLAB_PANIC,
+				ARCH_KMALLOC_FLAGS | SLAB_UBC |
+					SLAB_UBC_NOCHARGE | SLAB_PANIC,
				NULL, NULL);
	}

@@ -1446,7 +1477,8 @@ void __init kmem_cache_init(void)

			sizes->cs_cachep = kmem_cache_create(names->name,
					sizes->cs_size,
					ARCH_KMALLOC_MINALIGN,
-					ARCH_KMALLOC_FLAGS|SLAB_PANIC,
+					ARCH_KMALLOC_FLAGS | SLAB_UBC |
+						SLAB_UBC_NOCHARGE | SLAB_PANIC,
					NULL, NULL);
		}

@@ -1943,7 +1975,8 @@ static size_t calculate_slab_order(struc

			 * looping condition in cache_grow().
			 */
			offslab_limit = size - sizeof(struct slab);

- offslab_limit /= sizeof(kmem_bufctl_t);
+ offslab_limit /= (sizeof(kmem_bufctl_t) +
+ (flags & SLAB_UBC ? UB_EXTRASIZE : 0));

if (num > offslab_limit)

				break;
@@ -2251,8 +2284,8 @@ kmem_cache_create (const char *name, siz
		cachep = NULL;
		goto oops;
	}

- slab_size = ALIGN(cachep->num * sizeof(kmem_bufctl_t)
- + sizeof(struct slab), align);
+
+ slab_size = slab_mgmt_size(flags, cachep->num, align);

	/*
	 * If the slab has been placed off-slab, and we have enough space then
@@ -2263,11 +2296,9 @@ kmem_cache_create (const char *name, siz
		left_over -= slab_size;
	}

- if (flags & CFLGS_OFF_SLAB) {
+ if (flags & CFLGS_OFF_SLAB)

		/* really off slab. No need for manual alignment */

- slab_size =
- cachep->num * sizeof(kmem_bufctl_t) + sizeof(struct slab);
- }
+ slab_size = slab_mgmt_size_noalign(flags, cachep->num);

	cachep->colour_off = cache_line_size();
	/* Offset must be a multiple of the alignment. */

@@ -2513,6 +2544,30 @@ int kmem_cache_destroy(struct kmem_cache }
EXPORT_SYMBOL(kmem_cache_destroy);

+static inline kmem_bufctl_t *slab_bufctl(struct slab *slabp) +{
+ return (kmem_bufctl_t *) (slabp + 1);
+}
+
+#ifdef CONFIG_USER_RESOURCE
+static inline struct user_beancounter **slab_ub_ptrs(kmem_cache_t *cachep,
+ struct slab *slabp)
+{
+ return (struct user_beancounter **) ALIGN((unsigned long)
+ (slab_bufctl(slabp) + cachep->num), UB_EXTRASIZE);
+}
+
+struct user_beancounter **kmem_cache_ubp(kmem_cache_t *cachep, void *objp) +{
+ struct slab *slabp;
+ struct user_beancounter **ubs;
+
+ slabp = virt_to_slab(objp);
+ ubs = slab_ub_ptrs(cachep, slabp);
+ return ubs + obj_to_index(cachep, slabp, objp);
+}
+#endif
+
/*
* Get the memory for a slab management obj.
* For a slab cache when the slab descriptor is off-slab, slab descriptors
@@ -2533,7 +2588,8 @@ static struct slab *alloc_slabmgmt(struc

	if (OFF_SLAB(cachep)) {
		/* Slab management obj is off-slab. */
		slabp = kmem_cache_alloc_node(cachep->slabp_cache,
-					      local_flags, nodeid);
+					      local_flags & (~__GFP_UBC),
+					      nodeid);
		if (!slabp)
			return NULL;
	} else {
@@ -2544,14 +2600,14 @@ static struct slab *alloc_slabmgmt(struc
	slabp->colouroff = colour_off;
	slabp->s_mem = objp + colour_off;
	slabp->nodeid = nodeid;

+#ifdef CONFIG_USER_RESOURCE
+ if (cachep->flags & SLAB_UBC)
+ memset(slab_ub_ptrs(cachep, slabp), 0,
+ cachep->num * UB_EXTRASIZE);
+#endif

	return slabp;
}

-static inline kmem_bufctl_t *slab_bufctl(struct slab *slabp) -{
- return (kmem_bufctl_t *) (slabp + 1);
-}
-
static void cache_init_objs(struct kmem_cache *cachep,
struct slab *slabp, unsigned long ctor_flags)
{
@@ -2729,7 +2785,7 @@ static int cache_grow(struct kmem_cache
* Get mem for the objs. Attempt to allocate a physical page from
* 'nodeid'.
*/
- objp = kmem_getpages(cachep, flags, nodeid);

+	objp = kmem_getpages(cachep, flags & (~__GFP_UBC), nodeid);
	if (!objp)
		goto failed;

@@ -3077,6 +3133,19 @@ static inline void *____cache_alloc(stru

	return objp;
}

+static inline int ub_should_charge(kmem_cache_t *cachep, gfp_t flags) +{
+#ifdef CONFIG_USER_RESOURCE
+ if (!(cachep->flags & SLAB_UBC))
+ return 0;
+ if (flags & __GFP_UBC)
+ return 1;
+ if (!(cachep->flags & SLAB_UBC_NOCHARGE))
+ return 1;
+#endif
+ return 0;
+}
+
static __always_inline void *__cache_alloc(struct kmem_cache *cachep,
gfp_t flags, void *caller)
{
@@ -3090,6 +3159,12 @@ static __always_inline void *__cache_all

	local_irq_restore(save_flags);
	objp = cache_alloc_debugcheck_after(cachep, flags, objp,
					    caller);

+
+ if (objp && ub_should_charge(cachep, flags))
+ if (ub_slab_charge(cachep, objp, flags)) {
+ kmem_cache_free(cachep, objp);
+ objp = NULL;
+ }

	prefetchw(objp);
	return objp;
}
@@ -3287,6 +3362,8 @@ static inline void __cache_free(struct k
	struct array_cache *ac = cpu_cache_get(cachep);

	check_irq_off();
+	if (cachep->flags & SLAB_UBC)
+		ub_slab_uncharge(cachep, objp);
	objp = cache_free_debugcheck(cachep, objp, __builtin_return_address(0));

	if (cache_free_alien(cachep, objp))

@@ -520,6 +520,12 @@ void *vmalloc(unsigned long size)

}
EXPORT_SYMBOL(vmalloc);

+void *vmalloc_ub(unsigned long size)
+{
+ return __vmalloc(size, GFP_KERNEL_UBC | __GFP_HIGHMEM, PAGE_KERNEL);
+}
+EXPORT_SYMBOL(vmalloc_ub);
+
/**
* vmalloc_user - allocate virtually contiguous memory which has
* been zeroed so it can be mapped to userspace without

Mark some kmem caches with SLAB_UBC and some allocations with __GFP_UBC to cause charging/limiting of appropriate kernel resources.

---

arch/i386/kernel/ldt.c           |    4 ++--
arch/i386/mm/init.c              |    4 ++--
arch/i386/mm/pgtable.c           |    6 ++++--
drivers/char/tty_io.c            |   10 +++++-----
fs/file.c                        |    8 ++++----
fs/locks.c                       |    2 +-
fs/namespace.c                   |    3 ++-
fs/select.c                      |    7 ++++---
include/asm-i386/thread_info.h   |    4 ++--
include/asm-ia64/pgalloc.h       |   24 +++++++++++++++++-------
include/asm-x86_64/pgalloc.h     |   12 ++++++++----
include/asm-x86_64/thread_info.h |    5 +++--
ipc/msgutil.c                    |    4 ++--
ipc/sem.c                        |    7 ++++---
ipc/util.c                       |    8 ++++----
kernel/fork.c                    |   15 ++++++++-------
kernel/posix-timers.c            |    3 ++-
kernel/signal.c                  |    2 +-
kernel/user.c                    |    2 +-
mm/rmap.c                        |    3 ++-
mm/shmem.c                       |    3 ++-
21 files changed, 80 insertions(+), 56 deletions(-)

@@ -39,9 +39,9 @@ static int alloc_ldt(mm_context_t *pc, i

	oldsize = pc->size;
	mincount = (mincount+511)&(~511);
	if (mincount*LDT_ENTRY_SIZE > PAGE_SIZE)

- newldt = vmalloc(mincount*LDT_ENTRY_SIZE);
+ newldt = vmalloc_ub(mincount*LDT_ENTRY_SIZE);
else
- newldt = kmalloc(mincount*LDT_ENTRY_SIZE, GFP_KERNEL);
+ newldt = kmalloc(mincount*LDT_ENTRY_SIZE, GFP_KERNEL_UBC);

	if (!newldt)
		return -ENOMEM;

@@ -680,7 +680,7 @@ void __init pgtable_cache_init(void)

		pmd_cache = kmem_cache_create("pmd",
					PTRS_PER_PMD*sizeof(pmd_t),
					PTRS_PER_PMD*sizeof(pmd_t),
-					0,
+					SLAB_UBC,
					pmd_ctor,
					NULL);
		if (!pmd_cache)
@@ -689,7 +689,7 @@ void __init pgtable_cache_init(void)
	pgd_cache = kmem_cache_create("pgd",
				PTRS_PER_PGD*sizeof(pgd_t),
				PTRS_PER_PGD*sizeof(pgd_t),
-				0,
+				SLAB_UBC,
				pgd_ctor,
				PTRS_PER_PMD == 1 ? pgd_dtor : NULL);
	if (!pgd_cache)

@@ -158,9 +158,11 @@ struct page *pte_alloc_one(struct mm_str

	struct page *pte;

#ifdef CONFIG_HIGHPTE

-	pte = alloc_pages(GFP_KERNEL|__GFP_HIGHMEM|__GFP_REPEAT|__GFP_ZERO, 0);
+	pte = alloc_pages(GFP_KERNEL|__GFP_HIGHMEM|__GFP_REPEAT|__GFP_ZERO|
+			__GFP_UBC | __GFP_UBC_LIMIT, 0);
#else
-	pte = alloc_pages(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO, 0);
+	pte = alloc_pages(GFP_KERNEL|__GFP_REPEAT|__GFP_ZERO|
+			__GFP_UBC | __GFP_UBC_LIMIT, 0);
#endif
	return pte;
}

@@ -158,7 +158,7 @@ static struct tty_struct *alloc_tty_stru

{
	struct tty_struct *tty;

- tty = kmalloc(sizeof(struct tty_struct), GFP_KERNEL);

+	tty = kmalloc(sizeof(struct tty_struct), GFP_KERNEL_UBC);
	if (tty)
		memset(tty, 0, sizeof(struct tty_struct));
	return tty;

@@ -1495,7 +1495,7 @@ static int init_dev(struct tty_driver *d

	if (!*tp_loc) {
		tp = (struct termios *) kmalloc(sizeof(struct termios),
-						GFP_KERNEL);
+						GFP_KERNEL_UBC);
		if (!tp)
			goto free_mem_out;
		*tp = driver->init_termios;

@@ -1503,7 +1503,7 @@ static int init_dev(struct tty_driver *d

	if (!*ltp_loc) {
		ltp = (struct termios *) kmalloc(sizeof(struct termios),
-						 GFP_KERNEL);
+						 GFP_KERNEL_UBC);
		if (!ltp)
			goto free_mem_out;
		memset(ltp, 0, sizeof(struct termios));

@@ -1528,7 +1528,7 @@ static int init_dev(struct tty_driver *d

		if (!*o_tp_loc) {
			o_tp = (struct termios *)
-				kmalloc(sizeof(struct termios), GFP_KERNEL);
+				kmalloc(sizeof(struct termios), GFP_KERNEL_UBC);
			if (!o_tp)
				goto free_mem_out;
			*o_tp = driver->other->init_termios;

@@ -1536,7 +1536,7 @@ static int init_dev(struct tty_driver *d

		if (!*o_ltp_loc) {
			o_ltp = (struct termios *)
-				kmalloc(sizeof(struct termios), GFP_KERNEL);
+				kmalloc(sizeof(struct termios), GFP_KERNEL_UBC);
			if (!o_ltp)
				goto free_mem_out;
			memset(o_ltp, 0, sizeof(struct termios));

@@ -44,9 +44,9 @@ struct file ** alloc_fd_array(int num)

	int size = num * sizeof(struct file *);

	if (size <= PAGE_SIZE)

- new_fds = (struct file **) kmalloc(size, GFP_KERNEL);
+ new_fds = (struct file **) kmalloc(size, GFP_KERNEL_UBC);
else
- new_fds = (struct file **) vmalloc(size);

+		new_fds = (struct file **) vmalloc_ub(size);
	return new_fds;
}

@@ -213,9 +213,9 @@ fd_set * alloc_fdset(int num)

	int size = num / 8;

	if (size <= PAGE_SIZE)

- new_fdset = (fd_set *) kmalloc(size, GFP_KERNEL);
+ new_fdset = (fd_set *) kmalloc(size, GFP_KERNEL_UBC);
else
- new_fdset = (fd_set *) vmalloc(size);

+		new_fdset = (fd_set *) vmalloc_ub(size);
	return new_fdset;
}

@@ -2226,7 +2226,7 @@ EXPORT_SYMBOL(lock_may_write);

static int __init filelock_init(void)
{
filelock_cache = kmem_cache_create("file_lock_cache",
- sizeof(struct file_lock), 0, SLAB_PANIC,
+ sizeof(struct file_lock), 0, SLAB_PANIC | SLAB_UBC,

			init_once, NULL);
	return 0;
}

@@ -1825,7 +1825,8 @@ void __init mnt_init(unsigned long mempa

	init_rwsem(&namespace_sem);

	mnt_cache = kmem_cache_create("mnt_cache", sizeof(struct vfsmount),

- 0, SLAB_HWCACHE_ALIGN | SLAB_PANIC, NULL, NULL);
+ 0, SLAB_HWCACHE_ALIGN | SLAB_UBC | SLAB_PANIC,
+ NULL, NULL);

	mount_hashtable = (struct list_head *)__get_free_page(GFP_ATOMIC);

@@ -103,7 +103,8 @@ static struct poll_table_entry *poll_get

	if (!table || POLL_TABLE_FULL(table)) {
		struct poll_table_page *new_table;

- new_table = (struct poll_table_page *) __get_free_page(GFP_KERNEL);
+ new_table = (struct poll_table_page *)

+			__get_free_page(GFP_KERNEL_UBC);
		if (!new_table) {
			p->error = -ENOMEM;
			__set_current_state(TASK_RUNNING);
@@ -339,7 +340,7 @@ static int core_sys_select(int n, fd_set
	if (size > sizeof(stack_fds) / 6) {
		/* Not enough space in on-stack array; must use kmalloc */
		ret = -ENOMEM;
-		bits = kmalloc(6 * size, GFP_KERNEL);
+		bits = kmalloc(6 * size, GFP_KERNEL_UBC);
		if (!bits)
			goto out_nofds;
	}
@@ -693,7 +694,7 @@ int do_sys_poll(struct pollfd __user *uf
		if (!stack_pp)
			stack_pp = pp = (struct poll_list *)stack_pps;
		else {
-			pp = kmalloc(size, GFP_KERNEL);
+			pp = kmalloc(size, GFP_KERNEL_UBC);
			if (!pp)
				goto out_fds;
		}

@@ -99,13 +99,13 @@ static inline struct thread_info *curren

	({							\
		struct thread_info *ret;			\
								\
-		ret = kmalloc(THREAD_SIZE, GFP_KERNEL);		\
+		ret = kmalloc(THREAD_SIZE, GFP_KERNEL_UBC);	\
		if (ret)					\
			memset(ret, 0, THREAD_SIZE);		\
		ret;						\
	})

#else
-#define alloc_thread_info(tsk) kmalloc(THREAD_SIZE, GFP_KERNEL) +#define alloc_thread_info(tsk) kmalloc(THREAD_SIZE, GFP_KERNEL_UBC) #endif

#define free_thread_info(info) kfree(info)

@@ -19,6 +19,8 @@

#include <linux/page-flags.h>
#include <linux/threads.h>

+#include <ub/kmem.h>
+
#include <asm/mmu_context.h>

DECLARE_PER_CPU(unsigned long *, __pgtable_quicklist); @@ -37,7 +39,7 @@ static inline long pgtable_quicklist_tot

	return ql_size;
}

-static inline void *pgtable_quicklist_alloc(void) +static inline void *pgtable_quicklist_alloc(int charge)

{
	unsigned long *ret = NULL;

@@ -45,13 +47,20 @@ static inline void *pgtable_quicklist_al

	ret = pgtable_quicklist;
	if (likely(ret != NULL)) {

+ if (charge && ub_page_charge(virt_to_page(ret),
+ 0, __GFP_UBC_LIMIT)) {
+ ret = NULL;
+ goto out;
+ }

		pgtable_quicklist = (unsigned long *)(*ret);
		ret[0] = 0;
		--pgtable_quicklist_size;
+out:
		preempt_enable();
	} else {
		preempt_enable();
-		ret = (unsigned long *)__get_free_page(GFP_KERNEL | __GFP_ZERO);
+		ret = (unsigned long *)__get_free_page(GFP_KERNEL |
+				__GFP_ZERO | __GFP_UBC | __GFP_UBC_LIMIT);
	}

	return ret;

@@ -69,6 +78,7 @@ static inline void pgtable_quicklist_fre #endif

	preempt_disable();
+	ub_page_uncharge(virt_to_page(pgtable_entry), 0);
	*(unsigned long *)pgtable_entry = (unsigned long)pgtable_quicklist;
	pgtable_quicklist = (unsigned long *)pgtable_entry;
	++pgtable_quicklist_size;

@@ -77,7 +87,7 @@ static inline void pgtable_quicklist_fre

static inline pgd_t *pgd_alloc(struct mm_struct *mm) {
- return pgtable_quicklist_alloc();
+ return pgtable_quicklist_alloc(1);
}

static inline void pgd_free(pgd_t * pgd)
@@ -94,7 +104,7 @@ pgd_populate(struct mm_struct *mm, pgd_t

static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr) {
- return pgtable_quicklist_alloc();
+ return pgtable_quicklist_alloc(1);
}

static inline void pud_free(pud_t * pud)
@@ -112,7 +122,7 @@ pud_populate(struct mm_struct *mm, pud_t

static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr) {
- return pgtable_quicklist_alloc();
+ return pgtable_quicklist_alloc(1);
}

static inline void pmd_free(pmd_t * pmd)
@@ -137,13 +147,13 @@ pmd_populate_kernel(struct mm_struct *mm static inline struct page *pte_alloc_one(struct mm_struct *mm,
unsigned long addr)
{
- return virt_to_page(pgtable_quicklist_alloc());
+ return virt_to_page(pgtable_quicklist_alloc(1));
}

static inline pte_t *pte_alloc_one_kernel(struct mm_struct *mm,
unsigned long addr)
{
- return pgtable_quicklist_alloc();
+ return pgtable_quicklist_alloc(0);
}

static inline void pte_free(struct page *pte)

@@ -31,12 +31,14 @@ static inline void pmd_free(pmd_t *pmd)
 

static inline pmd_t *pmd_alloc_one (struct mm_struct *mm, unsigned long addr) {
- return (pmd_t *)get_zeroed_page(GFP_KERNEL|__GFP_REPEAT);
+ return (pmd_t *)get_zeroed_page(GFP_KERNEL|__GFP_REPEAT|
+ __GFP_UBC | __GFP_UBC_LIMIT);
}

static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr) {
- return (pud_t *)get_zeroed_page(GFP_KERNEL|__GFP_REPEAT);
+ return (pud_t *)get_zeroed_page(GFP_KERNEL|__GFP_REPEAT|
+ __GFP_UBC | __GFP_UBC_LIMIT);
}

static inline void pud_free (pud_t *pud)
@@ -74,7 +76,8 @@ static inline void pgd_list_del(pgd_t *p static inline pgd_t *pgd_alloc(struct mm_struct *mm)

{
	unsigned boundary;
-	pgd_t *pgd = (pgd_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT);
+	pgd_t *pgd = (pgd_t *)__get_free_page(GFP_KERNEL|__GFP_REPEAT|
+			__GFP_UBC | __GFP_UBC_LIMIT);
	if (!pgd)
		return NULL;
	pgd_list_add(pgd);

@@ -105,7 +108,8 @@ static inline pte_t *pte_alloc_one_kerne

static inline struct page *pte_alloc_one(struct mm_struct *mm, unsigned long address) {
- void *p = (void *)get_zeroed_page(GFP_KERNEL|__GFP_REPEAT);
+ void *p = (void *)get_zeroed_page(GFP_KERNEL|__GFP_REPEAT|

+			__GFP_UBC | __GFP_UBC_LIMIT);
	if (!p)
		return NULL;
	return virt_to_page(p);

@@ -78,14 +78,15 @@ static inline struct thread_info *stack_
    ({								\

	struct thread_info *ret;				\
								\
-	ret = ((struct thread_info *) __get_free_pages(GFP_KERNEL,THREAD_ORDER)); \
+	ret = ((struct thread_info *) __get_free_pages(GFP_KERNEL_UBC,	\
+				THREAD_ORDER)); 		\
	if (ret)						\
		memset(ret, 0, THREAD_SIZE);			\
	ret;							\
    })

#else
#define alloc_thread_info(tsk) \
- ((struct thread_info *) __get_free_pages(GFP_KERNEL,THREAD_ORDER))
+ ((struct thread_info *) __get_free_pages(GFP_KERNEL_UBC,THREAD_ORDER))
#endif

#define free_thread_info(ti) free_pages((unsigned long) (ti), THREAD_ORDER)

@@ -36,7 +36,7 @@ struct msg_msg *load_msg(const void __us

	if (alen > DATALEN_MSG)
		alen = DATALEN_MSG;

- msg = (struct msg_msg *)kmalloc(sizeof(*msg) + alen, GFP_KERNEL);

+	msg = (struct msg_msg *)kmalloc(sizeof(*msg) + alen, GFP_KERNEL_UBC);
	if (msg == NULL)
		return ERR_PTR(-ENOMEM);

@@ -57,7 +57,7 @@ struct msg_msg *load_msg(const void __us
if (alen > DATALEN_SEG)
alen = DATALEN_SEG;
seg = (struct msg_msgseg *)kmalloc(sizeof(*seg) + alen,
- GFP_KERNEL);

+						 GFP_KERNEL_UBC);
		if (seg == NULL) {
			err = -ENOMEM;
			goto out_err;

@@ -954,7 +954,7 @@ static inline int get_undo_list(struct s
 

	undo_list = current->sysvsem.undo_list;
	if (!undo_list) {
-		undo_list = kzalloc(sizeof(*undo_list), GFP_KERNEL);
+		undo_list = kzalloc(sizeof(*undo_list), GFP_KERNEL_UBC);
		if (undo_list == NULL)
			return -ENOMEM;
		spin_lock_init(&undo_list->lock);
@@ -1018,7 +1019,8 @@ static struct sem_undo *find_undo(int se
	ipc_rcu_getref(sma);
	sem_unlock(sma);

- new = (struct sem_undo *) kmalloc(sizeof(struct sem_undo) + sizeof(short)*nsems, GFP_KERNEL);
+ new = (struct sem_undo *) kmalloc(sizeof(struct sem_undo) +

+			sizeof(short)*nsems, GFP_KERNEL_UBC);
	if (!new) {
		ipc_lock_by_ptr(&sma->sem_perm);
		ipc_rcu_putref(sma);
@@ -1076,7 +1078,7 @@ asmlinkage long sys_semtimedop(int semid
	if (nsops > ns->sc_semopm)
		return -E2BIG;
	if(nsops > SEMOPM_FAST) {
-		sops = kmalloc(sizeof(*sops)*nsops,GFP_KERNEL);
+		sops = kmalloc(sizeof(*sops)*nsops,GFP_KERNEL_UBC);
		if(sops==NULL)
			return -ENOMEM;
	}

@@ -302,9 +302,9 @@ void* ipc_alloc(int size)

{
	void* out;
	if(size > PAGE_SIZE)

- out = vmalloc(size);
+ out = vmalloc_ub(size);
else
- out = kmalloc(size, GFP_KERNEL);

+		out = kmalloc(size, GFP_KERNEL_UBC);
	return out;
}

@@ -387,14 +387,14 @@ void* ipc_rcu_alloc(int size)

	 * workqueue if necessary (for vmalloc). 
	 */
	if (rcu_use_vmalloc(size)) {
-		out = vmalloc(HDRLEN_VMALLOC + size);
+		out = vmalloc_ub(HDRLEN_VMALLOC + size);
		if (out) {
			out += HDRLEN_VMALLOC;
			container_of(out, struct ipc_rcu_hdr, data)->is_vmalloc = 1;
			container_of(out, struct ipc_rcu_hdr, data)->refcount = 1;
		}
	} else {
-		out = kmalloc(HDRLEN_KMALLOC + size, GFP_KERNEL);
+		out = kmalloc(HDRLEN_KMALLOC + size, GFP_KERNEL_UBC);
		if (out) {
			out += HDRLEN_KMALLOC;
			container_of(out, struct ipc_rcu_hdr, data)->is_vmalloc = 0;

@@ -134,7 +134,7 @@ void __init fork_init(unsigned long memp

	/* create a slab on which task_structs can be allocated */
	task_struct_cachep =
		kmem_cache_create("task_struct", sizeof(struct task_struct),

- ARCH_MIN_TASKALIGN, SLAB_PANIC, NULL, NULL);
+ ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_UBC, NULL, NULL);
#endif

	/*

@@ -1425,23 +1425,24 @@ void __init proc_caches_init(void)
{
sighand_cachep = kmem_cache_create("sighand_cache",
sizeof(struct sighand_struct), 0,
- SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_DESTROY_BY_RCU,
+ SLAB_HWCACHE_ALIGN | SLAB_PANIC | \
+ SLAB_DESTROY_BY_RCU | SLAB_UBC,
sighand_ctor, NULL);
signal_cachep = kmem_cache_create("signal_cache",
sizeof(struct signal_struct), 0,
- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_UBC, NULL, NULL);
files_cachep = kmem_cache_create("files_cache",
sizeof(struct files_struct), 0,
- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_UBC, NULL, NULL);
fs_cachep = kmem_cache_create("fs_cache",
sizeof(struct fs_struct), 0,
- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_UBC, NULL, NULL);
vm_area_cachep = kmem_cache_create("vm_area_struct",
sizeof(struct vm_area_struct), 0,
- SLAB_PANIC, NULL, NULL);
+ SLAB_PANIC|SLAB_UBC, NULL, NULL);
mm_cachep = kmem_cache_create("mm_struct",
sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN,
- SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
+ SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_UBC, NULL, NULL);
}

@@ -242,7 +242,8 @@ static __init int init_posix_timers(void

	register_posix_clock(CLOCK_MONOTONIC, &clock_monotonic);

	posix_timers_cache = kmem_cache_create("posix_timers_cache",
-					sizeof (struct k_itimer), 0, 0, NULL, NULL);
+					sizeof (struct k_itimer), 0, SLAB_UBC,
+					NULL, NULL);
	idr_init(&posix_timers_id);
	return 0;
}

@@ -2574,5 +2574,5 @@ void __init signals_init(void)

kmem_cache_create("sigqueue",
sizeof(struct sigqueue), __alignof__(struct sigqueue),
- SLAB_PANIC, NULL, NULL);
+ SLAB_PANIC | SLAB_UBC, NULL, NULL);
}

@@ -197,7 +197,7 @@ static int __init uid_cache_init(void)

	int n;

	uid_cachep = kmem_cache_create("uid_cache", sizeof(struct user_struct),

- 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL, NULL);
+ 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_UBC, NULL, NULL);

	for(n = 0; n < UIDHASH_SZ; ++n)
		INIT_LIST_HEAD(uidhash_table + n);

@@ -179,7 +179,8 @@ static void anon_vma_ctor(void *data, st

void __init anon_vma_init(void)
{
anon_vma_cachep = kmem_cache_create("anon_vma", sizeof(struct anon_vma),
- 0, SLAB_DESTROY_BY_RCU|SLAB_PANIC, anon_vma_ctor, NULL);
+ 0, SLAB_DESTROY_BY_RCU|SLAB_PANIC|SLAB_UBC,
+ anon_vma_ctor, NULL);
}

/*

@@ -367,7 +367,8 @@ static swp_entry_t *shmem_swp_alloc(stru

		}

		spin_unlock(&info->lock);
-		page = shmem_dir_alloc(mapping_gfp_mask(inode->i_mapping) | __GFP_ZERO);
+		page = shmem_dir_alloc(mapping_gfp_mask(inode->i_mapping) | \
+				__GFP_ZERO | __GFP_UBC);
		if (page)
			set_page_private(page, 0);
		spin_lock(&info->lock);

Add proc interface (/proc/user_beancounters) allowing to see current state (usage/limits/fails for each UB). Implemented via seq files.

---

init/main.c        |    1
kernel/ub/Makefile |    1
kernel/ub/proc.c   |  205 +++++++++++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 207 insertions(+)

@@ -578,6 +578,7 @@ asmlinkage void __init start_kernel(void

	page_writeback_init();
#ifdef CONFIG_PROC_FS
	proc_root_init();
+	ub_init_proc();
#endif
	cpuset_init();
	taskstats_init_early();

@@ -4,3 +4,4 @@ obj-$(CONFIG_USER_RESOURCE) += beancount

obj-$(CONFIG_USER_RESOURCE) += misc.o
obj-y += sys.o
obj-$(CONFIG_USER_RESOURCE) += kmem.o
+obj-$(CONFIG_USER_RESOURCE) += proc.o

Ar Mer, 2006-08-16 am 19:38 +0400, ysgrifennodd Kirill Korotaev:

Ar Mer, 2006-08-16 am 19:39 +0400, ysgrifennodd Kirill Korotaev:

The

+ ub->ub_parms[UB_KMEMSIZE].limit = 32 * 1024 * 1024

seems a bit arbitary. 32Mb is variously vast amounts of memory and not enough to boot depending if you are booting a PDA or a 4096 core Itanic box

Ar Mer, 2006-08-16 am 19:42 +0400, ysgrifennodd Kirill Korotaev:

(although it will clash slightly with the diffs I just sent Andrew)

Ar Mer, 2006-08-16 am 19:37 +0400, ysgrifennodd Kirill Korotaev:

Ugh, why /proc? This doesn't have anything to do with processes, just users, right? What's wrong with /sys/kernel/ instead?

Or /sys/kernel/debug/user_beancounters/ in debugfs as this is just a debugging thing, right?

thanks,

greg k-h

hm. I'd have expected to see a `struct user_struct *' here, not a uid_t.

Why not have another system call for getting the current limits?

But as I said in previous mail, configfs seems like a better choice for user interface. That way user has to go to one place to read/write limits, see the current usage and other stats.

	...<snip>...

<snip>

Ar Mer, 2006-08-16 am 11:17 -0700, ysgrifennodd Rohit Seth:

Generally speaking there isn't a sane appropriate action because the resources can't just be yanked.

Good.

I wouldn't be too worried about doing fractions. Make it unfair and charge it to either the container who first instantiated the file or the container who faulted on that page first.

Though the part that seems important is to be able to define a directory in fs and say all pages belonging to files underneath that directory are going to be put in specific container. Just like you are having resource beans associated with sockets, have address_space or inode also associated with resource beans. (And it should be possible to have a container/resource bean without any active process but set of address_space mappings with its own limits and current usage).

-rohit

Ar Mer, 2006-08-16 am 11:53 -0700, ysgrifennodd Rohit Seth:

Thats no good if you can arrange who gets charged, it becomes possible to accumulate the advantages and break the constraints intended.

Thats an extremely crude use of beancounters. You can do far more useful things with them and namespaces (and even at times without namespaces) such as preventing one web site breaking another.

My preference would be to have container (I keep on saying container, but resource beancounter) pointer embeded in task, mm(not sure), address_space and anon_vma structures. This should allow us to track user land pages optimally. But for tracking kernel usage on behalf of user, we will have to use an additional field (unless we can re-use mapping). Please correct me if I'm wrong, though all the kernel resources will be allocated/freed in context of a user process. And at that time we know if a allocation should succeed or not. So we may actually not need to track kernel pages that closely. We are not going to run reclaim on any of them anyways.

-rohit

I was more thinking about (for example) user land physical memory limit for that bean counter. If the limits are going down, then the system call should try to flush out page cache pages or swap out anonymous memory. But you are right that it won't be possible in all cases, like for in kernel memory limits.

-rohit

Hmm. If we can embed it in the mm, then we can get there from any given anon_vma (or any pte for that matter). Here's a little prototype for doing just that:

http://www.sr71.net/patches/2.6.18/2.6.18-rc4-mm1-lxc1/broken-out/modify-lru-walk.patch

See file/anon_page_has_naughty_cpuset(). Anybody see any basic problems with doing it that way?

One trick with putting it in an mm is that we don't have a direct
relationship between processes and mm's. We could also potentially have two different threads of a process in two different accounting contexts. But, that might be as simple to fix as disallowing things that share mms from being in different accounting contexts, unless you unshare the mm.

-- Dave

Ar Mer, 2006-08-16 am 12:15 -0700, ysgrifennodd Rohit Seth:

Quite the reverse, tracking kernel pages is critical, user pages kind of balance out for many cases kernel ones don't.

Ar Mer, 2006-08-16 am 12:59 -0700, ysgrifennodd Dave Hansen:

At the point I have twenty containers containing 20 copies of glibc to meet your suggestion it would be *far* cheaper to put it in the page struct.

Alan

Kirill,

Thanks for posting the patches to ckrm-tech. I 'll look into it and post my comments tomorrow.

Some documentation (or pointer to the documentation) on how to use this feature and high level design would really help.

How does the hierarchy work ? (May be reading the code would clear it up :).

few comments below..
On Wed, 2006-08-16 at 19:24 +0400, Kirill Korotaev wrote:
<snip>

Since the core functionality is arch independent, why not have the Kconfig stuff in some generic place like init/Kconfig ?

wondering why we need three of these ?

I agree with Rohit that configfs based interface would be more easy to use (you will not get into the system call number issue that Greg has pointed too).

again, configfs would be easier.

----------------------------------------------------------------------
    Chandra Seetharaman               | Be careful what you choose....
              - [email protected]   |      .......you may get it.
----------------------------------------------------------------------

just historical code line which introduces UB_MAXVALUE independant of cross-compiler/headers etc.

Will replace it.

Kirill

We need more complex decrement/locking scheme than krefs provide. e.g. in __put_beancounter() we need atomic_dec_and_lock_irqsave() semantics for performance optimizations.

Kirill

check __charge_beancounter_locked and severity.
It provides some kind of soft and hard limits.

oh, its a misname. Should be ub_id. it is ID of user_beancounter and has nothing to do with user id.

the first one is for hierarchical UBs,
see beancounter_findcreate with UB_LOOKUP_SUB.
private_data is probably not used yet :)

what's wrong with it?

1. UBC doesn't require glibc modificatins.
2. if you think a bit more about it, adding UB parameters doesn't require user space changes as well.
3. it is possible to add any kind of interface for UBC. but do you like the idea to grep 200(containers)x20(parameters) files for getting current usages? Do you like the idea to convert numbers to strings and back w/o thinking of data types?

Thanks,
Kirill

Sorry, misused name. should be ub_id. not related to user_struct or user.

Thanks,
Kirill

[...skipped...]

Oh, will fix NR_SYSCALLS in entry.S and the comment in unistd.h. Thanks for catching this!

Thanks,
Kirill

will add sys_getublimit().

Check another email about interfaces. I have arguments against it :/

any idea what exact action to add here?
Looks like can be added when needed, agree?

Thanks,
Kirill

Such kind of memory management is less efficient than the one making decisions based on global shortages and global LRU alogrithm.

The problem here is that doing swap out takes more expensive disk I/O influencing other users.

So throttling algorithms if wanted should be optional, not mandatory. Lets postpone it and concentrate on the core.

Thanks,
Kirill

Do you have any plans to post a CPU controller? Is that tied to UBC interface as well?

Regards,
vatsa

[snip]

Regards,
vatsa

Is there a case where exec_ub and fork_sub can differ? I dont see that in the patch.

Regards,
vatsa

Ah, ok, missed that. Nevermind then :)

thanks,

greg k-h

Look in context changing in interrupts - "set_exec_ub(&ub0);" is done there.

charged kernel objects can't be _reclaimed_. how do you propose to reclaim tasks page tables or files or task struct or vma or etc.?

Kirill

When I discussed this with Hugh Dickins on summit we agreed that +4 bytes on page struct for kernel using accounting are ok and almost unavoidable.

it can be stored not on the struct page, but in this case you need to introduce some kind of hash to lookup ub quickly from page, which is slower for accounting-enabled kernels.

slab doesn't use this pointer on the page.
It is used for pages allocated by buddy alocator implicitly (e.g. LDT pages, page tables, ...).

Kirill

objects are really allocated in process context
(except for TCP/IP and other softirqs which are done in arbitrary process context!)
And objects are not always freed in correct context (!).

Note, page_ub is not for _user_ pages. user pages accounting will be added in next patch set. page_ub is added to track kernel allocations.

Kirill

We can move it, if there are much objections.
It is just here for more than 3 years (AFAIK starting from Alan's UBC) and would be nice to have for compatibility (at least with existing OpenVZ). But if it is required -- will do.

debugfs is usually OFF imho. you don't export meminfo information in debugfs, correct? user usages are the same imho...

Kirill

this limit is for newly created UBs, host system (ub0) is _unlimited_ by default.
The idea was to limit the user by default to make system secure. do you think it is good idea to have unlimited users created by default? Anyway, after creating UB context normal behaviour would be to set some limits.

Thanks,
Kirill

Not everything at once :) To tell the truth I think CPU controller is even more complicated than user memory accounting/limiting.

No, fair CPU scheduler is not tied to UBC in any regard. As we discussed before, it is valuable to have an ability to limit different resources separately (CPU, disk I/O, memory, etc.). For example, it can be possible to place some mission critical kernel threads (like kjournald) in a separate contanier.

This patches are related to kernel memory and nothing more :)

Thanks,
Kirill

yes, it is possible to use hierarchical beancounters.
kernel memory, user memory and TCP/IP buffers are accounted hierarchicaly. user interface for this is not provided yet as it would complicate patchset and increase number of topics for discussion :)

every patch which adds a resource modifies this function and sets some default limit. Check: [PATCH 5/7] UBC: kernel memory accounting (core)

Thanks,
Kirill

I think this can be added when needed, no?
See no much reason to add notifications which are not used yet.

Please, keep in mind. This patch set can be extended in infinite number of ways. But!!! It contains only the required minimal functionality. When we are to add code requiring to know about limit changes or fails or whatever we can always extend it accordingly.

Thanks,
Kirill

My main thought is that _everybody_ is going to have to live with the entry in the 'struct page'. Distros ship one kernel for everybody, and the cost will be paid by those not even using any kind of resource control or containers.

That said, it sure is simpler to implement, so I'm all for it!

-- Dave

Is it possible to put the locking in the destructor? It seems like that should give similar behavior.

-- Dave

Hmmm. There aren't _that_ many of those cases, right? Are there any that absolutely need raw access to the buddy allocator? I'm pretty sure that pagetables can be moved over to a slab, as long as we bump up the alignment.

It does seem a wee bit silly to have the pointer in _all_ of the struct pages, even the ones for which we will never do any accounting (and even on kernels that never need it). But, a hashing scheme sounds like a fine idea.

-- Dave

Do you have any statistics on which of these objects are the most troublesome? If it _is_ pagetables, for instance, it is quite conceivable that we could reclaim them.

This one probably deserves a big, fat comment, though. ;)

-- Dave

Ar Iau, 2006-08-17 am 07:26 -0700, ysgrifennodd Dave Hansen:

I don't see any good way around that. For the page struct it is a material issue, for the others its not a big deal providing we avoid accounting dumb stuff like dentries.

At the VM summit Linus suggested one option for user page allocation tracking would be to track not per page but by block of pages (say the 2MB chunks) and hand those out per container. That would really need the defrag work though.

One could always use a second set of arrays, mirroring mem_map

-Andi

Every userspace or page cache page will be in an object though. Could we do the pointer on a per object (mapping, anon vma, ...) basis?

Kernel pages are not using all of their struct page entries, so we could overload a field.

It all depends on how much we really care about not growing struct page :)

What is important?  What you want to be true, or what is true?

I also was quite surprised that openvz appears to have no way of constraining a container's memory usage. "I want to run this bunch of processes in a 4.5GB container".

A well-set-up container would presumably be working against its own spindle(s). If the operator has gone to all the trouble of isolating a job from the system's other jobs, he'd be pretty dumb to go and let all the "isolated" jobs share a stinky-slow resource like a disk.

But yes, swap is a problem. To do this properly we'd need a way of saying "this container here uses that swap device over there".

I am objecting. /proc is for processes so do not add any new files there that do not deal with processes.

No, distros enable it.

That is because the meminfo is tied to processes, or was added to proc before debugfs came about.

Then how about just /sys/kernel/ instead and use sysfs? Just remember, one value per file please.

thanks,

greg k-h

I see two problems with that. But let me first describe the current /proc/user_beancounters. This is how it looks like from inside a container:

# cat /proc/user_beancounters
Version: 2.5
      uid  resource           held    maxheld    barrier      limit    failcnt
      123: kmemsize         836919    1005343    2752512    2936012          0
           lockedpages           0          0         32         32          0
           privvmpages        4587       7289      49152      53575          0
............(more lines like that).........................................

I.e. a container owner can take a glance over the current parameters, their usage and (the thing that is really important) fail counters. Fail counter increases each time a parameter hits the limit. This is very straightforward way for container's owner to see if everything is OK or not.

So, the problems with /sys are:

(1) Gettng such info from 40+ files requires at least some script, while now cat is just fine.

(2) Do we want to virtualize sysfs and enable /sys for every container? Note that user_beancounters statistics is really needed for container's owner to see. At the same time, container's owner should not be able to modify it -- so we should end up with read/write ubc entries for the host system and read-only ones for the container.

Taking into account those two issues, current /proc/user_beancounters might be not that bad.

Sure ..But going by this it should mean that we don't see any code which hints of heirarchy (->parent)? :)

Regards,
vatsa

But anon_vmas could be shared across different processes (with different mms).

-rohit

The only way I see around it is using other mechanisms to more loosely attribute ownership of a page to particular containers. I know that my suggestion of traversing the rmap chains at page reclaim time is going appears to be slow compared to the regular reclaim path, but I'm not sure it really matters.

Let's say you have 20 containers sharing 20 pages which are on the LRU, and those pages are evenly distributed so that each container owns one page. Only one of those 20 containers is over its limit. With something that strictly assigns container ownership to one and only one container, you're going to have to walk half of the LRU to find the page.

With a "loose ownership" scheme, you'd hit on the first page, and you'd pay the cost by having to walk halfway through the 20 rmap entries. Admittedly, the rmap walk is much slower than an LRU walk.

-- Dave

Having the knowledge of how many kernel pages are getting used by each container is indeed very useful. But as long as the context in which they are created and destroyed is identifiable, there is no need to really physically tag each page with container id. And for the cases where we have no context, it will be worth while to see if mapping field could be used.

It is useful to put limits on some group of applications. So it is really not only about balancing out.

-rohit

I think the best would be to have a container for /usr/lib or /lib in this case where you can account all pages belonging to files present in these directories and shared across multiple applications.

-rohit

Would be easier to just rename them as soft and hard limits...

...just that user land will need to be some how informed about that.

You are right not for setting the limits. But for adding any new functionality related to containers....as in you just added a new system call to get the limits.

How are you doing it currently and how much more efficient it is in comparison to configfs?

IMO, setting up limits and containers (themselves) is not a common
operation. I wouldn't be too worried about loosing those few extra
cycles in setting them up.

-rohit

I agree that kernel objects cann't be reclaimed easily. But what you are proposing is also not right. Returning failure w/o doing any reclaim on pages (that are reclaimable) is not useful. And this is why I asked, is this change going to be part of next set of patches (as current set of patches are only tracking kernel usage).

-rohit

...and I'm still not convinced that syscall is the right approach.

When you have the support of user memory, then operations like flush the extra pages belonging to the container to disk seems reasonable.

-rohit

I'm really interested in seeing what changes you make in alloc_page when the container limits are hit.

When a container is throttling then yes it will have some additional cost to other containers but that is the cost of sharing an underlying platform.

-rohit

Can these pages be tagged using mapping field of the page struct.

You mean beyond Networking and softirq.

But will the page_ub be used for some purpose for user land pages?

-rohit

hmm, not sure why it is simpler.

-rohit

When you ask the question, "which container owns this page?", you don't have to look far, nor is it ambiguous in any way. It is very strict, and very straightforward.

-- Dave

Bingo. Even though it has the word "overload".

Besides, if we have the container pointer based on address_space (for example) then it will also allow file based tracking...

I think page based container pointer makes more sense when you have container as the central part of page lists (in place of nodes) deciding which list the free page is going to come from, and when freed which list it is going to go back to.

-rohit

You would need to be careful. Both the rewritten slab and the new tree network allocator use struct page fields already. There might be conflicts already.

-Andi (who still doesn't see what's so bad about a separate table)

as in page->mapping->container for user land?

What additional ambiguity you have when inode or task structures have the required information.

-rohit

Not much wrong with that, as long as we do something more like sparsemem than mem_map[]. ;)

-- Dave

I think _I_ was being too ambiguous. ;)

When you uniquely assign a kernel object, say mapping->container, there is no ambiguity.

-- Dave

On Thu, 2006-08-17 at 18:02 +0400, Kirill Korotaev wrote:
<snip>

The idea of upper layer code changing the lower layer's code doesn't sound good. May be you can think of defining some interface to do it.

----------------------------------------------------------------------
    Chandra Seetharaman               | Be careful what you choose....
              - [email protected]   |      .......you may get it.
----------------------------------------------------------------------

Not having the CPU controller on UBC doesn't sound good for the infrastructure. IMHO, the infrastructure (for resource management) we are going to have should be able to support different resource controllers, without each controllers needing to have their own infrastructure/interface etc.,

Having ability to limit/control different resources separately not necessarily mean we should have different infrastructure for each.

I don't understand the comment above (in this context).

----------------------------------------------------------------------
    Chandra Seetharaman               | Be careful what you choose....
              - [email protected]   |      .......you may get it.
----------------------------------------------------------------------

EXPORT_SYMBOL. Shouldn't that be done in the patch where it's needed outside of the kernel/ub code itself?