| Message ID | 20231030182013.40086-1-haitao.huang@linux.intel.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | Add Cgroup support for SGX EPC memory | expand |
On Mon, 2023-10-30 at 11:20 -0700, Haitao Huang wrote: > SGX Enclave Page Cache (EPC) memory allocations are separate from normal RAM allocations, and > are managed solely by the SGX subsystem. The existing cgroup memory controller cannot be used > to limit or account for SGX EPC memory, which is a desirable feature in some environments, > e.g., support for pod level control in a Kubernates cluster on a VM or baremetal host [1,2]. > > This patchset implements the support for sgx_epc memory within the misc cgroup controller. The > user can use the misc cgroup controller to set and enforce a max limit on total EPC usage per > cgroup. The implementation reports current usage and events of reaching the limit per cgroup as > well as the total system capacity. > > With the EPC misc controller enabled, every EPC page allocation is accounted for a cgroup's > usage, reflected in the 'sgx_epc' entry in the 'misc.current' interface file of the cgroup. > Much like normal system memory, EPC memory can be overcommitted via virtual memory techniques > and pages can be swapped out of the EPC to their backing store (normal system memory allocated > via shmem, accounted by the memory controller). When the EPC usage of a cgroup reaches its hard > limit ('sgx_epc' entry in the 'misc.max' file), the cgroup starts a reclamation process to swap > out some EPC pages within the same cgroup and its descendant to their backing store. Although > the SGX architecture supports swapping for all pages, to avoid extra complexities, this > implementation does not support swapping for certain page types, e.g. Version Array(VA) pages, > and treat them as unreclaimable pages. When the limit is reached but nothing left in the > cgroup for reclamation, i.e., only unreclaimable pages left, any new EPC allocation in the > cgroup will result in an ENOMEM error. > > The EPC pages allocated for guest VMs by the virtual EPC driver are not reclaimable by the host > kernel [5]. Therefore they are also treated as unreclaimable from cgroup's point of view. And > the virtual EPC driver translates an ENOMEM error resulted from an EPC allocation request into > a SIGBUS to the user process. > > This work was originally authored by Sean Christopherson a few years ago, and previously > modified by Kristen C. Accardi to utilize the misc cgroup controller rather than a custom > controller. I have been updating the patches based on review comments since V2 [3, 4, 10], > simplified the implementation/design and fixed some stability issues found from testing. > > The patches are organized as following: > - Patches 1-3 are prerequisite misc cgroup changes for adding new APIs, structs, resource > types. > - Patch 4 implements basic misc controller for EPC without reclamation. > - Patches 5-9 prepare for per-cgroup reclamation. > * Separate out the existing infrastructure of tracking reclaimable pages > from the global reclaimer(ksgxd) to a newly created LRU list struct. > * Separate out reusable top-level functions for reclamation. > - Patch 10 adds support for per-cgroup reclamation. > - Patch 11 adds documentation for the EPC cgroup. > - Patch 12 adds test scripts. > > I appreciate your review and providing tags if appropriate. > > --- > V6: > - Dropped OOM killing path, only implement non-preemptive enforcement of max limit (Dave, Michal) > - Simplified reclamation flow by taking out sgx_epc_reclaim_control, forced reclamation by > ignoring 'age". > - Restructured patches: split misc API + resource types patch and the big EPC cgroup patch > (Kai, Michal) > - Dropped some Tested-by/Reviewed-by tags due to significant changes > - Added more selftests > > v5: > - Replace the manual test script with a selftest script. > - Restore the "From" tag for some patches to Sean (Kai) > - Style fixes (Jarkko) > > v4: > - Collected "Tested-by" from Mikko. I kept it for now as no functional changes in v4. > - Rebased on to v6.6_rc1 and reordered patches as described above. > - Separated out the bug fixes [7,8,9]. This series depend on those patches. (Dave, Jarkko) > - Added comments in commit message to give more preview what's to come next. (Jarkko) > - Fixed some documentation error, gap, style (Mikko, Randy) > - Fixed some comments, typo, style in code (Mikko, Kai) > - Patch format and background for reclaimable vs unreclaimable (Kai, Jarkko) > - Fixed typo (Pavel) > - Exclude the previous fixes/enhancements for self-tests. Patch 18 now depends on series [6] > - Use the same to list for cover and all patches. (Solo) > > v3: > > - Added EPC states to replace flags in sgx_epc_page struct. (Jarkko) > - Unrolled wrappers for cond_resched, list (Dave) > - Separate patches for adding reclaimable and unreclaimable lists. (Dave) > - Other improvements on patch flow, commit messages, styles. (Dave, Jarkko) > - Simplified the cgroup tree walking with plain > css_for_each_descendant_pre. > - Fixed race conditions and crashes. > - OOM killer to wait for the victim enclave pages being reclaimed. > - Unblock the user by handling misc_max_write callback asynchronously. > - Rebased onto 6.4 and no longer base this series on the MCA patchset. > - Fix an overflow in misc_try_charge. > - Fix a NULL pointer in SGX PF handler. > - Updated and included the SGX selftest patches previously reviewed. Those > patches fix issues triggered in high EPC pressure required for cgroup > testing. > - Added test scripts to help setup and test SGX EPC cgroups. > > [1]https://lore.kernel.org/all/DM6PR21MB11772A6ED915825854B419D6C4989@DM6PR21MB1177.namprd21.prod.outlook.com/ > [2]https://lore.kernel.org/all/ZD7Iutppjj+muH4p@himmelriiki/ > [3]https://lore.kernel.org/all/20221202183655.3767674-1-kristen@linux.intel.com/ > [4]https://lore.kernel.org/linux-sgx/20230712230202.47929-1-haitao.huang@linux.intel.com/ > [5]Documentation/arch/x86/sgx.rst, Section "Virtual EPC" > [6]https://lore.kernel.org/linux-sgx/20220905020411.17290-1-jarkko@kernel.org/ > [7]https://lore.kernel.org/linux-sgx/ZLcXmvDKheCRYOjG@slm.duckdns.org/ > [8]https://lore.kernel.org/linux-sgx/20230721120231.13916-1-haitao.huang@linux.intel.com/ > [9]https://lore.kernel.org/linux-sgx/20230728051024.33063-1-haitao.huang@linux.intel.com/ > [10]https://lore.kernel.org/all/20230923030657.16148-1-haitao.huang@linux.intel.com/ > > Haitao Huang (2): > x86/sgx: Introduce EPC page states > selftests/sgx: Add scripts for EPC cgroup testing > > Kristen Carlson Accardi (5): > cgroup/misc: Add per resource callbacks for CSS events > cgroup/misc: Export APIs for SGX driver > cgroup/misc: Add SGX EPC resource type > x86/sgx: Implement basic EPC misc cgroup functionality > x86/sgx: Implement EPC reclamation for cgroup > > Sean Christopherson (5): > x86/sgx: Add sgx_epc_lru_list to encapsulate LRU list > x86/sgx: Use sgx_epc_lru_list for existing active page list > x86/sgx: Use a list to track to-be-reclaimed pages > x86/sgx: Restructure top-level EPC reclaim function > Docs/x86/sgx: Add description for cgroup support > > Documentation/arch/x86/sgx.rst | 74 ++++ > arch/x86/Kconfig | 13 + > arch/x86/kernel/cpu/sgx/Makefile | 1 + > arch/x86/kernel/cpu/sgx/encl.c | 2 +- > arch/x86/kernel/cpu/sgx/epc_cgroup.c | 319 ++++++++++++++++++ > arch/x86/kernel/cpu/sgx/epc_cgroup.h | 49 +++ > arch/x86/kernel/cpu/sgx/main.c | 245 +++++++++----- > arch/x86/kernel/cpu/sgx/sgx.h | 88 ++++- > include/linux/misc_cgroup.h | 42 +++ > kernel/cgroup/misc.c | 52 ++- > .../selftests/sgx/run_epc_cg_selftests.sh | 196 +++++++++++ > .../selftests/sgx/watch_misc_for_tests.sh | 13 + > 12 files changed, 996 insertions(+), 98 deletions(-) > create mode 100644 arch/x86/kernel/cpu/sgx/epc_cgroup.c > create mode 100644 arch/x86/kernel/cpu/sgx/epc_cgroup.h > create mode 100755 tools/testing/selftests/sgx/run_epc_cg_selftests.sh > create mode 100755 tools/testing/selftests/sgx/watch_misc_for_tests.sh > Is this expected to work on NUC7? Planning to test this next week (no time this week). BR, Jarkko
On Sun, 05 Nov 2023 21:26:44 -0600, Jarkko Sakkinen <jarkko@kernel.org> wrote: > On Mon, 2023-10-30 at 11:20 -0700, Haitao Huang wrote: >> SGX Enclave Page Cache (EPC) memory allocations are separate from >> normal RAM allocations, and >> are managed solely by the SGX subsystem. The existing cgroup memory >> controller cannot be used >> to limit or account for SGX EPC memory, which is a desirable feature in >> some environments, >> e.g., support for pod level control in a Kubernates cluster on a VM or >> baremetal host [1,2]. >> This patchset implements the support for sgx_epc memory within the >> misc cgroup controller. The >> user can use the misc cgroup controller to set and enforce a max limit >> on total EPC usage per >> cgroup. The implementation reports current usage and events of reaching >> the limit per cgroup as >> well as the total system capacity. >> With the EPC misc controller enabled, every EPC page allocation is >> accounted for a cgroup's >> usage, reflected in the 'sgx_epc' entry in the 'misc.current' interface >> file of the cgroup. >> Much like normal system memory, EPC memory can be overcommitted via >> virtual memory techniques >> and pages can be swapped out of the EPC to their backing store (normal >> system memory allocated >> via shmem, accounted by the memory controller). When the EPC usage of a >> cgroup reaches its hard >> limit ('sgx_epc' entry in the 'misc.max' file), the cgroup starts a >> reclamation process to swap >> out some EPC pages within the same cgroup and its descendant to their >> backing store. Although >> the SGX architecture supports swapping for all pages, to avoid extra >> complexities, this >> implementation does not support swapping for certain page types, e.g. >> Version Array(VA) pages, >> and treat them as unreclaimable pages. When the limit is reached but >> nothing left in the >> cgroup for reclamation, i.e., only unreclaimable pages left, any new >> EPC allocation in the >> cgroup will result in an ENOMEM error. >> >> The EPC pages allocated for guest VMs by the virtual EPC driver are not >> reclaimable by the host >> kernel [5]. Therefore they are also treated as unreclaimable from >> cgroup's point of view. And >> the virtual EPC driver translates an ENOMEM error resulted from an EPC >> allocation request into >> a SIGBUS to the user process. >> >> This work was originally authored by Sean Christopherson a few years >> ago, and previously >> modified by Kristen C. Accardi to utilize the misc cgroup controller >> rather than a custom >> controller. I have been updating the patches based on review comments >> since V2 [3, 4, 10], >> simplified the implementation/design and fixed some stability issues >> found from testing. >> The patches are organized as following: >> - Patches 1-3 are prerequisite misc cgroup changes for adding new APIs, >> structs, resource >> types. >> - Patch 4 implements basic misc controller for EPC without reclamation. >> - Patches 5-9 prepare for per-cgroup reclamation. >> * Separate out the existing infrastructure of tracking reclaimable >> pages >> from the global reclaimer(ksgxd) to a newly created LRU list >> struct. >> * Separate out reusable top-level functions for reclamation. >> - Patch 10 adds support for per-cgroup reclamation. >> - Patch 11 adds documentation for the EPC cgroup. >> - Patch 12 adds test scripts. >> >> I appreciate your review and providing tags if appropriate. >> >> --- >> V6: >> - Dropped OOM killing path, only implement non-preemptive enforcement >> of max limit (Dave, Michal) >> - Simplified reclamation flow by taking out sgx_epc_reclaim_control, >> forced reclamation by >> ignoring 'age". >> - Restructured patches: split misc API + resource types patch and the >> big EPC cgroup patch >> (Kai, Michal) >> - Dropped some Tested-by/Reviewed-by tags due to significant changes >> - Added more selftests >> >> v5: >> - Replace the manual test script with a selftest script. >> - Restore the "From" tag for some patches to Sean (Kai) >> - Style fixes (Jarkko) >> >> v4: >> - Collected "Tested-by" from Mikko. I kept it for now as no functional >> changes in v4. >> - Rebased on to v6.6_rc1 and reordered patches as described above. >> - Separated out the bug fixes [7,8,9]. This series depend on those >> patches. (Dave, Jarkko) >> - Added comments in commit message to give more preview what's to come >> next. (Jarkko) >> - Fixed some documentation error, gap, style (Mikko, Randy) >> - Fixed some comments, typo, style in code (Mikko, Kai) >> - Patch format and background for reclaimable vs unreclaimable (Kai, >> Jarkko) >> - Fixed typo (Pavel) >> - Exclude the previous fixes/enhancements for self-tests. Patch 18 now >> depends on series [6] >> - Use the same to list for cover and all patches. (Solo) >> v3: >> - Added EPC states to replace flags in sgx_epc_page struct. (Jarkko) >> - Unrolled wrappers for cond_resched, list (Dave) >> - Separate patches for adding reclaimable and unreclaimable lists. >> (Dave) >> - Other improvements on patch flow, commit messages, styles. (Dave, >> Jarkko) >> - Simplified the cgroup tree walking with plain >> css_for_each_descendant_pre. >> - Fixed race conditions and crashes. >> - OOM killer to wait for the victim enclave pages being reclaimed. >> - Unblock the user by handling misc_max_write callback asynchronously. >> - Rebased onto 6.4 and no longer base this series on the MCA patchset. >> - Fix an overflow in misc_try_charge. >> - Fix a NULL pointer in SGX PF handler. >> - Updated and included the SGX selftest patches previously reviewed. >> Those >> patches fix issues triggered in high EPC pressure required for cgroup >> testing. >> - Added test scripts to help setup and test SGX EPC cgroups. >> >> [1]https://lore.kernel.org/all/DM6PR21MB11772A6ED915825854B419D6C4989@DM6PR21MB1177.namprd21.prod.outlook.com/ >> [2]https://lore.kernel.org/all/ZD7Iutppjj+muH4p@himmelriiki/ >> [3]https://lore.kernel.org/all/20221202183655.3767674-1-kristen@linux.intel.com/ >> [4]https://lore.kernel.org/linux-sgx/20230712230202.47929-1-haitao.huang@linux.intel.com/ >> [5]Documentation/arch/x86/sgx.rst, Section "Virtual EPC" >> [6]https://lore.kernel.org/linux-sgx/20220905020411.17290-1-jarkko@kernel.org/ >> [7]https://lore.kernel.org/linux-sgx/ZLcXmvDKheCRYOjG@slm.duckdns.org/ >> [8]https://lore.kernel.org/linux-sgx/20230721120231.13916-1-haitao.huang@linux.intel.com/ >> [9]https://lore.kernel.org/linux-sgx/20230728051024.33063-1-haitao.huang@linux.intel.com/ >> [10]https://lore.kernel.org/all/20230923030657.16148-1-haitao.huang@linux.intel.com/ >> >> Haitao Huang (2): >> x86/sgx: Introduce EPC page states >> selftests/sgx: Add scripts for EPC cgroup testing >> >> Kristen Carlson Accardi (5): >> cgroup/misc: Add per resource callbacks for CSS events >> cgroup/misc: Export APIs for SGX driver >> cgroup/misc: Add SGX EPC resource type >> x86/sgx: Implement basic EPC misc cgroup functionality >> x86/sgx: Implement EPC reclamation for cgroup >> >> Sean Christopherson (5): >> x86/sgx: Add sgx_epc_lru_list to encapsulate LRU list >> x86/sgx: Use sgx_epc_lru_list for existing active page list >> x86/sgx: Use a list to track to-be-reclaimed pages >> x86/sgx: Restructure top-level EPC reclaim function >> Docs/x86/sgx: Add description for cgroup support >> >> Documentation/arch/x86/sgx.rst | 74 ++++ >> arch/x86/Kconfig | 13 + >> arch/x86/kernel/cpu/sgx/Makefile | 1 + >> arch/x86/kernel/cpu/sgx/encl.c | 2 +- >> arch/x86/kernel/cpu/sgx/epc_cgroup.c | 319 ++++++++++++++++++ >> arch/x86/kernel/cpu/sgx/epc_cgroup.h | 49 +++ >> arch/x86/kernel/cpu/sgx/main.c | 245 +++++++++----- >> arch/x86/kernel/cpu/sgx/sgx.h | 88 ++++- >> include/linux/misc_cgroup.h | 42 +++ >> kernel/cgroup/misc.c | 52 ++- >> .../selftests/sgx/run_epc_cg_selftests.sh | 196 +++++++++++ >> .../selftests/sgx/watch_misc_for_tests.sh | 13 + >> 12 files changed, 996 insertions(+), 98 deletions(-) >> create mode 100644 arch/x86/kernel/cpu/sgx/epc_cgroup.c >> create mode 100644 arch/x86/kernel/cpu/sgx/epc_cgroup.h >> create mode 100755 tools/testing/selftests/sgx/run_epc_cg_selftests.sh >> create mode 100755 tools/testing/selftests/sgx/watch_misc_for_tests.sh >> > > Is this expected to work on NUC7? > > Planning to test this next week (no time this week). > > BR, Jarkko I don't see a reason why it would not be working on a NUC. I'll try to get access to one and test it too. The only difference I can think of is you may have lower capacity. The selftests scripts try not hard code the limit numbers so I expect they should also work. Also changes do not depend on EDMM so any NUC should be fine. BTW I'll also send a fixup patch for an issue on memcg not charged for cgroup workqueue reclamation that Mikko found in his testing. Please apply that on top of the series when testing. Thanks Haitao
On Mon, 06 Nov 2023 09:48:36 -0600, Haitao Huang <haitao.huang@linux.intel.com> wrote: > On Sun, 05 Nov 2023 21:26:44 -0600, Jarkko Sakkinen <jarkko@kernel.org> > wrote: > >> On Mon, 2023-10-30 at 11:20 -0700, Haitao Huang wrote: >>> SGX Enclave Page Cache (EPC) memory allocations are separate from >>> normal RAM allocations, and >>> are managed solely by the SGX subsystem. The existing cgroup memory >>> controller cannot be used >>> to limit or account for SGX EPC memory, which is a desirable feature >>> in some environments, >>> e.g., support for pod level control in a Kubernates cluster on a VM or >>> baremetal host [1,2]. >>> This patchset implements the support for sgx_epc memory within the >>> misc cgroup controller. The >>> user can use the misc cgroup controller to set and enforce a max limit >>> on total EPC usage per >>> cgroup. The implementation reports current usage and events of >>> reaching the limit per cgroup as >>> well as the total system capacity. >>> With the EPC misc controller enabled, every EPC page allocation is >>> accounted for a cgroup's >>> usage, reflected in the 'sgx_epc' entry in the 'misc.current' >>> interface file of the cgroup. >>> Much like normal system memory, EPC memory can be overcommitted via >>> virtual memory techniques >>> and pages can be swapped out of the EPC to their backing store (normal >>> system memory allocated >>> via shmem, accounted by the memory controller). When the EPC usage of >>> a cgroup reaches its hard >>> limit ('sgx_epc' entry in the 'misc.max' file), the cgroup starts a >>> reclamation process to swap >>> out some EPC pages within the same cgroup and its descendant to their >>> backing store. Although >>> the SGX architecture supports swapping for all pages, to avoid extra >>> complexities, this >>> implementation does not support swapping for certain page types, e.g. >>> Version Array(VA) pages, >>> and treat them as unreclaimable pages. When the limit is reached but >>> nothing left in the >>> cgroup for reclamation, i.e., only unreclaimable pages left, any new >>> EPC allocation in the >>> cgroup will result in an ENOMEM error. >>> >>> The EPC pages allocated for guest VMs by the virtual EPC driver are >>> not reclaimable by the host >>> kernel [5]. Therefore they are also treated as unreclaimable from >>> cgroup's point of view. And >>> the virtual EPC driver translates an ENOMEM error resulted from an EPC >>> allocation request into >>> a SIGBUS to the user process. >>> >>> This work was originally authored by Sean Christopherson a few years >>> ago, and previously >>> modified by Kristen C. Accardi to utilize the misc cgroup controller >>> rather than a custom >>> controller. I have been updating the patches based on review comments >>> since V2 [3, 4, 10], >>> simplified the implementation/design and fixed some stability issues >>> found from testing. >>> The patches are organized as following: >>> - Patches 1-3 are prerequisite misc cgroup changes for adding new >>> APIs, structs, resource >>> types. >>> - Patch 4 implements basic misc controller for EPC without reclamation. >>> - Patches 5-9 prepare for per-cgroup reclamation. >>> * Separate out the existing infrastructure of tracking reclaimable >>> pages >>> from the global reclaimer(ksgxd) to a newly created LRU list >>> struct. >>> * Separate out reusable top-level functions for reclamation. >>> - Patch 10 adds support for per-cgroup reclamation. >>> - Patch 11 adds documentation for the EPC cgroup. >>> - Patch 12 adds test scripts. >>> >>> I appreciate your review and providing tags if appropriate. >>> >>> --- >>> V6: >>> - Dropped OOM killing path, only implement non-preemptive enforcement >>> of max limit (Dave, Michal) >>> - Simplified reclamation flow by taking out sgx_epc_reclaim_control, >>> forced reclamation by >>> ignoring 'age". >>> - Restructured patches: split misc API + resource types patch and the >>> big EPC cgroup patch >>> (Kai, Michal) >>> - Dropped some Tested-by/Reviewed-by tags due to significant changes >>> - Added more selftests >>> >>> v5: >>> - Replace the manual test script with a selftest script. >>> - Restore the "From" tag for some patches to Sean (Kai) >>> - Style fixes (Jarkko) >>> >>> v4: >>> - Collected "Tested-by" from Mikko. I kept it for now as no functional >>> changes in v4. >>> - Rebased on to v6.6_rc1 and reordered patches as described above. >>> - Separated out the bug fixes [7,8,9]. This series depend on those >>> patches. (Dave, Jarkko) >>> - Added comments in commit message to give more preview what's to come >>> next. (Jarkko) >>> - Fixed some documentation error, gap, style (Mikko, Randy) >>> - Fixed some comments, typo, style in code (Mikko, Kai) >>> - Patch format and background for reclaimable vs unreclaimable (Kai, >>> Jarkko) >>> - Fixed typo (Pavel) >>> - Exclude the previous fixes/enhancements for self-tests. Patch 18 now >>> depends on series [6] >>> - Use the same to list for cover and all patches. (Solo) >>> v3: >>> - Added EPC states to replace flags in sgx_epc_page struct. (Jarkko) >>> - Unrolled wrappers for cond_resched, list (Dave) >>> - Separate patches for adding reclaimable and unreclaimable lists. >>> (Dave) >>> - Other improvements on patch flow, commit messages, styles. (Dave, >>> Jarkko) >>> - Simplified the cgroup tree walking with plain >>> css_for_each_descendant_pre. >>> - Fixed race conditions and crashes. >>> - OOM killer to wait for the victim enclave pages being reclaimed. >>> - Unblock the user by handling misc_max_write callback asynchronously. >>> - Rebased onto 6.4 and no longer base this series on the MCA patchset. >>> - Fix an overflow in misc_try_charge. >>> - Fix a NULL pointer in SGX PF handler. >>> - Updated and included the SGX selftest patches previously reviewed. >>> Those >>> patches fix issues triggered in high EPC pressure required for cgroup >>> testing. >>> - Added test scripts to help setup and test SGX EPC cgroups. >>> >>> [1]https://lore.kernel.org/all/DM6PR21MB11772A6ED915825854B419D6C4989@DM6PR21MB1177.namprd21.prod.outlook.com/ >>> [2]https://lore.kernel.org/all/ZD7Iutppjj+muH4p@himmelriiki/ >>> [3]https://lore.kernel.org/all/20221202183655.3767674-1-kristen@linux.intel.com/ >>> [4]https://lore.kernel.org/linux-sgx/20230712230202.47929-1-haitao.huang@linux.intel.com/ >>> [5]Documentation/arch/x86/sgx.rst, Section "Virtual EPC" >>> [6]https://lore.kernel.org/linux-sgx/20220905020411.17290-1-jarkko@kernel.org/ >>> [7]https://lore.kernel.org/linux-sgx/ZLcXmvDKheCRYOjG@slm.duckdns.org/ >>> [8]https://lore.kernel.org/linux-sgx/20230721120231.13916-1-haitao.huang@linux.intel.com/ >>> [9]https://lore.kernel.org/linux-sgx/20230728051024.33063-1-haitao.huang@linux.intel.com/ >>> [10]https://lore.kernel.org/all/20230923030657.16148-1-haitao.huang@linux.intel.com/ >>> >>> Haitao Huang (2): >>> x86/sgx: Introduce EPC page states >>> selftests/sgx: Add scripts for EPC cgroup testing >>> >>> Kristen Carlson Accardi (5): >>> cgroup/misc: Add per resource callbacks for CSS events >>> cgroup/misc: Export APIs for SGX driver >>> cgroup/misc: Add SGX EPC resource type >>> x86/sgx: Implement basic EPC misc cgroup functionality >>> x86/sgx: Implement EPC reclamation for cgroup >>> >>> Sean Christopherson (5): >>> x86/sgx: Add sgx_epc_lru_list to encapsulate LRU list >>> x86/sgx: Use sgx_epc_lru_list for existing active page list >>> x86/sgx: Use a list to track to-be-reclaimed pages >>> x86/sgx: Restructure top-level EPC reclaim function >>> Docs/x86/sgx: Add description for cgroup support >>> >>> Documentation/arch/x86/sgx.rst | 74 ++++ >>> arch/x86/Kconfig | 13 + >>> arch/x86/kernel/cpu/sgx/Makefile | 1 + >>> arch/x86/kernel/cpu/sgx/encl.c | 2 +- >>> arch/x86/kernel/cpu/sgx/epc_cgroup.c | 319 ++++++++++++++++++ >>> arch/x86/kernel/cpu/sgx/epc_cgroup.h | 49 +++ >>> arch/x86/kernel/cpu/sgx/main.c | 245 +++++++++----- >>> arch/x86/kernel/cpu/sgx/sgx.h | 88 ++++- >>> include/linux/misc_cgroup.h | 42 +++ >>> kernel/cgroup/misc.c | 52 ++- >>> .../selftests/sgx/run_epc_cg_selftests.sh | 196 +++++++++++ >>> .../selftests/sgx/watch_misc_for_tests.sh | 13 + >>> 12 files changed, 996 insertions(+), 98 deletions(-) >>> create mode 100644 arch/x86/kernel/cpu/sgx/epc_cgroup.c >>> create mode 100644 arch/x86/kernel/cpu/sgx/epc_cgroup.h >>> create mode 100755 tools/testing/selftests/sgx/run_epc_cg_selftests.sh >>> create mode 100755 tools/testing/selftests/sgx/watch_misc_for_tests.sh >>> >> >> Is this expected to work on NUC7? >> >> Planning to test this next week (no time this week). >> >> BR, Jarkko > > I don't see a reason why it would not be working on a NUC. I'll try to > get access to one and test it too. Tried on a NUC with about 90M EPC. The selftests worked fine. BR Haitao
There's very little about how the LRU design came to be in this cover letter. Let's add some details. How's this? Writing this up, I'm a lot more convinced that this series is, in general, taking the right approach. I honestly don't see any other alternatives. As much as I'd love to do something stupidly simple like just killing enclaves at the moment they hit the limit, that would be a horrid experience for users _and_ a departure from what the existing reclaim support does. That said, there's still a lot of work do to do refactor this series. It's in need of some love to make it more clear what is going on and to making the eventual switch over to per-cgroup LRUs more gradual. Each patch in the series is still doing way too much, _especially_ in patch 10. == The existing EPC memory management aims to be a miniature version of the core VM where EPC memory can be overcommitted and reclaimed. EPC allocations can wait for reclaim. The alternative to waiting would have been to send a signal and let the enclave die. This series attempts to implement that same logic for cgroups, for the same reasons: it's preferable to wait for memory to become available and let reclaim happen than to do things that are fatal to enclaves. There is currently a global reclaimable page SGX LRU list. That list (and the existing scanning algorithm) is essentially useless for doing reclaim when a cgroup hits its limit because the cgroup's pages are scattered around that LRU. It is unspeakably inefficient to scan a linked list with millions of entries for what could be dozens of pages from a cgroup that needs reclaim. Even if unspeakably slow reclaim was accepted, the existing scanning algorithm only picks a few pages off the head of the global LRU. It would either need to hold the list locks for unreasonable amounts of time, or be taught to scan the list in pieces, which has its own challenges. tl;dr: An cgroup hitting its limit should be as similar as possible to the system running out of EPC memory. The only two choices to implement that are nasty changes the existing LRU scanning algorithm, or to add new LRUs. The result: Add a new LRU for each cgroup and scans those instead. Replace the existing global cgroup with the root cgroup's LRU (only when this new support is compiled in, obviously).
On Fri, 05 Jan 2024 12:29:05 -0600, Dave Hansen <dave.hansen@intel.com> wrote: > There's very little about how the LRU design came to be in this cover > letter. Let's add some details. > > How's this? > > Writing this up, I'm a lot more convinced that this series is, in > general, taking the right approach. I honestly don't see any other > alternatives. As much as I'd love to do something stupidly simple like > just killing enclaves at the moment they hit the limit, that would be a > horrid experience for users _and_ a departure from what the existing > reclaim support does. > > That said, there's still a lot of work do to do refactor this series. > It's in need of some love to make it more clear what is going on and to > making the eventual switch over to per-cgroup LRUs more gradual. Each > patch in the series is still doing way too much, _especially_ in patch > 10. > > == > > The existing EPC memory management aims to be a miniature version of the > core VM where EPC memory can be overcommitted and reclaimed. EPC > allocations can wait for reclaim. The alternative to waiting would have > been to send a signal and let the enclave die. > > This series attempts to implement that same logic for cgroups, for the > same reasons: it's preferable to wait for memory to become available and > let reclaim happen than to do things that are fatal to enclaves. > > There is currently a global reclaimable page SGX LRU list. That list > (and the existing scanning algorithm) is essentially useless for doing > reclaim when a cgroup hits its limit because the cgroup's pages are > scattered around that LRU. It is unspeakably inefficient to scan a > linked list with millions of entries for what could be dozens of pages > from a cgroup that needs reclaim. > > Even if unspeakably slow reclaim was accepted, the existing scanning > algorithm only picks a few pages off the head of the global LRU. It > would either need to hold the list locks for unreasonable amounts of > time, or be taught to scan the list in pieces, which has its own > challenges. > > tl;dr: An cgroup hitting its limit should be as similar as possible to > the system running out of EPC memory. The only two choices to implement > that are nasty changes the existing LRU scanning algorithm, or to add > new LRUs. The result: Add a new LRU for each cgroup and scans those > instead. Replace the existing global cgroup with the root cgroup's LRU > (only when this new support is compiled in, obviously). > I'll add this to the cover letter as a section justifying the LRU design for per-cgroup reclaiming. Thank you very much. Haitao
SGX Enclave Page Cache (EPC) memory allocations are separate from normal RAM allocations, and are managed solely by the SGX subsystem. The existing cgroup memory controller cannot be used to limit or account for SGX EPC memory, which is a desirable feature in some environments, e.g., support for pod level control in a Kubernates cluster on a VM or baremetal host [1,2]. This patchset implements the support for sgx_epc memory within the misc cgroup controller. The user can use the misc cgroup controller to set and enforce a max limit on total EPC usage per cgroup. The implementation reports current usage and events of reaching the limit per cgroup as well as the total system capacity. With the EPC misc controller enabled, every EPC page allocation is accounted for a cgroup's usage, reflected in the 'sgx_epc' entry in the 'misc.current' interface file of the cgroup. Much like normal system memory, EPC memory can be overcommitted via virtual memory techniques and pages can be swapped out of the EPC to their backing store (normal system memory allocated via shmem, accounted by the memory controller). When the EPC usage of a cgroup reaches its hard limit ('sgx_epc' entry in the 'misc.max' file), the cgroup starts a reclamation process to swap out some EPC pages within the same cgroup and its descendant to their backing store. Although the SGX architecture supports swapping for all pages, to avoid extra complexities, this implementation does not support swapping for certain page types, e.g. Version Array(VA) pages, and treat them as unreclaimable pages. When the limit is reached but nothing left in the cgroup for reclamation, i.e., only unreclaimable pages left, any new EPC allocation in the cgroup will result in an ENOMEM error. The EPC pages allocated for guest VMs by the virtual EPC driver are not reclaimable by the host kernel [5]. Therefore they are also treated as unreclaimable from cgroup's point of view. And the virtual EPC driver translates an ENOMEM error resulted from an EPC allocation request into a SIGBUS to the user process. This work was originally authored by Sean Christopherson a few years ago, and previously modified by Kristen C. Accardi to utilize the misc cgroup controller rather than a custom controller. I have been updating the patches based on review comments since V2 [3, 4, 10], simplified the implementation/design and fixed some stability issues found from testing. The patches are organized as following: - Patches 1-3 are prerequisite misc cgroup changes for adding new APIs, structs, resource types. - Patch 4 implements basic misc controller for EPC without reclamation. - Patches 5-9 prepare for per-cgroup reclamation. * Separate out the existing infrastructure of tracking reclaimable pages from the global reclaimer(ksgxd) to a newly created LRU list struct. * Separate out reusable top-level functions for reclamation. - Patch 10 adds support for per-cgroup reclamation. - Patch 11 adds documentation for the EPC cgroup. - Patch 12 adds test scripts. I appreciate your review and providing tags if appropriate. --- V6: - Dropped OOM killing path, only implement non-preemptive enforcement of max limit (Dave, Michal) - Simplified reclamation flow by taking out sgx_epc_reclaim_control, forced reclamation by ignoring 'age". - Restructured patches: split misc API + resource types patch and the big EPC cgroup patch (Kai, Michal) - Dropped some Tested-by/Reviewed-by tags due to significant changes - Added more selftests v5: - Replace the manual test script with a selftest script. - Restore the "From" tag for some patches to Sean (Kai) - Style fixes (Jarkko) v4: - Collected "Tested-by" from Mikko. I kept it for now as no functional changes in v4. - Rebased on to v6.6_rc1 and reordered patches as described above. - Separated out the bug fixes [7,8,9]. This series depend on those patches. (Dave, Jarkko) - Added comments in commit message to give more preview what's to come next. (Jarkko) - Fixed some documentation error, gap, style (Mikko, Randy) - Fixed some comments, typo, style in code (Mikko, Kai) - Patch format and background for reclaimable vs unreclaimable (Kai, Jarkko) - Fixed typo (Pavel) - Exclude the previous fixes/enhancements for self-tests. Patch 18 now depends on series [6] - Use the same to list for cover and all patches. (Solo) v3: - Added EPC states to replace flags in sgx_epc_page struct. (Jarkko) - Unrolled wrappers for cond_resched, list (Dave) - Separate patches for adding reclaimable and unreclaimable lists. (Dave) - Other improvements on patch flow, commit messages, styles. (Dave, Jarkko) - Simplified the cgroup tree walking with plain css_for_each_descendant_pre. - Fixed race conditions and crashes. - OOM killer to wait for the victim enclave pages being reclaimed. - Unblock the user by handling misc_max_write callback asynchronously. - Rebased onto 6.4 and no longer base this series on the MCA patchset. - Fix an overflow in misc_try_charge. - Fix a NULL pointer in SGX PF handler. - Updated and included the SGX selftest patches previously reviewed. Those patches fix issues triggered in high EPC pressure required for cgroup testing. - Added test scripts to help setup and test SGX EPC cgroups. [1]https://lore.kernel.org/all/DM6PR21MB11772A6ED915825854B419D6C4989@DM6PR21MB1177.namprd21.prod.outlook.com/ [2]https://lore.kernel.org/all/ZD7Iutppjj+muH4p@himmelriiki/ [3]https://lore.kernel.org/all/20221202183655.3767674-1-kristen@linux.intel.com/ [4]https://lore.kernel.org/linux-sgx/20230712230202.47929-1-haitao.huang@linux.intel.com/ [5]Documentation/arch/x86/sgx.rst, Section "Virtual EPC" [6]https://lore.kernel.org/linux-sgx/20220905020411.17290-1-jarkko@kernel.org/ [7]https://lore.kernel.org/linux-sgx/ZLcXmvDKheCRYOjG@slm.duckdns.org/ [8]https://lore.kernel.org/linux-sgx/20230721120231.13916-1-haitao.huang@linux.intel.com/ [9]https://lore.kernel.org/linux-sgx/20230728051024.33063-1-haitao.huang@linux.intel.com/ [10]https://lore.kernel.org/all/20230923030657.16148-1-haitao.huang@linux.intel.com/ Haitao Huang (2): x86/sgx: Introduce EPC page states selftests/sgx: Add scripts for EPC cgroup testing Kristen Carlson Accardi (5): cgroup/misc: Add per resource callbacks for CSS events cgroup/misc: Export APIs for SGX driver cgroup/misc: Add SGX EPC resource type x86/sgx: Implement basic EPC misc cgroup functionality x86/sgx: Implement EPC reclamation for cgroup Sean Christopherson (5): x86/sgx: Add sgx_epc_lru_list to encapsulate LRU list x86/sgx: Use sgx_epc_lru_list for existing active page list x86/sgx: Use a list to track to-be-reclaimed pages x86/sgx: Restructure top-level EPC reclaim function Docs/x86/sgx: Add description for cgroup support Documentation/arch/x86/sgx.rst | 74 ++++ arch/x86/Kconfig | 13 + arch/x86/kernel/cpu/sgx/Makefile | 1 + arch/x86/kernel/cpu/sgx/encl.c | 2 +- arch/x86/kernel/cpu/sgx/epc_cgroup.c | 319 ++++++++++++++++++ arch/x86/kernel/cpu/sgx/epc_cgroup.h | 49 +++ arch/x86/kernel/cpu/sgx/main.c | 245 +++++++++----- arch/x86/kernel/cpu/sgx/sgx.h | 88 ++++- include/linux/misc_cgroup.h | 42 +++ kernel/cgroup/misc.c | 52 ++- .../selftests/sgx/run_epc_cg_selftests.sh | 196 +++++++++++ .../selftests/sgx/watch_misc_for_tests.sh | 13 + 12 files changed, 996 insertions(+), 98 deletions(-) create mode 100644 arch/x86/kernel/cpu/sgx/epc_cgroup.c create mode 100644 arch/x86/kernel/cpu/sgx/epc_cgroup.h create mode 100755 tools/testing/selftests/sgx/run_epc_cg_selftests.sh create mode 100755 tools/testing/selftests/sgx/watch_misc_for_tests.sh