From: John Johansen <john.johansen@canonical.com>
To: Anil Altinay <aaltinay@google.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
LKLM <linux-kernel@vger.kernel.org>,
Sergey Senozhatsky <senozhatsky@chromium.org>,
Peter Zijlstra <peterz@infradead.org>,
Tomasz Figa <tfiga@chromium.org>,
linux-security-module@vger.kernel.org
Subject: Re: [PATCH v3] apparmor: global buffers spin lock may get contended
Date: Mon, 26 Jun 2023 17:31:37 -0700 [thread overview]
Message-ID: <31d6e8d6-0747-a282-746b-5c144a9970bb@canonical.com> (raw)
In-Reply-To: <CACCxZWO-+M-J_enENr7q1WDcu1U8vYFoytqJxAh=x-nuP268zA@mail.gmail.com>
On 6/26/23 16:33, Anil Altinay wrote:
> Hi John,
>
> I was wondering if you get a chance to work on patch v4. Please let me know if you need help with testing.
>
yeah, testing help is always much appreciated. I have a v4, and I am working on 3 alternate version to compare against, to help give a better sense if we can get away with simplifying or tweak the scaling. I should be able to post them out some time tonight.
> Best,
> Anil
>
> On Tue, Feb 21, 2023 at 1:27 PM Anil Altinay <aaltinay@google.com <mailto:aaltinay@google.com>> wrote:
>
> I can test the patch with 5.10 and 5.15 kernels in different machines.
> Just let me know which machine types you would like me to test.
>
> On Mon, Feb 20, 2023 at 12:42 AM John Johansen
> <john.johansen@canonical.com <mailto:john.johansen@canonical.com>> wrote:
> >
> > On 2/17/23 02:44, Sebastian Andrzej Siewior wrote:
> > > On 2023-02-16 16:08:10 [-0800], John Johansen wrote:
> > >> --- a/security/apparmor/lsm.c
> > >> +++ b/security/apparmor/lsm.c
> > >> @@ -49,12 +49,19 @@ union aa_buffer {
> > >> char buffer[1];
> > >> };
> > >> +struct aa_local_cache {
> > >> + unsigned int contention;
> > >> + unsigned int hold;
> > >> + struct list_head head;
> > >> +};
> > >
> > > if you stick a local_lock_t into that struct, then you could replace
> > > cache = get_cpu_ptr(&aa_local_buffers);
> > > with
> > > local_lock(&aa_local_buffers.lock);
> > > cache = this_cpu_ptr(&aa_local_buffers);
> > >
> > > You would get the preempt_disable() based locking for the per-CPU
> > > variable (as with get_cpu_ptr()) and additionally some lockdep
> > > validation which would warn if it is used outside of task context (IRQ).
> > >
> > I did look at local_locks and there was a reason I didn't use them. I
> > can't recall as the original iteration of this is over a year old now.
> > I will have to dig into it again.
> >
> > > I didn't parse completely the hold/contention logic but it seems to work
> > > ;)
> > > You check "cache->count >= 2" twice but I don't see an inc/ dec of it
> > > nor is it part of aa_local_cache.
> > >
> > sadly I messed up the reordering of this and the debug patch. This will be
> > fixed in v4.
> >
> > > I can't parse how many items can end up on the local list if the global
> > > list is locked. My guess would be more than 2 due the ->hold parameter.
> > >
> > So this iteration, forces pushing back to global list if there are already
> > two on the local list. The hold parameter just affects how long the
> > buffers remain on the local list, before trying to place them back on
> > the global list.
> >
> > Originally before the count was added more than 2 buffers could end up
> > on the local list, and having too many local buffers is a waste of
> > memory. The count got added to address this. The value of 2 (which should
> > be switched to a define) was chosen because no mediation routine currently
> > uses more than 2 buffers.
> >
> > Note that this doesn't mean that more than two buffers can be allocated
> > to a tasks on a cpu. Its possible in some cases to have a task have
> > allocated buffers and to still have buffers on the local cache list.
> >
> > > Do you have any numbers on the machine and performance it improved? It
> > > sure will be a good selling point.
> > >
> >
> > I can include some supporting info, for a 16 core machine. But it will
> > take some time to for me to get access to a bigger machine, where this
> > is much more important. Hence the call for some of the other people
> > on this thread to test.
> >
> > thanks for the feedback
> >
>
next prev parent reply other threads:[~2023-06-27 0:31 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-13 13:19 apparmor: global buffers spin lock may get contended Sergey Senozhatsky
2021-08-15 9:47 ` John Johansen
2022-10-28 9:34 ` John Johansen
2022-10-31 3:52 ` Sergey Senozhatsky
2022-10-31 3:55 ` John Johansen
2022-10-31 4:04 ` Sergey Senozhatsky
2023-02-17 0:03 ` John Johansen
2023-02-17 0:08 ` [PATCH v3] " John Johansen
2023-02-17 10:44 ` Sebastian Andrzej Siewior
2023-02-20 8:42 ` John Johansen
2023-02-21 21:27 ` Anil Altinay
2023-06-26 23:35 ` Anil Altinay
[not found] ` <CACCxZWO-+M-J_enENr7q1WDcu1U8vYFoytqJxAh=x-nuP268zA@mail.gmail.com>
2023-06-27 0:31 ` John Johansen [this message]
2023-10-06 4:18 ` Sergey Senozhatsky
2023-10-17 9:21 ` [PATCH v5 0/4] apparmor: cache buffers on percpu list if there is lock, contention John Johansen
2023-10-17 9:23 ` [PATCH v5 1/4] " John Johansen
2023-10-17 9:24 ` [PATCH v5 2/4] apparmor: exponential backoff on cache buffer contention John Johansen
2023-10-17 9:25 ` [PATCH v5 3/4] apparmor: experiment with faster backoff on global buffer John Johansen
2023-10-17 9:26 ` [PATCH v5 4/4] apparmor: limit the number of buffers in percpu cache John Johansen
2023-10-26 5:13 ` [PATCH v5 0/4] apparmor: cache buffers on percpu list if there is lock, contention Sergey Senozhatsky
[not found] ` <20221030013028.3557-1-hdanton@sina.com>
2022-10-30 6:32 ` apparmor: global buffers spin lock may get contended John Johansen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=31d6e8d6-0747-a282-746b-5c144a9970bb@canonical.com \
--to=john.johansen@canonical.com \
--cc=aaltinay@google.com \
--cc=bigeasy@linutronix.de \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=peterz@infradead.org \
--cc=senozhatsky@chromium.org \
--cc=tfiga@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).