From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A225FC433EF for ; Mon, 30 May 2022 14:22:49 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id DB4716B0071; Mon, 30 May 2022 10:22:48 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D632A6B0072; Mon, 30 May 2022 10:22:48 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C50306B0073; Mon, 30 May 2022 10:22:48 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id B5E446B0071 for ; Mon, 30 May 2022 10:22:48 -0400 (EDT) Received: from smtpin28.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay11.hostedemail.com (Postfix) with ESMTP id 8638D807E7 for ; Mon, 30 May 2022 14:22:48 +0000 (UTC) X-FDA: 79522625616.28.03115FF Received: from smtp-out1.suse.de (smtp-out1.suse.de [195.135.220.28]) by imf04.hostedemail.com (Postfix) with ESMTP id 8BBDB40010 for ; Mon, 30 May 2022 14:22:29 +0000 (UTC) Received: from relay2.suse.de (relay2.suse.de [149.44.160.134]) by smtp-out1.suse.de (Postfix) with ESMTP id 83E9721B02; Mon, 30 May 2022 14:22:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1653920560; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=R1q2pfo2QzLbUTyCNmaIYF0n/fj7XyAs77ZlAUjQ6ak=; b=lwzC5Fk0mpiDTx3KNaKbU0hkbTWL5JORAz04k/a1jlcG0T/BzcVAhTgQNNKKXmGTqPTrz4 LX+DskAB/Ytzxmb9xe7q/xAVI2oE4tZVPSqopcWzPvH5ro6oNis8YpZ9wLQ5oLCuGAqyQw PRdffCQMfEglqhDe1R6XROoKtU4kWYU= Received: from suse.cz (unknown [10.100.201.86]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by relay2.suse.de (Postfix) with ESMTPS id B16172C141; Mon, 30 May 2022 14:22:39 +0000 (UTC) Date: Mon, 30 May 2022 16:22:39 +0200 From: Michal Hocko To: Vasily Averin Cc: Andrew Morton , kernel@openvz.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Shakeel Butt , Roman Gushchin , Michal =?iso-8859-1?Q?Koutn=FD?= , Vlastimil Babka , Muchun Song , cgroups@vger.kernel.org Subject: Re: [PATCH mm v3 0/9] memcg: accounting for objects allocated by mkdir cgroup Message-ID: References: <06505918-3b8a-0ad5-5951-89ecb510138e@openvz.org> <3e1d6eab-57c7-ba3d-67e1-c45aa0dfa2ab@openvz.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Rspam-User: X-Rspamd-Queue-Id: 8BBDB40010 X-Stat-Signature: i7yckj5m4sx4taa83cacxtdjteayjok7 Authentication-Results: imf04.hostedemail.com; dkim=pass header.d=suse.com header.s=susede1 header.b=lwzC5Fk0; spf=pass (imf04.hostedemail.com: domain of mhocko@suse.com designates 195.135.220.28 as permitted sender) smtp.mailfrom=mhocko@suse.com; dmarc=pass (policy=quarantine) header.from=suse.com X-Rspamd-Server: rspam09 X-HE-Tag: 1653920549-21586 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon 30-05-22 16:09:00, Vasily Averin wrote: > On 5/30/22 14:55, Michal Hocko wrote: > > On Mon 30-05-22 14:25:45, Vasily Averin wrote: > >> Below is tracing results of mkdir /sys/fs/cgroup/vvs.test on > >> 4cpu VM with Fedora and self-complied upstream kernel. The calculations > >> are not precise, it depends on kernel config options, number of cpus, > >> enabled controllers, ignores possible page allocations etc. > >> However this is enough to clarify the general situation. > >> All allocations are splited into: > >> - common part, always called for each cgroup type > >> - per-cgroup allocations > >> > >> In each group we consider 2 corner cases: > >> - usual allocations, important for 1-2 CPU nodes/Vms > >> - percpu allocations, important for 'big irons' > >> > >> common part: ~11Kb + 318 bytes percpu > >> memcg: ~17Kb + 4692 bytes percpu > >> cpu: ~2.5Kb + 1036 bytes percpu > >> cpuset: ~3Kb + 12 bytes percpu > >> blkcg: ~3Kb + 12 bytes percpu > >> pid: ~1.5Kb + 12 bytes percpu > >> perf: ~320b + 60 bytes percpu > >> ------------------------------------------- > >> total: ~38Kb + 6142 bytes percpu > >> currently accounted: 4668 bytes percpu > >> > >> - it's important to account usual allocations called > >> in common part, because almost all of cgroup-specific allocations > >> are small. One exception here is memory cgroup, it allocates a few > >> huge objects that should be accounted. > >> - Percpu allocation called in common part, in memcg and cpu cgroups > >> should be accounted, rest ones are small an can be ignored. > >> - KERNFS objects are allocated both in common part and in most of > >> cgroups > >> > >> Details can be found here: > >> https://lore.kernel.org/all/d28233ee-bccb-7bc3-c2ec-461fd7f95e6a@openvz.org/ > >> > >> I checked other cgroups types was found that they all can be ignored. > >> Additionally I found allocation of struct rt_rq called in cpu cgroup > >> if CONFIG_RT_GROUP_SCHED was enabled, it allocates huge (~1700 bytes) > >> percpu structure and should be accounted too. > > > > One thing that the changelog is missing is an explanation why do we need > > to account those objects. Users are usually not empowered to create > > cgroups arbitrarily. Or at least they shouldn't because we can expect > > more problems to happen. > > > > Could you clarify this please? > > The problem is actual for OS-level containers: LXC or OpenVz. > They are widely used for hosting and allow to run containers > by untrusted end-users. Root inside such containers is able > to create groups inside own container and consume host memory > without its proper accounting. Is the unaccounted memory really the biggest problem here? IIRC having really huge cgroup trees can hurt quite some controllers. E.g. how does the cpu controller deal with too many or too deep hierarchies? -- Michal Hocko SUSE Labs