1 // SPDX-License-Identifier: GPL-2.0-only 2 /* Copyright (c) 2022 Meta Platforms, Inc. and affiliates. */ 3 #include <linux/mm.h> 4 #include <linux/llist.h> 5 #include <linux/bpf.h> 6 #include <linux/irq_work.h> 7 #include <linux/bpf_mem_alloc.h> 8 #include <linux/memcontrol.h> 9 #include <asm/local.h> 10 11 /* Any context (including NMI) BPF specific memory allocator. 12 * 13 * Tracing BPF programs can attach to kprobe and fentry. Hence they 14 * run in unknown context where calling plain kmalloc() might not be safe. 15 * 16 * Front-end kmalloc() with per-cpu per-bucket cache of free elements. 17 * Refill this cache asynchronously from irq_work. 18 * 19 * CPU_0 buckets 20 * 16 32 64 96 128 196 256 512 1024 2048 4096 21 * ... 22 * CPU_N buckets 23 * 16 32 64 96 128 196 256 512 1024 2048 4096 24 * 25 * The buckets are prefilled at the start. 26 * BPF programs always run with migration disabled. 27 * It's safe to allocate from cache of the current cpu with irqs disabled. 28 * Free-ing is always done into bucket of the current cpu as well. 29 * irq_work trims extra free elements from buckets with kfree 30 * and refills them with kmalloc, so global kmalloc logic takes care 31 * of freeing objects allocated by one cpu and freed on another. 32 * 33 * Every allocated objected is padded with extra 8 bytes that contains 34 * struct llist_node. 35 */ 36 #define LLIST_NODE_SZ sizeof(struct llist_node) 37 38 /* similar to kmalloc, but sizeof == 8 bucket is gone */ 39 static u8 size_index[24] __ro_after_init = { 40 3, /* 8 */ 41 3, /* 16 */ 42 4, /* 24 */ 43 4, /* 32 */ 44 5, /* 40 */ 45 5, /* 48 */ 46 5, /* 56 */ 47 5, /* 64 */ 48 1, /* 72 */ 49 1, /* 80 */ 50 1, /* 88 */ 51 1, /* 96 */ 52 6, /* 104 */ 53 6, /* 112 */ 54 6, /* 120 */ 55 6, /* 128 */ 56 2, /* 136 */ 57 2, /* 144 */ 58 2, /* 152 */ 59 2, /* 160 */ 60 2, /* 168 */ 61 2, /* 176 */ 62 2, /* 184 */ 63 2 /* 192 */ 64 }; 65 66 static int bpf_mem_cache_idx(size_t size) 67 { 68 if (!size || size > 4096) 69 return -1; 70 71 if (size <= 192) 72 return size_index[(size - 1) / 8] - 1; 73 74 return fls(size - 1) - 2; 75 } 76 77 #define NUM_CACHES 11 78 79 struct bpf_mem_cache { 80 /* per-cpu list of free objects of size 'unit_size'. 81 * All accesses are done with interrupts disabled and 'active' counter 82 * protection with __llist_add() and __llist_del_first(). 83 */ 84 struct llist_head free_llist; 85 local_t active; 86 87 /* Operations on the free_list from unit_alloc/unit_free/bpf_mem_refill 88 * are sequenced by per-cpu 'active' counter. But unit_free() cannot 89 * fail. When 'active' is busy the unit_free() will add an object to 90 * free_llist_extra. 91 */ 92 struct llist_head free_llist_extra; 93 94 struct irq_work refill_work; 95 struct obj_cgroup *objcg; 96 int unit_size; 97 /* count of objects in free_llist */ 98 int free_cnt; 99 int low_watermark, high_watermark, batch; 100 int percpu_size; 101 bool draining; 102 struct bpf_mem_cache *tgt; 103 104 /* list of objects to be freed after RCU tasks trace GP */ 105 struct llist_head free_by_rcu_ttrace; 106 struct llist_head waiting_for_gp_ttrace; 107 struct rcu_head rcu_ttrace; 108 atomic_t call_rcu_ttrace_in_progress; 109 }; 110 111 struct bpf_mem_caches { 112 struct bpf_mem_cache cache[NUM_CACHES]; 113 }; 114 115 static struct llist_node notrace *__llist_del_first(struct llist_head *head) 116 { 117 struct llist_node *entry, *next; 118 119 entry = head->first; 120 if (!entry) 121 return NULL; 122 next = entry->next; 123 head->first = next; 124 return entry; 125 } 126 127 static void *__alloc(struct bpf_mem_cache *c, int node, gfp_t flags) 128 { 129 if (c->percpu_size) { 130 void **obj = kmalloc_node(c->percpu_size, flags, node); 131 void *pptr = __alloc_percpu_gfp(c->unit_size, 8, flags); 132 133 if (!obj || !pptr) { 134 free_percpu(pptr); 135 kfree(obj); 136 return NULL; 137 } 138 obj[1] = pptr; 139 return obj; 140 } 141 142 return kmalloc_node(c->unit_size, flags | __GFP_ZERO, node); 143 } 144 145 static struct mem_cgroup *get_memcg(const struct bpf_mem_cache *c) 146 { 147 #ifdef CONFIG_MEMCG_KMEM 148 if (c->objcg) 149 return get_mem_cgroup_from_objcg(c->objcg); 150 #endif 151 152 #ifdef CONFIG_MEMCG 153 return root_mem_cgroup; 154 #else 155 return NULL; 156 #endif 157 } 158 159 static void inc_active(struct bpf_mem_cache *c, unsigned long *flags) 160 { 161 if (IS_ENABLED(CONFIG_PREEMPT_RT)) 162 /* In RT irq_work runs in per-cpu kthread, so disable 163 * interrupts to avoid preemption and interrupts and 164 * reduce the chance of bpf prog executing on this cpu 165 * when active counter is busy. 166 */ 167 local_irq_save(*flags); 168 /* alloc_bulk runs from irq_work which will not preempt a bpf 169 * program that does unit_alloc/unit_free since IRQs are 170 * disabled there. There is no race to increment 'active' 171 * counter. It protects free_llist from corruption in case NMI 172 * bpf prog preempted this loop. 173 */ 174 WARN_ON_ONCE(local_inc_return(&c->active) != 1); 175 } 176 177 static void dec_active(struct bpf_mem_cache *c, unsigned long flags) 178 { 179 local_dec(&c->active); 180 if (IS_ENABLED(CONFIG_PREEMPT_RT)) 181 local_irq_restore(flags); 182 } 183 184 static void add_obj_to_free_list(struct bpf_mem_cache *c, void *obj) 185 { 186 unsigned long flags; 187 188 inc_active(c, &flags); 189 __llist_add(obj, &c->free_llist); 190 c->free_cnt++; 191 dec_active(c, flags); 192 } 193 194 /* Mostly runs from irq_work except __init phase. */ 195 static void alloc_bulk(struct bpf_mem_cache *c, int cnt, int node) 196 { 197 struct mem_cgroup *memcg = NULL, *old_memcg; 198 void *obj; 199 int i; 200 201 for (i = 0; i < cnt; i++) { 202 /* 203 * For every 'c' llist_del_first(&c->free_by_rcu_ttrace); is 204 * done only by one CPU == current CPU. Other CPUs might 205 * llist_add() and llist_del_all() in parallel. 206 */ 207 obj = llist_del_first(&c->free_by_rcu_ttrace); 208 if (!obj) 209 break; 210 add_obj_to_free_list(c, obj); 211 } 212 if (i >= cnt) 213 return; 214 215 memcg = get_memcg(c); 216 old_memcg = set_active_memcg(memcg); 217 for (; i < cnt; i++) { 218 /* Allocate, but don't deplete atomic reserves that typical 219 * GFP_ATOMIC would do. irq_work runs on this cpu and kmalloc 220 * will allocate from the current numa node which is what we 221 * want here. 222 */ 223 obj = __alloc(c, node, GFP_NOWAIT | __GFP_NOWARN | __GFP_ACCOUNT); 224 if (!obj) 225 break; 226 add_obj_to_free_list(c, obj); 227 } 228 set_active_memcg(old_memcg); 229 mem_cgroup_put(memcg); 230 } 231 232 static void free_one(void *obj, bool percpu) 233 { 234 if (percpu) { 235 free_percpu(((void **)obj)[1]); 236 kfree(obj); 237 return; 238 } 239 240 kfree(obj); 241 } 242 243 static int free_all(struct llist_node *llnode, bool percpu) 244 { 245 struct llist_node *pos, *t; 246 int cnt = 0; 247 248 llist_for_each_safe(pos, t, llnode) { 249 free_one(pos, percpu); 250 cnt++; 251 } 252 return cnt; 253 } 254 255 static void __free_rcu(struct rcu_head *head) 256 { 257 struct bpf_mem_cache *c = container_of(head, struct bpf_mem_cache, rcu_ttrace); 258 259 free_all(llist_del_all(&c->waiting_for_gp_ttrace), !!c->percpu_size); 260 atomic_set(&c->call_rcu_ttrace_in_progress, 0); 261 } 262 263 static void __free_rcu_tasks_trace(struct rcu_head *head) 264 { 265 /* If RCU Tasks Trace grace period implies RCU grace period, 266 * there is no need to invoke call_rcu(). 267 */ 268 if (rcu_trace_implies_rcu_gp()) 269 __free_rcu(head); 270 else 271 call_rcu(head, __free_rcu); 272 } 273 274 static void enque_to_free(struct bpf_mem_cache *c, void *obj) 275 { 276 struct llist_node *llnode = obj; 277 278 /* bpf_mem_cache is a per-cpu object. Freeing happens in irq_work. 279 * Nothing races to add to free_by_rcu_ttrace list. 280 */ 281 llist_add(llnode, &c->free_by_rcu_ttrace); 282 } 283 284 static void do_call_rcu_ttrace(struct bpf_mem_cache *c) 285 { 286 struct llist_node *llnode, *t; 287 288 if (atomic_xchg(&c->call_rcu_ttrace_in_progress, 1)) { 289 if (unlikely(READ_ONCE(c->draining))) { 290 llnode = llist_del_all(&c->free_by_rcu_ttrace); 291 free_all(llnode, !!c->percpu_size); 292 } 293 return; 294 } 295 296 WARN_ON_ONCE(!llist_empty(&c->waiting_for_gp_ttrace)); 297 llist_for_each_safe(llnode, t, llist_del_all(&c->free_by_rcu_ttrace)) 298 /* There is no concurrent __llist_add(waiting_for_gp_ttrace) access. 299 * It doesn't race with llist_del_all either. 300 * But there could be two concurrent llist_del_all(waiting_for_gp_ttrace): 301 * from __free_rcu() and from drain_mem_cache(). 302 */ 303 __llist_add(llnode, &c->waiting_for_gp_ttrace); 304 305 if (unlikely(READ_ONCE(c->draining))) { 306 __free_rcu(&c->rcu_ttrace); 307 return; 308 } 309 310 /* Use call_rcu_tasks_trace() to wait for sleepable progs to finish. 311 * If RCU Tasks Trace grace period implies RCU grace period, free 312 * these elements directly, else use call_rcu() to wait for normal 313 * progs to finish and finally do free_one() on each element. 314 */ 315 call_rcu_tasks_trace(&c->rcu_ttrace, __free_rcu_tasks_trace); 316 } 317 318 static void free_bulk(struct bpf_mem_cache *c) 319 { 320 struct bpf_mem_cache *tgt = c->tgt; 321 struct llist_node *llnode, *t; 322 unsigned long flags; 323 int cnt; 324 325 WARN_ON_ONCE(tgt->unit_size != c->unit_size); 326 327 do { 328 inc_active(c, &flags); 329 llnode = __llist_del_first(&c->free_llist); 330 if (llnode) 331 cnt = --c->free_cnt; 332 else 333 cnt = 0; 334 dec_active(c, flags); 335 if (llnode) 336 enque_to_free(tgt, llnode); 337 } while (cnt > (c->high_watermark + c->low_watermark) / 2); 338 339 /* and drain free_llist_extra */ 340 llist_for_each_safe(llnode, t, llist_del_all(&c->free_llist_extra)) 341 enque_to_free(tgt, llnode); 342 do_call_rcu_ttrace(tgt); 343 } 344 345 static void bpf_mem_refill(struct irq_work *work) 346 { 347 struct bpf_mem_cache *c = container_of(work, struct bpf_mem_cache, refill_work); 348 int cnt; 349 350 /* Racy access to free_cnt. It doesn't need to be 100% accurate */ 351 cnt = c->free_cnt; 352 if (cnt < c->low_watermark) 353 /* irq_work runs on this cpu and kmalloc will allocate 354 * from the current numa node which is what we want here. 355 */ 356 alloc_bulk(c, c->batch, NUMA_NO_NODE); 357 else if (cnt > c->high_watermark) 358 free_bulk(c); 359 } 360 361 static void notrace irq_work_raise(struct bpf_mem_cache *c) 362 { 363 irq_work_queue(&c->refill_work); 364 } 365 366 /* For typical bpf map case that uses bpf_mem_cache_alloc and single bucket 367 * the freelist cache will be elem_size * 64 (or less) on each cpu. 368 * 369 * For bpf programs that don't have statically known allocation sizes and 370 * assuming (low_mark + high_mark) / 2 as an average number of elements per 371 * bucket and all buckets are used the total amount of memory in freelists 372 * on each cpu will be: 373 * 64*16 + 64*32 + 64*64 + 64*96 + 64*128 + 64*196 + 64*256 + 32*512 + 16*1024 + 8*2048 + 4*4096 374 * == ~ 116 Kbyte using below heuristic. 375 * Initialized, but unused bpf allocator (not bpf map specific one) will 376 * consume ~ 11 Kbyte per cpu. 377 * Typical case will be between 11K and 116K closer to 11K. 378 * bpf progs can and should share bpf_mem_cache when possible. 379 */ 380 381 static void prefill_mem_cache(struct bpf_mem_cache *c, int cpu) 382 { 383 init_irq_work(&c->refill_work, bpf_mem_refill); 384 if (c->unit_size <= 256) { 385 c->low_watermark = 32; 386 c->high_watermark = 96; 387 } else { 388 /* When page_size == 4k, order-0 cache will have low_mark == 2 389 * and high_mark == 6 with batch alloc of 3 individual pages at 390 * a time. 391 * 8k allocs and above low == 1, high == 3, batch == 1. 392 */ 393 c->low_watermark = max(32 * 256 / c->unit_size, 1); 394 c->high_watermark = max(96 * 256 / c->unit_size, 3); 395 } 396 c->batch = max((c->high_watermark - c->low_watermark) / 4 * 3, 1); 397 398 /* To avoid consuming memory assume that 1st run of bpf 399 * prog won't be doing more than 4 map_update_elem from 400 * irq disabled region 401 */ 402 alloc_bulk(c, c->unit_size <= 256 ? 4 : 1, cpu_to_node(cpu)); 403 } 404 405 /* When size != 0 bpf_mem_cache for each cpu. 406 * This is typical bpf hash map use case when all elements have equal size. 407 * 408 * When size == 0 allocate 11 bpf_mem_cache-s for each cpu, then rely on 409 * kmalloc/kfree. Max allocation size is 4096 in this case. 410 * This is bpf_dynptr and bpf_kptr use case. 411 */ 412 int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu) 413 { 414 static u16 sizes[NUM_CACHES] = {96, 192, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096}; 415 struct bpf_mem_caches *cc, __percpu *pcc; 416 struct bpf_mem_cache *c, __percpu *pc; 417 struct obj_cgroup *objcg = NULL; 418 int cpu, i, unit_size, percpu_size = 0; 419 420 if (size) { 421 pc = __alloc_percpu_gfp(sizeof(*pc), 8, GFP_KERNEL); 422 if (!pc) 423 return -ENOMEM; 424 425 if (percpu) 426 /* room for llist_node and per-cpu pointer */ 427 percpu_size = LLIST_NODE_SZ + sizeof(void *); 428 else 429 size += LLIST_NODE_SZ; /* room for llist_node */ 430 unit_size = size; 431 432 #ifdef CONFIG_MEMCG_KMEM 433 if (memcg_bpf_enabled()) 434 objcg = get_obj_cgroup_from_current(); 435 #endif 436 for_each_possible_cpu(cpu) { 437 c = per_cpu_ptr(pc, cpu); 438 c->unit_size = unit_size; 439 c->objcg = objcg; 440 c->percpu_size = percpu_size; 441 c->tgt = c; 442 prefill_mem_cache(c, cpu); 443 } 444 ma->cache = pc; 445 return 0; 446 } 447 448 /* size == 0 && percpu is an invalid combination */ 449 if (WARN_ON_ONCE(percpu)) 450 return -EINVAL; 451 452 pcc = __alloc_percpu_gfp(sizeof(*cc), 8, GFP_KERNEL); 453 if (!pcc) 454 return -ENOMEM; 455 #ifdef CONFIG_MEMCG_KMEM 456 objcg = get_obj_cgroup_from_current(); 457 #endif 458 for_each_possible_cpu(cpu) { 459 cc = per_cpu_ptr(pcc, cpu); 460 for (i = 0; i < NUM_CACHES; i++) { 461 c = &cc->cache[i]; 462 c->unit_size = sizes[i]; 463 c->objcg = objcg; 464 c->tgt = c; 465 prefill_mem_cache(c, cpu); 466 } 467 } 468 ma->caches = pcc; 469 return 0; 470 } 471 472 static void drain_mem_cache(struct bpf_mem_cache *c) 473 { 474 bool percpu = !!c->percpu_size; 475 476 /* No progs are using this bpf_mem_cache, but htab_map_free() called 477 * bpf_mem_cache_free() for all remaining elements and they can be in 478 * free_by_rcu_ttrace or in waiting_for_gp_ttrace lists, so drain those lists now. 479 * 480 * Except for waiting_for_gp_ttrace list, there are no concurrent operations 481 * on these lists, so it is safe to use __llist_del_all(). 482 */ 483 free_all(llist_del_all(&c->free_by_rcu_ttrace), percpu); 484 free_all(llist_del_all(&c->waiting_for_gp_ttrace), percpu); 485 free_all(__llist_del_all(&c->free_llist), percpu); 486 free_all(__llist_del_all(&c->free_llist_extra), percpu); 487 } 488 489 static void free_mem_alloc_no_barrier(struct bpf_mem_alloc *ma) 490 { 491 free_percpu(ma->cache); 492 free_percpu(ma->caches); 493 ma->cache = NULL; 494 ma->caches = NULL; 495 } 496 497 static void free_mem_alloc(struct bpf_mem_alloc *ma) 498 { 499 /* waiting_for_gp_ttrace lists was drained, but __free_rcu might 500 * still execute. Wait for it now before we freeing percpu caches. 501 * 502 * rcu_barrier_tasks_trace() doesn't imply synchronize_rcu_tasks_trace(), 503 * but rcu_barrier_tasks_trace() and rcu_barrier() below are only used 504 * to wait for the pending __free_rcu_tasks_trace() and __free_rcu(), 505 * so if call_rcu(head, __free_rcu) is skipped due to 506 * rcu_trace_implies_rcu_gp(), it will be OK to skip rcu_barrier() by 507 * using rcu_trace_implies_rcu_gp() as well. 508 */ 509 rcu_barrier_tasks_trace(); 510 if (!rcu_trace_implies_rcu_gp()) 511 rcu_barrier(); 512 free_mem_alloc_no_barrier(ma); 513 } 514 515 static void free_mem_alloc_deferred(struct work_struct *work) 516 { 517 struct bpf_mem_alloc *ma = container_of(work, struct bpf_mem_alloc, work); 518 519 free_mem_alloc(ma); 520 kfree(ma); 521 } 522 523 static void destroy_mem_alloc(struct bpf_mem_alloc *ma, int rcu_in_progress) 524 { 525 struct bpf_mem_alloc *copy; 526 527 if (!rcu_in_progress) { 528 /* Fast path. No callbacks are pending, hence no need to do 529 * rcu_barrier-s. 530 */ 531 free_mem_alloc_no_barrier(ma); 532 return; 533 } 534 535 copy = kmemdup(ma, sizeof(*ma), GFP_KERNEL); 536 if (!copy) { 537 /* Slow path with inline barrier-s */ 538 free_mem_alloc(ma); 539 return; 540 } 541 542 /* Defer barriers into worker to let the rest of map memory to be freed */ 543 memset(ma, 0, sizeof(*ma)); 544 INIT_WORK(©->work, free_mem_alloc_deferred); 545 queue_work(system_unbound_wq, ©->work); 546 } 547 548 void bpf_mem_alloc_destroy(struct bpf_mem_alloc *ma) 549 { 550 struct bpf_mem_caches *cc; 551 struct bpf_mem_cache *c; 552 int cpu, i, rcu_in_progress; 553 554 if (ma->cache) { 555 rcu_in_progress = 0; 556 for_each_possible_cpu(cpu) { 557 c = per_cpu_ptr(ma->cache, cpu); 558 WRITE_ONCE(c->draining, true); 559 irq_work_sync(&c->refill_work); 560 drain_mem_cache(c); 561 rcu_in_progress += atomic_read(&c->call_rcu_ttrace_in_progress); 562 } 563 /* objcg is the same across cpus */ 564 if (c->objcg) 565 obj_cgroup_put(c->objcg); 566 destroy_mem_alloc(ma, rcu_in_progress); 567 } 568 if (ma->caches) { 569 rcu_in_progress = 0; 570 for_each_possible_cpu(cpu) { 571 cc = per_cpu_ptr(ma->caches, cpu); 572 for (i = 0; i < NUM_CACHES; i++) { 573 c = &cc->cache[i]; 574 WRITE_ONCE(c->draining, true); 575 irq_work_sync(&c->refill_work); 576 drain_mem_cache(c); 577 rcu_in_progress += atomic_read(&c->call_rcu_ttrace_in_progress); 578 } 579 } 580 if (c->objcg) 581 obj_cgroup_put(c->objcg); 582 destroy_mem_alloc(ma, rcu_in_progress); 583 } 584 } 585 586 /* notrace is necessary here and in other functions to make sure 587 * bpf programs cannot attach to them and cause llist corruptions. 588 */ 589 static void notrace *unit_alloc(struct bpf_mem_cache *c) 590 { 591 struct llist_node *llnode = NULL; 592 unsigned long flags; 593 int cnt = 0; 594 595 /* Disable irqs to prevent the following race for majority of prog types: 596 * prog_A 597 * bpf_mem_alloc 598 * preemption or irq -> prog_B 599 * bpf_mem_alloc 600 * 601 * but prog_B could be a perf_event NMI prog. 602 * Use per-cpu 'active' counter to order free_list access between 603 * unit_alloc/unit_free/bpf_mem_refill. 604 */ 605 local_irq_save(flags); 606 if (local_inc_return(&c->active) == 1) { 607 llnode = __llist_del_first(&c->free_llist); 608 if (llnode) { 609 cnt = --c->free_cnt; 610 *(struct bpf_mem_cache **)llnode = c; 611 } 612 } 613 local_dec(&c->active); 614 local_irq_restore(flags); 615 616 WARN_ON(cnt < 0); 617 618 if (cnt < c->low_watermark) 619 irq_work_raise(c); 620 return llnode; 621 } 622 623 /* Though 'ptr' object could have been allocated on a different cpu 624 * add it to the free_llist of the current cpu. 625 * Let kfree() logic deal with it when it's later called from irq_work. 626 */ 627 static void notrace unit_free(struct bpf_mem_cache *c, void *ptr) 628 { 629 struct llist_node *llnode = ptr - LLIST_NODE_SZ; 630 unsigned long flags; 631 int cnt = 0; 632 633 BUILD_BUG_ON(LLIST_NODE_SZ > 8); 634 635 /* 636 * Remember bpf_mem_cache that allocated this object. 637 * The hint is not accurate. 638 */ 639 c->tgt = *(struct bpf_mem_cache **)llnode; 640 641 local_irq_save(flags); 642 if (local_inc_return(&c->active) == 1) { 643 __llist_add(llnode, &c->free_llist); 644 cnt = ++c->free_cnt; 645 } else { 646 /* unit_free() cannot fail. Therefore add an object to atomic 647 * llist. free_bulk() will drain it. Though free_llist_extra is 648 * a per-cpu list we have to use atomic llist_add here, since 649 * it also can be interrupted by bpf nmi prog that does another 650 * unit_free() into the same free_llist_extra. 651 */ 652 llist_add(llnode, &c->free_llist_extra); 653 } 654 local_dec(&c->active); 655 local_irq_restore(flags); 656 657 if (cnt > c->high_watermark) 658 /* free few objects from current cpu into global kmalloc pool */ 659 irq_work_raise(c); 660 } 661 662 /* Called from BPF program or from sys_bpf syscall. 663 * In both cases migration is disabled. 664 */ 665 void notrace *bpf_mem_alloc(struct bpf_mem_alloc *ma, size_t size) 666 { 667 int idx; 668 void *ret; 669 670 if (!size) 671 return ZERO_SIZE_PTR; 672 673 idx = bpf_mem_cache_idx(size + LLIST_NODE_SZ); 674 if (idx < 0) 675 return NULL; 676 677 ret = unit_alloc(this_cpu_ptr(ma->caches)->cache + idx); 678 return !ret ? NULL : ret + LLIST_NODE_SZ; 679 } 680 681 void notrace bpf_mem_free(struct bpf_mem_alloc *ma, void *ptr) 682 { 683 int idx; 684 685 if (!ptr) 686 return; 687 688 idx = bpf_mem_cache_idx(ksize(ptr - LLIST_NODE_SZ)); 689 if (idx < 0) 690 return; 691 692 unit_free(this_cpu_ptr(ma->caches)->cache + idx, ptr); 693 } 694 695 void notrace *bpf_mem_cache_alloc(struct bpf_mem_alloc *ma) 696 { 697 void *ret; 698 699 ret = unit_alloc(this_cpu_ptr(ma->cache)); 700 return !ret ? NULL : ret + LLIST_NODE_SZ; 701 } 702 703 void notrace bpf_mem_cache_free(struct bpf_mem_alloc *ma, void *ptr) 704 { 705 if (!ptr) 706 return; 707 708 unit_free(this_cpu_ptr(ma->cache), ptr); 709 } 710 711 /* Directly does a kfree() without putting 'ptr' back to the free_llist 712 * for reuse and without waiting for a rcu_tasks_trace gp. 713 * The caller must first go through the rcu_tasks_trace gp for 'ptr' 714 * before calling bpf_mem_cache_raw_free(). 715 * It could be used when the rcu_tasks_trace callback does not have 716 * a hold on the original bpf_mem_alloc object that allocated the 717 * 'ptr'. This should only be used in the uncommon code path. 718 * Otherwise, the bpf_mem_alloc's free_llist cannot be refilled 719 * and may affect performance. 720 */ 721 void bpf_mem_cache_raw_free(void *ptr) 722 { 723 if (!ptr) 724 return; 725 726 kfree(ptr - LLIST_NODE_SZ); 727 } 728 729 /* When flags == GFP_KERNEL, it signals that the caller will not cause 730 * deadlock when using kmalloc. bpf_mem_cache_alloc_flags() will use 731 * kmalloc if the free_llist is empty. 732 */ 733 void notrace *bpf_mem_cache_alloc_flags(struct bpf_mem_alloc *ma, gfp_t flags) 734 { 735 struct bpf_mem_cache *c; 736 void *ret; 737 738 c = this_cpu_ptr(ma->cache); 739 740 ret = unit_alloc(c); 741 if (!ret && flags == GFP_KERNEL) { 742 struct mem_cgroup *memcg, *old_memcg; 743 744 memcg = get_memcg(c); 745 old_memcg = set_active_memcg(memcg); 746 ret = __alloc(c, NUMA_NO_NODE, GFP_KERNEL | __GFP_NOWARN | __GFP_ACCOUNT); 747 set_active_memcg(old_memcg); 748 mem_cgroup_put(memcg); 749 } 750 751 return !ret ? NULL : ret + LLIST_NODE_SZ; 752 } 753