code review 74070043: runtime: improve efence

runtime: improve efence
Mark free memory blocks as unused.
On amd64 it allows the process to eat all 128 GB of heap
without killing the machine.

[dvyukov, 2014-03-11 16:44:52]

Hello rsc@golang.org (cc: golang-codereviews@googlegroups.com),

I'd like you to review this change to
https://dvyukov%40google.com@code.google.com/p/go/

[rsc, 2014-03-13 03:07:56]

LGTM

Oh, so if you mmap PROT_NONE over something the operating system keeps it
around in case you came along later and gave it different permissions?
Sheesh. We're calling mmap, not mprotect.

[dvyukov, 2014-03-13 06:20:43]

On 2014/03/13 03:07:56, rsc wrote:
> LGTM
> 
> Oh, so if you mmap PROT_NONE over something the operating system keeps it
> around in case you came along later and gave it different permissions?
> Sheesh. We're calling mmap, not mprotect.


uh

I've seen excessive memory (RSS) consumption that kills my machine, and assumed
that OS keeps contents of SysFault memory in case we "unprotect" it later.

But now that you've said this...

This is what we do now:

int main() {
	void *p = mmap(0, 4096, PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE, -1, 0);
	((int*)p)[42] = 42;
	if(mmap(p, 4096, PROT_NONE, 0, -1, 0) == MAP_FAILED)
		perror("mmap2");
	printf("%d\n", ((int*)p)[42]);
	if(mmap(p, 4096, PROT_READ|PROT_WRITE, MAP_ANON|MAP_PRIVATE|MAP_FIXED, -1, 0)
== MAP_FAILED)
		perror("mmap3");
	printf("%d\n", ((int*)p)[42]);
}

output:
mmap2: Bad file descriptor
42
0

So SysFault just fails and does nothing.

The following is better:

	if(mmap(p, 4096, PROT_NONE, MAP_ANON|MAP_PRIVATE, -1, 0) == MAP_FAILED)
		perror("mmap2");

but output is still:
42
0

So the mmap just gives us anew region of PROT_NONE memory.

And the following:

	if(mmap(p, 4096, PROT_NONE, MAP_ANON|MAP_PRIVATE|MAP_FIXED, -1, 0) ==
MAP_FAILED)
		perror("mmap2");

is what we need. Output is:
Segmentation fault (core dumped)

and if I comment out the first printf (that is intended to access protected
memory):
0

so the contents of the memory are not preserved (as you expected).

And with this last code, I can run a Go process till "fatal error: runtime: out
of memory" but it consumes only 2GB of RSS.

PTAL

[rsc, 2014-03-13 13:39:39]

LGTM

much better; thanks for digging into it

[dvyukov, 2014-03-13 15:04:04]

*** Submitted as https://code.google.com/p/go/source/detail?r=83227883e5d0 ***

runtime: improve efence
Mark free memory blocks as unused.
On amd64 it allows the process to eat all 128 GB of heap
without killing the machine.

LGTM=rsc
R=rsc
CC=golang-codereviews
https://codereview.appspot.com/74070043

[gobot, 2014-03-13 16:51:38]

This CL appears to have broken the windows-386-ec2 builder.