LinuxLists.cc - [RFC PATCH 0/3] Membarrier updates

2020-09-24 17:29:47

Subject: [RFC PATCH 0/3] Membarrier updates

Please find the following membarrier updates series posted as RFC.

Feedback is welcome,

Thanks,

Mathieu

Mathieu Desnoyers (3):
sched: fix exit_mm vs membarrier (v3)
sched: membarrier: cover kthread_use_mm (v3)
sched: membarrier: document memory ordering scenarios

include/linux/sched/mm.h | 5 ++
kernel/exit.c | 12 ++++
kernel/kthread.c | 21 ++++++
kernel/sched/core.c | 3 +-
kernel/sched/idle.c | 1 +
kernel/sched/membarrier.c | 148 ++++++++++++++++++++++++++++++++++++--
kernel/sched/sched.h | 5 +-
7 files changed, 186 insertions(+), 9 deletions(-)

--
2.17.1

2020-09-24 17:29:47

by Mathieu Desnoyers

[permalink] [raw]

Subject: [RFC PATCH 1/3] sched: fix exit_mm vs membarrier (v3)

exit_mm should issue memory barriers after user-space memory accesses,
before clearing current->mm, to order user-space memory accesses
performed prior to exit_mm before clearing tsk->mm, which has the
effect of skipping the membarrier private expedited IPIs.

exit_mm should also update the runqueue's membarrier_state so
membarrier global expedited IPIs are not sent when they are not
needed.

The membarrier system call can be issued concurrently with do_exit
if we have thread groups created with CLONE_VM but not CLONE_THREAD.

Here is the scenario I have in mind:

Two thread groups are created, A and B. Thread group B is created by
issuing clone from group A with flag CLONE_VM set, but not CLONE_THREAD.
Let's assume we have a single thread within each thread group (Thread A
and Thread B).

The AFAIU we can have:

Userspace variables:

int x = 0, y = 0;

CPU 0 CPU 1
Thread A Thread B
(in thread group A) (in thread group B)

x = 1
barrier()
y = 1
exit()
exit_mm()
current->mm = NULL;
r1 = load y
membarrier()
skips CPU 0 (no IPI) because its current mm is NULL
r2 = load x
BUG_ON(r1 == 1 && r2 == 0)

Signed-off-by: Mathieu Desnoyers <[email protected]>
Cc: Peter Zijlstra (Intel) <[email protected]>
Cc: Boqun Feng <[email protected]>
Cc: Will Deacon <[email protected]>
Cc: Paul E. McKenney <[email protected]>
Cc: Nicholas Piggin <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Alan Stern <[email protected]>
Cc: [email protected]
---
Changes since v1:
- Use smp_mb__after_spinlock rather than smp_mb.
- Document race scenario in commit message.

Changes since v2:
- Introduce membarrier_update_current_mm,
- Use membarrier_update_current_mm to update rq's membarrier_state from
exit_mm.
---
include/linux/sched/mm.h | 5 +++++
kernel/exit.c | 12 ++++++++++++
kernel/sched/membarrier.c | 12 ++++++++++++
3 files changed, 29 insertions(+)

diff --git a/include/linux/sched/mm.h b/include/linux/sched/mm.h
index f889e332912f..5dd7f56baaba 100644
--- a/include/linux/sched/mm.h
+++ b/include/linux/sched/mm.h
@@ -370,6 +370,8 @@ static inline void membarrier_mm_sync_core_before_usermode(struct mm_struct *mm)

extern void membarrier_exec_mmap(struct mm_struct *mm);

+extern void membarrier_update_current_mm(struct mm_struct *next_mm);
+
#else
#ifdef CONFIG_ARCH_HAS_MEMBARRIER_CALLBACKS
static inline void membarrier_arch_switch_mm(struct mm_struct *prev,
@@ -384,6 +386,9 @@ static inline void membarrier_exec_mmap(struct mm_struct *mm)
static inline void membarrier_mm_sync_core_before_usermode(struct mm_struct *mm)
{
}
+static inline void membarrier_update_current_mm(struct mm_struct *next_mm)
+{
+}
#endif

#endif /* _LINUX_SCHED_MM_H */
diff --git a/kernel/exit.c b/kernel/exit.c
index 733e80f334e7..0767a2dbf245 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -475,7 +475,19 @@ static void exit_mm(void)
BUG_ON(mm != current->active_mm);
/* more a memory barrier than a real lock */
task_lock(current);
+ /*
+ * When a thread stops operating on an address space, the loop
+ * in membarrier_private_expedited() may not observe that
+ * tsk->mm, and the loop in membarrier_global_expedited() may
+ * not observe a MEMBARRIER_STATE_GLOBAL_EXPEDITED
+ * rq->membarrier_state, so those would not issue an IPI.
+ * Membarrier requires a memory barrier after accessing
+ * user-space memory, before clearing tsk->mm or the
+ * rq->membarrier_state.
+ */
+ smp_mb__after_spinlock();
current->mm = NULL;
+ membarrier_update_current_mm(NULL);
mmap_read_unlock(mm);
enter_lazy_tlb(mm, current);
task_unlock(current);
diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c
index 168479a7d61b..8bc8b8a888b7 100644
--- a/kernel/sched/membarrier.c
+++ b/kernel/sched/membarrier.c
@@ -63,6 +63,18 @@ void membarrier_exec_mmap(struct mm_struct *mm)
this_cpu_write(runqueues.membarrier_state, 0);
}

+void membarrier_update_current_mm(struct mm_struct *next_mm)
+{
+ struct rq *rq = this_rq();
+ int membarrier_state = 0;
+
+ if (next_mm)
+ membarrier_state = atomic_read(&next_mm->membarrier_state);
+ if (READ_ONCE(rq->membarrier_state) == membarrier_state)
+ return;
+ WRITE_ONCE(rq->membarrier_state, membarrier_state);
+}
+
static int membarrier_global_expedited(void)
{
int cpu;
--
2.17.1

2020-09-24 17:29:52

by Mathieu Desnoyers

[permalink] [raw]

Subject: [RFC PATCH 2/3] sched: membarrier: cover kthread_use_mm (v3)

Add comments and memory barrier to kthread_use_mm and kthread_unuse_mm
to allow the effect of membarrier(2) to apply to kthreads accessing
user-space memory as well.

Given that no prior kthread use this guarantee and that it only affects
kthreads, adding this guarantee does not affect user-space ABI.

Refine the check in membarrier_global_expedited to exclude runqueues
running the idle thread rather than all kthreads from the IPI cpumask.

Now that membarrier_global_expedited can IPI kthreads, the scheduler
also needs to update the runqueue's membarrier_state when entering lazy
TLB state.

Signed-off-by: Mathieu Desnoyers <[email protected]>
Cc: Peter Zijlstra (Intel) <[email protected]>
Cc: Boqun Feng <[email protected]>
Cc: Will Deacon <[email protected]>
Cc: Paul E. McKenney <[email protected]>
Cc: Nicholas Piggin <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Andrew Morton <[email protected]>
---
Changes since v1:
- Add WARN_ON_ONCE(current->mm) in play_idle_precise (PeterZ),
- Use smp_mb__after_spinlock rather than smp_mb after task_lock.

Changes since v2:
- Update the rq's membarrier state on kthread use/unuse mm,
- The scheduler must use membarrier_switch_mm for lazy TLB case as well,
now that global expedited membarrier IPIs kthreads.
---
kernel/kthread.c | 21 +++++++++++++++++++++
kernel/sched/core.c | 3 ++-
kernel/sched/idle.c | 1 +
kernel/sched/membarrier.c | 8 ++------
kernel/sched/sched.h | 5 +++--
5 files changed, 29 insertions(+), 9 deletions(-)

diff --git a/kernel/kthread.c b/kernel/kthread.c
index 3edaa380dc7b..a396734d31f3 100644
--- a/kernel/kthread.c
+++ b/kernel/kthread.c
@@ -1248,6 +1248,7 @@ void kthread_use_mm(struct mm_struct *mm)
tsk->active_mm = mm;
}
tsk->mm = mm;
+ membarrier_update_current_mm(mm);
switch_mm_irqs_off(active_mm, mm, tsk);
local_irq_enable();
task_unlock(tsk);
@@ -1255,8 +1256,19 @@ void kthread_use_mm(struct mm_struct *mm)
finish_arch_post_lock_switch();
#endif

+ /*
+ * When a kthread starts operating on an address space, the loop
+ * in membarrier_{private,global}_expedited() may not observe
+ * that tsk->mm, and not issue an IPI. Membarrier requires a
+ * memory barrier after storing to tsk->mm, before accessing
+ * user-space memory. A full memory barrier for membarrier
+ * {PRIVATE,GLOBAL}_EXPEDITED is implicitly provided by
+ * mmdrop(), or explicitly with smp_mb().
+ */
if (active_mm != mm)
mmdrop(active_mm);
+ else
+ smp_mb();

to_kthread(tsk)->oldfs = force_uaccess_begin();
}
@@ -1276,9 +1288,18 @@ void kthread_unuse_mm(struct mm_struct *mm)
force_uaccess_end(to_kthread(tsk)->oldfs);

task_lock(tsk);
+ /*
+ * When a kthread stops operating on an address space, the loop
+ * in membarrier_{private,global}_expedited() may not observe
+ * that tsk->mm, and not issue an IPI. Membarrier requires a
+ * memory barrier after accessing user-space memory, before
+ * clearing tsk->mm.
+ */
+ smp_mb__after_spinlock();
sync_mm_rss(mm);
local_irq_disable();
tsk->mm = NULL;
+ membarrier_update_current_mm(NULL);
/* active_mm is still 'mm' */
enter_lazy_tlb(mm, tsk);
local_irq_enable();
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 2d95dc3f4644..bab6f4f2809f 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -3736,6 +3736,8 @@ context_switch(struct rq *rq, struct task_struct *prev,
*/
arch_start_context_switch(prev);

+ membarrier_switch_mm(rq, prev->mm, next->mm);
+
/*
* kernel -> kernel lazy + transfer active
* user -> kernel lazy + mmgrab() active
@@ -3752,7 +3754,6 @@ context_switch(struct rq *rq, struct task_struct *prev,
else
prev->active_mm = NULL;
} else { // to user
- membarrier_switch_mm(rq, prev->active_mm, next->mm);
/*
* sys_membarrier() requires an smp_mb() between setting
* rq->curr / membarrier_switch_mm() and returning to userspace.
diff --git a/kernel/sched/idle.c b/kernel/sched/idle.c
index f324dc36fc43..f0d81a5ea471 100644
--- a/kernel/sched/idle.c
+++ b/kernel/sched/idle.c
@@ -338,6 +338,7 @@ void play_idle_precise(u64 duration_ns, u64 latency_ns)
WARN_ON_ONCE(!(current->flags & PF_KTHREAD));
WARN_ON_ONCE(!(current->flags & PF_NO_SETAFFINITY));
WARN_ON_ONCE(!duration_ns);
+ WARN_ON_ONCE(current->mm);

rcu_sleep_check();
preempt_disable();
diff --git a/kernel/sched/membarrier.c b/kernel/sched/membarrier.c
index 8bc8b8a888b7..e5246580201b 100644
--- a/kernel/sched/membarrier.c
+++ b/kernel/sched/membarrier.c
@@ -112,13 +112,9 @@ static int membarrier_global_expedited(void)
MEMBARRIER_STATE_GLOBAL_EXPEDITED))
continue;

- /*
- * Skip the CPU if it runs a kernel thread. The scheduler
- * leaves the prior task mm in place as an optimization when
- * scheduling a kthread.
- */
+ /* Skip the CPU if it runs the idle thread. */
p = rcu_dereference(cpu_rq(cpu)->curr);
- if (p->flags & PF_KTHREAD)
+ if (is_idle_task(p))
continue;

__cpumask_set_cpu(cpu, tmpmask);
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 28709f6b0975..d884959d4280 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -2592,12 +2592,13 @@ static inline void membarrier_switch_mm(struct rq *rq,
struct mm_struct *prev_mm,
struct mm_struct *next_mm)
{
- int membarrier_state;
+ int membarrier_state = 0;

if (prev_mm == next_mm)
return;

- membarrier_state = atomic_read(&next_mm->membarrier_state);
+ if (next_mm)
+ membarrier_state = atomic_read(&next_mm->membarrier_state);
if (READ_ONCE(rq->membarrier_state) == membarrier_state)
return;

--
2.17.1

2020-09-29 17:18:58

by Mathieu Desnoyers

[permalink] [raw]

Subject: Re: [RFC PATCH 0/3] Membarrier updates

----- On Sep 24, 2020, at 1:25 PM, Mathieu Desnoyers [email protected] wrote:

> Please find the following membarrier updates series posted as RFC.

Hi Peter,

I did not get any feedback on this round of RFC. Is it because it is perfect,
or because it is abysmally wrong ? :)

If it's good, then I'll post it without RFC tag.

Thanks,

Mathieu

--
Mathieu Desnoyers
EfficiOS Inc.
http://www.efficios.com

2020-10-02 08:35:31

On 10/7/2020 10:50 PM, Mathieu Desnoyers wrote:
> ----- On Oct 2, 2020, at 4:33 AM, Rong Chen [email protected] wrote:
>
>> Greeting,
>>
>> FYI, we noticed a -37.0% regression of will-it-scale.per_thread_ops due to
>> commit:
>>
>>
>> commit: bdfcae11403e5099769a7c8dc3262e3c4193edef ("[RFC PATCH 2/3] sched:
>> membarrier: cover kthread_use_mm (v3)")
>> url:
>> https://github.com/0day-ci/linux/commits/Mathieu-Desnoyers/Membarrier-updates/20200925-012549
>> base: https://git.kernel.org/cgit/linux/kernel/git/tip/tip.git
>> 848785df48835eefebe0c4eb5da7690690b0a8b7
>>
>> in testcase: will-it-scale
>> on test machine: 104 threads Skylake with 192G memory
>> with following parameters:
>>
>> nr_task: 50%
>> mode: thread
>> test: context_switch1
>> cpufreq_governor: performance
>> ucode: 0x2006906
>>
>> test-description: Will It Scale takes a testcase and runs it from 1 through to n
>> parallel copies to see if the testcase will scale. It builds both a process and
>> threads based test in order to see any differences between the two.
>> test-url: https://github.com/antonblanchard/will-it-scale
>>
>
> Hi,
>
> I would like to report what I suspect is a random thread placement issue in the
> context_switch1 test used by the 0day bot when running on a machine with hyperthread
> enabled.
>
> AFAIU the test code uses hwloc for thread placement which should theoretically ensure
> that each thread is placed on same processing unit, core and numa node between runs.
>
> We can find the test code here:
>
> https://github.com/antonblanchard/will-it-scale/blob/master/tests/context_switch1.c
>
> And the main file containing thread setup is here:
>
> https://github.com/antonblanchard/will-it-scale/blob/master/main.c
>
> AFAIU, the test is started without the "-m" switch, which therefore affinitizes
> tasks on cores rather than on processing units (SMT threads).
>
> When testcase() creates the child thread with new_task(), it basically issues:
>
> pthread_create(&threads[nr_threads++], NULL, func, arg);
>
> passing a NULL pthread_attr_t, and not executing any pre_trampoline on the child.
> The pre_trampoline would have issued hwloc_set_thread_cpubind if it were executed on
> the child, but it's not. Therefore, we expect the cpu affinity mask of the parent to
> be copied on clone and used by the child.
>
> A quick test on a machine with hyperthreading enabled shows that the cpu affinity mask
> for the parent and child has two bits set:
>
> taskset -p 1868607
> pid 1868607's current affinity mask: 10001
> taskset -p 1868606
> pid 1868606's current affinity mask: 10001
>
> So AFAIU the placement of the parent and child will be random on either the same
> processing unit, or on separate processing units within the same core.
>
> I suspect this randomness can significantly affect the performance number between
> runs, and trigger unwarranted performance regression warnings.
>
> Thanks,
>
> Mathieu
>
Yes, the randomness may happen in some special cases. But in 0-day, we
test multi times (>=3), the report is the average number.
For this case, we test 4 times, it is stable, the wave is ± 2%.
So I don't think the -37.0% regression is caused by the randomness.

0/stats.json: "will-it-scale.per_thread_ops": 105228,
1/stats.json: "will-it-scale.per_thread_ops": 100443,
2/stats.json: "will-it-scale.per_thread_ops": 98786,
3/stats.json: "will-it-scale.per_thread_ops": 102821,

c2daff748f0ea954 bdfcae11403e5099769a7c8dc32
---------------- ---------------------------
%stddev %change %stddev
\ | \
161714 ± 2% -37.0% 101819 ± 2% will-it-scale.per_thread_ops

--
Zhengjun Xing