Protect vmstats on PREEMPT_RT

PATCH Applied Mel Gorman 4 participants 10 messages Aug 5, 2021 – Sep 6, 2021

Subsystems (2)

Memory management MM core

lore

Share & tools

lore

Mel Gorman

author

2021-08-05 16:00 UTC #0 lore raw

v2 cover Protect vmstats on PREEMPT_RT

Changelog since v1
o Remove preempt_[en|dis]able_rt helper

When adding local_lock support to mm/page_alloc.c and reducing the overhead of vmstats in general, I wondered how vmstats could be safe on PREEMPT_RT as it partially relies on interrupts being disabled for the stats that must be accurate for correctness. As it turns out, the preempt-rt tree already encountered the same problem.

This series protects just the accurate counters. As Thomas expressed concern that the preempt_enable_rt() helper could be abused, this version open-codes the preemption with a comment explaining why it is necessary.

This is specific to PREEMPT_RT which cannot be enabled on mainline yet and should have no impact on !PREEMPT_RT kernels.

This patch replaces the following mmotm patches

o preempt-provide-preempt__nort-variants.patch
o mm-vmstat-protect-per-cpu-variables-with-preempt-disable-on-rt.patch

Signature · 1 line

2.31.1

Mel Gorman

author

2021-08-05 16:00 UTC #1 lore raw

PATCH v2 1/1 mm/vmstat: Protect per cpu variables with preempt disable on RT

From: Ingo Molnar <[email protected]>

Disable preemption on -RT for the vmstat code. On vanila the code runs in IRQ-off regions while on -RT it may not when stats are updated under a local_lock. "preempt_disable" ensures that the same resources is not updated in parallel due to preemption.

This patch differs from the preempt-rt version where __count_vm_event and __count_vm_events are also protected. The counters are explicitly "allowed to be to be racy" so there is no need to protect them from preemption. Only the accurate page stats that are updated by a read-modify-write need protection. This patch also differs in that a preempt_[en|dis]able_rt helper is not used. As vmstat is the only user of the helper, it was suggested that it be open-coded in vmstat.c instead of risking the helper being used in unnecessary contexts.

Signed-off-by Ingo Molnar <[email protected]>

Signed-off-by Thomas Gleixner <[email protected]>

Signed-off-by Mel Gorman <[email protected]>

---
 mm/vmstat.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

mm/vmstat.c +48 -0

index b0534e068166..2c7e7569a453 100644
@@ -319,6 +319,16 @@ void __mod_zone_page_state(struct zone *zone, enum zone_stat_item item,
 	long x;
 	long t;
 
+	/*
+	 * Accurate vmstat updates require a RMW. On !PREEMPT_RT kernels,
+	 * atomicity is provided by IRQs being disabled -- either explicitly
+	 * or via local_lock_irq. On PREEMPT_RT, local_lock_irq only disables
+	 * CPU migrations and preemption potentially corrupts a counter so
+	 * disable preemption.
+	 */
+	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+		preempt_disable();
+
 	x = delta + __this_cpu_read(*p);
 
 	t = __this_cpu_read(pcp->stat_threshold);

@@ -328,6 +338,9 @@ void __mod_zone_page_state(struct zone *zone, enum zone_stat_item item,
 		x = 0;
 	}
 	__this_cpu_write(*p, x);
+
+	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+		preempt_enable();
 }
 EXPORT_SYMBOL(__mod_zone_page_state);

@@ -350,6 +363,10 @@ void __mod_node_page_state(struct pglist_data *pgdat, enum node_stat_item item,
 		delta >>= PAGE_SHIFT;
 	}
 
+	/* See __mod_node_page_state */
+	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+		preempt_disable();
+
 	x = delta + __this_cpu_read(*p);
 
 	t = __this_cpu_read(pcp->stat_threshold);

@@ -359,6 +376,9 @@ void __mod_node_page_state(struct pglist_data *pgdat, enum node_stat_item item,
 		x = 0;
 	}
 	__this_cpu_write(*p, x);
+
+	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+		preempt_enable();
 }
 EXPORT_SYMBOL(__mod_node_page_state);

@@ -391,6 +411,10 @@ void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
 	s8 __percpu *p = pcp->vm_stat_diff + item;
 	s8 v, t;
 
+	/* See __mod_node_page_state */
+	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+		preempt_disable();
+
 	v = __this_cpu_inc_return(*p);
 	t = __this_cpu_read(pcp->stat_threshold);
 	if (unlikely(v > t)) {

@@ -399,6 +423,9 @@ void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
 		zone_page_state_add(v + overstep, zone, item);
 		__this_cpu_write(*p, -overstep);
 	}
+
+	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+		preempt_enable();
 }
 
 void __inc_node_state(struct pglist_data *pgdat, enum node_stat_item item)

@@ -409,6 +436,10 @@ void __inc_node_state(struct pglist_data *pgdat, enum node_stat_item item)
 
 	VM_WARN_ON_ONCE(vmstat_item_in_bytes(item));
 
+	/* See __mod_node_page_state */
+	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+		preempt_disable();
+
 	v = __this_cpu_inc_return(*p);
 	t = __this_cpu_read(pcp->stat_threshold);
 	if (unlikely(v > t)) {

@@ -417,6 +448,9 @@ void __inc_node_state(struct pglist_data *pgdat, enum node_stat_item item)
 		node_page_state_add(v + overstep, pgdat, item);
 		__this_cpu_write(*p, -overstep);
 	}
+
+	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+		preempt_enable();
 }
 
 void __inc_zone_page_state(struct page *page, enum zone_stat_item item)

@@ -437,6 +471,10 @@ void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
 	s8 __percpu *p = pcp->vm_stat_diff + item;
 	s8 v, t;
 
+	/* See __mod_node_page_state */
+	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+		preempt_disable();
+
 	v = __this_cpu_dec_return(*p);
 	t = __this_cpu_read(pcp->stat_threshold);
 	if (unlikely(v < - t)) {

@@ -445,6 +483,9 @@ void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
 		zone_page_state_add(v - overstep, zone, item);
 		__this_cpu_write(*p, overstep);
 	}
+
+	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+		preempt_enable();
 }
 
 void __dec_node_state(struct pglist_data *pgdat, enum node_stat_item item)

@@ -455,6 +496,10 @@ void __dec_node_state(struct pglist_data *pgdat, enum node_stat_item item)
 
 	VM_WARN_ON_ONCE(vmstat_item_in_bytes(item));
 
+	/* See __mod_node_page_state */
+	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+		preempt_disable();
+
 	v = __this_cpu_dec_return(*p);
 	t = __this_cpu_read(pcp->stat_threshold);
 	if (unlikely(v < - t)) {

@@ -463,6 +508,9 @@ void __dec_node_state(struct pglist_data *pgdat, enum node_stat_item item)
 		node_page_state_add(v - overstep, pgdat, item);
 		__this_cpu_write(*p, overstep);
 	}
+
+	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+		preempt_enable();
 }
 
 void __dec_zone_page_state(struct page *page, enum zone_stat_item item)

Signature · 1 line

2.31.1

Andrew Morton

maintainer

2021-08-05 23:22 UTC #2 lore raw

Re: [PATCH 1/1] mm/vmstat: Protect per cpu variables with preempt disable on RT

Quoted 23 lines · On Thu, 5 Aug 2021 17:00:19 +0100 Mel Gorman <[email protected]>…

From: Ingo Molnar <[email protected]>
Disable preemption on -RT for the vmstat code. On vanila the code runs in IRQ-off regions while on -RT it may not when stats are updated under a local_lock. "preempt_disable" ensures that the same resources is not updated in parallel due to preemption.
This patch differs from the preempt-rt version where __count_vm_event and __count_vm_events are also protected. The counters are explicitly "allowed to be to be racy" so there is no need to protect them from preemption. Only the accurate page stats that are updated by a read-modify-write need protection. This patch also differs in that a preempt_[en|dis]able_rt helper is not used. As vmstat is the only user of the helper, it was suggested that it be open-coded in vmstat.c instead of risking the helper being used in unnecessary contexts.
...
mm/vmstat.c +0 -0
@@ -319,6 +319,16 @@ void __mod_zone_page_state(struct zone *zone, enum zone_stat_item item,
 	long x;
 	long t;

mm/vmstat.c void __mod_zone_page_state(struct zone *zone, enum zone_stat_item item, · line 330

Quoted 10 lines

mm/vmstat.c +9 -0

 
+	/*
+	 * Accurate vmstat updates require a RMW. On !PREEMPT_RT kernels,
+	 * atomicity is provided by IRQs being disabled -- either explicitly
+	 * or via local_lock_irq. On PREEMPT_RT, local_lock_irq only disables
+	 * CPU migrations and preemption potentially corrupts a counter so
+	 * disable preemption.
+	 */
+	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+		preempt_disable();

This is so obvious I expect it has been discussed, but... why not

static inline void preempt_disable_if_rt(void)

{
	if (IS_ENABLED(CONFIG_PREEMPT_RT))
		preempt_disable();
}

Vlastimil Babka

2021-08-06 07:50 UTC #3 lore raw

Re: [PATCH 1/1] mm/vmstat: Protect per cpu variables with preempt disable on RT

Quoted 38 lines · Andrew Morton

Quoted 23 lines · On Thu, 5 Aug 2021 17:00:19 +0100 Mel Gorman <[email protected]>…
From: Ingo Molnar <[email protected]>
Disable preemption on -RT for the vmstat code. On vanila the code runs in IRQ-off regions while on -RT it may not when stats are updated under a local_lock. "preempt_disable" ensures that the same resources is not updated in parallel due to preemption.
This patch differs from the preempt-rt version where __count_vm_event and __count_vm_events are also protected. The counters are explicitly "allowed to be to be racy" so there is no need to protect them from preemption. Only the accurate page stats that are updated by a read-modify-write need protection. This patch also differs in that a preempt_[en|dis]able_rt helper is not used. As vmstat is the only user of the helper, it was suggested that it be open-coded in vmstat.c instead of risking the helper being used in unnecessary contexts.
...
mm/vmstat.c +0 -0
@@ -319,6 +319,16 @@ void __mod_zone_page_state(struct zone *zone, enum zone_stat_item item,
 	long x;
 	long t;
mm/vmstat.c void __mod_zone_page_state(struct zone *zone, enum zone_stat_item item, · line 330
Quoted 10 lines
mm/vmstat.c +9 -0
 
+	/*
+	 * Accurate vmstat updates require a RMW. On !PREEMPT_RT kernels,
+	 * atomicity is provided by IRQs being disabled -- either explicitly
+	 * or via local_lock_irq. On PREEMPT_RT, local_lock_irq only disables
+	 * CPU migrations and preemption potentially corrupts a counter so
+	 * disable preemption.
+	 */
+	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+		preempt_disable();
This is so obvious I expect it has been discussed, but... why not

Quoted 5 lines

static inline void preempt_disable_if_rt(void)
{
	if (IS_ENABLED(CONFIG_PREEMPT_RT))
		preempt_disable();
}

Yeah v1 introduced similar more generic ones in include/linux/preempt.h and Thomas didn't like that. I guess it would be more acceptable when confined to mm/vmstat.c

Mel Gorman

author

2021-08-06 08:45 UTC #4 lore raw

Re: [PATCH 1/1] mm/vmstat: Protect per cpu variables with preempt disable on RT

In reply to Andrew Morton

Quoted 38 lines · Andrew Morton

Quoted 23 lines · On Thu, 5 Aug 2021 17:00:19 +0100 Mel Gorman <[email protected]>…
From: Ingo Molnar <[email protected]>
Disable preemption on -RT for the vmstat code. On vanila the code runs in IRQ-off regions while on -RT it may not when stats are updated under a local_lock. "preempt_disable" ensures that the same resources is not updated in parallel due to preemption.
This patch differs from the preempt-rt version where __count_vm_event and __count_vm_events are also protected. The counters are explicitly "allowed to be to be racy" so there is no need to protect them from preemption. Only the accurate page stats that are updated by a read-modify-write need protection. This patch also differs in that a preempt_[en|dis]able_rt helper is not used. As vmstat is the only user of the helper, it was suggested that it be open-coded in vmstat.c instead of risking the helper being used in unnecessary contexts.
...
mm/vmstat.c +0 -0
@@ -319,6 +319,16 @@ void __mod_zone_page_state(struct zone *zone, enum zone_stat_item item,
 	long x;
 	long t;
mm/vmstat.c void __mod_zone_page_state(struct zone *zone, enum zone_stat_item item, · line 330
Quoted 10 lines
mm/vmstat.c +9 -0
 
+	/*
+	 * Accurate vmstat updates require a RMW. On !PREEMPT_RT kernels,
+	 * atomicity is provided by IRQs being disabled -- either explicitly
+	 * or via local_lock_irq. On PREEMPT_RT, local_lock_irq only disables
+	 * CPU migrations and preemption potentially corrupts a counter so
+	 * disable preemption.
+	 */
+	if (IS_ENABLED(CONFIG_PREEMPT_RT))
+		preempt_disable();
This is so obvious I expect it has been discussed, but... why not

Quoted 8 lines

static inline void preempt_disable_if_rt(void)
{
	if (IS_ENABLED(CONFIG_PREEMPT_RT))
		preempt_disable();
}
?

The changelog briefly mentions it "also differs in that a preempt_[en|dis]able_rt" helper was not used. It is preferred that the RT helper does not exist and potentially get reused in other contexts that could have a different solution. Hence, it's open-coded for mm/vmstat.c even though it looks awkward. Obviously the helper could be in mm/vmstat.c but the only name that made sense was preempt_[en|dis]able_rt and that would likely get promoted to a common header for some reason.

The vmstat counters are "special" in that they have to be fast, an accurate counter must be available cheaply and they are updated from a mix of IRQ-disabled and local_lock_irq-disabled sections where the latter only disables CPU migrations (but not preemption) on PREEMPT_RT. It's not a special case that should be encouraged but is somewhat justified given how often vmstats get updated and its performance requirements.

The alternative would be to convert vmstat counters to percpu_counters. It also takes care to protect from IRQ and preempt contexts based on comments in the code and functionally is very similar to vmstat. However, based on how it works, I think it would incur a performance regression as well as having a larger memory footprint. The use of raw IRQ-safe spinlocks risks parallel update scaling issues that vmstat avoids with with rmw, cmpxchg and atomics depending on context combined combined with workqueues to accumulate per-cpu values. Converting to percpu_counters and then modifying the implementation to be similar to vmstat might work but would also be high risk with some significant complexities such as dealing with vmstat shepherd.

Hence, I think the open-coded is justified if somewhat clumsy so indicate this is a special case we're willing to tolerate but also clumsy enough that someone trying to copy it will be forced to think heavily about their problem. The only change I'd like to make to the patch is to

s/See __mod_node_page_state/See __mod_zone_page_state/

which is based on an stupid typo compounded by cut&paste as noted by Daniel Vacek.

Signature · 2 lines

Mel Gorman
SUSE Labs

Vlastimil Babka

Acked-by on v2 1/1

2021-08-06 12:38 UTC #5 lore raw

Re: [PATCH 1/1] mm/vmstat: Protect per cpu variables with preempt disable on RT

In reply to Mel Gorman

Quoted 16 lines · Mel Gorman

From: Ingo Molnar <[email protected]>
Disable preemption on -RT for the vmstat code. On vanila the code runs in IRQ-off regions while on -RT it may not when stats are updated under a local_lock. "preempt_disable" ensures that the same resources is not updated in parallel due to preemption.
This patch differs from the preempt-rt version where __count_vm_event and __count_vm_events are also protected. The counters are explicitly "allowed to be to be racy" so there is no need to protect them from preemption. Only the accurate page stats that are updated by a read-modify-write need protection. This patch also differs in that a preempt_[en|dis]able_rt helper is not used. As vmstat is the only user of the helper, it was suggested that it be open-coded in vmstat.c instead of risking the helper being used in unnecessary contexts.

Quoted 3 lines

Signed-off-by Ingo Molnar <[email protected]>
Signed-off-by Thomas Gleixner <[email protected]>
Signed-off-by Mel Gorman <[email protected]>

Acked-by Vlastimil Babka <[email protected]>

Sebastian Andrzej Siewior

2021-08-31 16:45 UTC #6 lore raw

Re: [PATCH 1/1] mm/vmstat: Protect per cpu variables with preempt disable on RT

In reply to Mel Gorman

Quoted 2 lines · Mel Gorman

 mm/vmstat.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

The version in RT also covered the functions
__count_vm_event()
__count_vm_events()

in include/linux/vmstat.h. Were they dropped by mistake or on purpose?

Sebastian

Andrew Morton

maintainer

2021-09-02 20:07 UTC #7 lore raw

Re: [PATCH 1/1] mm/vmstat: Protect per cpu variables with preempt disable on RT

Quoted 10 lines · On Tue, 31 Aug 2021 18:45:46 +0200 Sebastian Andrzej Siewior…

Quoted 2 lines · Mel Gorman
 mm/vmstat.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
The version in RT also covered the functions
__count_vm_event()
__count_vm_events()
in include/linux/vmstat.h. Were they dropped by mistake or on purpose?

Mel Gorman

author

2021-09-06 13:48 UTC #8 lore raw

Re: [PATCH 1/1] mm/vmstat: Protect per cpu variables with preempt disable on RT

In reply to Sebastian Andrzej Siewior

Quoted 10 lines · Sebastian Andrzej Siewior

Quoted 2 lines · Mel Gorman
 mm/vmstat.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
The version in RT also covered the functions
__count_vm_event()
__count_vm_events()
in include/linux/vmstat.h. Were they dropped by mistake or on purpose?

Sorry for the long delay, this got lost in a mess of mail. It was dropped on purpose and I tried to explain why in the changelog

Does that answer your question?

Signature · 2 lines

Mel Gorman
SUSE Labs

Sebastian Andrzej Siewior

2021-09-06 14:03 UTC #9 lore raw

Re: [PATCH 1/1] mm/vmstat: Protect per cpu variables with preempt disable on RT

Quoted 1 line · Mel Gorman

Does that answer your question?

Yes, completely. Thank you.

Sebastian