[RFC,v3,4/6] sched: secure access to other CPU statistics

Commit Message

Vincent Guittot March 22, 2013, 12:25 p.m. UTC

If a CPU accesses the runnable_avg_sum and runnable_avg_period fields of its
buddy CPU while the latter updates it, it can get the new version of a field
and the old version of the other one. This can generate erroneous decisions.
We don't want to use a lock mechanism for ensuring the coherency because of
the overhead in this critical path. The previous attempt can't ensure
coherency of both fields for 100% of the platform and use case as it will
depend of the toolchain and the platform architecture.
The runnable_avg_period of a runqueue tends to the max value in less than
345ms after plugging a CPU, which implies that we could use the max value
instead of reading runnable_avg_period after 345ms. During the starting phase,
we must ensure a minimum of coherency between the fields. A simple rule is
runnable_avg_sum <= runnable_avg_period.

Signed-off-by: Vincent Guittot <[e-mail]>
Reviewed-by: Morten Rasmussen <[e-mail]>
---
 kernel/sched/fair.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

Comments

Peter Zijlstra March 26, 2013, 12:50 p.m. UTC | #1

On Fri, 2013-03-22 at 13:25 +0100, Vincent Guittot wrote:
> @@ -3364,13 +3364,16 @@ done:
>  static bool is_buddy_busy(int cpu)
>  {
>         struct rq *rq = cpu_rq(cpu);
> +       u32 sum = rq->avg.runnable_avg_sum;
> +       u32 period = rq->avg.runnable_avg_period;
> +
> +       sum = min(sum, period);

OK this makes sense; use a simple sanity constraint instead of going
overboard on serialization -- however, why is this a separate patch?

That is, this could easily be part of the patch that introduces
is_buddy_busy(); also you likely want part of this patch's changelog
to become a comment that goes right above this min() :-)

Vincent Guittot March 26, 2013, 1:06 p.m. UTC | #2

On 26 March 2013 13:50, Peter Zijlstra <[e-mail]> wrote:
> On Fri, 2013-03-22 at 13:25 +0100, Vincent Guittot wrote:
>> @@ -3364,13 +3364,16 @@ done:
>>  static bool is_buddy_busy(int cpu)
>>  {
>>         struct rq *rq = cpu_rq(cpu);
>> +       u32 sum = rq->avg.runnable_avg_sum;
>> +       u32 period = rq->avg.runnable_avg_period;
>> +
>> +       sum = min(sum, period);
>
> OK this makes sense; use a simple sanity constraint instead of going
> overboard on serialization -- however, why is this a separate patch?

There is no real reason other than explaining why I have added this
additional check

>
> That is, this could easily be part of the patch that introduces
> is_buddy_busy(); also you likely want part of this patch's changelog
> to become a comment that goes right above this min() :-)

Yes, i 'm going to do that

>

Patch

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 021c7b7..b636199 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3364,13 +3364,16 @@  done:
 static bool is_buddy_busy(int cpu)
 {
 	struct rq *rq = cpu_rq(cpu);
+	u32 sum = rq->avg.runnable_avg_sum;
+	u32 period = rq->avg.runnable_avg_period;
+
+	sum = min(sum, period);
 
 	/*
 	 * A busy buddy is a CPU with a high load or a small load with a lot of
 	 * running tasks.
 	 */
-	return (rq->avg.runnable_avg_sum >
-			(rq->avg.runnable_avg_period / (rq->nr_running + 2)));
+	return (sum > (period / (rq->nr_running + 2)));
 }
 
 static bool is_light_task(struct task_struct *p)