From patchwork Thu Mar 19 00:11:53 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Dario Faggioli X-Patchwork-Id: 11446323 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1F18B13B1 for ; Thu, 19 Mar 2020 00:13:32 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id EE97A2076E for ; Thu, 19 Mar 2020 00:13:31 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org EE97A2076E Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=suse.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=xen-devel-bounces@lists.xenproject.org Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jEin1-0006hX-IJ; Thu, 19 Mar 2020 00:11:59 +0000 Received: from all-amaz-eas1.inumbo.com ([34.197.232.57] helo=us1-amaz-eas2.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.89) (envelope-from ) id 1jEimz-0006gi-Mq for xen-devel@lists.xenproject.org; Thu, 19 Mar 2020 00:11:57 +0000 X-Inumbo-ID: 3e0c1124-6976-11ea-bba2-12813bfff9fa Received: from mail-wm1-f66.google.com (unknown [209.85.128.66]) by us1-amaz-eas2.inumbo.com (Halon) with ESMTPS id 3e0c1124-6976-11ea-bba2-12813bfff9fa; Thu, 19 Mar 2020 00:11:56 +0000 (UTC) Received: by mail-wm1-f66.google.com with SMTP id c187so175142wme.1 for ; Wed, 18 Mar 2020 17:11:56 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:from:to:cc:date:message-id:in-reply-to :references:user-agent:mime-version:content-transfer-encoding; bh=y1kRVxDY+nl7SvNgqvrXz449PSZNYDfGzpNCJISLgjk=; b=Ig+2538wIaZo/Z8TkUbwt0Zt7AuiP98l0F+tBK8TRFTsQILMjLbPRX5q6ic44xpa8z QhLopQIgT6Kop/He/SPgrsl3KsgZYRoOfBdOBJ9DlZxJX1Z3ajvrsty/hboiq6KchsMP BxhOyOnDzh70hTQaJBFrxTwOqV74jy/7nfHVNhEnYVMw32RMQum5xj7plge6YJaB4Qq+ 5PzjazEJMNDCom2efZ4njiIpLqlwSPZbhqL0cpTNlBri7hz2XARSbaoY71wjjI8W3Jgk NOqGnqg9fu1y0WvQhvoJNj1hqJNqQrJfoZgXJdfGCItJyFad1m/7AjHE0/gCI3ipRAW/ IqlA== X-Gm-Message-State: ANhLgQ0L2L+K3yOJAmWQN9cmDacCtud/GwnTSOAMsnO+ahxoiEEPgW7P W/TX0hP1bE87XTnFDF0/go0= X-Google-Smtp-Source: ADFU+vtV5NRKGFQMtR74+Ce8BjPV7ZH0A/WuSpC/IdBwpZtCfBu7+QN7fDIvcH/jq9bIREtAhzI7xQ== X-Received: by 2002:a1c:bb86:: with SMTP id l128mr264938wmf.41.1584576715144; Wed, 18 Mar 2020 17:11:55 -0700 (PDT) Received: from [192.168.0.36] (87.78.186.89.cust.ip.kpnqwest.it. [89.186.78.87]) by smtp.gmail.com with ESMTPSA id k3sm605947wmf.16.2020.03.18.17.11.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 18 Mar 2020 17:11:54 -0700 (PDT) From: Dario Faggioli To: xen-devel@lists.xenproject.org Date: Thu, 19 Mar 2020 01:11:53 +0100 Message-ID: <158457671301.11355.1086453211878144633.stgit@Palanthas> In-Reply-To: <158457508246.11355.6457403441669388939.stgit@Palanthas> References: <158457508246.11355.6457403441669388939.stgit@Palanthas> User-Agent: StGit/0.21 MIME-Version: 1.0 Subject: [Xen-devel] [PATCH v2 1/2] xen: credit2: avoid vCPUs to ever reach lower credits than idle X-BeenThere: xen-devel@lists.xenproject.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Cc: Juergen Gross , Charles Arnold , Tomas Mozes , Glen , George Dunlap , Jan Beulich , Sarah Newman Errors-To: xen-devel-bounces@lists.xenproject.org Sender: "Xen-devel" There have been report of stalls of guest vCPUs, when Credit2 was used. It seemed like these vCPUs were not getting scheduled for very long time, even under light load conditions (e.g., during dom0 boot). Investigations led to the discovery that --although rarely-- it can happen that a vCPU manages to run for very long timeslices. In Credit2, this means that, when runtime accounting happens, the vCPU will lose a large quantity of credits. This in turn may lead to the vCPU having less credits than the idle vCPUs (-2^30). At this point, the scheduler will pick the idle vCPU, instead of the ready to run vCPU, for a few "epochs", which often times is enough for the guest kernel to think the vCPU is not responding and crashing. An example of this situation is shown here. In fact, we can see d0v1 sitting in the runqueue while all the CPUs are idle, as it has -1254238270 credits, which is smaller than -2^30 = −1073741824: (XEN) Runqueue 0: (XEN) ncpus = 28 (XEN) cpus = 0-27 (XEN) max_weight = 256 (XEN) pick_bias = 22 (XEN) instload = 1 (XEN) aveload = 293391 (~111%) (XEN) idlers: 00,00000000,00000000,00000000,00000000,00000000,0fffffff (XEN) tickled: 00,00000000,00000000,00000000,00000000,00000000,00000000 (XEN) fully idle cores: 00,00000000,00000000,00000000,00000000,00000000,0fffffff [...] (XEN) Runqueue 0: (XEN) CPU[00] runq=0, sibling=00,..., core=00,... (XEN) CPU[01] runq=0, sibling=00,..., core=00,... [...] (XEN) CPU[26] runq=0, sibling=00,..., core=00,... (XEN) CPU[27] runq=0, sibling=00,..., core=00,... (XEN) RUNQ: (XEN) 0: [0.1] flags=0 cpu=5 credit=-1254238270 [w=256] load=262144 (~100%) We certainly don't want, under any circumstance, this to happen. Let's, therefore, define a minimum amount of credits a vCPU can have. During accounting, we make sure that, for however long the vCPU has run, it will never get to have less than such minimum amount of credits. Then, we set the credits of the idle vCPU to an even smaller value. NOTE: investigations have been done about _how_ it is possible for a vCPU to execute for so much time that its credits becomes so low. While still not completely clear, there are evidence that: - it only happens very rarely, - it appears to be both machine and workload specific, - it does not look to be a Credit2 (e.g., as it happens when running with Credit1 as well) issue, or a scheduler issue. This patch makes Credit2 more robust to events like this, whatever the cause is, and should hence be backported (as far as possible). Reported-by: Glen Reported-by: Tomas Mozes Signed-off-by: Dario Faggioli Reviewed-by: George Dunlap --- Cc: George Dunlap Cc: Juergen Gross Cc: Jan Beulich Cc: Charles Arnold Cc: Sarah Newman --- Changes from v1: - different approach. Instead than using INT_MIN for idle vCPUs' credits, limit the minimum number of credits regular vCPUs can have. --- I will provide the backports myself, at least for 4.13 and 4.12.x (and feel free to ask for more). --- For Sarah, looking back at the various threads, I am not quite sure whether you also experienced the issue and reported it. If yes, I'm happy to add a "Reported-by:" line about you too (or, if this is fine to go in, for this to be done while committing, if possible). --- tools/xentrace/formats | 2 +- tools/xentrace/xenalyze.c | 5 ++-- xen/common/sched/credit2.c | 53 +++++++++++++++++++++++--------------------- 3 files changed, 31 insertions(+), 29 deletions(-) diff --git a/tools/xentrace/formats b/tools/xentrace/formats index d6e7e3f800..8f126f65f1 100644 --- a/tools/xentrace/formats +++ b/tools/xentrace/formats @@ -55,7 +55,7 @@ 0x00022204 CPU%(cpu)d %(tsc)d (+%(reltsc)8d) csched2:credit_add 0x00022205 CPU%(cpu)d %(tsc)d (+%(reltsc)8d) csched2:tickle_check [ dom:vcpu = 0x%(1)08x, credit = %(2)d, score = %(3)d ] 0x00022206 CPU%(cpu)d %(tsc)d (+%(reltsc)8d) csched2:tickle [ cpu = %(1)d ] -0x00022207 CPU%(cpu)d %(tsc)d (+%(reltsc)8d) csched2:credit_reset [ dom:vcpu = 0x%(1)08x, cr_start = %(2)d, cr_end = %(3)d, mult = %(4)d ] +0x00022207 CPU%(cpu)d %(tsc)d (+%(reltsc)8d) csched2:credit_reset [ dom:vcpu = 0x%(1)08x, cr_start = %(2)d, cr_end = %(3)d ] 0x00022208 CPU%(cpu)d %(tsc)d (+%(reltsc)8d) csched2:sched_tasklet 0x00022209 CPU%(cpu)d %(tsc)d (+%(reltsc)8d) csched2:update_load 0x0002220a CPU%(cpu)d %(tsc)d (+%(reltsc)8d) csched2:runq_assign [ dom:vcpu = 0x%(1)08x, rq_id = %(2)d ] diff --git a/tools/xentrace/xenalyze.c b/tools/xentrace/xenalyze.c index aa894673ad..d3c8368e9d 100644 --- a/tools/xentrace/xenalyze.c +++ b/tools/xentrace/xenalyze.c @@ -7718,13 +7718,12 @@ void sched_process(struct pcpu_info *p) struct { unsigned int vcpuid:16, domid:16; int credit_start, credit_end; - unsigned int multiplier; } *r = (typeof(r))ri->d; printf(" %s csched2:reset_credits d%uv%u, " - "credit_start = %d, credit_end = %d, mult = %u\n", + "credit_start = %d, credit_end = %d\n", ri->dump_header, r->domid, r->vcpuid, - r->credit_start, r->credit_end, r->multiplier); + r->credit_start, r->credit_end); } break; case TRC_SCHED_CLASS_EVT(CSCHED2, 8): /* SCHED_TASKLET */ diff --git a/xen/common/sched/credit2.c b/xen/common/sched/credit2.c index c7241944a8..cbf9ce2b97 100644 --- a/xen/common/sched/credit2.c +++ b/xen/common/sched/credit2.c @@ -229,12 +229,22 @@ * before a reset event. */ #define CSCHED2_CREDIT_INIT MILLISECS(10) +/* + * Minimum amount of credits VMs can have. Ideally, no VM would get + * close to this (unless a vCPU manages to execute for really long + * time uninterrupted). In case it happens, it makes no sense to + * track even deeper undershoots. + * + * NOTE: If making this smaller than -CSCHED2_CREDIT_INIT, adjust + * reset_credit() accordingly. + */ +#define CSCHED2_CREDIT_MIN (-CSCHED2_CREDIT_INIT) /* * Amount of credit the idle units have. It never changes, as idle * units does not consume credits, and it must be lower than whatever * amount of credit 'regular' unit would end up with. */ -#define CSCHED2_IDLE_CREDIT (-(1U<<30)) +#define CSCHED2_IDLE_CREDIT (CSCHED2_CREDIT_MIN-1) /* * Carryover: How much "extra" credit may be carried over after * a reset. @@ -781,10 +791,15 @@ static int get_fallback_cpu(struct csched2_unit *svc) static void t2c_update(const struct csched2_runqueue_data *rqd, s_time_t time, struct csched2_unit *svc) { - uint64_t val = time * rqd->max_weight + svc->residual; + int64_t val = time * rqd->max_weight + svc->residual; svc->residual = do_div(val, svc->weight); - svc->credit -= val; + /* Getting to lower credit than CSCHED2_CREDIT_MIN makes no sense. */ + val = svc->credit - val; + if ( unlikely(val < CSCHED2_CREDIT_MIN) ) + svc->credit = CSCHED2_CREDIT_MIN; + else + svc->credit = val; } static s_time_t c2t(const struct csched2_runqueue_data *rqd, s_time_t credit, @@ -1616,28 +1631,25 @@ static void reset_credit(int cpu, s_time_t now, struct csched2_unit *snext) { struct csched2_runqueue_data *rqd = c2rqd(cpu); struct list_head *iter; - int m; + int reset = CSCHED2_CREDIT_INIT; /* * Under normal circumstances, snext->credit should never be less * than -CSCHED2_MIN_TIMER. However, under some circumstances, an * unit with low credits may be allowed to run long enough that - * its credits are actually less than -CSCHED2_CREDIT_INIT. + * its credits are actually much lower than that. * (Instances have been observed, for example, where an unit with * 200us of credit was allowed to run for 11ms, giving it -10.8ms * of credit. Thus it was still negative even after the reset.) * * If this is the case for snext, we simply want to keep moving - * everyone up until it is in the black again. This fair because - * none of the other units want to run at the moment. - * - * Rather than looping, however, we just calculate a multiplier, - * avoiding an integer division and multiplication in the common - * case. + * everyone up until it is in the black again. This means that, + * since CSCHED2_CREDIT_MIN is -CSCHED2_CREDIT_INIT, we need to + * actually add 2*CSCHED2_CREDIT_INIT. */ - m = 1; - if ( snext->credit < -CSCHED2_CREDIT_INIT ) - m += (-snext->credit) / CSCHED2_CREDIT_INIT; + ASSERT(snext->credit >= CSCHED2_CREDIT_MIN); + if ( unlikely(snext->credit == CSCHED2_CREDIT_MIN) ) + reset += CSCHED2_CREDIT_INIT; list_for_each( iter, &rqd->svc ) { @@ -1668,15 +1680,7 @@ static void reset_credit(int cpu, s_time_t now, struct csched2_unit *snext) } start_credit = svc->credit; - - /* - * Add INIT * m, avoiding integer multiplication in the common case. - */ - if ( likely(m==1) ) - svc->credit += CSCHED2_CREDIT_INIT; - else - svc->credit += m * CSCHED2_CREDIT_INIT; - + svc->credit += reset; /* "Clip" credits to max carryover */ if ( svc->credit > CSCHED2_CREDIT_INIT + CSCHED2_CARRYOVER_MAX ) svc->credit = CSCHED2_CREDIT_INIT + CSCHED2_CARRYOVER_MAX; @@ -1688,19 +1692,18 @@ static void reset_credit(int cpu, s_time_t now, struct csched2_unit *snext) struct { unsigned unit:16, dom:16; int credit_start, credit_end; - unsigned multiplier; } d; d.dom = svc->unit->domain->domain_id; d.unit = svc->unit->unit_id; d.credit_start = start_credit; d.credit_end = svc->credit; - d.multiplier = m; __trace_var(TRC_CSCHED2_CREDIT_RESET, 1, sizeof(d), (unsigned char *)&d); } } + ASSERT(snext->credit > 0); SCHED_STAT_CRANK(credit_reset); /* No need to resort runqueue, as everyone's order should be the same. */