Virtualization - May 2023 - [PATCH 3/3] fork, vhost: Use CLONE_THREAD to fix freezer/ps regression

? 2023/5/23 20:15, Oleg Nesterov ??:
> On 05/22, Oleg Nesterov wrote:
>> Right now I think that "int dead" should die,
> No, probably we shouldn't call get_signal() if we have already dequeued
SIGKILL.
>
>> but let me think tomorrow.
> May be something like this... I don't like it but I can't suggest
anything better
> right now.
>
> 	bool killed = false;
>
> 	for (;;) {
> 		...
> 	
> 		node = llist_del_all(&worker->work_list);
> 		if (!node) {
> 			schedule();
> 			/*
> 			 * When we get a SIGKILL our release function will
> 			 * be called. That will stop new IOs from being queued
> 			 * and check for outstanding cmd responses. It will then
> 			 * call vhost_task_stop to tell us to return and exit.
> 			 */
> 			if (signal_pending(current)) {
> 				struct ksignal ksig;
>
> 				if (!killed)
> 					killed = get_signal(&ksig);
>
> 				clear_thread_flag(TIF_SIGPENDING);
> 			}
>
> 			continue;
> 		}
>
>
-------------------------------------------------------------------------------
> But let me ask a couple of questions. Let's forget this patch,
let's look at the
> current code:
>
> 		node = llist_del_all(&worker->work_list);
> 		if (!node)
> 			schedule();
>
> 		node = llist_reverse_order(node);
> 		... process works ...
>
> To me this looks a bit confusing. Shouldn't we do
>
> 		if (!node) {
> 			schedule();
> 			continue;
> 		}
>
> just to make the code a bit more clear? If node == NULL then
> llist_reverse_order() and llist_for_each_entry_safe() will do nothing.
> But this is minor.

Yes.

>
>
>
> 		/* make sure flag is seen after deletion */
> 		smp_wmb();
> 		llist_for_each_entry_safe(work, work_next, node, node) {
> 			clear_bit(VHOST_WORK_QUEUED, &work->flags);
>
> I am not sure about smp_wmb + clear_bit. Once we clear VHOST_WORK_QUEUED,
> vhost_work_queue() can add this work again and change
work->node->next.
>
> That is why we use _safe, but we need to ensure that llist_for_each_safe()
> completes LOAD(work->node->next) before VHOST_WORK_QUEUED is cleared.

This should be fine since store is not speculated, so work->node->next 
needs to be loaded before VHOST_WORK_QUEUED is cleared to meet the loop 
condition.

> So it seems that smp_wmb() can't help and should be removed, instead we
need
>
> 		llist_for_each_entry_safe(...) {
> 			smp_mb__before_atomic();
> 			clear_bit(VHOST_WORK_QUEUED, &work->flags);
>
> Also, if the work->fn pointer is not stable, we should read it before
> smp_mb__before_atomic() as well.

The fn won't be changed after it is initialized.

>
> No?
>
>
> 			__set_current_state(TASK_RUNNING);
>
> Why do we set TASK_RUNNING inside the loop? Does this mean that
work->fn()
> can return with current->state != RUNNING ?

It is because the state were set to TASK_INTERRUPTIBLE in the beginning 
of the loop otherwise it might be side effect while executing work->fn().

>
>
> 			work->fn(work);
>
> Now the main question. Whatever we do, SIGKILL/SIGSTOP/etc can come right
> before we call work->fn(). Is it "safe" to run this callback
with
> signal_pending() or fatal_signal_pending() ?

It looks safe since:

1) vhost hold refcnt of the mm
2) release will sync with the worker

>
>
> Finally. I never looked into drivers/vhost/ before so I don't
understand
> this code at all, but let me ask anyway... Can we change vhost_dev_flush()
> to run the pending callbacks rather than wait for vhost_worker() ?
> I guess we can't, ->mm won't be correct, but can you confirm?

Yes.

Thanks

>
> Oleg.
>

On 05/31, Jason Wang wrote:
>
> ? 2023/5/23 20:15, Oleg Nesterov ??:
> >
> >		/* make sure flag is seen after deletion */
> >		smp_wmb();
> >		llist_for_each_entry_safe(work, work_next, node, node) {
> >			clear_bit(VHOST_WORK_QUEUED, &work->flags);
> >
> >I am not sure about smp_wmb + clear_bit. Once we clear
VHOST_WORK_QUEUED,
> >vhost_work_queue() can add this work again and change
work->node->next.
> >
> >That is why we use _safe, but we need to ensure that
llist_for_each_safe()
> >completes LOAD(work->node->next) before VHOST_WORK_QUEUED is
cleared.
>
> This should be fine since store is not speculated, so
work->node->next needs
> to be loaded before VHOST_WORK_QUEUED is cleared to meet the loop
condition.
I don't understand you. OK, to simplify, suppose we have 2 global vars

	void *PTR = something_non_null;
	unsigned long FLAGS = -1ul;

Now I think this code

	CPU_0				CPU_1

	void *ptr = PTR;		if (!test_and_set_bit(0, FLAGS))
	clear_bit(0, FLAGS);			PTR = NULL;
	BUG_ON(!ptr);

is racy and can hit the BUG_ON(!ptr).

I guess it is fine on x86, but in general you need smp_mb__before_atomic()
before clear_bit(), or clear_bit_unlock().
> >			__set_current_state(TASK_RUNNING);
> >
> >Why do we set TASK_RUNNING inside the loop? Does this mean that
work->fn()
> >can return with current->state != RUNNING ?
>
> It is because the state were set to TASK_INTERRUPTIBLE in the beginning of
> the loop otherwise it might be side effect while executing work->fn().
Again, I don't understand you. So let me repeat: can work->fn() return
with
current->_state != TASK_RUNNING ? If not (and I'd say it should not), you
can
do __set_current_state(TASK_RUNNING) once, before llist_for_each_entry_safe().
> >Now the main question. Whatever we do, SIGKILL/SIGSTOP/etc can come
right
> >before we call work->fn(). Is it "safe" to run this
callback with
> >signal_pending() or fatal_signal_pending() ?
>
> It looks safe since:
>
> 1) vhost hold refcnt of the mm
> 2) release will sync with the worker
Well, that's not what I asked... nevermind, please forget.

Thanks.

Oleg.