lkml.org 
[lkml]   [2020]   [Oct]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    SubjectRe: [PATCH v3 10/19] sched: Fix migrate_disable() vs set_cpus_allowed_ptr()
    Date

    On 15/10/20 12:05, Peter Zijlstra wrote:
    > @@ -1862,15 +1875,27 @@ static int migration_cpu_stop(void *data
    > * we're holding p->pi_lock.
    > */
    > if (task_rq(p) == rq) {
    > + if (is_migration_disabled(p))
    > + goto out;
    > +
    > if (task_on_rq_queued(p))
    > rq = __migrate_task(rq, &rf, p, arg->dest_cpu);
    > else
    > p->wake_cpu = arg->dest_cpu;
    > +
    > + if (arg->done) {
    > + p->migration_pending = NULL;
    > + complete = true;

    Ok so nasty ahead:

    P0@CPU0 P1 P2 stopper

    migrate_disable();
    sca(P0, {CPU1});
    <installs pending>
    migrate_enable();
    <kicks stopper>
    sca(P0, {CPU0});
    <locks>
    <local, has pending:
    goto do_complete>
    <unlocks>
    complete_all();
    refcount_dec();
    refcount_dec();
    <done>
    <done>

    <locks>
    <fiddles with pending->arg->done>

    First, P2 can clear p->migration_pending before the stopper gets to run.

    Second, the complete_all() is done without pi / rq locks held, but P2 might
    get to it before the stopper does. This may cause &pending to be popped off
    the stack before the stopper gets to it, so mayhaps we would need the below
    hunk.

    The move_queued_task() from the stopper is "safe" in that we won't kick a
    task outside of its allowed mask, although we may move it around for no
    reason - I tried to prevent that.

    ---
    diff --git a/kernel/sched/core.c b/kernel/sched/core.c
    index a5b6eac07adb..1ebf653c2c2f 100644
    --- a/kernel/sched/core.c
    +++ b/kernel/sched/core.c
    @@ -1859,6 +1859,13 @@ static struct rq *__migrate_task(struct rq *rq, struct rq_flags *rf,
    return rq;
    }

    +struct set_affinity_pending {
    + refcount_t refs;
    + struct completion done;
    + struct cpu_stop_work stop_work;
    + struct migration_arg arg;
    +};
    +
    /*
    * migration_cpu_stop - this will be executed by a highprio stopper thread
    * and performs thread migration by bumping thread off CPU then
    @@ -1866,6 +1873,7 @@ static struct rq *__migrate_task(struct rq *rq, struct rq_flags *rf,
    */
    static int migration_cpu_stop(void *data)
    {
    + struct set_affinity_pending *pending;
    struct migration_arg *arg = data;
    struct task_struct *p = arg->task;
    struct rq *rq = this_rq();
    @@ -1886,13 +1894,22 @@ static int migration_cpu_stop(void *data)

    raw_spin_lock(&p->pi_lock);
    rq_lock(rq, &rf);
    +
    + if (arg->done)
    + pending = container_of(arg->done, struct set_affinity_pending, done);
    /*
    * If task_rq(p) != rq, it cannot be migrated here, because we're
    * holding rq->lock, if p->on_rq == 0 it cannot get enqueued because
    * we're holding p->pi_lock.
    */
    if (task_rq(p) == rq) {
    - if (is_migration_disabled(p))
    + /*
    + * An affinity update may have raced with us.
    + * p->migration_pending could now be NULL, or could be pointing
    + * elsewhere entirely.
    + */
    + if (is_migration_disabled(p) ||
    + (arg->done && p->migration_pending != pending))
    goto out;

    if (task_on_rq_queued(p))
    @@ -2024,13 +2041,6 @@ void do_set_cpus_allowed(struct task_struct *p, const struct cpumask *new_mask)
    __do_set_cpus_allowed(p, new_mask, 0);
    }

    -struct set_affinity_pending {
    - refcount_t refs;
    - struct completion done;
    - struct cpu_stop_work stop_work;
    - struct migration_arg arg;
    -};
    -
    /*
    * This function is wildly self concurrent; here be dragons.
    *
    \
     
     \ /
      Last update: 2020-10-16 14:49    [W:3.548 / U:0.164 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site