All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v11 00/26] Speculative page faults
@ 2019-01-11 15:43 Vinayak Menon
  2019-01-14 13:19 ` Vinayak Menon
  0 siblings, 1 reply; 58+ messages in thread
From: Vinayak Menon @ 2019-01-11 15:43 UTC (permalink / raw)
  To: ldufour; +Cc: Linux-MM, charante

Hi Laurent,

We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).

Steps:

1) Run the program

2) The 2 threads will try lock/unlock and prints messages, and main thread does fork. In around 1 minute time, lock/unlock threads will hang on pthread_mutex_lock.


Initially the issue was reported when ptrace was tried on apps. Later it was discovered that the write protect done by fork is causing the issue and the below test code was created.


Observations:

1) We have tried disabling SPF and the issue disappears.

2) Adding this piece of code in __handle_speculative_fault also fixes the problem.

if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))

    return VM_FAULT_RETRY;

3) As an experiment we tried encapsulating handle_speculative_fault with down_read(mmap_sem) and that too fixes the problem.

4) It is observed that while in wp_page_copy, the contents of the old_page changes which should not ideally happen as the pte is !pte_write.

5) To prove that it is a race, we tried affining the threads to single core, and the issue disappears.

Let us know if you want us to try out any experiments.

Thanks,
Vinayak

/**test.c***/

#include <stdio.h>
#include <pthread.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <errno.h>

#define UNUSED(expr) do { (void)(expr); } while(0)
#define print printf

pthread_mutex_t m;
pthread_cond_t c;

static void* cond_do(void* arg)
{
  UNUSED(arg);
  do {
    print("%s:%d state=%u addr: %lx\n", __func__, __LINE__, *(uint32_t*)(&m), (unsigned long)&m);
    pthread_mutex_lock(&m);
 
    print("%s:%d state=%u addr: %lx\n", __func__, __LINE__, *(uint32_t*)(&m), (unsigned long)&m);
    pthread_mutex_unlock(&m);
    print("%s:%d state=%u addr: %lx\n", __func__, __LINE__, *(uint32_t*)(&m), (unsigned long)&m);
  } while (true);

  return NULL;
}

static void* sig_do(void* arg)
{
  UNUSED(arg);
  do {
    print("%s:%d state=%u addr: %lx\n", __func__, __LINE__, *(uint32_t*)(&m), (unsigned long)&m);
    pthread_mutex_lock(&m);

    print("%s:%d state=%u addr: %lx\n", __func__, __LINE__, *(uint32_t*)(&m), (unsigned long)&m);
    pthread_mutex_unlock(&m);
    print("%s:%d state=%u addr: %lx\n", __func__, __LINE__, *(uint32_t*)(&m), (unsigned long)&m);
  } while (true);
  return NULL;
}

int main()
{
  pthread_t sig;
  pthread_t cond;
  pthread_mutex_init(&m, NULL);
 
  pthread_create(&cond, NULL, cond_do, NULL);
  pthread_create(&sig, NULL, sig_do, NULL);

  while(1) {
      if (!fork()) {
          usleep(500);
          abort();
      }
      usleep(550);
  }

  pthread_join(sig, NULL);
  pthread_join(cond, NULL);

  return 0;
}

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2019-01-11 15:43 [PATCH v11 00/26] Speculative page faults Vinayak Menon
@ 2019-01-14 13:19 ` Vinayak Menon
  2019-01-15  8:24   ` Laurent Dufour
  0 siblings, 1 reply; 58+ messages in thread
From: Vinayak Menon @ 2019-01-14 13:19 UTC (permalink / raw)
  To: ldufour; +Cc: Linux-MM, charante

On 1/11/2019 9:13 PM, Vinayak Menon wrote:
> Hi Laurent,
>
> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).


With the patch below, we don't hit the issue.

From: Vinayak Menon <vinmenon@codeaurora.org>
Date: Mon, 14 Jan 2019 16:06:34 +0530
Subject: [PATCH] mm: flush stale tlb entries on speculative write fault

It is observed that the following scenario results in
threads A and B of process 1 blocking on pthread_mutex_lock
forever after few iterations.

CPU 1                   CPU 2                    CPU 3
Process 1,              Process 1,               Process 1,
Thread A                Thread B                 Thread C

while (1) {             while (1) {              while(1) {
pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
}                       }

When from thread C, copy_one_pte write-protects the parent pte
(of lock l), stale tlb entries can exist with write permissions
on one of the CPUs at least. This can create a problem if one
of the threads A or B hits the write fault. Though dup_mmap calls
flush_tlb_mm after copy_page_range, since speculative page fault
does not take mmap_sem it can proceed further fixing a fault soon
after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
entry can still modify old_page even after it is copied to
new_page by wp_page_copy, thus causing a corruption.

Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
---
 mm/memory.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/mm/memory.c b/mm/memory.c
index 52080e4..1ea168ff 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
                return VM_FAULT_RETRY;
        }

+       /*
+        * Discard tlb entries created before ptep_set_wrprotect
+        * in copy_one_pte
+        */
+       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
+               flush_tlb_page(vmf.vma, address);
+
        mem_cgroup_oom_enable();
        ret = handle_pte_fault(&vmf);
        mem_cgroup_oom_disable();
--
QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a
member of the Code Aurora Forum, hosted by The Linux Foundation

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2019-01-14 13:19 ` Vinayak Menon
@ 2019-01-15  8:24   ` Laurent Dufour
  2019-01-16 11:41     ` Vinayak Menon
  2019-01-16 11:41     ` Vinayak Menon
  0 siblings, 2 replies; 58+ messages in thread
From: Laurent Dufour @ 2019-01-15  8:24 UTC (permalink / raw)
  To: Vinayak Menon; +Cc: Linux-MM, charante, Ganesh Mahendran

[-- Attachment #1: Type: text/plain, Size: 3581 bytes --]

Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>> Hi Laurent,
>>
>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
> 
> 
> With the patch below, we don't hit the issue.
> 
> From: Vinayak Menon <vinmenon@codeaurora.org>
> Date: Mon, 14 Jan 2019 16:06:34 +0530
> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
> 
> It is observed that the following scenario results in
> threads A and B of process 1 blocking on pthread_mutex_lock
> forever after few iterations.
> 
> CPU 1                   CPU 2                    CPU 3
> Process 1,              Process 1,               Process 1,
> Thread A                Thread B                 Thread C
> 
> while (1) {             while (1) {              while(1) {
> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
> }                       }
> 
> When from thread C, copy_one_pte write-protects the parent pte
> (of lock l), stale tlb entries can exist with write permissions
> on one of the CPUs at least. This can create a problem if one
> of the threads A or B hits the write fault. Though dup_mmap calls
> flush_tlb_mm after copy_page_range, since speculative page fault
> does not take mmap_sem it can proceed further fixing a fault soon
> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
> entry can still modify old_page even after it is copied to
> new_page by wp_page_copy, thus causing a corruption.

Nice catch and thanks for your investigation!

There is a real synchronization issue here between copy_page_range() and 
the speculative page fault handler. I didn't get it on PowerVM since the 
TLB are flushed when arch_exit_lazy_mode() is called in 
copy_page_range() but now, I can get it when running on x86_64.

> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
> ---
>   mm/memory.c | 7 +++++++
>   1 file changed, 7 insertions(+)
> 
> diff --git a/mm/memory.c b/mm/memory.c
> index 52080e4..1ea168ff 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>                  return VM_FAULT_RETRY;
>          }
> 
> +       /*
> +        * Discard tlb entries created before ptep_set_wrprotect
> +        * in copy_one_pte
> +        */
> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
> +               flush_tlb_page(vmf.vma, address);
> +
>          mem_cgroup_oom_enable();
>          ret = handle_pte_fault(&vmf);
>          mem_cgroup_oom_disable();

Your patch is fixing the race but I'm wondering about the cost of these 
tlb flushes. Here we are flushing on a per page basis (architecture like 
x86_64 are smarter and flush more pages) but there is a request to flush 
a range of tlb entries each time a cow page is newly touched. I think 
there could be some bad impact here.

Another option would be to flush the range in copy_pte_range() before 
unlocking the page table lock. This will flush entries flush_tlb_mm() 
would later handle in dup_mmap() but that will be called once per fork 
per cow VMA.

I tried the attached patch which seems to fix the issue on x86_64. Could 
you please give it a try on arm64 ?

Thanks,
Laurent.


[-- Attachment #2: 0001-mm-flush-TLB-once-pages-are-copied-when-SPF-is-on.patch --]
[-- Type: text/plain, Size: 2137 bytes --]

From 9847338187c5c7e2d387d14765452d00fa60981e Mon Sep 17 00:00:00 2001
From: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Date: Mon, 14 Jan 2019 18:35:39 +0100
Subject: [PATCH] mm: flush TLB once pages are copied when SPF is on

Vinayak Menon reported that the following scenario results in
threads A and B of process 1 blocking on pthread_mutex_lock
forever after few iterations.

CPU 1                   CPU 2                    CPU 3
Process 1,              Process 1,               Process 1,
Thread A                Thread B                 Thread C

while (1) {             while (1) {              while(1) {
pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
}                       }

When from thread C, copy_one_pte write-protects the parent pte
(of lock l), stale tlb entries can exist with write permissions
on one of the CPUs at least. This can create a problem if one
of the threads A or B hits the write fault. Though dup_mmap calls
flush_tlb_mm after copy_page_range, since speculative page fault
does not take mmap_sem it can proceed further fixing a fault soon
after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
entry can still modify old_page even after it is copied to
new_page by wp_page_copy, thus causing a corruption.

Reported-by: Vinayak Menon <vinmenon@codeaurora.org>
Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
---
 mm/memory.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/mm/memory.c b/mm/memory.c
index 48e1cf0a54ef..b7501294e0a0 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1112,6 +1112,15 @@ static int copy_pte_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
 	} while (dst_pte++, src_pte++, addr += PAGE_SIZE, addr != end);
 
 	arch_leave_lazy_mmu_mode();
+
+	/*
+	 * Prevent the page fault handler to copy the page while stale tlb entry
+	 * are still not flushed.
+	 */
+	if (IS_ENABLED(CONFIG_SPECULATIVE_PAGE_FAULT) &&
+	    is_cow_mapping(vma->vm_flags))
+		flush_tlb_range(vma, addr, end);
+
 	spin_unlock(src_ptl);
 	pte_unmap(orig_src_pte);
 	add_mm_rss_vec(dst_mm, rss);
-- 
2.20.1


^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2019-01-15  8:24   ` Laurent Dufour
@ 2019-01-16 11:41     ` Vinayak Menon
  2019-01-16 13:31       ` Laurent Dufour
  2019-01-16 11:41     ` Vinayak Menon
  1 sibling, 1 reply; 58+ messages in thread
From: Vinayak Menon @ 2019-01-16 11:41 UTC (permalink / raw)
  To: Laurent Dufour; +Cc: Linux-MM, charante, Ganesh Mahendran


On 1/15/2019 1:54 PM, Laurent Dufour wrote:
> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>> Hi Laurent,
>>>
>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>
>>
>> With the patch below, we don't hit the issue.
>>
>> From: Vinayak Menon <vinmenon@codeaurora.org>
>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>
>> It is observed that the following scenario results in
>> threads A and B of process 1 blocking on pthread_mutex_lock
>> forever after few iterations.
>>
>> CPU 1                   CPU 2                    CPU 3
>> Process 1,              Process 1,               Process 1,
>> Thread A                Thread B                 Thread C
>>
>> while (1) {             while (1) {              while(1) {
>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>> }                       }
>>
>> When from thread C, copy_one_pte write-protects the parent pte
>> (of lock l), stale tlb entries can exist with write permissions
>> on one of the CPUs at least. This can create a problem if one
>> of the threads A or B hits the write fault. Though dup_mmap calls
>> flush_tlb_mm after copy_page_range, since speculative page fault
>> does not take mmap_sem it can proceed further fixing a fault soon
>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>> entry can still modify old_page even after it is copied to
>> new_page by wp_page_copy, thus causing a corruption.
>
> Nice catch and thanks for your investigation!
>
> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>
>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>> ---
>>   mm/memory.c | 7 +++++++
>>   1 file changed, 7 insertions(+)
>>
>> diff --git a/mm/memory.c b/mm/memory.c
>> index 52080e4..1ea168ff 100644
>> --- a/mm/memory.c
>> +++ b/mm/memory.c
>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>                  return VM_FAULT_RETRY;
>>          }
>>
>> +       /*
>> +        * Discard tlb entries created before ptep_set_wrprotect
>> +        * in copy_one_pte
>> +        */
>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>> +               flush_tlb_page(vmf.vma, address);
>> +
>>          mem_cgroup_oom_enable();
>>          ret = handle_pte_fault(&vmf);
>>          mem_cgroup_oom_disable();
>
> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>
> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.


But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?


>
> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>

Your patch works fine on arm64 with a minor change. Thanks Laurent.

diff --git a/mm/memory.c b/mm/memory.c
index 52080e4..4767095 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1087,6 +1087,7 @@ static int copy_pte_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
        spinlock_t *src_ptl, *dst_ptl;
        int progress = 0;
        int rss[NR_MM_COUNTERS];
+       unsigned long orig_addr = addr;
        swp_entry_t entry = (swp_entry_t){0};

 again:
@@ -1125,6 +1126,15 @@ static int copy_pte_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
        } while (dst_pte++, src_pte++, addr += PAGE_SIZE, addr != end);

        arch_leave_lazy_mmu_mode();
+
+       /*
+        * Prevent the page fault handler to copy the page while stale tlb entry
+        * are still not flushed.
+        */
+       if (IS_ENABLED(CONFIG_SPECULATIVE_PAGE_FAULT) &&
+               is_cow_mapping(vma->vm_flags))
+                       flush_tlb_range(vma, orig_addr, end);
+
        spin_unlock(src_ptl);
        pte_unmap(orig_src_pte);
        add_mm_rss_vec(dst_mm, rss);

Thanks,

Vinayak

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2019-01-15  8:24   ` Laurent Dufour
  2019-01-16 11:41     ` Vinayak Menon
@ 2019-01-16 11:41     ` Vinayak Menon
  2019-01-17 15:51         ` zhong jiang
  1 sibling, 1 reply; 58+ messages in thread
From: Vinayak Menon @ 2019-01-16 11:41 UTC (permalink / raw)
  To: Laurent Dufour; +Cc: Linux-MM, charante, Ganesh Mahendran


On 1/15/2019 1:54 PM, Laurent Dufour wrote:
> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>> Hi Laurent,
>>>
>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>
>>
>> With the patch below, we don't hit the issue.
>>
>> From: Vinayak Menon <vinmenon@codeaurora.org>
>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>
>> It is observed that the following scenario results in
>> threads A and B of process 1 blocking on pthread_mutex_lock
>> forever after few iterations.
>>
>> CPU 1                   CPU 2                    CPU 3
>> Process 1,              Process 1,               Process 1,
>> Thread A                Thread B                 Thread C
>>
>> while (1) {             while (1) {              while(1) {
>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>> }                       }
>>
>> When from thread C, copy_one_pte write-protects the parent pte
>> (of lock l), stale tlb entries can exist with write permissions
>> on one of the CPUs at least. This can create a problem if one
>> of the threads A or B hits the write fault. Though dup_mmap calls
>> flush_tlb_mm after copy_page_range, since speculative page fault
>> does not take mmap_sem it can proceed further fixing a fault soon
>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>> entry can still modify old_page even after it is copied to
>> new_page by wp_page_copy, thus causing a corruption.
>
> Nice catch and thanks for your investigation!
>
> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>
>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>> ---
>>   mm/memory.c | 7 +++++++
>>   1 file changed, 7 insertions(+)
>>
>> diff --git a/mm/memory.c b/mm/memory.c
>> index 52080e4..1ea168ff 100644
>> --- a/mm/memory.c
>> +++ b/mm/memory.c
>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>                  return VM_FAULT_RETRY;
>>          }
>>
>> +       /*
>> +        * Discard tlb entries created before ptep_set_wrprotect
>> +        * in copy_one_pte
>> +        */
>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>> +               flush_tlb_page(vmf.vma, address);
>> +
>>          mem_cgroup_oom_enable();
>>          ret = handle_pte_fault(&vmf);
>>          mem_cgroup_oom_disable();
>
> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>
> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.


But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?


>
> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>

Your patch works fine on arm64 with a minor change. Thanks Laurent.

diff --git a/mm/memory.c b/mm/memory.c
index 52080e4..4767095 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1087,6 +1087,7 @@ static int copy_pte_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
        spinlock_t *src_ptl, *dst_ptl;
        int progress = 0;
        int rss[NR_MM_COUNTERS];
+       unsigned long orig_addr = addr;
        swp_entry_t entry = (swp_entry_t){0};

 again:
@@ -1125,6 +1126,15 @@ static int copy_pte_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
        } while (dst_pte++, src_pte++, addr += PAGE_SIZE, addr != end);

        arch_leave_lazy_mmu_mode();
+
+       /*
+        * Prevent the page fault handler to copy the page while stale tlb entry
+        * are still not flushed.
+        */
+       if (IS_ENABLED(CONFIG_SPECULATIVE_PAGE_FAULT) &&
+               is_cow_mapping(vma->vm_flags))
+                       flush_tlb_range(vma, orig_addr, end);
+
        spin_unlock(src_ptl);
        pte_unmap(orig_src_pte);
        add_mm_rss_vec(dst_mm, rss);

Thanks,

Vinayak

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2019-01-16 11:41     ` Vinayak Menon
@ 2019-01-16 13:31       ` Laurent Dufour
  0 siblings, 0 replies; 58+ messages in thread
From: Laurent Dufour @ 2019-01-16 13:31 UTC (permalink / raw)
  To: Vinayak Menon; +Cc: Linux-MM, charante, Ganesh Mahendran

Le 16/01/2019 à 12:41, Vinayak Menon a écrit :
> 
> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>> Hi Laurent,
>>>>
>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>
>>>
>>> With the patch below, we don't hit the issue.
>>>
>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>
>>> It is observed that the following scenario results in
>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>> forever after few iterations.
>>>
>>> CPU 1                   CPU 2                    CPU 3
>>> Process 1,              Process 1,               Process 1,
>>> Thread A                Thread B                 Thread C
>>>
>>> while (1) {             while (1) {              while(1) {
>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>> }                       }
>>>
>>> When from thread C, copy_one_pte write-protects the parent pte
>>> (of lock l), stale tlb entries can exist with write permissions
>>> on one of the CPUs at least. This can create a problem if one
>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>> does not take mmap_sem it can proceed further fixing a fault soon
>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>> entry can still modify old_page even after it is copied to
>>> new_page by wp_page_copy, thus causing a corruption.
>>
>> Nice catch and thanks for your investigation!
>>
>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>
>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>> ---
>>>    mm/memory.c | 7 +++++++
>>>    1 file changed, 7 insertions(+)
>>>
>>> diff --git a/mm/memory.c b/mm/memory.c
>>> index 52080e4..1ea168ff 100644
>>> --- a/mm/memory.c
>>> +++ b/mm/memory.c
>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>                   return VM_FAULT_RETRY;
>>>           }
>>>
>>> +       /*
>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>> +        * in copy_one_pte
>>> +        */
>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>> +               flush_tlb_page(vmf.vma, address);
>>> +
>>>           mem_cgroup_oom_enable();
>>>           ret = handle_pte_fault(&vmf);
>>>           mem_cgroup_oom_disable();
>>
>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>
>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
> 
> 
> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?

I think this should be less costly to do it per vma at the time of the 
fork instead of per page hit once the fork has been done, since this 
will happen in both the forked task and the forking one (the COW pages 
are concerning the both sides of the fork).

>>
>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>
> 
> Your patch works fine on arm64 with a minor change. Thanks Laurent.

Yup my mistake !
I tried to shrink the patch after testing it, sounds that I shrunk it 
far too much...

> 
> diff --git a/mm/memory.c b/mm/memory.c
> index 52080e4..4767095 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -1087,6 +1087,7 @@ static int copy_pte_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
>          spinlock_t *src_ptl, *dst_ptl;
>          int progress = 0;
>          int rss[NR_MM_COUNTERS];
> +       unsigned long orig_addr = addr;
>          swp_entry_t entry = (swp_entry_t){0};
> 
>   again:
> @@ -1125,6 +1126,15 @@ static int copy_pte_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
>          } while (dst_pte++, src_pte++, addr += PAGE_SIZE, addr != end);
> 
>          arch_leave_lazy_mmu_mode();
> +
> +       /*
> +        * Prevent the page fault handler to copy the page while stale tlb entry
> +        * are still not flushed.
> +        */
> +       if (IS_ENABLED(CONFIG_SPECULATIVE_PAGE_FAULT) &&
> +               is_cow_mapping(vma->vm_flags))
> +                       flush_tlb_range(vma, orig_addr, end);
> +
>          spin_unlock(src_ptl);
>          pte_unmap(orig_src_pte);
>          add_mm_rss_vec(dst_mm, rss);
> 
> Thanks,
> 
> Vinayak
> 

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2019-01-17 15:51         ` zhong jiang
  0 siblings, 0 replies; 58+ messages in thread
From: zhong jiang @ 2019-01-17 15:51 UTC (permalink / raw)
  To: Vinayak Menon, Laurent Dufour; +Cc: Linux-MM, charante, Ganesh Mahendran

On 2019/1/16 19:41, Vinayak Menon wrote:
> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>> Hi Laurent,
>>>>
>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>
>>> With the patch below, we don't hit the issue.
>>>
>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>
>>> It is observed that the following scenario results in
>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>> forever after few iterations.
>>>
>>> CPU 1                   CPU 2                    CPU 3
>>> Process 1,              Process 1,               Process 1,
>>> Thread A                Thread B                 Thread C
>>>
>>> while (1) {             while (1) {              while(1) {
>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>> }                       }
>>>
>>> When from thread C, copy_one_pte write-protects the parent pte
>>> (of lock l), stale tlb entries can exist with write permissions
>>> on one of the CPUs at least. This can create a problem if one
>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>> does not take mmap_sem it can proceed further fixing a fault soon
>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>> entry can still modify old_page even after it is copied to
>>> new_page by wp_page_copy, thus causing a corruption.
>> Nice catch and thanks for your investigation!
>>
>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>
>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>> ---
>>>   mm/memory.c | 7 +++++++
>>>   1 file changed, 7 insertions(+)
>>>
>>> diff --git a/mm/memory.c b/mm/memory.c
>>> index 52080e4..1ea168ff 100644
>>> --- a/mm/memory.c
>>> +++ b/mm/memory.c
>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>                  return VM_FAULT_RETRY;
>>>          }
>>>
>>> +       /*
>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>> +        * in copy_one_pte
>>> +        */
>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>> +               flush_tlb_page(vmf.vma, address);
>>> +
>>>          mem_cgroup_oom_enable();
>>>          ret = handle_pte_fault(&vmf);
>>>          mem_cgroup_oom_disable();
>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>
>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>
> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>
>
>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>
> Your patch works fine on arm64 with a minor change. Thanks Laurent.
Hi, Vinayak and Laurent

I think the below change will impact the performance significantly. Becuase most of process has many
vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
call the flush_tlb_mm  later.

I think we can try the following way to do.

vm_write_begin(vma)
copy_pte_range
vm_write_end(vma)

The speculative page fault will return to grap the mmap_sem to run the nromal path.
Any thought?

Thanks,
zhong jiang
> diff --git a/mm/memory.c b/mm/memory.c
> index 52080e4..4767095 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -1087,6 +1087,7 @@ static int copy_pte_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
>         spinlock_t *src_ptl, *dst_ptl;
>         int progress = 0;
>         int rss[NR_MM_COUNTERS];
> +       unsigned long orig_addr = addr;
>         swp_entry_t entry = (swp_entry_t){0};
>
>  again:
> @@ -1125,6 +1126,15 @@ static int copy_pte_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
>         } while (dst_pte++, src_pte++, addr += PAGE_SIZE, addr != end);
>
>         arch_leave_lazy_mmu_mode();
> +
> +       /*
> +        * Prevent the page fault handler to copy the page while stale tlb entry
> +        * are still not flushed.
> +        */
> +       if (IS_ENABLED(CONFIG_SPECULATIVE_PAGE_FAULT) &&
> +               is_cow_mapping(vma->vm_flags))
> +                       flush_tlb_range(vma, orig_addr, end);
> +
>         spin_unlock(src_ptl);
>         pte_unmap(orig_src_pte);
>         add_mm_rss_vec(dst_mm, rss);
>
> Thanks,
>
> Vinayak
>
>
>

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2019-01-17 15:51         ` zhong jiang
  0 siblings, 0 replies; 58+ messages in thread
From: zhong jiang @ 2019-01-17 15:51 UTC (permalink / raw)
  To: Vinayak Menon, Laurent Dufour; +Cc: Linux-MM, charante, Ganesh Mahendran

On 2019/1/16 19:41, Vinayak Menon wrote:
> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>> Hi Laurent,
>>>>
>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>
>>> With the patch below, we don't hit the issue.
>>>
>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>
>>> It is observed that the following scenario results in
>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>> forever after few iterations.
>>>
>>> CPU 1                   CPU 2                    CPU 3
>>> Process 1,              Process 1,               Process 1,
>>> Thread A                Thread B                 Thread C
>>>
>>> while (1) {             while (1) {              while(1) {
>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>> }                       }
>>>
>>> When from thread C, copy_one_pte write-protects the parent pte
>>> (of lock l), stale tlb entries can exist with write permissions
>>> on one of the CPUs at least. This can create a problem if one
>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>> does not take mmap_sem it can proceed further fixing a fault soon
>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>> entry can still modify old_page even after it is copied to
>>> new_page by wp_page_copy, thus causing a corruption.
>> Nice catch and thanks for your investigation!
>>
>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>
>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>> ---
>>>   mm/memory.c | 7 +++++++
>>>   1 file changed, 7 insertions(+)
>>>
>>> diff --git a/mm/memory.c b/mm/memory.c
>>> index 52080e4..1ea168ff 100644
>>> --- a/mm/memory.c
>>> +++ b/mm/memory.c
>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>                  return VM_FAULT_RETRY;
>>>          }
>>>
>>> +       /*
>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>> +        * in copy_one_pte
>>> +        */
>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>> +               flush_tlb_page(vmf.vma, address);
>>> +
>>>          mem_cgroup_oom_enable();
>>>          ret = handle_pte_fault(&vmf);
>>>          mem_cgroup_oom_disable();
>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>
>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>
> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>
>
>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>
> Your patch works fine on arm64 with a minor change. Thanks Laurent.
Hi, Vinayak and Laurent

I think the below change will impact the performance significantly. Becuase most of process has many
vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
call the flush_tlb_mm  later.

I think we can try the following way to do.

vm_write_begin(vma)
copy_pte_range
vm_write_end(vma)

The speculative page fault will return to grap the mmap_sem to run the nromal path.
Any thought?

Thanks,
zhong jiang
> diff --git a/mm/memory.c b/mm/memory.c
> index 52080e4..4767095 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -1087,6 +1087,7 @@ static int copy_pte_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
>         spinlock_t *src_ptl, *dst_ptl;
>         int progress = 0;
>         int rss[NR_MM_COUNTERS];
> +       unsigned long orig_addr = addr;
>         swp_entry_t entry = (swp_entry_t){0};
>
>  again:
> @@ -1125,6 +1126,15 @@ static int copy_pte_range(struct mm_struct *dst_mm, struct mm_struct *src_mm,
>         } while (dst_pte++, src_pte++, addr += PAGE_SIZE, addr != end);
>
>         arch_leave_lazy_mmu_mode();
> +
> +       /*
> +        * Prevent the page fault handler to copy the page while stale tlb entry
> +        * are still not flushed.
> +        */
> +       if (IS_ENABLED(CONFIG_SPECULATIVE_PAGE_FAULT) &&
> +               is_cow_mapping(vma->vm_flags))
> +                       flush_tlb_range(vma, orig_addr, end);
> +
>         spin_unlock(src_ptl);
>         pte_unmap(orig_src_pte);
>         add_mm_rss_vec(dst_mm, rss);
>
> Thanks,
>
> Vinayak
>
>
>



^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2019-01-17 15:51         ` zhong jiang
  (?)
@ 2019-01-18  9:29         ` Laurent Dufour
  2019-01-18 15:41             ` zhong jiang
  -1 siblings, 1 reply; 58+ messages in thread
From: Laurent Dufour @ 2019-01-18  9:29 UTC (permalink / raw)
  To: zhong jiang, Vinayak Menon; +Cc: Linux-MM, charante, Ganesh Mahendran

Le 17/01/2019 à 16:51, zhong jiang a écrit :
> On 2019/1/16 19:41, Vinayak Menon wrote:
>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>> Hi Laurent,
>>>>>
>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>
>>>> With the patch below, we don't hit the issue.
>>>>
>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>
>>>> It is observed that the following scenario results in
>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>> forever after few iterations.
>>>>
>>>> CPU 1                   CPU 2                    CPU 3
>>>> Process 1,              Process 1,               Process 1,
>>>> Thread A                Thread B                 Thread C
>>>>
>>>> while (1) {             while (1) {              while(1) {
>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>> }                       }
>>>>
>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>> (of lock l), stale tlb entries can exist with write permissions
>>>> on one of the CPUs at least. This can create a problem if one
>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>> entry can still modify old_page even after it is copied to
>>>> new_page by wp_page_copy, thus causing a corruption.
>>> Nice catch and thanks for your investigation!
>>>
>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>
>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>> ---
>>>>    mm/memory.c | 7 +++++++
>>>>    1 file changed, 7 insertions(+)
>>>>
>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>> index 52080e4..1ea168ff 100644
>>>> --- a/mm/memory.c
>>>> +++ b/mm/memory.c
>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>                   return VM_FAULT_RETRY;
>>>>           }
>>>>
>>>> +       /*
>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>> +        * in copy_one_pte
>>>> +        */
>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>> +               flush_tlb_page(vmf.vma, address);
>>>> +
>>>>           mem_cgroup_oom_enable();
>>>>           ret = handle_pte_fault(&vmf);
>>>>           mem_cgroup_oom_disable();
>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>
>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>
>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>
>>
>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>
>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
> Hi, Vinayak and Laurent
> 
> I think the below change will impact the performance significantly. Becuase most of process has many
> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
> call the flush_tlb_mm  later.
> 
> I think we can try the following way to do.
> 
> vm_write_begin(vma)
> copy_pte_range
> vm_write_end(vma)
> 
> The speculative page fault will return to grap the mmap_sem to run the nromal path.
> Any thought?

Hi Zhong,

I agree that flushing the TLB could have a bad impact on the 
performance, but tagging the VMA when copy_pte_range() is not fixing the 
issue as the VMA must be flagged until the PTE are flushed.

Here is what happens:

CPU A                CPU B                       CPU C
fork()
copy_pte_range()
   set PTE rdonly
got to next VMA...			
  .                   PTE is seen rdonly	         PTE still writable
  .                   thread is writing to page
  .                   -> page fault
  .                     copy the page             Thread writes to page
  .                      .                        -> no page fault
  .                     update the PTE
  .                     flush TLB for that PTE
flush TLB                                        PTE are now rdonly

So the write done by the CPU C is interfering with the page copy 
operation done by CPU B, leading to the data corruption.

Flushing the PTE in copy_pte_range() is fixing the issue as the CPU C is 
seeing the PTE as rdonly earlier. But this impacts performance.

Another option, I'll work on is to flag _all the COW eligible_ VMA 
before starting copying them and until the PTE are flushed on the CPU A.
This way when the CPU B will page fault the speculative handler will 
abort because the VMA is in the way to be touched.

But I need to ensure that all the calls to copy_pte_range() are handling 
this correctly.

Laurent.

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2019-01-18 15:41             ` zhong jiang
  0 siblings, 0 replies; 58+ messages in thread
From: zhong jiang @ 2019-01-18 15:41 UTC (permalink / raw)
  To: Laurent Dufour; +Cc: Vinayak Menon, Linux-MM, charante, Ganesh Mahendran

On 2019/1/18 17:29, Laurent Dufour wrote:
> Le 17/01/2019 à 16:51, zhong jiang a écrit :
>> On 2019/1/16 19:41, Vinayak Menon wrote:
>>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>>> Hi Laurent,
>>>>>>
>>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>>
>>>>> With the patch below, we don't hit the issue.
>>>>>
>>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>>
>>>>> It is observed that the following scenario results in
>>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>>> forever after few iterations.
>>>>>
>>>>> CPU 1                   CPU 2                    CPU 3
>>>>> Process 1,              Process 1,               Process 1,
>>>>> Thread A                Thread B                 Thread C
>>>>>
>>>>> while (1) {             while (1) {              while(1) {
>>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>>> }                       }
>>>>>
>>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>>> (of lock l), stale tlb entries can exist with write permissions
>>>>> on one of the CPUs at least. This can create a problem if one
>>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>>> entry can still modify old_page even after it is copied to
>>>>> new_page by wp_page_copy, thus causing a corruption.
>>>> Nice catch and thanks for your investigation!
>>>>
>>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>>
>>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>>> ---
>>>>>    mm/memory.c | 7 +++++++
>>>>>    1 file changed, 7 insertions(+)
>>>>>
>>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>>> index 52080e4..1ea168ff 100644
>>>>> --- a/mm/memory.c
>>>>> +++ b/mm/memory.c
>>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>>                   return VM_FAULT_RETRY;
>>>>>           }
>>>>>
>>>>> +       /*
>>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>>> +        * in copy_one_pte
>>>>> +        */
>>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>> +               flush_tlb_page(vmf.vma, address);
>>>>> +
>>>>>           mem_cgroup_oom_enable();
>>>>>           ret = handle_pte_fault(&vmf);
>>>>>           mem_cgroup_oom_disable();
>>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>>
>>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>>
>>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>>
>>>
>>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>>
>>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
>> Hi, Vinayak and Laurent
>>
>> I think the below change will impact the performance significantly. Becuase most of process has many
>> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
>> call the flush_tlb_mm  later.
>>
>> I think we can try the following way to do.
>>
>> vm_write_begin(vma)
>> copy_pte_range
>> vm_write_end(vma)
>>
>> The speculative page fault will return to grap the mmap_sem to run the nromal path.
>> Any thought?
>
> Hi Zhong,
>
> I agree that flushing the TLB could have a bad impact on the performance, but tagging the VMA when copy_pte_range() is not fixing the issue as the VMA must be flagged until the PTE are flushed.
>
> Here is what happens:
>
> CPU A                CPU B                       CPU C
> fork()
> copy_pte_range()
>   set PTE rdonly
> got to next VMA...           
>  .                   PTE is seen rdonly             PTE still writable
>  .                   thread is writing to page
>  .                   -> page fault
>  .                     copy the page             Thread writes to page
>  .                      .                        -> no page fault
>  .                     update the PTE
>  .                     flush TLB for that PTE
> flush TLB                                        PTE are now rdonly  
>
> So the write done by the CPU C is interfering with the page copy operation done by CPU B, leading to the data corruption.
>
I want to know the case if the CPU B has finished in front of the CPU C that the data still is vaild ?

This is to say, the old_page will be changed from other cpu because of the access from other cpu.

Maybe this is a stupid qestion :-)

Thanks,
zhong jiang.
> Flushing the PTE in copy_pte_range() is fixing the issue as the CPU C is seeing the PTE as rdonly earlier. But this impacts performance.
>
> Another option, I'll work on is to flag _all the COW eligible_ VMA before starting copying them and until the PTE are flushed on the CPU A.
> This way when the CPU B will page fault the speculative handler will abort because the VMA is in the way to be touched.
>
> But I need to ensure that all the calls to copy_pte_range() are handling this correctly.
>
> Laurent.
>
>
> .
>

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2019-01-18 15:41             ` zhong jiang
  0 siblings, 0 replies; 58+ messages in thread
From: zhong jiang @ 2019-01-18 15:41 UTC (permalink / raw)
  To: Laurent Dufour; +Cc: Vinayak Menon, Linux-MM, charante, Ganesh Mahendran

On 2019/1/18 17:29, Laurent Dufour wrote:
> Le 17/01/2019 à 16:51, zhong jiang a écrit :
>> On 2019/1/16 19:41, Vinayak Menon wrote:
>>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>>> Hi Laurent,
>>>>>>
>>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>>
>>>>> With the patch below, we don't hit the issue.
>>>>>
>>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>>
>>>>> It is observed that the following scenario results in
>>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>>> forever after few iterations.
>>>>>
>>>>> CPU 1                   CPU 2                    CPU 3
>>>>> Process 1,              Process 1,               Process 1,
>>>>> Thread A                Thread B                 Thread C
>>>>>
>>>>> while (1) {             while (1) {              while(1) {
>>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>>> }                       }
>>>>>
>>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>>> (of lock l), stale tlb entries can exist with write permissions
>>>>> on one of the CPUs at least. This can create a problem if one
>>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>>> entry can still modify old_page even after it is copied to
>>>>> new_page by wp_page_copy, thus causing a corruption.
>>>> Nice catch and thanks for your investigation!
>>>>
>>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>>
>>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>>> ---
>>>>>    mm/memory.c | 7 +++++++
>>>>>    1 file changed, 7 insertions(+)
>>>>>
>>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>>> index 52080e4..1ea168ff 100644
>>>>> --- a/mm/memory.c
>>>>> +++ b/mm/memory.c
>>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>>                   return VM_FAULT_RETRY;
>>>>>           }
>>>>>
>>>>> +       /*
>>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>>> +        * in copy_one_pte
>>>>> +        */
>>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>> +               flush_tlb_page(vmf.vma, address);
>>>>> +
>>>>>           mem_cgroup_oom_enable();
>>>>>           ret = handle_pte_fault(&vmf);
>>>>>           mem_cgroup_oom_disable();
>>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>>
>>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>>
>>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>>
>>>
>>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>>
>>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
>> Hi, Vinayak and Laurent
>>
>> I think the below change will impact the performance significantly. Becuase most of process has many
>> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
>> call the flush_tlb_mm  later.
>>
>> I think we can try the following way to do.
>>
>> vm_write_begin(vma)
>> copy_pte_range
>> vm_write_end(vma)
>>
>> The speculative page fault will return to grap the mmap_sem to run the nromal path.
>> Any thought?
>
> Hi Zhong,
>
> I agree that flushing the TLB could have a bad impact on the performance, but tagging the VMA when copy_pte_range() is not fixing the issue as the VMA must be flagged until the PTE are flushed.
>
> Here is what happens:
>
> CPU A                CPU B                       CPU C
> fork()
> copy_pte_range()
>   set PTE rdonly
> got to next VMA...           
>  .                   PTE is seen rdonly             PTE still writable
>  .                   thread is writing to page
>  .                   -> page fault
>  .                     copy the page             Thread writes to page
>  .                      .                        -> no page fault
>  .                     update the PTE
>  .                     flush TLB for that PTE
> flush TLB                                        PTE are now rdonly  
>
> So the write done by the CPU C is interfering with the page copy operation done by CPU B, leading to the data corruption.
>
I want to know the case if the CPU B has finished in front of the CPU C that the data still is vaild ?

This is to say, the old_page will be changed from other cpu because of the access from other cpu.

Maybe this is a stupid qestion :-)

Thanks,
zhong jiang.
> Flushing the PTE in copy_pte_range() is fixing the issue as the CPU C is seeing the PTE as rdonly earlier. But this impacts performance.
>
> Another option, I'll work on is to flag _all the COW eligible_ VMA before starting copying them and until the PTE are flushed on the CPU A.
> This way when the CPU B will page fault the speculative handler will abort because the VMA is in the way to be touched.
>
> But I need to ensure that all the calls to copy_pte_range() are handling this correctly.
>
> Laurent.
>
>
> .
>



^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2019-01-18 15:41             ` zhong jiang
  (?)
@ 2019-01-18 15:51             ` Laurent Dufour
  -1 siblings, 0 replies; 58+ messages in thread
From: Laurent Dufour @ 2019-01-18 15:51 UTC (permalink / raw)
  To: zhong jiang; +Cc: Vinayak Menon, Linux-MM, charante, Ganesh Mahendran

Le 18/01/2019 à 16:41, zhong jiang a écrit :
> On 2019/1/18 17:29, Laurent Dufour wrote:
>> Le 17/01/2019 à 16:51, zhong jiang a écrit :
>>> On 2019/1/16 19:41, Vinayak Menon wrote:
>>>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>>>> Hi Laurent,
>>>>>>>
>>>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>>>
>>>>>> With the patch below, we don't hit the issue.
>>>>>>
>>>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>>>
>>>>>> It is observed that the following scenario results in
>>>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>>>> forever after few iterations.
>>>>>>
>>>>>> CPU 1                   CPU 2                    CPU 3
>>>>>> Process 1,              Process 1,               Process 1,
>>>>>> Thread A                Thread B                 Thread C
>>>>>>
>>>>>> while (1) {             while (1) {              while(1) {
>>>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>>>> }                       }
>>>>>>
>>>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>>>> (of lock l), stale tlb entries can exist with write permissions
>>>>>> on one of the CPUs at least. This can create a problem if one
>>>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>>>> entry can still modify old_page even after it is copied to
>>>>>> new_page by wp_page_copy, thus causing a corruption.
>>>>> Nice catch and thanks for your investigation!
>>>>>
>>>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>>>
>>>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>> ---
>>>>>>     mm/memory.c | 7 +++++++
>>>>>>     1 file changed, 7 insertions(+)
>>>>>>
>>>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>>>> index 52080e4..1ea168ff 100644
>>>>>> --- a/mm/memory.c
>>>>>> +++ b/mm/memory.c
>>>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>>>                    return VM_FAULT_RETRY;
>>>>>>            }
>>>>>>
>>>>>> +       /*
>>>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>>>> +        * in copy_one_pte
>>>>>> +        */
>>>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>>> +               flush_tlb_page(vmf.vma, address);
>>>>>> +
>>>>>>            mem_cgroup_oom_enable();
>>>>>>            ret = handle_pte_fault(&vmf);
>>>>>>            mem_cgroup_oom_disable();
>>>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>>>
>>>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>>>
>>>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>>>
>>>>
>>>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>>>
>>>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
>>> Hi, Vinayak and Laurent
>>>
>>> I think the below change will impact the performance significantly. Becuase most of process has many
>>> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
>>> call the flush_tlb_mm  later.
>>>
>>> I think we can try the following way to do.
>>>
>>> vm_write_begin(vma)
>>> copy_pte_range
>>> vm_write_end(vma)
>>>
>>> The speculative page fault will return to grap the mmap_sem to run the nromal path.
>>> Any thought?
>>
>> Hi Zhong,
>>
>> I agree that flushing the TLB could have a bad impact on the performance, but tagging the VMA when copy_pte_range() is not fixing the issue as the VMA must be flagged until the PTE are flushed.
>>
>> Here is what happens:
>>
>> CPU A                CPU B                       CPU C
>> fork()
>> copy_pte_range()
>>    set PTE rdonly
>> got to next VMA...
>>   .                   PTE is seen rdonly             PTE still writable
>>   .                   thread is writing to page
>>   .                   -> page fault
>>   .                     copy the page             Thread writes to page
>>   .                      .                        -> no page fault
>>   .                     update the PTE
>>   .                     flush TLB for that PTE
>> flush TLB                                        PTE are now rdonly
>>
>> So the write done by the CPU C is interfering with the page copy operation done by CPU B, leading to the data corruption.
>>
> I want to know the case if the CPU B has finished in front of the CPU C that the data still is vaild ?

If the CPU B has done the flush TLB then the CPU C will write data to 
the right page. If the CPU B has not yet done the flush of the TLB as 
the time the CPU C is writing data, then this roughly the same issue.

Anyway this is fixed with the patch I'm about to sent for testing on arm64.

Cheers,
Laurent.

> 
> This is to say, the old_page will be changed from other cpu because of the access from other cpu.
> 
> Maybe this is a stupid qestion :-)
> 
> Thanks,
> zhong jiang.
>> Flushing the PTE in copy_pte_range() is fixing the issue as the CPU C is seeing the PTE as rdonly earlier. But this impacts performance.
>>
>> Another option, I'll work on is to flag _all the COW eligible_ VMA before starting copying them and until the PTE are flushed on the CPU A.
>> This way when the CPU B will page fault the speculative handler will abort because the VMA is in the way to be touched.
>>
>> But I need to ensure that all the calls to copy_pte_range() are handling this correctly.
>>
>> Laurent.
>>
>>
>> .
>>
> 
> 

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2019-01-17 15:51         ` zhong jiang
  (?)
  (?)
@ 2019-01-18 16:24         ` Laurent Dufour
  2019-01-19 17:05             ` zhong jiang
  2019-01-22 16:22             ` zhong jiang
  -1 siblings, 2 replies; 58+ messages in thread
From: Laurent Dufour @ 2019-01-18 16:24 UTC (permalink / raw)
  To: zhong jiang, Vinayak Menon; +Cc: Linux-MM, charante, Ganesh Mahendran

[-- Attachment #1: Type: text/plain, Size: 4671 bytes --]

Le 17/01/2019 à 16:51, zhong jiang a écrit :
> On 2019/1/16 19:41, Vinayak Menon wrote:
>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>> Hi Laurent,
>>>>>
>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>
>>>> With the patch below, we don't hit the issue.
>>>>
>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>
>>>> It is observed that the following scenario results in
>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>> forever after few iterations.
>>>>
>>>> CPU 1                   CPU 2                    CPU 3
>>>> Process 1,              Process 1,               Process 1,
>>>> Thread A                Thread B                 Thread C
>>>>
>>>> while (1) {             while (1) {              while(1) {
>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>> }                       }
>>>>
>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>> (of lock l), stale tlb entries can exist with write permissions
>>>> on one of the CPUs at least. This can create a problem if one
>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>> entry can still modify old_page even after it is copied to
>>>> new_page by wp_page_copy, thus causing a corruption.
>>> Nice catch and thanks for your investigation!
>>>
>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>
>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>> ---
>>>>    mm/memory.c | 7 +++++++
>>>>    1 file changed, 7 insertions(+)
>>>>
>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>> index 52080e4..1ea168ff 100644
>>>> --- a/mm/memory.c
>>>> +++ b/mm/memory.c
>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>                   return VM_FAULT_RETRY;
>>>>           }
>>>>
>>>> +       /*
>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>> +        * in copy_one_pte
>>>> +        */
>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>> +               flush_tlb_page(vmf.vma, address);
>>>> +
>>>>           mem_cgroup_oom_enable();
>>>>           ret = handle_pte_fault(&vmf);
>>>>           mem_cgroup_oom_disable();
>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>
>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>
>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>
>>
>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>
>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
> Hi, Vinayak and Laurent
> 
> I think the below change will impact the performance significantly. Becuase most of process has many
> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
> call the flush_tlb_mm  later.
> 
> I think we can try the following way to do.
> 
> vm_write_begin(vma)
> copy_pte_range
> vm_write_end(vma)
> 
> The speculative page fault will return to grap the mmap_sem to run the nromal path.
> Any thought?

Here is a new version of the patch fixing this issue. There is no 
additional TLB flush, all the fix is belonging on vm_write_{begin,end} 
calls.

I did some test on x86_64 and PowerPC but that needs to be double check 
on arm64.

Vinayak, Zhong, could you please give it a try ?

Thanks,
Laurent.


[-- Attachment #2: 0001-mm-protect-against-PTE-changes-done-by-dup_mmap.patch --]
[-- Type: text/plain, Size: 4050 bytes --]

From 3be977febb9ff93d516a2d222cca4b5a52472a9f Mon Sep 17 00:00:00 2001
From: Laurent Dufour <ldufour@linux.ibm.com>
Date: Fri, 18 Jan 2019 16:19:08 +0100
Subject: [PATCH] mm: protect against PTE changes done by dup_mmap()

Vinayak Menon and Ganesh Mahendran reported that the following scenario may
lead to thread being blocked due to data corruption:

    CPU 1                   CPU 2                    CPU 3
    Process 1,              Process 1,               Process 1,
    Thread A                Thread B                 Thread C

    while (1) {             while (1) {              while(1) {
    pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
    pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
    }                       }

In the details this happens because :

    CPU 1                CPU 2                       CPU 3
    fork()
    copy_pte_range()
      set PTE rdonly
    got to next VMA...
     .                   PTE is seen rdonly          PTE still writable
     .                   thread is writing to page
     .                   -> page fault
     .                     copy the page             Thread writes to page
     .                      .                        -> no page fault
     .                     update the PTE
     .                     flush TLB for that PTE
   flush TLB                                        PTE are now rdonly

So the write done by the CPU 3 is interfering with the page copy operation
done by CPU 2, leading to the data corruption.

To avoid this we mark all the VMA involved in the COW mechanism as changing
by calling vm_write_begin(). This ensures that the speculative page fault
handler will not try to handle a fault on these pages.
The marker is set until the TLB is flushed, ensuring that all the CPUs will
now see the PTE as not writable.
Once the TLB is flush, the marker is removed by calling vm_write_end().

The variable last is used to keep tracked of the latest VMA marked to
handle the error path where part of the VMA may have been marked.

Reported-by: Ganesh Mahendran <opensource.ganesh@gmail.com>
Reported-by: Vinayak Menon <vinmenon@codeaurora.org>
Signed-off-by: Laurent Dufour <ldufour@linux.ibm.com>
---
 kernel/fork.c | 30 ++++++++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/kernel/fork.c b/kernel/fork.c
index f1258c2ade09..39854b97d06a 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -395,7 +395,7 @@ EXPORT_SYMBOL(free_task);
 static __latent_entropy int dup_mmap(struct mm_struct *mm,
 					struct mm_struct *oldmm)
 {
-	struct vm_area_struct *mpnt, *tmp, *prev, **pprev;
+	struct vm_area_struct *mpnt, *tmp, *prev, **pprev, *last = NULL;
 	struct rb_node **rb_link, *rb_parent;
 	int retval;
 	unsigned long charge;
@@ -515,8 +515,18 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm,
 		rb_parent = &tmp->vm_rb;
 
 		mm->map_count++;
-		if (!(tmp->vm_flags & VM_WIPEONFORK))
+		if (!(tmp->vm_flags & VM_WIPEONFORK)) {
+			if (IS_ENABLED(CONFIG_SPECULATIVE_PAGE_FAULT)) {
+				/*
+				 * Mark this VMA as changing to prevent the
+				 * speculative page fault hanlder to process
+				 * it until the TLB are flushed below.
+				 */
+				last = mpnt;
+				vm_write_begin(mpnt);
+			}
 			retval = copy_page_range(mm, oldmm, mpnt);
+		}
 
 		if (tmp->vm_ops && tmp->vm_ops->open)
 			tmp->vm_ops->open(tmp);
@@ -530,6 +540,22 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm,
 out:
 	up_write(&mm->mmap_sem);
 	flush_tlb_mm(oldmm);
+
+	if (IS_ENABLED(CONFIG_SPECULATIVE_PAGE_FAULT)) {
+		/*
+		 * Since the TLB has been flush, we can safely unmark the
+		 * copied VMAs and allows the speculative page fault handler to
+		 * process them again.
+		 * Walk back the VMA list from the last marked VMA.
+		 */
+		for (; last; last = last->vm_prev) {
+			if (last->vm_flags & VM_DONTCOPY)
+				continue;
+			if (!(last->vm_flags & VM_WIPEONFORK))
+				vm_write_end(last);
+		}
+	}
+
 	up_write(&oldmm->mmap_sem);
 	dup_userfaultfd_complete(&uf);
 fail_uprobe_end:
-- 
2.20.1


^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2019-01-19 17:05             ` zhong jiang
  0 siblings, 0 replies; 58+ messages in thread
From: zhong jiang @ 2019-01-19 17:05 UTC (permalink / raw)
  To: Laurent Dufour; +Cc: Vinayak Menon, Linux-MM, charante, Ganesh Mahendran

On 2019/1/19 0:24, Laurent Dufour wrote:
> Le 17/01/2019 à 16:51, zhong jiang a écrit :
>> On 2019/1/16 19:41, Vinayak Menon wrote:
>>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>>> Hi Laurent,
>>>>>>
>>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>>
>>>>> With the patch below, we don't hit the issue.
>>>>>
>>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>>
>>>>> It is observed that the following scenario results in
>>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>>> forever after few iterations.
>>>>>
>>>>> CPU 1                   CPU 2                    CPU 3
>>>>> Process 1,              Process 1,               Process 1,
>>>>> Thread A                Thread B                 Thread C
>>>>>
>>>>> while (1) {             while (1) {              while(1) {
>>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>>> }                       }
>>>>>
>>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>>> (of lock l), stale tlb entries can exist with write permissions
>>>>> on one of the CPUs at least. This can create a problem if one
>>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>>> entry can still modify old_page even after it is copied to
>>>>> new_page by wp_page_copy, thus causing a corruption.
>>>> Nice catch and thanks for your investigation!
>>>>
>>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>>
>>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>>> ---
>>>>>    mm/memory.c | 7 +++++++
>>>>>    1 file changed, 7 insertions(+)
>>>>>
>>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>>> index 52080e4..1ea168ff 100644
>>>>> --- a/mm/memory.c
>>>>> +++ b/mm/memory.c
>>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>>                   return VM_FAULT_RETRY;
>>>>>           }
>>>>>
>>>>> +       /*
>>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>>> +        * in copy_one_pte
>>>>> +        */
>>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>> +               flush_tlb_page(vmf.vma, address);
>>>>> +
>>>>>           mem_cgroup_oom_enable();
>>>>>           ret = handle_pte_fault(&vmf);
>>>>>           mem_cgroup_oom_disable();
>>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>>
>>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>>
>>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>>
>>>
>>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>>
>>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
>> Hi, Vinayak and Laurent
>>
>> I think the below change will impact the performance significantly. Becuase most of process has many
>> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
>> call the flush_tlb_mm  later.
>>
>> I think we can try the following way to do.
>>
>> vm_write_begin(vma)
>> copy_pte_range
>> vm_write_end(vma)
>>
>> The speculative page fault will return to grap the mmap_sem to run the nromal path.
>> Any thought?
>
> Here is a new version of the patch fixing this issue. There is no additional TLB flush, all the fix is belonging on vm_write_{begin,end} calls.
>
> I did some test on x86_64 and PowerPC but that needs to be double check on arm64.
>
> Vinayak, Zhong, could you please give it a try ?
>
Thanks, look good to me. I will try it.

Sincerely,
zhong jiang
> Thanks,
> Laurent.
>

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2019-01-19 17:05             ` zhong jiang
  0 siblings, 0 replies; 58+ messages in thread
From: zhong jiang @ 2019-01-19 17:05 UTC (permalink / raw)
  To: Laurent Dufour; +Cc: Vinayak Menon, Linux-MM, charante, Ganesh Mahendran

On 2019/1/19 0:24, Laurent Dufour wrote:
> Le 17/01/2019 à 16:51, zhong jiang a écrit :
>> On 2019/1/16 19:41, Vinayak Menon wrote:
>>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>>> Hi Laurent,
>>>>>>
>>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>>
>>>>> With the patch below, we don't hit the issue.
>>>>>
>>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>>
>>>>> It is observed that the following scenario results in
>>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>>> forever after few iterations.
>>>>>
>>>>> CPU 1                   CPU 2                    CPU 3
>>>>> Process 1,              Process 1,               Process 1,
>>>>> Thread A                Thread B                 Thread C
>>>>>
>>>>> while (1) {             while (1) {              while(1) {
>>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>>> }                       }
>>>>>
>>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>>> (of lock l), stale tlb entries can exist with write permissions
>>>>> on one of the CPUs at least. This can create a problem if one
>>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>>> entry can still modify old_page even after it is copied to
>>>>> new_page by wp_page_copy, thus causing a corruption.
>>>> Nice catch and thanks for your investigation!
>>>>
>>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>>
>>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>>> ---
>>>>>    mm/memory.c | 7 +++++++
>>>>>    1 file changed, 7 insertions(+)
>>>>>
>>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>>> index 52080e4..1ea168ff 100644
>>>>> --- a/mm/memory.c
>>>>> +++ b/mm/memory.c
>>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>>                   return VM_FAULT_RETRY;
>>>>>           }
>>>>>
>>>>> +       /*
>>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>>> +        * in copy_one_pte
>>>>> +        */
>>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>> +               flush_tlb_page(vmf.vma, address);
>>>>> +
>>>>>           mem_cgroup_oom_enable();
>>>>>           ret = handle_pte_fault(&vmf);
>>>>>           mem_cgroup_oom_disable();
>>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>>
>>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>>
>>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>>
>>>
>>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>>
>>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
>> Hi, Vinayak and Laurent
>>
>> I think the below change will impact the performance significantly. Becuase most of process has many
>> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
>> call the flush_tlb_mm  later.
>>
>> I think we can try the following way to do.
>>
>> vm_write_begin(vma)
>> copy_pte_range
>> vm_write_end(vma)
>>
>> The speculative page fault will return to grap the mmap_sem to run the nromal path.
>> Any thought?
>
> Here is a new version of the patch fixing this issue. There is no additional TLB flush, all the fix is belonging on vm_write_{begin,end} calls.
>
> I did some test on x86_64 and PowerPC but that needs to be double check on arm64.
>
> Vinayak, Zhong, could you please give it a try ?
>
Thanks, look good to me. I will try it.

Sincerely,
zhong jiang
> Thanks,
> Laurent.
>



^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2019-01-22 16:22             ` zhong jiang
  0 siblings, 0 replies; 58+ messages in thread
From: zhong jiang @ 2019-01-22 16:22 UTC (permalink / raw)
  To: Laurent Dufour; +Cc: Vinayak Menon, Linux-MM, charante, Ganesh Mahendran

On 2019/1/19 0:24, Laurent Dufour wrote:
> Le 17/01/2019 à 16:51, zhong jiang a écrit :
>> On 2019/1/16 19:41, Vinayak Menon wrote:
>>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>>> Hi Laurent,
>>>>>>
>>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>>
>>>>> With the patch below, we don't hit the issue.
>>>>>
>>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>>
>>>>> It is observed that the following scenario results in
>>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>>> forever after few iterations.
>>>>>
>>>>> CPU 1                   CPU 2                    CPU 3
>>>>> Process 1,              Process 1,               Process 1,
>>>>> Thread A                Thread B                 Thread C
>>>>>
>>>>> while (1) {             while (1) {              while(1) {
>>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>>> }                       }
>>>>>
>>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>>> (of lock l), stale tlb entries can exist with write permissions
>>>>> on one of the CPUs at least. This can create a problem if one
>>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>>> entry can still modify old_page even after it is copied to
>>>>> new_page by wp_page_copy, thus causing a corruption.
>>>> Nice catch and thanks for your investigation!
>>>>
>>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>>
>>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>>> ---
>>>>>    mm/memory.c | 7 +++++++
>>>>>    1 file changed, 7 insertions(+)
>>>>>
>>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>>> index 52080e4..1ea168ff 100644
>>>>> --- a/mm/memory.c
>>>>> +++ b/mm/memory.c
>>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>>                   return VM_FAULT_RETRY;
>>>>>           }
>>>>>
>>>>> +       /*
>>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>>> +        * in copy_one_pte
>>>>> +        */
>>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>> +               flush_tlb_page(vmf.vma, address);
>>>>> +
>>>>>           mem_cgroup_oom_enable();
>>>>>           ret = handle_pte_fault(&vmf);
>>>>>           mem_cgroup_oom_disable();
>>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>>
>>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>>
>>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>>
>>>
>>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>>
>>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
>> Hi, Vinayak and Laurent
>>
>> I think the below change will impact the performance significantly. Becuase most of process has many
>> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
>> call the flush_tlb_mm  later.
>>
>> I think we can try the following way to do.
>>
>> vm_write_begin(vma)
>> copy_pte_range
>> vm_write_end(vma)
>>
>> The speculative page fault will return to grap the mmap_sem to run the nromal path.
>> Any thought?
>
> Here is a new version of the patch fixing this issue. There is no additional TLB flush, all the fix is belonging on vm_write_{begin,end} calls.
>
> I did some test on x86_64 and PowerPC but that needs to be double check on arm64.
>
> Vinayak, Zhong, could you please give it a try ?
>
Hi Laurent

I apply the patch you had attached and none of any abnormal thing came in two days. It is feasible to fix the issue.

but It will better to filter the condition by is_cow_mapping. is it right?

for example:

if (is_cow_mapping(mnpt->vm_flags)) {
      
    ........
}
   
Thanks,
zhong jiang
> Thanks,
> Laurent.
>

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2019-01-22 16:22             ` zhong jiang
  0 siblings, 0 replies; 58+ messages in thread
From: zhong jiang @ 2019-01-22 16:22 UTC (permalink / raw)
  To: Laurent Dufour; +Cc: Vinayak Menon, Linux-MM, charante, Ganesh Mahendran

On 2019/1/19 0:24, Laurent Dufour wrote:
> Le 17/01/2019 à 16:51, zhong jiang a écrit :
>> On 2019/1/16 19:41, Vinayak Menon wrote:
>>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>>> Hi Laurent,
>>>>>>
>>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>>
>>>>> With the patch below, we don't hit the issue.
>>>>>
>>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>>
>>>>> It is observed that the following scenario results in
>>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>>> forever after few iterations.
>>>>>
>>>>> CPU 1                   CPU 2                    CPU 3
>>>>> Process 1,              Process 1,               Process 1,
>>>>> Thread A                Thread B                 Thread C
>>>>>
>>>>> while (1) {             while (1) {              while(1) {
>>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>>> }                       }
>>>>>
>>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>>> (of lock l), stale tlb entries can exist with write permissions
>>>>> on one of the CPUs at least. This can create a problem if one
>>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>>> entry can still modify old_page even after it is copied to
>>>>> new_page by wp_page_copy, thus causing a corruption.
>>>> Nice catch and thanks for your investigation!
>>>>
>>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>>
>>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>>> ---
>>>>>    mm/memory.c | 7 +++++++
>>>>>    1 file changed, 7 insertions(+)
>>>>>
>>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>>> index 52080e4..1ea168ff 100644
>>>>> --- a/mm/memory.c
>>>>> +++ b/mm/memory.c
>>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>>                   return VM_FAULT_RETRY;
>>>>>           }
>>>>>
>>>>> +       /*
>>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>>> +        * in copy_one_pte
>>>>> +        */
>>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>> +               flush_tlb_page(vmf.vma, address);
>>>>> +
>>>>>           mem_cgroup_oom_enable();
>>>>>           ret = handle_pte_fault(&vmf);
>>>>>           mem_cgroup_oom_disable();
>>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>>
>>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>>
>>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>>
>>>
>>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>>
>>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
>> Hi, Vinayak and Laurent
>>
>> I think the below change will impact the performance significantly. Becuase most of process has many
>> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
>> call the flush_tlb_mm  later.
>>
>> I think we can try the following way to do.
>>
>> vm_write_begin(vma)
>> copy_pte_range
>> vm_write_end(vma)
>>
>> The speculative page fault will return to grap the mmap_sem to run the nromal path.
>> Any thought?
>
> Here is a new version of the patch fixing this issue. There is no additional TLB flush, all the fix is belonging on vm_write_{begin,end} calls.
>
> I did some test on x86_64 and PowerPC but that needs to be double check on arm64.
>
> Vinayak, Zhong, could you please give it a try ?
>
Hi Laurent

I apply the patch you had attached and none of any abnormal thing came in two days. It is feasible to fix the issue.

but It will better to filter the condition by is_cow_mapping. is it right?

for example:

if (is_cow_mapping(mnpt->vm_flags)) {
      
    ........
}
   
Thanks,
zhong jiang
> Thanks,
> Laurent.
>



^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2019-01-22 16:22             ` zhong jiang
  (?)
@ 2019-01-24  8:20             ` Laurent Dufour
  2019-01-25 12:32                 ` zhong jiang
  -1 siblings, 1 reply; 58+ messages in thread
From: Laurent Dufour @ 2019-01-24  8:20 UTC (permalink / raw)
  To: zhong jiang; +Cc: Vinayak Menon, Linux-MM, charante, Ganesh Mahendran

Le 22/01/2019 à 17:22, zhong jiang a écrit :
> On 2019/1/19 0:24, Laurent Dufour wrote:
>> Le 17/01/2019 à 16:51, zhong jiang a écrit :
>>> On 2019/1/16 19:41, Vinayak Menon wrote:
>>>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>>>> Hi Laurent,
>>>>>>>
>>>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>>>
>>>>>> With the patch below, we don't hit the issue.
>>>>>>
>>>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>>>
>>>>>> It is observed that the following scenario results in
>>>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>>>> forever after few iterations.
>>>>>>
>>>>>> CPU 1                   CPU 2                    CPU 3
>>>>>> Process 1,              Process 1,               Process 1,
>>>>>> Thread A                Thread B                 Thread C
>>>>>>
>>>>>> while (1) {             while (1) {              while(1) {
>>>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>>>> }                       }
>>>>>>
>>>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>>>> (of lock l), stale tlb entries can exist with write permissions
>>>>>> on one of the CPUs at least. This can create a problem if one
>>>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>>>> entry can still modify old_page even after it is copied to
>>>>>> new_page by wp_page_copy, thus causing a corruption.
>>>>> Nice catch and thanks for your investigation!
>>>>>
>>>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>>>
>>>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>> ---
>>>>>>     mm/memory.c | 7 +++++++
>>>>>>     1 file changed, 7 insertions(+)
>>>>>>
>>>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>>>> index 52080e4..1ea168ff 100644
>>>>>> --- a/mm/memory.c
>>>>>> +++ b/mm/memory.c
>>>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>>>                    return VM_FAULT_RETRY;
>>>>>>            }
>>>>>>
>>>>>> +       /*
>>>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>>>> +        * in copy_one_pte
>>>>>> +        */
>>>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>>> +               flush_tlb_page(vmf.vma, address);
>>>>>> +
>>>>>>            mem_cgroup_oom_enable();
>>>>>>            ret = handle_pte_fault(&vmf);
>>>>>>            mem_cgroup_oom_disable();
>>>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>>>
>>>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>>>
>>>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>>>
>>>>
>>>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>>>
>>>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
>>> Hi, Vinayak and Laurent
>>>
>>> I think the below change will impact the performance significantly. Becuase most of process has many
>>> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
>>> call the flush_tlb_mm  later.
>>>
>>> I think we can try the following way to do.
>>>
>>> vm_write_begin(vma)
>>> copy_pte_range
>>> vm_write_end(vma)
>>>
>>> The speculative page fault will return to grap the mmap_sem to run the nromal path.
>>> Any thought?
>>
>> Here is a new version of the patch fixing this issue. There is no additional TLB flush, all the fix is belonging on vm_write_{begin,end} calls.
>>
>> I did some test on x86_64 and PowerPC but that needs to be double check on arm64.
>>
>> Vinayak, Zhong, could you please give it a try ?
>>
> Hi Laurent
> 
> I apply the patch you had attached and none of any abnormal thing came in two days. It is feasible to fix the issue.

Good news !

> 
> but It will better to filter the condition by is_cow_mapping. is it right?
> 
> for example:
> 
> if (is_cow_mapping(mnpt->vm_flags)) {
>        
>      ........
> }

That's doable for sure but I don't think this has to be introduce in 
dup_mmap().
Unless there is a real performance benefit to do so, I don't think 
dup_mmap() has to mimic underlying checks done in copy_page_range().

Cheers,
Laurent.

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2019-01-25 12:32                 ` zhong jiang
  0 siblings, 0 replies; 58+ messages in thread
From: zhong jiang @ 2019-01-25 12:32 UTC (permalink / raw)
  To: Laurent Dufour; +Cc: Vinayak Menon, Linux-MM, charante, Ganesh Mahendran

On 2019/1/24 16:20, Laurent Dufour wrote:
> Le 22/01/2019 à 17:22, zhong jiang a écrit :
>> On 2019/1/19 0:24, Laurent Dufour wrote:
>>> Le 17/01/2019 à 16:51, zhong jiang a écrit :
>>>> On 2019/1/16 19:41, Vinayak Menon wrote:
>>>>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>>>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>>>>> Hi Laurent,
>>>>>>>>
>>>>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>>>>
>>>>>>> With the patch below, we don't hit the issue.
>>>>>>>
>>>>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>>>>
>>>>>>> It is observed that the following scenario results in
>>>>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>>>>> forever after few iterations.
>>>>>>>
>>>>>>> CPU 1                   CPU 2                    CPU 3
>>>>>>> Process 1,              Process 1,               Process 1,
>>>>>>> Thread A                Thread B                 Thread C
>>>>>>>
>>>>>>> while (1) {             while (1) {              while(1) {
>>>>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>>>>> }                       }
>>>>>>>
>>>>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>>>>> (of lock l), stale tlb entries can exist with write permissions
>>>>>>> on one of the CPUs at least. This can create a problem if one
>>>>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>>>>> entry can still modify old_page even after it is copied to
>>>>>>> new_page by wp_page_copy, thus causing a corruption.
>>>>>> Nice catch and thanks for your investigation!
>>>>>>
>>>>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>>>>
>>>>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>>> ---
>>>>>>>     mm/memory.c | 7 +++++++
>>>>>>>     1 file changed, 7 insertions(+)
>>>>>>>
>>>>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>>>>> index 52080e4..1ea168ff 100644
>>>>>>> --- a/mm/memory.c
>>>>>>> +++ b/mm/memory.c
>>>>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>>>>                    return VM_FAULT_RETRY;
>>>>>>>            }
>>>>>>>
>>>>>>> +       /*
>>>>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>>>>> +        * in copy_one_pte
>>>>>>> +        */
>>>>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>>>> +               flush_tlb_page(vmf.vma, address);
>>>>>>> +
>>>>>>>            mem_cgroup_oom_enable();
>>>>>>>            ret = handle_pte_fault(&vmf);
>>>>>>>            mem_cgroup_oom_disable();
>>>>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>>>>
>>>>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>>>>
>>>>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>>>>
>>>>>
>>>>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>>>>
>>>>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
>>>> Hi, Vinayak and Laurent
>>>>
>>>> I think the below change will impact the performance significantly. Becuase most of process has many
>>>> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
>>>> call the flush_tlb_mm  later.
>>>>
>>>> I think we can try the following way to do.
>>>>
>>>> vm_write_begin(vma)
>>>> copy_pte_range
>>>> vm_write_end(vma)
>>>>
>>>> The speculative page fault will return to grap the mmap_sem to run the nromal path.
>>>> Any thought?
>>>
>>> Here is a new version of the patch fixing this issue. There is no additional TLB flush, all the fix is belonging on vm_write_{begin,end} calls.
>>>
>>> I did some test on x86_64 and PowerPC but that needs to be double check on arm64.
>>>
>>> Vinayak, Zhong, could you please give it a try ?
>>>
>> Hi Laurent
>>
>> I apply the patch you had attached and none of any abnormal thing came in two days. It is feasible to fix the issue.
>
> Good news !
>
>>
>> but It will better to filter the condition by is_cow_mapping. is it right?
>>
>> for example:
>>
>> if (is_cow_mapping(mnpt->vm_flags)) {
>>             ........
>> }
>
> That's doable for sure but I don't think this has to be introduce in dup_mmap().
> Unless there is a real performance benefit to do so, I don't think dup_mmap() has to mimic underlying checks done in copy_page_range().
>

Hi, Laurent

I test the performace with microbench after appling the patch. I find 
the page fault latency will increase about 8% than before.  I think we
should use is_cow_mapping to waken the impact and I will try it out.

or we can use the following solution to replace as Vinayak has said.
 
if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
    return VM_FAULT_RETRY;

Even though it will influence the performance of SPF, but at least it does
not bring in any negative impact. Any thought?

Thanks,


> Cheers,
> Laurent.
>
>
> .
>

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2019-01-25 12:32                 ` zhong jiang
  0 siblings, 0 replies; 58+ messages in thread
From: zhong jiang @ 2019-01-25 12:32 UTC (permalink / raw)
  To: Laurent Dufour; +Cc: Vinayak Menon, Linux-MM, charante, Ganesh Mahendran

On 2019/1/24 16:20, Laurent Dufour wrote:
> Le 22/01/2019 à 17:22, zhong jiang a écrit :
>> On 2019/1/19 0:24, Laurent Dufour wrote:
>>> Le 17/01/2019 à 16:51, zhong jiang a écrit :
>>>> On 2019/1/16 19:41, Vinayak Menon wrote:
>>>>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>>>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>>>>> Hi Laurent,
>>>>>>>>
>>>>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>>>>
>>>>>>> With the patch below, we don't hit the issue.
>>>>>>>
>>>>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>>>>
>>>>>>> It is observed that the following scenario results in
>>>>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>>>>> forever after few iterations.
>>>>>>>
>>>>>>> CPU 1                   CPU 2                    CPU 3
>>>>>>> Process 1,              Process 1,               Process 1,
>>>>>>> Thread A                Thread B                 Thread C
>>>>>>>
>>>>>>> while (1) {             while (1) {              while(1) {
>>>>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>>>>> }                       }
>>>>>>>
>>>>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>>>>> (of lock l), stale tlb entries can exist with write permissions
>>>>>>> on one of the CPUs at least. This can create a problem if one
>>>>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>>>>> entry can still modify old_page even after it is copied to
>>>>>>> new_page by wp_page_copy, thus causing a corruption.
>>>>>> Nice catch and thanks for your investigation!
>>>>>>
>>>>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>>>>
>>>>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>>> ---
>>>>>>>     mm/memory.c | 7 +++++++
>>>>>>>     1 file changed, 7 insertions(+)
>>>>>>>
>>>>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>>>>> index 52080e4..1ea168ff 100644
>>>>>>> --- a/mm/memory.c
>>>>>>> +++ b/mm/memory.c
>>>>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>>>>                    return VM_FAULT_RETRY;
>>>>>>>            }
>>>>>>>
>>>>>>> +       /*
>>>>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>>>>> +        * in copy_one_pte
>>>>>>> +        */
>>>>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>>>> +               flush_tlb_page(vmf.vma, address);
>>>>>>> +
>>>>>>>            mem_cgroup_oom_enable();
>>>>>>>            ret = handle_pte_fault(&vmf);
>>>>>>>            mem_cgroup_oom_disable();
>>>>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>>>>
>>>>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>>>>
>>>>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>>>>
>>>>>
>>>>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>>>>
>>>>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
>>>> Hi, Vinayak and Laurent
>>>>
>>>> I think the below change will impact the performance significantly. Becuase most of process has many
>>>> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
>>>> call the flush_tlb_mm  later.
>>>>
>>>> I think we can try the following way to do.
>>>>
>>>> vm_write_begin(vma)
>>>> copy_pte_range
>>>> vm_write_end(vma)
>>>>
>>>> The speculative page fault will return to grap the mmap_sem to run the nromal path.
>>>> Any thought?
>>>
>>> Here is a new version of the patch fixing this issue. There is no additional TLB flush, all the fix is belonging on vm_write_{begin,end} calls.
>>>
>>> I did some test on x86_64 and PowerPC but that needs to be double check on arm64.
>>>
>>> Vinayak, Zhong, could you please give it a try ?
>>>
>> Hi Laurent
>>
>> I apply the patch you had attached and none of any abnormal thing came in two days. It is feasible to fix the issue.
>
> Good news !
>
>>
>> but It will better to filter the condition by is_cow_mapping. is it right?
>>
>> for example:
>>
>> if (is_cow_mapping(mnpt->vm_flags)) {
>>             ........
>> }
>
> That's doable for sure but I don't think this has to be introduce in dup_mmap().
> Unless there is a real performance benefit to do so, I don't think dup_mmap() has to mimic underlying checks done in copy_page_range().
>

Hi, Laurent

I test the performace with microbench after appling the patch. I find 
the page fault latency will increase about 8% than before.  I think we
should use is_cow_mapping to waken the impact and I will try it out.

or we can use the following solution to replace as Vinayak has said.
 
if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
    return VM_FAULT_RETRY;

Even though it will influence the performance of SPF, but at least it does
not bring in any negative impact. Any thought?

Thanks,


> Cheers,
> Laurent.
>
>
> .
>



^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2019-01-25 12:32                 ` zhong jiang
  (?)
@ 2019-01-28  8:59                 ` Laurent Dufour
  2019-01-28 14:09                     ` zhong jiang
  -1 siblings, 1 reply; 58+ messages in thread
From: Laurent Dufour @ 2019-01-28  8:59 UTC (permalink / raw)
  To: zhong jiang; +Cc: Vinayak Menon, Linux-MM, charante, Ganesh Mahendran

Le 25/01/2019 à 13:32, zhong jiang a écrit :
> On 2019/1/24 16:20, Laurent Dufour wrote:
>> Le 22/01/2019 à 17:22, zhong jiang a écrit :
>>> On 2019/1/19 0:24, Laurent Dufour wrote:
>>>> Le 17/01/2019 à 16:51, zhong jiang a écrit :
>>>>> On 2019/1/16 19:41, Vinayak Menon wrote:
>>>>>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>>>>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>>>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>>>>>> Hi Laurent,
>>>>>>>>>
>>>>>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>>>>>
>>>>>>>> With the patch below, we don't hit the issue.
>>>>>>>>
>>>>>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>>>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>>>>>
>>>>>>>> It is observed that the following scenario results in
>>>>>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>>>>>> forever after few iterations.
>>>>>>>>
>>>>>>>> CPU 1                   CPU 2                    CPU 3
>>>>>>>> Process 1,              Process 1,               Process 1,
>>>>>>>> Thread A                Thread B                 Thread C
>>>>>>>>
>>>>>>>> while (1) {             while (1) {              while(1) {
>>>>>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>>>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>>>>>> }                       }
>>>>>>>>
>>>>>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>>>>>> (of lock l), stale tlb entries can exist with write permissions
>>>>>>>> on one of the CPUs at least. This can create a problem if one
>>>>>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>>>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>>>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>>>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>>>>>> entry can still modify old_page even after it is copied to
>>>>>>>> new_page by wp_page_copy, thus causing a corruption.
>>>>>>> Nice catch and thanks for your investigation!
>>>>>>>
>>>>>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>>>>>
>>>>>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>>>> ---
>>>>>>>>      mm/memory.c | 7 +++++++
>>>>>>>>      1 file changed, 7 insertions(+)
>>>>>>>>
>>>>>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>>>>>> index 52080e4..1ea168ff 100644
>>>>>>>> --- a/mm/memory.c
>>>>>>>> +++ b/mm/memory.c
>>>>>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>>>>>                     return VM_FAULT_RETRY;
>>>>>>>>             }
>>>>>>>>
>>>>>>>> +       /*
>>>>>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>>>>>> +        * in copy_one_pte
>>>>>>>> +        */
>>>>>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>>>>> +               flush_tlb_page(vmf.vma, address);
>>>>>>>> +
>>>>>>>>             mem_cgroup_oom_enable();
>>>>>>>>             ret = handle_pte_fault(&vmf);
>>>>>>>>             mem_cgroup_oom_disable();
>>>>>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>>>>>
>>>>>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>>>>>
>>>>>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>>>>>
>>>>>>
>>>>>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>>>>>
>>>>>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
>>>>> Hi, Vinayak and Laurent
>>>>>
>>>>> I think the below change will impact the performance significantly. Becuase most of process has many
>>>>> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
>>>>> call the flush_tlb_mm  later.
>>>>>
>>>>> I think we can try the following way to do.
>>>>>
>>>>> vm_write_begin(vma)
>>>>> copy_pte_range
>>>>> vm_write_end(vma)
>>>>>
>>>>> The speculative page fault will return to grap the mmap_sem to run the nromal path.
>>>>> Any thought?
>>>>
>>>> Here is a new version of the patch fixing this issue. There is no additional TLB flush, all the fix is belonging on vm_write_{begin,end} calls.
>>>>
>>>> I did some test on x86_64 and PowerPC but that needs to be double check on arm64.
>>>>
>>>> Vinayak, Zhong, could you please give it a try ?
>>>>
>>> Hi Laurent
>>>
>>> I apply the patch you had attached and none of any abnormal thing came in two days. It is feasible to fix the issue.
>>
>> Good news !
>>
>>>
>>> but It will better to filter the condition by is_cow_mapping. is it right?
>>>
>>> for example:
>>>
>>> if (is_cow_mapping(mnpt->vm_flags)) {
>>>              ........
>>> }
>>
>> That's doable for sure but I don't think this has to be introduce in dup_mmap().
>> Unless there is a real performance benefit to do so, I don't think dup_mmap() has to mimic underlying checks done in copy_page_range().
>>
> 
> Hi, Laurent
> 
> I test the performace with microbench after appling the patch. I find
> the page fault latency will increase about 8% than before.  I think we
> should use is_cow_mapping to waken the impact and I will try it out.

That's interesting,  I would not expect such a higher latency assuming 
that most of the area not in copied on write are also not managed by the 
speculative page fault handler (file mapping, etc.). Anyway I'm looking 
forward to see the result with additional is_cow_mapping() check.

> or we can use the following solution to replace as Vinayak has said.
> 
> if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>      return VM_FAULT_RETRY;
> 
> Even though it will influence the performance of SPF, but at least it does
> not bring in any negative impact. Any thought?

I don't agree, this checks will completely by pass the SPF handler for 
all the COW areas, even if there is no race situation.

Cheers,
Laurent.
> 
> Thanks,
> 
> 
>> Cheers,
>> Laurent.
>>
>>
>> .
>>
> 
> 

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2019-01-28 14:09                     ` zhong jiang
  0 siblings, 0 replies; 58+ messages in thread
From: zhong jiang @ 2019-01-28 14:09 UTC (permalink / raw)
  To: Laurent Dufour; +Cc: Vinayak Menon, Linux-MM, charante, Ganesh Mahendran

On 2019/1/28 16:59, Laurent Dufour wrote:
> Le 25/01/2019 à 13:32, zhong jiang a écrit :
>> On 2019/1/24 16:20, Laurent Dufour wrote:
>>> Le 22/01/2019 à 17:22, zhong jiang a écrit :
>>>> On 2019/1/19 0:24, Laurent Dufour wrote:
>>>>> Le 17/01/2019 à 16:51, zhong jiang a écrit :
>>>>>> On 2019/1/16 19:41, Vinayak Menon wrote:
>>>>>>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>>>>>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>>>>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>>>>>>> Hi Laurent,
>>>>>>>>>>
>>>>>>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>>>>>>
>>>>>>>>> With the patch below, we don't hit the issue.
>>>>>>>>>
>>>>>>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>>>>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>>>>>>
>>>>>>>>> It is observed that the following scenario results in
>>>>>>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>>>>>>> forever after few iterations.
>>>>>>>>>
>>>>>>>>> CPU 1                   CPU 2                    CPU 3
>>>>>>>>> Process 1,              Process 1,               Process 1,
>>>>>>>>> Thread A                Thread B                 Thread C
>>>>>>>>>
>>>>>>>>> while (1) {             while (1) {              while(1) {
>>>>>>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>>>>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>>>>>>> }                       }
>>>>>>>>>
>>>>>>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>>>>>>> (of lock l), stale tlb entries can exist with write permissions
>>>>>>>>> on one of the CPUs at least. This can create a problem if one
>>>>>>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>>>>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>>>>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>>>>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>>>>>>> entry can still modify old_page even after it is copied to
>>>>>>>>> new_page by wp_page_copy, thus causing a corruption.
>>>>>>>> Nice catch and thanks for your investigation!
>>>>>>>>
>>>>>>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>>>>>>
>>>>>>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>>>>> ---
>>>>>>>>>      mm/memory.c | 7 +++++++
>>>>>>>>>      1 file changed, 7 insertions(+)
>>>>>>>>>
>>>>>>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>>>>>>> index 52080e4..1ea168ff 100644
>>>>>>>>> --- a/mm/memory.c
>>>>>>>>> +++ b/mm/memory.c
>>>>>>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>>>>>>                     return VM_FAULT_RETRY;
>>>>>>>>>             }
>>>>>>>>>
>>>>>>>>> +       /*
>>>>>>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>>>>>>> +        * in copy_one_pte
>>>>>>>>> +        */
>>>>>>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>>>>>> +               flush_tlb_page(vmf.vma, address);
>>>>>>>>> +
>>>>>>>>>             mem_cgroup_oom_enable();
>>>>>>>>>             ret = handle_pte_fault(&vmf);
>>>>>>>>>             mem_cgroup_oom_disable();
>>>>>>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>>>>>>
>>>>>>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>>>>>>
>>>>>>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>>>>>>
>>>>>>>
>>>>>>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>>>>>>
>>>>>>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
>>>>>> Hi, Vinayak and Laurent
>>>>>>
>>>>>> I think the below change will impact the performance significantly. Becuase most of process has many
>>>>>> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
>>>>>> call the flush_tlb_mm  later.
>>>>>>
>>>>>> I think we can try the following way to do.
>>>>>>
>>>>>> vm_write_begin(vma)
>>>>>> copy_pte_range
>>>>>> vm_write_end(vma)
>>>>>>
>>>>>> The speculative page fault will return to grap the mmap_sem to run the nromal path.
>>>>>> Any thought?
>>>>>
>>>>> Here is a new version of the patch fixing this issue. There is no additional TLB flush, all the fix is belonging on vm_write_{begin,end} calls.
>>>>>
>>>>> I did some test on x86_64 and PowerPC but that needs to be double check on arm64.
>>>>>
>>>>> Vinayak, Zhong, could you please give it a try ?
>>>>>
>>>> Hi Laurent
>>>>
>>>> I apply the patch you had attached and none of any abnormal thing came in two days. It is feasible to fix the issue.
>>>
>>> Good news !
>>>
>>>>
>>>> but It will better to filter the condition by is_cow_mapping. is it right?
>>>>
>>>> for example:
>>>>
>>>> if (is_cow_mapping(mnpt->vm_flags)) {
>>>>              ........
>>>> }
>>>
>>> That's doable for sure but I don't think this has to be introduce in dup_mmap().
>>> Unless there is a real performance benefit to do so, I don't think dup_mmap() has to mimic underlying checks done in copy_page_range().
>>>
>>
>> Hi, Laurent
>>
>> I test the performace with microbench after appling the patch. I find
>> the page fault latency will increase about 8% than before.  I think we
>> should use is_cow_mapping to waken the impact and I will try it out.
>
> That's interesting,  I would not expect such a higher latency assuming that most of the area not in copied on write are also not managed by the speculative page fault handler (file mapping, etc.). Anyway I'm looking forward to see the result with additional is_cow_mapping() check.
>
I test the performance again. It is the protect error access latency in lat_sig.c that it will result in a drop of 8% in that testcase.
The page fault latency, In fact, does not impact the performace. It seems to just the fluctuation.

Thanks,
zhong jiang
>> or we can use the following solution to replace as Vinayak has said.
>>
>> if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>      return VM_FAULT_RETRY;
>>
>> Even though it will influence the performance of SPF, but at least it does
>> not bring in any negative impact. Any thought?
>
> I don't agree, this checks will completely by pass the SPF handler for all the COW areas, even if there is no race situation.
>
> Cheers,
> Laurent.
>>
>> Thanks,
>>
>>
>>> Cheers,
>>> Laurent.
>>>
>>>
>>> .
>>>
>>
>>
>
>
>

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2019-01-28 14:09                     ` zhong jiang
  0 siblings, 0 replies; 58+ messages in thread
From: zhong jiang @ 2019-01-28 14:09 UTC (permalink / raw)
  To: Laurent Dufour; +Cc: Vinayak Menon, Linux-MM, charante, Ganesh Mahendran

On 2019/1/28 16:59, Laurent Dufour wrote:
> Le 25/01/2019 à 13:32, zhong jiang a écrit :
>> On 2019/1/24 16:20, Laurent Dufour wrote:
>>> Le 22/01/2019 à 17:22, zhong jiang a écrit :
>>>> On 2019/1/19 0:24, Laurent Dufour wrote:
>>>>> Le 17/01/2019 à 16:51, zhong jiang a écrit :
>>>>>> On 2019/1/16 19:41, Vinayak Menon wrote:
>>>>>>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>>>>>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>>>>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>>>>>>> Hi Laurent,
>>>>>>>>>>
>>>>>>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>>>>>>
>>>>>>>>> With the patch below, we don't hit the issue.
>>>>>>>>>
>>>>>>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>>>>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>>>>>>
>>>>>>>>> It is observed that the following scenario results in
>>>>>>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>>>>>>> forever after few iterations.
>>>>>>>>>
>>>>>>>>> CPU 1                   CPU 2                    CPU 3
>>>>>>>>> Process 1,              Process 1,               Process 1,
>>>>>>>>> Thread A                Thread B                 Thread C
>>>>>>>>>
>>>>>>>>> while (1) {             while (1) {              while(1) {
>>>>>>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>>>>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>>>>>>> }                       }
>>>>>>>>>
>>>>>>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>>>>>>> (of lock l), stale tlb entries can exist with write permissions
>>>>>>>>> on one of the CPUs at least. This can create a problem if one
>>>>>>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>>>>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>>>>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>>>>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>>>>>>> entry can still modify old_page even after it is copied to
>>>>>>>>> new_page by wp_page_copy, thus causing a corruption.
>>>>>>>> Nice catch and thanks for your investigation!
>>>>>>>>
>>>>>>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>>>>>>
>>>>>>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>>>>> ---
>>>>>>>>>      mm/memory.c | 7 +++++++
>>>>>>>>>      1 file changed, 7 insertions(+)
>>>>>>>>>
>>>>>>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>>>>>>> index 52080e4..1ea168ff 100644
>>>>>>>>> --- a/mm/memory.c
>>>>>>>>> +++ b/mm/memory.c
>>>>>>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>>>>>>                     return VM_FAULT_RETRY;
>>>>>>>>>             }
>>>>>>>>>
>>>>>>>>> +       /*
>>>>>>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>>>>>>> +        * in copy_one_pte
>>>>>>>>> +        */
>>>>>>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>>>>>> +               flush_tlb_page(vmf.vma, address);
>>>>>>>>> +
>>>>>>>>>             mem_cgroup_oom_enable();
>>>>>>>>>             ret = handle_pte_fault(&vmf);
>>>>>>>>>             mem_cgroup_oom_disable();
>>>>>>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>>>>>>
>>>>>>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>>>>>>
>>>>>>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>>>>>>
>>>>>>>
>>>>>>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>>>>>>
>>>>>>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
>>>>>> Hi, Vinayak and Laurent
>>>>>>
>>>>>> I think the below change will impact the performance significantly. Becuase most of process has many
>>>>>> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
>>>>>> call the flush_tlb_mm  later.
>>>>>>
>>>>>> I think we can try the following way to do.
>>>>>>
>>>>>> vm_write_begin(vma)
>>>>>> copy_pte_range
>>>>>> vm_write_end(vma)
>>>>>>
>>>>>> The speculative page fault will return to grap the mmap_sem to run the nromal path.
>>>>>> Any thought?
>>>>>
>>>>> Here is a new version of the patch fixing this issue. There is no additional TLB flush, all the fix is belonging on vm_write_{begin,end} calls.
>>>>>
>>>>> I did some test on x86_64 and PowerPC but that needs to be double check on arm64.
>>>>>
>>>>> Vinayak, Zhong, could you please give it a try ?
>>>>>
>>>> Hi Laurent
>>>>
>>>> I apply the patch you had attached and none of any abnormal thing came in two days. It is feasible to fix the issue.
>>>
>>> Good news !
>>>
>>>>
>>>> but It will better to filter the condition by is_cow_mapping. is it right?
>>>>
>>>> for example:
>>>>
>>>> if (is_cow_mapping(mnpt->vm_flags)) {
>>>>              ........
>>>> }
>>>
>>> That's doable for sure but I don't think this has to be introduce in dup_mmap().
>>> Unless there is a real performance benefit to do so, I don't think dup_mmap() has to mimic underlying checks done in copy_page_range().
>>>
>>
>> Hi, Laurent
>>
>> I test the performace with microbench after appling the patch. I find
>> the page fault latency will increase about 8% than before.  I think we
>> should use is_cow_mapping to waken the impact and I will try it out.
>
> That's interesting,  I would not expect such a higher latency assuming that most of the area not in copied on write are also not managed by the speculative page fault handler (file mapping, etc.). Anyway I'm looking forward to see the result with additional is_cow_mapping() check.
>
I test the performance again. It is the protect error access latency in lat_sig.c that it will result in a drop of 8% in that testcase.
The page fault latency, In fact, does not impact the performace. It seems to just the fluctuation.

Thanks,
zhong jiang
>> or we can use the following solution to replace as Vinayak has said.
>>
>> if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>      return VM_FAULT_RETRY;
>>
>> Even though it will influence the performance of SPF, but at least it does
>> not bring in any negative impact. Any thought?
>
> I don't agree, this checks will completely by pass the SPF handler for all the COW areas, even if there is no race situation.
>
> Cheers,
> Laurent.
>>
>> Thanks,
>>
>>
>>> Cheers,
>>> Laurent.
>>>
>>>
>>> .
>>>
>>
>>
>
>
>



^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2019-01-28 14:09                     ` zhong jiang
  (?)
@ 2019-01-28 15:45                     ` Laurent Dufour
  2019-01-29 15:40                       ` zhong jiang
  -1 siblings, 1 reply; 58+ messages in thread
From: Laurent Dufour @ 2019-01-28 15:45 UTC (permalink / raw)
  To: zhong jiang; +Cc: Vinayak Menon, Linux-MM, charante, Ganesh Mahendran

Le 28/01/2019 à 15:09, zhong jiang a écrit :
> On 2019/1/28 16:59, Laurent Dufour wrote:
>> Le 25/01/2019 à 13:32, zhong jiang a écrit :
>>> On 2019/1/24 16:20, Laurent Dufour wrote:
>>>> Le 22/01/2019 à 17:22, zhong jiang a écrit :
>>>>> On 2019/1/19 0:24, Laurent Dufour wrote:
>>>>>> Le 17/01/2019 à 16:51, zhong jiang a écrit :
>>>>>>> On 2019/1/16 19:41, Vinayak Menon wrote:
>>>>>>>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>>>>>>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>>>>>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>>>>>>>> Hi Laurent,
>>>>>>>>>>>
>>>>>>>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>>>>>>>
>>>>>>>>>> With the patch below, we don't hit the issue.
>>>>>>>>>>
>>>>>>>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>>>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>>>>>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>>>>>>>
>>>>>>>>>> It is observed that the following scenario results in
>>>>>>>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>>>>>>>> forever after few iterations.
>>>>>>>>>>
>>>>>>>>>> CPU 1                   CPU 2                    CPU 3
>>>>>>>>>> Process 1,              Process 1,               Process 1,
>>>>>>>>>> Thread A                Thread B                 Thread C
>>>>>>>>>>
>>>>>>>>>> while (1) {             while (1) {              while(1) {
>>>>>>>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>>>>>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>>>>>>>> }                       }
>>>>>>>>>>
>>>>>>>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>>>>>>>> (of lock l), stale tlb entries can exist with write permissions
>>>>>>>>>> on one of the CPUs at least. This can create a problem if one
>>>>>>>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>>>>>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>>>>>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>>>>>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>>>>>>>> entry can still modify old_page even after it is copied to
>>>>>>>>>> new_page by wp_page_copy, thus causing a corruption.
>>>>>>>>> Nice catch and thanks for your investigation!
>>>>>>>>>
>>>>>>>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>>>>>>>
>>>>>>>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>>>>>> ---
>>>>>>>>>>       mm/memory.c | 7 +++++++
>>>>>>>>>>       1 file changed, 7 insertions(+)
>>>>>>>>>>
>>>>>>>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>>>>>>>> index 52080e4..1ea168ff 100644
>>>>>>>>>> --- a/mm/memory.c
>>>>>>>>>> +++ b/mm/memory.c
>>>>>>>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>>>>>>>                      return VM_FAULT_RETRY;
>>>>>>>>>>              }
>>>>>>>>>>
>>>>>>>>>> +       /*
>>>>>>>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>>>>>>>> +        * in copy_one_pte
>>>>>>>>>> +        */
>>>>>>>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>>>>>>> +               flush_tlb_page(vmf.vma, address);
>>>>>>>>>> +
>>>>>>>>>>              mem_cgroup_oom_enable();
>>>>>>>>>>              ret = handle_pte_fault(&vmf);
>>>>>>>>>>              mem_cgroup_oom_disable();
>>>>>>>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>>>>>>>
>>>>>>>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>>>>>>>
>>>>>>>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>>>>>>>
>>>>>>>>
>>>>>>>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>>>>>>>
>>>>>>>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
>>>>>>> Hi, Vinayak and Laurent
>>>>>>>
>>>>>>> I think the below change will impact the performance significantly. Becuase most of process has many
>>>>>>> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
>>>>>>> call the flush_tlb_mm  later.
>>>>>>>
>>>>>>> I think we can try the following way to do.
>>>>>>>
>>>>>>> vm_write_begin(vma)
>>>>>>> copy_pte_range
>>>>>>> vm_write_end(vma)
>>>>>>>
>>>>>>> The speculative page fault will return to grap the mmap_sem to run the nromal path.
>>>>>>> Any thought?
>>>>>>
>>>>>> Here is a new version of the patch fixing this issue. There is no additional TLB flush, all the fix is belonging on vm_write_{begin,end} calls.
>>>>>>
>>>>>> I did some test on x86_64 and PowerPC but that needs to be double check on arm64.
>>>>>>
>>>>>> Vinayak, Zhong, could you please give it a try ?
>>>>>>
>>>>> Hi Laurent
>>>>>
>>>>> I apply the patch you had attached and none of any abnormal thing came in two days. It is feasible to fix the issue.
>>>>
>>>> Good news !
>>>>
>>>>>
>>>>> but It will better to filter the condition by is_cow_mapping. is it right?
>>>>>
>>>>> for example:
>>>>>
>>>>> if (is_cow_mapping(mnpt->vm_flags)) {
>>>>>               ........
>>>>> }
>>>>
>>>> That's doable for sure but I don't think this has to be introduce in dup_mmap().
>>>> Unless there is a real performance benefit to do so, I don't think dup_mmap() has to mimic underlying checks done in copy_page_range().
>>>>
>>>
>>> Hi, Laurent
>>>
>>> I test the performace with microbench after appling the patch. I find
>>> the page fault latency will increase about 8% than before.  I think we
>>> should use is_cow_mapping to waken the impact and I will try it out.
>>
>> That's interesting,  I would not expect such a higher latency assuming that most of the area not in copied on write are also not managed by the speculative page fault handler (file mapping, etc.). Anyway I'm looking forward to see the result with additional is_cow_mapping() check.
>>
> I test the performance again. It is the protect error access latency in lat_sig.c that it will result in a drop of 8% in that testcase.

What is that "protect error access latency in lat_sig.c" ?

> The page fault latency, In fact, does not impact the performace. It seems to just the fluctuation.
> 
> Thanks,
> zhong jiang
>>> or we can use the following solution to replace as Vinayak has said.
>>>
>>> if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>       return VM_FAULT_RETRY;
>>>
>>> Even though it will influence the performance of SPF, but at least it does
>>> not bring in any negative impact. Any thought?
>>
>> I don't agree, this checks will completely by pass the SPF handler for all the COW areas, even if there is no race situation.
>>
>> Cheers,
>> Laurent.
>>>
>>> Thanks,
>>>
>>>
>>>> Cheers,
>>>> Laurent.
>>>>
>>>>
>>>> .
>>>>
>>>
>>>
>>
>>
>>
> 
> 

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2019-01-28 15:45                     ` Laurent Dufour
@ 2019-01-29 15:40                       ` zhong jiang
  0 siblings, 0 replies; 58+ messages in thread
From: zhong jiang @ 2019-01-29 15:40 UTC (permalink / raw)
  To: Laurent Dufour; +Cc: Vinayak Menon, Linux-MM, charante, Ganesh Mahendran

On 2019/1/28 23:45, Laurent Dufour wrote:
> Le 28/01/2019 à 15:09, zhong jiang a écrit :
>> On 2019/1/28 16:59, Laurent Dufour wrote:
>>> Le 25/01/2019 à 13:32, zhong jiang a écrit :
>>>> On 2019/1/24 16:20, Laurent Dufour wrote:
>>>>> Le 22/01/2019 à 17:22, zhong jiang a écrit :
>>>>>> On 2019/1/19 0:24, Laurent Dufour wrote:
>>>>>>> Le 17/01/2019 à 16:51, zhong jiang a écrit :
>>>>>>>> On 2019/1/16 19:41, Vinayak Menon wrote:
>>>>>>>>> On 1/15/2019 1:54 PM, Laurent Dufour wrote:
>>>>>>>>>> Le 14/01/2019 à 14:19, Vinayak Menon a écrit :
>>>>>>>>>>> On 1/11/2019 9:13 PM, Vinayak Menon wrote:
>>>>>>>>>>>> Hi Laurent,
>>>>>>>>>>>>
>>>>>>>>>>>> We are observing an issue with speculative page fault with the following test code on ARM64 (4.14 kernel, 8 cores).
>>>>>>>>>>>
>>>>>>>>>>> With the patch below, we don't hit the issue.
>>>>>>>>>>>
>>>>>>>>>>> From: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>>>>>>> Date: Mon, 14 Jan 2019 16:06:34 +0530
>>>>>>>>>>> Subject: [PATCH] mm: flush stale tlb entries on speculative write fault
>>>>>>>>>>>
>>>>>>>>>>> It is observed that the following scenario results in
>>>>>>>>>>> threads A and B of process 1 blocking on pthread_mutex_lock
>>>>>>>>>>> forever after few iterations.
>>>>>>>>>>>
>>>>>>>>>>> CPU 1                   CPU 2                    CPU 3
>>>>>>>>>>> Process 1,              Process 1,               Process 1,
>>>>>>>>>>> Thread A                Thread B                 Thread C
>>>>>>>>>>>
>>>>>>>>>>> while (1) {             while (1) {              while(1) {
>>>>>>>>>>> pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
>>>>>>>>>>> pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
>>>>>>>>>>> }                       }
>>>>>>>>>>>
>>>>>>>>>>> When from thread C, copy_one_pte write-protects the parent pte
>>>>>>>>>>> (of lock l), stale tlb entries can exist with write permissions
>>>>>>>>>>> on one of the CPUs at least. This can create a problem if one
>>>>>>>>>>> of the threads A or B hits the write fault. Though dup_mmap calls
>>>>>>>>>>> flush_tlb_mm after copy_page_range, since speculative page fault
>>>>>>>>>>> does not take mmap_sem it can proceed further fixing a fault soon
>>>>>>>>>>> after CPU 3 does ptep_set_wrprotect. But the CPU with stale tlb
>>>>>>>>>>> entry can still modify old_page even after it is copied to
>>>>>>>>>>> new_page by wp_page_copy, thus causing a corruption.
>>>>>>>>>> Nice catch and thanks for your investigation!
>>>>>>>>>>
>>>>>>>>>> There is a real synchronization issue here between copy_page_range() and the speculative page fault handler. I didn't get it on PowerVM since the TLB are flushed when arch_exit_lazy_mode() is called in copy_page_range() but now, I can get it when running on x86_64.
>>>>>>>>>>
>>>>>>>>>>> Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
>>>>>>>>>>> ---
>>>>>>>>>>>       mm/memory.c | 7 +++++++
>>>>>>>>>>>       1 file changed, 7 insertions(+)
>>>>>>>>>>>
>>>>>>>>>>> diff --git a/mm/memory.c b/mm/memory.c
>>>>>>>>>>> index 52080e4..1ea168ff 100644
>>>>>>>>>>> --- a/mm/memory.c
>>>>>>>>>>> +++ b/mm/memory.c
>>>>>>>>>>> @@ -4507,6 +4507,13 @@ int __handle_speculative_fault(struct mm_struct *mm, unsigned long address,
>>>>>>>>>>>                      return VM_FAULT_RETRY;
>>>>>>>>>>>              }
>>>>>>>>>>>
>>>>>>>>>>> +       /*
>>>>>>>>>>> +        * Discard tlb entries created before ptep_set_wrprotect
>>>>>>>>>>> +        * in copy_one_pte
>>>>>>>>>>> +        */
>>>>>>>>>>> +       if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>>>>>>>> +               flush_tlb_page(vmf.vma, address);
>>>>>>>>>>> +
>>>>>>>>>>>              mem_cgroup_oom_enable();
>>>>>>>>>>>              ret = handle_pte_fault(&vmf);
>>>>>>>>>>>              mem_cgroup_oom_disable();
>>>>>>>>>> Your patch is fixing the race but I'm wondering about the cost of these tlb flushes. Here we are flushing on a per page basis (architecture like x86_64 are smarter and flush more pages) but there is a request to flush a range of tlb entries each time a cow page is newly touched. I think there could be some bad impact here.
>>>>>>>>>>
>>>>>>>>>> Another option would be to flush the range in copy_pte_range() before unlocking the page table lock. This will flush entries flush_tlb_mm() would later handle in dup_mmap() but that will be called once per fork per cow VMA.
>>>>>>>>>
>>>>>>>>> But wouldn't this cause an unnecessary impact if most of the COW pages remain untouched (which I assume would be the usual case) and thus do not create a fault ?
>>>>>>>>>
>>>>>>>>>
>>>>>>>>>> I tried the attached patch which seems to fix the issue on x86_64. Could you please give it a try on arm64 ?
>>>>>>>>>>
>>>>>>>>> Your patch works fine on arm64 with a minor change. Thanks Laurent.
>>>>>>>> Hi, Vinayak and Laurent
>>>>>>>>
>>>>>>>> I think the below change will impact the performance significantly. Becuase most of process has many
>>>>>>>> vmas with cow flags. Flush the tlb in advance is not the better way to avoid the issue and it will
>>>>>>>> call the flush_tlb_mm  later.
>>>>>>>>
>>>>>>>> I think we can try the following way to do.
>>>>>>>>
>>>>>>>> vm_write_begin(vma)
>>>>>>>> copy_pte_range
>>>>>>>> vm_write_end(vma)
>>>>>>>>
>>>>>>>> The speculative page fault will return to grap the mmap_sem to run the nromal path.
>>>>>>>> Any thought?
>>>>>>>
>>>>>>> Here is a new version of the patch fixing this issue. There is no additional TLB flush, all the fix is belonging on vm_write_{begin,end} calls.
>>>>>>>
>>>>>>> I did some test on x86_64 and PowerPC but that needs to be double check on arm64.
>>>>>>>
>>>>>>> Vinayak, Zhong, could you please give it a try ?
>>>>>>>
>>>>>> Hi Laurent
>>>>>>
>>>>>> I apply the patch you had attached and none of any abnormal thing came in two days. It is feasible to fix the issue.
>>>>>
>>>>> Good news !
>>>>>
>>>>>>
>>>>>> but It will better to filter the condition by is_cow_mapping. is it right?
>>>>>>
>>>>>> for example:
>>>>>>
>>>>>> if (is_cow_mapping(mnpt->vm_flags)) {
>>>>>>               ........
>>>>>> }
>>>>>
>>>>> That's doable for sure but I don't think this has to be introduce in dup_mmap().
>>>>> Unless there is a real performance benefit to do so, I don't think dup_mmap() has to mimic underlying checks done in copy_page_range().
>>>>>
>>>>
>>>> Hi, Laurent
>>>>
>>>> I test the performace with microbench after appling the patch. I find
>>>> the page fault latency will increase about 8% than before.  I think we
>>>> should use is_cow_mapping to waken the impact and I will try it out.
>>>
>>> That's interesting,  I would not expect such a higher latency assuming that most of the area not in copied on write are also not managed by the speculative page fault handler (file mapping, etc.). Anyway I'm looking forward to see the result with additional is_cow_mapping() check.
>>>
>> I test the performance again. It is the protect error access latency in lat_sig.c that it will result in a drop of 8% in that testcase.
>
> What is that "protect error access latency in lat_sig.c" ?
>
It is the protect error access that the source code is lat_sig.c in microbench.
>> The page fault latency, In fact, does not impact the performace. It seems to just the fluctuation.
>>
>> Thanks,
>> zhong jiang
>>>> or we can use the following solution to replace as Vinayak has said.
>>>>
>>>> if (flags & FAULT_FLAG_WRITE && !pte_write(vmf.orig_pte))
>>>>       return VM_FAULT_RETRY;
>>>>
>>>> Even though it will influence the performance of SPF, but at least it does
>>>> not bring in any negative impact. Any thought?
>>>
>>> I don't agree, this checks will completely by pass the SPF handler for all the COW areas, even if there is no race situation.
>>>
>>> Cheers,
>>> Laurent.
>>>>
>>>> Thanks,
>>>>
>>>>
>>>>> Cheers,
>>>>> Laurent.
>>>>>
>>>>>
>>>>> .
>>>>>
>>>>
>>>>
>>>
>>>
>>>
>>
>>
>
>
> .
>



^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2018-11-05 10:42   ` Balbir Singh
  (?)
@ 2018-11-05 16:08     ` Laurent Dufour
  -1 siblings, 0 replies; 58+ messages in thread
From: Laurent Dufour @ 2018-11-05 16:08 UTC (permalink / raw)
  To: Balbir Singh, Laurent Dufour
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	kemi.wang, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, paulmck,
	Tim Chen, linuxppc-dev, x86

Le 05/11/2018 à 11:42, Balbir Singh a écrit :
> On Thu, May 17, 2018 at 01:06:07PM +0200, Laurent Dufour wrote:
>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>> page fault without holding the mm semaphore [1].
>>
>> The idea is to try to handle user space page faults without holding the
>> mmap_sem. This should allow better concurrency for massively threaded
> 
> Question -- I presume mmap_sem (rw_semaphore implementation tested against)
> was qrwlock?

I don't think so, this series doesn't change the mmap_sem definition so 
it still belongs to the 'struct rw_semaphore'.

Laurent.


^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2018-11-05 16:08     ` Laurent Dufour
  0 siblings, 0 replies; 58+ messages in thread
From: Laurent Dufour @ 2018-11-05 16:08 UTC (permalink / raw)
  To: Balbir Singh, Laurent Dufour
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	kemi.wang, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, paulmck,
	Tim Chen, linuxppc-dev, x86

Le 05/11/2018 A  11:42, Balbir Singh a A(C)critA :
> On Thu, May 17, 2018 at 01:06:07PM +0200, Laurent Dufour wrote:
>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>> page fault without holding the mm semaphore [1].
>>
>> The idea is to try to handle user space page faults without holding the
>> mmap_sem. This should allow better concurrency for massively threaded
> 
> Question -- I presume mmap_sem (rw_semaphore implementation tested against)
> was qrwlock?

I don't think so, this series doesn't change the mmap_sem definition so 
it still belongs to the 'struct rw_semaphore'.

Laurent.

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2018-11-05 16:08     ` Laurent Dufour
  0 siblings, 0 replies; 58+ messages in thread
From: Laurent Dufour @ 2018-11-05 16:08 UTC (permalink / raw)
  To: Balbir Singh, Laurent Dufour
  Cc: jack, sergey.senozhatsky.work, peterz, Will Deacon, mhocko,
	linux-mm, paulus, Punit Agrawal, hpa, Alexei Starovoitov,
	khandual, Andrea Arcangeli, ak, Minchan Kim, x86, Matthew Wilcox,
	Daniel Jordan, Ingo Molnar, David Rientjes, paulmck, npiggin,
	Jerome Glisse, dave, kemi.wang, kirill, Thomas Gleixner,
	Ganesh Mahendran, Yang Shi, linuxppc-dev, linux-kernel,
	Sergey Senozhatsky, vinayak menon, aneesh.kumar, akpm, Tim Chen,
	haren

Le 05/11/2018 à 11:42, Balbir Singh a écrit :
> On Thu, May 17, 2018 at 01:06:07PM +0200, Laurent Dufour wrote:
>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>> page fault without holding the mm semaphore [1].
>>
>> The idea is to try to handle user space page faults without holding the
>> mmap_sem. This should allow better concurrency for massively threaded
> 
> Question -- I presume mmap_sem (rw_semaphore implementation tested against)
> was qrwlock?

I don't think so, this series doesn't change the mmap_sem definition so 
it still belongs to the 'struct rw_semaphore'.

Laurent.


^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2018-05-17 11:06 Laurent Dufour
@ 2018-11-05 10:42   ` Balbir Singh
  2018-11-05 10:42   ` Balbir Singh
  1 sibling, 0 replies; 58+ messages in thread
From: Balbir Singh @ 2018-11-05 10:42 UTC (permalink / raw)
  To: Laurent Dufour
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	kemi.wang, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, paulmck,
	Tim Chen, linuxppc-dev, x86

On Thu, May 17, 2018 at 01:06:07PM +0200, Laurent Dufour wrote:
> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
> page fault without holding the mm semaphore [1].
> 
> The idea is to try to handle user space page faults without holding the
> mmap_sem. This should allow better concurrency for massively threaded

Question -- I presume mmap_sem (rw_semaphore implementation tested against)
was qrwlock?

Balbir Singh.

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2018-11-05 10:42   ` Balbir Singh
  0 siblings, 0 replies; 58+ messages in thread
From: Balbir Singh @ 2018-11-05 10:42 UTC (permalink / raw)
  To: Laurent Dufour
  Cc: jack, sergey.senozhatsky.work, peterz, Will Deacon, mhocko,
	linux-mm, paulus, Punit Agrawal, hpa, Alexei Starovoitov,
	khandual, Andrea Arcangeli, ak, Minchan Kim, x86, Matthew Wilcox,
	Daniel Jordan, Ingo Molnar, David Rientjes, paulmck, npiggin,
	Jerome Glisse, dave, kemi.wang, kirill, Thomas Gleixner,
	Ganesh Mahendran, Yang Shi, linuxppc-dev, linux-kernel,
	Sergey Senozhatsky, vinayak menon, aneesh.kumar, akpm, Tim Chen,
	haren

On Thu, May 17, 2018 at 01:06:07PM +0200, Laurent Dufour wrote:
> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
> page fault without holding the mm semaphore [1].
> 
> The idea is to try to handle user space page faults without holding the
> mmap_sem. This should allow better concurrency for massively threaded

Question -- I presume mmap_sem (rw_semaphore implementation tested against)
was qrwlock?

Balbir Singh.

^ permalink raw reply	[flat|nested] 58+ messages in thread

* RE: [PATCH v11 00/26] Speculative page faults
  2018-08-22 14:23                           ` Laurent Dufour
  (?)
@ 2018-09-18  6:42                           ` Song, HaiyanX
  -1 siblings, 0 replies; 58+ messages in thread
From: Song, HaiyanX @ 2018-09-18  6:42 UTC (permalink / raw)
  To: Laurent Dufour
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

[-- Attachment #1: Type: text/plain, Size: 46630 bytes --]

Hi Laurent,

I am sorry for replying you so late. 
The previous LKP test for this case are running on the same Intel skylake 4s platform, but it need maintain recently. 
So I changed to another test box to run the page_fault3 test case, it is Intel skylake 2s platform (nr_cpu: 104, memory: 64G).

I applied your patch to the SPF kernel (commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12), then triggered below 2 cases test.
a)  Turn on the SPF handler by below command, then run page_fault3-thp-always test.
echo 1 > /proc/sys/vm/speculative_page_fault

b) Turn off the SPF handler by below command, then run page_fault3-thp-always test.
 echo 0 > /proc/sys/vm/speculative_page_fault

Every test run 3 times, and then get test result and capture perf data. 
Here is average result for will-it-scale.per_thread_ops:                                                         
                                                                                          SPF_turn_off       SPF_turn_on
page_fault3-THP-Alwasys.will-it-scale.per_thread_ops    31963                  26285

Best regards,
Haiyan Song

________________________________________
From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
Sent: Wednesday, August 22, 2018 10:23 PM
To: Song, HaiyanX
Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
Subject: Re: [PATCH v11 00/26] Speculative page faults

On 03/08/2018 08:36, Song, HaiyanX wrote:
> Hi Laurent,

Hi Haiyan,

Sorry for the late answer, I was off a couple of days.

>
> Thanks for your analysis for the last perf results.
> Your mentioned ," the major differences at the head of the perf report is the 92% testcase which is weirdly not reported
> on the head side", which is a bug of 0-day,and it caused the item is not counted in perf.
>
> I've triggered the test page_fault2 and page_fault3 again only with thread mode of will-it-scale on 0-day (on the same test box,every case tested 3 times).
> I checked the perf report have no above mentioned problem.
>
> I have compared them, found some items have difference, such as below case:
>        page_fault2-thp-always: handle_mm_fault, base: 45.22%    head: 29.41%
>        page_fault3-thp-always: handle_mm_fault, base: 22.95%    head: 14.15%

These would mean that the system spends lees time running handle_mm_fault()
when SPF is in the picture in this 2 cases which is good. This should lead to
better results with the SPF series, and I can't find any values higher on the
head side.

>
> So i attached the perf result in mail again, could your have a look again for checking the difference between base and head commit.

I took a close look to all the perf result you sent, but I can't identify any
major difference. But the compiler optimization is getting rid of the
handle_pte_fault() symbol on the base kernel which add complexity to check the
differences.

To get rid of that, I'm proposing that you applied the attached patch to the
spf kernel. This patch is allowing to turn on/off the SPF handler through
/proc/sys/vm/speculative_page_fault.

This should ease the testing by limiting the reboot and avoid kernel's symbols
mismatch. Obviously there is still a small overhead due to the check but it
should not be viewable.

With this patch applied you can simply run
echo 1 > /proc/sys/vm/speculative_page_fault
to run a test with the speculative page fault handler activated. Or run
echo 0 > /proc/sys/vm/speculative_page_fault
to run a test without it.

I'm really sorry to asking that again, but could please run the test
page_fault3_base_THP-Always with and without SPF and capture the perf output.

I think we should focus on that test which showed the biggest regression.

Thanks,
Laurent.


>
> Thanks,
> Haiyan, Song
>
> ________________________________________
> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
> Sent: Tuesday, July 17, 2018 5:36 PM
> To: Song, HaiyanX
> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
> Subject: Re: [PATCH v11 00/26] Speculative page faults
>
> On 13/07/2018 05:56, Song, HaiyanX wrote:
>> Hi Laurent,
>
> Hi Haiyan,
>
> Thanks a lot for sharing this perf reports.
>
> I looked at them closely, and I've to admit that I was not able to found a
> major difference between the base and the head report, except that
> handle_pte_fault() is no more in-lined in the head one.
>
> As expected, __handle_speculative_fault() is never traced since these tests are
> dealing with file mapping, not handled in the speculative way.
>
> When running these test did you seen a major differences in the test's result
> between base and head ?
>
> From the number of cycles counted, the biggest difference is page_fault3 when
> run with the THP enabled:
>                                 BASE            HEAD            Delta
> page_fault2_base_thp_never      1142252426747   1065866197589   -6.69%
> page_fault2_base_THP-Alwasys    1124844374523   1076312228927   -4.31%
> page_fault3_base_thp_never      1099387298152   1134118402345   3.16%
> page_fault3_base_THP-Always     1059370178101   853985561949    -19.39%
>
>
> The very weird thing is the difference of the delta cycles reported between
> thp never and thp always, because the speculative way is aborted when checking
> for the vma->ops field, which is the same in both case, and the thp is never
> checked. So there is no code covering differnce, on the speculative path,
> between these 2 cases. This leads me to think that there are other interactions
> interfering in the measure.
>
> Looking at the perf-profile_page_fault3_*_THP-Always, the major differences at
> the head of the perf report is the 92% testcase which is weirdly not reported
> on the head side :
>     92.02%    22.33%  page_fault3_processes  [.] testcase
> 92.02% testcase
>
> Then the base reported 37.67% for __do_page_fault() where the head reported
> 48.41%, but the only difference in this function, between base and head, is the
> call to handle_speculative_fault(). But this is a macro checking for the fault
> flags, and mm->users and then calling __handle_speculative_fault() if needed.
> So this can't explain this difference, except if __handle_speculative_fault()
> is inlined in __do_page_fault().
> Is this the case on your build ?
>
> Haiyan, do you still have the output of the test to check those numbers too ?
>
> Cheers,
> Laurent
>
>> I attached the perf-profile.gz file for case page_fault2 and page_fault3. These files were captured during test the related test case.
>> Please help to check on these data if it can help you to find the higher change. Thanks.
>>
>> File name perf-profile_page_fault2_head_THP-Always.gz, means the perf-profile result get from page_fault2
>>     tested for head commit (a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12) with THP_always configuration.
>>
>> Best regards,
>> Haiyan Song
>>
>> ________________________________________
>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>> Sent: Thursday, July 12, 2018 1:05 AM
>> To: Song, HaiyanX
>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>
>> Hi Haiyan,
>>
>> Do you get a chance to capture some performance cycles on your system ?
>> I still can't get these numbers on my hardware.
>>
>> Thanks,
>> Laurent.
>>
>> On 04/07/2018 09:51, Laurent Dufour wrote:
>>> On 04/07/2018 05:23, Song, HaiyanX wrote:
>>>> Hi Laurent,
>>>>
>>>>
>>>> For the test result on Intel 4s skylake platform (192 CPUs, 768G Memory), the below test cases all were run 3 times.
>>>> I check the test results, only page_fault3_thread/enable THP have 6% stddev for head commit, other tests have lower stddev.
>>>
>>> Repeating the test only 3 times seems a bit too low to me.
>>>
>>> I'll focus on the higher change for the moment, but I don't have access to such
>>> a hardware.
>>>
>>> Is possible to provide a diff between base and SPF of the performance cycles
>>> measured when running page_fault3 and page_fault2 when the 20% change is detected.
>>>
>>> Please stay focus on the test case process to see exactly where the series is
>>> impacting.
>>>
>>> Thanks,
>>> Laurent.
>>>
>>>>
>>>> And I did not find other high variation on test case result.
>>>>
>>>> a). Enable THP
>>>> testcase                          base     stddev       change      head     stddev         metric
>>>> page_fault3/enable THP           10519      ± 3%        -20.5%      8368      ±6%          will-it-scale.per_thread_ops
>>>> page_fault2/enalbe THP            8281      ± 2%        -18.8%      6728                   will-it-scale.per_thread_ops
>>>> brk1/eanble THP                 998475                   -2.2%    976893                   will-it-scale.per_process_ops
>>>> context_switch1/enable THP      223910                   -1.3%    220930                   will-it-scale.per_process_ops
>>>> context_switch1/enable THP      233722                   -1.0%    231288                   will-it-scale.per_thread_ops
>>>>
>>>> b). Disable THP
>>>> page_fault3/disable THP          10856                  -23.1%      8344                   will-it-scale.per_thread_ops
>>>> page_fault2/disable THP           8147                  -18.8%      6613                   will-it-scale.per_thread_ops
>>>> brk1/disable THP                   957                    -7.9%      881                   will-it-scale.per_thread_ops
>>>> context_switch1/disable THP     237006                    -2.2%    231907                  will-it-scale.per_thread_ops
>>>> brk1/disable THP                997317                    -2.0%    977778                  will-it-scale.per_process_ops
>>>> page_fault3/disable THP         467454                    -1.8%    459251                  will-it-scale.per_process_ops
>>>> context_switch1/disable THP     224431                    -1.3%    221567                  will-it-scale.per_process_ops
>>>>
>>>>
>>>> Best regards,
>>>> Haiyan Song
>>>> ________________________________________
>>>> From: Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>> Sent: Monday, July 02, 2018 4:59 PM
>>>> To: Song, HaiyanX
>>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>>
>>>> On 11/06/2018 09:49, Song, HaiyanX wrote:
>>>>> Hi Laurent,
>>>>>
>>>>> Regression test for v11 patch serials have been run, some regression is found by LKP-tools (linux kernel performance)
>>>>> tested on Intel 4s skylake platform. This time only test the cases which have been run and found regressions on
>>>>> V9 patch serials.
>>>>>
>>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>>> branch: Laurent-Dufour/Speculative-page-faults/20180520-045126
>>>>> commit id:
>>>>>   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12
>>>>>   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1
>>>>> Benchmark: will-it-scale
>>>>> Download link: https://github.com/antonblanchard/will-it-scale/tree/master
>>>>>
>>>>> Metrics:
>>>>>   will-it-scale.per_process_ops=processes/nr_cpu
>>>>>   will-it-scale.per_thread_ops=threads/nr_cpu
>>>>>   test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>>> THP: enable / disable
>>>>> nr_task:100%
>>>>>
>>>>> 1. Regressions:
>>>>>
>>>>> a). Enable THP
>>>>> testcase                          base           change      head           metric
>>>>> page_fault3/enable THP           10519          -20.5%        836      will-it-scale.per_thread_ops
>>>>> page_fault2/enalbe THP            8281          -18.8%       6728      will-it-scale.per_thread_ops
>>>>> brk1/eanble THP                 998475           -2.2%     976893      will-it-scale.per_process_ops
>>>>> context_switch1/enable THP      223910           -1.3%     220930      will-it-scale.per_process_ops
>>>>> context_switch1/enable THP      233722           -1.0%     231288      will-it-scale.per_thread_ops
>>>>>
>>>>> b). Disable THP
>>>>> page_fault3/disable THP          10856          -23.1%       8344      will-it-scale.per_thread_ops
>>>>> page_fault2/disable THP           8147          -18.8%       6613      will-it-scale.per_thread_ops
>>>>> brk1/disable THP                   957           -7.9%        881      will-it-scale.per_thread_ops
>>>>> context_switch1/disable THP     237006           -2.2%     231907      will-it-scale.per_thread_ops
>>>>> brk1/disable THP                997317           -2.0%     977778      will-it-scale.per_process_ops
>>>>> page_fault3/disable THP         467454           -1.8%     459251      will-it-scale.per_process_ops
>>>>> context_switch1/disable THP     224431           -1.3%     221567      will-it-scale.per_process_ops
>>>>>
>>>>> Notes: for the above  values of test result, the higher is better.
>>>>
>>>> I tried the same tests on my PowerPC victim VM (1024 CPUs, 11TB) and I can't
>>>> get reproducible results. The results have huge variation, even on the vanilla
>>>> kernel, and I can't state on any changes due to that.
>>>>
>>>> I tried on smaller node (80 CPUs, 32G), and the tests ran better, but I didn't
>>>> measure any changes between the vanilla and the SPF patched ones:
>>>>
>>>> test THP enabled                4.17.0-rc4-mm1  spf             delta
>>>> page_fault3_threads             2697.7          2683.5          -0.53%
>>>> page_fault2_threads             170660.6        169574.1        -0.64%
>>>> context_switch1_threads         6915269.2       6877507.3       -0.55%
>>>> context_switch1_processes       6478076.2       6529493.5       0.79%
>>>> brk1                            243391.2        238527.5        -2.00%
>>>>
>>>> Tests were run 10 times, no high variation detected.
>>>>
>>>> Did you see high variation on your side ? How many times the test were run to
>>>> compute the average values ?
>>>>
>>>> Thanks,
>>>> Laurent.
>>>>
>>>>
>>>>>
>>>>> 2. Improvement: not found improvement based on the selected test cases.
>>>>>
>>>>>
>>>>> Best regards
>>>>> Haiyan Song
>>>>> ________________________________________
>>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>>> Sent: Monday, May 28, 2018 4:54 PM
>>>>> To: Song, HaiyanX
>>>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>>>
>>>>> On 28/05/2018 10:22, Haiyan Song wrote:
>>>>>> Hi Laurent,
>>>>>>
>>>>>> Yes, these tests are done on V9 patch.
>>>>>
>>>>> Do you plan to give this V11 a run ?
>>>>>
>>>>>>
>>>>>>
>>>>>> Best regards,
>>>>>> Haiyan Song
>>>>>>
>>>>>> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:
>>>>>>> On 28/05/2018 07:23, Song, HaiyanX wrote:
>>>>>>>>
>>>>>>>> Some regression and improvements is found by LKP-tools(linux kernel performance) on V9 patch series
>>>>>>>> tested on Intel 4s Skylake platform.
>>>>>>>
>>>>>>> Hi,
>>>>>>>
>>>>>>> Thanks for reporting this benchmark results, but you mentioned the "V9 patch
>>>>>>> series" while responding to the v11 header series...
>>>>>>> Were these tests done on v9 or v11 ?
>>>>>>>
>>>>>>> Cheers,
>>>>>>> Laurent.
>>>>>>>
>>>>>>>>
>>>>>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>>>>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 patch series)
>>>>>>>> Commit id:
>>>>>>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f
>>>>>>>>     head commit: 0355322b3577eeab7669066df42c550a56801110
>>>>>>>> Benchmark suite: will-it-scale
>>>>>>>> Download link:
>>>>>>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests
>>>>>>>> Metrics:
>>>>>>>>     will-it-scale.per_process_ops=processes/nr_cpu
>>>>>>>>     will-it-scale.per_thread_ops=threads/nr_cpu
>>>>>>>> test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>>>>>> THP: enable / disable
>>>>>>>> nr_task: 100%
>>>>>>>>
>>>>>>>> 1. Regressions:
>>>>>>>> a) THP enabled:
>>>>>>>> testcase                        base            change          head       metric
>>>>>>>> page_fault3/ enable THP         10092           -17.5%          8323       will-it-scale.per_thread_ops
>>>>>>>> page_fault2/ enable THP          8300           -17.2%          6869       will-it-scale.per_thread_ops
>>>>>>>> brk1/ enable THP                  957.67         -7.6%           885       will-it-scale.per_thread_ops
>>>>>>>> page_fault3/ enable THP        172821            -5.3%        163692       will-it-scale.per_process_ops
>>>>>>>> signal1/ enable THP              9125            -3.2%          8834       will-it-scale.per_process_ops
>>>>>>>>
>>>>>>>> b) THP disabled:
>>>>>>>> testcase                        base            change          head       metric
>>>>>>>> page_fault3/ disable THP        10107           -19.1%          8180       will-it-scale.per_thread_ops
>>>>>>>> page_fault2/ disable THP         8432           -17.8%          6931       will-it-scale.per_thread_ops
>>>>>>>> context_switch1/ disable THP   215389            -6.8%        200776       will-it-scale.per_thread_ops
>>>>>>>> brk1/ disable THP                 939.67         -6.6%           877.33    will-it-scale.per_thread_ops
>>>>>>>> page_fault3/ disable THP       173145            -4.7%        165064       will-it-scale.per_process_ops
>>>>>>>> signal1/ disable THP             9162            -3.9%          8802       will-it-scale.per_process_ops
>>>>>>>>
>>>>>>>> 2. Improvements:
>>>>>>>> a) THP enabled:
>>>>>>>> testcase                        base            change          head       metric
>>>>>>>> malloc1/ enable THP               66.33        +469.8%           383.67    will-it-scale.per_thread_ops
>>>>>>>> writeseek3/ enable THP          2531             +4.5%          2646       will-it-scale.per_thread_ops
>>>>>>>> signal1/ enable THP              989.33          +2.8%          1016       will-it-scale.per_thread_ops
>>>>>>>>
>>>>>>>> b) THP disabled:
>>>>>>>> testcase                        base            change          head       metric
>>>>>>>> malloc1/ disable THP              90.33        +417.3%           467.33    will-it-scale.per_thread_ops
>>>>>>>> read2/ disable THP             58934            +39.2%         82060       will-it-scale.per_thread_ops
>>>>>>>> page_fault1/ disable THP        8607            +36.4%         11736       will-it-scale.per_thread_ops
>>>>>>>> read1/ disable THP            314063            +12.7%        353934       will-it-scale.per_thread_ops
>>>>>>>> writeseek3/ disable THP         2452            +12.5%          2759       will-it-scale.per_thread_ops
>>>>>>>> signal1/ disable THP             971.33          +5.5%          1024       will-it-scale.per_thread_ops
>>>>>>>>
>>>>>>>> Notes: for above values in column "change", the higher value means that the related testcase result
>>>>>>>> on head commit is better than that on base commit for this benchmark.
>>>>>>>>
>>>>>>>>
>>>>>>>> Best regards
>>>>>>>> Haiyan Song
>>>>>>>>
>>>>>>>> ________________________________________
>>>>>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>>>>>> Sent: Thursday, May 17, 2018 7:06 PM
>>>>>>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi
>>>>>>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>>>>>> Subject: [PATCH v11 00/26] Speculative page faults
>>>>>>>>
>>>>>>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>>>>>>>> page fault without holding the mm semaphore [1].
>>>>>>>>
>>>>>>>> The idea is to try to handle user space page faults without holding the
>>>>>>>> mmap_sem. This should allow better concurrency for massively threaded
>>>>>>>> process since the page fault handler will not wait for other threads memory
>>>>>>>> layout change to be done, assuming that this change is done in another part
>>>>>>>> of the process's memory space. This type page fault is named speculative
>>>>>>>> page fault. If the speculative page fault fails because of a concurrency is
>>>>>>>> detected or because underlying PMD or PTE tables are not yet allocating, it
>>>>>>>> is failing its processing and a classic page fault is then tried.
>>>>>>>>
>>>>>>>> The speculative page fault (SPF) has to look for the VMA matching the fault
>>>>>>>> address without holding the mmap_sem, this is done by introducing a rwlock
>>>>>>>> which protects the access to the mm_rb tree. Previously this was done using
>>>>>>>> SRCU but it was introducing a lot of scheduling to process the VMA's
>>>>>>>> freeing operation which was hitting the performance by 20% as reported by
>>>>>>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is
>>>>>>>> limiting the locking contention to these operations which are expected to
>>>>>>>> be in a O(log n) order. In addition to ensure that the VMA is not freed in
>>>>>>>> our back a reference count is added and 2 services (get_vma() and
>>>>>>>> put_vma()) are introduced to handle the reference count. Once a VMA is
>>>>>>>> fetched from the RB tree using get_vma(), it must be later freed using
>>>>>>>> put_vma(). I can't see anymore the overhead I got while will-it-scale
>>>>>>>> benchmark anymore.
>>>>>>>>
>>>>>>>> The VMA's attributes checked during the speculative page fault processing
>>>>>>>> have to be protected against parallel changes. This is done by using a per
>>>>>>>> VMA sequence lock. This sequence lock allows the speculative page fault
>>>>>>>> handler to fast check for parallel changes in progress and to abort the
>>>>>>>> speculative page fault in that case.
>>>>>>>>
>>>>>>>> Once the VMA has been found, the speculative page fault handler would check
>>>>>>>> for the VMA's attributes to verify that the page fault has to be handled
>>>>>>>> correctly or not. Thus, the VMA is protected through a sequence lock which
>>>>>>>> allows fast detection of concurrent VMA changes. If such a change is
>>>>>>>> detected, the speculative page fault is aborted and a *classic* page fault
>>>>>>>> is tried.  VMA sequence lockings are added when VMA attributes which are
>>>>>>>> checked during the page fault are modified.
>>>>>>>>
>>>>>>>> When the PTE is fetched, the VMA is checked to see if it has been changed,
>>>>>>>> so once the page table is locked, the VMA is valid, so any other changes
>>>>>>>> leading to touching this PTE will need to lock the page table, so no
>>>>>>>> parallel change is possible at this time.
>>>>>>>>
>>>>>>>> The locking of the PTE is done with interrupts disabled, this allows
>>>>>>>> checking for the PMD to ensure that there is not an ongoing collapsing
>>>>>>>> operation. Since khugepaged is firstly set the PMD to pmd_none and then is
>>>>>>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd is
>>>>>>>> valid at the time the PTE is locked, we have the guarantee that the
>>>>>>>> collapsing operation will have to wait on the PTE lock to move forward.
>>>>>>>> This allows the SPF handler to map the PTE safely. If the PMD value is
>>>>>>>> different from the one recorded at the beginning of the SPF operation, the
>>>>>>>> classic page fault handler will be called to handle the operation while
>>>>>>>> holding the mmap_sem. As the PTE lock is done with the interrupts disabled,
>>>>>>>> the lock is done using spin_trylock() to avoid dead lock when handling a
>>>>>>>> page fault while a TLB invalidate is requested by another CPU holding the
>>>>>>>> PTE.
>>>>>>>>
>>>>>>>> In pseudo code, this could be seen as:
>>>>>>>>     speculative_page_fault()
>>>>>>>>     {
>>>>>>>>             vma = get_vma()
>>>>>>>>             check vma sequence count
>>>>>>>>             check vma's support
>>>>>>>>             disable interrupt
>>>>>>>>                   check pgd,p4d,...,pte
>>>>>>>>                   save pmd and pte in vmf
>>>>>>>>                   save vma sequence counter in vmf
>>>>>>>>             enable interrupt
>>>>>>>>             check vma sequence count
>>>>>>>>             handle_pte_fault(vma)
>>>>>>>>                     ..
>>>>>>>>                     page = alloc_page()
>>>>>>>>                     pte_map_lock()
>>>>>>>>                             disable interrupt
>>>>>>>>                                     abort if sequence counter has changed
>>>>>>>>                                     abort if pmd or pte has changed
>>>>>>>>                                     pte map and lock
>>>>>>>>                             enable interrupt
>>>>>>>>                     if abort
>>>>>>>>                        free page
>>>>>>>>                        abort
>>>>>>>>                     ...
>>>>>>>>     }
>>>>>>>>
>>>>>>>>     arch_fault_handler()
>>>>>>>>     {
>>>>>>>>             if (speculative_page_fault(&vma))
>>>>>>>>                goto done
>>>>>>>>     again:
>>>>>>>>             lock(mmap_sem)
>>>>>>>>             vma = find_vma();
>>>>>>>>             handle_pte_fault(vma);
>>>>>>>>             if retry
>>>>>>>>                unlock(mmap_sem)
>>>>>>>>                goto again;
>>>>>>>>     done:
>>>>>>>>             handle fault error
>>>>>>>>     }
>>>>>>>>
>>>>>>>> Support for THP is not done because when checking for the PMD, we can be
>>>>>>>> confused by an in progress collapsing operation done by khugepaged. The
>>>>>>>> issue is that pmd_none() could be true either if the PMD is not already
>>>>>>>> populated or if the underlying PTE are in the way to be collapsed. So we
>>>>>>>> cannot safely allocate a PMD if pmd_none() is true.
>>>>>>>>
>>>>>>>> This series add a new software performance event named 'speculative-faults'
>>>>>>>> or 'spf'. It counts the number of successful page fault event handled
>>>>>>>> speculatively. When recording 'faults,spf' events, the faults one is
>>>>>>>> counting the total number of page fault events while 'spf' is only counting
>>>>>>>> the part of the faults processed speculatively.
>>>>>>>>
>>>>>>>> There are some trace events introduced by this series. They allow
>>>>>>>> identifying why the page faults were not processed speculatively. This
>>>>>>>> doesn't take in account the faults generated by a monothreaded process
>>>>>>>> which directly processed while holding the mmap_sem. This trace events are
>>>>>>>> grouped in a system named 'pagefault', they are:
>>>>>>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back
>>>>>>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.
>>>>>>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported
>>>>>>>>  - pagefault:spf_vma_access : the VMA's access right are not respected
>>>>>>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in our
>>>>>>>>    back.
>>>>>>>>
>>>>>>>> To record all the related events, the easier is to run perf with the
>>>>>>>> following arguments :
>>>>>>>> $ perf stat -e 'faults,spf,pagefault:*' <command>
>>>>>>>>
>>>>>>>> There is also a dedicated vmstat counter showing the number of successful
>>>>>>>> page fault handled speculatively. I can be seen this way:
>>>>>>>> $ grep speculative_pgfault /proc/vmstat
>>>>>>>>
>>>>>>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is functional
>>>>>>>> on x86, PowerPC and arm64.
>>>>>>>>
>>>>>>>> ---------------------
>>>>>>>> Real Workload results
>>>>>>>>
>>>>>>>> As mentioned in previous email, we did non official runs using a "popular
>>>>>>>> in memory multithreaded database product" on 176 cores SMT8 Power system
>>>>>>>> which showed a 30% improvements in the number of transaction processed per
>>>>>>>> second. This run has been done on the v6 series, but changes introduced in
>>>>>>>> this new version should not impact the performance boost seen.
>>>>>>>>
>>>>>>>> Here are the perf data captured during 2 of these runs on top of the v8
>>>>>>>> series:
>>>>>>>>                 vanilla         spf
>>>>>>>> faults          89.418          101.364         +13%
>>>>>>>> spf                n/a           97.989
>>>>>>>>
>>>>>>>> With the SPF kernel, most of the page fault were processed in a speculative
>>>>>>>> way.
>>>>>>>>
>>>>>>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and gave
>>>>>>>> it a try on an android device. He reported that the application launch time
>>>>>>>> was improved in average by 6%, and for large applications (~100 threads) by
>>>>>>>> 20%.
>>>>>>>>
>>>>>>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qcom
>>>>>>>> MSM845 (8 cores) with 6GB (the less is better):
>>>>>>>>
>>>>>>>> Application                             4.9     4.9+spf delta
>>>>>>>> com.tencent.mm                          416     389     -7%
>>>>>>>> com.eg.android.AlipayGphone             1135    986     -13%
>>>>>>>> com.tencent.mtt                         455     454     0%
>>>>>>>> com.qqgame.hlddz                        1497    1409    -6%
>>>>>>>> com.autonavi.minimap                    711     701     -1%
>>>>>>>> com.tencent.tmgp.sgame                  788     748     -5%
>>>>>>>> com.immomo.momo                         501     487     -3%
>>>>>>>> com.tencent.peng                        2145    2112    -2%
>>>>>>>> com.smile.gifmaker                      491     461     -6%
>>>>>>>> com.baidu.BaiduMap                      479     366     -23%
>>>>>>>> com.taobao.taobao                       1341    1198    -11%
>>>>>>>> com.baidu.searchbox                     333     314     -6%
>>>>>>>> com.tencent.mobileqq                    394     384     -3%
>>>>>>>> com.sina.weibo                          907     906     0%
>>>>>>>> com.youku.phone                         816     731     -11%
>>>>>>>> com.happyelements.AndroidAnimal.qq      763     717     -6%
>>>>>>>> com.UCMobile                            415     411     -1%
>>>>>>>> com.tencent.tmgp.ak                     1464    1431    -2%
>>>>>>>> com.tencent.qqmusic                     336     329     -2%
>>>>>>>> com.sankuai.meituan                     1661    1302    -22%
>>>>>>>> com.netease.cloudmusic                  1193    1200    1%
>>>>>>>> air.tv.douyu.android                    4257    4152    -2%
>>>>>>>>
>>>>>>>> ------------------
>>>>>>>> Benchmarks results
>>>>>>>>
>>>>>>>> Base kernel is v4.17.0-rc4-mm1
>>>>>>>> SPF is BASE + this series
>>>>>>>>
>>>>>>>> Kernbench:
>>>>>>>> ----------
>>>>>>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15
>>>>>>>> kernel (kernel is build 5 times):
>>>>>>>>
>>>>>>>> Average Half load -j 8
>>>>>>>>                  Run    (std deviation)
>>>>>>>>                  BASE                   SPF
>>>>>>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%
>>>>>>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%
>>>>>>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%
>>>>>>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%
>>>>>>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%
>>>>>>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%
>>>>>>>>
>>>>>>>> Average Optimal load -j 16
>>>>>>>>                  Run    (std deviation)
>>>>>>>>                  BASE                   SPF
>>>>>>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%
>>>>>>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%
>>>>>>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%
>>>>>>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%
>>>>>>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%
>>>>>>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%
>>>>>>>>
>>>>>>>>
>>>>>>>> During a run on the SPF, perf events were captured:
>>>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>>>          526743764      faults
>>>>>>>>                210      spf
>>>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>>               2278      pagefault:spf_vma_notsup
>>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>>
>>>>>>>> Very few speculative page faults were recorded as most of the processes
>>>>>>>> involved are monothreaded (sounds that on this architecture some threads
>>>>>>>> were created during the kernel build processing).
>>>>>>>>
>>>>>>>> Here are the kerbench results on a 80 CPUs Power8 system:
>>>>>>>>
>>>>>>>> Average Half load -j 40
>>>>>>>>                  Run    (std deviation)
>>>>>>>>                  BASE                   SPF
>>>>>>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%
>>>>>>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%
>>>>>>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%
>>>>>>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%
>>>>>>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%
>>>>>>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%
>>>>>>>>
>>>>>>>> Average Optimal load -j 80
>>>>>>>>                  Run    (std deviation)
>>>>>>>>                  BASE                   SPF
>>>>>>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%
>>>>>>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%
>>>>>>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%
>>>>>>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%
>>>>>>>> Context Switches 223861  (138865)       225032  (139632)        0.52%
>>>>>>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%
>>>>>>>>
>>>>>>>> During a run on the SPF, perf events were captured:
>>>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>>>          116730856      faults
>>>>>>>>                  0      spf
>>>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>>                476      pagefault:spf_vma_notsup
>>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>>
>>>>>>>> Most of the processes involved are monothreaded so SPF is not activated but
>>>>>>>> there is no impact on the performance.
>>>>>>>>
>>>>>>>> Ebizzy:
>>>>>>>> -------
>>>>>>>> The test is counting the number of records per second it can manage, the
>>>>>>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get
>>>>>>>> consistent result I repeated the test 100 times and measure the average
>>>>>>>> result. The number is the record processes per second, the higher is the
>>>>>>>> best.
>>>>>>>>
>>>>>>>>                 BASE            SPF             delta
>>>>>>>> 16 CPUs x86 VM  742.57          1490.24         100.69%
>>>>>>>> 80 CPUs P8 node 13105.4         24174.23        84.46%
>>>>>>>>
>>>>>>>> Here are the performance counter read during a run on a 16 CPUs x86 VM:
>>>>>>>>  Performance counter stats for './ebizzy -mTt 16':
>>>>>>>>            1706379      faults
>>>>>>>>            1674599      spf
>>>>>>>>              30588      pagefault:spf_vma_changed
>>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>>                363      pagefault:spf_vma_notsup
>>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>>
>>>>>>>> And the ones captured during a run on a 80 CPUs Power node:
>>>>>>>>  Performance counter stats for './ebizzy -mTt 80':
>>>>>>>>            1874773      faults
>>>>>>>>            1461153      spf
>>>>>>>>             413293      pagefault:spf_vma_changed
>>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>>                200      pagefault:spf_vma_notsup
>>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>>
>>>>>>>> In ebizzy's case most of the page fault were handled in a speculative way,
>>>>>>>> leading the ebizzy performance boost.
>>>>>>>>
>>>>>>>> ------------------
>>>>>>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):
>>>>>>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahendran
>>>>>>>>    and Minchan Kim, hopefully.
>>>>>>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in
>>>>>>>>    __do_page_fault().
>>>>>>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails
>>>>>>>>    instead
>>>>>>>>    of aborting the speculative page fault handling. Dropping the now
>>>>>>>> useless
>>>>>>>>    trace event pagefault:spf_pte_lock.
>>>>>>>>  - No more try to reuse the fetched VMA during the speculative page fault
>>>>>>>>    handling when retrying is needed. This adds a lot of complexity and
>>>>>>>>    additional tests done didn't show a significant performance improvement.
>>>>>>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.
>>>>>>>>
>>>>>>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at-speculative-page-faults-tt965642.html#none
>>>>>>>> [2] https://patchwork.kernel.org/patch/9999687/
>>>>>>>>
>>>>>>>>
>>>>>>>> Laurent Dufour (20):
>>>>>>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT
>>>>>>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE
>>>>>>>>   mm: make pte_unmap_same compatible with SPF
>>>>>>>>   mm: introduce INIT_VMA()
>>>>>>>>   mm: protect VMA modifications using VMA sequence count
>>>>>>>>   mm: protect mremap() against SPF hanlder
>>>>>>>>   mm: protect SPF handler against anon_vma changes
>>>>>>>>   mm: cache some VMA fields in the vm_fault structure
>>>>>>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()
>>>>>>>>   mm: introduce __lru_cache_add_active_or_unevictable
>>>>>>>>   mm: introduce __vm_normal_page()
>>>>>>>>   mm: introduce __page_add_new_anon_rmap()
>>>>>>>>   mm: protect mm_rb tree with a rwlock
>>>>>>>>   mm: adding speculative page fault failure trace events
>>>>>>>>   perf: add a speculative page fault sw event
>>>>>>>>   perf tools: add support for the SPF perf event
>>>>>>>>   mm: add speculative page fault vmstats
>>>>>>>>   powerpc/mm: add speculative page fault
>>>>>>>>
>>>>>>>> Mahendran Ganesh (2):
>>>>>>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>>   arm64/mm: add speculative page fault
>>>>>>>>
>>>>>>>> Peter Zijlstra (4):
>>>>>>>>   mm: prepare for FAULT_FLAG_SPECULATIVE
>>>>>>>>   mm: VMA sequence count
>>>>>>>>   mm: provide speculative fault infrastructure
>>>>>>>>   x86/mm: add speculative pagefault handling
>>>>>>>>
>>>>>>>>  arch/arm64/Kconfig                    |   1 +
>>>>>>>>  arch/arm64/mm/fault.c                 |  12 +
>>>>>>>>  arch/powerpc/Kconfig                  |   1 +
>>>>>>>>  arch/powerpc/mm/fault.c               |  16 +
>>>>>>>>  arch/x86/Kconfig                      |   1 +
>>>>>>>>  arch/x86/mm/fault.c                   |  27 +-
>>>>>>>>  fs/exec.c                             |   2 +-
>>>>>>>>  fs/proc/task_mmu.c                    |   5 +-
>>>>>>>>  fs/userfaultfd.c                      |  17 +-
>>>>>>>>  include/linux/hugetlb_inline.h        |   2 +-
>>>>>>>>  include/linux/migrate.h               |   4 +-
>>>>>>>>  include/linux/mm.h                    | 136 +++++++-
>>>>>>>>  include/linux/mm_types.h              |   7 +
>>>>>>>>  include/linux/pagemap.h               |   4 +-
>>>>>>>>  include/linux/rmap.h                  |  12 +-
>>>>>>>>  include/linux/swap.h                  |  10 +-
>>>>>>>>  include/linux/vm_event_item.h         |   3 +
>>>>>>>>  include/trace/events/pagefault.h      |  80 +++++
>>>>>>>>  include/uapi/linux/perf_event.h       |   1 +
>>>>>>>>  kernel/fork.c                         |   5 +-
>>>>>>>>  mm/Kconfig                            |  22 ++
>>>>>>>>  mm/huge_memory.c                      |   6 +-
>>>>>>>>  mm/hugetlb.c                          |   2 +
>>>>>>>>  mm/init-mm.c                          |   3 +
>>>>>>>>  mm/internal.h                         |  20 ++
>>>>>>>>  mm/khugepaged.c                       |   5 +
>>>>>>>>  mm/madvise.c                          |   6 +-
>>>>>>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++++++-----
>>>>>>>>  mm/mempolicy.c                        |  51 ++-
>>>>>>>>  mm/migrate.c                          |   6 +-
>>>>>>>>  mm/mlock.c                            |  13 +-
>>>>>>>>  mm/mmap.c                             | 229 ++++++++++---
>>>>>>>>  mm/mprotect.c                         |   4 +-
>>>>>>>>  mm/mremap.c                           |  13 +
>>>>>>>>  mm/nommu.c                            |   2 +-
>>>>>>>>  mm/rmap.c                             |   5 +-
>>>>>>>>  mm/swap.c                             |   6 +-
>>>>>>>>  mm/swap_state.c                       |   8 +-
>>>>>>>>  mm/vmstat.c                           |   5 +-
>>>>>>>>  tools/include/uapi/linux/perf_event.h |   1 +
>>>>>>>>  tools/perf/util/evsel.c               |   1 +
>>>>>>>>  tools/perf/util/parse-events.c        |   4 +
>>>>>>>>  tools/perf/util/parse-events.l        |   1 +
>>>>>>>>  tools/perf/util/python.c              |   1 +
>>>>>>>>  44 files changed, 1161 insertions(+), 211 deletions(-)
>>>>>>>>  create mode 100644 include/trace/events/pagefault.h
>>>>>>>>
>>>>>>>> --
>>>>>>>> 2.7.4
>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>
>>>>>
>>>>
>>>>
>>>
>>
>


[-- Attachment #2: perf-profile_page_fault3-head-thp-always-SPF-off.gz --]
[-- Type: application/gzip, Size: 11278 bytes --]

[-- Attachment #3: perf-profile_page_fault3-head-thp-always-SPF-on.gz --]
[-- Type: application/gzip, Size: 11424 bytes --]

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2018-08-03  6:36                       ` Song, HaiyanX
@ 2018-08-22 14:23                           ` Laurent Dufour
  2018-08-22 14:23                           ` Laurent Dufour
  1 sibling, 0 replies; 58+ messages in thread
From: Laurent Dufour @ 2018-08-22 14:23 UTC (permalink / raw)
  To: Song, HaiyanX
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

[-- Attachment #1: Type: text/plain, Size: 43707 bytes --]

On 03/08/2018 08:36, Song, HaiyanX wrote:
> Hi Laurent,

Hi Haiyan,

Sorry for the late answer, I was off a couple of days.

> 
> Thanks for your analysis for the last perf results.
> Your mentioned ," the major differences at the head of the perf report is the 92% testcase which is weirdly not reported
> on the head side", which is a bug of 0-day,and it caused the item is not counted in perf. 
> 
> I've triggered the test page_fault2 and page_fault3 again only with thread mode of will-it-scale on 0-day (on the same test box,every case tested 3 times).
> I checked the perf report have no above mentioned problem.
> 
> I have compared them, found some items have difference, such as below case:
>        page_fault2-thp-always: handle_mm_fault, base: 45.22%    head: 29.41%
>        page_fault3-thp-always: handle_mm_fault, base: 22.95%    head: 14.15%       

These would mean that the system spends lees time running handle_mm_fault()
when SPF is in the picture in this 2 cases which is good. This should lead to
better results with the SPF series, and I can't find any values higher on the
head side.

> 
> So i attached the perf result in mail again, could your have a look again for checking the difference between base and head commit.

I took a close look to all the perf result you sent, but I can't identify any
major difference. But the compiler optimization is getting rid of the
handle_pte_fault() symbol on the base kernel which add complexity to check the
differences.

To get rid of that, I'm proposing that you applied the attached patch to the
spf kernel. This patch is allowing to turn on/off the SPF handler through
/proc/sys/vm/speculative_page_fault.

This should ease the testing by limiting the reboot and avoid kernel's symbols
mismatch. Obviously there is still a small overhead due to the check but it
should not be viewable.

With this patch applied you can simply run
echo 1 > /proc/sys/vm/speculative_page_fault
to run a test with the speculative page fault handler activated. Or run
echo 0 > /proc/sys/vm/speculative_page_fault
to run a test without it.

I'm really sorry to asking that again, but could please run the test
page_fault3_base_THP-Always with and without SPF and capture the perf output.

I think we should focus on that test which showed the biggest regression.

Thanks,
Laurent.


> 
> Thanks,
> Haiyan, Song
>  
> ________________________________________
> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
> Sent: Tuesday, July 17, 2018 5:36 PM
> To: Song, HaiyanX
> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
> Subject: Re: [PATCH v11 00/26] Speculative page faults
> 
> On 13/07/2018 05:56, Song, HaiyanX wrote:
>> Hi Laurent,
> 
> Hi Haiyan,
> 
> Thanks a lot for sharing this perf reports.
> 
> I looked at them closely, and I've to admit that I was not able to found a
> major difference between the base and the head report, except that
> handle_pte_fault() is no more in-lined in the head one.
> 
> As expected, __handle_speculative_fault() is never traced since these tests are
> dealing with file mapping, not handled in the speculative way.
> 
> When running these test did you seen a major differences in the test's result
> between base and head ?
> 
> From the number of cycles counted, the biggest difference is page_fault3 when
> run with the THP enabled:
>                                 BASE            HEAD            Delta
> page_fault2_base_thp_never      1142252426747   1065866197589   -6.69%
> page_fault2_base_THP-Alwasys    1124844374523   1076312228927   -4.31%
> page_fault3_base_thp_never      1099387298152   1134118402345   3.16%
> page_fault3_base_THP-Always     1059370178101   853985561949    -19.39%
> 
> 
> The very weird thing is the difference of the delta cycles reported between
> thp never and thp always, because the speculative way is aborted when checking
> for the vma->ops field, which is the same in both case, and the thp is never
> checked. So there is no code covering differnce, on the speculative path,
> between these 2 cases. This leads me to think that there are other interactions
> interfering in the measure.
> 
> Looking at the perf-profile_page_fault3_*_THP-Always, the major differences at
> the head of the perf report is the 92% testcase which is weirdly not reported
> on the head side :
>     92.02%    22.33%  page_fault3_processes  [.] testcase
> 92.02% testcase
> 
> Then the base reported 37.67% for __do_page_fault() where the head reported
> 48.41%, but the only difference in this function, between base and head, is the
> call to handle_speculative_fault(). But this is a macro checking for the fault
> flags, and mm->users and then calling __handle_speculative_fault() if needed.
> So this can't explain this difference, except if __handle_speculative_fault()
> is inlined in __do_page_fault().
> Is this the case on your build ?
> 
> Haiyan, do you still have the output of the test to check those numbers too ?
> 
> Cheers,
> Laurent
> 
>> I attached the perf-profile.gz file for case page_fault2 and page_fault3. These files were captured during test the related test case.
>> Please help to check on these data if it can help you to find the higher change. Thanks.
>>
>> File name perf-profile_page_fault2_head_THP-Always.gz, means the perf-profile result get from page_fault2
>>     tested for head commit (a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12) with THP_always configuration.
>>
>> Best regards,
>> Haiyan Song
>>
>> ________________________________________
>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>> Sent: Thursday, July 12, 2018 1:05 AM
>> To: Song, HaiyanX
>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>
>> Hi Haiyan,
>>
>> Do you get a chance to capture some performance cycles on your system ?
>> I still can't get these numbers on my hardware.
>>
>> Thanks,
>> Laurent.
>>
>> On 04/07/2018 09:51, Laurent Dufour wrote:
>>> On 04/07/2018 05:23, Song, HaiyanX wrote:
>>>> Hi Laurent,
>>>>
>>>>
>>>> For the test result on Intel 4s skylake platform (192 CPUs, 768G Memory), the below test cases all were run 3 times.
>>>> I check the test results, only page_fault3_thread/enable THP have 6% stddev for head commit, other tests have lower stddev.
>>>
>>> Repeating the test only 3 times seems a bit too low to me.
>>>
>>> I'll focus on the higher change for the moment, but I don't have access to such
>>> a hardware.
>>>
>>> Is possible to provide a diff between base and SPF of the performance cycles
>>> measured when running page_fault3 and page_fault2 when the 20% change is detected.
>>>
>>> Please stay focus on the test case process to see exactly where the series is
>>> impacting.
>>>
>>> Thanks,
>>> Laurent.
>>>
>>>>
>>>> And I did not find other high variation on test case result.
>>>>
>>>> a). Enable THP
>>>> testcase                          base     stddev       change      head     stddev         metric
>>>> page_fault3/enable THP           10519      +- 3%        -20.5%      8368      +-6%          will-it-scale.per_thread_ops
>>>> page_fault2/enalbe THP            8281      +- 2%        -18.8%      6728                   will-it-scale.per_thread_ops
>>>> brk1/eanble THP                 998475                   -2.2%    976893                   will-it-scale.per_process_ops
>>>> context_switch1/enable THP      223910                   -1.3%    220930                   will-it-scale.per_process_ops
>>>> context_switch1/enable THP      233722                   -1.0%    231288                   will-it-scale.per_thread_ops
>>>>
>>>> b). Disable THP
>>>> page_fault3/disable THP          10856                  -23.1%      8344                   will-it-scale.per_thread_ops
>>>> page_fault2/disable THP           8147                  -18.8%      6613                   will-it-scale.per_thread_ops
>>>> brk1/disable THP                   957                    -7.9%      881                   will-it-scale.per_thread_ops
>>>> context_switch1/disable THP     237006                    -2.2%    231907                  will-it-scale.per_thread_ops
>>>> brk1/disable THP                997317                    -2.0%    977778                  will-it-scale.per_process_ops
>>>> page_fault3/disable THP         467454                    -1.8%    459251                  will-it-scale.per_process_ops
>>>> context_switch1/disable THP     224431                    -1.3%    221567                  will-it-scale.per_process_ops
>>>>
>>>>
>>>> Best regards,
>>>> Haiyan Song
>>>> ________________________________________
>>>> From: Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>> Sent: Monday, July 02, 2018 4:59 PM
>>>> To: Song, HaiyanX
>>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>>
>>>> On 11/06/2018 09:49, Song, HaiyanX wrote:
>>>>> Hi Laurent,
>>>>>
>>>>> Regression test for v11 patch serials have been run, some regression is found by LKP-tools (linux kernel performance)
>>>>> tested on Intel 4s skylake platform. This time only test the cases which have been run and found regressions on
>>>>> V9 patch serials.
>>>>>
>>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>>> branch: Laurent-Dufour/Speculative-page-faults/20180520-045126
>>>>> commit id:
>>>>>   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12
>>>>>   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1
>>>>> Benchmark: will-it-scale
>>>>> Download link: https://github.com/antonblanchard/will-it-scale/tree/master
>>>>>
>>>>> Metrics:
>>>>>   will-it-scale.per_process_ops=processes/nr_cpu
>>>>>   will-it-scale.per_thread_ops=threads/nr_cpu
>>>>>   test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>>> THP: enable / disable
>>>>> nr_task:100%
>>>>>
>>>>> 1. Regressions:
>>>>>
>>>>> a). Enable THP
>>>>> testcase                          base           change      head           metric
>>>>> page_fault3/enable THP           10519          -20.5%        836      will-it-scale.per_thread_ops
>>>>> page_fault2/enalbe THP            8281          -18.8%       6728      will-it-scale.per_thread_ops
>>>>> brk1/eanble THP                 998475           -2.2%     976893      will-it-scale.per_process_ops
>>>>> context_switch1/enable THP      223910           -1.3%     220930      will-it-scale.per_process_ops
>>>>> context_switch1/enable THP      233722           -1.0%     231288      will-it-scale.per_thread_ops
>>>>>
>>>>> b). Disable THP
>>>>> page_fault3/disable THP          10856          -23.1%       8344      will-it-scale.per_thread_ops
>>>>> page_fault2/disable THP           8147          -18.8%       6613      will-it-scale.per_thread_ops
>>>>> brk1/disable THP                   957           -7.9%        881      will-it-scale.per_thread_ops
>>>>> context_switch1/disable THP     237006           -2.2%     231907      will-it-scale.per_thread_ops
>>>>> brk1/disable THP                997317           -2.0%     977778      will-it-scale.per_process_ops
>>>>> page_fault3/disable THP         467454           -1.8%     459251      will-it-scale.per_process_ops
>>>>> context_switch1/disable THP     224431           -1.3%     221567      will-it-scale.per_process_ops
>>>>>
>>>>> Notes: for the above  values of test result, the higher is better.
>>>>
>>>> I tried the same tests on my PowerPC victim VM (1024 CPUs, 11TB) and I can't
>>>> get reproducible results. The results have huge variation, even on the vanilla
>>>> kernel, and I can't state on any changes due to that.
>>>>
>>>> I tried on smaller node (80 CPUs, 32G), and the tests ran better, but I didn't
>>>> measure any changes between the vanilla and the SPF patched ones:
>>>>
>>>> test THP enabled                4.17.0-rc4-mm1  spf             delta
>>>> page_fault3_threads             2697.7          2683.5          -0.53%
>>>> page_fault2_threads             170660.6        169574.1        -0.64%
>>>> context_switch1_threads         6915269.2       6877507.3       -0.55%
>>>> context_switch1_processes       6478076.2       6529493.5       0.79%
>>>> brk1                            243391.2        238527.5        -2.00%
>>>>
>>>> Tests were run 10 times, no high variation detected.
>>>>
>>>> Did you see high variation on your side ? How many times the test were run to
>>>> compute the average values ?
>>>>
>>>> Thanks,
>>>> Laurent.
>>>>
>>>>
>>>>>
>>>>> 2. Improvement: not found improvement based on the selected test cases.
>>>>>
>>>>>
>>>>> Best regards
>>>>> Haiyan Song
>>>>> ________________________________________
>>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>>> Sent: Monday, May 28, 2018 4:54 PM
>>>>> To: Song, HaiyanX
>>>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>>>
>>>>> On 28/05/2018 10:22, Haiyan Song wrote:
>>>>>> Hi Laurent,
>>>>>>
>>>>>> Yes, these tests are done on V9 patch.
>>>>>
>>>>> Do you plan to give this V11 a run ?
>>>>>
>>>>>>
>>>>>>
>>>>>> Best regards,
>>>>>> Haiyan Song
>>>>>>
>>>>>> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:
>>>>>>> On 28/05/2018 07:23, Song, HaiyanX wrote:
>>>>>>>>
>>>>>>>> Some regression and improvements is found by LKP-tools(linux kernel performance) on V9 patch series
>>>>>>>> tested on Intel 4s Skylake platform.
>>>>>>>
>>>>>>> Hi,
>>>>>>>
>>>>>>> Thanks for reporting this benchmark results, but you mentioned the "V9 patch
>>>>>>> series" while responding to the v11 header series...
>>>>>>> Were these tests done on v9 or v11 ?
>>>>>>>
>>>>>>> Cheers,
>>>>>>> Laurent.
>>>>>>>
>>>>>>>>
>>>>>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>>>>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 patch series)
>>>>>>>> Commit id:
>>>>>>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f
>>>>>>>>     head commit: 0355322b3577eeab7669066df42c550a56801110
>>>>>>>> Benchmark suite: will-it-scale
>>>>>>>> Download link:
>>>>>>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests
>>>>>>>> Metrics:
>>>>>>>>     will-it-scale.per_process_ops=processes/nr_cpu
>>>>>>>>     will-it-scale.per_thread_ops=threads/nr_cpu
>>>>>>>> test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>>>>>> THP: enable / disable
>>>>>>>> nr_task: 100%
>>>>>>>>
>>>>>>>> 1. Regressions:
>>>>>>>> a) THP enabled:
>>>>>>>> testcase                        base            change          head       metric
>>>>>>>> page_fault3/ enable THP         10092           -17.5%          8323       will-it-scale.per_thread_ops
>>>>>>>> page_fault2/ enable THP          8300           -17.2%          6869       will-it-scale.per_thread_ops
>>>>>>>> brk1/ enable THP                  957.67         -7.6%           885       will-it-scale.per_thread_ops
>>>>>>>> page_fault3/ enable THP        172821            -5.3%        163692       will-it-scale.per_process_ops
>>>>>>>> signal1/ enable THP              9125            -3.2%          8834       will-it-scale.per_process_ops
>>>>>>>>
>>>>>>>> b) THP disabled:
>>>>>>>> testcase                        base            change          head       metric
>>>>>>>> page_fault3/ disable THP        10107           -19.1%          8180       will-it-scale.per_thread_ops
>>>>>>>> page_fault2/ disable THP         8432           -17.8%          6931       will-it-scale.per_thread_ops
>>>>>>>> context_switch1/ disable THP   215389            -6.8%        200776       will-it-scale.per_thread_ops
>>>>>>>> brk1/ disable THP                 939.67         -6.6%           877.33    will-it-scale.per_thread_ops
>>>>>>>> page_fault3/ disable THP       173145            -4.7%        165064       will-it-scale.per_process_ops
>>>>>>>> signal1/ disable THP             9162            -3.9%          8802       will-it-scale.per_process_ops
>>>>>>>>
>>>>>>>> 2. Improvements:
>>>>>>>> a) THP enabled:
>>>>>>>> testcase                        base            change          head       metric
>>>>>>>> malloc1/ enable THP               66.33        +469.8%           383.67    will-it-scale.per_thread_ops
>>>>>>>> writeseek3/ enable THP          2531             +4.5%          2646       will-it-scale.per_thread_ops
>>>>>>>> signal1/ enable THP              989.33          +2.8%          1016       will-it-scale.per_thread_ops
>>>>>>>>
>>>>>>>> b) THP disabled:
>>>>>>>> testcase                        base            change          head       metric
>>>>>>>> malloc1/ disable THP              90.33        +417.3%           467.33    will-it-scale.per_thread_ops
>>>>>>>> read2/ disable THP             58934            +39.2%         82060       will-it-scale.per_thread_ops
>>>>>>>> page_fault1/ disable THP        8607            +36.4%         11736       will-it-scale.per_thread_ops
>>>>>>>> read1/ disable THP            314063            +12.7%        353934       will-it-scale.per_thread_ops
>>>>>>>> writeseek3/ disable THP         2452            +12.5%          2759       will-it-scale.per_thread_ops
>>>>>>>> signal1/ disable THP             971.33          +5.5%          1024       will-it-scale.per_thread_ops
>>>>>>>>
>>>>>>>> Notes: for above values in column "change", the higher value means that the related testcase result
>>>>>>>> on head commit is better than that on base commit for this benchmark.
>>>>>>>>
>>>>>>>>
>>>>>>>> Best regards
>>>>>>>> Haiyan Song
>>>>>>>>
>>>>>>>> ________________________________________
>>>>>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>>>>>> Sent: Thursday, May 17, 2018 7:06 PM
>>>>>>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi
>>>>>>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>>>>>> Subject: [PATCH v11 00/26] Speculative page faults
>>>>>>>>
>>>>>>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>>>>>>>> page fault without holding the mm semaphore [1].
>>>>>>>>
>>>>>>>> The idea is to try to handle user space page faults without holding the
>>>>>>>> mmap_sem. This should allow better concurrency for massively threaded
>>>>>>>> process since the page fault handler will not wait for other threads memory
>>>>>>>> layout change to be done, assuming that this change is done in another part
>>>>>>>> of the process's memory space. This type page fault is named speculative
>>>>>>>> page fault. If the speculative page fault fails because of a concurrency is
>>>>>>>> detected or because underlying PMD or PTE tables are not yet allocating, it
>>>>>>>> is failing its processing and a classic page fault is then tried.
>>>>>>>>
>>>>>>>> The speculative page fault (SPF) has to look for the VMA matching the fault
>>>>>>>> address without holding the mmap_sem, this is done by introducing a rwlock
>>>>>>>> which protects the access to the mm_rb tree. Previously this was done using
>>>>>>>> SRCU but it was introducing a lot of scheduling to process the VMA's
>>>>>>>> freeing operation which was hitting the performance by 20% as reported by
>>>>>>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is
>>>>>>>> limiting the locking contention to these operations which are expected to
>>>>>>>> be in a O(log n) order. In addition to ensure that the VMA is not freed in
>>>>>>>> our back a reference count is added and 2 services (get_vma() and
>>>>>>>> put_vma()) are introduced to handle the reference count. Once a VMA is
>>>>>>>> fetched from the RB tree using get_vma(), it must be later freed using
>>>>>>>> put_vma(). I can't see anymore the overhead I got while will-it-scale
>>>>>>>> benchmark anymore.
>>>>>>>>
>>>>>>>> The VMA's attributes checked during the speculative page fault processing
>>>>>>>> have to be protected against parallel changes. This is done by using a per
>>>>>>>> VMA sequence lock. This sequence lock allows the speculative page fault
>>>>>>>> handler to fast check for parallel changes in progress and to abort the
>>>>>>>> speculative page fault in that case.
>>>>>>>>
>>>>>>>> Once the VMA has been found, the speculative page fault handler would check
>>>>>>>> for the VMA's attributes to verify that the page fault has to be handled
>>>>>>>> correctly or not. Thus, the VMA is protected through a sequence lock which
>>>>>>>> allows fast detection of concurrent VMA changes. If such a change is
>>>>>>>> detected, the speculative page fault is aborted and a *classic* page fault
>>>>>>>> is tried.  VMA sequence lockings are added when VMA attributes which are
>>>>>>>> checked during the page fault are modified.
>>>>>>>>
>>>>>>>> When the PTE is fetched, the VMA is checked to see if it has been changed,
>>>>>>>> so once the page table is locked, the VMA is valid, so any other changes
>>>>>>>> leading to touching this PTE will need to lock the page table, so no
>>>>>>>> parallel change is possible at this time.
>>>>>>>>
>>>>>>>> The locking of the PTE is done with interrupts disabled, this allows
>>>>>>>> checking for the PMD to ensure that there is not an ongoing collapsing
>>>>>>>> operation. Since khugepaged is firstly set the PMD to pmd_none and then is
>>>>>>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd is
>>>>>>>> valid at the time the PTE is locked, we have the guarantee that the
>>>>>>>> collapsing operation will have to wait on the PTE lock to move forward.
>>>>>>>> This allows the SPF handler to map the PTE safely. If the PMD value is
>>>>>>>> different from the one recorded at the beginning of the SPF operation, the
>>>>>>>> classic page fault handler will be called to handle the operation while
>>>>>>>> holding the mmap_sem. As the PTE lock is done with the interrupts disabled,
>>>>>>>> the lock is done using spin_trylock() to avoid dead lock when handling a
>>>>>>>> page fault while a TLB invalidate is requested by another CPU holding the
>>>>>>>> PTE.
>>>>>>>>
>>>>>>>> In pseudo code, this could be seen as:
>>>>>>>>     speculative_page_fault()
>>>>>>>>     {
>>>>>>>>             vma = get_vma()
>>>>>>>>             check vma sequence count
>>>>>>>>             check vma's support
>>>>>>>>             disable interrupt
>>>>>>>>                   check pgd,p4d,...,pte
>>>>>>>>                   save pmd and pte in vmf
>>>>>>>>                   save vma sequence counter in vmf
>>>>>>>>             enable interrupt
>>>>>>>>             check vma sequence count
>>>>>>>>             handle_pte_fault(vma)
>>>>>>>>                     ..
>>>>>>>>                     page = alloc_page()
>>>>>>>>                     pte_map_lock()
>>>>>>>>                             disable interrupt
>>>>>>>>                                     abort if sequence counter has changed
>>>>>>>>                                     abort if pmd or pte has changed
>>>>>>>>                                     pte map and lock
>>>>>>>>                             enable interrupt
>>>>>>>>                     if abort
>>>>>>>>                        free page
>>>>>>>>                        abort
>>>>>>>>                     ...
>>>>>>>>     }
>>>>>>>>
>>>>>>>>     arch_fault_handler()
>>>>>>>>     {
>>>>>>>>             if (speculative_page_fault(&vma))
>>>>>>>>                goto done
>>>>>>>>     again:
>>>>>>>>             lock(mmap_sem)
>>>>>>>>             vma = find_vma();
>>>>>>>>             handle_pte_fault(vma);
>>>>>>>>             if retry
>>>>>>>>                unlock(mmap_sem)
>>>>>>>>                goto again;
>>>>>>>>     done:
>>>>>>>>             handle fault error
>>>>>>>>     }
>>>>>>>>
>>>>>>>> Support for THP is not done because when checking for the PMD, we can be
>>>>>>>> confused by an in progress collapsing operation done by khugepaged. The
>>>>>>>> issue is that pmd_none() could be true either if the PMD is not already
>>>>>>>> populated or if the underlying PTE are in the way to be collapsed. So we
>>>>>>>> cannot safely allocate a PMD if pmd_none() is true.
>>>>>>>>
>>>>>>>> This series add a new software performance event named 'speculative-faults'
>>>>>>>> or 'spf'. It counts the number of successful page fault event handled
>>>>>>>> speculatively. When recording 'faults,spf' events, the faults one is
>>>>>>>> counting the total number of page fault events while 'spf' is only counting
>>>>>>>> the part of the faults processed speculatively.
>>>>>>>>
>>>>>>>> There are some trace events introduced by this series. They allow
>>>>>>>> identifying why the page faults were not processed speculatively. This
>>>>>>>> doesn't take in account the faults generated by a monothreaded process
>>>>>>>> which directly processed while holding the mmap_sem. This trace events are
>>>>>>>> grouped in a system named 'pagefault', they are:
>>>>>>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back
>>>>>>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.
>>>>>>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported
>>>>>>>>  - pagefault:spf_vma_access : the VMA's access right are not respected
>>>>>>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in our
>>>>>>>>    back.
>>>>>>>>
>>>>>>>> To record all the related events, the easier is to run perf with the
>>>>>>>> following arguments :
>>>>>>>> $ perf stat -e 'faults,spf,pagefault:*' <command>
>>>>>>>>
>>>>>>>> There is also a dedicated vmstat counter showing the number of successful
>>>>>>>> page fault handled speculatively. I can be seen this way:
>>>>>>>> $ grep speculative_pgfault /proc/vmstat
>>>>>>>>
>>>>>>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is functional
>>>>>>>> on x86, PowerPC and arm64.
>>>>>>>>
>>>>>>>> ---------------------
>>>>>>>> Real Workload results
>>>>>>>>
>>>>>>>> As mentioned in previous email, we did non official runs using a "popular
>>>>>>>> in memory multithreaded database product" on 176 cores SMT8 Power system
>>>>>>>> which showed a 30% improvements in the number of transaction processed per
>>>>>>>> second. This run has been done on the v6 series, but changes introduced in
>>>>>>>> this new version should not impact the performance boost seen.
>>>>>>>>
>>>>>>>> Here are the perf data captured during 2 of these runs on top of the v8
>>>>>>>> series:
>>>>>>>>                 vanilla         spf
>>>>>>>> faults          89.418          101.364         +13%
>>>>>>>> spf                n/a           97.989
>>>>>>>>
>>>>>>>> With the SPF kernel, most of the page fault were processed in a speculative
>>>>>>>> way.
>>>>>>>>
>>>>>>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and gave
>>>>>>>> it a try on an android device. He reported that the application launch time
>>>>>>>> was improved in average by 6%, and for large applications (~100 threads) by
>>>>>>>> 20%.
>>>>>>>>
>>>>>>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qcom
>>>>>>>> MSM845 (8 cores) with 6GB (the less is better):
>>>>>>>>
>>>>>>>> Application                             4.9     4.9+spf delta
>>>>>>>> com.tencent.mm                          416     389     -7%
>>>>>>>> com.eg.android.AlipayGphone             1135    986     -13%
>>>>>>>> com.tencent.mtt                         455     454     0%
>>>>>>>> com.qqgame.hlddz                        1497    1409    -6%
>>>>>>>> com.autonavi.minimap                    711     701     -1%
>>>>>>>> com.tencent.tmgp.sgame                  788     748     -5%
>>>>>>>> com.immomo.momo                         501     487     -3%
>>>>>>>> com.tencent.peng                        2145    2112    -2%
>>>>>>>> com.smile.gifmaker                      491     461     -6%
>>>>>>>> com.baidu.BaiduMap                      479     366     -23%
>>>>>>>> com.taobao.taobao                       1341    1198    -11%
>>>>>>>> com.baidu.searchbox                     333     314     -6%
>>>>>>>> com.tencent.mobileqq                    394     384     -3%
>>>>>>>> com.sina.weibo                          907     906     0%
>>>>>>>> com.youku.phone                         816     731     -11%
>>>>>>>> com.happyelements.AndroidAnimal.qq      763     717     -6%
>>>>>>>> com.UCMobile                            415     411     -1%
>>>>>>>> com.tencent.tmgp.ak                     1464    1431    -2%
>>>>>>>> com.tencent.qqmusic                     336     329     -2%
>>>>>>>> com.sankuai.meituan                     1661    1302    -22%
>>>>>>>> com.netease.cloudmusic                  1193    1200    1%
>>>>>>>> air.tv.douyu.android                    4257    4152    -2%
>>>>>>>>
>>>>>>>> ------------------
>>>>>>>> Benchmarks results
>>>>>>>>
>>>>>>>> Base kernel is v4.17.0-rc4-mm1
>>>>>>>> SPF is BASE + this series
>>>>>>>>
>>>>>>>> Kernbench:
>>>>>>>> ----------
>>>>>>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15
>>>>>>>> kernel (kernel is build 5 times):
>>>>>>>>
>>>>>>>> Average Half load -j 8
>>>>>>>>                  Run    (std deviation)
>>>>>>>>                  BASE                   SPF
>>>>>>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%
>>>>>>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%
>>>>>>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%
>>>>>>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%
>>>>>>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%
>>>>>>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%
>>>>>>>>
>>>>>>>> Average Optimal load -j 16
>>>>>>>>                  Run    (std deviation)
>>>>>>>>                  BASE                   SPF
>>>>>>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%
>>>>>>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%
>>>>>>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%
>>>>>>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%
>>>>>>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%
>>>>>>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%
>>>>>>>>
>>>>>>>>
>>>>>>>> During a run on the SPF, perf events were captured:
>>>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>>>          526743764      faults
>>>>>>>>                210      spf
>>>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>>               2278      pagefault:spf_vma_notsup
>>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>>
>>>>>>>> Very few speculative page faults were recorded as most of the processes
>>>>>>>> involved are monothreaded (sounds that on this architecture some threads
>>>>>>>> were created during the kernel build processing).
>>>>>>>>
>>>>>>>> Here are the kerbench results on a 80 CPUs Power8 system:
>>>>>>>>
>>>>>>>> Average Half load -j 40
>>>>>>>>                  Run    (std deviation)
>>>>>>>>                  BASE                   SPF
>>>>>>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%
>>>>>>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%
>>>>>>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%
>>>>>>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%
>>>>>>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%
>>>>>>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%
>>>>>>>>
>>>>>>>> Average Optimal load -j 80
>>>>>>>>                  Run    (std deviation)
>>>>>>>>                  BASE                   SPF
>>>>>>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%
>>>>>>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%
>>>>>>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%
>>>>>>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%
>>>>>>>> Context Switches 223861  (138865)       225032  (139632)        0.52%
>>>>>>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%
>>>>>>>>
>>>>>>>> During a run on the SPF, perf events were captured:
>>>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>>>          116730856      faults
>>>>>>>>                  0      spf
>>>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>>                476      pagefault:spf_vma_notsup
>>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>>
>>>>>>>> Most of the processes involved are monothreaded so SPF is not activated but
>>>>>>>> there is no impact on the performance.
>>>>>>>>
>>>>>>>> Ebizzy:
>>>>>>>> -------
>>>>>>>> The test is counting the number of records per second it can manage, the
>>>>>>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get
>>>>>>>> consistent result I repeated the test 100 times and measure the average
>>>>>>>> result. The number is the record processes per second, the higher is the
>>>>>>>> best.
>>>>>>>>
>>>>>>>>                 BASE            SPF             delta
>>>>>>>> 16 CPUs x86 VM  742.57          1490.24         100.69%
>>>>>>>> 80 CPUs P8 node 13105.4         24174.23        84.46%
>>>>>>>>
>>>>>>>> Here are the performance counter read during a run on a 16 CPUs x86 VM:
>>>>>>>>  Performance counter stats for './ebizzy -mTt 16':
>>>>>>>>            1706379      faults
>>>>>>>>            1674599      spf
>>>>>>>>              30588      pagefault:spf_vma_changed
>>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>>                363      pagefault:spf_vma_notsup
>>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>>
>>>>>>>> And the ones captured during a run on a 80 CPUs Power node:
>>>>>>>>  Performance counter stats for './ebizzy -mTt 80':
>>>>>>>>            1874773      faults
>>>>>>>>            1461153      spf
>>>>>>>>             413293      pagefault:spf_vma_changed
>>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>>                200      pagefault:spf_vma_notsup
>>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>>
>>>>>>>> In ebizzy's case most of the page fault were handled in a speculative way,
>>>>>>>> leading the ebizzy performance boost.
>>>>>>>>
>>>>>>>> ------------------
>>>>>>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):
>>>>>>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahendran
>>>>>>>>    and Minchan Kim, hopefully.
>>>>>>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in
>>>>>>>>    __do_page_fault().
>>>>>>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails
>>>>>>>>    instead
>>>>>>>>    of aborting the speculative page fault handling. Dropping the now
>>>>>>>> useless
>>>>>>>>    trace event pagefault:spf_pte_lock.
>>>>>>>>  - No more try to reuse the fetched VMA during the speculative page fault
>>>>>>>>    handling when retrying is needed. This adds a lot of complexity and
>>>>>>>>    additional tests done didn't show a significant performance improvement.
>>>>>>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.
>>>>>>>>
>>>>>>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at-speculative-page-faults-tt965642.html#none
>>>>>>>> [2] https://patchwork.kernel.org/patch/9999687/
>>>>>>>>
>>>>>>>>
>>>>>>>> Laurent Dufour (20):
>>>>>>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT
>>>>>>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE
>>>>>>>>   mm: make pte_unmap_same compatible with SPF
>>>>>>>>   mm: introduce INIT_VMA()
>>>>>>>>   mm: protect VMA modifications using VMA sequence count
>>>>>>>>   mm: protect mremap() against SPF hanlder
>>>>>>>>   mm: protect SPF handler against anon_vma changes
>>>>>>>>   mm: cache some VMA fields in the vm_fault structure
>>>>>>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()
>>>>>>>>   mm: introduce __lru_cache_add_active_or_unevictable
>>>>>>>>   mm: introduce __vm_normal_page()
>>>>>>>>   mm: introduce __page_add_new_anon_rmap()
>>>>>>>>   mm: protect mm_rb tree with a rwlock
>>>>>>>>   mm: adding speculative page fault failure trace events
>>>>>>>>   perf: add a speculative page fault sw event
>>>>>>>>   perf tools: add support for the SPF perf event
>>>>>>>>   mm: add speculative page fault vmstats
>>>>>>>>   powerpc/mm: add speculative page fault
>>>>>>>>
>>>>>>>> Mahendran Ganesh (2):
>>>>>>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>>   arm64/mm: add speculative page fault
>>>>>>>>
>>>>>>>> Peter Zijlstra (4):
>>>>>>>>   mm: prepare for FAULT_FLAG_SPECULATIVE
>>>>>>>>   mm: VMA sequence count
>>>>>>>>   mm: provide speculative fault infrastructure
>>>>>>>>   x86/mm: add speculative pagefault handling
>>>>>>>>
>>>>>>>>  arch/arm64/Kconfig                    |   1 +
>>>>>>>>  arch/arm64/mm/fault.c                 |  12 +
>>>>>>>>  arch/powerpc/Kconfig                  |   1 +
>>>>>>>>  arch/powerpc/mm/fault.c               |  16 +
>>>>>>>>  arch/x86/Kconfig                      |   1 +
>>>>>>>>  arch/x86/mm/fault.c                   |  27 +-
>>>>>>>>  fs/exec.c                             |   2 +-
>>>>>>>>  fs/proc/task_mmu.c                    |   5 +-
>>>>>>>>  fs/userfaultfd.c                      |  17 +-
>>>>>>>>  include/linux/hugetlb_inline.h        |   2 +-
>>>>>>>>  include/linux/migrate.h               |   4 +-
>>>>>>>>  include/linux/mm.h                    | 136 +++++++-
>>>>>>>>  include/linux/mm_types.h              |   7 +
>>>>>>>>  include/linux/pagemap.h               |   4 +-
>>>>>>>>  include/linux/rmap.h                  |  12 +-
>>>>>>>>  include/linux/swap.h                  |  10 +-
>>>>>>>>  include/linux/vm_event_item.h         |   3 +
>>>>>>>>  include/trace/events/pagefault.h      |  80 +++++
>>>>>>>>  include/uapi/linux/perf_event.h       |   1 +
>>>>>>>>  kernel/fork.c                         |   5 +-
>>>>>>>>  mm/Kconfig                            |  22 ++
>>>>>>>>  mm/huge_memory.c                      |   6 +-
>>>>>>>>  mm/hugetlb.c                          |   2 +
>>>>>>>>  mm/init-mm.c                          |   3 +
>>>>>>>>  mm/internal.h                         |  20 ++
>>>>>>>>  mm/khugepaged.c                       |   5 +
>>>>>>>>  mm/madvise.c                          |   6 +-
>>>>>>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++++++-----
>>>>>>>>  mm/mempolicy.c                        |  51 ++-
>>>>>>>>  mm/migrate.c                          |   6 +-
>>>>>>>>  mm/mlock.c                            |  13 +-
>>>>>>>>  mm/mmap.c                             | 229 ++++++++++---
>>>>>>>>  mm/mprotect.c                         |   4 +-
>>>>>>>>  mm/mremap.c                           |  13 +
>>>>>>>>  mm/nommu.c                            |   2 +-
>>>>>>>>  mm/rmap.c                             |   5 +-
>>>>>>>>  mm/swap.c                             |   6 +-
>>>>>>>>  mm/swap_state.c                       |   8 +-
>>>>>>>>  mm/vmstat.c                           |   5 +-
>>>>>>>>  tools/include/uapi/linux/perf_event.h |   1 +
>>>>>>>>  tools/perf/util/evsel.c               |   1 +
>>>>>>>>  tools/perf/util/parse-events.c        |   4 +
>>>>>>>>  tools/perf/util/parse-events.l        |   1 +
>>>>>>>>  tools/perf/util/python.c              |   1 +
>>>>>>>>  44 files changed, 1161 insertions(+), 211 deletions(-)
>>>>>>>>  create mode 100644 include/trace/events/pagefault.h
>>>>>>>>
>>>>>>>> --
>>>>>>>> 2.7.4
>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>
>>>>>
>>>>
>>>>
>>>
>>
> 


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-mm-Add-a-speculative-page-fault-switch-in-sysctl.patch --]
[-- Type: text/x-patch; name="0001-mm-Add-a-speculative-page-fault-switch-in-sysctl.patch", Size: 0 bytes --]



^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2018-08-22 14:23                           ` Laurent Dufour
  0 siblings, 0 replies; 58+ messages in thread
From: Laurent Dufour @ 2018-08-22 14:23 UTC (permalink / raw)
  To: Song, HaiyanX
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

[-- Attachment #1: Type: text/plain, Size: 43704 bytes --]

On 03/08/2018 08:36, Song, HaiyanX wrote:
> Hi Laurent,

Hi Haiyan,

Sorry for the late answer, I was off a couple of days.

> 
> Thanks for your analysis for the last perf results.
> Your mentioned ," the major differences at the head of the perf report is the 92% testcase which is weirdly not reported
> on the head side", which is a bug of 0-day,and it caused the item is not counted in perf. 
> 
> I've triggered the test page_fault2 and page_fault3 again only with thread mode of will-it-scale on 0-day (on the same test box,every case tested 3 times).
> I checked the perf report have no above mentioned problem.
> 
> I have compared them, found some items have difference, such as below case:
>        page_fault2-thp-always: handle_mm_fault, base: 45.22%    head: 29.41%
>        page_fault3-thp-always: handle_mm_fault, base: 22.95%    head: 14.15%       

These would mean that the system spends lees time running handle_mm_fault()
when SPF is in the picture in this 2 cases which is good. This should lead to
better results with the SPF series, and I can't find any values higher on the
head side.

> 
> So i attached the perf result in mail again, could your have a look again for checking the difference between base and head commit.

I took a close look to all the perf result you sent, but I can't identify any
major difference. But the compiler optimization is getting rid of the
handle_pte_fault() symbol on the base kernel which add complexity to check the
differences.

To get rid of that, I'm proposing that you applied the attached patch to the
spf kernel. This patch is allowing to turn on/off the SPF handler through
/proc/sys/vm/speculative_page_fault.

This should ease the testing by limiting the reboot and avoid kernel's symbols
mismatch. Obviously there is still a small overhead due to the check but it
should not be viewable.

With this patch applied you can simply run
echo 1 > /proc/sys/vm/speculative_page_fault
to run a test with the speculative page fault handler activated. Or run
echo 0 > /proc/sys/vm/speculative_page_fault
to run a test without it.

I'm really sorry to asking that again, but could please run the test
page_fault3_base_THP-Always with and without SPF and capture the perf output.

I think we should focus on that test which showed the biggest regression.

Thanks,
Laurent.


> 
> Thanks,
> Haiyan, Song
>  
> ________________________________________
> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
> Sent: Tuesday, July 17, 2018 5:36 PM
> To: Song, HaiyanX
> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
> Subject: Re: [PATCH v11 00/26] Speculative page faults
> 
> On 13/07/2018 05:56, Song, HaiyanX wrote:
>> Hi Laurent,
> 
> Hi Haiyan,
> 
> Thanks a lot for sharing this perf reports.
> 
> I looked at them closely, and I've to admit that I was not able to found a
> major difference between the base and the head report, except that
> handle_pte_fault() is no more in-lined in the head one.
> 
> As expected, __handle_speculative_fault() is never traced since these tests are
> dealing with file mapping, not handled in the speculative way.
> 
> When running these test did you seen a major differences in the test's result
> between base and head ?
> 
> From the number of cycles counted, the biggest difference is page_fault3 when
> run with the THP enabled:
>                                 BASE            HEAD            Delta
> page_fault2_base_thp_never      1142252426747   1065866197589   -6.69%
> page_fault2_base_THP-Alwasys    1124844374523   1076312228927   -4.31%
> page_fault3_base_thp_never      1099387298152   1134118402345   3.16%
> page_fault3_base_THP-Always     1059370178101   853985561949    -19.39%
> 
> 
> The very weird thing is the difference of the delta cycles reported between
> thp never and thp always, because the speculative way is aborted when checking
> for the vma->ops field, which is the same in both case, and the thp is never
> checked. So there is no code covering differnce, on the speculative path,
> between these 2 cases. This leads me to think that there are other interactions
> interfering in the measure.
> 
> Looking at the perf-profile_page_fault3_*_THP-Always, the major differences at
> the head of the perf report is the 92% testcase which is weirdly not reported
> on the head side :
>     92.02%    22.33%  page_fault3_processes  [.] testcase
> 92.02% testcase
> 
> Then the base reported 37.67% for __do_page_fault() where the head reported
> 48.41%, but the only difference in this function, between base and head, is the
> call to handle_speculative_fault(). But this is a macro checking for the fault
> flags, and mm->users and then calling __handle_speculative_fault() if needed.
> So this can't explain this difference, except if __handle_speculative_fault()
> is inlined in __do_page_fault().
> Is this the case on your build ?
> 
> Haiyan, do you still have the output of the test to check those numbers too ?
> 
> Cheers,
> Laurent
> 
>> I attached the perf-profile.gz file for case page_fault2 and page_fault3. These files were captured during test the related test case.
>> Please help to check on these data if it can help you to find the higher change. Thanks.
>>
>> File name perf-profile_page_fault2_head_THP-Always.gz, means the perf-profile result get from page_fault2
>>     tested for head commit (a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12) with THP_always configuration.
>>
>> Best regards,
>> Haiyan Song
>>
>> ________________________________________
>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>> Sent: Thursday, July 12, 2018 1:05 AM
>> To: Song, HaiyanX
>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>
>> Hi Haiyan,
>>
>> Do you get a chance to capture some performance cycles on your system ?
>> I still can't get these numbers on my hardware.
>>
>> Thanks,
>> Laurent.
>>
>> On 04/07/2018 09:51, Laurent Dufour wrote:
>>> On 04/07/2018 05:23, Song, HaiyanX wrote:
>>>> Hi Laurent,
>>>>
>>>>
>>>> For the test result on Intel 4s skylake platform (192 CPUs, 768G Memory), the below test cases all were run 3 times.
>>>> I check the test results, only page_fault3_thread/enable THP have 6% stddev for head commit, other tests have lower stddev.
>>>
>>> Repeating the test only 3 times seems a bit too low to me.
>>>
>>> I'll focus on the higher change for the moment, but I don't have access to such
>>> a hardware.
>>>
>>> Is possible to provide a diff between base and SPF of the performance cycles
>>> measured when running page_fault3 and page_fault2 when the 20% change is detected.
>>>
>>> Please stay focus on the test case process to see exactly where the series is
>>> impacting.
>>>
>>> Thanks,
>>> Laurent.
>>>
>>>>
>>>> And I did not find other high variation on test case result.
>>>>
>>>> a). Enable THP
>>>> testcase                          base     stddev       change      head     stddev         metric
>>>> page_fault3/enable THP           10519      ± 3%        -20.5%      8368      ±6%          will-it-scale.per_thread_ops
>>>> page_fault2/enalbe THP            8281      ± 2%        -18.8%      6728                   will-it-scale.per_thread_ops
>>>> brk1/eanble THP                 998475                   -2.2%    976893                   will-it-scale.per_process_ops
>>>> context_switch1/enable THP      223910                   -1.3%    220930                   will-it-scale.per_process_ops
>>>> context_switch1/enable THP      233722                   -1.0%    231288                   will-it-scale.per_thread_ops
>>>>
>>>> b). Disable THP
>>>> page_fault3/disable THP          10856                  -23.1%      8344                   will-it-scale.per_thread_ops
>>>> page_fault2/disable THP           8147                  -18.8%      6613                   will-it-scale.per_thread_ops
>>>> brk1/disable THP                   957                    -7.9%      881                   will-it-scale.per_thread_ops
>>>> context_switch1/disable THP     237006                    -2.2%    231907                  will-it-scale.per_thread_ops
>>>> brk1/disable THP                997317                    -2.0%    977778                  will-it-scale.per_process_ops
>>>> page_fault3/disable THP         467454                    -1.8%    459251                  will-it-scale.per_process_ops
>>>> context_switch1/disable THP     224431                    -1.3%    221567                  will-it-scale.per_process_ops
>>>>
>>>>
>>>> Best regards,
>>>> Haiyan Song
>>>> ________________________________________
>>>> From: Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>> Sent: Monday, July 02, 2018 4:59 PM
>>>> To: Song, HaiyanX
>>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>>
>>>> On 11/06/2018 09:49, Song, HaiyanX wrote:
>>>>> Hi Laurent,
>>>>>
>>>>> Regression test for v11 patch serials have been run, some regression is found by LKP-tools (linux kernel performance)
>>>>> tested on Intel 4s skylake platform. This time only test the cases which have been run and found regressions on
>>>>> V9 patch serials.
>>>>>
>>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>>> branch: Laurent-Dufour/Speculative-page-faults/20180520-045126
>>>>> commit id:
>>>>>   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12
>>>>>   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1
>>>>> Benchmark: will-it-scale
>>>>> Download link: https://github.com/antonblanchard/will-it-scale/tree/master
>>>>>
>>>>> Metrics:
>>>>>   will-it-scale.per_process_ops=processes/nr_cpu
>>>>>   will-it-scale.per_thread_ops=threads/nr_cpu
>>>>>   test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>>> THP: enable / disable
>>>>> nr_task:100%
>>>>>
>>>>> 1. Regressions:
>>>>>
>>>>> a). Enable THP
>>>>> testcase                          base           change      head           metric
>>>>> page_fault3/enable THP           10519          -20.5%        836      will-it-scale.per_thread_ops
>>>>> page_fault2/enalbe THP            8281          -18.8%       6728      will-it-scale.per_thread_ops
>>>>> brk1/eanble THP                 998475           -2.2%     976893      will-it-scale.per_process_ops
>>>>> context_switch1/enable THP      223910           -1.3%     220930      will-it-scale.per_process_ops
>>>>> context_switch1/enable THP      233722           -1.0%     231288      will-it-scale.per_thread_ops
>>>>>
>>>>> b). Disable THP
>>>>> page_fault3/disable THP          10856          -23.1%       8344      will-it-scale.per_thread_ops
>>>>> page_fault2/disable THP           8147          -18.8%       6613      will-it-scale.per_thread_ops
>>>>> brk1/disable THP                   957           -7.9%        881      will-it-scale.per_thread_ops
>>>>> context_switch1/disable THP     237006           -2.2%     231907      will-it-scale.per_thread_ops
>>>>> brk1/disable THP                997317           -2.0%     977778      will-it-scale.per_process_ops
>>>>> page_fault3/disable THP         467454           -1.8%     459251      will-it-scale.per_process_ops
>>>>> context_switch1/disable THP     224431           -1.3%     221567      will-it-scale.per_process_ops
>>>>>
>>>>> Notes: for the above  values of test result, the higher is better.
>>>>
>>>> I tried the same tests on my PowerPC victim VM (1024 CPUs, 11TB) and I can't
>>>> get reproducible results. The results have huge variation, even on the vanilla
>>>> kernel, and I can't state on any changes due to that.
>>>>
>>>> I tried on smaller node (80 CPUs, 32G), and the tests ran better, but I didn't
>>>> measure any changes between the vanilla and the SPF patched ones:
>>>>
>>>> test THP enabled                4.17.0-rc4-mm1  spf             delta
>>>> page_fault3_threads             2697.7          2683.5          -0.53%
>>>> page_fault2_threads             170660.6        169574.1        -0.64%
>>>> context_switch1_threads         6915269.2       6877507.3       -0.55%
>>>> context_switch1_processes       6478076.2       6529493.5       0.79%
>>>> brk1                            243391.2        238527.5        -2.00%
>>>>
>>>> Tests were run 10 times, no high variation detected.
>>>>
>>>> Did you see high variation on your side ? How many times the test were run to
>>>> compute the average values ?
>>>>
>>>> Thanks,
>>>> Laurent.
>>>>
>>>>
>>>>>
>>>>> 2. Improvement: not found improvement based on the selected test cases.
>>>>>
>>>>>
>>>>> Best regards
>>>>> Haiyan Song
>>>>> ________________________________________
>>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>>> Sent: Monday, May 28, 2018 4:54 PM
>>>>> To: Song, HaiyanX
>>>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>>>
>>>>> On 28/05/2018 10:22, Haiyan Song wrote:
>>>>>> Hi Laurent,
>>>>>>
>>>>>> Yes, these tests are done on V9 patch.
>>>>>
>>>>> Do you plan to give this V11 a run ?
>>>>>
>>>>>>
>>>>>>
>>>>>> Best regards,
>>>>>> Haiyan Song
>>>>>>
>>>>>> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:
>>>>>>> On 28/05/2018 07:23, Song, HaiyanX wrote:
>>>>>>>>
>>>>>>>> Some regression and improvements is found by LKP-tools(linux kernel performance) on V9 patch series
>>>>>>>> tested on Intel 4s Skylake platform.
>>>>>>>
>>>>>>> Hi,
>>>>>>>
>>>>>>> Thanks for reporting this benchmark results, but you mentioned the "V9 patch
>>>>>>> series" while responding to the v11 header series...
>>>>>>> Were these tests done on v9 or v11 ?
>>>>>>>
>>>>>>> Cheers,
>>>>>>> Laurent.
>>>>>>>
>>>>>>>>
>>>>>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>>>>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 patch series)
>>>>>>>> Commit id:
>>>>>>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f
>>>>>>>>     head commit: 0355322b3577eeab7669066df42c550a56801110
>>>>>>>> Benchmark suite: will-it-scale
>>>>>>>> Download link:
>>>>>>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests
>>>>>>>> Metrics:
>>>>>>>>     will-it-scale.per_process_ops=processes/nr_cpu
>>>>>>>>     will-it-scale.per_thread_ops=threads/nr_cpu
>>>>>>>> test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>>>>>> THP: enable / disable
>>>>>>>> nr_task: 100%
>>>>>>>>
>>>>>>>> 1. Regressions:
>>>>>>>> a) THP enabled:
>>>>>>>> testcase                        base            change          head       metric
>>>>>>>> page_fault3/ enable THP         10092           -17.5%          8323       will-it-scale.per_thread_ops
>>>>>>>> page_fault2/ enable THP          8300           -17.2%          6869       will-it-scale.per_thread_ops
>>>>>>>> brk1/ enable THP                  957.67         -7.6%           885       will-it-scale.per_thread_ops
>>>>>>>> page_fault3/ enable THP        172821            -5.3%        163692       will-it-scale.per_process_ops
>>>>>>>> signal1/ enable THP              9125            -3.2%          8834       will-it-scale.per_process_ops
>>>>>>>>
>>>>>>>> b) THP disabled:
>>>>>>>> testcase                        base            change          head       metric
>>>>>>>> page_fault3/ disable THP        10107           -19.1%          8180       will-it-scale.per_thread_ops
>>>>>>>> page_fault2/ disable THP         8432           -17.8%          6931       will-it-scale.per_thread_ops
>>>>>>>> context_switch1/ disable THP   215389            -6.8%        200776       will-it-scale.per_thread_ops
>>>>>>>> brk1/ disable THP                 939.67         -6.6%           877.33    will-it-scale.per_thread_ops
>>>>>>>> page_fault3/ disable THP       173145            -4.7%        165064       will-it-scale.per_process_ops
>>>>>>>> signal1/ disable THP             9162            -3.9%          8802       will-it-scale.per_process_ops
>>>>>>>>
>>>>>>>> 2. Improvements:
>>>>>>>> a) THP enabled:
>>>>>>>> testcase                        base            change          head       metric
>>>>>>>> malloc1/ enable THP               66.33        +469.8%           383.67    will-it-scale.per_thread_ops
>>>>>>>> writeseek3/ enable THP          2531             +4.5%          2646       will-it-scale.per_thread_ops
>>>>>>>> signal1/ enable THP              989.33          +2.8%          1016       will-it-scale.per_thread_ops
>>>>>>>>
>>>>>>>> b) THP disabled:
>>>>>>>> testcase                        base            change          head       metric
>>>>>>>> malloc1/ disable THP              90.33        +417.3%           467.33    will-it-scale.per_thread_ops
>>>>>>>> read2/ disable THP             58934            +39.2%         82060       will-it-scale.per_thread_ops
>>>>>>>> page_fault1/ disable THP        8607            +36.4%         11736       will-it-scale.per_thread_ops
>>>>>>>> read1/ disable THP            314063            +12.7%        353934       will-it-scale.per_thread_ops
>>>>>>>> writeseek3/ disable THP         2452            +12.5%          2759       will-it-scale.per_thread_ops
>>>>>>>> signal1/ disable THP             971.33          +5.5%          1024       will-it-scale.per_thread_ops
>>>>>>>>
>>>>>>>> Notes: for above values in column "change", the higher value means that the related testcase result
>>>>>>>> on head commit is better than that on base commit for this benchmark.
>>>>>>>>
>>>>>>>>
>>>>>>>> Best regards
>>>>>>>> Haiyan Song
>>>>>>>>
>>>>>>>> ________________________________________
>>>>>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>>>>>> Sent: Thursday, May 17, 2018 7:06 PM
>>>>>>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi
>>>>>>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>>>>>> Subject: [PATCH v11 00/26] Speculative page faults
>>>>>>>>
>>>>>>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>>>>>>>> page fault without holding the mm semaphore [1].
>>>>>>>>
>>>>>>>> The idea is to try to handle user space page faults without holding the
>>>>>>>> mmap_sem. This should allow better concurrency for massively threaded
>>>>>>>> process since the page fault handler will not wait for other threads memory
>>>>>>>> layout change to be done, assuming that this change is done in another part
>>>>>>>> of the process's memory space. This type page fault is named speculative
>>>>>>>> page fault. If the speculative page fault fails because of a concurrency is
>>>>>>>> detected or because underlying PMD or PTE tables are not yet allocating, it
>>>>>>>> is failing its processing and a classic page fault is then tried.
>>>>>>>>
>>>>>>>> The speculative page fault (SPF) has to look for the VMA matching the fault
>>>>>>>> address without holding the mmap_sem, this is done by introducing a rwlock
>>>>>>>> which protects the access to the mm_rb tree. Previously this was done using
>>>>>>>> SRCU but it was introducing a lot of scheduling to process the VMA's
>>>>>>>> freeing operation which was hitting the performance by 20% as reported by
>>>>>>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is
>>>>>>>> limiting the locking contention to these operations which are expected to
>>>>>>>> be in a O(log n) order. In addition to ensure that the VMA is not freed in
>>>>>>>> our back a reference count is added and 2 services (get_vma() and
>>>>>>>> put_vma()) are introduced to handle the reference count. Once a VMA is
>>>>>>>> fetched from the RB tree using get_vma(), it must be later freed using
>>>>>>>> put_vma(). I can't see anymore the overhead I got while will-it-scale
>>>>>>>> benchmark anymore.
>>>>>>>>
>>>>>>>> The VMA's attributes checked during the speculative page fault processing
>>>>>>>> have to be protected against parallel changes. This is done by using a per
>>>>>>>> VMA sequence lock. This sequence lock allows the speculative page fault
>>>>>>>> handler to fast check for parallel changes in progress and to abort the
>>>>>>>> speculative page fault in that case.
>>>>>>>>
>>>>>>>> Once the VMA has been found, the speculative page fault handler would check
>>>>>>>> for the VMA's attributes to verify that the page fault has to be handled
>>>>>>>> correctly or not. Thus, the VMA is protected through a sequence lock which
>>>>>>>> allows fast detection of concurrent VMA changes. If such a change is
>>>>>>>> detected, the speculative page fault is aborted and a *classic* page fault
>>>>>>>> is tried.  VMA sequence lockings are added when VMA attributes which are
>>>>>>>> checked during the page fault are modified.
>>>>>>>>
>>>>>>>> When the PTE is fetched, the VMA is checked to see if it has been changed,
>>>>>>>> so once the page table is locked, the VMA is valid, so any other changes
>>>>>>>> leading to touching this PTE will need to lock the page table, so no
>>>>>>>> parallel change is possible at this time.
>>>>>>>>
>>>>>>>> The locking of the PTE is done with interrupts disabled, this allows
>>>>>>>> checking for the PMD to ensure that there is not an ongoing collapsing
>>>>>>>> operation. Since khugepaged is firstly set the PMD to pmd_none and then is
>>>>>>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd is
>>>>>>>> valid at the time the PTE is locked, we have the guarantee that the
>>>>>>>> collapsing operation will have to wait on the PTE lock to move forward.
>>>>>>>> This allows the SPF handler to map the PTE safely. If the PMD value is
>>>>>>>> different from the one recorded at the beginning of the SPF operation, the
>>>>>>>> classic page fault handler will be called to handle the operation while
>>>>>>>> holding the mmap_sem. As the PTE lock is done with the interrupts disabled,
>>>>>>>> the lock is done using spin_trylock() to avoid dead lock when handling a
>>>>>>>> page fault while a TLB invalidate is requested by another CPU holding the
>>>>>>>> PTE.
>>>>>>>>
>>>>>>>> In pseudo code, this could be seen as:
>>>>>>>>     speculative_page_fault()
>>>>>>>>     {
>>>>>>>>             vma = get_vma()
>>>>>>>>             check vma sequence count
>>>>>>>>             check vma's support
>>>>>>>>             disable interrupt
>>>>>>>>                   check pgd,p4d,...,pte
>>>>>>>>                   save pmd and pte in vmf
>>>>>>>>                   save vma sequence counter in vmf
>>>>>>>>             enable interrupt
>>>>>>>>             check vma sequence count
>>>>>>>>             handle_pte_fault(vma)
>>>>>>>>                     ..
>>>>>>>>                     page = alloc_page()
>>>>>>>>                     pte_map_lock()
>>>>>>>>                             disable interrupt
>>>>>>>>                                     abort if sequence counter has changed
>>>>>>>>                                     abort if pmd or pte has changed
>>>>>>>>                                     pte map and lock
>>>>>>>>                             enable interrupt
>>>>>>>>                     if abort
>>>>>>>>                        free page
>>>>>>>>                        abort
>>>>>>>>                     ...
>>>>>>>>     }
>>>>>>>>
>>>>>>>>     arch_fault_handler()
>>>>>>>>     {
>>>>>>>>             if (speculative_page_fault(&vma))
>>>>>>>>                goto done
>>>>>>>>     again:
>>>>>>>>             lock(mmap_sem)
>>>>>>>>             vma = find_vma();
>>>>>>>>             handle_pte_fault(vma);
>>>>>>>>             if retry
>>>>>>>>                unlock(mmap_sem)
>>>>>>>>                goto again;
>>>>>>>>     done:
>>>>>>>>             handle fault error
>>>>>>>>     }
>>>>>>>>
>>>>>>>> Support for THP is not done because when checking for the PMD, we can be
>>>>>>>> confused by an in progress collapsing operation done by khugepaged. The
>>>>>>>> issue is that pmd_none() could be true either if the PMD is not already
>>>>>>>> populated or if the underlying PTE are in the way to be collapsed. So we
>>>>>>>> cannot safely allocate a PMD if pmd_none() is true.
>>>>>>>>
>>>>>>>> This series add a new software performance event named 'speculative-faults'
>>>>>>>> or 'spf'. It counts the number of successful page fault event handled
>>>>>>>> speculatively. When recording 'faults,spf' events, the faults one is
>>>>>>>> counting the total number of page fault events while 'spf' is only counting
>>>>>>>> the part of the faults processed speculatively.
>>>>>>>>
>>>>>>>> There are some trace events introduced by this series. They allow
>>>>>>>> identifying why the page faults were not processed speculatively. This
>>>>>>>> doesn't take in account the faults generated by a monothreaded process
>>>>>>>> which directly processed while holding the mmap_sem. This trace events are
>>>>>>>> grouped in a system named 'pagefault', they are:
>>>>>>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back
>>>>>>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.
>>>>>>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported
>>>>>>>>  - pagefault:spf_vma_access : the VMA's access right are not respected
>>>>>>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in our
>>>>>>>>    back.
>>>>>>>>
>>>>>>>> To record all the related events, the easier is to run perf with the
>>>>>>>> following arguments :
>>>>>>>> $ perf stat -e 'faults,spf,pagefault:*' <command>
>>>>>>>>
>>>>>>>> There is also a dedicated vmstat counter showing the number of successful
>>>>>>>> page fault handled speculatively. I can be seen this way:
>>>>>>>> $ grep speculative_pgfault /proc/vmstat
>>>>>>>>
>>>>>>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is functional
>>>>>>>> on x86, PowerPC and arm64.
>>>>>>>>
>>>>>>>> ---------------------
>>>>>>>> Real Workload results
>>>>>>>>
>>>>>>>> As mentioned in previous email, we did non official runs using a "popular
>>>>>>>> in memory multithreaded database product" on 176 cores SMT8 Power system
>>>>>>>> which showed a 30% improvements in the number of transaction processed per
>>>>>>>> second. This run has been done on the v6 series, but changes introduced in
>>>>>>>> this new version should not impact the performance boost seen.
>>>>>>>>
>>>>>>>> Here are the perf data captured during 2 of these runs on top of the v8
>>>>>>>> series:
>>>>>>>>                 vanilla         spf
>>>>>>>> faults          89.418          101.364         +13%
>>>>>>>> spf                n/a           97.989
>>>>>>>>
>>>>>>>> With the SPF kernel, most of the page fault were processed in a speculative
>>>>>>>> way.
>>>>>>>>
>>>>>>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and gave
>>>>>>>> it a try on an android device. He reported that the application launch time
>>>>>>>> was improved in average by 6%, and for large applications (~100 threads) by
>>>>>>>> 20%.
>>>>>>>>
>>>>>>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qcom
>>>>>>>> MSM845 (8 cores) with 6GB (the less is better):
>>>>>>>>
>>>>>>>> Application                             4.9     4.9+spf delta
>>>>>>>> com.tencent.mm                          416     389     -7%
>>>>>>>> com.eg.android.AlipayGphone             1135    986     -13%
>>>>>>>> com.tencent.mtt                         455     454     0%
>>>>>>>> com.qqgame.hlddz                        1497    1409    -6%
>>>>>>>> com.autonavi.minimap                    711     701     -1%
>>>>>>>> com.tencent.tmgp.sgame                  788     748     -5%
>>>>>>>> com.immomo.momo                         501     487     -3%
>>>>>>>> com.tencent.peng                        2145    2112    -2%
>>>>>>>> com.smile.gifmaker                      491     461     -6%
>>>>>>>> com.baidu.BaiduMap                      479     366     -23%
>>>>>>>> com.taobao.taobao                       1341    1198    -11%
>>>>>>>> com.baidu.searchbox                     333     314     -6%
>>>>>>>> com.tencent.mobileqq                    394     384     -3%
>>>>>>>> com.sina.weibo                          907     906     0%
>>>>>>>> com.youku.phone                         816     731     -11%
>>>>>>>> com.happyelements.AndroidAnimal.qq      763     717     -6%
>>>>>>>> com.UCMobile                            415     411     -1%
>>>>>>>> com.tencent.tmgp.ak                     1464    1431    -2%
>>>>>>>> com.tencent.qqmusic                     336     329     -2%
>>>>>>>> com.sankuai.meituan                     1661    1302    -22%
>>>>>>>> com.netease.cloudmusic                  1193    1200    1%
>>>>>>>> air.tv.douyu.android                    4257    4152    -2%
>>>>>>>>
>>>>>>>> ------------------
>>>>>>>> Benchmarks results
>>>>>>>>
>>>>>>>> Base kernel is v4.17.0-rc4-mm1
>>>>>>>> SPF is BASE + this series
>>>>>>>>
>>>>>>>> Kernbench:
>>>>>>>> ----------
>>>>>>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15
>>>>>>>> kernel (kernel is build 5 times):
>>>>>>>>
>>>>>>>> Average Half load -j 8
>>>>>>>>                  Run    (std deviation)
>>>>>>>>                  BASE                   SPF
>>>>>>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%
>>>>>>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%
>>>>>>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%
>>>>>>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%
>>>>>>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%
>>>>>>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%
>>>>>>>>
>>>>>>>> Average Optimal load -j 16
>>>>>>>>                  Run    (std deviation)
>>>>>>>>                  BASE                   SPF
>>>>>>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%
>>>>>>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%
>>>>>>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%
>>>>>>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%
>>>>>>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%
>>>>>>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%
>>>>>>>>
>>>>>>>>
>>>>>>>> During a run on the SPF, perf events were captured:
>>>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>>>          526743764      faults
>>>>>>>>                210      spf
>>>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>>               2278      pagefault:spf_vma_notsup
>>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>>
>>>>>>>> Very few speculative page faults were recorded as most of the processes
>>>>>>>> involved are monothreaded (sounds that on this architecture some threads
>>>>>>>> were created during the kernel build processing).
>>>>>>>>
>>>>>>>> Here are the kerbench results on a 80 CPUs Power8 system:
>>>>>>>>
>>>>>>>> Average Half load -j 40
>>>>>>>>                  Run    (std deviation)
>>>>>>>>                  BASE                   SPF
>>>>>>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%
>>>>>>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%
>>>>>>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%
>>>>>>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%
>>>>>>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%
>>>>>>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%
>>>>>>>>
>>>>>>>> Average Optimal load -j 80
>>>>>>>>                  Run    (std deviation)
>>>>>>>>                  BASE                   SPF
>>>>>>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%
>>>>>>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%
>>>>>>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%
>>>>>>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%
>>>>>>>> Context Switches 223861  (138865)       225032  (139632)        0.52%
>>>>>>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%
>>>>>>>>
>>>>>>>> During a run on the SPF, perf events were captured:
>>>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>>>          116730856      faults
>>>>>>>>                  0      spf
>>>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>>                476      pagefault:spf_vma_notsup
>>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>>
>>>>>>>> Most of the processes involved are monothreaded so SPF is not activated but
>>>>>>>> there is no impact on the performance.
>>>>>>>>
>>>>>>>> Ebizzy:
>>>>>>>> -------
>>>>>>>> The test is counting the number of records per second it can manage, the
>>>>>>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get
>>>>>>>> consistent result I repeated the test 100 times and measure the average
>>>>>>>> result. The number is the record processes per second, the higher is the
>>>>>>>> best.
>>>>>>>>
>>>>>>>>                 BASE            SPF             delta
>>>>>>>> 16 CPUs x86 VM  742.57          1490.24         100.69%
>>>>>>>> 80 CPUs P8 node 13105.4         24174.23        84.46%
>>>>>>>>
>>>>>>>> Here are the performance counter read during a run on a 16 CPUs x86 VM:
>>>>>>>>  Performance counter stats for './ebizzy -mTt 16':
>>>>>>>>            1706379      faults
>>>>>>>>            1674599      spf
>>>>>>>>              30588      pagefault:spf_vma_changed
>>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>>                363      pagefault:spf_vma_notsup
>>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>>
>>>>>>>> And the ones captured during a run on a 80 CPUs Power node:
>>>>>>>>  Performance counter stats for './ebizzy -mTt 80':
>>>>>>>>            1874773      faults
>>>>>>>>            1461153      spf
>>>>>>>>             413293      pagefault:spf_vma_changed
>>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>>                200      pagefault:spf_vma_notsup
>>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>>
>>>>>>>> In ebizzy's case most of the page fault were handled in a speculative way,
>>>>>>>> leading the ebizzy performance boost.
>>>>>>>>
>>>>>>>> ------------------
>>>>>>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):
>>>>>>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahendran
>>>>>>>>    and Minchan Kim, hopefully.
>>>>>>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in
>>>>>>>>    __do_page_fault().
>>>>>>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails
>>>>>>>>    instead
>>>>>>>>    of aborting the speculative page fault handling. Dropping the now
>>>>>>>> useless
>>>>>>>>    trace event pagefault:spf_pte_lock.
>>>>>>>>  - No more try to reuse the fetched VMA during the speculative page fault
>>>>>>>>    handling when retrying is needed. This adds a lot of complexity and
>>>>>>>>    additional tests done didn't show a significant performance improvement.
>>>>>>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.
>>>>>>>>
>>>>>>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at-speculative-page-faults-tt965642.html#none
>>>>>>>> [2] https://patchwork.kernel.org/patch/9999687/
>>>>>>>>
>>>>>>>>
>>>>>>>> Laurent Dufour (20):
>>>>>>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT
>>>>>>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE
>>>>>>>>   mm: make pte_unmap_same compatible with SPF
>>>>>>>>   mm: introduce INIT_VMA()
>>>>>>>>   mm: protect VMA modifications using VMA sequence count
>>>>>>>>   mm: protect mremap() against SPF hanlder
>>>>>>>>   mm: protect SPF handler against anon_vma changes
>>>>>>>>   mm: cache some VMA fields in the vm_fault structure
>>>>>>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()
>>>>>>>>   mm: introduce __lru_cache_add_active_or_unevictable
>>>>>>>>   mm: introduce __vm_normal_page()
>>>>>>>>   mm: introduce __page_add_new_anon_rmap()
>>>>>>>>   mm: protect mm_rb tree with a rwlock
>>>>>>>>   mm: adding speculative page fault failure trace events
>>>>>>>>   perf: add a speculative page fault sw event
>>>>>>>>   perf tools: add support for the SPF perf event
>>>>>>>>   mm: add speculative page fault vmstats
>>>>>>>>   powerpc/mm: add speculative page fault
>>>>>>>>
>>>>>>>> Mahendran Ganesh (2):
>>>>>>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>>   arm64/mm: add speculative page fault
>>>>>>>>
>>>>>>>> Peter Zijlstra (4):
>>>>>>>>   mm: prepare for FAULT_FLAG_SPECULATIVE
>>>>>>>>   mm: VMA sequence count
>>>>>>>>   mm: provide speculative fault infrastructure
>>>>>>>>   x86/mm: add speculative pagefault handling
>>>>>>>>
>>>>>>>>  arch/arm64/Kconfig                    |   1 +
>>>>>>>>  arch/arm64/mm/fault.c                 |  12 +
>>>>>>>>  arch/powerpc/Kconfig                  |   1 +
>>>>>>>>  arch/powerpc/mm/fault.c               |  16 +
>>>>>>>>  arch/x86/Kconfig                      |   1 +
>>>>>>>>  arch/x86/mm/fault.c                   |  27 +-
>>>>>>>>  fs/exec.c                             |   2 +-
>>>>>>>>  fs/proc/task_mmu.c                    |   5 +-
>>>>>>>>  fs/userfaultfd.c                      |  17 +-
>>>>>>>>  include/linux/hugetlb_inline.h        |   2 +-
>>>>>>>>  include/linux/migrate.h               |   4 +-
>>>>>>>>  include/linux/mm.h                    | 136 +++++++-
>>>>>>>>  include/linux/mm_types.h              |   7 +
>>>>>>>>  include/linux/pagemap.h               |   4 +-
>>>>>>>>  include/linux/rmap.h                  |  12 +-
>>>>>>>>  include/linux/swap.h                  |  10 +-
>>>>>>>>  include/linux/vm_event_item.h         |   3 +
>>>>>>>>  include/trace/events/pagefault.h      |  80 +++++
>>>>>>>>  include/uapi/linux/perf_event.h       |   1 +
>>>>>>>>  kernel/fork.c                         |   5 +-
>>>>>>>>  mm/Kconfig                            |  22 ++
>>>>>>>>  mm/huge_memory.c                      |   6 +-
>>>>>>>>  mm/hugetlb.c                          |   2 +
>>>>>>>>  mm/init-mm.c                          |   3 +
>>>>>>>>  mm/internal.h                         |  20 ++
>>>>>>>>  mm/khugepaged.c                       |   5 +
>>>>>>>>  mm/madvise.c                          |   6 +-
>>>>>>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++++++-----
>>>>>>>>  mm/mempolicy.c                        |  51 ++-
>>>>>>>>  mm/migrate.c                          |   6 +-
>>>>>>>>  mm/mlock.c                            |  13 +-
>>>>>>>>  mm/mmap.c                             | 229 ++++++++++---
>>>>>>>>  mm/mprotect.c                         |   4 +-
>>>>>>>>  mm/mremap.c                           |  13 +
>>>>>>>>  mm/nommu.c                            |   2 +-
>>>>>>>>  mm/rmap.c                             |   5 +-
>>>>>>>>  mm/swap.c                             |   6 +-
>>>>>>>>  mm/swap_state.c                       |   8 +-
>>>>>>>>  mm/vmstat.c                           |   5 +-
>>>>>>>>  tools/include/uapi/linux/perf_event.h |   1 +
>>>>>>>>  tools/perf/util/evsel.c               |   1 +
>>>>>>>>  tools/perf/util/parse-events.c        |   4 +
>>>>>>>>  tools/perf/util/parse-events.l        |   1 +
>>>>>>>>  tools/perf/util/python.c              |   1 +
>>>>>>>>  44 files changed, 1161 insertions(+), 211 deletions(-)
>>>>>>>>  create mode 100644 include/trace/events/pagefault.h
>>>>>>>>
>>>>>>>> --
>>>>>>>> 2.7.4
>>>>>>>>
>>>>>>>>
>>>>>>>
>>>>>>
>>>>>
>>>>
>>>>
>>>
>>
> 


[-- Attachment #2: 0001-mm-Add-a-speculative-page-fault-switch-in-sysctl.patch --]
[-- Type: text/x-patch, Size: 2326 bytes --]

>From b6c7fa413f25b8574edf8c764b136715c40299c2 Mon Sep 17 00:00:00 2001
From: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Date: Mon, 20 Aug 2018 17:51:26 +0200
Subject: [PATCH] mm: Add a speculative page fault switch in sysctl

This allows to turn on/off the use of the speculative page fault handler.

By default it's turned on.

Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
---
 include/linux/mm.h | 3 +++
 kernel/sysctl.c    | 9 +++++++++
 mm/memory.c        | 3 +++
 3 files changed, 15 insertions(+)

diff --git a/include/linux/mm.h b/include/linux/mm.h
index 31acf98a7d92..ac102efc4c86 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1422,6 +1422,7 @@ extern int handle_mm_fault(struct vm_area_struct *vma, unsigned long address,
 		unsigned int flags);
 
 #ifdef CONFIG_SPECULATIVE_PAGE_FAULT
+extern int sysctl_speculative_page_fault;
 extern int __handle_speculative_fault(struct mm_struct *mm,
 				      unsigned long address,
 				      unsigned int flags);
@@ -1429,6 +1430,8 @@ static inline int handle_speculative_fault(struct mm_struct *mm,
 					   unsigned long address,
 					   unsigned int flags)
 {
+	if (unlikely(!sysctl_speculative_page_fault))
+		return VM_FAULT_RETRY;
 	/*
 	 * Try speculative page fault for multithreaded user space task only.
 	 */
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index f45ed9e696eb..0fb81edd22c1 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -1243,6 +1243,15 @@ static struct ctl_table vm_table[] = {
 		.extra1		= &zero,
 		.extra2		= &two,
 	},
+#ifdef CONFIG_SPECULATIVE_PAGE_FAULT
+	{
+		.procname	= "speculative_page_fault",
+		.data		= &sysctl_speculative_page_fault,
+		.maxlen		= sizeof(sysctl_speculative_page_fault),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec,
+	},
+#endif
 	{
 		.procname	= "panic_on_oom",
 		.data		= &sysctl_panic_on_oom,
diff --git a/mm/memory.c b/mm/memory.c
index 48e1cf0a54ef..c3db3bc4347b 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -82,6 +82,9 @@
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/pagefault.h>
+#ifdef CONFIG_SPECULATIVE_PAGE_FAULT
+int sysctl_speculative_page_fault = 1;
+#endif
 
 #if defined(LAST_CPUPID_NOT_IN_PAGE_FLAGS) && !defined(CONFIG_COMPILE_TEST)
 #warning Unfortunate NUMA and NUMA Balancing config, growing page-frame for last_cpupid.
-- 
2.7.4



^ permalink raw reply	[flat|nested] 58+ messages in thread

* RE: [PATCH v11 00/26] Speculative page faults
  2018-08-03  6:36                       ` Song, HaiyanX
@ 2018-08-03  6:45                         ` Song, HaiyanX
  2018-08-22 14:23                           ` Laurent Dufour
  1 sibling, 0 replies; 58+ messages in thread
From: Song, HaiyanX @ 2018-08-03  6:45 UTC (permalink / raw)
  To: Laurent Dufour
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

[-- Attachment #1: Type: text/plain, Size: 43157 bytes --]

Add another 3 perf file.
________________________________________
From: Song, HaiyanX
Sent: Friday, August 03, 2018 2:36 PM
To: Laurent Dufour
Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
Subject: RE: [PATCH v11 00/26] Speculative page faults

Hi Laurent,

Thanks for your analysis for the last perf results.
Your mentioned ," the major differences at the head of the perf report is the 92% testcase which is weirdly not reported
on the head side", which is a bug of 0-day,and it caused the item is not counted in perf.

I've triggered the test page_fault2 and page_fault3 again only with thread mode of will-it-scale on 0-day (on the same test box,every case tested 3 times).
I checked the perf report have no above mentioned problem.

I have compared them, found some items have difference, such as below case:
       page_fault2-thp-always: handle_mm_fault, base: 45.22%    head: 29.41%
       page_fault3-thp-always: handle_mm_fault, base: 22.95%    head: 14.15%

So i attached the perf result in mail again, could your have a look again for checking the difference between base and head commit.


Thanks,
Haiyan, Song

________________________________________
From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
Sent: Tuesday, July 17, 2018 5:36 PM
To: Song, HaiyanX
Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
Subject: Re: [PATCH v11 00/26] Speculative page faults

On 13/07/2018 05:56, Song, HaiyanX wrote:
> Hi Laurent,

Hi Haiyan,

Thanks a lot for sharing this perf reports.

I looked at them closely, and I've to admit that I was not able to found a
major difference between the base and the head report, except that
handle_pte_fault() is no more in-lined in the head one.

As expected, __handle_speculative_fault() is never traced since these tests are
dealing with file mapping, not handled in the speculative way.

When running these test did you seen a major differences in the test's result
between base and head ?

>From the number of cycles counted, the biggest difference is page_fault3 when
run with the THP enabled:
                                BASE            HEAD            Delta
page_fault2_base_thp_never      1142252426747   1065866197589   -6.69%
page_fault2_base_THP-Alwasys    1124844374523   1076312228927   -4.31%
page_fault3_base_thp_never      1099387298152   1134118402345   3.16%
page_fault3_base_THP-Always     1059370178101   853985561949    -19.39%


The very weird thing is the difference of the delta cycles reported between
thp never and thp always, because the speculative way is aborted when checking
for the vma->ops field, which is the same in both case, and the thp is never
checked. So there is no code covering differnce, on the speculative path,
between these 2 cases. This leads me to think that there are other interactions
interfering in the measure.

Looking at the perf-profile_page_fault3_*_THP-Always, the major differences at
the head of the perf report is the 92% testcase which is weirdly not reported
on the head side :
    92.02%    22.33%  page_fault3_processes  [.] testcase
92.02% testcase

Then the base reported 37.67% for __do_page_fault() where the head reported
48.41%, but the only difference in this function, between base and head, is the
call to handle_speculative_fault(). But this is a macro checking for the fault
flags, and mm->users and then calling __handle_speculative_fault() if needed.
So this can't explain this difference, except if __handle_speculative_fault()
is inlined in __do_page_fault().
Is this the case on your build ?

Haiyan, do you still have the output of the test to check those numbers too ?

Cheers,
Laurent

> I attached the perf-profile.gz file for case page_fault2 and page_fault3. These files were captured during test the related test case.
> Please help to check on these data if it can help you to find the higher change. Thanks.
>
> File name perf-profile_page_fault2_head_THP-Always.gz, means the perf-profile result get from page_fault2
>     tested for head commit (a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12) with THP_always configuration.
>
> Best regards,
> Haiyan Song
>
> ________________________________________
> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
> Sent: Thursday, July 12, 2018 1:05 AM
> To: Song, HaiyanX
> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
> Subject: Re: [PATCH v11 00/26] Speculative page faults
>
> Hi Haiyan,
>
> Do you get a chance to capture some performance cycles on your system ?
> I still can't get these numbers on my hardware.
>
> Thanks,
> Laurent.
>
> On 04/07/2018 09:51, Laurent Dufour wrote:
>> On 04/07/2018 05:23, Song, HaiyanX wrote:
>>> Hi Laurent,
>>>
>>>
>>> For the test result on Intel 4s skylake platform (192 CPUs, 768G Memory), the below test cases all were run 3 times.
>>> I check the test results, only page_fault3_thread/enable THP have 6% stddev for head commit, other tests have lower stddev.
>>
>> Repeating the test only 3 times seems a bit too low to me.
>>
>> I'll focus on the higher change for the moment, but I don't have access to such
>> a hardware.
>>
>> Is possible to provide a diff between base and SPF of the performance cycles
>> measured when running page_fault3 and page_fault2 when the 20% change is detected.
>>
>> Please stay focus on the test case process to see exactly where the series is
>> impacting.
>>
>> Thanks,
>> Laurent.
>>
>>>
>>> And I did not find other high variation on test case result.
>>>
>>> a). Enable THP
>>> testcase                          base     stddev       change      head     stddev         metric
>>> page_fault3/enable THP           10519      ± 3%        -20.5%      8368      ±6%          will-it-scale.per_thread_ops
>>> page_fault2/enalbe THP            8281      ± 2%        -18.8%      6728                   will-it-scale.per_thread_ops
>>> brk1/eanble THP                 998475                   -2.2%    976893                   will-it-scale.per_process_ops
>>> context_switch1/enable THP      223910                   -1.3%    220930                   will-it-scale.per_process_ops
>>> context_switch1/enable THP      233722                   -1.0%    231288                   will-it-scale.per_thread_ops
>>>
>>> b). Disable THP
>>> page_fault3/disable THP          10856                  -23.1%      8344                   will-it-scale.per_thread_ops
>>> page_fault2/disable THP           8147                  -18.8%      6613                   will-it-scale.per_thread_ops
>>> brk1/disable THP                   957                    -7.9%      881                   will-it-scale.per_thread_ops
>>> context_switch1/disable THP     237006                    -2.2%    231907                  will-it-scale.per_thread_ops
>>> brk1/disable THP                997317                    -2.0%    977778                  will-it-scale.per_process_ops
>>> page_fault3/disable THP         467454                    -1.8%    459251                  will-it-scale.per_process_ops
>>> context_switch1/disable THP     224431                    -1.3%    221567                  will-it-scale.per_process_ops
>>>
>>>
>>> Best regards,
>>> Haiyan Song
>>> ________________________________________
>>> From: Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>> Sent: Monday, July 02, 2018 4:59 PM
>>> To: Song, HaiyanX
>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>
>>> On 11/06/2018 09:49, Song, HaiyanX wrote:
>>>> Hi Laurent,
>>>>
>>>> Regression test for v11 patch serials have been run, some regression is found by LKP-tools (linux kernel performance)
>>>> tested on Intel 4s skylake platform. This time only test the cases which have been run and found regressions on
>>>> V9 patch serials.
>>>>
>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>> branch: Laurent-Dufour/Speculative-page-faults/20180520-045126
>>>> commit id:
>>>>   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12
>>>>   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1
>>>> Benchmark: will-it-scale
>>>> Download link: https://github.com/antonblanchard/will-it-scale/tree/master
>>>>
>>>> Metrics:
>>>>   will-it-scale.per_process_ops=processes/nr_cpu
>>>>   will-it-scale.per_thread_ops=threads/nr_cpu
>>>>   test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>> THP: enable / disable
>>>> nr_task:100%
>>>>
>>>> 1. Regressions:
>>>>
>>>> a). Enable THP
>>>> testcase                          base           change      head           metric
>>>> page_fault3/enable THP           10519          -20.5%        836      will-it-scale.per_thread_ops
>>>> page_fault2/enalbe THP            8281          -18.8%       6728      will-it-scale.per_thread_ops
>>>> brk1/eanble THP                 998475           -2.2%     976893      will-it-scale.per_process_ops
>>>> context_switch1/enable THP      223910           -1.3%     220930      will-it-scale.per_process_ops
>>>> context_switch1/enable THP      233722           -1.0%     231288      will-it-scale.per_thread_ops
>>>>
>>>> b). Disable THP
>>>> page_fault3/disable THP          10856          -23.1%       8344      will-it-scale.per_thread_ops
>>>> page_fault2/disable THP           8147          -18.8%       6613      will-it-scale.per_thread_ops
>>>> brk1/disable THP                   957           -7.9%        881      will-it-scale.per_thread_ops
>>>> context_switch1/disable THP     237006           -2.2%     231907      will-it-scale.per_thread_ops
>>>> brk1/disable THP                997317           -2.0%     977778      will-it-scale.per_process_ops
>>>> page_fault3/disable THP         467454           -1.8%     459251      will-it-scale.per_process_ops
>>>> context_switch1/disable THP     224431           -1.3%     221567      will-it-scale.per_process_ops
>>>>
>>>> Notes: for the above  values of test result, the higher is better.
>>>
>>> I tried the same tests on my PowerPC victim VM (1024 CPUs, 11TB) and I can't
>>> get reproducible results. The results have huge variation, even on the vanilla
>>> kernel, and I can't state on any changes due to that.
>>>
>>> I tried on smaller node (80 CPUs, 32G), and the tests ran better, but I didn't
>>> measure any changes between the vanilla and the SPF patched ones:
>>>
>>> test THP enabled                4.17.0-rc4-mm1  spf             delta
>>> page_fault3_threads             2697.7          2683.5          -0.53%
>>> page_fault2_threads             170660.6        169574.1        -0.64%
>>> context_switch1_threads         6915269.2       6877507.3       -0.55%
>>> context_switch1_processes       6478076.2       6529493.5       0.79%
>>> brk1                            243391.2        238527.5        -2.00%
>>>
>>> Tests were run 10 times, no high variation detected.
>>>
>>> Did you see high variation on your side ? How many times the test were run to
>>> compute the average values ?
>>>
>>> Thanks,
>>> Laurent.
>>>
>>>
>>>>
>>>> 2. Improvement: not found improvement based on the selected test cases.
>>>>
>>>>
>>>> Best regards
>>>> Haiyan Song
>>>> ________________________________________
>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>> Sent: Monday, May 28, 2018 4:54 PM
>>>> To: Song, HaiyanX
>>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>>
>>>> On 28/05/2018 10:22, Haiyan Song wrote:
>>>>> Hi Laurent,
>>>>>
>>>>> Yes, these tests are done on V9 patch.
>>>>
>>>> Do you plan to give this V11 a run ?
>>>>
>>>>>
>>>>>
>>>>> Best regards,
>>>>> Haiyan Song
>>>>>
>>>>> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:
>>>>>> On 28/05/2018 07:23, Song, HaiyanX wrote:
>>>>>>>
>>>>>>> Some regression and improvements is found by LKP-tools(linux kernel performance) on V9 patch series
>>>>>>> tested on Intel 4s Skylake platform.
>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> Thanks for reporting this benchmark results, but you mentioned the "V9 patch
>>>>>> series" while responding to the v11 header series...
>>>>>> Were these tests done on v9 or v11 ?
>>>>>>
>>>>>> Cheers,
>>>>>> Laurent.
>>>>>>
>>>>>>>
>>>>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>>>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 patch series)
>>>>>>> Commit id:
>>>>>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f
>>>>>>>     head commit: 0355322b3577eeab7669066df42c550a56801110
>>>>>>> Benchmark suite: will-it-scale
>>>>>>> Download link:
>>>>>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests
>>>>>>> Metrics:
>>>>>>>     will-it-scale.per_process_ops=processes/nr_cpu
>>>>>>>     will-it-scale.per_thread_ops=threads/nr_cpu
>>>>>>> test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>>>>> THP: enable / disable
>>>>>>> nr_task: 100%
>>>>>>>
>>>>>>> 1. Regressions:
>>>>>>> a) THP enabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> page_fault3/ enable THP         10092           -17.5%          8323       will-it-scale.per_thread_ops
>>>>>>> page_fault2/ enable THP          8300           -17.2%          6869       will-it-scale.per_thread_ops
>>>>>>> brk1/ enable THP                  957.67         -7.6%           885       will-it-scale.per_thread_ops
>>>>>>> page_fault3/ enable THP        172821            -5.3%        163692       will-it-scale.per_process_ops
>>>>>>> signal1/ enable THP              9125            -3.2%          8834       will-it-scale.per_process_ops
>>>>>>>
>>>>>>> b) THP disabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> page_fault3/ disable THP        10107           -19.1%          8180       will-it-scale.per_thread_ops
>>>>>>> page_fault2/ disable THP         8432           -17.8%          6931       will-it-scale.per_thread_ops
>>>>>>> context_switch1/ disable THP   215389            -6.8%        200776       will-it-scale.per_thread_ops
>>>>>>> brk1/ disable THP                 939.67         -6.6%           877.33    will-it-scale.per_thread_ops
>>>>>>> page_fault3/ disable THP       173145            -4.7%        165064       will-it-scale.per_process_ops
>>>>>>> signal1/ disable THP             9162            -3.9%          8802       will-it-scale.per_process_ops
>>>>>>>
>>>>>>> 2. Improvements:
>>>>>>> a) THP enabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> malloc1/ enable THP               66.33        +469.8%           383.67    will-it-scale.per_thread_ops
>>>>>>> writeseek3/ enable THP          2531             +4.5%          2646       will-it-scale.per_thread_ops
>>>>>>> signal1/ enable THP              989.33          +2.8%          1016       will-it-scale.per_thread_ops
>>>>>>>
>>>>>>> b) THP disabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> malloc1/ disable THP              90.33        +417.3%           467.33    will-it-scale.per_thread_ops
>>>>>>> read2/ disable THP             58934            +39.2%         82060       will-it-scale.per_thread_ops
>>>>>>> page_fault1/ disable THP        8607            +36.4%         11736       will-it-scale.per_thread_ops
>>>>>>> read1/ disable THP            314063            +12.7%        353934       will-it-scale.per_thread_ops
>>>>>>> writeseek3/ disable THP         2452            +12.5%          2759       will-it-scale.per_thread_ops
>>>>>>> signal1/ disable THP             971.33          +5.5%          1024       will-it-scale.per_thread_ops
>>>>>>>
>>>>>>> Notes: for above values in column "change", the higher value means that the related testcase result
>>>>>>> on head commit is better than that on base commit for this benchmark.
>>>>>>>
>>>>>>>
>>>>>>> Best regards
>>>>>>> Haiyan Song
>>>>>>>
>>>>>>> ________________________________________
>>>>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>>>>> Sent: Thursday, May 17, 2018 7:06 PM
>>>>>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi
>>>>>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>>>>> Subject: [PATCH v11 00/26] Speculative page faults
>>>>>>>
>>>>>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>>>>>>> page fault without holding the mm semaphore [1].
>>>>>>>
>>>>>>> The idea is to try to handle user space page faults without holding the
>>>>>>> mmap_sem. This should allow better concurrency for massively threaded
>>>>>>> process since the page fault handler will not wait for other threads memory
>>>>>>> layout change to be done, assuming that this change is done in another part
>>>>>>> of the process's memory space. This type page fault is named speculative
>>>>>>> page fault. If the speculative page fault fails because of a concurrency is
>>>>>>> detected or because underlying PMD or PTE tables are not yet allocating, it
>>>>>>> is failing its processing and a classic page fault is then tried.
>>>>>>>
>>>>>>> The speculative page fault (SPF) has to look for the VMA matching the fault
>>>>>>> address without holding the mmap_sem, this is done by introducing a rwlock
>>>>>>> which protects the access to the mm_rb tree. Previously this was done using
>>>>>>> SRCU but it was introducing a lot of scheduling to process the VMA's
>>>>>>> freeing operation which was hitting the performance by 20% as reported by
>>>>>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is
>>>>>>> limiting the locking contention to these operations which are expected to
>>>>>>> be in a O(log n) order. In addition to ensure that the VMA is not freed in
>>>>>>> our back a reference count is added and 2 services (get_vma() and
>>>>>>> put_vma()) are introduced to handle the reference count. Once a VMA is
>>>>>>> fetched from the RB tree using get_vma(), it must be later freed using
>>>>>>> put_vma(). I can't see anymore the overhead I got while will-it-scale
>>>>>>> benchmark anymore.
>>>>>>>
>>>>>>> The VMA's attributes checked during the speculative page fault processing
>>>>>>> have to be protected against parallel changes. This is done by using a per
>>>>>>> VMA sequence lock. This sequence lock allows the speculative page fault
>>>>>>> handler to fast check for parallel changes in progress and to abort the
>>>>>>> speculative page fault in that case.
>>>>>>>
>>>>>>> Once the VMA has been found, the speculative page fault handler would check
>>>>>>> for the VMA's attributes to verify that the page fault has to be handled
>>>>>>> correctly or not. Thus, the VMA is protected through a sequence lock which
>>>>>>> allows fast detection of concurrent VMA changes. If such a change is
>>>>>>> detected, the speculative page fault is aborted and a *classic* page fault
>>>>>>> is tried.  VMA sequence lockings are added when VMA attributes which are
>>>>>>> checked during the page fault are modified.
>>>>>>>
>>>>>>> When the PTE is fetched, the VMA is checked to see if it has been changed,
>>>>>>> so once the page table is locked, the VMA is valid, so any other changes
>>>>>>> leading to touching this PTE will need to lock the page table, so no
>>>>>>> parallel change is possible at this time.
>>>>>>>
>>>>>>> The locking of the PTE is done with interrupts disabled, this allows
>>>>>>> checking for the PMD to ensure that there is not an ongoing collapsing
>>>>>>> operation. Since khugepaged is firstly set the PMD to pmd_none and then is
>>>>>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd is
>>>>>>> valid at the time the PTE is locked, we have the guarantee that the
>>>>>>> collapsing operation will have to wait on the PTE lock to move forward.
>>>>>>> This allows the SPF handler to map the PTE safely. If the PMD value is
>>>>>>> different from the one recorded at the beginning of the SPF operation, the
>>>>>>> classic page fault handler will be called to handle the operation while
>>>>>>> holding the mmap_sem. As the PTE lock is done with the interrupts disabled,
>>>>>>> the lock is done using spin_trylock() to avoid dead lock when handling a
>>>>>>> page fault while a TLB invalidate is requested by another CPU holding the
>>>>>>> PTE.
>>>>>>>
>>>>>>> In pseudo code, this could be seen as:
>>>>>>>     speculative_page_fault()
>>>>>>>     {
>>>>>>>             vma = get_vma()
>>>>>>>             check vma sequence count
>>>>>>>             check vma's support
>>>>>>>             disable interrupt
>>>>>>>                   check pgd,p4d,...,pte
>>>>>>>                   save pmd and pte in vmf
>>>>>>>                   save vma sequence counter in vmf
>>>>>>>             enable interrupt
>>>>>>>             check vma sequence count
>>>>>>>             handle_pte_fault(vma)
>>>>>>>                     ..
>>>>>>>                     page = alloc_page()
>>>>>>>                     pte_map_lock()
>>>>>>>                             disable interrupt
>>>>>>>                                     abort if sequence counter has changed
>>>>>>>                                     abort if pmd or pte has changed
>>>>>>>                                     pte map and lock
>>>>>>>                             enable interrupt
>>>>>>>                     if abort
>>>>>>>                        free page
>>>>>>>                        abort
>>>>>>>                     ...
>>>>>>>     }
>>>>>>>
>>>>>>>     arch_fault_handler()
>>>>>>>     {
>>>>>>>             if (speculative_page_fault(&vma))
>>>>>>>                goto done
>>>>>>>     again:
>>>>>>>             lock(mmap_sem)
>>>>>>>             vma = find_vma();
>>>>>>>             handle_pte_fault(vma);
>>>>>>>             if retry
>>>>>>>                unlock(mmap_sem)
>>>>>>>                goto again;
>>>>>>>     done:
>>>>>>>             handle fault error
>>>>>>>     }
>>>>>>>
>>>>>>> Support for THP is not done because when checking for the PMD, we can be
>>>>>>> confused by an in progress collapsing operation done by khugepaged. The
>>>>>>> issue is that pmd_none() could be true either if the PMD is not already
>>>>>>> populated or if the underlying PTE are in the way to be collapsed. So we
>>>>>>> cannot safely allocate a PMD if pmd_none() is true.
>>>>>>>
>>>>>>> This series add a new software performance event named 'speculative-faults'
>>>>>>> or 'spf'. It counts the number of successful page fault event handled
>>>>>>> speculatively. When recording 'faults,spf' events, the faults one is
>>>>>>> counting the total number of page fault events while 'spf' is only counting
>>>>>>> the part of the faults processed speculatively.
>>>>>>>
>>>>>>> There are some trace events introduced by this series. They allow
>>>>>>> identifying why the page faults were not processed speculatively. This
>>>>>>> doesn't take in account the faults generated by a monothreaded process
>>>>>>> which directly processed while holding the mmap_sem. This trace events are
>>>>>>> grouped in a system named 'pagefault', they are:
>>>>>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back
>>>>>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.
>>>>>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported
>>>>>>>  - pagefault:spf_vma_access : the VMA's access right are not respected
>>>>>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in our
>>>>>>>    back.
>>>>>>>
>>>>>>> To record all the related events, the easier is to run perf with the
>>>>>>> following arguments :
>>>>>>> $ perf stat -e 'faults,spf,pagefault:*' <command>
>>>>>>>
>>>>>>> There is also a dedicated vmstat counter showing the number of successful
>>>>>>> page fault handled speculatively. I can be seen this way:
>>>>>>> $ grep speculative_pgfault /proc/vmstat
>>>>>>>
>>>>>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is functional
>>>>>>> on x86, PowerPC and arm64.
>>>>>>>
>>>>>>> ---------------------
>>>>>>> Real Workload results
>>>>>>>
>>>>>>> As mentioned in previous email, we did non official runs using a "popular
>>>>>>> in memory multithreaded database product" on 176 cores SMT8 Power system
>>>>>>> which showed a 30% improvements in the number of transaction processed per
>>>>>>> second. This run has been done on the v6 series, but changes introduced in
>>>>>>> this new version should not impact the performance boost seen.
>>>>>>>
>>>>>>> Here are the perf data captured during 2 of these runs on top of the v8
>>>>>>> series:
>>>>>>>                 vanilla         spf
>>>>>>> faults          89.418          101.364         +13%
>>>>>>> spf                n/a           97.989
>>>>>>>
>>>>>>> With the SPF kernel, most of the page fault were processed in a speculative
>>>>>>> way.
>>>>>>>
>>>>>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and gave
>>>>>>> it a try on an android device. He reported that the application launch time
>>>>>>> was improved in average by 6%, and for large applications (~100 threads) by
>>>>>>> 20%.
>>>>>>>
>>>>>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qcom
>>>>>>> MSM845 (8 cores) with 6GB (the less is better):
>>>>>>>
>>>>>>> Application                             4.9     4.9+spf delta
>>>>>>> com.tencent.mm                          416     389     -7%
>>>>>>> com.eg.android.AlipayGphone             1135    986     -13%
>>>>>>> com.tencent.mtt                         455     454     0%
>>>>>>> com.qqgame.hlddz                        1497    1409    -6%
>>>>>>> com.autonavi.minimap                    711     701     -1%
>>>>>>> com.tencent.tmgp.sgame                  788     748     -5%
>>>>>>> com.immomo.momo                         501     487     -3%
>>>>>>> com.tencent.peng                        2145    2112    -2%
>>>>>>> com.smile.gifmaker                      491     461     -6%
>>>>>>> com.baidu.BaiduMap                      479     366     -23%
>>>>>>> com.taobao.taobao                       1341    1198    -11%
>>>>>>> com.baidu.searchbox                     333     314     -6%
>>>>>>> com.tencent.mobileqq                    394     384     -3%
>>>>>>> com.sina.weibo                          907     906     0%
>>>>>>> com.youku.phone                         816     731     -11%
>>>>>>> com.happyelements.AndroidAnimal.qq      763     717     -6%
>>>>>>> com.UCMobile                            415     411     -1%
>>>>>>> com.tencent.tmgp.ak                     1464    1431    -2%
>>>>>>> com.tencent.qqmusic                     336     329     -2%
>>>>>>> com.sankuai.meituan                     1661    1302    -22%
>>>>>>> com.netease.cloudmusic                  1193    1200    1%
>>>>>>> air.tv.douyu.android                    4257    4152    -2%
>>>>>>>
>>>>>>> ------------------
>>>>>>> Benchmarks results
>>>>>>>
>>>>>>> Base kernel is v4.17.0-rc4-mm1
>>>>>>> SPF is BASE + this series
>>>>>>>
>>>>>>> Kernbench:
>>>>>>> ----------
>>>>>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15
>>>>>>> kernel (kernel is build 5 times):
>>>>>>>
>>>>>>> Average Half load -j 8
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%
>>>>>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%
>>>>>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%
>>>>>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%
>>>>>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%
>>>>>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%
>>>>>>>
>>>>>>> Average Optimal load -j 16
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%
>>>>>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%
>>>>>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%
>>>>>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%
>>>>>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%
>>>>>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%
>>>>>>>
>>>>>>>
>>>>>>> During a run on the SPF, perf events were captured:
>>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>>          526743764      faults
>>>>>>>                210      spf
>>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>               2278      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> Very few speculative page faults were recorded as most of the processes
>>>>>>> involved are monothreaded (sounds that on this architecture some threads
>>>>>>> were created during the kernel build processing).
>>>>>>>
>>>>>>> Here are the kerbench results on a 80 CPUs Power8 system:
>>>>>>>
>>>>>>> Average Half load -j 40
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%
>>>>>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%
>>>>>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%
>>>>>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%
>>>>>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%
>>>>>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%
>>>>>>>
>>>>>>> Average Optimal load -j 80
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%
>>>>>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%
>>>>>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%
>>>>>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%
>>>>>>> Context Switches 223861  (138865)       225032  (139632)        0.52%
>>>>>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%
>>>>>>>
>>>>>>> During a run on the SPF, perf events were captured:
>>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>>          116730856      faults
>>>>>>>                  0      spf
>>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>                476      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> Most of the processes involved are monothreaded so SPF is not activated but
>>>>>>> there is no impact on the performance.
>>>>>>>
>>>>>>> Ebizzy:
>>>>>>> -------
>>>>>>> The test is counting the number of records per second it can manage, the
>>>>>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get
>>>>>>> consistent result I repeated the test 100 times and measure the average
>>>>>>> result. The number is the record processes per second, the higher is the
>>>>>>> best.
>>>>>>>
>>>>>>>                 BASE            SPF             delta
>>>>>>> 16 CPUs x86 VM  742.57          1490.24         100.69%
>>>>>>> 80 CPUs P8 node 13105.4         24174.23        84.46%
>>>>>>>
>>>>>>> Here are the performance counter read during a run on a 16 CPUs x86 VM:
>>>>>>>  Performance counter stats for './ebizzy -mTt 16':
>>>>>>>            1706379      faults
>>>>>>>            1674599      spf
>>>>>>>              30588      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>                363      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> And the ones captured during a run on a 80 CPUs Power node:
>>>>>>>  Performance counter stats for './ebizzy -mTt 80':
>>>>>>>            1874773      faults
>>>>>>>            1461153      spf
>>>>>>>             413293      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>                200      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> In ebizzy's case most of the page fault were handled in a speculative way,
>>>>>>> leading the ebizzy performance boost.
>>>>>>>
>>>>>>> ------------------
>>>>>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):
>>>>>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahendran
>>>>>>>    and Minchan Kim, hopefully.
>>>>>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in
>>>>>>>    __do_page_fault().
>>>>>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails
>>>>>>>    instead
>>>>>>>    of aborting the speculative page fault handling. Dropping the now
>>>>>>> useless
>>>>>>>    trace event pagefault:spf_pte_lock.
>>>>>>>  - No more try to reuse the fetched VMA during the speculative page fault
>>>>>>>    handling when retrying is needed. This adds a lot of complexity and
>>>>>>>    additional tests done didn't show a significant performance improvement.
>>>>>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.
>>>>>>>
>>>>>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at-speculative-page-faults-tt965642.html#none
>>>>>>> [2] https://patchwork.kernel.org/patch/9999687/
>>>>>>>
>>>>>>>
>>>>>>> Laurent Dufour (20):
>>>>>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT
>>>>>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE
>>>>>>>   mm: make pte_unmap_same compatible with SPF
>>>>>>>   mm: introduce INIT_VMA()
>>>>>>>   mm: protect VMA modifications using VMA sequence count
>>>>>>>   mm: protect mremap() against SPF hanlder
>>>>>>>   mm: protect SPF handler against anon_vma changes
>>>>>>>   mm: cache some VMA fields in the vm_fault structure
>>>>>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()
>>>>>>>   mm: introduce __lru_cache_add_active_or_unevictable
>>>>>>>   mm: introduce __vm_normal_page()
>>>>>>>   mm: introduce __page_add_new_anon_rmap()
>>>>>>>   mm: protect mm_rb tree with a rwlock
>>>>>>>   mm: adding speculative page fault failure trace events
>>>>>>>   perf: add a speculative page fault sw event
>>>>>>>   perf tools: add support for the SPF perf event
>>>>>>>   mm: add speculative page fault vmstats
>>>>>>>   powerpc/mm: add speculative page fault
>>>>>>>
>>>>>>> Mahendran Ganesh (2):
>>>>>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>   arm64/mm: add speculative page fault
>>>>>>>
>>>>>>> Peter Zijlstra (4):
>>>>>>>   mm: prepare for FAULT_FLAG_SPECULATIVE
>>>>>>>   mm: VMA sequence count
>>>>>>>   mm: provide speculative fault infrastructure
>>>>>>>   x86/mm: add speculative pagefault handling
>>>>>>>
>>>>>>>  arch/arm64/Kconfig                    |   1 +
>>>>>>>  arch/arm64/mm/fault.c                 |  12 +
>>>>>>>  arch/powerpc/Kconfig                  |   1 +
>>>>>>>  arch/powerpc/mm/fault.c               |  16 +
>>>>>>>  arch/x86/Kconfig                      |   1 +
>>>>>>>  arch/x86/mm/fault.c                   |  27 +-
>>>>>>>  fs/exec.c                             |   2 +-
>>>>>>>  fs/proc/task_mmu.c                    |   5 +-
>>>>>>>  fs/userfaultfd.c                      |  17 +-
>>>>>>>  include/linux/hugetlb_inline.h        |   2 +-
>>>>>>>  include/linux/migrate.h               |   4 +-
>>>>>>>  include/linux/mm.h                    | 136 +++++++-
>>>>>>>  include/linux/mm_types.h              |   7 +
>>>>>>>  include/linux/pagemap.h               |   4 +-
>>>>>>>  include/linux/rmap.h                  |  12 +-
>>>>>>>  include/linux/swap.h                  |  10 +-
>>>>>>>  include/linux/vm_event_item.h         |   3 +
>>>>>>>  include/trace/events/pagefault.h      |  80 +++++
>>>>>>>  include/uapi/linux/perf_event.h       |   1 +
>>>>>>>  kernel/fork.c                         |   5 +-
>>>>>>>  mm/Kconfig                            |  22 ++
>>>>>>>  mm/huge_memory.c                      |   6 +-
>>>>>>>  mm/hugetlb.c                          |   2 +
>>>>>>>  mm/init-mm.c                          |   3 +
>>>>>>>  mm/internal.h                         |  20 ++
>>>>>>>  mm/khugepaged.c                       |   5 +
>>>>>>>  mm/madvise.c                          |   6 +-
>>>>>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++++++-----
>>>>>>>  mm/mempolicy.c                        |  51 ++-
>>>>>>>  mm/migrate.c                          |   6 +-
>>>>>>>  mm/mlock.c                            |  13 +-
>>>>>>>  mm/mmap.c                             | 229 ++++++++++---
>>>>>>>  mm/mprotect.c                         |   4 +-
>>>>>>>  mm/mremap.c                           |  13 +
>>>>>>>  mm/nommu.c                            |   2 +-
>>>>>>>  mm/rmap.c                             |   5 +-
>>>>>>>  mm/swap.c                             |   6 +-
>>>>>>>  mm/swap_state.c                       |   8 +-
>>>>>>>  mm/vmstat.c                           |   5 +-
>>>>>>>  tools/include/uapi/linux/perf_event.h |   1 +
>>>>>>>  tools/perf/util/evsel.c               |   1 +
>>>>>>>  tools/perf/util/parse-events.c        |   4 +
>>>>>>>  tools/perf/util/parse-events.l        |   1 +
>>>>>>>  tools/perf/util/python.c              |   1 +
>>>>>>>  44 files changed, 1161 insertions(+), 211 deletions(-)
>>>>>>>  create mode 100644 include/trace/events/pagefault.h
>>>>>>>
>>>>>>> --
>>>>>>> 2.7.4
>>>>>>>
>>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>>
>>
>


[-- Attachment #2: perf-profile_page_fault3_head_thp_always.gz --]
[-- Type: application/gzip, Size: 12909 bytes --]

[-- Attachment #3: perf-profile_page_fault3_head_thp_never.gz --]
[-- Type: application/gzip, Size: 12535 bytes --]

[-- Attachment #4: perf-profile_page_fault2_head_thp_never.gz --]
[-- Type: application/gzip, Size: 11782 bytes --]

^ permalink raw reply	[flat|nested] 58+ messages in thread

* RE: [PATCH v11 00/26] Speculative page faults
  2018-07-17  9:36                       ` Laurent Dufour
  (?)
@ 2018-08-03  6:36                       ` Song, HaiyanX
  2018-08-03  6:45                         ` Song, HaiyanX
  2018-08-22 14:23                           ` Laurent Dufour
  -1 siblings, 2 replies; 58+ messages in thread
From: Song, HaiyanX @ 2018-08-03  6:36 UTC (permalink / raw)
  To: Laurent Dufour
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

[-- Attachment #1: Type: text/plain, Size: 42188 bytes --]

Hi Laurent,

Thanks for your analysis for the last perf results.
Your mentioned ," the major differences at the head of the perf report is the 92% testcase which is weirdly not reported
on the head side", which is a bug of 0-day,and it caused the item is not counted in perf. 

I've triggered the test page_fault2 and page_fault3 again only with thread mode of will-it-scale on 0-day (on the same test box,every case tested 3 times).
I checked the perf report have no above mentioned problem.

I have compared them, found some items have difference, such as below case:
       page_fault2-thp-always: handle_mm_fault, base: 45.22%    head: 29.41%
       page_fault3-thp-always: handle_mm_fault, base: 22.95%    head: 14.15%       

So i attached the perf result in mail again, could your have a look again for checking the difference between base and head commit.


Thanks,
Haiyan, Song
 
________________________________________
From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
Sent: Tuesday, July 17, 2018 5:36 PM
To: Song, HaiyanX
Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
Subject: Re: [PATCH v11 00/26] Speculative page faults

On 13/07/2018 05:56, Song, HaiyanX wrote:
> Hi Laurent,

Hi Haiyan,

Thanks a lot for sharing this perf reports.

I looked at them closely, and I've to admit that I was not able to found a
major difference between the base and the head report, except that
handle_pte_fault() is no more in-lined in the head one.

As expected, __handle_speculative_fault() is never traced since these tests are
dealing with file mapping, not handled in the speculative way.

When running these test did you seen a major differences in the test's result
between base and head ?

>From the number of cycles counted, the biggest difference is page_fault3 when
run with the THP enabled:
                                BASE            HEAD            Delta
page_fault2_base_thp_never      1142252426747   1065866197589   -6.69%
page_fault2_base_THP-Alwasys    1124844374523   1076312228927   -4.31%
page_fault3_base_thp_never      1099387298152   1134118402345   3.16%
page_fault3_base_THP-Always     1059370178101   853985561949    -19.39%


The very weird thing is the difference of the delta cycles reported between
thp never and thp always, because the speculative way is aborted when checking
for the vma->ops field, which is the same in both case, and the thp is never
checked. So there is no code covering differnce, on the speculative path,
between these 2 cases. This leads me to think that there are other interactions
interfering in the measure.

Looking at the perf-profile_page_fault3_*_THP-Always, the major differences at
the head of the perf report is the 92% testcase which is weirdly not reported
on the head side :
    92.02%    22.33%  page_fault3_processes  [.] testcase
92.02% testcase

Then the base reported 37.67% for __do_page_fault() where the head reported
48.41%, but the only difference in this function, between base and head, is the
call to handle_speculative_fault(). But this is a macro checking for the fault
flags, and mm->users and then calling __handle_speculative_fault() if needed.
So this can't explain this difference, except if __handle_speculative_fault()
is inlined in __do_page_fault().
Is this the case on your build ?

Haiyan, do you still have the output of the test to check those numbers too ?

Cheers,
Laurent

> I attached the perf-profile.gz file for case page_fault2 and page_fault3. These files were captured during test the related test case.
> Please help to check on these data if it can help you to find the higher change. Thanks.
>
> File name perf-profile_page_fault2_head_THP-Always.gz, means the perf-profile result get from page_fault2
>     tested for head commit (a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12) with THP_always configuration.
>
> Best regards,
> Haiyan Song
>
> ________________________________________
> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
> Sent: Thursday, July 12, 2018 1:05 AM
> To: Song, HaiyanX
> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
> Subject: Re: [PATCH v11 00/26] Speculative page faults
>
> Hi Haiyan,
>
> Do you get a chance to capture some performance cycles on your system ?
> I still can't get these numbers on my hardware.
>
> Thanks,
> Laurent.
>
> On 04/07/2018 09:51, Laurent Dufour wrote:
>> On 04/07/2018 05:23, Song, HaiyanX wrote:
>>> Hi Laurent,
>>>
>>>
>>> For the test result on Intel 4s skylake platform (192 CPUs, 768G Memory), the below test cases all were run 3 times.
>>> I check the test results, only page_fault3_thread/enable THP have 6% stddev for head commit, other tests have lower stddev.
>>
>> Repeating the test only 3 times seems a bit too low to me.
>>
>> I'll focus on the higher change for the moment, but I don't have access to such
>> a hardware.
>>
>> Is possible to provide a diff between base and SPF of the performance cycles
>> measured when running page_fault3 and page_fault2 when the 20% change is detected.
>>
>> Please stay focus on the test case process to see exactly where the series is
>> impacting.
>>
>> Thanks,
>> Laurent.
>>
>>>
>>> And I did not find other high variation on test case result.
>>>
>>> a). Enable THP
>>> testcase                          base     stddev       change      head     stddev         metric
>>> page_fault3/enable THP           10519      ± 3%        -20.5%      8368      ±6%          will-it-scale.per_thread_ops
>>> page_fault2/enalbe THP            8281      ± 2%        -18.8%      6728                   will-it-scale.per_thread_ops
>>> brk1/eanble THP                 998475                   -2.2%    976893                   will-it-scale.per_process_ops
>>> context_switch1/enable THP      223910                   -1.3%    220930                   will-it-scale.per_process_ops
>>> context_switch1/enable THP      233722                   -1.0%    231288                   will-it-scale.per_thread_ops
>>>
>>> b). Disable THP
>>> page_fault3/disable THP          10856                  -23.1%      8344                   will-it-scale.per_thread_ops
>>> page_fault2/disable THP           8147                  -18.8%      6613                   will-it-scale.per_thread_ops
>>> brk1/disable THP                   957                    -7.9%      881                   will-it-scale.per_thread_ops
>>> context_switch1/disable THP     237006                    -2.2%    231907                  will-it-scale.per_thread_ops
>>> brk1/disable THP                997317                    -2.0%    977778                  will-it-scale.per_process_ops
>>> page_fault3/disable THP         467454                    -1.8%    459251                  will-it-scale.per_process_ops
>>> context_switch1/disable THP     224431                    -1.3%    221567                  will-it-scale.per_process_ops
>>>
>>>
>>> Best regards,
>>> Haiyan Song
>>> ________________________________________
>>> From: Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>> Sent: Monday, July 02, 2018 4:59 PM
>>> To: Song, HaiyanX
>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>
>>> On 11/06/2018 09:49, Song, HaiyanX wrote:
>>>> Hi Laurent,
>>>>
>>>> Regression test for v11 patch serials have been run, some regression is found by LKP-tools (linux kernel performance)
>>>> tested on Intel 4s skylake platform. This time only test the cases which have been run and found regressions on
>>>> V9 patch serials.
>>>>
>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>> branch: Laurent-Dufour/Speculative-page-faults/20180520-045126
>>>> commit id:
>>>>   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12
>>>>   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1
>>>> Benchmark: will-it-scale
>>>> Download link: https://github.com/antonblanchard/will-it-scale/tree/master
>>>>
>>>> Metrics:
>>>>   will-it-scale.per_process_ops=processes/nr_cpu
>>>>   will-it-scale.per_thread_ops=threads/nr_cpu
>>>>   test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>> THP: enable / disable
>>>> nr_task:100%
>>>>
>>>> 1. Regressions:
>>>>
>>>> a). Enable THP
>>>> testcase                          base           change      head           metric
>>>> page_fault3/enable THP           10519          -20.5%        836      will-it-scale.per_thread_ops
>>>> page_fault2/enalbe THP            8281          -18.8%       6728      will-it-scale.per_thread_ops
>>>> brk1/eanble THP                 998475           -2.2%     976893      will-it-scale.per_process_ops
>>>> context_switch1/enable THP      223910           -1.3%     220930      will-it-scale.per_process_ops
>>>> context_switch1/enable THP      233722           -1.0%     231288      will-it-scale.per_thread_ops
>>>>
>>>> b). Disable THP
>>>> page_fault3/disable THP          10856          -23.1%       8344      will-it-scale.per_thread_ops
>>>> page_fault2/disable THP           8147          -18.8%       6613      will-it-scale.per_thread_ops
>>>> brk1/disable THP                   957           -7.9%        881      will-it-scale.per_thread_ops
>>>> context_switch1/disable THP     237006           -2.2%     231907      will-it-scale.per_thread_ops
>>>> brk1/disable THP                997317           -2.0%     977778      will-it-scale.per_process_ops
>>>> page_fault3/disable THP         467454           -1.8%     459251      will-it-scale.per_process_ops
>>>> context_switch1/disable THP     224431           -1.3%     221567      will-it-scale.per_process_ops
>>>>
>>>> Notes: for the above  values of test result, the higher is better.
>>>
>>> I tried the same tests on my PowerPC victim VM (1024 CPUs, 11TB) and I can't
>>> get reproducible results. The results have huge variation, even on the vanilla
>>> kernel, and I can't state on any changes due to that.
>>>
>>> I tried on smaller node (80 CPUs, 32G), and the tests ran better, but I didn't
>>> measure any changes between the vanilla and the SPF patched ones:
>>>
>>> test THP enabled                4.17.0-rc4-mm1  spf             delta
>>> page_fault3_threads             2697.7          2683.5          -0.53%
>>> page_fault2_threads             170660.6        169574.1        -0.64%
>>> context_switch1_threads         6915269.2       6877507.3       -0.55%
>>> context_switch1_processes       6478076.2       6529493.5       0.79%
>>> brk1                            243391.2        238527.5        -2.00%
>>>
>>> Tests were run 10 times, no high variation detected.
>>>
>>> Did you see high variation on your side ? How many times the test were run to
>>> compute the average values ?
>>>
>>> Thanks,
>>> Laurent.
>>>
>>>
>>>>
>>>> 2. Improvement: not found improvement based on the selected test cases.
>>>>
>>>>
>>>> Best regards
>>>> Haiyan Song
>>>> ________________________________________
>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>> Sent: Monday, May 28, 2018 4:54 PM
>>>> To: Song, HaiyanX
>>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>>
>>>> On 28/05/2018 10:22, Haiyan Song wrote:
>>>>> Hi Laurent,
>>>>>
>>>>> Yes, these tests are done on V9 patch.
>>>>
>>>> Do you plan to give this V11 a run ?
>>>>
>>>>>
>>>>>
>>>>> Best regards,
>>>>> Haiyan Song
>>>>>
>>>>> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:
>>>>>> On 28/05/2018 07:23, Song, HaiyanX wrote:
>>>>>>>
>>>>>>> Some regression and improvements is found by LKP-tools(linux kernel performance) on V9 patch series
>>>>>>> tested on Intel 4s Skylake platform.
>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> Thanks for reporting this benchmark results, but you mentioned the "V9 patch
>>>>>> series" while responding to the v11 header series...
>>>>>> Were these tests done on v9 or v11 ?
>>>>>>
>>>>>> Cheers,
>>>>>> Laurent.
>>>>>>
>>>>>>>
>>>>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>>>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 patch series)
>>>>>>> Commit id:
>>>>>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f
>>>>>>>     head commit: 0355322b3577eeab7669066df42c550a56801110
>>>>>>> Benchmark suite: will-it-scale
>>>>>>> Download link:
>>>>>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests
>>>>>>> Metrics:
>>>>>>>     will-it-scale.per_process_ops=processes/nr_cpu
>>>>>>>     will-it-scale.per_thread_ops=threads/nr_cpu
>>>>>>> test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>>>>> THP: enable / disable
>>>>>>> nr_task: 100%
>>>>>>>
>>>>>>> 1. Regressions:
>>>>>>> a) THP enabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> page_fault3/ enable THP         10092           -17.5%          8323       will-it-scale.per_thread_ops
>>>>>>> page_fault2/ enable THP          8300           -17.2%          6869       will-it-scale.per_thread_ops
>>>>>>> brk1/ enable THP                  957.67         -7.6%           885       will-it-scale.per_thread_ops
>>>>>>> page_fault3/ enable THP        172821            -5.3%        163692       will-it-scale.per_process_ops
>>>>>>> signal1/ enable THP              9125            -3.2%          8834       will-it-scale.per_process_ops
>>>>>>>
>>>>>>> b) THP disabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> page_fault3/ disable THP        10107           -19.1%          8180       will-it-scale.per_thread_ops
>>>>>>> page_fault2/ disable THP         8432           -17.8%          6931       will-it-scale.per_thread_ops
>>>>>>> context_switch1/ disable THP   215389            -6.8%        200776       will-it-scale.per_thread_ops
>>>>>>> brk1/ disable THP                 939.67         -6.6%           877.33    will-it-scale.per_thread_ops
>>>>>>> page_fault3/ disable THP       173145            -4.7%        165064       will-it-scale.per_process_ops
>>>>>>> signal1/ disable THP             9162            -3.9%          8802       will-it-scale.per_process_ops
>>>>>>>
>>>>>>> 2. Improvements:
>>>>>>> a) THP enabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> malloc1/ enable THP               66.33        +469.8%           383.67    will-it-scale.per_thread_ops
>>>>>>> writeseek3/ enable THP          2531             +4.5%          2646       will-it-scale.per_thread_ops
>>>>>>> signal1/ enable THP              989.33          +2.8%          1016       will-it-scale.per_thread_ops
>>>>>>>
>>>>>>> b) THP disabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> malloc1/ disable THP              90.33        +417.3%           467.33    will-it-scale.per_thread_ops
>>>>>>> read2/ disable THP             58934            +39.2%         82060       will-it-scale.per_thread_ops
>>>>>>> page_fault1/ disable THP        8607            +36.4%         11736       will-it-scale.per_thread_ops
>>>>>>> read1/ disable THP            314063            +12.7%        353934       will-it-scale.per_thread_ops
>>>>>>> writeseek3/ disable THP         2452            +12.5%          2759       will-it-scale.per_thread_ops
>>>>>>> signal1/ disable THP             971.33          +5.5%          1024       will-it-scale.per_thread_ops
>>>>>>>
>>>>>>> Notes: for above values in column "change", the higher value means that the related testcase result
>>>>>>> on head commit is better than that on base commit for this benchmark.
>>>>>>>
>>>>>>>
>>>>>>> Best regards
>>>>>>> Haiyan Song
>>>>>>>
>>>>>>> ________________________________________
>>>>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>>>>> Sent: Thursday, May 17, 2018 7:06 PM
>>>>>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi
>>>>>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>>>>> Subject: [PATCH v11 00/26] Speculative page faults
>>>>>>>
>>>>>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>>>>>>> page fault without holding the mm semaphore [1].
>>>>>>>
>>>>>>> The idea is to try to handle user space page faults without holding the
>>>>>>> mmap_sem. This should allow better concurrency for massively threaded
>>>>>>> process since the page fault handler will not wait for other threads memory
>>>>>>> layout change to be done, assuming that this change is done in another part
>>>>>>> of the process's memory space. This type page fault is named speculative
>>>>>>> page fault. If the speculative page fault fails because of a concurrency is
>>>>>>> detected or because underlying PMD or PTE tables are not yet allocating, it
>>>>>>> is failing its processing and a classic page fault is then tried.
>>>>>>>
>>>>>>> The speculative page fault (SPF) has to look for the VMA matching the fault
>>>>>>> address without holding the mmap_sem, this is done by introducing a rwlock
>>>>>>> which protects the access to the mm_rb tree. Previously this was done using
>>>>>>> SRCU but it was introducing a lot of scheduling to process the VMA's
>>>>>>> freeing operation which was hitting the performance by 20% as reported by
>>>>>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is
>>>>>>> limiting the locking contention to these operations which are expected to
>>>>>>> be in a O(log n) order. In addition to ensure that the VMA is not freed in
>>>>>>> our back a reference count is added and 2 services (get_vma() and
>>>>>>> put_vma()) are introduced to handle the reference count. Once a VMA is
>>>>>>> fetched from the RB tree using get_vma(), it must be later freed using
>>>>>>> put_vma(). I can't see anymore the overhead I got while will-it-scale
>>>>>>> benchmark anymore.
>>>>>>>
>>>>>>> The VMA's attributes checked during the speculative page fault processing
>>>>>>> have to be protected against parallel changes. This is done by using a per
>>>>>>> VMA sequence lock. This sequence lock allows the speculative page fault
>>>>>>> handler to fast check for parallel changes in progress and to abort the
>>>>>>> speculative page fault in that case.
>>>>>>>
>>>>>>> Once the VMA has been found, the speculative page fault handler would check
>>>>>>> for the VMA's attributes to verify that the page fault has to be handled
>>>>>>> correctly or not. Thus, the VMA is protected through a sequence lock which
>>>>>>> allows fast detection of concurrent VMA changes. If such a change is
>>>>>>> detected, the speculative page fault is aborted and a *classic* page fault
>>>>>>> is tried.  VMA sequence lockings are added when VMA attributes which are
>>>>>>> checked during the page fault are modified.
>>>>>>>
>>>>>>> When the PTE is fetched, the VMA is checked to see if it has been changed,
>>>>>>> so once the page table is locked, the VMA is valid, so any other changes
>>>>>>> leading to touching this PTE will need to lock the page table, so no
>>>>>>> parallel change is possible at this time.
>>>>>>>
>>>>>>> The locking of the PTE is done with interrupts disabled, this allows
>>>>>>> checking for the PMD to ensure that there is not an ongoing collapsing
>>>>>>> operation. Since khugepaged is firstly set the PMD to pmd_none and then is
>>>>>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd is
>>>>>>> valid at the time the PTE is locked, we have the guarantee that the
>>>>>>> collapsing operation will have to wait on the PTE lock to move forward.
>>>>>>> This allows the SPF handler to map the PTE safely. If the PMD value is
>>>>>>> different from the one recorded at the beginning of the SPF operation, the
>>>>>>> classic page fault handler will be called to handle the operation while
>>>>>>> holding the mmap_sem. As the PTE lock is done with the interrupts disabled,
>>>>>>> the lock is done using spin_trylock() to avoid dead lock when handling a
>>>>>>> page fault while a TLB invalidate is requested by another CPU holding the
>>>>>>> PTE.
>>>>>>>
>>>>>>> In pseudo code, this could be seen as:
>>>>>>>     speculative_page_fault()
>>>>>>>     {
>>>>>>>             vma = get_vma()
>>>>>>>             check vma sequence count
>>>>>>>             check vma's support
>>>>>>>             disable interrupt
>>>>>>>                   check pgd,p4d,...,pte
>>>>>>>                   save pmd and pte in vmf
>>>>>>>                   save vma sequence counter in vmf
>>>>>>>             enable interrupt
>>>>>>>             check vma sequence count
>>>>>>>             handle_pte_fault(vma)
>>>>>>>                     ..
>>>>>>>                     page = alloc_page()
>>>>>>>                     pte_map_lock()
>>>>>>>                             disable interrupt
>>>>>>>                                     abort if sequence counter has changed
>>>>>>>                                     abort if pmd or pte has changed
>>>>>>>                                     pte map and lock
>>>>>>>                             enable interrupt
>>>>>>>                     if abort
>>>>>>>                        free page
>>>>>>>                        abort
>>>>>>>                     ...
>>>>>>>     }
>>>>>>>
>>>>>>>     arch_fault_handler()
>>>>>>>     {
>>>>>>>             if (speculative_page_fault(&vma))
>>>>>>>                goto done
>>>>>>>     again:
>>>>>>>             lock(mmap_sem)
>>>>>>>             vma = find_vma();
>>>>>>>             handle_pte_fault(vma);
>>>>>>>             if retry
>>>>>>>                unlock(mmap_sem)
>>>>>>>                goto again;
>>>>>>>     done:
>>>>>>>             handle fault error
>>>>>>>     }
>>>>>>>
>>>>>>> Support for THP is not done because when checking for the PMD, we can be
>>>>>>> confused by an in progress collapsing operation done by khugepaged. The
>>>>>>> issue is that pmd_none() could be true either if the PMD is not already
>>>>>>> populated or if the underlying PTE are in the way to be collapsed. So we
>>>>>>> cannot safely allocate a PMD if pmd_none() is true.
>>>>>>>
>>>>>>> This series add a new software performance event named 'speculative-faults'
>>>>>>> or 'spf'. It counts the number of successful page fault event handled
>>>>>>> speculatively. When recording 'faults,spf' events, the faults one is
>>>>>>> counting the total number of page fault events while 'spf' is only counting
>>>>>>> the part of the faults processed speculatively.
>>>>>>>
>>>>>>> There are some trace events introduced by this series. They allow
>>>>>>> identifying why the page faults were not processed speculatively. This
>>>>>>> doesn't take in account the faults generated by a monothreaded process
>>>>>>> which directly processed while holding the mmap_sem. This trace events are
>>>>>>> grouped in a system named 'pagefault', they are:
>>>>>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back
>>>>>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.
>>>>>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported
>>>>>>>  - pagefault:spf_vma_access : the VMA's access right are not respected
>>>>>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in our
>>>>>>>    back.
>>>>>>>
>>>>>>> To record all the related events, the easier is to run perf with the
>>>>>>> following arguments :
>>>>>>> $ perf stat -e 'faults,spf,pagefault:*' <command>
>>>>>>>
>>>>>>> There is also a dedicated vmstat counter showing the number of successful
>>>>>>> page fault handled speculatively. I can be seen this way:
>>>>>>> $ grep speculative_pgfault /proc/vmstat
>>>>>>>
>>>>>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is functional
>>>>>>> on x86, PowerPC and arm64.
>>>>>>>
>>>>>>> ---------------------
>>>>>>> Real Workload results
>>>>>>>
>>>>>>> As mentioned in previous email, we did non official runs using a "popular
>>>>>>> in memory multithreaded database product" on 176 cores SMT8 Power system
>>>>>>> which showed a 30% improvements in the number of transaction processed per
>>>>>>> second. This run has been done on the v6 series, but changes introduced in
>>>>>>> this new version should not impact the performance boost seen.
>>>>>>>
>>>>>>> Here are the perf data captured during 2 of these runs on top of the v8
>>>>>>> series:
>>>>>>>                 vanilla         spf
>>>>>>> faults          89.418          101.364         +13%
>>>>>>> spf                n/a           97.989
>>>>>>>
>>>>>>> With the SPF kernel, most of the page fault were processed in a speculative
>>>>>>> way.
>>>>>>>
>>>>>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and gave
>>>>>>> it a try on an android device. He reported that the application launch time
>>>>>>> was improved in average by 6%, and for large applications (~100 threads) by
>>>>>>> 20%.
>>>>>>>
>>>>>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qcom
>>>>>>> MSM845 (8 cores) with 6GB (the less is better):
>>>>>>>
>>>>>>> Application                             4.9     4.9+spf delta
>>>>>>> com.tencent.mm                          416     389     -7%
>>>>>>> com.eg.android.AlipayGphone             1135    986     -13%
>>>>>>> com.tencent.mtt                         455     454     0%
>>>>>>> com.qqgame.hlddz                        1497    1409    -6%
>>>>>>> com.autonavi.minimap                    711     701     -1%
>>>>>>> com.tencent.tmgp.sgame                  788     748     -5%
>>>>>>> com.immomo.momo                         501     487     -3%
>>>>>>> com.tencent.peng                        2145    2112    -2%
>>>>>>> com.smile.gifmaker                      491     461     -6%
>>>>>>> com.baidu.BaiduMap                      479     366     -23%
>>>>>>> com.taobao.taobao                       1341    1198    -11%
>>>>>>> com.baidu.searchbox                     333     314     -6%
>>>>>>> com.tencent.mobileqq                    394     384     -3%
>>>>>>> com.sina.weibo                          907     906     0%
>>>>>>> com.youku.phone                         816     731     -11%
>>>>>>> com.happyelements.AndroidAnimal.qq      763     717     -6%
>>>>>>> com.UCMobile                            415     411     -1%
>>>>>>> com.tencent.tmgp.ak                     1464    1431    -2%
>>>>>>> com.tencent.qqmusic                     336     329     -2%
>>>>>>> com.sankuai.meituan                     1661    1302    -22%
>>>>>>> com.netease.cloudmusic                  1193    1200    1%
>>>>>>> air.tv.douyu.android                    4257    4152    -2%
>>>>>>>
>>>>>>> ------------------
>>>>>>> Benchmarks results
>>>>>>>
>>>>>>> Base kernel is v4.17.0-rc4-mm1
>>>>>>> SPF is BASE + this series
>>>>>>>
>>>>>>> Kernbench:
>>>>>>> ----------
>>>>>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15
>>>>>>> kernel (kernel is build 5 times):
>>>>>>>
>>>>>>> Average Half load -j 8
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%
>>>>>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%
>>>>>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%
>>>>>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%
>>>>>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%
>>>>>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%
>>>>>>>
>>>>>>> Average Optimal load -j 16
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%
>>>>>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%
>>>>>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%
>>>>>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%
>>>>>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%
>>>>>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%
>>>>>>>
>>>>>>>
>>>>>>> During a run on the SPF, perf events were captured:
>>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>>          526743764      faults
>>>>>>>                210      spf
>>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>               2278      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> Very few speculative page faults were recorded as most of the processes
>>>>>>> involved are monothreaded (sounds that on this architecture some threads
>>>>>>> were created during the kernel build processing).
>>>>>>>
>>>>>>> Here are the kerbench results on a 80 CPUs Power8 system:
>>>>>>>
>>>>>>> Average Half load -j 40
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%
>>>>>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%
>>>>>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%
>>>>>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%
>>>>>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%
>>>>>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%
>>>>>>>
>>>>>>> Average Optimal load -j 80
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%
>>>>>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%
>>>>>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%
>>>>>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%
>>>>>>> Context Switches 223861  (138865)       225032  (139632)        0.52%
>>>>>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%
>>>>>>>
>>>>>>> During a run on the SPF, perf events were captured:
>>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>>          116730856      faults
>>>>>>>                  0      spf
>>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>                476      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> Most of the processes involved are monothreaded so SPF is not activated but
>>>>>>> there is no impact on the performance.
>>>>>>>
>>>>>>> Ebizzy:
>>>>>>> -------
>>>>>>> The test is counting the number of records per second it can manage, the
>>>>>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get
>>>>>>> consistent result I repeated the test 100 times and measure the average
>>>>>>> result. The number is the record processes per second, the higher is the
>>>>>>> best.
>>>>>>>
>>>>>>>                 BASE            SPF             delta
>>>>>>> 16 CPUs x86 VM  742.57          1490.24         100.69%
>>>>>>> 80 CPUs P8 node 13105.4         24174.23        84.46%
>>>>>>>
>>>>>>> Here are the performance counter read during a run on a 16 CPUs x86 VM:
>>>>>>>  Performance counter stats for './ebizzy -mTt 16':
>>>>>>>            1706379      faults
>>>>>>>            1674599      spf
>>>>>>>              30588      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>                363      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> And the ones captured during a run on a 80 CPUs Power node:
>>>>>>>  Performance counter stats for './ebizzy -mTt 80':
>>>>>>>            1874773      faults
>>>>>>>            1461153      spf
>>>>>>>             413293      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>                200      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> In ebizzy's case most of the page fault were handled in a speculative way,
>>>>>>> leading the ebizzy performance boost.
>>>>>>>
>>>>>>> ------------------
>>>>>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):
>>>>>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahendran
>>>>>>>    and Minchan Kim, hopefully.
>>>>>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in
>>>>>>>    __do_page_fault().
>>>>>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails
>>>>>>>    instead
>>>>>>>    of aborting the speculative page fault handling. Dropping the now
>>>>>>> useless
>>>>>>>    trace event pagefault:spf_pte_lock.
>>>>>>>  - No more try to reuse the fetched VMA during the speculative page fault
>>>>>>>    handling when retrying is needed. This adds a lot of complexity and
>>>>>>>    additional tests done didn't show a significant performance improvement.
>>>>>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.
>>>>>>>
>>>>>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at-speculative-page-faults-tt965642.html#none
>>>>>>> [2] https://patchwork.kernel.org/patch/9999687/
>>>>>>>
>>>>>>>
>>>>>>> Laurent Dufour (20):
>>>>>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT
>>>>>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE
>>>>>>>   mm: make pte_unmap_same compatible with SPF
>>>>>>>   mm: introduce INIT_VMA()
>>>>>>>   mm: protect VMA modifications using VMA sequence count
>>>>>>>   mm: protect mremap() against SPF hanlder
>>>>>>>   mm: protect SPF handler against anon_vma changes
>>>>>>>   mm: cache some VMA fields in the vm_fault structure
>>>>>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()
>>>>>>>   mm: introduce __lru_cache_add_active_or_unevictable
>>>>>>>   mm: introduce __vm_normal_page()
>>>>>>>   mm: introduce __page_add_new_anon_rmap()
>>>>>>>   mm: protect mm_rb tree with a rwlock
>>>>>>>   mm: adding speculative page fault failure trace events
>>>>>>>   perf: add a speculative page fault sw event
>>>>>>>   perf tools: add support for the SPF perf event
>>>>>>>   mm: add speculative page fault vmstats
>>>>>>>   powerpc/mm: add speculative page fault
>>>>>>>
>>>>>>> Mahendran Ganesh (2):
>>>>>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>   arm64/mm: add speculative page fault
>>>>>>>
>>>>>>> Peter Zijlstra (4):
>>>>>>>   mm: prepare for FAULT_FLAG_SPECULATIVE
>>>>>>>   mm: VMA sequence count
>>>>>>>   mm: provide speculative fault infrastructure
>>>>>>>   x86/mm: add speculative pagefault handling
>>>>>>>
>>>>>>>  arch/arm64/Kconfig                    |   1 +
>>>>>>>  arch/arm64/mm/fault.c                 |  12 +
>>>>>>>  arch/powerpc/Kconfig                  |   1 +
>>>>>>>  arch/powerpc/mm/fault.c               |  16 +
>>>>>>>  arch/x86/Kconfig                      |   1 +
>>>>>>>  arch/x86/mm/fault.c                   |  27 +-
>>>>>>>  fs/exec.c                             |   2 +-
>>>>>>>  fs/proc/task_mmu.c                    |   5 +-
>>>>>>>  fs/userfaultfd.c                      |  17 +-
>>>>>>>  include/linux/hugetlb_inline.h        |   2 +-
>>>>>>>  include/linux/migrate.h               |   4 +-
>>>>>>>  include/linux/mm.h                    | 136 +++++++-
>>>>>>>  include/linux/mm_types.h              |   7 +
>>>>>>>  include/linux/pagemap.h               |   4 +-
>>>>>>>  include/linux/rmap.h                  |  12 +-
>>>>>>>  include/linux/swap.h                  |  10 +-
>>>>>>>  include/linux/vm_event_item.h         |   3 +
>>>>>>>  include/trace/events/pagefault.h      |  80 +++++
>>>>>>>  include/uapi/linux/perf_event.h       |   1 +
>>>>>>>  kernel/fork.c                         |   5 +-
>>>>>>>  mm/Kconfig                            |  22 ++
>>>>>>>  mm/huge_memory.c                      |   6 +-
>>>>>>>  mm/hugetlb.c                          |   2 +
>>>>>>>  mm/init-mm.c                          |   3 +
>>>>>>>  mm/internal.h                         |  20 ++
>>>>>>>  mm/khugepaged.c                       |   5 +
>>>>>>>  mm/madvise.c                          |   6 +-
>>>>>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++++++-----
>>>>>>>  mm/mempolicy.c                        |  51 ++-
>>>>>>>  mm/migrate.c                          |   6 +-
>>>>>>>  mm/mlock.c                            |  13 +-
>>>>>>>  mm/mmap.c                             | 229 ++++++++++---
>>>>>>>  mm/mprotect.c                         |   4 +-
>>>>>>>  mm/mremap.c                           |  13 +
>>>>>>>  mm/nommu.c                            |   2 +-
>>>>>>>  mm/rmap.c                             |   5 +-
>>>>>>>  mm/swap.c                             |   6 +-
>>>>>>>  mm/swap_state.c                       |   8 +-
>>>>>>>  mm/vmstat.c                           |   5 +-
>>>>>>>  tools/include/uapi/linux/perf_event.h |   1 +
>>>>>>>  tools/perf/util/evsel.c               |   1 +
>>>>>>>  tools/perf/util/parse-events.c        |   4 +
>>>>>>>  tools/perf/util/parse-events.l        |   1 +
>>>>>>>  tools/perf/util/python.c              |   1 +
>>>>>>>  44 files changed, 1161 insertions(+), 211 deletions(-)
>>>>>>>  create mode 100644 include/trace/events/pagefault.h
>>>>>>>
>>>>>>> --
>>>>>>> 2.7.4
>>>>>>>
>>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>>
>>
>


[-- Attachment #2: perf-profile_page_fault2_base_thp_always.gz --]
[-- Type: application/gzip, Size: 12167 bytes --]

[-- Attachment #3: perf-profile_page_fault2_base_thp_never.gz --]
[-- Type: application/gzip, Size: 11543 bytes --]

[-- Attachment #4: perf-profile_page_fault2_head_thp_always.gz --]
[-- Type: application/gzip, Size: 12019 bytes --]

[-- Attachment #5: perf-profile_page_fault3_base_thp_always.gz --]
[-- Type: application/gzip, Size: 12701 bytes --]

[-- Attachment #6: perf-profile_page_fault3_base_thp_always.gz --]
[-- Type: application/gzip, Size: 12701 bytes --]

[-- Attachment #7: perf-profile_page_fault3_base_thp_never.gz --]
[-- Type: application/gzip, Size: 12699 bytes --]

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2018-07-13  3:56                   ` Song, HaiyanX
@ 2018-07-17  9:36                       ` Laurent Dufour
  0 siblings, 0 replies; 58+ messages in thread
From: Laurent Dufour @ 2018-07-17  9:36 UTC (permalink / raw)
  To: Song, HaiyanX
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

On 13/07/2018 05:56, Song, HaiyanX wrote:
> Hi Laurent,

Hi Haiyan,

Thanks a lot for sharing this perf reports.

I looked at them closely, and I've to admit that I was not able to found a
major difference between the base and the head report, except that
handle_pte_fault() is no more in-lined in the head one.

As expected, __handle_speculative_fault() is never traced since these tests are
dealing with file mapping, not handled in the speculative way.

When running these test did you seen a major differences in the test's result
between base and head ?

>From the number of cycles counted, the biggest difference is page_fault3 when
run with the THP enabled:
				BASE		HEAD		Delta
page_fault2_base_thp_never	1142252426747	1065866197589	-6.69%
page_fault2_base_THP-Alwasys	1124844374523	1076312228927	-4.31%
page_fault3_base_thp_never	1099387298152	1134118402345	3.16%
page_fault3_base_THP-Always	1059370178101	853985561949	-19.39%


The very weird thing is the difference of the delta cycles reported between
thp never and thp always, because the speculative way is aborted when checking
for the vma->ops field, which is the same in both case, and the thp is never
checked. So there is no code covering differnce, on the speculative path,
between these 2 cases. This leads me to think that there are other interactions
interfering in the measure.

Looking at the perf-profile_page_fault3_*_THP-Always, the major differences at
the head of the perf report is the 92% testcase which is weirdly not reported
on the head side :
    92.02%    22.33%  page_fault3_processes  [.] testcase
92.02% testcase

Then the base reported 37.67% for __do_page_fault() where the head reported
48.41%, but the only difference in this function, between base and head, is the
call to handle_speculative_fault(). But this is a macro checking for the fault
flags, and mm->users and then calling __handle_speculative_fault() if needed.
So this can't explain this difference, except if __handle_speculative_fault()
is inlined in __do_page_fault().
Is this the case on your build ?

Haiyan, do you still have the output of the test to check those numbers too ?

Cheers,
Laurent

> I attached the perf-profile.gz file for case page_fault2 and page_fault3. These files were captured during test the related test case. 
> Please help to check on these data if it can help you to find the higher change. Thanks.
> 
> File name perf-profile_page_fault2_head_THP-Always.gz, means the perf-profile result get from page_fault2 
>     tested for head commit (a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12) with THP_always configuration.
> 
> Best regards,
> Haiyan Song
> 
> ________________________________________
> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
> Sent: Thursday, July 12, 2018 1:05 AM
> To: Song, HaiyanX
> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
> Subject: Re: [PATCH v11 00/26] Speculative page faults
> 
> Hi Haiyan,
> 
> Do you get a chance to capture some performance cycles on your system ?
> I still can't get these numbers on my hardware.
> 
> Thanks,
> Laurent.
> 
> On 04/07/2018 09:51, Laurent Dufour wrote:
>> On 04/07/2018 05:23, Song, HaiyanX wrote:
>>> Hi Laurent,
>>>
>>>
>>> For the test result on Intel 4s skylake platform (192 CPUs, 768G Memory), the below test cases all were run 3 times.
>>> I check the test results, only page_fault3_thread/enable THP have 6% stddev for head commit, other tests have lower stddev.
>>
>> Repeating the test only 3 times seems a bit too low to me.
>>
>> I'll focus on the higher change for the moment, but I don't have access to such
>> a hardware.
>>
>> Is possible to provide a diff between base and SPF of the performance cycles
>> measured when running page_fault3 and page_fault2 when the 20% change is detected.
>>
>> Please stay focus on the test case process to see exactly where the series is
>> impacting.
>>
>> Thanks,
>> Laurent.
>>
>>>
>>> And I did not find other high variation on test case result.
>>>
>>> a). Enable THP
>>> testcase                          base     stddev       change      head     stddev         metric
>>> page_fault3/enable THP           10519      +- 3%        -20.5%      8368      +-6%          will-it-scale.per_thread_ops
>>> page_fault2/enalbe THP            8281      +- 2%        -18.8%      6728                   will-it-scale.per_thread_ops
>>> brk1/eanble THP                 998475                   -2.2%    976893                   will-it-scale.per_process_ops
>>> context_switch1/enable THP      223910                   -1.3%    220930                   will-it-scale.per_process_ops
>>> context_switch1/enable THP      233722                   -1.0%    231288                   will-it-scale.per_thread_ops
>>>
>>> b). Disable THP
>>> page_fault3/disable THP          10856                  -23.1%      8344                   will-it-scale.per_thread_ops
>>> page_fault2/disable THP           8147                  -18.8%      6613                   will-it-scale.per_thread_ops
>>> brk1/disable THP                   957                    -7.9%      881                   will-it-scale.per_thread_ops
>>> context_switch1/disable THP     237006                    -2.2%    231907                  will-it-scale.per_thread_ops
>>> brk1/disable THP                997317                    -2.0%    977778                  will-it-scale.per_process_ops
>>> page_fault3/disable THP         467454                    -1.8%    459251                  will-it-scale.per_process_ops
>>> context_switch1/disable THP     224431                    -1.3%    221567                  will-it-scale.per_process_ops
>>>
>>>
>>> Best regards,
>>> Haiyan Song
>>> ________________________________________
>>> From: Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>> Sent: Monday, July 02, 2018 4:59 PM
>>> To: Song, HaiyanX
>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>
>>> On 11/06/2018 09:49, Song, HaiyanX wrote:
>>>> Hi Laurent,
>>>>
>>>> Regression test for v11 patch serials have been run, some regression is found by LKP-tools (linux kernel performance)
>>>> tested on Intel 4s skylake platform. This time only test the cases which have been run and found regressions on
>>>> V9 patch serials.
>>>>
>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>> branch: Laurent-Dufour/Speculative-page-faults/20180520-045126
>>>> commit id:
>>>>   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12
>>>>   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1
>>>> Benchmark: will-it-scale
>>>> Download link: https://github.com/antonblanchard/will-it-scale/tree/master
>>>>
>>>> Metrics:
>>>>   will-it-scale.per_process_ops=processes/nr_cpu
>>>>   will-it-scale.per_thread_ops=threads/nr_cpu
>>>>   test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>> THP: enable / disable
>>>> nr_task:100%
>>>>
>>>> 1. Regressions:
>>>>
>>>> a). Enable THP
>>>> testcase                          base           change      head           metric
>>>> page_fault3/enable THP           10519          -20.5%        836      will-it-scale.per_thread_ops
>>>> page_fault2/enalbe THP            8281          -18.8%       6728      will-it-scale.per_thread_ops
>>>> brk1/eanble THP                 998475           -2.2%     976893      will-it-scale.per_process_ops
>>>> context_switch1/enable THP      223910           -1.3%     220930      will-it-scale.per_process_ops
>>>> context_switch1/enable THP      233722           -1.0%     231288      will-it-scale.per_thread_ops
>>>>
>>>> b). Disable THP
>>>> page_fault3/disable THP          10856          -23.1%       8344      will-it-scale.per_thread_ops
>>>> page_fault2/disable THP           8147          -18.8%       6613      will-it-scale.per_thread_ops
>>>> brk1/disable THP                   957           -7.9%        881      will-it-scale.per_thread_ops
>>>> context_switch1/disable THP     237006           -2.2%     231907      will-it-scale.per_thread_ops
>>>> brk1/disable THP                997317           -2.0%     977778      will-it-scale.per_process_ops
>>>> page_fault3/disable THP         467454           -1.8%     459251      will-it-scale.per_process_ops
>>>> context_switch1/disable THP     224431           -1.3%     221567      will-it-scale.per_process_ops
>>>>
>>>> Notes: for the above  values of test result, the higher is better.
>>>
>>> I tried the same tests on my PowerPC victim VM (1024 CPUs, 11TB) and I can't
>>> get reproducible results. The results have huge variation, even on the vanilla
>>> kernel, and I can't state on any changes due to that.
>>>
>>> I tried on smaller node (80 CPUs, 32G), and the tests ran better, but I didn't
>>> measure any changes between the vanilla and the SPF patched ones:
>>>
>>> test THP enabled                4.17.0-rc4-mm1  spf             delta
>>> page_fault3_threads             2697.7          2683.5          -0.53%
>>> page_fault2_threads             170660.6        169574.1        -0.64%
>>> context_switch1_threads         6915269.2       6877507.3       -0.55%
>>> context_switch1_processes       6478076.2       6529493.5       0.79%
>>> brk1                            243391.2        238527.5        -2.00%
>>>
>>> Tests were run 10 times, no high variation detected.
>>>
>>> Did you see high variation on your side ? How many times the test were run to
>>> compute the average values ?
>>>
>>> Thanks,
>>> Laurent.
>>>
>>>
>>>>
>>>> 2. Improvement: not found improvement based on the selected test cases.
>>>>
>>>>
>>>> Best regards
>>>> Haiyan Song
>>>> ________________________________________
>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>> Sent: Monday, May 28, 2018 4:54 PM
>>>> To: Song, HaiyanX
>>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>>
>>>> On 28/05/2018 10:22, Haiyan Song wrote:
>>>>> Hi Laurent,
>>>>>
>>>>> Yes, these tests are done on V9 patch.
>>>>
>>>> Do you plan to give this V11 a run ?
>>>>
>>>>>
>>>>>
>>>>> Best regards,
>>>>> Haiyan Song
>>>>>
>>>>> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:
>>>>>> On 28/05/2018 07:23, Song, HaiyanX wrote:
>>>>>>>
>>>>>>> Some regression and improvements is found by LKP-tools(linux kernel performance) on V9 patch series
>>>>>>> tested on Intel 4s Skylake platform.
>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> Thanks for reporting this benchmark results, but you mentioned the "V9 patch
>>>>>> series" while responding to the v11 header series...
>>>>>> Were these tests done on v9 or v11 ?
>>>>>>
>>>>>> Cheers,
>>>>>> Laurent.
>>>>>>
>>>>>>>
>>>>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>>>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 patch series)
>>>>>>> Commit id:
>>>>>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f
>>>>>>>     head commit: 0355322b3577eeab7669066df42c550a56801110
>>>>>>> Benchmark suite: will-it-scale
>>>>>>> Download link:
>>>>>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests
>>>>>>> Metrics:
>>>>>>>     will-it-scale.per_process_ops=processes/nr_cpu
>>>>>>>     will-it-scale.per_thread_ops=threads/nr_cpu
>>>>>>> test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>>>>> THP: enable / disable
>>>>>>> nr_task: 100%
>>>>>>>
>>>>>>> 1. Regressions:
>>>>>>> a) THP enabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> page_fault3/ enable THP         10092           -17.5%          8323       will-it-scale.per_thread_ops
>>>>>>> page_fault2/ enable THP          8300           -17.2%          6869       will-it-scale.per_thread_ops
>>>>>>> brk1/ enable THP                  957.67         -7.6%           885       will-it-scale.per_thread_ops
>>>>>>> page_fault3/ enable THP        172821            -5.3%        163692       will-it-scale.per_process_ops
>>>>>>> signal1/ enable THP              9125            -3.2%          8834       will-it-scale.per_process_ops
>>>>>>>
>>>>>>> b) THP disabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> page_fault3/ disable THP        10107           -19.1%          8180       will-it-scale.per_thread_ops
>>>>>>> page_fault2/ disable THP         8432           -17.8%          6931       will-it-scale.per_thread_ops
>>>>>>> context_switch1/ disable THP   215389            -6.8%        200776       will-it-scale.per_thread_ops
>>>>>>> brk1/ disable THP                 939.67         -6.6%           877.33    will-it-scale.per_thread_ops
>>>>>>> page_fault3/ disable THP       173145            -4.7%        165064       will-it-scale.per_process_ops
>>>>>>> signal1/ disable THP             9162            -3.9%          8802       will-it-scale.per_process_ops
>>>>>>>
>>>>>>> 2. Improvements:
>>>>>>> a) THP enabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> malloc1/ enable THP               66.33        +469.8%           383.67    will-it-scale.per_thread_ops
>>>>>>> writeseek3/ enable THP          2531             +4.5%          2646       will-it-scale.per_thread_ops
>>>>>>> signal1/ enable THP              989.33          +2.8%          1016       will-it-scale.per_thread_ops
>>>>>>>
>>>>>>> b) THP disabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> malloc1/ disable THP              90.33        +417.3%           467.33    will-it-scale.per_thread_ops
>>>>>>> read2/ disable THP             58934            +39.2%         82060       will-it-scale.per_thread_ops
>>>>>>> page_fault1/ disable THP        8607            +36.4%         11736       will-it-scale.per_thread_ops
>>>>>>> read1/ disable THP            314063            +12.7%        353934       will-it-scale.per_thread_ops
>>>>>>> writeseek3/ disable THP         2452            +12.5%          2759       will-it-scale.per_thread_ops
>>>>>>> signal1/ disable THP             971.33          +5.5%          1024       will-it-scale.per_thread_ops
>>>>>>>
>>>>>>> Notes: for above values in column "change", the higher value means that the related testcase result
>>>>>>> on head commit is better than that on base commit for this benchmark.
>>>>>>>
>>>>>>>
>>>>>>> Best regards
>>>>>>> Haiyan Song
>>>>>>>
>>>>>>> ________________________________________
>>>>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>>>>> Sent: Thursday, May 17, 2018 7:06 PM
>>>>>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi
>>>>>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>>>>> Subject: [PATCH v11 00/26] Speculative page faults
>>>>>>>
>>>>>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>>>>>>> page fault without holding the mm semaphore [1].
>>>>>>>
>>>>>>> The idea is to try to handle user space page faults without holding the
>>>>>>> mmap_sem. This should allow better concurrency for massively threaded
>>>>>>> process since the page fault handler will not wait for other threads memory
>>>>>>> layout change to be done, assuming that this change is done in another part
>>>>>>> of the process's memory space. This type page fault is named speculative
>>>>>>> page fault. If the speculative page fault fails because of a concurrency is
>>>>>>> detected or because underlying PMD or PTE tables are not yet allocating, it
>>>>>>> is failing its processing and a classic page fault is then tried.
>>>>>>>
>>>>>>> The speculative page fault (SPF) has to look for the VMA matching the fault
>>>>>>> address without holding the mmap_sem, this is done by introducing a rwlock
>>>>>>> which protects the access to the mm_rb tree. Previously this was done using
>>>>>>> SRCU but it was introducing a lot of scheduling to process the VMA's
>>>>>>> freeing operation which was hitting the performance by 20% as reported by
>>>>>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is
>>>>>>> limiting the locking contention to these operations which are expected to
>>>>>>> be in a O(log n) order. In addition to ensure that the VMA is not freed in
>>>>>>> our back a reference count is added and 2 services (get_vma() and
>>>>>>> put_vma()) are introduced to handle the reference count. Once a VMA is
>>>>>>> fetched from the RB tree using get_vma(), it must be later freed using
>>>>>>> put_vma(). I can't see anymore the overhead I got while will-it-scale
>>>>>>> benchmark anymore.
>>>>>>>
>>>>>>> The VMA's attributes checked during the speculative page fault processing
>>>>>>> have to be protected against parallel changes. This is done by using a per
>>>>>>> VMA sequence lock. This sequence lock allows the speculative page fault
>>>>>>> handler to fast check for parallel changes in progress and to abort the
>>>>>>> speculative page fault in that case.
>>>>>>>
>>>>>>> Once the VMA has been found, the speculative page fault handler would check
>>>>>>> for the VMA's attributes to verify that the page fault has to be handled
>>>>>>> correctly or not. Thus, the VMA is protected through a sequence lock which
>>>>>>> allows fast detection of concurrent VMA changes. If such a change is
>>>>>>> detected, the speculative page fault is aborted and a *classic* page fault
>>>>>>> is tried.  VMA sequence lockings are added when VMA attributes which are
>>>>>>> checked during the page fault are modified.
>>>>>>>
>>>>>>> When the PTE is fetched, the VMA is checked to see if it has been changed,
>>>>>>> so once the page table is locked, the VMA is valid, so any other changes
>>>>>>> leading to touching this PTE will need to lock the page table, so no
>>>>>>> parallel change is possible at this time.
>>>>>>>
>>>>>>> The locking of the PTE is done with interrupts disabled, this allows
>>>>>>> checking for the PMD to ensure that there is not an ongoing collapsing
>>>>>>> operation. Since khugepaged is firstly set the PMD to pmd_none and then is
>>>>>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd is
>>>>>>> valid at the time the PTE is locked, we have the guarantee that the
>>>>>>> collapsing operation will have to wait on the PTE lock to move forward.
>>>>>>> This allows the SPF handler to map the PTE safely. If the PMD value is
>>>>>>> different from the one recorded at the beginning of the SPF operation, the
>>>>>>> classic page fault handler will be called to handle the operation while
>>>>>>> holding the mmap_sem. As the PTE lock is done with the interrupts disabled,
>>>>>>> the lock is done using spin_trylock() to avoid dead lock when handling a
>>>>>>> page fault while a TLB invalidate is requested by another CPU holding the
>>>>>>> PTE.
>>>>>>>
>>>>>>> In pseudo code, this could be seen as:
>>>>>>>     speculative_page_fault()
>>>>>>>     {
>>>>>>>             vma = get_vma()
>>>>>>>             check vma sequence count
>>>>>>>             check vma's support
>>>>>>>             disable interrupt
>>>>>>>                   check pgd,p4d,...,pte
>>>>>>>                   save pmd and pte in vmf
>>>>>>>                   save vma sequence counter in vmf
>>>>>>>             enable interrupt
>>>>>>>             check vma sequence count
>>>>>>>             handle_pte_fault(vma)
>>>>>>>                     ..
>>>>>>>                     page = alloc_page()
>>>>>>>                     pte_map_lock()
>>>>>>>                             disable interrupt
>>>>>>>                                     abort if sequence counter has changed
>>>>>>>                                     abort if pmd or pte has changed
>>>>>>>                                     pte map and lock
>>>>>>>                             enable interrupt
>>>>>>>                     if abort
>>>>>>>                        free page
>>>>>>>                        abort
>>>>>>>                     ...
>>>>>>>     }
>>>>>>>
>>>>>>>     arch_fault_handler()
>>>>>>>     {
>>>>>>>             if (speculative_page_fault(&vma))
>>>>>>>                goto done
>>>>>>>     again:
>>>>>>>             lock(mmap_sem)
>>>>>>>             vma = find_vma();
>>>>>>>             handle_pte_fault(vma);
>>>>>>>             if retry
>>>>>>>                unlock(mmap_sem)
>>>>>>>                goto again;
>>>>>>>     done:
>>>>>>>             handle fault error
>>>>>>>     }
>>>>>>>
>>>>>>> Support for THP is not done because when checking for the PMD, we can be
>>>>>>> confused by an in progress collapsing operation done by khugepaged. The
>>>>>>> issue is that pmd_none() could be true either if the PMD is not already
>>>>>>> populated or if the underlying PTE are in the way to be collapsed. So we
>>>>>>> cannot safely allocate a PMD if pmd_none() is true.
>>>>>>>
>>>>>>> This series add a new software performance event named 'speculative-faults'
>>>>>>> or 'spf'. It counts the number of successful page fault event handled
>>>>>>> speculatively. When recording 'faults,spf' events, the faults one is
>>>>>>> counting the total number of page fault events while 'spf' is only counting
>>>>>>> the part of the faults processed speculatively.
>>>>>>>
>>>>>>> There are some trace events introduced by this series. They allow
>>>>>>> identifying why the page faults were not processed speculatively. This
>>>>>>> doesn't take in account the faults generated by a monothreaded process
>>>>>>> which directly processed while holding the mmap_sem. This trace events are
>>>>>>> grouped in a system named 'pagefault', they are:
>>>>>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back
>>>>>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.
>>>>>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported
>>>>>>>  - pagefault:spf_vma_access : the VMA's access right are not respected
>>>>>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in our
>>>>>>>    back.
>>>>>>>
>>>>>>> To record all the related events, the easier is to run perf with the
>>>>>>> following arguments :
>>>>>>> $ perf stat -e 'faults,spf,pagefault:*' <command>
>>>>>>>
>>>>>>> There is also a dedicated vmstat counter showing the number of successful
>>>>>>> page fault handled speculatively. I can be seen this way:
>>>>>>> $ grep speculative_pgfault /proc/vmstat
>>>>>>>
>>>>>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is functional
>>>>>>> on x86, PowerPC and arm64.
>>>>>>>
>>>>>>> ---------------------
>>>>>>> Real Workload results
>>>>>>>
>>>>>>> As mentioned in previous email, we did non official runs using a "popular
>>>>>>> in memory multithreaded database product" on 176 cores SMT8 Power system
>>>>>>> which showed a 30% improvements in the number of transaction processed per
>>>>>>> second. This run has been done on the v6 series, but changes introduced in
>>>>>>> this new version should not impact the performance boost seen.
>>>>>>>
>>>>>>> Here are the perf data captured during 2 of these runs on top of the v8
>>>>>>> series:
>>>>>>>                 vanilla         spf
>>>>>>> faults          89.418          101.364         +13%
>>>>>>> spf                n/a           97.989
>>>>>>>
>>>>>>> With the SPF kernel, most of the page fault were processed in a speculative
>>>>>>> way.
>>>>>>>
>>>>>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and gave
>>>>>>> it a try on an android device. He reported that the application launch time
>>>>>>> was improved in average by 6%, and for large applications (~100 threads) by
>>>>>>> 20%.
>>>>>>>
>>>>>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qcom
>>>>>>> MSM845 (8 cores) with 6GB (the less is better):
>>>>>>>
>>>>>>> Application                             4.9     4.9+spf delta
>>>>>>> com.tencent.mm                          416     389     -7%
>>>>>>> com.eg.android.AlipayGphone             1135    986     -13%
>>>>>>> com.tencent.mtt                         455     454     0%
>>>>>>> com.qqgame.hlddz                        1497    1409    -6%
>>>>>>> com.autonavi.minimap                    711     701     -1%
>>>>>>> com.tencent.tmgp.sgame                  788     748     -5%
>>>>>>> com.immomo.momo                         501     487     -3%
>>>>>>> com.tencent.peng                        2145    2112    -2%
>>>>>>> com.smile.gifmaker                      491     461     -6%
>>>>>>> com.baidu.BaiduMap                      479     366     -23%
>>>>>>> com.taobao.taobao                       1341    1198    -11%
>>>>>>> com.baidu.searchbox                     333     314     -6%
>>>>>>> com.tencent.mobileqq                    394     384     -3%
>>>>>>> com.sina.weibo                          907     906     0%
>>>>>>> com.youku.phone                         816     731     -11%
>>>>>>> com.happyelements.AndroidAnimal.qq      763     717     -6%
>>>>>>> com.UCMobile                            415     411     -1%
>>>>>>> com.tencent.tmgp.ak                     1464    1431    -2%
>>>>>>> com.tencent.qqmusic                     336     329     -2%
>>>>>>> com.sankuai.meituan                     1661    1302    -22%
>>>>>>> com.netease.cloudmusic                  1193    1200    1%
>>>>>>> air.tv.douyu.android                    4257    4152    -2%
>>>>>>>
>>>>>>> ------------------
>>>>>>> Benchmarks results
>>>>>>>
>>>>>>> Base kernel is v4.17.0-rc4-mm1
>>>>>>> SPF is BASE + this series
>>>>>>>
>>>>>>> Kernbench:
>>>>>>> ----------
>>>>>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15
>>>>>>> kernel (kernel is build 5 times):
>>>>>>>
>>>>>>> Average Half load -j 8
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%
>>>>>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%
>>>>>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%
>>>>>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%
>>>>>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%
>>>>>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%
>>>>>>>
>>>>>>> Average Optimal load -j 16
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%
>>>>>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%
>>>>>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%
>>>>>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%
>>>>>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%
>>>>>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%
>>>>>>>
>>>>>>>
>>>>>>> During a run on the SPF, perf events were captured:
>>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>>          526743764      faults
>>>>>>>                210      spf
>>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>               2278      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> Very few speculative page faults were recorded as most of the processes
>>>>>>> involved are monothreaded (sounds that on this architecture some threads
>>>>>>> were created during the kernel build processing).
>>>>>>>
>>>>>>> Here are the kerbench results on a 80 CPUs Power8 system:
>>>>>>>
>>>>>>> Average Half load -j 40
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%
>>>>>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%
>>>>>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%
>>>>>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%
>>>>>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%
>>>>>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%
>>>>>>>
>>>>>>> Average Optimal load -j 80
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%
>>>>>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%
>>>>>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%
>>>>>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%
>>>>>>> Context Switches 223861  (138865)       225032  (139632)        0.52%
>>>>>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%
>>>>>>>
>>>>>>> During a run on the SPF, perf events were captured:
>>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>>          116730856      faults
>>>>>>>                  0      spf
>>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>                476      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> Most of the processes involved are monothreaded so SPF is not activated but
>>>>>>> there is no impact on the performance.
>>>>>>>
>>>>>>> Ebizzy:
>>>>>>> -------
>>>>>>> The test is counting the number of records per second it can manage, the
>>>>>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get
>>>>>>> consistent result I repeated the test 100 times and measure the average
>>>>>>> result. The number is the record processes per second, the higher is the
>>>>>>> best.
>>>>>>>
>>>>>>>                 BASE            SPF             delta
>>>>>>> 16 CPUs x86 VM  742.57          1490.24         100.69%
>>>>>>> 80 CPUs P8 node 13105.4         24174.23        84.46%
>>>>>>>
>>>>>>> Here are the performance counter read during a run on a 16 CPUs x86 VM:
>>>>>>>  Performance counter stats for './ebizzy -mTt 16':
>>>>>>>            1706379      faults
>>>>>>>            1674599      spf
>>>>>>>              30588      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>                363      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> And the ones captured during a run on a 80 CPUs Power node:
>>>>>>>  Performance counter stats for './ebizzy -mTt 80':
>>>>>>>            1874773      faults
>>>>>>>            1461153      spf
>>>>>>>             413293      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>                200      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> In ebizzy's case most of the page fault were handled in a speculative way,
>>>>>>> leading the ebizzy performance boost.
>>>>>>>
>>>>>>> ------------------
>>>>>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):
>>>>>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahendran
>>>>>>>    and Minchan Kim, hopefully.
>>>>>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in
>>>>>>>    __do_page_fault().
>>>>>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails
>>>>>>>    instead
>>>>>>>    of aborting the speculative page fault handling. Dropping the now
>>>>>>> useless
>>>>>>>    trace event pagefault:spf_pte_lock.
>>>>>>>  - No more try to reuse the fetched VMA during the speculative page fault
>>>>>>>    handling when retrying is needed. This adds a lot of complexity and
>>>>>>>    additional tests done didn't show a significant performance improvement.
>>>>>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.
>>>>>>>
>>>>>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at-speculative-page-faults-tt965642.html#none
>>>>>>> [2] https://patchwork.kernel.org/patch/9999687/
>>>>>>>
>>>>>>>
>>>>>>> Laurent Dufour (20):
>>>>>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT
>>>>>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE
>>>>>>>   mm: make pte_unmap_same compatible with SPF
>>>>>>>   mm: introduce INIT_VMA()
>>>>>>>   mm: protect VMA modifications using VMA sequence count
>>>>>>>   mm: protect mremap() against SPF hanlder
>>>>>>>   mm: protect SPF handler against anon_vma changes
>>>>>>>   mm: cache some VMA fields in the vm_fault structure
>>>>>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()
>>>>>>>   mm: introduce __lru_cache_add_active_or_unevictable
>>>>>>>   mm: introduce __vm_normal_page()
>>>>>>>   mm: introduce __page_add_new_anon_rmap()
>>>>>>>   mm: protect mm_rb tree with a rwlock
>>>>>>>   mm: adding speculative page fault failure trace events
>>>>>>>   perf: add a speculative page fault sw event
>>>>>>>   perf tools: add support for the SPF perf event
>>>>>>>   mm: add speculative page fault vmstats
>>>>>>>   powerpc/mm: add speculative page fault
>>>>>>>
>>>>>>> Mahendran Ganesh (2):
>>>>>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>   arm64/mm: add speculative page fault
>>>>>>>
>>>>>>> Peter Zijlstra (4):
>>>>>>>   mm: prepare for FAULT_FLAG_SPECULATIVE
>>>>>>>   mm: VMA sequence count
>>>>>>>   mm: provide speculative fault infrastructure
>>>>>>>   x86/mm: add speculative pagefault handling
>>>>>>>
>>>>>>>  arch/arm64/Kconfig                    |   1 +
>>>>>>>  arch/arm64/mm/fault.c                 |  12 +
>>>>>>>  arch/powerpc/Kconfig                  |   1 +
>>>>>>>  arch/powerpc/mm/fault.c               |  16 +
>>>>>>>  arch/x86/Kconfig                      |   1 +
>>>>>>>  arch/x86/mm/fault.c                   |  27 +-
>>>>>>>  fs/exec.c                             |   2 +-
>>>>>>>  fs/proc/task_mmu.c                    |   5 +-
>>>>>>>  fs/userfaultfd.c                      |  17 +-
>>>>>>>  include/linux/hugetlb_inline.h        |   2 +-
>>>>>>>  include/linux/migrate.h               |   4 +-
>>>>>>>  include/linux/mm.h                    | 136 +++++++-
>>>>>>>  include/linux/mm_types.h              |   7 +
>>>>>>>  include/linux/pagemap.h               |   4 +-
>>>>>>>  include/linux/rmap.h                  |  12 +-
>>>>>>>  include/linux/swap.h                  |  10 +-
>>>>>>>  include/linux/vm_event_item.h         |   3 +
>>>>>>>  include/trace/events/pagefault.h      |  80 +++++
>>>>>>>  include/uapi/linux/perf_event.h       |   1 +
>>>>>>>  kernel/fork.c                         |   5 +-
>>>>>>>  mm/Kconfig                            |  22 ++
>>>>>>>  mm/huge_memory.c                      |   6 +-
>>>>>>>  mm/hugetlb.c                          |   2 +
>>>>>>>  mm/init-mm.c                          |   3 +
>>>>>>>  mm/internal.h                         |  20 ++
>>>>>>>  mm/khugepaged.c                       |   5 +
>>>>>>>  mm/madvise.c                          |   6 +-
>>>>>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++++++-----
>>>>>>>  mm/mempolicy.c                        |  51 ++-
>>>>>>>  mm/migrate.c                          |   6 +-
>>>>>>>  mm/mlock.c                            |  13 +-
>>>>>>>  mm/mmap.c                             | 229 ++++++++++---
>>>>>>>  mm/mprotect.c                         |   4 +-
>>>>>>>  mm/mremap.c                           |  13 +
>>>>>>>  mm/nommu.c                            |   2 +-
>>>>>>>  mm/rmap.c                             |   5 +-
>>>>>>>  mm/swap.c                             |   6 +-
>>>>>>>  mm/swap_state.c                       |   8 +-
>>>>>>>  mm/vmstat.c                           |   5 +-
>>>>>>>  tools/include/uapi/linux/perf_event.h |   1 +
>>>>>>>  tools/perf/util/evsel.c               |   1 +
>>>>>>>  tools/perf/util/parse-events.c        |   4 +
>>>>>>>  tools/perf/util/parse-events.l        |   1 +
>>>>>>>  tools/perf/util/python.c              |   1 +
>>>>>>>  44 files changed, 1161 insertions(+), 211 deletions(-)
>>>>>>>  create mode 100644 include/trace/events/pagefault.h
>>>>>>>
>>>>>>> --
>>>>>>> 2.7.4
>>>>>>>
>>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>>
>>
> 

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2018-07-17  9:36                       ` Laurent Dufour
  0 siblings, 0 replies; 58+ messages in thread
From: Laurent Dufour @ 2018-07-17  9:36 UTC (permalink / raw)
  To: Song, HaiyanX
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

On 13/07/2018 05:56, Song, HaiyanX wrote:
> Hi Laurent,

Hi Haiyan,

Thanks a lot for sharing this perf reports.

I looked at them closely, and I've to admit that I was not able to found a
major difference between the base and the head report, except that
handle_pte_fault() is no more in-lined in the head one.

As expected, __handle_speculative_fault() is never traced since these tests are
dealing with file mapping, not handled in the speculative way.

When running these test did you seen a major differences in the test's result
between base and head ?

>From the number of cycles counted, the biggest difference is page_fault3 when
run with the THP enabled:
				BASE		HEAD		Delta
page_fault2_base_thp_never	1142252426747	1065866197589	-6.69%
page_fault2_base_THP-Alwasys	1124844374523	1076312228927	-4.31%
page_fault3_base_thp_never	1099387298152	1134118402345	3.16%
page_fault3_base_THP-Always	1059370178101	853985561949	-19.39%


The very weird thing is the difference of the delta cycles reported between
thp never and thp always, because the speculative way is aborted when checking
for the vma->ops field, which is the same in both case, and the thp is never
checked. So there is no code covering differnce, on the speculative path,
between these 2 cases. This leads me to think that there are other interactions
interfering in the measure.

Looking at the perf-profile_page_fault3_*_THP-Always, the major differences at
the head of the perf report is the 92% testcase which is weirdly not reported
on the head side :
    92.02%    22.33%  page_fault3_processes  [.] testcase
92.02% testcase

Then the base reported 37.67% for __do_page_fault() where the head reported
48.41%, but the only difference in this function, between base and head, is the
call to handle_speculative_fault(). But this is a macro checking for the fault
flags, and mm->users and then calling __handle_speculative_fault() if needed.
So this can't explain this difference, except if __handle_speculative_fault()
is inlined in __do_page_fault().
Is this the case on your build ?

Haiyan, do you still have the output of the test to check those numbers too ?

Cheers,
Laurent

> I attached the perf-profile.gz file for case page_fault2 and page_fault3. These files were captured during test the related test case. 
> Please help to check on these data if it can help you to find the higher change. Thanks.
> 
> File name perf-profile_page_fault2_head_THP-Always.gz, means the perf-profile result get from page_fault2 
>     tested for head commit (a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12) with THP_always configuration.
> 
> Best regards,
> Haiyan Song
> 
> ________________________________________
> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
> Sent: Thursday, July 12, 2018 1:05 AM
> To: Song, HaiyanX
> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
> Subject: Re: [PATCH v11 00/26] Speculative page faults
> 
> Hi Haiyan,
> 
> Do you get a chance to capture some performance cycles on your system ?
> I still can't get these numbers on my hardware.
> 
> Thanks,
> Laurent.
> 
> On 04/07/2018 09:51, Laurent Dufour wrote:
>> On 04/07/2018 05:23, Song, HaiyanX wrote:
>>> Hi Laurent,
>>>
>>>
>>> For the test result on Intel 4s skylake platform (192 CPUs, 768G Memory), the below test cases all were run 3 times.
>>> I check the test results, only page_fault3_thread/enable THP have 6% stddev for head commit, other tests have lower stddev.
>>
>> Repeating the test only 3 times seems a bit too low to me.
>>
>> I'll focus on the higher change for the moment, but I don't have access to such
>> a hardware.
>>
>> Is possible to provide a diff between base and SPF of the performance cycles
>> measured when running page_fault3 and page_fault2 when the 20% change is detected.
>>
>> Please stay focus on the test case process to see exactly where the series is
>> impacting.
>>
>> Thanks,
>> Laurent.
>>
>>>
>>> And I did not find other high variation on test case result.
>>>
>>> a). Enable THP
>>> testcase                          base     stddev       change      head     stddev         metric
>>> page_fault3/enable THP           10519      ± 3%        -20.5%      8368      ±6%          will-it-scale.per_thread_ops
>>> page_fault2/enalbe THP            8281      ± 2%        -18.8%      6728                   will-it-scale.per_thread_ops
>>> brk1/eanble THP                 998475                   -2.2%    976893                   will-it-scale.per_process_ops
>>> context_switch1/enable THP      223910                   -1.3%    220930                   will-it-scale.per_process_ops
>>> context_switch1/enable THP      233722                   -1.0%    231288                   will-it-scale.per_thread_ops
>>>
>>> b). Disable THP
>>> page_fault3/disable THP          10856                  -23.1%      8344                   will-it-scale.per_thread_ops
>>> page_fault2/disable THP           8147                  -18.8%      6613                   will-it-scale.per_thread_ops
>>> brk1/disable THP                   957                    -7.9%      881                   will-it-scale.per_thread_ops
>>> context_switch1/disable THP     237006                    -2.2%    231907                  will-it-scale.per_thread_ops
>>> brk1/disable THP                997317                    -2.0%    977778                  will-it-scale.per_process_ops
>>> page_fault3/disable THP         467454                    -1.8%    459251                  will-it-scale.per_process_ops
>>> context_switch1/disable THP     224431                    -1.3%    221567                  will-it-scale.per_process_ops
>>>
>>>
>>> Best regards,
>>> Haiyan Song
>>> ________________________________________
>>> From: Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>> Sent: Monday, July 02, 2018 4:59 PM
>>> To: Song, HaiyanX
>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>
>>> On 11/06/2018 09:49, Song, HaiyanX wrote:
>>>> Hi Laurent,
>>>>
>>>> Regression test for v11 patch serials have been run, some regression is found by LKP-tools (linux kernel performance)
>>>> tested on Intel 4s skylake platform. This time only test the cases which have been run and found regressions on
>>>> V9 patch serials.
>>>>
>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>> branch: Laurent-Dufour/Speculative-page-faults/20180520-045126
>>>> commit id:
>>>>   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12
>>>>   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1
>>>> Benchmark: will-it-scale
>>>> Download link: https://github.com/antonblanchard/will-it-scale/tree/master
>>>>
>>>> Metrics:
>>>>   will-it-scale.per_process_ops=processes/nr_cpu
>>>>   will-it-scale.per_thread_ops=threads/nr_cpu
>>>>   test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>> THP: enable / disable
>>>> nr_task:100%
>>>>
>>>> 1. Regressions:
>>>>
>>>> a). Enable THP
>>>> testcase                          base           change      head           metric
>>>> page_fault3/enable THP           10519          -20.5%        836      will-it-scale.per_thread_ops
>>>> page_fault2/enalbe THP            8281          -18.8%       6728      will-it-scale.per_thread_ops
>>>> brk1/eanble THP                 998475           -2.2%     976893      will-it-scale.per_process_ops
>>>> context_switch1/enable THP      223910           -1.3%     220930      will-it-scale.per_process_ops
>>>> context_switch1/enable THP      233722           -1.0%     231288      will-it-scale.per_thread_ops
>>>>
>>>> b). Disable THP
>>>> page_fault3/disable THP          10856          -23.1%       8344      will-it-scale.per_thread_ops
>>>> page_fault2/disable THP           8147          -18.8%       6613      will-it-scale.per_thread_ops
>>>> brk1/disable THP                   957           -7.9%        881      will-it-scale.per_thread_ops
>>>> context_switch1/disable THP     237006           -2.2%     231907      will-it-scale.per_thread_ops
>>>> brk1/disable THP                997317           -2.0%     977778      will-it-scale.per_process_ops
>>>> page_fault3/disable THP         467454           -1.8%     459251      will-it-scale.per_process_ops
>>>> context_switch1/disable THP     224431           -1.3%     221567      will-it-scale.per_process_ops
>>>>
>>>> Notes: for the above  values of test result, the higher is better.
>>>
>>> I tried the same tests on my PowerPC victim VM (1024 CPUs, 11TB) and I can't
>>> get reproducible results. The results have huge variation, even on the vanilla
>>> kernel, and I can't state on any changes due to that.
>>>
>>> I tried on smaller node (80 CPUs, 32G), and the tests ran better, but I didn't
>>> measure any changes between the vanilla and the SPF patched ones:
>>>
>>> test THP enabled                4.17.0-rc4-mm1  spf             delta
>>> page_fault3_threads             2697.7          2683.5          -0.53%
>>> page_fault2_threads             170660.6        169574.1        -0.64%
>>> context_switch1_threads         6915269.2       6877507.3       -0.55%
>>> context_switch1_processes       6478076.2       6529493.5       0.79%
>>> brk1                            243391.2        238527.5        -2.00%
>>>
>>> Tests were run 10 times, no high variation detected.
>>>
>>> Did you see high variation on your side ? How many times the test were run to
>>> compute the average values ?
>>>
>>> Thanks,
>>> Laurent.
>>>
>>>
>>>>
>>>> 2. Improvement: not found improvement based on the selected test cases.
>>>>
>>>>
>>>> Best regards
>>>> Haiyan Song
>>>> ________________________________________
>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>> Sent: Monday, May 28, 2018 4:54 PM
>>>> To: Song, HaiyanX
>>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>>
>>>> On 28/05/2018 10:22, Haiyan Song wrote:
>>>>> Hi Laurent,
>>>>>
>>>>> Yes, these tests are done on V9 patch.
>>>>
>>>> Do you plan to give this V11 a run ?
>>>>
>>>>>
>>>>>
>>>>> Best regards,
>>>>> Haiyan Song
>>>>>
>>>>> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:
>>>>>> On 28/05/2018 07:23, Song, HaiyanX wrote:
>>>>>>>
>>>>>>> Some regression and improvements is found by LKP-tools(linux kernel performance) on V9 patch series
>>>>>>> tested on Intel 4s Skylake platform.
>>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> Thanks for reporting this benchmark results, but you mentioned the "V9 patch
>>>>>> series" while responding to the v11 header series...
>>>>>> Were these tests done on v9 or v11 ?
>>>>>>
>>>>>> Cheers,
>>>>>> Laurent.
>>>>>>
>>>>>>>
>>>>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>>>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 patch series)
>>>>>>> Commit id:
>>>>>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f
>>>>>>>     head commit: 0355322b3577eeab7669066df42c550a56801110
>>>>>>> Benchmark suite: will-it-scale
>>>>>>> Download link:
>>>>>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests
>>>>>>> Metrics:
>>>>>>>     will-it-scale.per_process_ops=processes/nr_cpu
>>>>>>>     will-it-scale.per_thread_ops=threads/nr_cpu
>>>>>>> test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>>>>> THP: enable / disable
>>>>>>> nr_task: 100%
>>>>>>>
>>>>>>> 1. Regressions:
>>>>>>> a) THP enabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> page_fault3/ enable THP         10092           -17.5%          8323       will-it-scale.per_thread_ops
>>>>>>> page_fault2/ enable THP          8300           -17.2%          6869       will-it-scale.per_thread_ops
>>>>>>> brk1/ enable THP                  957.67         -7.6%           885       will-it-scale.per_thread_ops
>>>>>>> page_fault3/ enable THP        172821            -5.3%        163692       will-it-scale.per_process_ops
>>>>>>> signal1/ enable THP              9125            -3.2%          8834       will-it-scale.per_process_ops
>>>>>>>
>>>>>>> b) THP disabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> page_fault3/ disable THP        10107           -19.1%          8180       will-it-scale.per_thread_ops
>>>>>>> page_fault2/ disable THP         8432           -17.8%          6931       will-it-scale.per_thread_ops
>>>>>>> context_switch1/ disable THP   215389            -6.8%        200776       will-it-scale.per_thread_ops
>>>>>>> brk1/ disable THP                 939.67         -6.6%           877.33    will-it-scale.per_thread_ops
>>>>>>> page_fault3/ disable THP       173145            -4.7%        165064       will-it-scale.per_process_ops
>>>>>>> signal1/ disable THP             9162            -3.9%          8802       will-it-scale.per_process_ops
>>>>>>>
>>>>>>> 2. Improvements:
>>>>>>> a) THP enabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> malloc1/ enable THP               66.33        +469.8%           383.67    will-it-scale.per_thread_ops
>>>>>>> writeseek3/ enable THP          2531             +4.5%          2646       will-it-scale.per_thread_ops
>>>>>>> signal1/ enable THP              989.33          +2.8%          1016       will-it-scale.per_thread_ops
>>>>>>>
>>>>>>> b) THP disabled:
>>>>>>> testcase                        base            change          head       metric
>>>>>>> malloc1/ disable THP              90.33        +417.3%           467.33    will-it-scale.per_thread_ops
>>>>>>> read2/ disable THP             58934            +39.2%         82060       will-it-scale.per_thread_ops
>>>>>>> page_fault1/ disable THP        8607            +36.4%         11736       will-it-scale.per_thread_ops
>>>>>>> read1/ disable THP            314063            +12.7%        353934       will-it-scale.per_thread_ops
>>>>>>> writeseek3/ disable THP         2452            +12.5%          2759       will-it-scale.per_thread_ops
>>>>>>> signal1/ disable THP             971.33          +5.5%          1024       will-it-scale.per_thread_ops
>>>>>>>
>>>>>>> Notes: for above values in column "change", the higher value means that the related testcase result
>>>>>>> on head commit is better than that on base commit for this benchmark.
>>>>>>>
>>>>>>>
>>>>>>> Best regards
>>>>>>> Haiyan Song
>>>>>>>
>>>>>>> ________________________________________
>>>>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>>>>> Sent: Thursday, May 17, 2018 7:06 PM
>>>>>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi
>>>>>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>>>>> Subject: [PATCH v11 00/26] Speculative page faults
>>>>>>>
>>>>>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>>>>>>> page fault without holding the mm semaphore [1].
>>>>>>>
>>>>>>> The idea is to try to handle user space page faults without holding the
>>>>>>> mmap_sem. This should allow better concurrency for massively threaded
>>>>>>> process since the page fault handler will not wait for other threads memory
>>>>>>> layout change to be done, assuming that this change is done in another part
>>>>>>> of the process's memory space. This type page fault is named speculative
>>>>>>> page fault. If the speculative page fault fails because of a concurrency is
>>>>>>> detected or because underlying PMD or PTE tables are not yet allocating, it
>>>>>>> is failing its processing and a classic page fault is then tried.
>>>>>>>
>>>>>>> The speculative page fault (SPF) has to look for the VMA matching the fault
>>>>>>> address without holding the mmap_sem, this is done by introducing a rwlock
>>>>>>> which protects the access to the mm_rb tree. Previously this was done using
>>>>>>> SRCU but it was introducing a lot of scheduling to process the VMA's
>>>>>>> freeing operation which was hitting the performance by 20% as reported by
>>>>>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is
>>>>>>> limiting the locking contention to these operations which are expected to
>>>>>>> be in a O(log n) order. In addition to ensure that the VMA is not freed in
>>>>>>> our back a reference count is added and 2 services (get_vma() and
>>>>>>> put_vma()) are introduced to handle the reference count. Once a VMA is
>>>>>>> fetched from the RB tree using get_vma(), it must be later freed using
>>>>>>> put_vma(). I can't see anymore the overhead I got while will-it-scale
>>>>>>> benchmark anymore.
>>>>>>>
>>>>>>> The VMA's attributes checked during the speculative page fault processing
>>>>>>> have to be protected against parallel changes. This is done by using a per
>>>>>>> VMA sequence lock. This sequence lock allows the speculative page fault
>>>>>>> handler to fast check for parallel changes in progress and to abort the
>>>>>>> speculative page fault in that case.
>>>>>>>
>>>>>>> Once the VMA has been found, the speculative page fault handler would check
>>>>>>> for the VMA's attributes to verify that the page fault has to be handled
>>>>>>> correctly or not. Thus, the VMA is protected through a sequence lock which
>>>>>>> allows fast detection of concurrent VMA changes. If such a change is
>>>>>>> detected, the speculative page fault is aborted and a *classic* page fault
>>>>>>> is tried.  VMA sequence lockings are added when VMA attributes which are
>>>>>>> checked during the page fault are modified.
>>>>>>>
>>>>>>> When the PTE is fetched, the VMA is checked to see if it has been changed,
>>>>>>> so once the page table is locked, the VMA is valid, so any other changes
>>>>>>> leading to touching this PTE will need to lock the page table, so no
>>>>>>> parallel change is possible at this time.
>>>>>>>
>>>>>>> The locking of the PTE is done with interrupts disabled, this allows
>>>>>>> checking for the PMD to ensure that there is not an ongoing collapsing
>>>>>>> operation. Since khugepaged is firstly set the PMD to pmd_none and then is
>>>>>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd is
>>>>>>> valid at the time the PTE is locked, we have the guarantee that the
>>>>>>> collapsing operation will have to wait on the PTE lock to move forward.
>>>>>>> This allows the SPF handler to map the PTE safely. If the PMD value is
>>>>>>> different from the one recorded at the beginning of the SPF operation, the
>>>>>>> classic page fault handler will be called to handle the operation while
>>>>>>> holding the mmap_sem. As the PTE lock is done with the interrupts disabled,
>>>>>>> the lock is done using spin_trylock() to avoid dead lock when handling a
>>>>>>> page fault while a TLB invalidate is requested by another CPU holding the
>>>>>>> PTE.
>>>>>>>
>>>>>>> In pseudo code, this could be seen as:
>>>>>>>     speculative_page_fault()
>>>>>>>     {
>>>>>>>             vma = get_vma()
>>>>>>>             check vma sequence count
>>>>>>>             check vma's support
>>>>>>>             disable interrupt
>>>>>>>                   check pgd,p4d,...,pte
>>>>>>>                   save pmd and pte in vmf
>>>>>>>                   save vma sequence counter in vmf
>>>>>>>             enable interrupt
>>>>>>>             check vma sequence count
>>>>>>>             handle_pte_fault(vma)
>>>>>>>                     ..
>>>>>>>                     page = alloc_page()
>>>>>>>                     pte_map_lock()
>>>>>>>                             disable interrupt
>>>>>>>                                     abort if sequence counter has changed
>>>>>>>                                     abort if pmd or pte has changed
>>>>>>>                                     pte map and lock
>>>>>>>                             enable interrupt
>>>>>>>                     if abort
>>>>>>>                        free page
>>>>>>>                        abort
>>>>>>>                     ...
>>>>>>>     }
>>>>>>>
>>>>>>>     arch_fault_handler()
>>>>>>>     {
>>>>>>>             if (speculative_page_fault(&vma))
>>>>>>>                goto done
>>>>>>>     again:
>>>>>>>             lock(mmap_sem)
>>>>>>>             vma = find_vma();
>>>>>>>             handle_pte_fault(vma);
>>>>>>>             if retry
>>>>>>>                unlock(mmap_sem)
>>>>>>>                goto again;
>>>>>>>     done:
>>>>>>>             handle fault error
>>>>>>>     }
>>>>>>>
>>>>>>> Support for THP is not done because when checking for the PMD, we can be
>>>>>>> confused by an in progress collapsing operation done by khugepaged. The
>>>>>>> issue is that pmd_none() could be true either if the PMD is not already
>>>>>>> populated or if the underlying PTE are in the way to be collapsed. So we
>>>>>>> cannot safely allocate a PMD if pmd_none() is true.
>>>>>>>
>>>>>>> This series add a new software performance event named 'speculative-faults'
>>>>>>> or 'spf'. It counts the number of successful page fault event handled
>>>>>>> speculatively. When recording 'faults,spf' events, the faults one is
>>>>>>> counting the total number of page fault events while 'spf' is only counting
>>>>>>> the part of the faults processed speculatively.
>>>>>>>
>>>>>>> There are some trace events introduced by this series. They allow
>>>>>>> identifying why the page faults were not processed speculatively. This
>>>>>>> doesn't take in account the faults generated by a monothreaded process
>>>>>>> which directly processed while holding the mmap_sem. This trace events are
>>>>>>> grouped in a system named 'pagefault', they are:
>>>>>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back
>>>>>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.
>>>>>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported
>>>>>>>  - pagefault:spf_vma_access : the VMA's access right are not respected
>>>>>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in our
>>>>>>>    back.
>>>>>>>
>>>>>>> To record all the related events, the easier is to run perf with the
>>>>>>> following arguments :
>>>>>>> $ perf stat -e 'faults,spf,pagefault:*' <command>
>>>>>>>
>>>>>>> There is also a dedicated vmstat counter showing the number of successful
>>>>>>> page fault handled speculatively. I can be seen this way:
>>>>>>> $ grep speculative_pgfault /proc/vmstat
>>>>>>>
>>>>>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is functional
>>>>>>> on x86, PowerPC and arm64.
>>>>>>>
>>>>>>> ---------------------
>>>>>>> Real Workload results
>>>>>>>
>>>>>>> As mentioned in previous email, we did non official runs using a "popular
>>>>>>> in memory multithreaded database product" on 176 cores SMT8 Power system
>>>>>>> which showed a 30% improvements in the number of transaction processed per
>>>>>>> second. This run has been done on the v6 series, but changes introduced in
>>>>>>> this new version should not impact the performance boost seen.
>>>>>>>
>>>>>>> Here are the perf data captured during 2 of these runs on top of the v8
>>>>>>> series:
>>>>>>>                 vanilla         spf
>>>>>>> faults          89.418          101.364         +13%
>>>>>>> spf                n/a           97.989
>>>>>>>
>>>>>>> With the SPF kernel, most of the page fault were processed in a speculative
>>>>>>> way.
>>>>>>>
>>>>>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and gave
>>>>>>> it a try on an android device. He reported that the application launch time
>>>>>>> was improved in average by 6%, and for large applications (~100 threads) by
>>>>>>> 20%.
>>>>>>>
>>>>>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qcom
>>>>>>> MSM845 (8 cores) with 6GB (the less is better):
>>>>>>>
>>>>>>> Application                             4.9     4.9+spf delta
>>>>>>> com.tencent.mm                          416     389     -7%
>>>>>>> com.eg.android.AlipayGphone             1135    986     -13%
>>>>>>> com.tencent.mtt                         455     454     0%
>>>>>>> com.qqgame.hlddz                        1497    1409    -6%
>>>>>>> com.autonavi.minimap                    711     701     -1%
>>>>>>> com.tencent.tmgp.sgame                  788     748     -5%
>>>>>>> com.immomo.momo                         501     487     -3%
>>>>>>> com.tencent.peng                        2145    2112    -2%
>>>>>>> com.smile.gifmaker                      491     461     -6%
>>>>>>> com.baidu.BaiduMap                      479     366     -23%
>>>>>>> com.taobao.taobao                       1341    1198    -11%
>>>>>>> com.baidu.searchbox                     333     314     -6%
>>>>>>> com.tencent.mobileqq                    394     384     -3%
>>>>>>> com.sina.weibo                          907     906     0%
>>>>>>> com.youku.phone                         816     731     -11%
>>>>>>> com.happyelements.AndroidAnimal.qq      763     717     -6%
>>>>>>> com.UCMobile                            415     411     -1%
>>>>>>> com.tencent.tmgp.ak                     1464    1431    -2%
>>>>>>> com.tencent.qqmusic                     336     329     -2%
>>>>>>> com.sankuai.meituan                     1661    1302    -22%
>>>>>>> com.netease.cloudmusic                  1193    1200    1%
>>>>>>> air.tv.douyu.android                    4257    4152    -2%
>>>>>>>
>>>>>>> ------------------
>>>>>>> Benchmarks results
>>>>>>>
>>>>>>> Base kernel is v4.17.0-rc4-mm1
>>>>>>> SPF is BASE + this series
>>>>>>>
>>>>>>> Kernbench:
>>>>>>> ----------
>>>>>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15
>>>>>>> kernel (kernel is build 5 times):
>>>>>>>
>>>>>>> Average Half load -j 8
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%
>>>>>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%
>>>>>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%
>>>>>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%
>>>>>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%
>>>>>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%
>>>>>>>
>>>>>>> Average Optimal load -j 16
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%
>>>>>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%
>>>>>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%
>>>>>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%
>>>>>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%
>>>>>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%
>>>>>>>
>>>>>>>
>>>>>>> During a run on the SPF, perf events were captured:
>>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>>          526743764      faults
>>>>>>>                210      spf
>>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>               2278      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> Very few speculative page faults were recorded as most of the processes
>>>>>>> involved are monothreaded (sounds that on this architecture some threads
>>>>>>> were created during the kernel build processing).
>>>>>>>
>>>>>>> Here are the kerbench results on a 80 CPUs Power8 system:
>>>>>>>
>>>>>>> Average Half load -j 40
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%
>>>>>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%
>>>>>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%
>>>>>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%
>>>>>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%
>>>>>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%
>>>>>>>
>>>>>>> Average Optimal load -j 80
>>>>>>>                  Run    (std deviation)
>>>>>>>                  BASE                   SPF
>>>>>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%
>>>>>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%
>>>>>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%
>>>>>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%
>>>>>>> Context Switches 223861  (138865)       225032  (139632)        0.52%
>>>>>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%
>>>>>>>
>>>>>>> During a run on the SPF, perf events were captured:
>>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>>          116730856      faults
>>>>>>>                  0      spf
>>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>                476      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> Most of the processes involved are monothreaded so SPF is not activated but
>>>>>>> there is no impact on the performance.
>>>>>>>
>>>>>>> Ebizzy:
>>>>>>> -------
>>>>>>> The test is counting the number of records per second it can manage, the
>>>>>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get
>>>>>>> consistent result I repeated the test 100 times and measure the average
>>>>>>> result. The number is the record processes per second, the higher is the
>>>>>>> best.
>>>>>>>
>>>>>>>                 BASE            SPF             delta
>>>>>>> 16 CPUs x86 VM  742.57          1490.24         100.69%
>>>>>>> 80 CPUs P8 node 13105.4         24174.23        84.46%
>>>>>>>
>>>>>>> Here are the performance counter read during a run on a 16 CPUs x86 VM:
>>>>>>>  Performance counter stats for './ebizzy -mTt 16':
>>>>>>>            1706379      faults
>>>>>>>            1674599      spf
>>>>>>>              30588      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>                363      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> And the ones captured during a run on a 80 CPUs Power node:
>>>>>>>  Performance counter stats for './ebizzy -mTt 80':
>>>>>>>            1874773      faults
>>>>>>>            1461153      spf
>>>>>>>             413293      pagefault:spf_vma_changed
>>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>>                200      pagefault:spf_vma_notsup
>>>>>>>                  0      pagefault:spf_vma_access
>>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>>
>>>>>>> In ebizzy's case most of the page fault were handled in a speculative way,
>>>>>>> leading the ebizzy performance boost.
>>>>>>>
>>>>>>> ------------------
>>>>>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):
>>>>>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahendran
>>>>>>>    and Minchan Kim, hopefully.
>>>>>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in
>>>>>>>    __do_page_fault().
>>>>>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails
>>>>>>>    instead
>>>>>>>    of aborting the speculative page fault handling. Dropping the now
>>>>>>> useless
>>>>>>>    trace event pagefault:spf_pte_lock.
>>>>>>>  - No more try to reuse the fetched VMA during the speculative page fault
>>>>>>>    handling when retrying is needed. This adds a lot of complexity and
>>>>>>>    additional tests done didn't show a significant performance improvement.
>>>>>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.
>>>>>>>
>>>>>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at-speculative-page-faults-tt965642.html#none
>>>>>>> [2] https://patchwork.kernel.org/patch/9999687/
>>>>>>>
>>>>>>>
>>>>>>> Laurent Dufour (20):
>>>>>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT
>>>>>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE
>>>>>>>   mm: make pte_unmap_same compatible with SPF
>>>>>>>   mm: introduce INIT_VMA()
>>>>>>>   mm: protect VMA modifications using VMA sequence count
>>>>>>>   mm: protect mremap() against SPF hanlder
>>>>>>>   mm: protect SPF handler against anon_vma changes
>>>>>>>   mm: cache some VMA fields in the vm_fault structure
>>>>>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()
>>>>>>>   mm: introduce __lru_cache_add_active_or_unevictable
>>>>>>>   mm: introduce __vm_normal_page()
>>>>>>>   mm: introduce __page_add_new_anon_rmap()
>>>>>>>   mm: protect mm_rb tree with a rwlock
>>>>>>>   mm: adding speculative page fault failure trace events
>>>>>>>   perf: add a speculative page fault sw event
>>>>>>>   perf tools: add support for the SPF perf event
>>>>>>>   mm: add speculative page fault vmstats
>>>>>>>   powerpc/mm: add speculative page fault
>>>>>>>
>>>>>>> Mahendran Ganesh (2):
>>>>>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>>   arm64/mm: add speculative page fault
>>>>>>>
>>>>>>> Peter Zijlstra (4):
>>>>>>>   mm: prepare for FAULT_FLAG_SPECULATIVE
>>>>>>>   mm: VMA sequence count
>>>>>>>   mm: provide speculative fault infrastructure
>>>>>>>   x86/mm: add speculative pagefault handling
>>>>>>>
>>>>>>>  arch/arm64/Kconfig                    |   1 +
>>>>>>>  arch/arm64/mm/fault.c                 |  12 +
>>>>>>>  arch/powerpc/Kconfig                  |   1 +
>>>>>>>  arch/powerpc/mm/fault.c               |  16 +
>>>>>>>  arch/x86/Kconfig                      |   1 +
>>>>>>>  arch/x86/mm/fault.c                   |  27 +-
>>>>>>>  fs/exec.c                             |   2 +-
>>>>>>>  fs/proc/task_mmu.c                    |   5 +-
>>>>>>>  fs/userfaultfd.c                      |  17 +-
>>>>>>>  include/linux/hugetlb_inline.h        |   2 +-
>>>>>>>  include/linux/migrate.h               |   4 +-
>>>>>>>  include/linux/mm.h                    | 136 +++++++-
>>>>>>>  include/linux/mm_types.h              |   7 +
>>>>>>>  include/linux/pagemap.h               |   4 +-
>>>>>>>  include/linux/rmap.h                  |  12 +-
>>>>>>>  include/linux/swap.h                  |  10 +-
>>>>>>>  include/linux/vm_event_item.h         |   3 +
>>>>>>>  include/trace/events/pagefault.h      |  80 +++++
>>>>>>>  include/uapi/linux/perf_event.h       |   1 +
>>>>>>>  kernel/fork.c                         |   5 +-
>>>>>>>  mm/Kconfig                            |  22 ++
>>>>>>>  mm/huge_memory.c                      |   6 +-
>>>>>>>  mm/hugetlb.c                          |   2 +
>>>>>>>  mm/init-mm.c                          |   3 +
>>>>>>>  mm/internal.h                         |  20 ++
>>>>>>>  mm/khugepaged.c                       |   5 +
>>>>>>>  mm/madvise.c                          |   6 +-
>>>>>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++++++-----
>>>>>>>  mm/mempolicy.c                        |  51 ++-
>>>>>>>  mm/migrate.c                          |   6 +-
>>>>>>>  mm/mlock.c                            |  13 +-
>>>>>>>  mm/mmap.c                             | 229 ++++++++++---
>>>>>>>  mm/mprotect.c                         |   4 +-
>>>>>>>  mm/mremap.c                           |  13 +
>>>>>>>  mm/nommu.c                            |   2 +-
>>>>>>>  mm/rmap.c                             |   5 +-
>>>>>>>  mm/swap.c                             |   6 +-
>>>>>>>  mm/swap_state.c                       |   8 +-
>>>>>>>  mm/vmstat.c                           |   5 +-
>>>>>>>  tools/include/uapi/linux/perf_event.h |   1 +
>>>>>>>  tools/perf/util/evsel.c               |   1 +
>>>>>>>  tools/perf/util/parse-events.c        |   4 +
>>>>>>>  tools/perf/util/parse-events.l        |   1 +
>>>>>>>  tools/perf/util/python.c              |   1 +
>>>>>>>  44 files changed, 1161 insertions(+), 211 deletions(-)
>>>>>>>  create mode 100644 include/trace/events/pagefault.h
>>>>>>>
>>>>>>> --
>>>>>>> 2.7.4
>>>>>>>
>>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>>
>>
> 

^ permalink raw reply	[flat|nested] 58+ messages in thread

* RE: [PATCH v11 00/26] Speculative page faults
  2018-07-11 17:05                   ` Laurent Dufour
  (?)
@ 2018-07-13  3:56                   ` Song, HaiyanX
  2018-07-17  9:36                       ` Laurent Dufour
  -1 siblings, 1 reply; 58+ messages in thread
From: Song, HaiyanX @ 2018-07-13  3:56 UTC (permalink / raw)
  To: Laurent Dufour
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

[-- Attachment #1: Type: text/plain, Size: 37281 bytes --]

Hi Laurent,

I attached the perf-profile.gz file for case page_fault2 and page_fault3. These files were captured during test the related test case. 
Please help to check on these data if it can help you to find the higher change. Thanks.

File name perf-profile_page_fault2_head_THP-Always.gz, means the perf-profile result get from page_fault2 
    tested for head commit (a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12) with THP_always configuration.

Best regards,
Haiyan Song

________________________________________
From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
Sent: Thursday, July 12, 2018 1:05 AM
To: Song, HaiyanX
Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
Subject: Re: [PATCH v11 00/26] Speculative page faults

Hi Haiyan,

Do you get a chance to capture some performance cycles on your system ?
I still can't get these numbers on my hardware.

Thanks,
Laurent.

On 04/07/2018 09:51, Laurent Dufour wrote:
> On 04/07/2018 05:23, Song, HaiyanX wrote:
>> Hi Laurent,
>>
>>
>> For the test result on Intel 4s skylake platform (192 CPUs, 768G Memory), the below test cases all were run 3 times.
>> I check the test results, only page_fault3_thread/enable THP have 6% stddev for head commit, other tests have lower stddev.
>
> Repeating the test only 3 times seems a bit too low to me.
>
> I'll focus on the higher change for the moment, but I don't have access to such
> a hardware.
>
> Is possible to provide a diff between base and SPF of the performance cycles
> measured when running page_fault3 and page_fault2 when the 20% change is detected.
>
> Please stay focus on the test case process to see exactly where the series is
> impacting.
>
> Thanks,
> Laurent.
>
>>
>> And I did not find other high variation on test case result.
>>
>> a). Enable THP
>> testcase                          base     stddev       change      head     stddev         metric
>> page_fault3/enable THP           10519      ± 3%        -20.5%      8368      ±6%          will-it-scale.per_thread_ops
>> page_fault2/enalbe THP            8281      ± 2%        -18.8%      6728                   will-it-scale.per_thread_ops
>> brk1/eanble THP                 998475                   -2.2%    976893                   will-it-scale.per_process_ops
>> context_switch1/enable THP      223910                   -1.3%    220930                   will-it-scale.per_process_ops
>> context_switch1/enable THP      233722                   -1.0%    231288                   will-it-scale.per_thread_ops
>>
>> b). Disable THP
>> page_fault3/disable THP          10856                  -23.1%      8344                   will-it-scale.per_thread_ops
>> page_fault2/disable THP           8147                  -18.8%      6613                   will-it-scale.per_thread_ops
>> brk1/disable THP                   957                    -7.9%      881                   will-it-scale.per_thread_ops
>> context_switch1/disable THP     237006                    -2.2%    231907                  will-it-scale.per_thread_ops
>> brk1/disable THP                997317                    -2.0%    977778                  will-it-scale.per_process_ops
>> page_fault3/disable THP         467454                    -1.8%    459251                  will-it-scale.per_process_ops
>> context_switch1/disable THP     224431                    -1.3%    221567                  will-it-scale.per_process_ops
>>
>>
>> Best regards,
>> Haiyan Song
>> ________________________________________
>> From: Laurent Dufour [ldufour@linux.vnet.ibm.com]
>> Sent: Monday, July 02, 2018 4:59 PM
>> To: Song, HaiyanX
>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>
>> On 11/06/2018 09:49, Song, HaiyanX wrote:
>>> Hi Laurent,
>>>
>>> Regression test for v11 patch serials have been run, some regression is found by LKP-tools (linux kernel performance)
>>> tested on Intel 4s skylake platform. This time only test the cases which have been run and found regressions on
>>> V9 patch serials.
>>>
>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>> branch: Laurent-Dufour/Speculative-page-faults/20180520-045126
>>> commit id:
>>>   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12
>>>   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1
>>> Benchmark: will-it-scale
>>> Download link: https://github.com/antonblanchard/will-it-scale/tree/master
>>>
>>> Metrics:
>>>   will-it-scale.per_process_ops=processes/nr_cpu
>>>   will-it-scale.per_thread_ops=threads/nr_cpu
>>>   test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>> THP: enable / disable
>>> nr_task:100%
>>>
>>> 1. Regressions:
>>>
>>> a). Enable THP
>>> testcase                          base           change      head           metric
>>> page_fault3/enable THP           10519          -20.5%        836      will-it-scale.per_thread_ops
>>> page_fault2/enalbe THP            8281          -18.8%       6728      will-it-scale.per_thread_ops
>>> brk1/eanble THP                 998475           -2.2%     976893      will-it-scale.per_process_ops
>>> context_switch1/enable THP      223910           -1.3%     220930      will-it-scale.per_process_ops
>>> context_switch1/enable THP      233722           -1.0%     231288      will-it-scale.per_thread_ops
>>>
>>> b). Disable THP
>>> page_fault3/disable THP          10856          -23.1%       8344      will-it-scale.per_thread_ops
>>> page_fault2/disable THP           8147          -18.8%       6613      will-it-scale.per_thread_ops
>>> brk1/disable THP                   957           -7.9%        881      will-it-scale.per_thread_ops
>>> context_switch1/disable THP     237006           -2.2%     231907      will-it-scale.per_thread_ops
>>> brk1/disable THP                997317           -2.0%     977778      will-it-scale.per_process_ops
>>> page_fault3/disable THP         467454           -1.8%     459251      will-it-scale.per_process_ops
>>> context_switch1/disable THP     224431           -1.3%     221567      will-it-scale.per_process_ops
>>>
>>> Notes: for the above  values of test result, the higher is better.
>>
>> I tried the same tests on my PowerPC victim VM (1024 CPUs, 11TB) and I can't
>> get reproducible results. The results have huge variation, even on the vanilla
>> kernel, and I can't state on any changes due to that.
>>
>> I tried on smaller node (80 CPUs, 32G), and the tests ran better, but I didn't
>> measure any changes between the vanilla and the SPF patched ones:
>>
>> test THP enabled                4.17.0-rc4-mm1  spf             delta
>> page_fault3_threads             2697.7          2683.5          -0.53%
>> page_fault2_threads             170660.6        169574.1        -0.64%
>> context_switch1_threads         6915269.2       6877507.3       -0.55%
>> context_switch1_processes       6478076.2       6529493.5       0.79%
>> brk1                            243391.2        238527.5        -2.00%
>>
>> Tests were run 10 times, no high variation detected.
>>
>> Did you see high variation on your side ? How many times the test were run to
>> compute the average values ?
>>
>> Thanks,
>> Laurent.
>>
>>
>>>
>>> 2. Improvement: not found improvement based on the selected test cases.
>>>
>>>
>>> Best regards
>>> Haiyan Song
>>> ________________________________________
>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>> Sent: Monday, May 28, 2018 4:54 PM
>>> To: Song, HaiyanX
>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>
>>> On 28/05/2018 10:22, Haiyan Song wrote:
>>>> Hi Laurent,
>>>>
>>>> Yes, these tests are done on V9 patch.
>>>
>>> Do you plan to give this V11 a run ?
>>>
>>>>
>>>>
>>>> Best regards,
>>>> Haiyan Song
>>>>
>>>> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:
>>>>> On 28/05/2018 07:23, Song, HaiyanX wrote:
>>>>>>
>>>>>> Some regression and improvements is found by LKP-tools(linux kernel performance) on V9 patch series
>>>>>> tested on Intel 4s Skylake platform.
>>>>>
>>>>> Hi,
>>>>>
>>>>> Thanks for reporting this benchmark results, but you mentioned the "V9 patch
>>>>> series" while responding to the v11 header series...
>>>>> Were these tests done on v9 or v11 ?
>>>>>
>>>>> Cheers,
>>>>> Laurent.
>>>>>
>>>>>>
>>>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 patch series)
>>>>>> Commit id:
>>>>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f
>>>>>>     head commit: 0355322b3577eeab7669066df42c550a56801110
>>>>>> Benchmark suite: will-it-scale
>>>>>> Download link:
>>>>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests
>>>>>> Metrics:
>>>>>>     will-it-scale.per_process_ops=processes/nr_cpu
>>>>>>     will-it-scale.per_thread_ops=threads/nr_cpu
>>>>>> test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>>>> THP: enable / disable
>>>>>> nr_task: 100%
>>>>>>
>>>>>> 1. Regressions:
>>>>>> a) THP enabled:
>>>>>> testcase                        base            change          head       metric
>>>>>> page_fault3/ enable THP         10092           -17.5%          8323       will-it-scale.per_thread_ops
>>>>>> page_fault2/ enable THP          8300           -17.2%          6869       will-it-scale.per_thread_ops
>>>>>> brk1/ enable THP                  957.67         -7.6%           885       will-it-scale.per_thread_ops
>>>>>> page_fault3/ enable THP        172821            -5.3%        163692       will-it-scale.per_process_ops
>>>>>> signal1/ enable THP              9125            -3.2%          8834       will-it-scale.per_process_ops
>>>>>>
>>>>>> b) THP disabled:
>>>>>> testcase                        base            change          head       metric
>>>>>> page_fault3/ disable THP        10107           -19.1%          8180       will-it-scale.per_thread_ops
>>>>>> page_fault2/ disable THP         8432           -17.8%          6931       will-it-scale.per_thread_ops
>>>>>> context_switch1/ disable THP   215389            -6.8%        200776       will-it-scale.per_thread_ops
>>>>>> brk1/ disable THP                 939.67         -6.6%           877.33    will-it-scale.per_thread_ops
>>>>>> page_fault3/ disable THP       173145            -4.7%        165064       will-it-scale.per_process_ops
>>>>>> signal1/ disable THP             9162            -3.9%          8802       will-it-scale.per_process_ops
>>>>>>
>>>>>> 2. Improvements:
>>>>>> a) THP enabled:
>>>>>> testcase                        base            change          head       metric
>>>>>> malloc1/ enable THP               66.33        +469.8%           383.67    will-it-scale.per_thread_ops
>>>>>> writeseek3/ enable THP          2531             +4.5%          2646       will-it-scale.per_thread_ops
>>>>>> signal1/ enable THP              989.33          +2.8%          1016       will-it-scale.per_thread_ops
>>>>>>
>>>>>> b) THP disabled:
>>>>>> testcase                        base            change          head       metric
>>>>>> malloc1/ disable THP              90.33        +417.3%           467.33    will-it-scale.per_thread_ops
>>>>>> read2/ disable THP             58934            +39.2%         82060       will-it-scale.per_thread_ops
>>>>>> page_fault1/ disable THP        8607            +36.4%         11736       will-it-scale.per_thread_ops
>>>>>> read1/ disable THP            314063            +12.7%        353934       will-it-scale.per_thread_ops
>>>>>> writeseek3/ disable THP         2452            +12.5%          2759       will-it-scale.per_thread_ops
>>>>>> signal1/ disable THP             971.33          +5.5%          1024       will-it-scale.per_thread_ops
>>>>>>
>>>>>> Notes: for above values in column "change", the higher value means that the related testcase result
>>>>>> on head commit is better than that on base commit for this benchmark.
>>>>>>
>>>>>>
>>>>>> Best regards
>>>>>> Haiyan Song
>>>>>>
>>>>>> ________________________________________
>>>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>>>> Sent: Thursday, May 17, 2018 7:06 PM
>>>>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi
>>>>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>>>> Subject: [PATCH v11 00/26] Speculative page faults
>>>>>>
>>>>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>>>>>> page fault without holding the mm semaphore [1].
>>>>>>
>>>>>> The idea is to try to handle user space page faults without holding the
>>>>>> mmap_sem. This should allow better concurrency for massively threaded
>>>>>> process since the page fault handler will not wait for other threads memory
>>>>>> layout change to be done, assuming that this change is done in another part
>>>>>> of the process's memory space. This type page fault is named speculative
>>>>>> page fault. If the speculative page fault fails because of a concurrency is
>>>>>> detected or because underlying PMD or PTE tables are not yet allocating, it
>>>>>> is failing its processing and a classic page fault is then tried.
>>>>>>
>>>>>> The speculative page fault (SPF) has to look for the VMA matching the fault
>>>>>> address without holding the mmap_sem, this is done by introducing a rwlock
>>>>>> which protects the access to the mm_rb tree. Previously this was done using
>>>>>> SRCU but it was introducing a lot of scheduling to process the VMA's
>>>>>> freeing operation which was hitting the performance by 20% as reported by
>>>>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is
>>>>>> limiting the locking contention to these operations which are expected to
>>>>>> be in a O(log n) order. In addition to ensure that the VMA is not freed in
>>>>>> our back a reference count is added and 2 services (get_vma() and
>>>>>> put_vma()) are introduced to handle the reference count. Once a VMA is
>>>>>> fetched from the RB tree using get_vma(), it must be later freed using
>>>>>> put_vma(). I can't see anymore the overhead I got while will-it-scale
>>>>>> benchmark anymore.
>>>>>>
>>>>>> The VMA's attributes checked during the speculative page fault processing
>>>>>> have to be protected against parallel changes. This is done by using a per
>>>>>> VMA sequence lock. This sequence lock allows the speculative page fault
>>>>>> handler to fast check for parallel changes in progress and to abort the
>>>>>> speculative page fault in that case.
>>>>>>
>>>>>> Once the VMA has been found, the speculative page fault handler would check
>>>>>> for the VMA's attributes to verify that the page fault has to be handled
>>>>>> correctly or not. Thus, the VMA is protected through a sequence lock which
>>>>>> allows fast detection of concurrent VMA changes. If such a change is
>>>>>> detected, the speculative page fault is aborted and a *classic* page fault
>>>>>> is tried.  VMA sequence lockings are added when VMA attributes which are
>>>>>> checked during the page fault are modified.
>>>>>>
>>>>>> When the PTE is fetched, the VMA is checked to see if it has been changed,
>>>>>> so once the page table is locked, the VMA is valid, so any other changes
>>>>>> leading to touching this PTE will need to lock the page table, so no
>>>>>> parallel change is possible at this time.
>>>>>>
>>>>>> The locking of the PTE is done with interrupts disabled, this allows
>>>>>> checking for the PMD to ensure that there is not an ongoing collapsing
>>>>>> operation. Since khugepaged is firstly set the PMD to pmd_none and then is
>>>>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd is
>>>>>> valid at the time the PTE is locked, we have the guarantee that the
>>>>>> collapsing operation will have to wait on the PTE lock to move forward.
>>>>>> This allows the SPF handler to map the PTE safely. If the PMD value is
>>>>>> different from the one recorded at the beginning of the SPF operation, the
>>>>>> classic page fault handler will be called to handle the operation while
>>>>>> holding the mmap_sem. As the PTE lock is done with the interrupts disabled,
>>>>>> the lock is done using spin_trylock() to avoid dead lock when handling a
>>>>>> page fault while a TLB invalidate is requested by another CPU holding the
>>>>>> PTE.
>>>>>>
>>>>>> In pseudo code, this could be seen as:
>>>>>>     speculative_page_fault()
>>>>>>     {
>>>>>>             vma = get_vma()
>>>>>>             check vma sequence count
>>>>>>             check vma's support
>>>>>>             disable interrupt
>>>>>>                   check pgd,p4d,...,pte
>>>>>>                   save pmd and pte in vmf
>>>>>>                   save vma sequence counter in vmf
>>>>>>             enable interrupt
>>>>>>             check vma sequence count
>>>>>>             handle_pte_fault(vma)
>>>>>>                     ..
>>>>>>                     page = alloc_page()
>>>>>>                     pte_map_lock()
>>>>>>                             disable interrupt
>>>>>>                                     abort if sequence counter has changed
>>>>>>                                     abort if pmd or pte has changed
>>>>>>                                     pte map and lock
>>>>>>                             enable interrupt
>>>>>>                     if abort
>>>>>>                        free page
>>>>>>                        abort
>>>>>>                     ...
>>>>>>     }
>>>>>>
>>>>>>     arch_fault_handler()
>>>>>>     {
>>>>>>             if (speculative_page_fault(&vma))
>>>>>>                goto done
>>>>>>     again:
>>>>>>             lock(mmap_sem)
>>>>>>             vma = find_vma();
>>>>>>             handle_pte_fault(vma);
>>>>>>             if retry
>>>>>>                unlock(mmap_sem)
>>>>>>                goto again;
>>>>>>     done:
>>>>>>             handle fault error
>>>>>>     }
>>>>>>
>>>>>> Support for THP is not done because when checking for the PMD, we can be
>>>>>> confused by an in progress collapsing operation done by khugepaged. The
>>>>>> issue is that pmd_none() could be true either if the PMD is not already
>>>>>> populated or if the underlying PTE are in the way to be collapsed. So we
>>>>>> cannot safely allocate a PMD if pmd_none() is true.
>>>>>>
>>>>>> This series add a new software performance event named 'speculative-faults'
>>>>>> or 'spf'. It counts the number of successful page fault event handled
>>>>>> speculatively. When recording 'faults,spf' events, the faults one is
>>>>>> counting the total number of page fault events while 'spf' is only counting
>>>>>> the part of the faults processed speculatively.
>>>>>>
>>>>>> There are some trace events introduced by this series. They allow
>>>>>> identifying why the page faults were not processed speculatively. This
>>>>>> doesn't take in account the faults generated by a monothreaded process
>>>>>> which directly processed while holding the mmap_sem. This trace events are
>>>>>> grouped in a system named 'pagefault', they are:
>>>>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back
>>>>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.
>>>>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported
>>>>>>  - pagefault:spf_vma_access : the VMA's access right are not respected
>>>>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in our
>>>>>>    back.
>>>>>>
>>>>>> To record all the related events, the easier is to run perf with the
>>>>>> following arguments :
>>>>>> $ perf stat -e 'faults,spf,pagefault:*' <command>
>>>>>>
>>>>>> There is also a dedicated vmstat counter showing the number of successful
>>>>>> page fault handled speculatively. I can be seen this way:
>>>>>> $ grep speculative_pgfault /proc/vmstat
>>>>>>
>>>>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is functional
>>>>>> on x86, PowerPC and arm64.
>>>>>>
>>>>>> ---------------------
>>>>>> Real Workload results
>>>>>>
>>>>>> As mentioned in previous email, we did non official runs using a "popular
>>>>>> in memory multithreaded database product" on 176 cores SMT8 Power system
>>>>>> which showed a 30% improvements in the number of transaction processed per
>>>>>> second. This run has been done on the v6 series, but changes introduced in
>>>>>> this new version should not impact the performance boost seen.
>>>>>>
>>>>>> Here are the perf data captured during 2 of these runs on top of the v8
>>>>>> series:
>>>>>>                 vanilla         spf
>>>>>> faults          89.418          101.364         +13%
>>>>>> spf                n/a           97.989
>>>>>>
>>>>>> With the SPF kernel, most of the page fault were processed in a speculative
>>>>>> way.
>>>>>>
>>>>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and gave
>>>>>> it a try on an android device. He reported that the application launch time
>>>>>> was improved in average by 6%, and for large applications (~100 threads) by
>>>>>> 20%.
>>>>>>
>>>>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qcom
>>>>>> MSM845 (8 cores) with 6GB (the less is better):
>>>>>>
>>>>>> Application                             4.9     4.9+spf delta
>>>>>> com.tencent.mm                          416     389     -7%
>>>>>> com.eg.android.AlipayGphone             1135    986     -13%
>>>>>> com.tencent.mtt                         455     454     0%
>>>>>> com.qqgame.hlddz                        1497    1409    -6%
>>>>>> com.autonavi.minimap                    711     701     -1%
>>>>>> com.tencent.tmgp.sgame                  788     748     -5%
>>>>>> com.immomo.momo                         501     487     -3%
>>>>>> com.tencent.peng                        2145    2112    -2%
>>>>>> com.smile.gifmaker                      491     461     -6%
>>>>>> com.baidu.BaiduMap                      479     366     -23%
>>>>>> com.taobao.taobao                       1341    1198    -11%
>>>>>> com.baidu.searchbox                     333     314     -6%
>>>>>> com.tencent.mobileqq                    394     384     -3%
>>>>>> com.sina.weibo                          907     906     0%
>>>>>> com.youku.phone                         816     731     -11%
>>>>>> com.happyelements.AndroidAnimal.qq      763     717     -6%
>>>>>> com.UCMobile                            415     411     -1%
>>>>>> com.tencent.tmgp.ak                     1464    1431    -2%
>>>>>> com.tencent.qqmusic                     336     329     -2%
>>>>>> com.sankuai.meituan                     1661    1302    -22%
>>>>>> com.netease.cloudmusic                  1193    1200    1%
>>>>>> air.tv.douyu.android                    4257    4152    -2%
>>>>>>
>>>>>> ------------------
>>>>>> Benchmarks results
>>>>>>
>>>>>> Base kernel is v4.17.0-rc4-mm1
>>>>>> SPF is BASE + this series
>>>>>>
>>>>>> Kernbench:
>>>>>> ----------
>>>>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15
>>>>>> kernel (kernel is build 5 times):
>>>>>>
>>>>>> Average Half load -j 8
>>>>>>                  Run    (std deviation)
>>>>>>                  BASE                   SPF
>>>>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%
>>>>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%
>>>>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%
>>>>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%
>>>>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%
>>>>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%
>>>>>>
>>>>>> Average Optimal load -j 16
>>>>>>                  Run    (std deviation)
>>>>>>                  BASE                   SPF
>>>>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%
>>>>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%
>>>>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%
>>>>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%
>>>>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%
>>>>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%
>>>>>>
>>>>>>
>>>>>> During a run on the SPF, perf events were captured:
>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>          526743764      faults
>>>>>>                210      spf
>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>               2278      pagefault:spf_vma_notsup
>>>>>>                  0      pagefault:spf_vma_access
>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>
>>>>>> Very few speculative page faults were recorded as most of the processes
>>>>>> involved are monothreaded (sounds that on this architecture some threads
>>>>>> were created during the kernel build processing).
>>>>>>
>>>>>> Here are the kerbench results on a 80 CPUs Power8 system:
>>>>>>
>>>>>> Average Half load -j 40
>>>>>>                  Run    (std deviation)
>>>>>>                  BASE                   SPF
>>>>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%
>>>>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%
>>>>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%
>>>>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%
>>>>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%
>>>>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%
>>>>>>
>>>>>> Average Optimal load -j 80
>>>>>>                  Run    (std deviation)
>>>>>>                  BASE                   SPF
>>>>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%
>>>>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%
>>>>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%
>>>>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%
>>>>>> Context Switches 223861  (138865)       225032  (139632)        0.52%
>>>>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%
>>>>>>
>>>>>> During a run on the SPF, perf events were captured:
>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>          116730856      faults
>>>>>>                  0      spf
>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>                476      pagefault:spf_vma_notsup
>>>>>>                  0      pagefault:spf_vma_access
>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>
>>>>>> Most of the processes involved are monothreaded so SPF is not activated but
>>>>>> there is no impact on the performance.
>>>>>>
>>>>>> Ebizzy:
>>>>>> -------
>>>>>> The test is counting the number of records per second it can manage, the
>>>>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get
>>>>>> consistent result I repeated the test 100 times and measure the average
>>>>>> result. The number is the record processes per second, the higher is the
>>>>>> best.
>>>>>>
>>>>>>                 BASE            SPF             delta
>>>>>> 16 CPUs x86 VM  742.57          1490.24         100.69%
>>>>>> 80 CPUs P8 node 13105.4         24174.23        84.46%
>>>>>>
>>>>>> Here are the performance counter read during a run on a 16 CPUs x86 VM:
>>>>>>  Performance counter stats for './ebizzy -mTt 16':
>>>>>>            1706379      faults
>>>>>>            1674599      spf
>>>>>>              30588      pagefault:spf_vma_changed
>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>                363      pagefault:spf_vma_notsup
>>>>>>                  0      pagefault:spf_vma_access
>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>
>>>>>> And the ones captured during a run on a 80 CPUs Power node:
>>>>>>  Performance counter stats for './ebizzy -mTt 80':
>>>>>>            1874773      faults
>>>>>>            1461153      spf
>>>>>>             413293      pagefault:spf_vma_changed
>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>                200      pagefault:spf_vma_notsup
>>>>>>                  0      pagefault:spf_vma_access
>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>
>>>>>> In ebizzy's case most of the page fault were handled in a speculative way,
>>>>>> leading the ebizzy performance boost.
>>>>>>
>>>>>> ------------------
>>>>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):
>>>>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahendran
>>>>>>    and Minchan Kim, hopefully.
>>>>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in
>>>>>>    __do_page_fault().
>>>>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails
>>>>>>    instead
>>>>>>    of aborting the speculative page fault handling. Dropping the now
>>>>>> useless
>>>>>>    trace event pagefault:spf_pte_lock.
>>>>>>  - No more try to reuse the fetched VMA during the speculative page fault
>>>>>>    handling when retrying is needed. This adds a lot of complexity and
>>>>>>    additional tests done didn't show a significant performance improvement.
>>>>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.
>>>>>>
>>>>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at-speculative-page-faults-tt965642.html#none
>>>>>> [2] https://patchwork.kernel.org/patch/9999687/
>>>>>>
>>>>>>
>>>>>> Laurent Dufour (20):
>>>>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT
>>>>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE
>>>>>>   mm: make pte_unmap_same compatible with SPF
>>>>>>   mm: introduce INIT_VMA()
>>>>>>   mm: protect VMA modifications using VMA sequence count
>>>>>>   mm: protect mremap() against SPF hanlder
>>>>>>   mm: protect SPF handler against anon_vma changes
>>>>>>   mm: cache some VMA fields in the vm_fault structure
>>>>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()
>>>>>>   mm: introduce __lru_cache_add_active_or_unevictable
>>>>>>   mm: introduce __vm_normal_page()
>>>>>>   mm: introduce __page_add_new_anon_rmap()
>>>>>>   mm: protect mm_rb tree with a rwlock
>>>>>>   mm: adding speculative page fault failure trace events
>>>>>>   perf: add a speculative page fault sw event
>>>>>>   perf tools: add support for the SPF perf event
>>>>>>   mm: add speculative page fault vmstats
>>>>>>   powerpc/mm: add speculative page fault
>>>>>>
>>>>>> Mahendran Ganesh (2):
>>>>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>   arm64/mm: add speculative page fault
>>>>>>
>>>>>> Peter Zijlstra (4):
>>>>>>   mm: prepare for FAULT_FLAG_SPECULATIVE
>>>>>>   mm: VMA sequence count
>>>>>>   mm: provide speculative fault infrastructure
>>>>>>   x86/mm: add speculative pagefault handling
>>>>>>
>>>>>>  arch/arm64/Kconfig                    |   1 +
>>>>>>  arch/arm64/mm/fault.c                 |  12 +
>>>>>>  arch/powerpc/Kconfig                  |   1 +
>>>>>>  arch/powerpc/mm/fault.c               |  16 +
>>>>>>  arch/x86/Kconfig                      |   1 +
>>>>>>  arch/x86/mm/fault.c                   |  27 +-
>>>>>>  fs/exec.c                             |   2 +-
>>>>>>  fs/proc/task_mmu.c                    |   5 +-
>>>>>>  fs/userfaultfd.c                      |  17 +-
>>>>>>  include/linux/hugetlb_inline.h        |   2 +-
>>>>>>  include/linux/migrate.h               |   4 +-
>>>>>>  include/linux/mm.h                    | 136 +++++++-
>>>>>>  include/linux/mm_types.h              |   7 +
>>>>>>  include/linux/pagemap.h               |   4 +-
>>>>>>  include/linux/rmap.h                  |  12 +-
>>>>>>  include/linux/swap.h                  |  10 +-
>>>>>>  include/linux/vm_event_item.h         |   3 +
>>>>>>  include/trace/events/pagefault.h      |  80 +++++
>>>>>>  include/uapi/linux/perf_event.h       |   1 +
>>>>>>  kernel/fork.c                         |   5 +-
>>>>>>  mm/Kconfig                            |  22 ++
>>>>>>  mm/huge_memory.c                      |   6 +-
>>>>>>  mm/hugetlb.c                          |   2 +
>>>>>>  mm/init-mm.c                          |   3 +
>>>>>>  mm/internal.h                         |  20 ++
>>>>>>  mm/khugepaged.c                       |   5 +
>>>>>>  mm/madvise.c                          |   6 +-
>>>>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++++++-----
>>>>>>  mm/mempolicy.c                        |  51 ++-
>>>>>>  mm/migrate.c                          |   6 +-
>>>>>>  mm/mlock.c                            |  13 +-
>>>>>>  mm/mmap.c                             | 229 ++++++++++---
>>>>>>  mm/mprotect.c                         |   4 +-
>>>>>>  mm/mremap.c                           |  13 +
>>>>>>  mm/nommu.c                            |   2 +-
>>>>>>  mm/rmap.c                             |   5 +-
>>>>>>  mm/swap.c                             |   6 +-
>>>>>>  mm/swap_state.c                       |   8 +-
>>>>>>  mm/vmstat.c                           |   5 +-
>>>>>>  tools/include/uapi/linux/perf_event.h |   1 +
>>>>>>  tools/perf/util/evsel.c               |   1 +
>>>>>>  tools/perf/util/parse-events.c        |   4 +
>>>>>>  tools/perf/util/parse-events.l        |   1 +
>>>>>>  tools/perf/util/python.c              |   1 +
>>>>>>  44 files changed, 1161 insertions(+), 211 deletions(-)
>>>>>>  create mode 100644 include/trace/events/pagefault.h
>>>>>>
>>>>>> --
>>>>>> 2.7.4
>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>
>>
>


[-- Attachment #2: perf-profile_page_fault2_base_THP-Alwasys.gz --]
[-- Type: application/gzip, Size: 10171 bytes --]

[-- Attachment #3: perf-profile_page_fault2_base_thp_never.gz --]
[-- Type: application/gzip, Size: 11474 bytes --]

[-- Attachment #4: perf-profile_page_fault2_head_THP-Always.gz --]
[-- Type: application/gzip, Size: 10374 bytes --]

[-- Attachment #5: perf-profile_page_fault2_head_thp_never.gz --]
[-- Type: application/gzip, Size: 11327 bytes --]

[-- Attachment #6: perf-profile_page_fault3_base_THP-Always.gz --]
[-- Type: application/gzip, Size: 9503 bytes --]

[-- Attachment #7: perf-profile_page_fault3_base_thp_never.gz --]
[-- Type: application/gzip, Size: 9843 bytes --]

[-- Attachment #8: perf-profile_page_fault3_head_THP-Always.gz --]
[-- Type: application/gzip, Size: 9596 bytes --]

[-- Attachment #9: perf-profile_page_fault3_head_thp_never.gz --]
[-- Type: application/gzip, Size: 10137 bytes --]

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2018-07-04  7:51                 ` Laurent Dufour
@ 2018-07-11 17:05                   ` Laurent Dufour
  -1 siblings, 0 replies; 58+ messages in thread
From: Laurent Dufour @ 2018-07-11 17:05 UTC (permalink / raw)
  To: Song, HaiyanX
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

Hi Haiyan,

Do you get a chance to capture some performance cycles on your system ?
I still can't get these numbers on my hardware.

Thanks,
Laurent.

On 04/07/2018 09:51, Laurent Dufour wrote:
> On 04/07/2018 05:23, Song, HaiyanX wrote:
>> Hi Laurent,
>>
>>
>> For the test result on Intel 4s skylake platform (192 CPUs, 768G Memory), the below test cases all were run 3 times.
>> I check the test results, only page_fault3_thread/enable THP have 6% stddev for head commit, other tests have lower stddev.
> 
> Repeating the test only 3 times seems a bit too low to me.
> 
> I'll focus on the higher change for the moment, but I don't have access to such
> a hardware.
> 
> Is possible to provide a diff between base and SPF of the performance cycles
> measured when running page_fault3 and page_fault2 when the 20% change is detected.
> 
> Please stay focus on the test case process to see exactly where the series is
> impacting.
> 
> Thanks,
> Laurent.
> 
>>
>> And I did not find other high variation on test case result.
>>
>> a). Enable THP
>> testcase                          base     stddev       change      head     stddev         metric
>> page_fault3/enable THP           10519      A+- 3%        -20.5%      8368      A+-6%          will-it-scale.per_thread_ops
>> page_fault2/enalbe THP            8281      A+- 2%        -18.8%      6728                   will-it-scale.per_thread_ops
>> brk1/eanble THP                 998475                   -2.2%    976893                   will-it-scale.per_process_ops
>> context_switch1/enable THP      223910                   -1.3%    220930                   will-it-scale.per_process_ops
>> context_switch1/enable THP      233722                   -1.0%    231288                   will-it-scale.per_thread_ops
>>
>> b). Disable THP
>> page_fault3/disable THP          10856                  -23.1%      8344                   will-it-scale.per_thread_ops
>> page_fault2/disable THP           8147                  -18.8%      6613                   will-it-scale.per_thread_ops
>> brk1/disable THP                   957                    -7.9%      881                   will-it-scale.per_thread_ops
>> context_switch1/disable THP     237006                    -2.2%    231907                  will-it-scale.per_thread_ops
>> brk1/disable THP                997317                    -2.0%    977778                  will-it-scale.per_process_ops
>> page_fault3/disable THP         467454                    -1.8%    459251                  will-it-scale.per_process_ops
>> context_switch1/disable THP     224431                    -1.3%    221567                  will-it-scale.per_process_ops
>>
>>
>> Best regards,
>> Haiyan Song
>> ________________________________________
>> From: Laurent Dufour [ldufour@linux.vnet.ibm.com]
>> Sent: Monday, July 02, 2018 4:59 PM
>> To: Song, HaiyanX
>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>
>> On 11/06/2018 09:49, Song, HaiyanX wrote:
>>> Hi Laurent,
>>>
>>> Regression test for v11 patch serials have been run, some regression is found by LKP-tools (linux kernel performance)
>>> tested on Intel 4s skylake platform. This time only test the cases which have been run and found regressions on
>>> V9 patch serials.
>>>
>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>> branch: Laurent-Dufour/Speculative-page-faults/20180520-045126
>>> commit id:
>>>   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12
>>>   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1
>>> Benchmark: will-it-scale
>>> Download link: https://github.com/antonblanchard/will-it-scale/tree/master
>>>
>>> Metrics:
>>>   will-it-scale.per_process_ops=processes/nr_cpu
>>>   will-it-scale.per_thread_ops=threads/nr_cpu
>>>   test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>> THP: enable / disable
>>> nr_task:100%
>>>
>>> 1. Regressions:
>>>
>>> a). Enable THP
>>> testcase                          base           change      head           metric
>>> page_fault3/enable THP           10519          -20.5%        836      will-it-scale.per_thread_ops
>>> page_fault2/enalbe THP            8281          -18.8%       6728      will-it-scale.per_thread_ops
>>> brk1/eanble THP                 998475           -2.2%     976893      will-it-scale.per_process_ops
>>> context_switch1/enable THP      223910           -1.3%     220930      will-it-scale.per_process_ops
>>> context_switch1/enable THP      233722           -1.0%     231288      will-it-scale.per_thread_ops
>>>
>>> b). Disable THP
>>> page_fault3/disable THP          10856          -23.1%       8344      will-it-scale.per_thread_ops
>>> page_fault2/disable THP           8147          -18.8%       6613      will-it-scale.per_thread_ops
>>> brk1/disable THP                   957           -7.9%        881      will-it-scale.per_thread_ops
>>> context_switch1/disable THP     237006           -2.2%     231907      will-it-scale.per_thread_ops
>>> brk1/disable THP                997317           -2.0%     977778      will-it-scale.per_process_ops
>>> page_fault3/disable THP         467454           -1.8%     459251      will-it-scale.per_process_ops
>>> context_switch1/disable THP     224431           -1.3%     221567      will-it-scale.per_process_ops
>>>
>>> Notes: for the above  values of test result, the higher is better.
>>
>> I tried the same tests on my PowerPC victim VM (1024 CPUs, 11TB) and I can't
>> get reproducible results. The results have huge variation, even on the vanilla
>> kernel, and I can't state on any changes due to that.
>>
>> I tried on smaller node (80 CPUs, 32G), and the tests ran better, but I didn't
>> measure any changes between the vanilla and the SPF patched ones:
>>
>> test THP enabled                4.17.0-rc4-mm1  spf             delta
>> page_fault3_threads             2697.7          2683.5          -0.53%
>> page_fault2_threads             170660.6        169574.1        -0.64%
>> context_switch1_threads         6915269.2       6877507.3       -0.55%
>> context_switch1_processes       6478076.2       6529493.5       0.79%
>> brk1                            243391.2        238527.5        -2.00%
>>
>> Tests were run 10 times, no high variation detected.
>>
>> Did you see high variation on your side ? How many times the test were run to
>> compute the average values ?
>>
>> Thanks,
>> Laurent.
>>
>>
>>>
>>> 2. Improvement: not found improvement based on the selected test cases.
>>>
>>>
>>> Best regards
>>> Haiyan Song
>>> ________________________________________
>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>> Sent: Monday, May 28, 2018 4:54 PM
>>> To: Song, HaiyanX
>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>
>>> On 28/05/2018 10:22, Haiyan Song wrote:
>>>> Hi Laurent,
>>>>
>>>> Yes, these tests are done on V9 patch.
>>>
>>> Do you plan to give this V11 a run ?
>>>
>>>>
>>>>
>>>> Best regards,
>>>> Haiyan Song
>>>>
>>>> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:
>>>>> On 28/05/2018 07:23, Song, HaiyanX wrote:
>>>>>>
>>>>>> Some regression and improvements is found by LKP-tools(linux kernel performance) on V9 patch series
>>>>>> tested on Intel 4s Skylake platform.
>>>>>
>>>>> Hi,
>>>>>
>>>>> Thanks for reporting this benchmark results, but you mentioned the "V9 patch
>>>>> series" while responding to the v11 header series...
>>>>> Were these tests done on v9 or v11 ?
>>>>>
>>>>> Cheers,
>>>>> Laurent.
>>>>>
>>>>>>
>>>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 patch series)
>>>>>> Commit id:
>>>>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f
>>>>>>     head commit: 0355322b3577eeab7669066df42c550a56801110
>>>>>> Benchmark suite: will-it-scale
>>>>>> Download link:
>>>>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests
>>>>>> Metrics:
>>>>>>     will-it-scale.per_process_ops=processes/nr_cpu
>>>>>>     will-it-scale.per_thread_ops=threads/nr_cpu
>>>>>> test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>>>> THP: enable / disable
>>>>>> nr_task: 100%
>>>>>>
>>>>>> 1. Regressions:
>>>>>> a) THP enabled:
>>>>>> testcase                        base            change          head       metric
>>>>>> page_fault3/ enable THP         10092           -17.5%          8323       will-it-scale.per_thread_ops
>>>>>> page_fault2/ enable THP          8300           -17.2%          6869       will-it-scale.per_thread_ops
>>>>>> brk1/ enable THP                  957.67         -7.6%           885       will-it-scale.per_thread_ops
>>>>>> page_fault3/ enable THP        172821            -5.3%        163692       will-it-scale.per_process_ops
>>>>>> signal1/ enable THP              9125            -3.2%          8834       will-it-scale.per_process_ops
>>>>>>
>>>>>> b) THP disabled:
>>>>>> testcase                        base            change          head       metric
>>>>>> page_fault3/ disable THP        10107           -19.1%          8180       will-it-scale.per_thread_ops
>>>>>> page_fault2/ disable THP         8432           -17.8%          6931       will-it-scale.per_thread_ops
>>>>>> context_switch1/ disable THP   215389            -6.8%        200776       will-it-scale.per_thread_ops
>>>>>> brk1/ disable THP                 939.67         -6.6%           877.33    will-it-scale.per_thread_ops
>>>>>> page_fault3/ disable THP       173145            -4.7%        165064       will-it-scale.per_process_ops
>>>>>> signal1/ disable THP             9162            -3.9%          8802       will-it-scale.per_process_ops
>>>>>>
>>>>>> 2. Improvements:
>>>>>> a) THP enabled:
>>>>>> testcase                        base            change          head       metric
>>>>>> malloc1/ enable THP               66.33        +469.8%           383.67    will-it-scale.per_thread_ops
>>>>>> writeseek3/ enable THP          2531             +4.5%          2646       will-it-scale.per_thread_ops
>>>>>> signal1/ enable THP              989.33          +2.8%          1016       will-it-scale.per_thread_ops
>>>>>>
>>>>>> b) THP disabled:
>>>>>> testcase                        base            change          head       metric
>>>>>> malloc1/ disable THP              90.33        +417.3%           467.33    will-it-scale.per_thread_ops
>>>>>> read2/ disable THP             58934            +39.2%         82060       will-it-scale.per_thread_ops
>>>>>> page_fault1/ disable THP        8607            +36.4%         11736       will-it-scale.per_thread_ops
>>>>>> read1/ disable THP            314063            +12.7%        353934       will-it-scale.per_thread_ops
>>>>>> writeseek3/ disable THP         2452            +12.5%          2759       will-it-scale.per_thread_ops
>>>>>> signal1/ disable THP             971.33          +5.5%          1024       will-it-scale.per_thread_ops
>>>>>>
>>>>>> Notes: for above values in column "change", the higher value means that the related testcase result
>>>>>> on head commit is better than that on base commit for this benchmark.
>>>>>>
>>>>>>
>>>>>> Best regards
>>>>>> Haiyan Song
>>>>>>
>>>>>> ________________________________________
>>>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>>>> Sent: Thursday, May 17, 2018 7:06 PM
>>>>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi
>>>>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>>>> Subject: [PATCH v11 00/26] Speculative page faults
>>>>>>
>>>>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>>>>>> page fault without holding the mm semaphore [1].
>>>>>>
>>>>>> The idea is to try to handle user space page faults without holding the
>>>>>> mmap_sem. This should allow better concurrency for massively threaded
>>>>>> process since the page fault handler will not wait for other threads memory
>>>>>> layout change to be done, assuming that this change is done in another part
>>>>>> of the process's memory space. This type page fault is named speculative
>>>>>> page fault. If the speculative page fault fails because of a concurrency is
>>>>>> detected or because underlying PMD or PTE tables are not yet allocating, it
>>>>>> is failing its processing and a classic page fault is then tried.
>>>>>>
>>>>>> The speculative page fault (SPF) has to look for the VMA matching the fault
>>>>>> address without holding the mmap_sem, this is done by introducing a rwlock
>>>>>> which protects the access to the mm_rb tree. Previously this was done using
>>>>>> SRCU but it was introducing a lot of scheduling to process the VMA's
>>>>>> freeing operation which was hitting the performance by 20% as reported by
>>>>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is
>>>>>> limiting the locking contention to these operations which are expected to
>>>>>> be in a O(log n) order. In addition to ensure that the VMA is not freed in
>>>>>> our back a reference count is added and 2 services (get_vma() and
>>>>>> put_vma()) are introduced to handle the reference count. Once a VMA is
>>>>>> fetched from the RB tree using get_vma(), it must be later freed using
>>>>>> put_vma(). I can't see anymore the overhead I got while will-it-scale
>>>>>> benchmark anymore.
>>>>>>
>>>>>> The VMA's attributes checked during the speculative page fault processing
>>>>>> have to be protected against parallel changes. This is done by using a per
>>>>>> VMA sequence lock. This sequence lock allows the speculative page fault
>>>>>> handler to fast check for parallel changes in progress and to abort the
>>>>>> speculative page fault in that case.
>>>>>>
>>>>>> Once the VMA has been found, the speculative page fault handler would check
>>>>>> for the VMA's attributes to verify that the page fault has to be handled
>>>>>> correctly or not. Thus, the VMA is protected through a sequence lock which
>>>>>> allows fast detection of concurrent VMA changes. If such a change is
>>>>>> detected, the speculative page fault is aborted and a *classic* page fault
>>>>>> is tried.  VMA sequence lockings are added when VMA attributes which are
>>>>>> checked during the page fault are modified.
>>>>>>
>>>>>> When the PTE is fetched, the VMA is checked to see if it has been changed,
>>>>>> so once the page table is locked, the VMA is valid, so any other changes
>>>>>> leading to touching this PTE will need to lock the page table, so no
>>>>>> parallel change is possible at this time.
>>>>>>
>>>>>> The locking of the PTE is done with interrupts disabled, this allows
>>>>>> checking for the PMD to ensure that there is not an ongoing collapsing
>>>>>> operation. Since khugepaged is firstly set the PMD to pmd_none and then is
>>>>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd is
>>>>>> valid at the time the PTE is locked, we have the guarantee that the
>>>>>> collapsing operation will have to wait on the PTE lock to move forward.
>>>>>> This allows the SPF handler to map the PTE safely. If the PMD value is
>>>>>> different from the one recorded at the beginning of the SPF operation, the
>>>>>> classic page fault handler will be called to handle the operation while
>>>>>> holding the mmap_sem. As the PTE lock is done with the interrupts disabled,
>>>>>> the lock is done using spin_trylock() to avoid dead lock when handling a
>>>>>> page fault while a TLB invalidate is requested by another CPU holding the
>>>>>> PTE.
>>>>>>
>>>>>> In pseudo code, this could be seen as:
>>>>>>     speculative_page_fault()
>>>>>>     {
>>>>>>             vma = get_vma()
>>>>>>             check vma sequence count
>>>>>>             check vma's support
>>>>>>             disable interrupt
>>>>>>                   check pgd,p4d,...,pte
>>>>>>                   save pmd and pte in vmf
>>>>>>                   save vma sequence counter in vmf
>>>>>>             enable interrupt
>>>>>>             check vma sequence count
>>>>>>             handle_pte_fault(vma)
>>>>>>                     ..
>>>>>>                     page = alloc_page()
>>>>>>                     pte_map_lock()
>>>>>>                             disable interrupt
>>>>>>                                     abort if sequence counter has changed
>>>>>>                                     abort if pmd or pte has changed
>>>>>>                                     pte map and lock
>>>>>>                             enable interrupt
>>>>>>                     if abort
>>>>>>                        free page
>>>>>>                        abort
>>>>>>                     ...
>>>>>>     }
>>>>>>
>>>>>>     arch_fault_handler()
>>>>>>     {
>>>>>>             if (speculative_page_fault(&vma))
>>>>>>                goto done
>>>>>>     again:
>>>>>>             lock(mmap_sem)
>>>>>>             vma = find_vma();
>>>>>>             handle_pte_fault(vma);
>>>>>>             if retry
>>>>>>                unlock(mmap_sem)
>>>>>>                goto again;
>>>>>>     done:
>>>>>>             handle fault error
>>>>>>     }
>>>>>>
>>>>>> Support for THP is not done because when checking for the PMD, we can be
>>>>>> confused by an in progress collapsing operation done by khugepaged. The
>>>>>> issue is that pmd_none() could be true either if the PMD is not already
>>>>>> populated or if the underlying PTE are in the way to be collapsed. So we
>>>>>> cannot safely allocate a PMD if pmd_none() is true.
>>>>>>
>>>>>> This series add a new software performance event named 'speculative-faults'
>>>>>> or 'spf'. It counts the number of successful page fault event handled
>>>>>> speculatively. When recording 'faults,spf' events, the faults one is
>>>>>> counting the total number of page fault events while 'spf' is only counting
>>>>>> the part of the faults processed speculatively.
>>>>>>
>>>>>> There are some trace events introduced by this series. They allow
>>>>>> identifying why the page faults were not processed speculatively. This
>>>>>> doesn't take in account the faults generated by a monothreaded process
>>>>>> which directly processed while holding the mmap_sem. This trace events are
>>>>>> grouped in a system named 'pagefault', they are:
>>>>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back
>>>>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.
>>>>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported
>>>>>>  - pagefault:spf_vma_access : the VMA's access right are not respected
>>>>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in our
>>>>>>    back.
>>>>>>
>>>>>> To record all the related events, the easier is to run perf with the
>>>>>> following arguments :
>>>>>> $ perf stat -e 'faults,spf,pagefault:*' <command>
>>>>>>
>>>>>> There is also a dedicated vmstat counter showing the number of successful
>>>>>> page fault handled speculatively. I can be seen this way:
>>>>>> $ grep speculative_pgfault /proc/vmstat
>>>>>>
>>>>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is functional
>>>>>> on x86, PowerPC and arm64.
>>>>>>
>>>>>> ---------------------
>>>>>> Real Workload results
>>>>>>
>>>>>> As mentioned in previous email, we did non official runs using a "popular
>>>>>> in memory multithreaded database product" on 176 cores SMT8 Power system
>>>>>> which showed a 30% improvements in the number of transaction processed per
>>>>>> second. This run has been done on the v6 series, but changes introduced in
>>>>>> this new version should not impact the performance boost seen.
>>>>>>
>>>>>> Here are the perf data captured during 2 of these runs on top of the v8
>>>>>> series:
>>>>>>                 vanilla         spf
>>>>>> faults          89.418          101.364         +13%
>>>>>> spf                n/a           97.989
>>>>>>
>>>>>> With the SPF kernel, most of the page fault were processed in a speculative
>>>>>> way.
>>>>>>
>>>>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and gave
>>>>>> it a try on an android device. He reported that the application launch time
>>>>>> was improved in average by 6%, and for large applications (~100 threads) by
>>>>>> 20%.
>>>>>>
>>>>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qcom
>>>>>> MSM845 (8 cores) with 6GB (the less is better):
>>>>>>
>>>>>> Application                             4.9     4.9+spf delta
>>>>>> com.tencent.mm                          416     389     -7%
>>>>>> com.eg.android.AlipayGphone             1135    986     -13%
>>>>>> com.tencent.mtt                         455     454     0%
>>>>>> com.qqgame.hlddz                        1497    1409    -6%
>>>>>> com.autonavi.minimap                    711     701     -1%
>>>>>> com.tencent.tmgp.sgame                  788     748     -5%
>>>>>> com.immomo.momo                         501     487     -3%
>>>>>> com.tencent.peng                        2145    2112    -2%
>>>>>> com.smile.gifmaker                      491     461     -6%
>>>>>> com.baidu.BaiduMap                      479     366     -23%
>>>>>> com.taobao.taobao                       1341    1198    -11%
>>>>>> com.baidu.searchbox                     333     314     -6%
>>>>>> com.tencent.mobileqq                    394     384     -3%
>>>>>> com.sina.weibo                          907     906     0%
>>>>>> com.youku.phone                         816     731     -11%
>>>>>> com.happyelements.AndroidAnimal.qq      763     717     -6%
>>>>>> com.UCMobile                            415     411     -1%
>>>>>> com.tencent.tmgp.ak                     1464    1431    -2%
>>>>>> com.tencent.qqmusic                     336     329     -2%
>>>>>> com.sankuai.meituan                     1661    1302    -22%
>>>>>> com.netease.cloudmusic                  1193    1200    1%
>>>>>> air.tv.douyu.android                    4257    4152    -2%
>>>>>>
>>>>>> ------------------
>>>>>> Benchmarks results
>>>>>>
>>>>>> Base kernel is v4.17.0-rc4-mm1
>>>>>> SPF is BASE + this series
>>>>>>
>>>>>> Kernbench:
>>>>>> ----------
>>>>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15
>>>>>> kernel (kernel is build 5 times):
>>>>>>
>>>>>> Average Half load -j 8
>>>>>>                  Run    (std deviation)
>>>>>>                  BASE                   SPF
>>>>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%
>>>>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%
>>>>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%
>>>>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%
>>>>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%
>>>>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%
>>>>>>
>>>>>> Average Optimal load -j 16
>>>>>>                  Run    (std deviation)
>>>>>>                  BASE                   SPF
>>>>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%
>>>>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%
>>>>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%
>>>>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%
>>>>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%
>>>>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%
>>>>>>
>>>>>>
>>>>>> During a run on the SPF, perf events were captured:
>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>          526743764      faults
>>>>>>                210      spf
>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>               2278      pagefault:spf_vma_notsup
>>>>>>                  0      pagefault:spf_vma_access
>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>
>>>>>> Very few speculative page faults were recorded as most of the processes
>>>>>> involved are monothreaded (sounds that on this architecture some threads
>>>>>> were created during the kernel build processing).
>>>>>>
>>>>>> Here are the kerbench results on a 80 CPUs Power8 system:
>>>>>>
>>>>>> Average Half load -j 40
>>>>>>                  Run    (std deviation)
>>>>>>                  BASE                   SPF
>>>>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%
>>>>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%
>>>>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%
>>>>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%
>>>>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%
>>>>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%
>>>>>>
>>>>>> Average Optimal load -j 80
>>>>>>                  Run    (std deviation)
>>>>>>                  BASE                   SPF
>>>>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%
>>>>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%
>>>>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%
>>>>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%
>>>>>> Context Switches 223861  (138865)       225032  (139632)        0.52%
>>>>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%
>>>>>>
>>>>>> During a run on the SPF, perf events were captured:
>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>          116730856      faults
>>>>>>                  0      spf
>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>                476      pagefault:spf_vma_notsup
>>>>>>                  0      pagefault:spf_vma_access
>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>
>>>>>> Most of the processes involved are monothreaded so SPF is not activated but
>>>>>> there is no impact on the performance.
>>>>>>
>>>>>> Ebizzy:
>>>>>> -------
>>>>>> The test is counting the number of records per second it can manage, the
>>>>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get
>>>>>> consistent result I repeated the test 100 times and measure the average
>>>>>> result. The number is the record processes per second, the higher is the
>>>>>> best.
>>>>>>
>>>>>>                 BASE            SPF             delta
>>>>>> 16 CPUs x86 VM  742.57          1490.24         100.69%
>>>>>> 80 CPUs P8 node 13105.4         24174.23        84.46%
>>>>>>
>>>>>> Here are the performance counter read during a run on a 16 CPUs x86 VM:
>>>>>>  Performance counter stats for './ebizzy -mTt 16':
>>>>>>            1706379      faults
>>>>>>            1674599      spf
>>>>>>              30588      pagefault:spf_vma_changed
>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>                363      pagefault:spf_vma_notsup
>>>>>>                  0      pagefault:spf_vma_access
>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>
>>>>>> And the ones captured during a run on a 80 CPUs Power node:
>>>>>>  Performance counter stats for './ebizzy -mTt 80':
>>>>>>            1874773      faults
>>>>>>            1461153      spf
>>>>>>             413293      pagefault:spf_vma_changed
>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>                200      pagefault:spf_vma_notsup
>>>>>>                  0      pagefault:spf_vma_access
>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>
>>>>>> In ebizzy's case most of the page fault were handled in a speculative way,
>>>>>> leading the ebizzy performance boost.
>>>>>>
>>>>>> ------------------
>>>>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):
>>>>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahendran
>>>>>>    and Minchan Kim, hopefully.
>>>>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in
>>>>>>    __do_page_fault().
>>>>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails
>>>>>>    instead
>>>>>>    of aborting the speculative page fault handling. Dropping the now
>>>>>> useless
>>>>>>    trace event pagefault:spf_pte_lock.
>>>>>>  - No more try to reuse the fetched VMA during the speculative page fault
>>>>>>    handling when retrying is needed. This adds a lot of complexity and
>>>>>>    additional tests done didn't show a significant performance improvement.
>>>>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.
>>>>>>
>>>>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at-speculative-page-faults-tt965642.html#none
>>>>>> [2] https://patchwork.kernel.org/patch/9999687/
>>>>>>
>>>>>>
>>>>>> Laurent Dufour (20):
>>>>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT
>>>>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE
>>>>>>   mm: make pte_unmap_same compatible with SPF
>>>>>>   mm: introduce INIT_VMA()
>>>>>>   mm: protect VMA modifications using VMA sequence count
>>>>>>   mm: protect mremap() against SPF hanlder
>>>>>>   mm: protect SPF handler against anon_vma changes
>>>>>>   mm: cache some VMA fields in the vm_fault structure
>>>>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()
>>>>>>   mm: introduce __lru_cache_add_active_or_unevictable
>>>>>>   mm: introduce __vm_normal_page()
>>>>>>   mm: introduce __page_add_new_anon_rmap()
>>>>>>   mm: protect mm_rb tree with a rwlock
>>>>>>   mm: adding speculative page fault failure trace events
>>>>>>   perf: add a speculative page fault sw event
>>>>>>   perf tools: add support for the SPF perf event
>>>>>>   mm: add speculative page fault vmstats
>>>>>>   powerpc/mm: add speculative page fault
>>>>>>
>>>>>> Mahendran Ganesh (2):
>>>>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>   arm64/mm: add speculative page fault
>>>>>>
>>>>>> Peter Zijlstra (4):
>>>>>>   mm: prepare for FAULT_FLAG_SPECULATIVE
>>>>>>   mm: VMA sequence count
>>>>>>   mm: provide speculative fault infrastructure
>>>>>>   x86/mm: add speculative pagefault handling
>>>>>>
>>>>>>  arch/arm64/Kconfig                    |   1 +
>>>>>>  arch/arm64/mm/fault.c                 |  12 +
>>>>>>  arch/powerpc/Kconfig                  |   1 +
>>>>>>  arch/powerpc/mm/fault.c               |  16 +
>>>>>>  arch/x86/Kconfig                      |   1 +
>>>>>>  arch/x86/mm/fault.c                   |  27 +-
>>>>>>  fs/exec.c                             |   2 +-
>>>>>>  fs/proc/task_mmu.c                    |   5 +-
>>>>>>  fs/userfaultfd.c                      |  17 +-
>>>>>>  include/linux/hugetlb_inline.h        |   2 +-
>>>>>>  include/linux/migrate.h               |   4 +-
>>>>>>  include/linux/mm.h                    | 136 +++++++-
>>>>>>  include/linux/mm_types.h              |   7 +
>>>>>>  include/linux/pagemap.h               |   4 +-
>>>>>>  include/linux/rmap.h                  |  12 +-
>>>>>>  include/linux/swap.h                  |  10 +-
>>>>>>  include/linux/vm_event_item.h         |   3 +
>>>>>>  include/trace/events/pagefault.h      |  80 +++++
>>>>>>  include/uapi/linux/perf_event.h       |   1 +
>>>>>>  kernel/fork.c                         |   5 +-
>>>>>>  mm/Kconfig                            |  22 ++
>>>>>>  mm/huge_memory.c                      |   6 +-
>>>>>>  mm/hugetlb.c                          |   2 +
>>>>>>  mm/init-mm.c                          |   3 +
>>>>>>  mm/internal.h                         |  20 ++
>>>>>>  mm/khugepaged.c                       |   5 +
>>>>>>  mm/madvise.c                          |   6 +-
>>>>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++++++-----
>>>>>>  mm/mempolicy.c                        |  51 ++-
>>>>>>  mm/migrate.c                          |   6 +-
>>>>>>  mm/mlock.c                            |  13 +-
>>>>>>  mm/mmap.c                             | 229 ++++++++++---
>>>>>>  mm/mprotect.c                         |   4 +-
>>>>>>  mm/mremap.c                           |  13 +
>>>>>>  mm/nommu.c                            |   2 +-
>>>>>>  mm/rmap.c                             |   5 +-
>>>>>>  mm/swap.c                             |   6 +-
>>>>>>  mm/swap_state.c                       |   8 +-
>>>>>>  mm/vmstat.c                           |   5 +-
>>>>>>  tools/include/uapi/linux/perf_event.h |   1 +
>>>>>>  tools/perf/util/evsel.c               |   1 +
>>>>>>  tools/perf/util/parse-events.c        |   4 +
>>>>>>  tools/perf/util/parse-events.l        |   1 +
>>>>>>  tools/perf/util/python.c              |   1 +
>>>>>>  44 files changed, 1161 insertions(+), 211 deletions(-)
>>>>>>  create mode 100644 include/trace/events/pagefault.h
>>>>>>
>>>>>> --
>>>>>> 2.7.4
>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>
>>
> 

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2018-07-11 17:05                   ` Laurent Dufour
  0 siblings, 0 replies; 58+ messages in thread
From: Laurent Dufour @ 2018-07-11 17:05 UTC (permalink / raw)
  To: Song, HaiyanX
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

Hi Haiyan,

Do you get a chance to capture some performance cycles on your system ?
I still can't get these numbers on my hardware.

Thanks,
Laurent.

On 04/07/2018 09:51, Laurent Dufour wrote:
> On 04/07/2018 05:23, Song, HaiyanX wrote:
>> Hi Laurent,
>>
>>
>> For the test result on Intel 4s skylake platform (192 CPUs, 768G Memory), the below test cases all were run 3 times.
>> I check the test results, only page_fault3_thread/enable THP have 6% stddev for head commit, other tests have lower stddev.
> 
> Repeating the test only 3 times seems a bit too low to me.
> 
> I'll focus on the higher change for the moment, but I don't have access to such
> a hardware.
> 
> Is possible to provide a diff between base and SPF of the performance cycles
> measured when running page_fault3 and page_fault2 when the 20% change is detected.
> 
> Please stay focus on the test case process to see exactly where the series is
> impacting.
> 
> Thanks,
> Laurent.
> 
>>
>> And I did not find other high variation on test case result.
>>
>> a). Enable THP
>> testcase                          base     stddev       change      head     stddev         metric
>> page_fault3/enable THP           10519      ± 3%        -20.5%      8368      ±6%          will-it-scale.per_thread_ops
>> page_fault2/enalbe THP            8281      ± 2%        -18.8%      6728                   will-it-scale.per_thread_ops
>> brk1/eanble THP                 998475                   -2.2%    976893                   will-it-scale.per_process_ops
>> context_switch1/enable THP      223910                   -1.3%    220930                   will-it-scale.per_process_ops
>> context_switch1/enable THP      233722                   -1.0%    231288                   will-it-scale.per_thread_ops
>>
>> b). Disable THP
>> page_fault3/disable THP          10856                  -23.1%      8344                   will-it-scale.per_thread_ops
>> page_fault2/disable THP           8147                  -18.8%      6613                   will-it-scale.per_thread_ops
>> brk1/disable THP                   957                    -7.9%      881                   will-it-scale.per_thread_ops
>> context_switch1/disable THP     237006                    -2.2%    231907                  will-it-scale.per_thread_ops
>> brk1/disable THP                997317                    -2.0%    977778                  will-it-scale.per_process_ops
>> page_fault3/disable THP         467454                    -1.8%    459251                  will-it-scale.per_process_ops
>> context_switch1/disable THP     224431                    -1.3%    221567                  will-it-scale.per_process_ops
>>
>>
>> Best regards,
>> Haiyan Song
>> ________________________________________
>> From: Laurent Dufour [ldufour@linux.vnet.ibm.com]
>> Sent: Monday, July 02, 2018 4:59 PM
>> To: Song, HaiyanX
>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>
>> On 11/06/2018 09:49, Song, HaiyanX wrote:
>>> Hi Laurent,
>>>
>>> Regression test for v11 patch serials have been run, some regression is found by LKP-tools (linux kernel performance)
>>> tested on Intel 4s skylake platform. This time only test the cases which have been run and found regressions on
>>> V9 patch serials.
>>>
>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>> branch: Laurent-Dufour/Speculative-page-faults/20180520-045126
>>> commit id:
>>>   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12
>>>   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1
>>> Benchmark: will-it-scale
>>> Download link: https://github.com/antonblanchard/will-it-scale/tree/master
>>>
>>> Metrics:
>>>   will-it-scale.per_process_ops=processes/nr_cpu
>>>   will-it-scale.per_thread_ops=threads/nr_cpu
>>>   test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>> THP: enable / disable
>>> nr_task:100%
>>>
>>> 1. Regressions:
>>>
>>> a). Enable THP
>>> testcase                          base           change      head           metric
>>> page_fault3/enable THP           10519          -20.5%        836      will-it-scale.per_thread_ops
>>> page_fault2/enalbe THP            8281          -18.8%       6728      will-it-scale.per_thread_ops
>>> brk1/eanble THP                 998475           -2.2%     976893      will-it-scale.per_process_ops
>>> context_switch1/enable THP      223910           -1.3%     220930      will-it-scale.per_process_ops
>>> context_switch1/enable THP      233722           -1.0%     231288      will-it-scale.per_thread_ops
>>>
>>> b). Disable THP
>>> page_fault3/disable THP          10856          -23.1%       8344      will-it-scale.per_thread_ops
>>> page_fault2/disable THP           8147          -18.8%       6613      will-it-scale.per_thread_ops
>>> brk1/disable THP                   957           -7.9%        881      will-it-scale.per_thread_ops
>>> context_switch1/disable THP     237006           -2.2%     231907      will-it-scale.per_thread_ops
>>> brk1/disable THP                997317           -2.0%     977778      will-it-scale.per_process_ops
>>> page_fault3/disable THP         467454           -1.8%     459251      will-it-scale.per_process_ops
>>> context_switch1/disable THP     224431           -1.3%     221567      will-it-scale.per_process_ops
>>>
>>> Notes: for the above  values of test result, the higher is better.
>>
>> I tried the same tests on my PowerPC victim VM (1024 CPUs, 11TB) and I can't
>> get reproducible results. The results have huge variation, even on the vanilla
>> kernel, and I can't state on any changes due to that.
>>
>> I tried on smaller node (80 CPUs, 32G), and the tests ran better, but I didn't
>> measure any changes between the vanilla and the SPF patched ones:
>>
>> test THP enabled                4.17.0-rc4-mm1  spf             delta
>> page_fault3_threads             2697.7          2683.5          -0.53%
>> page_fault2_threads             170660.6        169574.1        -0.64%
>> context_switch1_threads         6915269.2       6877507.3       -0.55%
>> context_switch1_processes       6478076.2       6529493.5       0.79%
>> brk1                            243391.2        238527.5        -2.00%
>>
>> Tests were run 10 times, no high variation detected.
>>
>> Did you see high variation on your side ? How many times the test were run to
>> compute the average values ?
>>
>> Thanks,
>> Laurent.
>>
>>
>>>
>>> 2. Improvement: not found improvement based on the selected test cases.
>>>
>>>
>>> Best regards
>>> Haiyan Song
>>> ________________________________________
>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>> Sent: Monday, May 28, 2018 4:54 PM
>>> To: Song, HaiyanX
>>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>>
>>> On 28/05/2018 10:22, Haiyan Song wrote:
>>>> Hi Laurent,
>>>>
>>>> Yes, these tests are done on V9 patch.
>>>
>>> Do you plan to give this V11 a run ?
>>>
>>>>
>>>>
>>>> Best regards,
>>>> Haiyan Song
>>>>
>>>> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:
>>>>> On 28/05/2018 07:23, Song, HaiyanX wrote:
>>>>>>
>>>>>> Some regression and improvements is found by LKP-tools(linux kernel performance) on V9 patch series
>>>>>> tested on Intel 4s Skylake platform.
>>>>>
>>>>> Hi,
>>>>>
>>>>> Thanks for reporting this benchmark results, but you mentioned the "V9 patch
>>>>> series" while responding to the v11 header series...
>>>>> Were these tests done on v9 or v11 ?
>>>>>
>>>>> Cheers,
>>>>> Laurent.
>>>>>
>>>>>>
>>>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 patch series)
>>>>>> Commit id:
>>>>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f
>>>>>>     head commit: 0355322b3577eeab7669066df42c550a56801110
>>>>>> Benchmark suite: will-it-scale
>>>>>> Download link:
>>>>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests
>>>>>> Metrics:
>>>>>>     will-it-scale.per_process_ops=processes/nr_cpu
>>>>>>     will-it-scale.per_thread_ops=threads/nr_cpu
>>>>>> test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>>>> THP: enable / disable
>>>>>> nr_task: 100%
>>>>>>
>>>>>> 1. Regressions:
>>>>>> a) THP enabled:
>>>>>> testcase                        base            change          head       metric
>>>>>> page_fault3/ enable THP         10092           -17.5%          8323       will-it-scale.per_thread_ops
>>>>>> page_fault2/ enable THP          8300           -17.2%          6869       will-it-scale.per_thread_ops
>>>>>> brk1/ enable THP                  957.67         -7.6%           885       will-it-scale.per_thread_ops
>>>>>> page_fault3/ enable THP        172821            -5.3%        163692       will-it-scale.per_process_ops
>>>>>> signal1/ enable THP              9125            -3.2%          8834       will-it-scale.per_process_ops
>>>>>>
>>>>>> b) THP disabled:
>>>>>> testcase                        base            change          head       metric
>>>>>> page_fault3/ disable THP        10107           -19.1%          8180       will-it-scale.per_thread_ops
>>>>>> page_fault2/ disable THP         8432           -17.8%          6931       will-it-scale.per_thread_ops
>>>>>> context_switch1/ disable THP   215389            -6.8%        200776       will-it-scale.per_thread_ops
>>>>>> brk1/ disable THP                 939.67         -6.6%           877.33    will-it-scale.per_thread_ops
>>>>>> page_fault3/ disable THP       173145            -4.7%        165064       will-it-scale.per_process_ops
>>>>>> signal1/ disable THP             9162            -3.9%          8802       will-it-scale.per_process_ops
>>>>>>
>>>>>> 2. Improvements:
>>>>>> a) THP enabled:
>>>>>> testcase                        base            change          head       metric
>>>>>> malloc1/ enable THP               66.33        +469.8%           383.67    will-it-scale.per_thread_ops
>>>>>> writeseek3/ enable THP          2531             +4.5%          2646       will-it-scale.per_thread_ops
>>>>>> signal1/ enable THP              989.33          +2.8%          1016       will-it-scale.per_thread_ops
>>>>>>
>>>>>> b) THP disabled:
>>>>>> testcase                        base            change          head       metric
>>>>>> malloc1/ disable THP              90.33        +417.3%           467.33    will-it-scale.per_thread_ops
>>>>>> read2/ disable THP             58934            +39.2%         82060       will-it-scale.per_thread_ops
>>>>>> page_fault1/ disable THP        8607            +36.4%         11736       will-it-scale.per_thread_ops
>>>>>> read1/ disable THP            314063            +12.7%        353934       will-it-scale.per_thread_ops
>>>>>> writeseek3/ disable THP         2452            +12.5%          2759       will-it-scale.per_thread_ops
>>>>>> signal1/ disable THP             971.33          +5.5%          1024       will-it-scale.per_thread_ops
>>>>>>
>>>>>> Notes: for above values in column "change", the higher value means that the related testcase result
>>>>>> on head commit is better than that on base commit for this benchmark.
>>>>>>
>>>>>>
>>>>>> Best regards
>>>>>> Haiyan Song
>>>>>>
>>>>>> ________________________________________
>>>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>>>> Sent: Thursday, May 17, 2018 7:06 PM
>>>>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi
>>>>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>>>> Subject: [PATCH v11 00/26] Speculative page faults
>>>>>>
>>>>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>>>>>> page fault without holding the mm semaphore [1].
>>>>>>
>>>>>> The idea is to try to handle user space page faults without holding the
>>>>>> mmap_sem. This should allow better concurrency for massively threaded
>>>>>> process since the page fault handler will not wait for other threads memory
>>>>>> layout change to be done, assuming that this change is done in another part
>>>>>> of the process's memory space. This type page fault is named speculative
>>>>>> page fault. If the speculative page fault fails because of a concurrency is
>>>>>> detected or because underlying PMD or PTE tables are not yet allocating, it
>>>>>> is failing its processing and a classic page fault is then tried.
>>>>>>
>>>>>> The speculative page fault (SPF) has to look for the VMA matching the fault
>>>>>> address without holding the mmap_sem, this is done by introducing a rwlock
>>>>>> which protects the access to the mm_rb tree. Previously this was done using
>>>>>> SRCU but it was introducing a lot of scheduling to process the VMA's
>>>>>> freeing operation which was hitting the performance by 20% as reported by
>>>>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is
>>>>>> limiting the locking contention to these operations which are expected to
>>>>>> be in a O(log n) order. In addition to ensure that the VMA is not freed in
>>>>>> our back a reference count is added and 2 services (get_vma() and
>>>>>> put_vma()) are introduced to handle the reference count. Once a VMA is
>>>>>> fetched from the RB tree using get_vma(), it must be later freed using
>>>>>> put_vma(). I can't see anymore the overhead I got while will-it-scale
>>>>>> benchmark anymore.
>>>>>>
>>>>>> The VMA's attributes checked during the speculative page fault processing
>>>>>> have to be protected against parallel changes. This is done by using a per
>>>>>> VMA sequence lock. This sequence lock allows the speculative page fault
>>>>>> handler to fast check for parallel changes in progress and to abort the
>>>>>> speculative page fault in that case.
>>>>>>
>>>>>> Once the VMA has been found, the speculative page fault handler would check
>>>>>> for the VMA's attributes to verify that the page fault has to be handled
>>>>>> correctly or not. Thus, the VMA is protected through a sequence lock which
>>>>>> allows fast detection of concurrent VMA changes. If such a change is
>>>>>> detected, the speculative page fault is aborted and a *classic* page fault
>>>>>> is tried.  VMA sequence lockings are added when VMA attributes which are
>>>>>> checked during the page fault are modified.
>>>>>>
>>>>>> When the PTE is fetched, the VMA is checked to see if it has been changed,
>>>>>> so once the page table is locked, the VMA is valid, so any other changes
>>>>>> leading to touching this PTE will need to lock the page table, so no
>>>>>> parallel change is possible at this time.
>>>>>>
>>>>>> The locking of the PTE is done with interrupts disabled, this allows
>>>>>> checking for the PMD to ensure that there is not an ongoing collapsing
>>>>>> operation. Since khugepaged is firstly set the PMD to pmd_none and then is
>>>>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd is
>>>>>> valid at the time the PTE is locked, we have the guarantee that the
>>>>>> collapsing operation will have to wait on the PTE lock to move forward.
>>>>>> This allows the SPF handler to map the PTE safely. If the PMD value is
>>>>>> different from the one recorded at the beginning of the SPF operation, the
>>>>>> classic page fault handler will be called to handle the operation while
>>>>>> holding the mmap_sem. As the PTE lock is done with the interrupts disabled,
>>>>>> the lock is done using spin_trylock() to avoid dead lock when handling a
>>>>>> page fault while a TLB invalidate is requested by another CPU holding the
>>>>>> PTE.
>>>>>>
>>>>>> In pseudo code, this could be seen as:
>>>>>>     speculative_page_fault()
>>>>>>     {
>>>>>>             vma = get_vma()
>>>>>>             check vma sequence count
>>>>>>             check vma's support
>>>>>>             disable interrupt
>>>>>>                   check pgd,p4d,...,pte
>>>>>>                   save pmd and pte in vmf
>>>>>>                   save vma sequence counter in vmf
>>>>>>             enable interrupt
>>>>>>             check vma sequence count
>>>>>>             handle_pte_fault(vma)
>>>>>>                     ..
>>>>>>                     page = alloc_page()
>>>>>>                     pte_map_lock()
>>>>>>                             disable interrupt
>>>>>>                                     abort if sequence counter has changed
>>>>>>                                     abort if pmd or pte has changed
>>>>>>                                     pte map and lock
>>>>>>                             enable interrupt
>>>>>>                     if abort
>>>>>>                        free page
>>>>>>                        abort
>>>>>>                     ...
>>>>>>     }
>>>>>>
>>>>>>     arch_fault_handler()
>>>>>>     {
>>>>>>             if (speculative_page_fault(&vma))
>>>>>>                goto done
>>>>>>     again:
>>>>>>             lock(mmap_sem)
>>>>>>             vma = find_vma();
>>>>>>             handle_pte_fault(vma);
>>>>>>             if retry
>>>>>>                unlock(mmap_sem)
>>>>>>                goto again;
>>>>>>     done:
>>>>>>             handle fault error
>>>>>>     }
>>>>>>
>>>>>> Support for THP is not done because when checking for the PMD, we can be
>>>>>> confused by an in progress collapsing operation done by khugepaged. The
>>>>>> issue is that pmd_none() could be true either if the PMD is not already
>>>>>> populated or if the underlying PTE are in the way to be collapsed. So we
>>>>>> cannot safely allocate a PMD if pmd_none() is true.
>>>>>>
>>>>>> This series add a new software performance event named 'speculative-faults'
>>>>>> or 'spf'. It counts the number of successful page fault event handled
>>>>>> speculatively. When recording 'faults,spf' events, the faults one is
>>>>>> counting the total number of page fault events while 'spf' is only counting
>>>>>> the part of the faults processed speculatively.
>>>>>>
>>>>>> There are some trace events introduced by this series. They allow
>>>>>> identifying why the page faults were not processed speculatively. This
>>>>>> doesn't take in account the faults generated by a monothreaded process
>>>>>> which directly processed while holding the mmap_sem. This trace events are
>>>>>> grouped in a system named 'pagefault', they are:
>>>>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back
>>>>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.
>>>>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported
>>>>>>  - pagefault:spf_vma_access : the VMA's access right are not respected
>>>>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in our
>>>>>>    back.
>>>>>>
>>>>>> To record all the related events, the easier is to run perf with the
>>>>>> following arguments :
>>>>>> $ perf stat -e 'faults,spf,pagefault:*' <command>
>>>>>>
>>>>>> There is also a dedicated vmstat counter showing the number of successful
>>>>>> page fault handled speculatively. I can be seen this way:
>>>>>> $ grep speculative_pgfault /proc/vmstat
>>>>>>
>>>>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is functional
>>>>>> on x86, PowerPC and arm64.
>>>>>>
>>>>>> ---------------------
>>>>>> Real Workload results
>>>>>>
>>>>>> As mentioned in previous email, we did non official runs using a "popular
>>>>>> in memory multithreaded database product" on 176 cores SMT8 Power system
>>>>>> which showed a 30% improvements in the number of transaction processed per
>>>>>> second. This run has been done on the v6 series, but changes introduced in
>>>>>> this new version should not impact the performance boost seen.
>>>>>>
>>>>>> Here are the perf data captured during 2 of these runs on top of the v8
>>>>>> series:
>>>>>>                 vanilla         spf
>>>>>> faults          89.418          101.364         +13%
>>>>>> spf                n/a           97.989
>>>>>>
>>>>>> With the SPF kernel, most of the page fault were processed in a speculative
>>>>>> way.
>>>>>>
>>>>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and gave
>>>>>> it a try on an android device. He reported that the application launch time
>>>>>> was improved in average by 6%, and for large applications (~100 threads) by
>>>>>> 20%.
>>>>>>
>>>>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qcom
>>>>>> MSM845 (8 cores) with 6GB (the less is better):
>>>>>>
>>>>>> Application                             4.9     4.9+spf delta
>>>>>> com.tencent.mm                          416     389     -7%
>>>>>> com.eg.android.AlipayGphone             1135    986     -13%
>>>>>> com.tencent.mtt                         455     454     0%
>>>>>> com.qqgame.hlddz                        1497    1409    -6%
>>>>>> com.autonavi.minimap                    711     701     -1%
>>>>>> com.tencent.tmgp.sgame                  788     748     -5%
>>>>>> com.immomo.momo                         501     487     -3%
>>>>>> com.tencent.peng                        2145    2112    -2%
>>>>>> com.smile.gifmaker                      491     461     -6%
>>>>>> com.baidu.BaiduMap                      479     366     -23%
>>>>>> com.taobao.taobao                       1341    1198    -11%
>>>>>> com.baidu.searchbox                     333     314     -6%
>>>>>> com.tencent.mobileqq                    394     384     -3%
>>>>>> com.sina.weibo                          907     906     0%
>>>>>> com.youku.phone                         816     731     -11%
>>>>>> com.happyelements.AndroidAnimal.qq      763     717     -6%
>>>>>> com.UCMobile                            415     411     -1%
>>>>>> com.tencent.tmgp.ak                     1464    1431    -2%
>>>>>> com.tencent.qqmusic                     336     329     -2%
>>>>>> com.sankuai.meituan                     1661    1302    -22%
>>>>>> com.netease.cloudmusic                  1193    1200    1%
>>>>>> air.tv.douyu.android                    4257    4152    -2%
>>>>>>
>>>>>> ------------------
>>>>>> Benchmarks results
>>>>>>
>>>>>> Base kernel is v4.17.0-rc4-mm1
>>>>>> SPF is BASE + this series
>>>>>>
>>>>>> Kernbench:
>>>>>> ----------
>>>>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15
>>>>>> kernel (kernel is build 5 times):
>>>>>>
>>>>>> Average Half load -j 8
>>>>>>                  Run    (std deviation)
>>>>>>                  BASE                   SPF
>>>>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%
>>>>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%
>>>>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%
>>>>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%
>>>>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%
>>>>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%
>>>>>>
>>>>>> Average Optimal load -j 16
>>>>>>                  Run    (std deviation)
>>>>>>                  BASE                   SPF
>>>>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%
>>>>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%
>>>>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%
>>>>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%
>>>>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%
>>>>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%
>>>>>>
>>>>>>
>>>>>> During a run on the SPF, perf events were captured:
>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>          526743764      faults
>>>>>>                210      spf
>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>               2278      pagefault:spf_vma_notsup
>>>>>>                  0      pagefault:spf_vma_access
>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>
>>>>>> Very few speculative page faults were recorded as most of the processes
>>>>>> involved are monothreaded (sounds that on this architecture some threads
>>>>>> were created during the kernel build processing).
>>>>>>
>>>>>> Here are the kerbench results on a 80 CPUs Power8 system:
>>>>>>
>>>>>> Average Half load -j 40
>>>>>>                  Run    (std deviation)
>>>>>>                  BASE                   SPF
>>>>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%
>>>>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%
>>>>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%
>>>>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%
>>>>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%
>>>>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%
>>>>>>
>>>>>> Average Optimal load -j 80
>>>>>>                  Run    (std deviation)
>>>>>>                  BASE                   SPF
>>>>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%
>>>>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%
>>>>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%
>>>>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%
>>>>>> Context Switches 223861  (138865)       225032  (139632)        0.52%
>>>>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%
>>>>>>
>>>>>> During a run on the SPF, perf events were captured:
>>>>>>  Performance counter stats for '../kernbench -M':
>>>>>>          116730856      faults
>>>>>>                  0      spf
>>>>>>                  3      pagefault:spf_vma_changed
>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>                476      pagefault:spf_vma_notsup
>>>>>>                  0      pagefault:spf_vma_access
>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>
>>>>>> Most of the processes involved are monothreaded so SPF is not activated but
>>>>>> there is no impact on the performance.
>>>>>>
>>>>>> Ebizzy:
>>>>>> -------
>>>>>> The test is counting the number of records per second it can manage, the
>>>>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get
>>>>>> consistent result I repeated the test 100 times and measure the average
>>>>>> result. The number is the record processes per second, the higher is the
>>>>>> best.
>>>>>>
>>>>>>                 BASE            SPF             delta
>>>>>> 16 CPUs x86 VM  742.57          1490.24         100.69%
>>>>>> 80 CPUs P8 node 13105.4         24174.23        84.46%
>>>>>>
>>>>>> Here are the performance counter read during a run on a 16 CPUs x86 VM:
>>>>>>  Performance counter stats for './ebizzy -mTt 16':
>>>>>>            1706379      faults
>>>>>>            1674599      spf
>>>>>>              30588      pagefault:spf_vma_changed
>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>                363      pagefault:spf_vma_notsup
>>>>>>                  0      pagefault:spf_vma_access
>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>
>>>>>> And the ones captured during a run on a 80 CPUs Power node:
>>>>>>  Performance counter stats for './ebizzy -mTt 80':
>>>>>>            1874773      faults
>>>>>>            1461153      spf
>>>>>>             413293      pagefault:spf_vma_changed
>>>>>>                  0      pagefault:spf_vma_noanon
>>>>>>                200      pagefault:spf_vma_notsup
>>>>>>                  0      pagefault:spf_vma_access
>>>>>>                  0      pagefault:spf_pmd_changed
>>>>>>
>>>>>> In ebizzy's case most of the page fault were handled in a speculative way,
>>>>>> leading the ebizzy performance boost.
>>>>>>
>>>>>> ------------------
>>>>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):
>>>>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahendran
>>>>>>    and Minchan Kim, hopefully.
>>>>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in
>>>>>>    __do_page_fault().
>>>>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails
>>>>>>    instead
>>>>>>    of aborting the speculative page fault handling. Dropping the now
>>>>>> useless
>>>>>>    trace event pagefault:spf_pte_lock.
>>>>>>  - No more try to reuse the fetched VMA during the speculative page fault
>>>>>>    handling when retrying is needed. This adds a lot of complexity and
>>>>>>    additional tests done didn't show a significant performance improvement.
>>>>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.
>>>>>>
>>>>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at-speculative-page-faults-tt965642.html#none
>>>>>> [2] https://patchwork.kernel.org/patch/9999687/
>>>>>>
>>>>>>
>>>>>> Laurent Dufour (20):
>>>>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT
>>>>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE
>>>>>>   mm: make pte_unmap_same compatible with SPF
>>>>>>   mm: introduce INIT_VMA()
>>>>>>   mm: protect VMA modifications using VMA sequence count
>>>>>>   mm: protect mremap() against SPF hanlder
>>>>>>   mm: protect SPF handler against anon_vma changes
>>>>>>   mm: cache some VMA fields in the vm_fault structure
>>>>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()
>>>>>>   mm: introduce __lru_cache_add_active_or_unevictable
>>>>>>   mm: introduce __vm_normal_page()
>>>>>>   mm: introduce __page_add_new_anon_rmap()
>>>>>>   mm: protect mm_rb tree with a rwlock
>>>>>>   mm: adding speculative page fault failure trace events
>>>>>>   perf: add a speculative page fault sw event
>>>>>>   perf tools: add support for the SPF perf event
>>>>>>   mm: add speculative page fault vmstats
>>>>>>   powerpc/mm: add speculative page fault
>>>>>>
>>>>>> Mahendran Ganesh (2):
>>>>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>>   arm64/mm: add speculative page fault
>>>>>>
>>>>>> Peter Zijlstra (4):
>>>>>>   mm: prepare for FAULT_FLAG_SPECULATIVE
>>>>>>   mm: VMA sequence count
>>>>>>   mm: provide speculative fault infrastructure
>>>>>>   x86/mm: add speculative pagefault handling
>>>>>>
>>>>>>  arch/arm64/Kconfig                    |   1 +
>>>>>>  arch/arm64/mm/fault.c                 |  12 +
>>>>>>  arch/powerpc/Kconfig                  |   1 +
>>>>>>  arch/powerpc/mm/fault.c               |  16 +
>>>>>>  arch/x86/Kconfig                      |   1 +
>>>>>>  arch/x86/mm/fault.c                   |  27 +-
>>>>>>  fs/exec.c                             |   2 +-
>>>>>>  fs/proc/task_mmu.c                    |   5 +-
>>>>>>  fs/userfaultfd.c                      |  17 +-
>>>>>>  include/linux/hugetlb_inline.h        |   2 +-
>>>>>>  include/linux/migrate.h               |   4 +-
>>>>>>  include/linux/mm.h                    | 136 +++++++-
>>>>>>  include/linux/mm_types.h              |   7 +
>>>>>>  include/linux/pagemap.h               |   4 +-
>>>>>>  include/linux/rmap.h                  |  12 +-
>>>>>>  include/linux/swap.h                  |  10 +-
>>>>>>  include/linux/vm_event_item.h         |   3 +
>>>>>>  include/trace/events/pagefault.h      |  80 +++++
>>>>>>  include/uapi/linux/perf_event.h       |   1 +
>>>>>>  kernel/fork.c                         |   5 +-
>>>>>>  mm/Kconfig                            |  22 ++
>>>>>>  mm/huge_memory.c                      |   6 +-
>>>>>>  mm/hugetlb.c                          |   2 +
>>>>>>  mm/init-mm.c                          |   3 +
>>>>>>  mm/internal.h                         |  20 ++
>>>>>>  mm/khugepaged.c                       |   5 +
>>>>>>  mm/madvise.c                          |   6 +-
>>>>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++++++-----
>>>>>>  mm/mempolicy.c                        |  51 ++-
>>>>>>  mm/migrate.c                          |   6 +-
>>>>>>  mm/mlock.c                            |  13 +-
>>>>>>  mm/mmap.c                             | 229 ++++++++++---
>>>>>>  mm/mprotect.c                         |   4 +-
>>>>>>  mm/mremap.c                           |  13 +
>>>>>>  mm/nommu.c                            |   2 +-
>>>>>>  mm/rmap.c                             |   5 +-
>>>>>>  mm/swap.c                             |   6 +-
>>>>>>  mm/swap_state.c                       |   8 +-
>>>>>>  mm/vmstat.c                           |   5 +-
>>>>>>  tools/include/uapi/linux/perf_event.h |   1 +
>>>>>>  tools/perf/util/evsel.c               |   1 +
>>>>>>  tools/perf/util/parse-events.c        |   4 +
>>>>>>  tools/perf/util/parse-events.l        |   1 +
>>>>>>  tools/perf/util/python.c              |   1 +
>>>>>>  44 files changed, 1161 insertions(+), 211 deletions(-)
>>>>>>  create mode 100644 include/trace/events/pagefault.h
>>>>>>
>>>>>> --
>>>>>> 2.7.4
>>>>>>
>>>>>>
>>>>>
>>>>
>>>
>>
>>
> 

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2018-07-04  3:23               ` Song, HaiyanX
@ 2018-07-04  7:51                 ` Laurent Dufour
  -1 siblings, 0 replies; 58+ messages in thread
From: Laurent Dufour @ 2018-07-04  7:51 UTC (permalink / raw)
  To: Song, HaiyanX
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

On 04/07/2018 05:23, Song, HaiyanX wrote:
> Hi Laurent,
> 
> 
> For the test result on Intel 4s skylake platform (192 CPUs, 768G Memory), the below test cases all were run 3 times.
> I check the test results, only page_fault3_thread/enable THP have 6% stddev for head commit, other tests have lower stddev.

Repeating the test only 3 times seems a bit too low to me.

I'll focus on the higher change for the moment, but I don't have access to such
a hardware.

Is possible to provide a diff between base and SPF of the performance cycles
measured when running page_fault3 and page_fault2 when the 20% change is detected.

Please stay focus on the test case process to see exactly where the series is
impacting.

Thanks,
Laurent.

> 
> And I did not find other high variation on test case result.
> 
> a). Enable THP
> testcase                          base     stddev       change      head     stddev         metric
> page_fault3/enable THP           10519      A+- 3%        -20.5%      8368      A+-6%          will-it-scale.per_thread_ops
> page_fault2/enalbe THP            8281      A+- 2%        -18.8%      6728                   will-it-scale.per_thread_ops
> brk1/eanble THP                 998475                   -2.2%    976893                   will-it-scale.per_process_ops
> context_switch1/enable THP      223910                   -1.3%    220930                   will-it-scale.per_process_ops
> context_switch1/enable THP      233722                   -1.0%    231288                   will-it-scale.per_thread_ops
> 
> b). Disable THP
> page_fault3/disable THP          10856                  -23.1%      8344                   will-it-scale.per_thread_ops
> page_fault2/disable THP           8147                  -18.8%      6613                   will-it-scale.per_thread_ops
> brk1/disable THP                   957                    -7.9%      881                   will-it-scale.per_thread_ops
> context_switch1/disable THP     237006                    -2.2%    231907                  will-it-scale.per_thread_ops
> brk1/disable THP                997317                    -2.0%    977778                  will-it-scale.per_process_ops
> page_fault3/disable THP         467454                    -1.8%    459251                  will-it-scale.per_process_ops
> context_switch1/disable THP     224431                    -1.3%    221567                  will-it-scale.per_process_ops
> 
> 
> Best regards,
> Haiyan Song
> ________________________________________
> From: Laurent Dufour [ldufour@linux.vnet.ibm.com]
> Sent: Monday, July 02, 2018 4:59 PM
> To: Song, HaiyanX
> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
> Subject: Re: [PATCH v11 00/26] Speculative page faults
> 
> On 11/06/2018 09:49, Song, HaiyanX wrote:
>> Hi Laurent,
>>
>> Regression test for v11 patch serials have been run, some regression is found by LKP-tools (linux kernel performance)
>> tested on Intel 4s skylake platform. This time only test the cases which have been run and found regressions on
>> V9 patch serials.
>>
>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>> branch: Laurent-Dufour/Speculative-page-faults/20180520-045126
>> commit id:
>>   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12
>>   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1
>> Benchmark: will-it-scale
>> Download link: https://github.com/antonblanchard/will-it-scale/tree/master
>>
>> Metrics:
>>   will-it-scale.per_process_ops=processes/nr_cpu
>>   will-it-scale.per_thread_ops=threads/nr_cpu
>>   test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>> THP: enable / disable
>> nr_task:100%
>>
>> 1. Regressions:
>>
>> a). Enable THP
>> testcase                          base           change      head           metric
>> page_fault3/enable THP           10519          -20.5%        836      will-it-scale.per_thread_ops
>> page_fault2/enalbe THP            8281          -18.8%       6728      will-it-scale.per_thread_ops
>> brk1/eanble THP                 998475           -2.2%     976893      will-it-scale.per_process_ops
>> context_switch1/enable THP      223910           -1.3%     220930      will-it-scale.per_process_ops
>> context_switch1/enable THP      233722           -1.0%     231288      will-it-scale.per_thread_ops
>>
>> b). Disable THP
>> page_fault3/disable THP          10856          -23.1%       8344      will-it-scale.per_thread_ops
>> page_fault2/disable THP           8147          -18.8%       6613      will-it-scale.per_thread_ops
>> brk1/disable THP                   957           -7.9%        881      will-it-scale.per_thread_ops
>> context_switch1/disable THP     237006           -2.2%     231907      will-it-scale.per_thread_ops
>> brk1/disable THP                997317           -2.0%     977778      will-it-scale.per_process_ops
>> page_fault3/disable THP         467454           -1.8%     459251      will-it-scale.per_process_ops
>> context_switch1/disable THP     224431           -1.3%     221567      will-it-scale.per_process_ops
>>
>> Notes: for the above  values of test result, the higher is better.
> 
> I tried the same tests on my PowerPC victim VM (1024 CPUs, 11TB) and I can't
> get reproducible results. The results have huge variation, even on the vanilla
> kernel, and I can't state on any changes due to that.
> 
> I tried on smaller node (80 CPUs, 32G), and the tests ran better, but I didn't
> measure any changes between the vanilla and the SPF patched ones:
> 
> test THP enabled                4.17.0-rc4-mm1  spf             delta
> page_fault3_threads             2697.7          2683.5          -0.53%
> page_fault2_threads             170660.6        169574.1        -0.64%
> context_switch1_threads         6915269.2       6877507.3       -0.55%
> context_switch1_processes       6478076.2       6529493.5       0.79%
> brk1                            243391.2        238527.5        -2.00%
> 
> Tests were run 10 times, no high variation detected.
> 
> Did you see high variation on your side ? How many times the test were run to
> compute the average values ?
> 
> Thanks,
> Laurent.
> 
> 
>>
>> 2. Improvement: not found improvement based on the selected test cases.
>>
>>
>> Best regards
>> Haiyan Song
>> ________________________________________
>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>> Sent: Monday, May 28, 2018 4:54 PM
>> To: Song, HaiyanX
>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>
>> On 28/05/2018 10:22, Haiyan Song wrote:
>>> Hi Laurent,
>>>
>>> Yes, these tests are done on V9 patch.
>>
>> Do you plan to give this V11 a run ?
>>
>>>
>>>
>>> Best regards,
>>> Haiyan Song
>>>
>>> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:
>>>> On 28/05/2018 07:23, Song, HaiyanX wrote:
>>>>>
>>>>> Some regression and improvements is found by LKP-tools(linux kernel performance) on V9 patch series
>>>>> tested on Intel 4s Skylake platform.
>>>>
>>>> Hi,
>>>>
>>>> Thanks for reporting this benchmark results, but you mentioned the "V9 patch
>>>> series" while responding to the v11 header series...
>>>> Were these tests done on v9 or v11 ?
>>>>
>>>> Cheers,
>>>> Laurent.
>>>>
>>>>>
>>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 patch series)
>>>>> Commit id:
>>>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f
>>>>>     head commit: 0355322b3577eeab7669066df42c550a56801110
>>>>> Benchmark suite: will-it-scale
>>>>> Download link:
>>>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests
>>>>> Metrics:
>>>>>     will-it-scale.per_process_ops=processes/nr_cpu
>>>>>     will-it-scale.per_thread_ops=threads/nr_cpu
>>>>> test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>>> THP: enable / disable
>>>>> nr_task: 100%
>>>>>
>>>>> 1. Regressions:
>>>>> a) THP enabled:
>>>>> testcase                        base            change          head       metric
>>>>> page_fault3/ enable THP         10092           -17.5%          8323       will-it-scale.per_thread_ops
>>>>> page_fault2/ enable THP          8300           -17.2%          6869       will-it-scale.per_thread_ops
>>>>> brk1/ enable THP                  957.67         -7.6%           885       will-it-scale.per_thread_ops
>>>>> page_fault3/ enable THP        172821            -5.3%        163692       will-it-scale.per_process_ops
>>>>> signal1/ enable THP              9125            -3.2%          8834       will-it-scale.per_process_ops
>>>>>
>>>>> b) THP disabled:
>>>>> testcase                        base            change          head       metric
>>>>> page_fault3/ disable THP        10107           -19.1%          8180       will-it-scale.per_thread_ops
>>>>> page_fault2/ disable THP         8432           -17.8%          6931       will-it-scale.per_thread_ops
>>>>> context_switch1/ disable THP   215389            -6.8%        200776       will-it-scale.per_thread_ops
>>>>> brk1/ disable THP                 939.67         -6.6%           877.33    will-it-scale.per_thread_ops
>>>>> page_fault3/ disable THP       173145            -4.7%        165064       will-it-scale.per_process_ops
>>>>> signal1/ disable THP             9162            -3.9%          8802       will-it-scale.per_process_ops
>>>>>
>>>>> 2. Improvements:
>>>>> a) THP enabled:
>>>>> testcase                        base            change          head       metric
>>>>> malloc1/ enable THP               66.33        +469.8%           383.67    will-it-scale.per_thread_ops
>>>>> writeseek3/ enable THP          2531             +4.5%          2646       will-it-scale.per_thread_ops
>>>>> signal1/ enable THP              989.33          +2.8%          1016       will-it-scale.per_thread_ops
>>>>>
>>>>> b) THP disabled:
>>>>> testcase                        base            change          head       metric
>>>>> malloc1/ disable THP              90.33        +417.3%           467.33    will-it-scale.per_thread_ops
>>>>> read2/ disable THP             58934            +39.2%         82060       will-it-scale.per_thread_ops
>>>>> page_fault1/ disable THP        8607            +36.4%         11736       will-it-scale.per_thread_ops
>>>>> read1/ disable THP            314063            +12.7%        353934       will-it-scale.per_thread_ops
>>>>> writeseek3/ disable THP         2452            +12.5%          2759       will-it-scale.per_thread_ops
>>>>> signal1/ disable THP             971.33          +5.5%          1024       will-it-scale.per_thread_ops
>>>>>
>>>>> Notes: for above values in column "change", the higher value means that the related testcase result
>>>>> on head commit is better than that on base commit for this benchmark.
>>>>>
>>>>>
>>>>> Best regards
>>>>> Haiyan Song
>>>>>
>>>>> ________________________________________
>>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>>> Sent: Thursday, May 17, 2018 7:06 PM
>>>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi
>>>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>>> Subject: [PATCH v11 00/26] Speculative page faults
>>>>>
>>>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>>>>> page fault without holding the mm semaphore [1].
>>>>>
>>>>> The idea is to try to handle user space page faults without holding the
>>>>> mmap_sem. This should allow better concurrency for massively threaded
>>>>> process since the page fault handler will not wait for other threads memory
>>>>> layout change to be done, assuming that this change is done in another part
>>>>> of the process's memory space. This type page fault is named speculative
>>>>> page fault. If the speculative page fault fails because of a concurrency is
>>>>> detected or because underlying PMD or PTE tables are not yet allocating, it
>>>>> is failing its processing and a classic page fault is then tried.
>>>>>
>>>>> The speculative page fault (SPF) has to look for the VMA matching the fault
>>>>> address without holding the mmap_sem, this is done by introducing a rwlock
>>>>> which protects the access to the mm_rb tree. Previously this was done using
>>>>> SRCU but it was introducing a lot of scheduling to process the VMA's
>>>>> freeing operation which was hitting the performance by 20% as reported by
>>>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is
>>>>> limiting the locking contention to these operations which are expected to
>>>>> be in a O(log n) order. In addition to ensure that the VMA is not freed in
>>>>> our back a reference count is added and 2 services (get_vma() and
>>>>> put_vma()) are introduced to handle the reference count. Once a VMA is
>>>>> fetched from the RB tree using get_vma(), it must be later freed using
>>>>> put_vma(). I can't see anymore the overhead I got while will-it-scale
>>>>> benchmark anymore.
>>>>>
>>>>> The VMA's attributes checked during the speculative page fault processing
>>>>> have to be protected against parallel changes. This is done by using a per
>>>>> VMA sequence lock. This sequence lock allows the speculative page fault
>>>>> handler to fast check for parallel changes in progress and to abort the
>>>>> speculative page fault in that case.
>>>>>
>>>>> Once the VMA has been found, the speculative page fault handler would check
>>>>> for the VMA's attributes to verify that the page fault has to be handled
>>>>> correctly or not. Thus, the VMA is protected through a sequence lock which
>>>>> allows fast detection of concurrent VMA changes. If such a change is
>>>>> detected, the speculative page fault is aborted and a *classic* page fault
>>>>> is tried.  VMA sequence lockings are added when VMA attributes which are
>>>>> checked during the page fault are modified.
>>>>>
>>>>> When the PTE is fetched, the VMA is checked to see if it has been changed,
>>>>> so once the page table is locked, the VMA is valid, so any other changes
>>>>> leading to touching this PTE will need to lock the page table, so no
>>>>> parallel change is possible at this time.
>>>>>
>>>>> The locking of the PTE is done with interrupts disabled, this allows
>>>>> checking for the PMD to ensure that there is not an ongoing collapsing
>>>>> operation. Since khugepaged is firstly set the PMD to pmd_none and then is
>>>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd is
>>>>> valid at the time the PTE is locked, we have the guarantee that the
>>>>> collapsing operation will have to wait on the PTE lock to move forward.
>>>>> This allows the SPF handler to map the PTE safely. If the PMD value is
>>>>> different from the one recorded at the beginning of the SPF operation, the
>>>>> classic page fault handler will be called to handle the operation while
>>>>> holding the mmap_sem. As the PTE lock is done with the interrupts disabled,
>>>>> the lock is done using spin_trylock() to avoid dead lock when handling a
>>>>> page fault while a TLB invalidate is requested by another CPU holding the
>>>>> PTE.
>>>>>
>>>>> In pseudo code, this could be seen as:
>>>>>     speculative_page_fault()
>>>>>     {
>>>>>             vma = get_vma()
>>>>>             check vma sequence count
>>>>>             check vma's support
>>>>>             disable interrupt
>>>>>                   check pgd,p4d,...,pte
>>>>>                   save pmd and pte in vmf
>>>>>                   save vma sequence counter in vmf
>>>>>             enable interrupt
>>>>>             check vma sequence count
>>>>>             handle_pte_fault(vma)
>>>>>                     ..
>>>>>                     page = alloc_page()
>>>>>                     pte_map_lock()
>>>>>                             disable interrupt
>>>>>                                     abort if sequence counter has changed
>>>>>                                     abort if pmd or pte has changed
>>>>>                                     pte map and lock
>>>>>                             enable interrupt
>>>>>                     if abort
>>>>>                        free page
>>>>>                        abort
>>>>>                     ...
>>>>>     }
>>>>>
>>>>>     arch_fault_handler()
>>>>>     {
>>>>>             if (speculative_page_fault(&vma))
>>>>>                goto done
>>>>>     again:
>>>>>             lock(mmap_sem)
>>>>>             vma = find_vma();
>>>>>             handle_pte_fault(vma);
>>>>>             if retry
>>>>>                unlock(mmap_sem)
>>>>>                goto again;
>>>>>     done:
>>>>>             handle fault error
>>>>>     }
>>>>>
>>>>> Support for THP is not done because when checking for the PMD, we can be
>>>>> confused by an in progress collapsing operation done by khugepaged. The
>>>>> issue is that pmd_none() could be true either if the PMD is not already
>>>>> populated or if the underlying PTE are in the way to be collapsed. So we
>>>>> cannot safely allocate a PMD if pmd_none() is true.
>>>>>
>>>>> This series add a new software performance event named 'speculative-faults'
>>>>> or 'spf'. It counts the number of successful page fault event handled
>>>>> speculatively. When recording 'faults,spf' events, the faults one is
>>>>> counting the total number of page fault events while 'spf' is only counting
>>>>> the part of the faults processed speculatively.
>>>>>
>>>>> There are some trace events introduced by this series. They allow
>>>>> identifying why the page faults were not processed speculatively. This
>>>>> doesn't take in account the faults generated by a monothreaded process
>>>>> which directly processed while holding the mmap_sem. This trace events are
>>>>> grouped in a system named 'pagefault', they are:
>>>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back
>>>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.
>>>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported
>>>>>  - pagefault:spf_vma_access : the VMA's access right are not respected
>>>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in our
>>>>>    back.
>>>>>
>>>>> To record all the related events, the easier is to run perf with the
>>>>> following arguments :
>>>>> $ perf stat -e 'faults,spf,pagefault:*' <command>
>>>>>
>>>>> There is also a dedicated vmstat counter showing the number of successful
>>>>> page fault handled speculatively. I can be seen this way:
>>>>> $ grep speculative_pgfault /proc/vmstat
>>>>>
>>>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is functional
>>>>> on x86, PowerPC and arm64.
>>>>>
>>>>> ---------------------
>>>>> Real Workload results
>>>>>
>>>>> As mentioned in previous email, we did non official runs using a "popular
>>>>> in memory multithreaded database product" on 176 cores SMT8 Power system
>>>>> which showed a 30% improvements in the number of transaction processed per
>>>>> second. This run has been done on the v6 series, but changes introduced in
>>>>> this new version should not impact the performance boost seen.
>>>>>
>>>>> Here are the perf data captured during 2 of these runs on top of the v8
>>>>> series:
>>>>>                 vanilla         spf
>>>>> faults          89.418          101.364         +13%
>>>>> spf                n/a           97.989
>>>>>
>>>>> With the SPF kernel, most of the page fault were processed in a speculative
>>>>> way.
>>>>>
>>>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and gave
>>>>> it a try on an android device. He reported that the application launch time
>>>>> was improved in average by 6%, and for large applications (~100 threads) by
>>>>> 20%.
>>>>>
>>>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qcom
>>>>> MSM845 (8 cores) with 6GB (the less is better):
>>>>>
>>>>> Application                             4.9     4.9+spf delta
>>>>> com.tencent.mm                          416     389     -7%
>>>>> com.eg.android.AlipayGphone             1135    986     -13%
>>>>> com.tencent.mtt                         455     454     0%
>>>>> com.qqgame.hlddz                        1497    1409    -6%
>>>>> com.autonavi.minimap                    711     701     -1%
>>>>> com.tencent.tmgp.sgame                  788     748     -5%
>>>>> com.immomo.momo                         501     487     -3%
>>>>> com.tencent.peng                        2145    2112    -2%
>>>>> com.smile.gifmaker                      491     461     -6%
>>>>> com.baidu.BaiduMap                      479     366     -23%
>>>>> com.taobao.taobao                       1341    1198    -11%
>>>>> com.baidu.searchbox                     333     314     -6%
>>>>> com.tencent.mobileqq                    394     384     -3%
>>>>> com.sina.weibo                          907     906     0%
>>>>> com.youku.phone                         816     731     -11%
>>>>> com.happyelements.AndroidAnimal.qq      763     717     -6%
>>>>> com.UCMobile                            415     411     -1%
>>>>> com.tencent.tmgp.ak                     1464    1431    -2%
>>>>> com.tencent.qqmusic                     336     329     -2%
>>>>> com.sankuai.meituan                     1661    1302    -22%
>>>>> com.netease.cloudmusic                  1193    1200    1%
>>>>> air.tv.douyu.android                    4257    4152    -2%
>>>>>
>>>>> ------------------
>>>>> Benchmarks results
>>>>>
>>>>> Base kernel is v4.17.0-rc4-mm1
>>>>> SPF is BASE + this series
>>>>>
>>>>> Kernbench:
>>>>> ----------
>>>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15
>>>>> kernel (kernel is build 5 times):
>>>>>
>>>>> Average Half load -j 8
>>>>>                  Run    (std deviation)
>>>>>                  BASE                   SPF
>>>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%
>>>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%
>>>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%
>>>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%
>>>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%
>>>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%
>>>>>
>>>>> Average Optimal load -j 16
>>>>>                  Run    (std deviation)
>>>>>                  BASE                   SPF
>>>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%
>>>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%
>>>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%
>>>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%
>>>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%
>>>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%
>>>>>
>>>>>
>>>>> During a run on the SPF, perf events were captured:
>>>>>  Performance counter stats for '../kernbench -M':
>>>>>          526743764      faults
>>>>>                210      spf
>>>>>                  3      pagefault:spf_vma_changed
>>>>>                  0      pagefault:spf_vma_noanon
>>>>>               2278      pagefault:spf_vma_notsup
>>>>>                  0      pagefault:spf_vma_access
>>>>>                  0      pagefault:spf_pmd_changed
>>>>>
>>>>> Very few speculative page faults were recorded as most of the processes
>>>>> involved are monothreaded (sounds that on this architecture some threads
>>>>> were created during the kernel build processing).
>>>>>
>>>>> Here are the kerbench results on a 80 CPUs Power8 system:
>>>>>
>>>>> Average Half load -j 40
>>>>>                  Run    (std deviation)
>>>>>                  BASE                   SPF
>>>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%
>>>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%
>>>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%
>>>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%
>>>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%
>>>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%
>>>>>
>>>>> Average Optimal load -j 80
>>>>>                  Run    (std deviation)
>>>>>                  BASE                   SPF
>>>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%
>>>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%
>>>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%
>>>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%
>>>>> Context Switches 223861  (138865)       225032  (139632)        0.52%
>>>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%
>>>>>
>>>>> During a run on the SPF, perf events were captured:
>>>>>  Performance counter stats for '../kernbench -M':
>>>>>          116730856      faults
>>>>>                  0      spf
>>>>>                  3      pagefault:spf_vma_changed
>>>>>                  0      pagefault:spf_vma_noanon
>>>>>                476      pagefault:spf_vma_notsup
>>>>>                  0      pagefault:spf_vma_access
>>>>>                  0      pagefault:spf_pmd_changed
>>>>>
>>>>> Most of the processes involved are monothreaded so SPF is not activated but
>>>>> there is no impact on the performance.
>>>>>
>>>>> Ebizzy:
>>>>> -------
>>>>> The test is counting the number of records per second it can manage, the
>>>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get
>>>>> consistent result I repeated the test 100 times and measure the average
>>>>> result. The number is the record processes per second, the higher is the
>>>>> best.
>>>>>
>>>>>                 BASE            SPF             delta
>>>>> 16 CPUs x86 VM  742.57          1490.24         100.69%
>>>>> 80 CPUs P8 node 13105.4         24174.23        84.46%
>>>>>
>>>>> Here are the performance counter read during a run on a 16 CPUs x86 VM:
>>>>>  Performance counter stats for './ebizzy -mTt 16':
>>>>>            1706379      faults
>>>>>            1674599      spf
>>>>>              30588      pagefault:spf_vma_changed
>>>>>                  0      pagefault:spf_vma_noanon
>>>>>                363      pagefault:spf_vma_notsup
>>>>>                  0      pagefault:spf_vma_access
>>>>>                  0      pagefault:spf_pmd_changed
>>>>>
>>>>> And the ones captured during a run on a 80 CPUs Power node:
>>>>>  Performance counter stats for './ebizzy -mTt 80':
>>>>>            1874773      faults
>>>>>            1461153      spf
>>>>>             413293      pagefault:spf_vma_changed
>>>>>                  0      pagefault:spf_vma_noanon
>>>>>                200      pagefault:spf_vma_notsup
>>>>>                  0      pagefault:spf_vma_access
>>>>>                  0      pagefault:spf_pmd_changed
>>>>>
>>>>> In ebizzy's case most of the page fault were handled in a speculative way,
>>>>> leading the ebizzy performance boost.
>>>>>
>>>>> ------------------
>>>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):
>>>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahendran
>>>>>    and Minchan Kim, hopefully.
>>>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in
>>>>>    __do_page_fault().
>>>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails
>>>>>    instead
>>>>>    of aborting the speculative page fault handling. Dropping the now
>>>>> useless
>>>>>    trace event pagefault:spf_pte_lock.
>>>>>  - No more try to reuse the fetched VMA during the speculative page fault
>>>>>    handling when retrying is needed. This adds a lot of complexity and
>>>>>    additional tests done didn't show a significant performance improvement.
>>>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.
>>>>>
>>>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at-speculative-page-faults-tt965642.html#none
>>>>> [2] https://patchwork.kernel.org/patch/9999687/
>>>>>
>>>>>
>>>>> Laurent Dufour (20):
>>>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT
>>>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE
>>>>>   mm: make pte_unmap_same compatible with SPF
>>>>>   mm: introduce INIT_VMA()
>>>>>   mm: protect VMA modifications using VMA sequence count
>>>>>   mm: protect mremap() against SPF hanlder
>>>>>   mm: protect SPF handler against anon_vma changes
>>>>>   mm: cache some VMA fields in the vm_fault structure
>>>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()
>>>>>   mm: introduce __lru_cache_add_active_or_unevictable
>>>>>   mm: introduce __vm_normal_page()
>>>>>   mm: introduce __page_add_new_anon_rmap()
>>>>>   mm: protect mm_rb tree with a rwlock
>>>>>   mm: adding speculative page fault failure trace events
>>>>>   perf: add a speculative page fault sw event
>>>>>   perf tools: add support for the SPF perf event
>>>>>   mm: add speculative page fault vmstats
>>>>>   powerpc/mm: add speculative page fault
>>>>>
>>>>> Mahendran Ganesh (2):
>>>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>   arm64/mm: add speculative page fault
>>>>>
>>>>> Peter Zijlstra (4):
>>>>>   mm: prepare for FAULT_FLAG_SPECULATIVE
>>>>>   mm: VMA sequence count
>>>>>   mm: provide speculative fault infrastructure
>>>>>   x86/mm: add speculative pagefault handling
>>>>>
>>>>>  arch/arm64/Kconfig                    |   1 +
>>>>>  arch/arm64/mm/fault.c                 |  12 +
>>>>>  arch/powerpc/Kconfig                  |   1 +
>>>>>  arch/powerpc/mm/fault.c               |  16 +
>>>>>  arch/x86/Kconfig                      |   1 +
>>>>>  arch/x86/mm/fault.c                   |  27 +-
>>>>>  fs/exec.c                             |   2 +-
>>>>>  fs/proc/task_mmu.c                    |   5 +-
>>>>>  fs/userfaultfd.c                      |  17 +-
>>>>>  include/linux/hugetlb_inline.h        |   2 +-
>>>>>  include/linux/migrate.h               |   4 +-
>>>>>  include/linux/mm.h                    | 136 +++++++-
>>>>>  include/linux/mm_types.h              |   7 +
>>>>>  include/linux/pagemap.h               |   4 +-
>>>>>  include/linux/rmap.h                  |  12 +-
>>>>>  include/linux/swap.h                  |  10 +-
>>>>>  include/linux/vm_event_item.h         |   3 +
>>>>>  include/trace/events/pagefault.h      |  80 +++++
>>>>>  include/uapi/linux/perf_event.h       |   1 +
>>>>>  kernel/fork.c                         |   5 +-
>>>>>  mm/Kconfig                            |  22 ++
>>>>>  mm/huge_memory.c                      |   6 +-
>>>>>  mm/hugetlb.c                          |   2 +
>>>>>  mm/init-mm.c                          |   3 +
>>>>>  mm/internal.h                         |  20 ++
>>>>>  mm/khugepaged.c                       |   5 +
>>>>>  mm/madvise.c                          |   6 +-
>>>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++++++-----
>>>>>  mm/mempolicy.c                        |  51 ++-
>>>>>  mm/migrate.c                          |   6 +-
>>>>>  mm/mlock.c                            |  13 +-
>>>>>  mm/mmap.c                             | 229 ++++++++++---
>>>>>  mm/mprotect.c                         |   4 +-
>>>>>  mm/mremap.c                           |  13 +
>>>>>  mm/nommu.c                            |   2 +-
>>>>>  mm/rmap.c                             |   5 +-
>>>>>  mm/swap.c                             |   6 +-
>>>>>  mm/swap_state.c                       |   8 +-
>>>>>  mm/vmstat.c                           |   5 +-
>>>>>  tools/include/uapi/linux/perf_event.h |   1 +
>>>>>  tools/perf/util/evsel.c               |   1 +
>>>>>  tools/perf/util/parse-events.c        |   4 +
>>>>>  tools/perf/util/parse-events.l        |   1 +
>>>>>  tools/perf/util/python.c              |   1 +
>>>>>  44 files changed, 1161 insertions(+), 211 deletions(-)
>>>>>  create mode 100644 include/trace/events/pagefault.h
>>>>>
>>>>> --
>>>>> 2.7.4
>>>>>
>>>>>
>>>>
>>>
>>
> 
> 

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
@ 2018-07-04  7:51                 ` Laurent Dufour
  0 siblings, 0 replies; 58+ messages in thread
From: Laurent Dufour @ 2018-07-04  7:51 UTC (permalink / raw)
  To: Song, HaiyanX
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

On 04/07/2018 05:23, Song, HaiyanX wrote:
> Hi Laurent,
> 
> 
> For the test result on Intel 4s skylake platform (192 CPUs, 768G Memory), the below test cases all were run 3 times.
> I check the test results, only page_fault3_thread/enable THP have 6% stddev for head commit, other tests have lower stddev.

Repeating the test only 3 times seems a bit too low to me.

I'll focus on the higher change for the moment, but I don't have access to such
a hardware.

Is possible to provide a diff between base and SPF of the performance cycles
measured when running page_fault3 and page_fault2 when the 20% change is detected.

Please stay focus on the test case process to see exactly where the series is
impacting.

Thanks,
Laurent.

> 
> And I did not find other high variation on test case result.
> 
> a). Enable THP
> testcase                          base     stddev       change      head     stddev         metric
> page_fault3/enable THP           10519      ± 3%        -20.5%      8368      ±6%          will-it-scale.per_thread_ops
> page_fault2/enalbe THP            8281      ± 2%        -18.8%      6728                   will-it-scale.per_thread_ops
> brk1/eanble THP                 998475                   -2.2%    976893                   will-it-scale.per_process_ops
> context_switch1/enable THP      223910                   -1.3%    220930                   will-it-scale.per_process_ops
> context_switch1/enable THP      233722                   -1.0%    231288                   will-it-scale.per_thread_ops
> 
> b). Disable THP
> page_fault3/disable THP          10856                  -23.1%      8344                   will-it-scale.per_thread_ops
> page_fault2/disable THP           8147                  -18.8%      6613                   will-it-scale.per_thread_ops
> brk1/disable THP                   957                    -7.9%      881                   will-it-scale.per_thread_ops
> context_switch1/disable THP     237006                    -2.2%    231907                  will-it-scale.per_thread_ops
> brk1/disable THP                997317                    -2.0%    977778                  will-it-scale.per_process_ops
> page_fault3/disable THP         467454                    -1.8%    459251                  will-it-scale.per_process_ops
> context_switch1/disable THP     224431                    -1.3%    221567                  will-it-scale.per_process_ops
> 
> 
> Best regards,
> Haiyan Song
> ________________________________________
> From: Laurent Dufour [ldufour@linux.vnet.ibm.com]
> Sent: Monday, July 02, 2018 4:59 PM
> To: Song, HaiyanX
> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
> Subject: Re: [PATCH v11 00/26] Speculative page faults
> 
> On 11/06/2018 09:49, Song, HaiyanX wrote:
>> Hi Laurent,
>>
>> Regression test for v11 patch serials have been run, some regression is found by LKP-tools (linux kernel performance)
>> tested on Intel 4s skylake platform. This time only test the cases which have been run and found regressions on
>> V9 patch serials.
>>
>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>> branch: Laurent-Dufour/Speculative-page-faults/20180520-045126
>> commit id:
>>   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12
>>   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1
>> Benchmark: will-it-scale
>> Download link: https://github.com/antonblanchard/will-it-scale/tree/master
>>
>> Metrics:
>>   will-it-scale.per_process_ops=processes/nr_cpu
>>   will-it-scale.per_thread_ops=threads/nr_cpu
>>   test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>> THP: enable / disable
>> nr_task:100%
>>
>> 1. Regressions:
>>
>> a). Enable THP
>> testcase                          base           change      head           metric
>> page_fault3/enable THP           10519          -20.5%        836      will-it-scale.per_thread_ops
>> page_fault2/enalbe THP            8281          -18.8%       6728      will-it-scale.per_thread_ops
>> brk1/eanble THP                 998475           -2.2%     976893      will-it-scale.per_process_ops
>> context_switch1/enable THP      223910           -1.3%     220930      will-it-scale.per_process_ops
>> context_switch1/enable THP      233722           -1.0%     231288      will-it-scale.per_thread_ops
>>
>> b). Disable THP
>> page_fault3/disable THP          10856          -23.1%       8344      will-it-scale.per_thread_ops
>> page_fault2/disable THP           8147          -18.8%       6613      will-it-scale.per_thread_ops
>> brk1/disable THP                   957           -7.9%        881      will-it-scale.per_thread_ops
>> context_switch1/disable THP     237006           -2.2%     231907      will-it-scale.per_thread_ops
>> brk1/disable THP                997317           -2.0%     977778      will-it-scale.per_process_ops
>> page_fault3/disable THP         467454           -1.8%     459251      will-it-scale.per_process_ops
>> context_switch1/disable THP     224431           -1.3%     221567      will-it-scale.per_process_ops
>>
>> Notes: for the above  values of test result, the higher is better.
> 
> I tried the same tests on my PowerPC victim VM (1024 CPUs, 11TB) and I can't
> get reproducible results. The results have huge variation, even on the vanilla
> kernel, and I can't state on any changes due to that.
> 
> I tried on smaller node (80 CPUs, 32G), and the tests ran better, but I didn't
> measure any changes between the vanilla and the SPF patched ones:
> 
> test THP enabled                4.17.0-rc4-mm1  spf             delta
> page_fault3_threads             2697.7          2683.5          -0.53%
> page_fault2_threads             170660.6        169574.1        -0.64%
> context_switch1_threads         6915269.2       6877507.3       -0.55%
> context_switch1_processes       6478076.2       6529493.5       0.79%
> brk1                            243391.2        238527.5        -2.00%
> 
> Tests were run 10 times, no high variation detected.
> 
> Did you see high variation on your side ? How many times the test were run to
> compute the average values ?
> 
> Thanks,
> Laurent.
> 
> 
>>
>> 2. Improvement: not found improvement based on the selected test cases.
>>
>>
>> Best regards
>> Haiyan Song
>> ________________________________________
>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>> Sent: Monday, May 28, 2018 4:54 PM
>> To: Song, HaiyanX
>> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>> Subject: Re: [PATCH v11 00/26] Speculative page faults
>>
>> On 28/05/2018 10:22, Haiyan Song wrote:
>>> Hi Laurent,
>>>
>>> Yes, these tests are done on V9 patch.
>>
>> Do you plan to give this V11 a run ?
>>
>>>
>>>
>>> Best regards,
>>> Haiyan Song
>>>
>>> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:
>>>> On 28/05/2018 07:23, Song, HaiyanX wrote:
>>>>>
>>>>> Some regression and improvements is found by LKP-tools(linux kernel performance) on V9 patch series
>>>>> tested on Intel 4s Skylake platform.
>>>>
>>>> Hi,
>>>>
>>>> Thanks for reporting this benchmark results, but you mentioned the "V9 patch
>>>> series" while responding to the v11 header series...
>>>> Were these tests done on v9 or v11 ?
>>>>
>>>> Cheers,
>>>> Laurent.
>>>>
>>>>>
>>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 patch series)
>>>>> Commit id:
>>>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f
>>>>>     head commit: 0355322b3577eeab7669066df42c550a56801110
>>>>> Benchmark suite: will-it-scale
>>>>> Download link:
>>>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests
>>>>> Metrics:
>>>>>     will-it-scale.per_process_ops=processes/nr_cpu
>>>>>     will-it-scale.per_thread_ops=threads/nr_cpu
>>>>> test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>>> THP: enable / disable
>>>>> nr_task: 100%
>>>>>
>>>>> 1. Regressions:
>>>>> a) THP enabled:
>>>>> testcase                        base            change          head       metric
>>>>> page_fault3/ enable THP         10092           -17.5%          8323       will-it-scale.per_thread_ops
>>>>> page_fault2/ enable THP          8300           -17.2%          6869       will-it-scale.per_thread_ops
>>>>> brk1/ enable THP                  957.67         -7.6%           885       will-it-scale.per_thread_ops
>>>>> page_fault3/ enable THP        172821            -5.3%        163692       will-it-scale.per_process_ops
>>>>> signal1/ enable THP              9125            -3.2%          8834       will-it-scale.per_process_ops
>>>>>
>>>>> b) THP disabled:
>>>>> testcase                        base            change          head       metric
>>>>> page_fault3/ disable THP        10107           -19.1%          8180       will-it-scale.per_thread_ops
>>>>> page_fault2/ disable THP         8432           -17.8%          6931       will-it-scale.per_thread_ops
>>>>> context_switch1/ disable THP   215389            -6.8%        200776       will-it-scale.per_thread_ops
>>>>> brk1/ disable THP                 939.67         -6.6%           877.33    will-it-scale.per_thread_ops
>>>>> page_fault3/ disable THP       173145            -4.7%        165064       will-it-scale.per_process_ops
>>>>> signal1/ disable THP             9162            -3.9%          8802       will-it-scale.per_process_ops
>>>>>
>>>>> 2. Improvements:
>>>>> a) THP enabled:
>>>>> testcase                        base            change          head       metric
>>>>> malloc1/ enable THP               66.33        +469.8%           383.67    will-it-scale.per_thread_ops
>>>>> writeseek3/ enable THP          2531             +4.5%          2646       will-it-scale.per_thread_ops
>>>>> signal1/ enable THP              989.33          +2.8%          1016       will-it-scale.per_thread_ops
>>>>>
>>>>> b) THP disabled:
>>>>> testcase                        base            change          head       metric
>>>>> malloc1/ disable THP              90.33        +417.3%           467.33    will-it-scale.per_thread_ops
>>>>> read2/ disable THP             58934            +39.2%         82060       will-it-scale.per_thread_ops
>>>>> page_fault1/ disable THP        8607            +36.4%         11736       will-it-scale.per_thread_ops
>>>>> read1/ disable THP            314063            +12.7%        353934       will-it-scale.per_thread_ops
>>>>> writeseek3/ disable THP         2452            +12.5%          2759       will-it-scale.per_thread_ops
>>>>> signal1/ disable THP             971.33          +5.5%          1024       will-it-scale.per_thread_ops
>>>>>
>>>>> Notes: for above values in column "change", the higher value means that the related testcase result
>>>>> on head commit is better than that on base commit for this benchmark.
>>>>>
>>>>>
>>>>> Best regards
>>>>> Haiyan Song
>>>>>
>>>>> ________________________________________
>>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>>> Sent: Thursday, May 17, 2018 7:06 PM
>>>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi
>>>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>>> Subject: [PATCH v11 00/26] Speculative page faults
>>>>>
>>>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>>>>> page fault without holding the mm semaphore [1].
>>>>>
>>>>> The idea is to try to handle user space page faults without holding the
>>>>> mmap_sem. This should allow better concurrency for massively threaded
>>>>> process since the page fault handler will not wait for other threads memory
>>>>> layout change to be done, assuming that this change is done in another part
>>>>> of the process's memory space. This type page fault is named speculative
>>>>> page fault. If the speculative page fault fails because of a concurrency is
>>>>> detected or because underlying PMD or PTE tables are not yet allocating, it
>>>>> is failing its processing and a classic page fault is then tried.
>>>>>
>>>>> The speculative page fault (SPF) has to look for the VMA matching the fault
>>>>> address without holding the mmap_sem, this is done by introducing a rwlock
>>>>> which protects the access to the mm_rb tree. Previously this was done using
>>>>> SRCU but it was introducing a lot of scheduling to process the VMA's
>>>>> freeing operation which was hitting the performance by 20% as reported by
>>>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is
>>>>> limiting the locking contention to these operations which are expected to
>>>>> be in a O(log n) order. In addition to ensure that the VMA is not freed in
>>>>> our back a reference count is added and 2 services (get_vma() and
>>>>> put_vma()) are introduced to handle the reference count. Once a VMA is
>>>>> fetched from the RB tree using get_vma(), it must be later freed using
>>>>> put_vma(). I can't see anymore the overhead I got while will-it-scale
>>>>> benchmark anymore.
>>>>>
>>>>> The VMA's attributes checked during the speculative page fault processing
>>>>> have to be protected against parallel changes. This is done by using a per
>>>>> VMA sequence lock. This sequence lock allows the speculative page fault
>>>>> handler to fast check for parallel changes in progress and to abort the
>>>>> speculative page fault in that case.
>>>>>
>>>>> Once the VMA has been found, the speculative page fault handler would check
>>>>> for the VMA's attributes to verify that the page fault has to be handled
>>>>> correctly or not. Thus, the VMA is protected through a sequence lock which
>>>>> allows fast detection of concurrent VMA changes. If such a change is
>>>>> detected, the speculative page fault is aborted and a *classic* page fault
>>>>> is tried.  VMA sequence lockings are added when VMA attributes which are
>>>>> checked during the page fault are modified.
>>>>>
>>>>> When the PTE is fetched, the VMA is checked to see if it has been changed,
>>>>> so once the page table is locked, the VMA is valid, so any other changes
>>>>> leading to touching this PTE will need to lock the page table, so no
>>>>> parallel change is possible at this time.
>>>>>
>>>>> The locking of the PTE is done with interrupts disabled, this allows
>>>>> checking for the PMD to ensure that there is not an ongoing collapsing
>>>>> operation. Since khugepaged is firstly set the PMD to pmd_none and then is
>>>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd is
>>>>> valid at the time the PTE is locked, we have the guarantee that the
>>>>> collapsing operation will have to wait on the PTE lock to move forward.
>>>>> This allows the SPF handler to map the PTE safely. If the PMD value is
>>>>> different from the one recorded at the beginning of the SPF operation, the
>>>>> classic page fault handler will be called to handle the operation while
>>>>> holding the mmap_sem. As the PTE lock is done with the interrupts disabled,
>>>>> the lock is done using spin_trylock() to avoid dead lock when handling a
>>>>> page fault while a TLB invalidate is requested by another CPU holding the
>>>>> PTE.
>>>>>
>>>>> In pseudo code, this could be seen as:
>>>>>     speculative_page_fault()
>>>>>     {
>>>>>             vma = get_vma()
>>>>>             check vma sequence count
>>>>>             check vma's support
>>>>>             disable interrupt
>>>>>                   check pgd,p4d,...,pte
>>>>>                   save pmd and pte in vmf
>>>>>                   save vma sequence counter in vmf
>>>>>             enable interrupt
>>>>>             check vma sequence count
>>>>>             handle_pte_fault(vma)
>>>>>                     ..
>>>>>                     page = alloc_page()
>>>>>                     pte_map_lock()
>>>>>                             disable interrupt
>>>>>                                     abort if sequence counter has changed
>>>>>                                     abort if pmd or pte has changed
>>>>>                                     pte map and lock
>>>>>                             enable interrupt
>>>>>                     if abort
>>>>>                        free page
>>>>>                        abort
>>>>>                     ...
>>>>>     }
>>>>>
>>>>>     arch_fault_handler()
>>>>>     {
>>>>>             if (speculative_page_fault(&vma))
>>>>>                goto done
>>>>>     again:
>>>>>             lock(mmap_sem)
>>>>>             vma = find_vma();
>>>>>             handle_pte_fault(vma);
>>>>>             if retry
>>>>>                unlock(mmap_sem)
>>>>>                goto again;
>>>>>     done:
>>>>>             handle fault error
>>>>>     }
>>>>>
>>>>> Support for THP is not done because when checking for the PMD, we can be
>>>>> confused by an in progress collapsing operation done by khugepaged. The
>>>>> issue is that pmd_none() could be true either if the PMD is not already
>>>>> populated or if the underlying PTE are in the way to be collapsed. So we
>>>>> cannot safely allocate a PMD if pmd_none() is true.
>>>>>
>>>>> This series add a new software performance event named 'speculative-faults'
>>>>> or 'spf'. It counts the number of successful page fault event handled
>>>>> speculatively. When recording 'faults,spf' events, the faults one is
>>>>> counting the total number of page fault events while 'spf' is only counting
>>>>> the part of the faults processed speculatively.
>>>>>
>>>>> There are some trace events introduced by this series. They allow
>>>>> identifying why the page faults were not processed speculatively. This
>>>>> doesn't take in account the faults generated by a monothreaded process
>>>>> which directly processed while holding the mmap_sem. This trace events are
>>>>> grouped in a system named 'pagefault', they are:
>>>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back
>>>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.
>>>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported
>>>>>  - pagefault:spf_vma_access : the VMA's access right are not respected
>>>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in our
>>>>>    back.
>>>>>
>>>>> To record all the related events, the easier is to run perf with the
>>>>> following arguments :
>>>>> $ perf stat -e 'faults,spf,pagefault:*' <command>
>>>>>
>>>>> There is also a dedicated vmstat counter showing the number of successful
>>>>> page fault handled speculatively. I can be seen this way:
>>>>> $ grep speculative_pgfault /proc/vmstat
>>>>>
>>>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is functional
>>>>> on x86, PowerPC and arm64.
>>>>>
>>>>> ---------------------
>>>>> Real Workload results
>>>>>
>>>>> As mentioned in previous email, we did non official runs using a "popular
>>>>> in memory multithreaded database product" on 176 cores SMT8 Power system
>>>>> which showed a 30% improvements in the number of transaction processed per
>>>>> second. This run has been done on the v6 series, but changes introduced in
>>>>> this new version should not impact the performance boost seen.
>>>>>
>>>>> Here are the perf data captured during 2 of these runs on top of the v8
>>>>> series:
>>>>>                 vanilla         spf
>>>>> faults          89.418          101.364         +13%
>>>>> spf                n/a           97.989
>>>>>
>>>>> With the SPF kernel, most of the page fault were processed in a speculative
>>>>> way.
>>>>>
>>>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and gave
>>>>> it a try on an android device. He reported that the application launch time
>>>>> was improved in average by 6%, and for large applications (~100 threads) by
>>>>> 20%.
>>>>>
>>>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qcom
>>>>> MSM845 (8 cores) with 6GB (the less is better):
>>>>>
>>>>> Application                             4.9     4.9+spf delta
>>>>> com.tencent.mm                          416     389     -7%
>>>>> com.eg.android.AlipayGphone             1135    986     -13%
>>>>> com.tencent.mtt                         455     454     0%
>>>>> com.qqgame.hlddz                        1497    1409    -6%
>>>>> com.autonavi.minimap                    711     701     -1%
>>>>> com.tencent.tmgp.sgame                  788     748     -5%
>>>>> com.immomo.momo                         501     487     -3%
>>>>> com.tencent.peng                        2145    2112    -2%
>>>>> com.smile.gifmaker                      491     461     -6%
>>>>> com.baidu.BaiduMap                      479     366     -23%
>>>>> com.taobao.taobao                       1341    1198    -11%
>>>>> com.baidu.searchbox                     333     314     -6%
>>>>> com.tencent.mobileqq                    394     384     -3%
>>>>> com.sina.weibo                          907     906     0%
>>>>> com.youku.phone                         816     731     -11%
>>>>> com.happyelements.AndroidAnimal.qq      763     717     -6%
>>>>> com.UCMobile                            415     411     -1%
>>>>> com.tencent.tmgp.ak                     1464    1431    -2%
>>>>> com.tencent.qqmusic                     336     329     -2%
>>>>> com.sankuai.meituan                     1661    1302    -22%
>>>>> com.netease.cloudmusic                  1193    1200    1%
>>>>> air.tv.douyu.android                    4257    4152    -2%
>>>>>
>>>>> ------------------
>>>>> Benchmarks results
>>>>>
>>>>> Base kernel is v4.17.0-rc4-mm1
>>>>> SPF is BASE + this series
>>>>>
>>>>> Kernbench:
>>>>> ----------
>>>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15
>>>>> kernel (kernel is build 5 times):
>>>>>
>>>>> Average Half load -j 8
>>>>>                  Run    (std deviation)
>>>>>                  BASE                   SPF
>>>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%
>>>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%
>>>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%
>>>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%
>>>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%
>>>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%
>>>>>
>>>>> Average Optimal load -j 16
>>>>>                  Run    (std deviation)
>>>>>                  BASE                   SPF
>>>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%
>>>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%
>>>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%
>>>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%
>>>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%
>>>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%
>>>>>
>>>>>
>>>>> During a run on the SPF, perf events were captured:
>>>>>  Performance counter stats for '../kernbench -M':
>>>>>          526743764      faults
>>>>>                210      spf
>>>>>                  3      pagefault:spf_vma_changed
>>>>>                  0      pagefault:spf_vma_noanon
>>>>>               2278      pagefault:spf_vma_notsup
>>>>>                  0      pagefault:spf_vma_access
>>>>>                  0      pagefault:spf_pmd_changed
>>>>>
>>>>> Very few speculative page faults were recorded as most of the processes
>>>>> involved are monothreaded (sounds that on this architecture some threads
>>>>> were created during the kernel build processing).
>>>>>
>>>>> Here are the kerbench results on a 80 CPUs Power8 system:
>>>>>
>>>>> Average Half load -j 40
>>>>>                  Run    (std deviation)
>>>>>                  BASE                   SPF
>>>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%
>>>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%
>>>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%
>>>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%
>>>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%
>>>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%
>>>>>
>>>>> Average Optimal load -j 80
>>>>>                  Run    (std deviation)
>>>>>                  BASE                   SPF
>>>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%
>>>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%
>>>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%
>>>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%
>>>>> Context Switches 223861  (138865)       225032  (139632)        0.52%
>>>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%
>>>>>
>>>>> During a run on the SPF, perf events were captured:
>>>>>  Performance counter stats for '../kernbench -M':
>>>>>          116730856      faults
>>>>>                  0      spf
>>>>>                  3      pagefault:spf_vma_changed
>>>>>                  0      pagefault:spf_vma_noanon
>>>>>                476      pagefault:spf_vma_notsup
>>>>>                  0      pagefault:spf_vma_access
>>>>>                  0      pagefault:spf_pmd_changed
>>>>>
>>>>> Most of the processes involved are monothreaded so SPF is not activated but
>>>>> there is no impact on the performance.
>>>>>
>>>>> Ebizzy:
>>>>> -------
>>>>> The test is counting the number of records per second it can manage, the
>>>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get
>>>>> consistent result I repeated the test 100 times and measure the average
>>>>> result. The number is the record processes per second, the higher is the
>>>>> best.
>>>>>
>>>>>                 BASE            SPF             delta
>>>>> 16 CPUs x86 VM  742.57          1490.24         100.69%
>>>>> 80 CPUs P8 node 13105.4         24174.23        84.46%
>>>>>
>>>>> Here are the performance counter read during a run on a 16 CPUs x86 VM:
>>>>>  Performance counter stats for './ebizzy -mTt 16':
>>>>>            1706379      faults
>>>>>            1674599      spf
>>>>>              30588      pagefault:spf_vma_changed
>>>>>                  0      pagefault:spf_vma_noanon
>>>>>                363      pagefault:spf_vma_notsup
>>>>>                  0      pagefault:spf_vma_access
>>>>>                  0      pagefault:spf_pmd_changed
>>>>>
>>>>> And the ones captured during a run on a 80 CPUs Power node:
>>>>>  Performance counter stats for './ebizzy -mTt 80':
>>>>>            1874773      faults
>>>>>            1461153      spf
>>>>>             413293      pagefault:spf_vma_changed
>>>>>                  0      pagefault:spf_vma_noanon
>>>>>                200      pagefault:spf_vma_notsup
>>>>>                  0      pagefault:spf_vma_access
>>>>>                  0      pagefault:spf_pmd_changed
>>>>>
>>>>> In ebizzy's case most of the page fault were handled in a speculative way,
>>>>> leading the ebizzy performance boost.
>>>>>
>>>>> ------------------
>>>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):
>>>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahendran
>>>>>    and Minchan Kim, hopefully.
>>>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in
>>>>>    __do_page_fault().
>>>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails
>>>>>    instead
>>>>>    of aborting the speculative page fault handling. Dropping the now
>>>>> useless
>>>>>    trace event pagefault:spf_pte_lock.
>>>>>  - No more try to reuse the fetched VMA during the speculative page fault
>>>>>    handling when retrying is needed. This adds a lot of complexity and
>>>>>    additional tests done didn't show a significant performance improvement.
>>>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.
>>>>>
>>>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at-speculative-page-faults-tt965642.html#none
>>>>> [2] https://patchwork.kernel.org/patch/9999687/
>>>>>
>>>>>
>>>>> Laurent Dufour (20):
>>>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT
>>>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE
>>>>>   mm: make pte_unmap_same compatible with SPF
>>>>>   mm: introduce INIT_VMA()
>>>>>   mm: protect VMA modifications using VMA sequence count
>>>>>   mm: protect mremap() against SPF hanlder
>>>>>   mm: protect SPF handler against anon_vma changes
>>>>>   mm: cache some VMA fields in the vm_fault structure
>>>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()
>>>>>   mm: introduce __lru_cache_add_active_or_unevictable
>>>>>   mm: introduce __vm_normal_page()
>>>>>   mm: introduce __page_add_new_anon_rmap()
>>>>>   mm: protect mm_rb tree with a rwlock
>>>>>   mm: adding speculative page fault failure trace events
>>>>>   perf: add a speculative page fault sw event
>>>>>   perf tools: add support for the SPF perf event
>>>>>   mm: add speculative page fault vmstats
>>>>>   powerpc/mm: add speculative page fault
>>>>>
>>>>> Mahendran Ganesh (2):
>>>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>>   arm64/mm: add speculative page fault
>>>>>
>>>>> Peter Zijlstra (4):
>>>>>   mm: prepare for FAULT_FLAG_SPECULATIVE
>>>>>   mm: VMA sequence count
>>>>>   mm: provide speculative fault infrastructure
>>>>>   x86/mm: add speculative pagefault handling
>>>>>
>>>>>  arch/arm64/Kconfig                    |   1 +
>>>>>  arch/arm64/mm/fault.c                 |  12 +
>>>>>  arch/powerpc/Kconfig                  |   1 +
>>>>>  arch/powerpc/mm/fault.c               |  16 +
>>>>>  arch/x86/Kconfig                      |   1 +
>>>>>  arch/x86/mm/fault.c                   |  27 +-
>>>>>  fs/exec.c                             |   2 +-
>>>>>  fs/proc/task_mmu.c                    |   5 +-
>>>>>  fs/userfaultfd.c                      |  17 +-
>>>>>  include/linux/hugetlb_inline.h        |   2 +-
>>>>>  include/linux/migrate.h               |   4 +-
>>>>>  include/linux/mm.h                    | 136 +++++++-
>>>>>  include/linux/mm_types.h              |   7 +
>>>>>  include/linux/pagemap.h               |   4 +-
>>>>>  include/linux/rmap.h                  |  12 +-
>>>>>  include/linux/swap.h                  |  10 +-
>>>>>  include/linux/vm_event_item.h         |   3 +
>>>>>  include/trace/events/pagefault.h      |  80 +++++
>>>>>  include/uapi/linux/perf_event.h       |   1 +
>>>>>  kernel/fork.c                         |   5 +-
>>>>>  mm/Kconfig                            |  22 ++
>>>>>  mm/huge_memory.c                      |   6 +-
>>>>>  mm/hugetlb.c                          |   2 +
>>>>>  mm/init-mm.c                          |   3 +
>>>>>  mm/internal.h                         |  20 ++
>>>>>  mm/khugepaged.c                       |   5 +
>>>>>  mm/madvise.c                          |   6 +-
>>>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++++++-----
>>>>>  mm/mempolicy.c                        |  51 ++-
>>>>>  mm/migrate.c                          |   6 +-
>>>>>  mm/mlock.c                            |  13 +-
>>>>>  mm/mmap.c                             | 229 ++++++++++---
>>>>>  mm/mprotect.c                         |   4 +-
>>>>>  mm/mremap.c                           |  13 +
>>>>>  mm/nommu.c                            |   2 +-
>>>>>  mm/rmap.c                             |   5 +-
>>>>>  mm/swap.c                             |   6 +-
>>>>>  mm/swap_state.c                       |   8 +-
>>>>>  mm/vmstat.c                           |   5 +-
>>>>>  tools/include/uapi/linux/perf_event.h |   1 +
>>>>>  tools/perf/util/evsel.c               |   1 +
>>>>>  tools/perf/util/parse-events.c        |   4 +
>>>>>  tools/perf/util/parse-events.l        |   1 +
>>>>>  tools/perf/util/python.c              |   1 +
>>>>>  44 files changed, 1161 insertions(+), 211 deletions(-)
>>>>>  create mode 100644 include/trace/events/pagefault.h
>>>>>
>>>>> --
>>>>> 2.7.4
>>>>>
>>>>>
>>>>
>>>
>>
> 
> 

^ permalink raw reply	[flat|nested] 58+ messages in thread

* RE: [PATCH v11 00/26] Speculative page faults
  2018-07-02  8:59           ` Laurent Dufour
@ 2018-07-04  3:23               ` Song, HaiyanX
  0 siblings, 0 replies; 58+ messages in thread
From: Song, HaiyanX @ 2018-07-04  3:23 UTC (permalink / raw)
  To: Laurent Dufour
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

Hi Laurent,


For the test result on Intel 4s skylake platform (192 CPUs, 768G Memory), the below test cases all were run 3 times.
I check the test results, only page_fault3_thread/enable THP have 6% stddev for head commit, other tests have lower stddev.

And I did not find other high variation on test case result.

a). Enable THP
testcase                          base     stddev       change      head     stddev         metric
page_fault3/enable THP           10519      ± 3%        -20.5%      8368      ±6%          will-it-scale.per_thread_ops
page_fault2/enalbe THP            8281      ± 2%        -18.8%      6728                   will-it-scale.per_thread_ops
brk1/eanble THP                 998475                   -2.2%    976893                   will-it-scale.per_process_ops
context_switch1/enable THP      223910                   -1.3%    220930                   will-it-scale.per_process_ops
context_switch1/enable THP      233722                   -1.0%    231288                   will-it-scale.per_thread_ops

b). Disable THP
page_fault3/disable THP          10856                  -23.1%      8344                   will-it-scale.per_thread_ops
page_fault2/disable THP           8147                  -18.8%      6613                   will-it-scale.per_thread_ops
brk1/disable THP                   957                    -7.9%      881                   will-it-scale.per_thread_ops
context_switch1/disable THP     237006                    -2.2%    231907                  will-it-scale.per_thread_ops
brk1/disable THP                997317                    -2.0%    977778                  will-it-scale.per_process_ops
page_fault3/disable THP         467454                    -1.8%    459251                  will-it-scale.per_process_ops
context_switch1/disable THP     224431                    -1.3%    221567                  will-it-scale.per_process_ops


Best regards,
Haiyan Song
________________________________________
From: Laurent Dufour [ldufour@linux.vnet.ibm.com]
Sent: Monday, July 02, 2018 4:59 PM
To: Song, HaiyanX
Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
Subject: Re: [PATCH v11 00/26] Speculative page faults

On 11/06/2018 09:49, Song, HaiyanX wrote:
> Hi Laurent,
>
> Regression test for v11 patch serials have been run, some regression is found by LKP-tools (linux kernel performance)
> tested on Intel 4s skylake platform. This time only test the cases which have been run and found regressions on
> V9 patch serials.
>
> The regression result is sorted by the metric will-it-scale.per_thread_ops.
> branch: Laurent-Dufour/Speculative-page-faults/20180520-045126
> commit id:
>   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12
>   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1
> Benchmark: will-it-scale
> Download link: https://github.com/antonblanchard/will-it-scale/tree/master
>
> Metrics:
>   will-it-scale.per_process_ops=processes/nr_cpu
>   will-it-scale.per_thread_ops=threads/nr_cpu
>   test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
> THP: enable / disable
> nr_task:100%
>
> 1. Regressions:
>
> a). Enable THP
> testcase                          base           change      head           metric
> page_fault3/enable THP           10519          -20.5%        836      will-it-scale.per_thread_ops
> page_fault2/enalbe THP            8281          -18.8%       6728      will-it-scale.per_thread_ops
> brk1/eanble THP                 998475           -2.2%     976893      will-it-scale.per_process_ops
> context_switch1/enable THP      223910           -1.3%     220930      will-it-scale.per_process_ops
> context_switch1/enable THP      233722           -1.0%     231288      will-it-scale.per_thread_ops
>
> b). Disable THP
> page_fault3/disable THP          10856          -23.1%       8344      will-it-scale.per_thread_ops
> page_fault2/disable THP           8147          -18.8%       6613      will-it-scale.per_thread_ops
> brk1/disable THP                   957           -7.9%        881      will-it-scale.per_thread_ops
> context_switch1/disable THP     237006           -2.2%     231907      will-it-scale.per_thread_ops
> brk1/disable THP                997317           -2.0%     977778      will-it-scale.per_process_ops
> page_fault3/disable THP         467454           -1.8%     459251      will-it-scale.per_process_ops
> context_switch1/disable THP     224431           -1.3%     221567      will-it-scale.per_process_ops
>
> Notes: for the above  values of test result, the higher is better.

I tried the same tests on my PowerPC victim VM (1024 CPUs, 11TB) and I can't
get reproducible results. The results have huge variation, even on the vanilla
kernel, and I can't state on any changes due to that.

I tried on smaller node (80 CPUs, 32G), and the tests ran better, but I didn't
measure any changes between the vanilla and the SPF patched ones:

test THP enabled                4.17.0-rc4-mm1  spf             delta
page_fault3_threads             2697.7          2683.5          -0.53%
page_fault2_threads             170660.6        169574.1        -0.64%
context_switch1_threads         6915269.2       6877507.3       -0.55%
context_switch1_processes       6478076.2       6529493.5       0.79%
brk1                            243391.2        238527.5        -2.00%

Tests were run 10 times, no high variation detected.

Did you see high variation on your side ? How many times the test were run to
compute the average values ?

Thanks,
Laurent.


>
> 2. Improvement: not found improvement based on the selected test cases.
>
>
> Best regards
> Haiyan Song
> ________________________________________
> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
> Sent: Monday, May 28, 2018 4:54 PM
> To: Song, HaiyanX
> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
> Subject: Re: [PATCH v11 00/26] Speculative page faults
>
> On 28/05/2018 10:22, Haiyan Song wrote:
>> Hi Laurent,
>>
>> Yes, these tests are done on V9 patch.
>
> Do you plan to give this V11 a run ?
>
>>
>>
>> Best regards,
>> Haiyan Song
>>
>> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:
>>> On 28/05/2018 07:23, Song, HaiyanX wrote:
>>>>
>>>> Some regression and improvements is found by LKP-tools(linux kernel performance) on V9 patch series
>>>> tested on Intel 4s Skylake platform.
>>>
>>> Hi,
>>>
>>> Thanks for reporting this benchmark results, but you mentioned the "V9 patch
>>> series" while responding to the v11 header series...
>>> Were these tests done on v9 or v11 ?
>>>
>>> Cheers,
>>> Laurent.
>>>
>>>>
>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 patch series)
>>>> Commit id:
>>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f
>>>>     head commit: 0355322b3577eeab7669066df42c550a56801110
>>>> Benchmark suite: will-it-scale
>>>> Download link:
>>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests
>>>> Metrics:
>>>>     will-it-scale.per_process_ops=processes/nr_cpu
>>>>     will-it-scale.per_thread_ops=threads/nr_cpu
>>>> test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>> THP: enable / disable
>>>> nr_task: 100%
>>>>
>>>> 1. Regressions:
>>>> a) THP enabled:
>>>> testcase                        base            change          head       metric
>>>> page_fault3/ enable THP         10092           -17.5%          8323       will-it-scale.per_thread_ops
>>>> page_fault2/ enable THP          8300           -17.2%          6869       will-it-scale.per_thread_ops
>>>> brk1/ enable THP                  957.67         -7.6%           885       will-it-scale.per_thread_ops
>>>> page_fault3/ enable THP        172821            -5.3%        163692       will-it-scale.per_process_ops
>>>> signal1/ enable THP              9125            -3.2%          8834       will-it-scale.per_process_ops
>>>>
>>>> b) THP disabled:
>>>> testcase                        base            change          head       metric
>>>> page_fault3/ disable THP        10107           -19.1%          8180       will-it-scale.per_thread_ops
>>>> page_fault2/ disable THP         8432           -17.8%          6931       will-it-scale.per_thread_ops
>>>> context_switch1/ disable THP   215389            -6.8%        200776       will-it-scale.per_thread_ops
>>>> brk1/ disable THP                 939.67         -6.6%           877.33    will-it-scale.per_thread_ops
>>>> page_fault3/ disable THP       173145            -4.7%        165064       will-it-scale.per_process_ops
>>>> signal1/ disable THP             9162            -3.9%          8802       will-it-scale.per_process_ops
>>>>
>>>> 2. Improvements:
>>>> a) THP enabled:
>>>> testcase                        base            change          head       metric
>>>> malloc1/ enable THP               66.33        +469.8%           383.67    will-it-scale.per_thread_ops
>>>> writeseek3/ enable THP          2531             +4.5%          2646       will-it-scale.per_thread_ops
>>>> signal1/ enable THP              989.33          +2.8%          1016       will-it-scale.per_thread_ops
>>>>
>>>> b) THP disabled:
>>>> testcase                        base            change          head       metric
>>>> malloc1/ disable THP              90.33        +417.3%           467.33    will-it-scale.per_thread_ops
>>>> read2/ disable THP             58934            +39.2%         82060       will-it-scale.per_thread_ops
>>>> page_fault1/ disable THP        8607            +36.4%         11736       will-it-scale.per_thread_ops
>>>> read1/ disable THP            314063            +12.7%        353934       will-it-scale.per_thread_ops
>>>> writeseek3/ disable THP         2452            +12.5%          2759       will-it-scale.per_thread_ops
>>>> signal1/ disable THP             971.33          +5.5%          1024       will-it-scale.per_thread_ops
>>>>
>>>> Notes: for above values in column "change", the higher value means that the related testcase result
>>>> on head commit is better than that on base commit for this benchmark.
>>>>
>>>>
>>>> Best regards
>>>> Haiyan Song
>>>>
>>>> ________________________________________
>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>> Sent: Thursday, May 17, 2018 7:06 PM
>>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi
>>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>> Subject: [PATCH v11 00/26] Speculative page faults
>>>>
>>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>>>> page fault without holding the mm semaphore [1].
>>>>
>>>> The idea is to try to handle user space page faults without holding the
>>>> mmap_sem. This should allow better concurrency for massively threaded
>>>> process since the page fault handler will not wait for other threads memory
>>>> layout change to be done, assuming that this change is done in another part
>>>> of the process's memory space. This type page fault is named speculative
>>>> page fault. If the speculative page fault fails because of a concurrency is
>>>> detected or because underlying PMD or PTE tables are not yet allocating, it
>>>> is failing its processing and a classic page fault is then tried.
>>>>
>>>> The speculative page fault (SPF) has to look for the VMA matching the fault
>>>> address without holding the mmap_sem, this is done by introducing a rwlock
>>>> which protects the access to the mm_rb tree. Previously this was done using
>>>> SRCU but it was introducing a lot of scheduling to process the VMA's
>>>> freeing operation which was hitting the performance by 20% as reported by
>>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is
>>>> limiting the locking contention to these operations which are expected to
>>>> be in a O(log n) order. In addition to ensure that the VMA is not freed in
>>>> our back a reference count is added and 2 services (get_vma() and
>>>> put_vma()) are introduced to handle the reference count. Once a VMA is
>>>> fetched from the RB tree using get_vma(), it must be later freed using
>>>> put_vma(). I can't see anymore the overhead I got while will-it-scale
>>>> benchmark anymore.
>>>>
>>>> The VMA's attributes checked during the speculative page fault processing
>>>> have to be protected against parallel changes. This is done by using a per
>>>> VMA sequence lock. This sequence lock allows the speculative page fault
>>>> handler to fast check for parallel changes in progress and to abort the
>>>> speculative page fault in that case.
>>>>
>>>> Once the VMA has been found, the speculative page fault handler would check
>>>> for the VMA's attributes to verify that the page fault has to be handled
>>>> correctly or not. Thus, the VMA is protected through a sequence lock which
>>>> allows fast detection of concurrent VMA changes. If such a change is
>>>> detected, the speculative page fault is aborted and a *classic* page fault
>>>> is tried.  VMA sequence lockings are added when VMA attributes which are
>>>> checked during the page fault are modified.
>>>>
>>>> When the PTE is fetched, the VMA is checked to see if it has been changed,
>>>> so once the page table is locked, the VMA is valid, so any other changes
>>>> leading to touching this PTE will need to lock the page table, so no
>>>> parallel change is possible at this time.
>>>>
>>>> The locking of the PTE is done with interrupts disabled, this allows
>>>> checking for the PMD to ensure that there is not an ongoing collapsing
>>>> operation. Since khugepaged is firstly set the PMD to pmd_none and then is
>>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd is
>>>> valid at the time the PTE is locked, we have the guarantee that the
>>>> collapsing operation will have to wait on the PTE lock to move forward.
>>>> This allows the SPF handler to map the PTE safely. If the PMD value is
>>>> different from the one recorded at the beginning of the SPF operation, the
>>>> classic page fault handler will be called to handle the operation while
>>>> holding the mmap_sem. As the PTE lock is done with the interrupts disabled,
>>>> the lock is done using spin_trylock() to avoid dead lock when handling a
>>>> page fault while a TLB invalidate is requested by another CPU holding the
>>>> PTE.
>>>>
>>>> In pseudo code, this could be seen as:
>>>>     speculative_page_fault()
>>>>     {
>>>>             vma = get_vma()
>>>>             check vma sequence count
>>>>             check vma's support
>>>>             disable interrupt
>>>>                   check pgd,p4d,...,pte
>>>>                   save pmd and pte in vmf
>>>>                   save vma sequence counter in vmf
>>>>             enable interrupt
>>>>             check vma sequence count
>>>>             handle_pte_fault(vma)
>>>>                     ..
>>>>                     page = alloc_page()
>>>>                     pte_map_lock()
>>>>                             disable interrupt
>>>>                                     abort if sequence counter has changed
>>>>                                     abort if pmd or pte has changed
>>>>                                     pte map and lock
>>>>                             enable interrupt
>>>>                     if abort
>>>>                        free page
>>>>                        abort
>>>>                     ...
>>>>     }
>>>>
>>>>     arch_fault_handler()
>>>>     {
>>>>             if (speculative_page_fault(&vma))
>>>>                goto done
>>>>     again:
>>>>             lock(mmap_sem)
>>>>             vma = find_vma();
>>>>             handle_pte_fault(vma);
>>>>             if retry
>>>>                unlock(mmap_sem)
>>>>                goto again;
>>>>     done:
>>>>             handle fault error
>>>>     }
>>>>
>>>> Support for THP is not done because when checking for the PMD, we can be
>>>> confused by an in progress collapsing operation done by khugepaged. The
>>>> issue is that pmd_none() could be true either if the PMD is not already
>>>> populated or if the underlying PTE are in the way to be collapsed. So we
>>>> cannot safely allocate a PMD if pmd_none() is true.
>>>>
>>>> This series add a new software performance event named 'speculative-faults'
>>>> or 'spf'. It counts the number of successful page fault event handled
>>>> speculatively. When recording 'faults,spf' events, the faults one is
>>>> counting the total number of page fault events while 'spf' is only counting
>>>> the part of the faults processed speculatively.
>>>>
>>>> There are some trace events introduced by this series. They allow
>>>> identifying why the page faults were not processed speculatively. This
>>>> doesn't take in account the faults generated by a monothreaded process
>>>> which directly processed while holding the mmap_sem. This trace events are
>>>> grouped in a system named 'pagefault', they are:
>>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back
>>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.
>>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported
>>>>  - pagefault:spf_vma_access : the VMA's access right are not respected
>>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in our
>>>>    back.
>>>>
>>>> To record all the related events, the easier is to run perf with the
>>>> following arguments :
>>>> $ perf stat -e 'faults,spf,pagefault:*' <command>
>>>>
>>>> There is also a dedicated vmstat counter showing the number of successful
>>>> page fault handled speculatively. I can be seen this way:
>>>> $ grep speculative_pgfault /proc/vmstat
>>>>
>>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is functional
>>>> on x86, PowerPC and arm64.
>>>>
>>>> ---------------------
>>>> Real Workload results
>>>>
>>>> As mentioned in previous email, we did non official runs using a "popular
>>>> in memory multithreaded database product" on 176 cores SMT8 Power system
>>>> which showed a 30% improvements in the number of transaction processed per
>>>> second. This run has been done on the v6 series, but changes introduced in
>>>> this new version should not impact the performance boost seen.
>>>>
>>>> Here are the perf data captured during 2 of these runs on top of the v8
>>>> series:
>>>>                 vanilla         spf
>>>> faults          89.418          101.364         +13%
>>>> spf                n/a           97.989
>>>>
>>>> With the SPF kernel, most of the page fault were processed in a speculative
>>>> way.
>>>>
>>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and gave
>>>> it a try on an android device. He reported that the application launch time
>>>> was improved in average by 6%, and for large applications (~100 threads) by
>>>> 20%.
>>>>
>>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qcom
>>>> MSM845 (8 cores) with 6GB (the less is better):
>>>>
>>>> Application                             4.9     4.9+spf delta
>>>> com.tencent.mm                          416     389     -7%
>>>> com.eg.android.AlipayGphone             1135    986     -13%
>>>> com.tencent.mtt                         455     454     0%
>>>> com.qqgame.hlddz                        1497    1409    -6%
>>>> com.autonavi.minimap                    711     701     -1%
>>>> com.tencent.tmgp.sgame                  788     748     -5%
>>>> com.immomo.momo                         501     487     -3%
>>>> com.tencent.peng                        2145    2112    -2%
>>>> com.smile.gifmaker                      491     461     -6%
>>>> com.baidu.BaiduMap                      479     366     -23%
>>>> com.taobao.taobao                       1341    1198    -11%
>>>> com.baidu.searchbox                     333     314     -6%
>>>> com.tencent.mobileqq                    394     384     -3%
>>>> com.sina.weibo                          907     906     0%
>>>> com.youku.phone                         816     731     -11%
>>>> com.happyelements.AndroidAnimal.qq      763     717     -6%
>>>> com.UCMobile                            415     411     -1%
>>>> com.tencent.tmgp.ak                     1464    1431    -2%
>>>> com.tencent.qqmusic                     336     329     -2%
>>>> com.sankuai.meituan                     1661    1302    -22%
>>>> com.netease.cloudmusic                  1193    1200    1%
>>>> air.tv.douyu.android                    4257    4152    -2%
>>>>
>>>> ------------------
>>>> Benchmarks results
>>>>
>>>> Base kernel is v4.17.0-rc4-mm1
>>>> SPF is BASE + this series
>>>>
>>>> Kernbench:
>>>> ----------
>>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15
>>>> kernel (kernel is build 5 times):
>>>>
>>>> Average Half load -j 8
>>>>                  Run    (std deviation)
>>>>                  BASE                   SPF
>>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%
>>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%
>>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%
>>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%
>>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%
>>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%
>>>>
>>>> Average Optimal load -j 16
>>>>                  Run    (std deviation)
>>>>                  BASE                   SPF
>>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%
>>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%
>>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%
>>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%
>>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%
>>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%
>>>>
>>>>
>>>> During a run on the SPF, perf events were captured:
>>>>  Performance counter stats for '../kernbench -M':
>>>>          526743764      faults
>>>>                210      spf
>>>>                  3      pagefault:spf_vma_changed
>>>>                  0      pagefault:spf_vma_noanon
>>>>               2278      pagefault:spf_vma_notsup
>>>>                  0      pagefault:spf_vma_access
>>>>                  0      pagefault:spf_pmd_changed
>>>>
>>>> Very few speculative page faults were recorded as most of the processes
>>>> involved are monothreaded (sounds that on this architecture some threads
>>>> were created during the kernel build processing).
>>>>
>>>> Here are the kerbench results on a 80 CPUs Power8 system:
>>>>
>>>> Average Half load -j 40
>>>>                  Run    (std deviation)
>>>>                  BASE                   SPF
>>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%
>>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%
>>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%
>>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%
>>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%
>>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%
>>>>
>>>> Average Optimal load -j 80
>>>>                  Run    (std deviation)
>>>>                  BASE                   SPF
>>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%
>>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%
>>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%
>>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%
>>>> Context Switches 223861  (138865)       225032  (139632)        0.52%
>>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%
>>>>
>>>> During a run on the SPF, perf events were captured:
>>>>  Performance counter stats for '../kernbench -M':
>>>>          116730856      faults
>>>>                  0      spf
>>>>                  3      pagefault:spf_vma_changed
>>>>                  0      pagefault:spf_vma_noanon
>>>>                476      pagefault:spf_vma_notsup
>>>>                  0      pagefault:spf_vma_access
>>>>                  0      pagefault:spf_pmd_changed
>>>>
>>>> Most of the processes involved are monothreaded so SPF is not activated but
>>>> there is no impact on the performance.
>>>>
>>>> Ebizzy:
>>>> -------
>>>> The test is counting the number of records per second it can manage, the
>>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get
>>>> consistent result I repeated the test 100 times and measure the average
>>>> result. The number is the record processes per second, the higher is the
>>>> best.
>>>>
>>>>                 BASE            SPF             delta
>>>> 16 CPUs x86 VM  742.57          1490.24         100.69%
>>>> 80 CPUs P8 node 13105.4         24174.23        84.46%
>>>>
>>>> Here are the performance counter read during a run on a 16 CPUs x86 VM:
>>>>  Performance counter stats for './ebizzy -mTt 16':
>>>>            1706379      faults
>>>>            1674599      spf
>>>>              30588      pagefault:spf_vma_changed
>>>>                  0      pagefault:spf_vma_noanon
>>>>                363      pagefault:spf_vma_notsup
>>>>                  0      pagefault:spf_vma_access
>>>>                  0      pagefault:spf_pmd_changed
>>>>
>>>> And the ones captured during a run on a 80 CPUs Power node:
>>>>  Performance counter stats for './ebizzy -mTt 80':
>>>>            1874773      faults
>>>>            1461153      spf
>>>>             413293      pagefault:spf_vma_changed
>>>>                  0      pagefault:spf_vma_noanon
>>>>                200      pagefault:spf_vma_notsup
>>>>                  0      pagefault:spf_vma_access
>>>>                  0      pagefault:spf_pmd_changed
>>>>
>>>> In ebizzy's case most of the page fault were handled in a speculative way,
>>>> leading the ebizzy performance boost.
>>>>
>>>> ------------------
>>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):
>>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahendran
>>>>    and Minchan Kim, hopefully.
>>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in
>>>>    __do_page_fault().
>>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails
>>>>    instead
>>>>    of aborting the speculative page fault handling. Dropping the now
>>>> useless
>>>>    trace event pagefault:spf_pte_lock.
>>>>  - No more try to reuse the fetched VMA during the speculative page fault
>>>>    handling when retrying is needed. This adds a lot of complexity and
>>>>    additional tests done didn't show a significant performance improvement.
>>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.
>>>>
>>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at-speculative-page-faults-tt965642.html#none
>>>> [2] https://patchwork.kernel.org/patch/9999687/
>>>>
>>>>
>>>> Laurent Dufour (20):
>>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT
>>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE
>>>>   mm: make pte_unmap_same compatible with SPF
>>>>   mm: introduce INIT_VMA()
>>>>   mm: protect VMA modifications using VMA sequence count
>>>>   mm: protect mremap() against SPF hanlder
>>>>   mm: protect SPF handler against anon_vma changes
>>>>   mm: cache some VMA fields in the vm_fault structure
>>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()
>>>>   mm: introduce __lru_cache_add_active_or_unevictable
>>>>   mm: introduce __vm_normal_page()
>>>>   mm: introduce __page_add_new_anon_rmap()
>>>>   mm: protect mm_rb tree with a rwlock
>>>>   mm: adding speculative page fault failure trace events
>>>>   perf: add a speculative page fault sw event
>>>>   perf tools: add support for the SPF perf event
>>>>   mm: add speculative page fault vmstats
>>>>   powerpc/mm: add speculative page fault
>>>>
>>>> Mahendran Ganesh (2):
>>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>   arm64/mm: add speculative page fault
>>>>
>>>> Peter Zijlstra (4):
>>>>   mm: prepare for FAULT_FLAG_SPECULATIVE
>>>>   mm: VMA sequence count
>>>>   mm: provide speculative fault infrastructure
>>>>   x86/mm: add speculative pagefault handling
>>>>
>>>>  arch/arm64/Kconfig                    |   1 +
>>>>  arch/arm64/mm/fault.c                 |  12 +
>>>>  arch/powerpc/Kconfig                  |   1 +
>>>>  arch/powerpc/mm/fault.c               |  16 +
>>>>  arch/x86/Kconfig                      |   1 +
>>>>  arch/x86/mm/fault.c                   |  27 +-
>>>>  fs/exec.c                             |   2 +-
>>>>  fs/proc/task_mmu.c                    |   5 +-
>>>>  fs/userfaultfd.c                      |  17 +-
>>>>  include/linux/hugetlb_inline.h        |   2 +-
>>>>  include/linux/migrate.h               |   4 +-
>>>>  include/linux/mm.h                    | 136 +++++++-
>>>>  include/linux/mm_types.h              |   7 +
>>>>  include/linux/pagemap.h               |   4 +-
>>>>  include/linux/rmap.h                  |  12 +-
>>>>  include/linux/swap.h                  |  10 +-
>>>>  include/linux/vm_event_item.h         |   3 +
>>>>  include/trace/events/pagefault.h      |  80 +++++
>>>>  include/uapi/linux/perf_event.h       |   1 +
>>>>  kernel/fork.c                         |   5 +-
>>>>  mm/Kconfig                            |  22 ++
>>>>  mm/huge_memory.c                      |   6 +-
>>>>  mm/hugetlb.c                          |   2 +
>>>>  mm/init-mm.c                          |   3 +
>>>>  mm/internal.h                         |  20 ++
>>>>  mm/khugepaged.c                       |   5 +
>>>>  mm/madvise.c                          |   6 +-
>>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++++++-----
>>>>  mm/mempolicy.c                        |  51 ++-
>>>>  mm/migrate.c                          |   6 +-
>>>>  mm/mlock.c                            |  13 +-
>>>>  mm/mmap.c                             | 229 ++++++++++---
>>>>  mm/mprotect.c                         |   4 +-
>>>>  mm/mremap.c                           |  13 +
>>>>  mm/nommu.c                            |   2 +-
>>>>  mm/rmap.c                             |   5 +-
>>>>  mm/swap.c                             |   6 +-
>>>>  mm/swap_state.c                       |   8 +-
>>>>  mm/vmstat.c                           |   5 +-
>>>>  tools/include/uapi/linux/perf_event.h |   1 +
>>>>  tools/perf/util/evsel.c               |   1 +
>>>>  tools/perf/util/parse-events.c        |   4 +
>>>>  tools/perf/util/parse-events.l        |   1 +
>>>>  tools/perf/util/python.c              |   1 +
>>>>  44 files changed, 1161 insertions(+), 211 deletions(-)
>>>>  create mode 100644 include/trace/events/pagefault.h
>>>>
>>>> --
>>>> 2.7.4
>>>>
>>>>
>>>
>>
>


^ permalink raw reply	[flat|nested] 58+ messages in thread

* RE: [PATCH v11 00/26] Speculative page faults
@ 2018-07-04  3:23               ` Song, HaiyanX
  0 siblings, 0 replies; 58+ messages in thread
From: Song, HaiyanX @ 2018-07-04  3:23 UTC (permalink / raw)
  To: Laurent Dufour
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

Hi Laurent,=0A=
=0A=
=0A=
For the test result on Intel 4s skylake platform (192 CPUs, 768G Memory), t=
he below test cases all were run 3 times.=0A=
I check the test results, only page_fault3_thread/enable THP have 6% stddev=
 for head commit, other tests have lower stddev.=0A=
=0A=
And I did not find other high variation on test case result.=0A=
=0A=
a). Enable THP=0A=
testcase                          base     stddev       change      head   =
  stddev         metric=0A=
page_fault3/enable THP           10519      =B1 3%        -20.5%      8368 =
     =B16%          will-it-scale.per_thread_ops=0A=
page_fault2/enalbe THP            8281      =B1 2%        -18.8%      6728 =
                  will-it-scale.per_thread_ops=0A=
brk1/eanble THP                 998475                   -2.2%    976893   =
                will-it-scale.per_process_ops=0A=
context_switch1/enable THP      223910                   -1.3%    220930   =
                will-it-scale.per_process_ops=0A=
context_switch1/enable THP      233722                   -1.0%    231288   =
                will-it-scale.per_thread_ops=0A=
=0A=
b). Disable THP=0A=
page_fault3/disable THP          10856                  -23.1%      8344   =
                will-it-scale.per_thread_ops=0A=
page_fault2/disable THP           8147                  -18.8%      6613   =
                will-it-scale.per_thread_ops=0A=
brk1/disable THP                   957                    -7.9%      881   =
                will-it-scale.per_thread_ops=0A=
context_switch1/disable THP     237006                    -2.2%    231907  =
                will-it-scale.per_thread_ops=0A=
brk1/disable THP                997317                    -2.0%    977778  =
                will-it-scale.per_process_ops=0A=
page_fault3/disable THP         467454                    -1.8%    459251  =
                will-it-scale.per_process_ops=0A=
context_switch1/disable THP     224431                    -1.3%    221567  =
                will-it-scale.per_process_ops=0A=
=0A=
=0A=
Best regards,=0A=
Haiyan Song=0A=
________________________________________=0A=
From: Laurent Dufour [ldufour@linux.vnet.ibm.com]=0A=
Sent: Monday, July 02, 2018 4:59 PM=0A=
To: Song, HaiyanX=0A=
Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kir=
ill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Mat=
thew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; =
benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Glei=
xner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.s=
enozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi=
; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan K=
im; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; l=
inux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora=
@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs=
.org; x86@kernel.org=0A=
Subject: Re: [PATCH v11 00/26] Speculative page faults=0A=
=0A=
On 11/06/2018 09:49, Song, HaiyanX wrote:=0A=
> Hi Laurent,=0A=
>=0A=
> Regression test for v11 patch serials have been run, some regression is f=
ound by LKP-tools (linux kernel performance)=0A=
> tested on Intel 4s skylake platform. This time only test the cases which =
have been run and found regressions on=0A=
> V9 patch serials.=0A=
>=0A=
> The regression result is sorted by the metric will-it-scale.per_thread_op=
s.=0A=
> branch: Laurent-Dufour/Speculative-page-faults/20180520-045126=0A=
> commit id:=0A=
>   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12=0A=
>   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1=0A=
> Benchmark: will-it-scale=0A=
> Download link: https://github.com/antonblanchard/will-it-scale/tree/maste=
r=0A=
>=0A=
> Metrics:=0A=
>   will-it-scale.per_process_ops=3Dprocesses/nr_cpu=0A=
>   will-it-scale.per_thread_ops=3Dthreads/nr_cpu=0A=
>   test box: lkp-skl-4sp1(nr_cpu=3D192,memory=3D768G)=0A=
> THP: enable / disable=0A=
> nr_task:100%=0A=
>=0A=
> 1. Regressions:=0A=
>=0A=
> a). Enable THP=0A=
> testcase                          base           change      head        =
   metric=0A=
> page_fault3/enable THP           10519          -20.5%        836      wi=
ll-it-scale.per_thread_ops=0A=
> page_fault2/enalbe THP            8281          -18.8%       6728      wi=
ll-it-scale.per_thread_ops=0A=
> brk1/eanble THP                 998475           -2.2%     976893      wi=
ll-it-scale.per_process_ops=0A=
> context_switch1/enable THP      223910           -1.3%     220930      wi=
ll-it-scale.per_process_ops=0A=
> context_switch1/enable THP      233722           -1.0%     231288      wi=
ll-it-scale.per_thread_ops=0A=
>=0A=
> b). Disable THP=0A=
> page_fault3/disable THP          10856          -23.1%       8344      wi=
ll-it-scale.per_thread_ops=0A=
> page_fault2/disable THP           8147          -18.8%       6613      wi=
ll-it-scale.per_thread_ops=0A=
> brk1/disable THP                   957           -7.9%        881      wi=
ll-it-scale.per_thread_ops=0A=
> context_switch1/disable THP     237006           -2.2%     231907      wi=
ll-it-scale.per_thread_ops=0A=
> brk1/disable THP                997317           -2.0%     977778      wi=
ll-it-scale.per_process_ops=0A=
> page_fault3/disable THP         467454           -1.8%     459251      wi=
ll-it-scale.per_process_ops=0A=
> context_switch1/disable THP     224431           -1.3%     221567      wi=
ll-it-scale.per_process_ops=0A=
>=0A=
> Notes: for the above  values of test result, the higher is better.=0A=
=0A=
I tried the same tests on my PowerPC victim VM (1024 CPUs, 11TB) and I can'=
t=0A=
get reproducible results. The results have huge variation, even on the vani=
lla=0A=
kernel, and I can't state on any changes due to that.=0A=
=0A=
I tried on smaller node (80 CPUs, 32G), and the tests ran better, but I did=
n't=0A=
measure any changes between the vanilla and the SPF patched ones:=0A=
=0A=
test THP enabled                4.17.0-rc4-mm1  spf             delta=0A=
page_fault3_threads             2697.7          2683.5          -0.53%=0A=
page_fault2_threads             170660.6        169574.1        -0.64%=0A=
context_switch1_threads         6915269.2       6877507.3       -0.55%=0A=
context_switch1_processes       6478076.2       6529493.5       0.79%=0A=
brk1                            243391.2        238527.5        -2.00%=0A=
=0A=
Tests were run 10 times, no high variation detected.=0A=
=0A=
Did you see high variation on your side ? How many times the test were run =
to=0A=
compute the average values ?=0A=
=0A=
Thanks,=0A=
Laurent.=0A=
=0A=
=0A=
>=0A=
> 2. Improvement: not found improvement based on the selected test cases.=
=0A=
>=0A=
>=0A=
> Best regards=0A=
> Haiyan Song=0A=
> ________________________________________=0A=
> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of La=
urent Dufour [ldufour@linux.vnet.ibm.com]=0A=
> Sent: Monday, May 28, 2018 4:54 PM=0A=
> To: Song, HaiyanX=0A=
> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; k=
irill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; M=
atthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com=
; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gl=
eixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey=
.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Ke=
mi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan=
 Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org;=
 linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharo=
ra@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozla=
bs.org; x86@kernel.org=0A=
> Subject: Re: [PATCH v11 00/26] Speculative page faults=0A=
>=0A=
> On 28/05/2018 10:22, Haiyan Song wrote:=0A=
>> Hi Laurent,=0A=
>>=0A=
>> Yes, these tests are done on V9 patch.=0A=
>=0A=
> Do you plan to give this V11 a run ?=0A=
>=0A=
>>=0A=
>>=0A=
>> Best regards,=0A=
>> Haiyan Song=0A=
>>=0A=
>> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:=0A=
>>> On 28/05/2018 07:23, Song, HaiyanX wrote:=0A=
>>>>=0A=
>>>> Some regression and improvements is found by LKP-tools(linux kernel pe=
rformance) on V9 patch series=0A=
>>>> tested on Intel 4s Skylake platform.=0A=
>>>=0A=
>>> Hi,=0A=
>>>=0A=
>>> Thanks for reporting this benchmark results, but you mentioned the "V9 =
patch=0A=
>>> series" while responding to the v11 header series...=0A=
>>> Were these tests done on v9 or v11 ?=0A=
>>>=0A=
>>> Cheers,=0A=
>>> Laurent.=0A=
>>>=0A=
>>>>=0A=
>>>> The regression result is sorted by the metric will-it-scale.per_thread=
_ops.=0A=
>>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 pat=
ch series)=0A=
>>>> Commit id:=0A=
>>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f=0A=
>>>>     head commit: 0355322b3577eeab7669066df42c550a56801110=0A=
>>>> Benchmark suite: will-it-scale=0A=
>>>> Download link:=0A=
>>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests=0A=
>>>> Metrics:=0A=
>>>>     will-it-scale.per_process_ops=3Dprocesses/nr_cpu=0A=
>>>>     will-it-scale.per_thread_ops=3Dthreads/nr_cpu=0A=
>>>> test box: lkp-skl-4sp1(nr_cpu=3D192,memory=3D768G)=0A=
>>>> THP: enable / disable=0A=
>>>> nr_task: 100%=0A=
>>>>=0A=
>>>> 1. Regressions:=0A=
>>>> a) THP enabled:=0A=
>>>> testcase                        base            change          head  =
     metric=0A=
>>>> page_fault3/ enable THP         10092           -17.5%          8323  =
     will-it-scale.per_thread_ops=0A=
>>>> page_fault2/ enable THP          8300           -17.2%          6869  =
     will-it-scale.per_thread_ops=0A=
>>>> brk1/ enable THP                  957.67         -7.6%           885  =
     will-it-scale.per_thread_ops=0A=
>>>> page_fault3/ enable THP        172821            -5.3%        163692  =
     will-it-scale.per_process_ops=0A=
>>>> signal1/ enable THP              9125            -3.2%          8834  =
     will-it-scale.per_process_ops=0A=
>>>>=0A=
>>>> b) THP disabled:=0A=
>>>> testcase                        base            change          head  =
     metric=0A=
>>>> page_fault3/ disable THP        10107           -19.1%          8180  =
     will-it-scale.per_thread_ops=0A=
>>>> page_fault2/ disable THP         8432           -17.8%          6931  =
     will-it-scale.per_thread_ops=0A=
>>>> context_switch1/ disable THP   215389            -6.8%        200776  =
     will-it-scale.per_thread_ops=0A=
>>>> brk1/ disable THP                 939.67         -6.6%           877.3=
3    will-it-scale.per_thread_ops=0A=
>>>> page_fault3/ disable THP       173145            -4.7%        165064  =
     will-it-scale.per_process_ops=0A=
>>>> signal1/ disable THP             9162            -3.9%          8802  =
     will-it-scale.per_process_ops=0A=
>>>>=0A=
>>>> 2. Improvements:=0A=
>>>> a) THP enabled:=0A=
>>>> testcase                        base            change          head  =
     metric=0A=
>>>> malloc1/ enable THP               66.33        +469.8%           383.6=
7    will-it-scale.per_thread_ops=0A=
>>>> writeseek3/ enable THP          2531             +4.5%          2646  =
     will-it-scale.per_thread_ops=0A=
>>>> signal1/ enable THP              989.33          +2.8%          1016  =
     will-it-scale.per_thread_ops=0A=
>>>>=0A=
>>>> b) THP disabled:=0A=
>>>> testcase                        base            change          head  =
     metric=0A=
>>>> malloc1/ disable THP              90.33        +417.3%           467.3=
3    will-it-scale.per_thread_ops=0A=
>>>> read2/ disable THP             58934            +39.2%         82060  =
     will-it-scale.per_thread_ops=0A=
>>>> page_fault1/ disable THP        8607            +36.4%         11736  =
     will-it-scale.per_thread_ops=0A=
>>>> read1/ disable THP            314063            +12.7%        353934  =
     will-it-scale.per_thread_ops=0A=
>>>> writeseek3/ disable THP         2452            +12.5%          2759  =
     will-it-scale.per_thread_ops=0A=
>>>> signal1/ disable THP             971.33          +5.5%          1024  =
     will-it-scale.per_thread_ops=0A=
>>>>=0A=
>>>> Notes: for above values in column "change", the higher value means tha=
t the related testcase result=0A=
>>>> on head commit is better than that on base commit for this benchmark.=
=0A=
>>>>=0A=
>>>>=0A=
>>>> Best regards=0A=
>>>> Haiyan Song=0A=
>>>>=0A=
>>>> ________________________________________=0A=
>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of=
 Laurent Dufour [ldufour@linux.vnet.ibm.com]=0A=
>>>> Sent: Thursday, May 17, 2018 7:06 PM=0A=
>>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org=
; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz=
; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.=
com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas=
 Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; ser=
gey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang,=
 Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minc=
han Kim; Punit Agrawal; vinayak menon; Yang Shi=0A=
>>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet=
.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.=
com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org=0A=
>>>> Subject: [PATCH v11 00/26] Speculative page faults=0A=
>>>>=0A=
>>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to ha=
ndle=0A=
>>>> page fault without holding the mm semaphore [1].=0A=
>>>>=0A=
>>>> The idea is to try to handle user space page faults without holding th=
e=0A=
>>>> mmap_sem. This should allow better concurrency for massively threaded=
=0A=
>>>> process since the page fault handler will not wait for other threads m=
emory=0A=
>>>> layout change to be done, assuming that this change is done in another=
 part=0A=
>>>> of the process's memory space. This type page fault is named speculati=
ve=0A=
>>>> page fault. If the speculative page fault fails because of a concurren=
cy is=0A=
>>>> detected or because underlying PMD or PTE tables are not yet allocatin=
g, it=0A=
>>>> is failing its processing and a classic page fault is then tried.=0A=
>>>>=0A=
>>>> The speculative page fault (SPF) has to look for the VMA matching the =
fault=0A=
>>>> address without holding the mmap_sem, this is done by introducing a rw=
lock=0A=
>>>> which protects the access to the mm_rb tree. Previously this was done =
using=0A=
>>>> SRCU but it was introducing a lot of scheduling to process the VMA's=
=0A=
>>>> freeing operation which was hitting the performance by 20% as reported=
 by=0A=
>>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is=
=0A=
>>>> limiting the locking contention to these operations which are expected=
 to=0A=
>>>> be in a O(log n) order. In addition to ensure that the VMA is not free=
d in=0A=
>>>> our back a reference count is added and 2 services (get_vma() and=0A=
>>>> put_vma()) are introduced to handle the reference count. Once a VMA is=
=0A=
>>>> fetched from the RB tree using get_vma(), it must be later freed using=
=0A=
>>>> put_vma(). I can't see anymore the overhead I got while will-it-scale=
=0A=
>>>> benchmark anymore.=0A=
>>>>=0A=
>>>> The VMA's attributes checked during the speculative page fault process=
ing=0A=
>>>> have to be protected against parallel changes. This is done by using a=
 per=0A=
>>>> VMA sequence lock. This sequence lock allows the speculative page faul=
t=0A=
>>>> handler to fast check for parallel changes in progress and to abort th=
e=0A=
>>>> speculative page fault in that case.=0A=
>>>>=0A=
>>>> Once the VMA has been found, the speculative page fault handler would =
check=0A=
>>>> for the VMA's attributes to verify that the page fault has to be handl=
ed=0A=
>>>> correctly or not. Thus, the VMA is protected through a sequence lock w=
hich=0A=
>>>> allows fast detection of concurrent VMA changes. If such a change is=
=0A=
>>>> detected, the speculative page fault is aborted and a *classic* page f=
ault=0A=
>>>> is tried.  VMA sequence lockings are added when VMA attributes which a=
re=0A=
>>>> checked during the page fault are modified.=0A=
>>>>=0A=
>>>> When the PTE is fetched, the VMA is checked to see if it has been chan=
ged,=0A=
>>>> so once the page table is locked, the VMA is valid, so any other chang=
es=0A=
>>>> leading to touching this PTE will need to lock the page table, so no=
=0A=
>>>> parallel change is possible at this time.=0A=
>>>>=0A=
>>>> The locking of the PTE is done with interrupts disabled, this allows=
=0A=
>>>> checking for the PMD to ensure that there is not an ongoing collapsing=
=0A=
>>>> operation. Since khugepaged is firstly set the PMD to pmd_none and the=
n is=0A=
>>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd=
 is=0A=
>>>> valid at the time the PTE is locked, we have the guarantee that the=0A=
>>>> collapsing operation will have to wait on the PTE lock to move forward=
.=0A=
>>>> This allows the SPF handler to map the PTE safely. If the PMD value is=
=0A=
>>>> different from the one recorded at the beginning of the SPF operation,=
 the=0A=
>>>> classic page fault handler will be called to handle the operation whil=
e=0A=
>>>> holding the mmap_sem. As the PTE lock is done with the interrupts disa=
bled,=0A=
>>>> the lock is done using spin_trylock() to avoid dead lock when handling=
 a=0A=
>>>> page fault while a TLB invalidate is requested by another CPU holding =
the=0A=
>>>> PTE.=0A=
>>>>=0A=
>>>> In pseudo code, this could be seen as:=0A=
>>>>     speculative_page_fault()=0A=
>>>>     {=0A=
>>>>             vma =3D get_vma()=0A=
>>>>             check vma sequence count=0A=
>>>>             check vma's support=0A=
>>>>             disable interrupt=0A=
>>>>                   check pgd,p4d,...,pte=0A=
>>>>                   save pmd and pte in vmf=0A=
>>>>                   save vma sequence counter in vmf=0A=
>>>>             enable interrupt=0A=
>>>>             check vma sequence count=0A=
>>>>             handle_pte_fault(vma)=0A=
>>>>                     ..=0A=
>>>>                     page =3D alloc_page()=0A=
>>>>                     pte_map_lock()=0A=
>>>>                             disable interrupt=0A=
>>>>                                     abort if sequence counter has chan=
ged=0A=
>>>>                                     abort if pmd or pte has changed=0A=
>>>>                                     pte map and lock=0A=
>>>>                             enable interrupt=0A=
>>>>                     if abort=0A=
>>>>                        free page=0A=
>>>>                        abort=0A=
>>>>                     ...=0A=
>>>>     }=0A=
>>>>=0A=
>>>>     arch_fault_handler()=0A=
>>>>     {=0A=
>>>>             if (speculative_page_fault(&vma))=0A=
>>>>                goto done=0A=
>>>>     again:=0A=
>>>>             lock(mmap_sem)=0A=
>>>>             vma =3D find_vma();=0A=
>>>>             handle_pte_fault(vma);=0A=
>>>>             if retry=0A=
>>>>                unlock(mmap_sem)=0A=
>>>>                goto again;=0A=
>>>>     done:=0A=
>>>>             handle fault error=0A=
>>>>     }=0A=
>>>>=0A=
>>>> Support for THP is not done because when checking for the PMD, we can =
be=0A=
>>>> confused by an in progress collapsing operation done by khugepaged. Th=
e=0A=
>>>> issue is that pmd_none() could be true either if the PMD is not alread=
y=0A=
>>>> populated or if the underlying PTE are in the way to be collapsed. So =
we=0A=
>>>> cannot safely allocate a PMD if pmd_none() is true.=0A=
>>>>=0A=
>>>> This series add a new software performance event named 'speculative-fa=
ults'=0A=
>>>> or 'spf'. It counts the number of successful page fault event handled=
=0A=
>>>> speculatively. When recording 'faults,spf' events, the faults one is=
=0A=
>>>> counting the total number of page fault events while 'spf' is only cou=
nting=0A=
>>>> the part of the faults processed speculatively.=0A=
>>>>=0A=
>>>> There are some trace events introduced by this series. They allow=0A=
>>>> identifying why the page faults were not processed speculatively. This=
=0A=
>>>> doesn't take in account the faults generated by a monothreaded process=
=0A=
>>>> which directly processed while holding the mmap_sem. This trace events=
 are=0A=
>>>> grouped in a system named 'pagefault', they are:=0A=
>>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back=
=0A=
>>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.=
=0A=
>>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported=0A=
>>>>  - pagefault:spf_vma_access : the VMA's access right are not respected=
=0A=
>>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in ou=
r=0A=
>>>>    back.=0A=
>>>>=0A=
>>>> To record all the related events, the easier is to run perf with the=
=0A=
>>>> following arguments :=0A=
>>>> $ perf stat -e 'faults,spf,pagefault:*' <command>=0A=
>>>>=0A=
>>>> There is also a dedicated vmstat counter showing the number of success=
ful=0A=
>>>> page fault handled speculatively. I can be seen this way:=0A=
>>>> $ grep speculative_pgfault /proc/vmstat=0A=
>>>>=0A=
>>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is funct=
ional=0A=
>>>> on x86, PowerPC and arm64.=0A=
>>>>=0A=
>>>> ---------------------=0A=
>>>> Real Workload results=0A=
>>>>=0A=
>>>> As mentioned in previous email, we did non official runs using a "popu=
lar=0A=
>>>> in memory multithreaded database product" on 176 cores SMT8 Power syst=
em=0A=
>>>> which showed a 30% improvements in the number of transaction processed=
 per=0A=
>>>> second. This run has been done on the v6 series, but changes introduce=
d in=0A=
>>>> this new version should not impact the performance boost seen.=0A=
>>>>=0A=
>>>> Here are the perf data captured during 2 of these runs on top of the v=
8=0A=
>>>> series:=0A=
>>>>                 vanilla         spf=0A=
>>>> faults          89.418          101.364         +13%=0A=
>>>> spf                n/a           97.989=0A=
>>>>=0A=
>>>> With the SPF kernel, most of the page fault were processed in a specul=
ative=0A=
>>>> way.=0A=
>>>>=0A=
>>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and =
gave=0A=
>>>> it a try on an android device. He reported that the application launch=
 time=0A=
>>>> was improved in average by 6%, and for large applications (~100 thread=
s) by=0A=
>>>> 20%.=0A=
>>>>=0A=
>>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qco=
m=0A=
>>>> MSM845 (8 cores) with 6GB (the less is better):=0A=
>>>>=0A=
>>>> Application                             4.9     4.9+spf delta=0A=
>>>> com.tencent.mm                          416     389     -7%=0A=
>>>> com.eg.android.AlipayGphone             1135    986     -13%=0A=
>>>> com.tencent.mtt                         455     454     0%=0A=
>>>> com.qqgame.hlddz                        1497    1409    -6%=0A=
>>>> com.autonavi.minimap                    711     701     -1%=0A=
>>>> com.tencent.tmgp.sgame                  788     748     -5%=0A=
>>>> com.immomo.momo                         501     487     -3%=0A=
>>>> com.tencent.peng                        2145    2112    -2%=0A=
>>>> com.smile.gifmaker                      491     461     -6%=0A=
>>>> com.baidu.BaiduMap                      479     366     -23%=0A=
>>>> com.taobao.taobao                       1341    1198    -11%=0A=
>>>> com.baidu.searchbox                     333     314     -6%=0A=
>>>> com.tencent.mobileqq                    394     384     -3%=0A=
>>>> com.sina.weibo                          907     906     0%=0A=
>>>> com.youku.phone                         816     731     -11%=0A=
>>>> com.happyelements.AndroidAnimal.qq      763     717     -6%=0A=
>>>> com.UCMobile                            415     411     -1%=0A=
>>>> com.tencent.tmgp.ak                     1464    1431    -2%=0A=
>>>> com.tencent.qqmusic                     336     329     -2%=0A=
>>>> com.sankuai.meituan                     1661    1302    -22%=0A=
>>>> com.netease.cloudmusic                  1193    1200    1%=0A=
>>>> air.tv.douyu.android                    4257    4152    -2%=0A=
>>>>=0A=
>>>> ------------------=0A=
>>>> Benchmarks results=0A=
>>>>=0A=
>>>> Base kernel is v4.17.0-rc4-mm1=0A=
>>>> SPF is BASE + this series=0A=
>>>>=0A=
>>>> Kernbench:=0A=
>>>> ----------=0A=
>>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15=
=0A=
>>>> kernel (kernel is build 5 times):=0A=
>>>>=0A=
>>>> Average Half load -j 8=0A=
>>>>                  Run    (std deviation)=0A=
>>>>                  BASE                   SPF=0A=
>>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%=
=0A=
>>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%=
=0A=
>>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%=
=0A=
>>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%=
=0A=
>>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%=
=0A=
>>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%=
=0A=
>>>>=0A=
>>>> Average Optimal load -j 16=0A=
>>>>                  Run    (std deviation)=0A=
>>>>                  BASE                   SPF=0A=
>>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%=
=0A=
>>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%=
=0A=
>>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%=
=0A=
>>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%=
=0A=
>>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%=
=0A=
>>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%=
=0A=
>>>>=0A=
>>>>=0A=
>>>> During a run on the SPF, perf events were captured:=0A=
>>>>  Performance counter stats for '../kernbench -M':=0A=
>>>>          526743764      faults=0A=
>>>>                210      spf=0A=
>>>>                  3      pagefault:spf_vma_changed=0A=
>>>>                  0      pagefault:spf_vma_noanon=0A=
>>>>               2278      pagefault:spf_vma_notsup=0A=
>>>>                  0      pagefault:spf_vma_access=0A=
>>>>                  0      pagefault:spf_pmd_changed=0A=
>>>>=0A=
>>>> Very few speculative page faults were recorded as most of the processe=
s=0A=
>>>> involved are monothreaded (sounds that on this architecture some threa=
ds=0A=
>>>> were created during the kernel build processing).=0A=
>>>>=0A=
>>>> Here are the kerbench results on a 80 CPUs Power8 system:=0A=
>>>>=0A=
>>>> Average Half load -j 40=0A=
>>>>                  Run    (std deviation)=0A=
>>>>                  BASE                   SPF=0A=
>>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%=
=0A=
>>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%=
=0A=
>>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%=
=0A=
>>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%=
=0A=
>>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%=
=0A=
>>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%=
=0A=
>>>>=0A=
>>>> Average Optimal load -j 80=0A=
>>>>                  Run    (std deviation)=0A=
>>>>                  BASE                   SPF=0A=
>>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%=
=0A=
>>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%=
=0A=
>>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%=
=0A=
>>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%=
=0A=
>>>> Context Switches 223861  (138865)       225032  (139632)        0.52%=
=0A=
>>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%=
=0A=
>>>>=0A=
>>>> During a run on the SPF, perf events were captured:=0A=
>>>>  Performance counter stats for '../kernbench -M':=0A=
>>>>          116730856      faults=0A=
>>>>                  0      spf=0A=
>>>>                  3      pagefault:spf_vma_changed=0A=
>>>>                  0      pagefault:spf_vma_noanon=0A=
>>>>                476      pagefault:spf_vma_notsup=0A=
>>>>                  0      pagefault:spf_vma_access=0A=
>>>>                  0      pagefault:spf_pmd_changed=0A=
>>>>=0A=
>>>> Most of the processes involved are monothreaded so SPF is not activate=
d but=0A=
>>>> there is no impact on the performance.=0A=
>>>>=0A=
>>>> Ebizzy:=0A=
>>>> -------=0A=
>>>> The test is counting the number of records per second it can manage, t=
he=0A=
>>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get=
=0A=
>>>> consistent result I repeated the test 100 times and measure the averag=
e=0A=
>>>> result. The number is the record processes per second, the higher is t=
he=0A=
>>>> best.=0A=
>>>>=0A=
>>>>                 BASE            SPF             delta=0A=
>>>> 16 CPUs x86 VM  742.57          1490.24         100.69%=0A=
>>>> 80 CPUs P8 node 13105.4         24174.23        84.46%=0A=
>>>>=0A=
>>>> Here are the performance counter read during a run on a 16 CPUs x86 VM=
:=0A=
>>>>  Performance counter stats for './ebizzy -mTt 16':=0A=
>>>>            1706379      faults=0A=
>>>>            1674599      spf=0A=
>>>>              30588      pagefault:spf_vma_changed=0A=
>>>>                  0      pagefault:spf_vma_noanon=0A=
>>>>                363      pagefault:spf_vma_notsup=0A=
>>>>                  0      pagefault:spf_vma_access=0A=
>>>>                  0      pagefault:spf_pmd_changed=0A=
>>>>=0A=
>>>> And the ones captured during a run on a 80 CPUs Power node:=0A=
>>>>  Performance counter stats for './ebizzy -mTt 80':=0A=
>>>>            1874773      faults=0A=
>>>>            1461153      spf=0A=
>>>>             413293      pagefault:spf_vma_changed=0A=
>>>>                  0      pagefault:spf_vma_noanon=0A=
>>>>                200      pagefault:spf_vma_notsup=0A=
>>>>                  0      pagefault:spf_vma_access=0A=
>>>>                  0      pagefault:spf_pmd_changed=0A=
>>>>=0A=
>>>> In ebizzy's case most of the page fault were handled in a speculative =
way,=0A=
>>>> leading the ebizzy performance boost.=0A=
>>>>=0A=
>>>> ------------------=0A=
>>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):=0A=
>>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahen=
dran=0A=
>>>>    and Minchan Kim, hopefully.=0A=
>>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in=0A=
>>>>    __do_page_fault().=0A=
>>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails=
=0A=
>>>>    instead=0A=
>>>>    of aborting the speculative page fault handling. Dropping the now=
=0A=
>>>> useless=0A=
>>>>    trace event pagefault:spf_pte_lock.=0A=
>>>>  - No more try to reuse the fetched VMA during the speculative page fa=
ult=0A=
>>>>    handling when retrying is needed. This adds a lot of complexity and=
=0A=
>>>>    additional tests done didn't show a significant performance improve=
ment.=0A=
>>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.=
=0A=
>>>>=0A=
>>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at=
-speculative-page-faults-tt965642.html#none=0A=
>>>> [2] https://patchwork.kernel.org/patch/9999687/=0A=
>>>>=0A=
>>>>=0A=
>>>> Laurent Dufour (20):=0A=
>>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT=0A=
>>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT=0A=
>>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT=0A=
>>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE=0A=
>>>>   mm: make pte_unmap_same compatible with SPF=0A=
>>>>   mm: introduce INIT_VMA()=0A=
>>>>   mm: protect VMA modifications using VMA sequence count=0A=
>>>>   mm: protect mremap() against SPF hanlder=0A=
>>>>   mm: protect SPF handler against anon_vma changes=0A=
>>>>   mm: cache some VMA fields in the vm_fault structure=0A=
>>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()=0A=
>>>>   mm: introduce __lru_cache_add_active_or_unevictable=0A=
>>>>   mm: introduce __vm_normal_page()=0A=
>>>>   mm: introduce __page_add_new_anon_rmap()=0A=
>>>>   mm: protect mm_rb tree with a rwlock=0A=
>>>>   mm: adding speculative page fault failure trace events=0A=
>>>>   perf: add a speculative page fault sw event=0A=
>>>>   perf tools: add support for the SPF perf event=0A=
>>>>   mm: add speculative page fault vmstats=0A=
>>>>   powerpc/mm: add speculative page fault=0A=
>>>>=0A=
>>>> Mahendran Ganesh (2):=0A=
>>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT=0A=
>>>>   arm64/mm: add speculative page fault=0A=
>>>>=0A=
>>>> Peter Zijlstra (4):=0A=
>>>>   mm: prepare for FAULT_FLAG_SPECULATIVE=0A=
>>>>   mm: VMA sequence count=0A=
>>>>   mm: provide speculative fault infrastructure=0A=
>>>>   x86/mm: add speculative pagefault handling=0A=
>>>>=0A=
>>>>  arch/arm64/Kconfig                    |   1 +=0A=
>>>>  arch/arm64/mm/fault.c                 |  12 +=0A=
>>>>  arch/powerpc/Kconfig                  |   1 +=0A=
>>>>  arch/powerpc/mm/fault.c               |  16 +=0A=
>>>>  arch/x86/Kconfig                      |   1 +=0A=
>>>>  arch/x86/mm/fault.c                   |  27 +-=0A=
>>>>  fs/exec.c                             |   2 +-=0A=
>>>>  fs/proc/task_mmu.c                    |   5 +-=0A=
>>>>  fs/userfaultfd.c                      |  17 +-=0A=
>>>>  include/linux/hugetlb_inline.h        |   2 +-=0A=
>>>>  include/linux/migrate.h               |   4 +-=0A=
>>>>  include/linux/mm.h                    | 136 +++++++-=0A=
>>>>  include/linux/mm_types.h              |   7 +=0A=
>>>>  include/linux/pagemap.h               |   4 +-=0A=
>>>>  include/linux/rmap.h                  |  12 +-=0A=
>>>>  include/linux/swap.h                  |  10 +-=0A=
>>>>  include/linux/vm_event_item.h         |   3 +=0A=
>>>>  include/trace/events/pagefault.h      |  80 +++++=0A=
>>>>  include/uapi/linux/perf_event.h       |   1 +=0A=
>>>>  kernel/fork.c                         |   5 +-=0A=
>>>>  mm/Kconfig                            |  22 ++=0A=
>>>>  mm/huge_memory.c                      |   6 +-=0A=
>>>>  mm/hugetlb.c                          |   2 +=0A=
>>>>  mm/init-mm.c                          |   3 +=0A=
>>>>  mm/internal.h                         |  20 ++=0A=
>>>>  mm/khugepaged.c                       |   5 +=0A=
>>>>  mm/madvise.c                          |   6 +-=0A=
>>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++=
++++-----=0A=
>>>>  mm/mempolicy.c                        |  51 ++-=0A=
>>>>  mm/migrate.c                          |   6 +-=0A=
>>>>  mm/mlock.c                            |  13 +-=0A=
>>>>  mm/mmap.c                             | 229 ++++++++++---=0A=
>>>>  mm/mprotect.c                         |   4 +-=0A=
>>>>  mm/mremap.c                           |  13 +=0A=
>>>>  mm/nommu.c                            |   2 +-=0A=
>>>>  mm/rmap.c                             |   5 +-=0A=
>>>>  mm/swap.c                             |   6 +-=0A=
>>>>  mm/swap_state.c                       |   8 +-=0A=
>>>>  mm/vmstat.c                           |   5 +-=0A=
>>>>  tools/include/uapi/linux/perf_event.h |   1 +=0A=
>>>>  tools/perf/util/evsel.c               |   1 +=0A=
>>>>  tools/perf/util/parse-events.c        |   4 +=0A=
>>>>  tools/perf/util/parse-events.l        |   1 +=0A=
>>>>  tools/perf/util/python.c              |   1 +=0A=
>>>>  44 files changed, 1161 insertions(+), 211 deletions(-)=0A=
>>>>  create mode 100644 include/trace/events/pagefault.h=0A=
>>>>=0A=
>>>> --=0A=
>>>> 2.7.4=0A=
>>>>=0A=
>>>>=0A=
>>>=0A=
>>=0A=
>=0A=
=0A=

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2018-06-11  7:49           ` Song, HaiyanX
  (?)
  (?)
@ 2018-07-02  8:59           ` Laurent Dufour
  2018-07-04  3:23               ` Song, HaiyanX
  -1 siblings, 1 reply; 58+ messages in thread
From: Laurent Dufour @ 2018-07-02  8:59 UTC (permalink / raw)
  To: Song, HaiyanX
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

On 11/06/2018 09:49, Song, HaiyanX wrote:
> Hi Laurent,
> 
> Regression test for v11 patch serials have been run, some regression is found by LKP-tools (linux kernel performance)
> tested on Intel 4s skylake platform. This time only test the cases which have been run and found regressions on
> V9 patch serials.
> 
> The regression result is sorted by the metric will-it-scale.per_thread_ops.
> branch: Laurent-Dufour/Speculative-page-faults/20180520-045126
> commit id:
>   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12
>   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1
> Benchmark: will-it-scale
> Download link: https://github.com/antonblanchard/will-it-scale/tree/master
> 
> Metrics:
>   will-it-scale.per_process_ops=processes/nr_cpu
>   will-it-scale.per_thread_ops=threads/nr_cpu
>   test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
> THP: enable / disable
> nr_task:100%
> 
> 1. Regressions:
> 
> a). Enable THP
> testcase                          base           change      head           metric
> page_fault3/enable THP           10519          -20.5%        836      will-it-scale.per_thread_ops
> page_fault2/enalbe THP            8281          -18.8%       6728      will-it-scale.per_thread_ops
> brk1/eanble THP                 998475           -2.2%     976893      will-it-scale.per_process_ops
> context_switch1/enable THP      223910           -1.3%     220930      will-it-scale.per_process_ops
> context_switch1/enable THP      233722           -1.0%     231288      will-it-scale.per_thread_ops
> 
> b). Disable THP
> page_fault3/disable THP          10856          -23.1%       8344      will-it-scale.per_thread_ops
> page_fault2/disable THP           8147          -18.8%       6613      will-it-scale.per_thread_ops
> brk1/disable THP                   957           -7.9%        881      will-it-scale.per_thread_ops
> context_switch1/disable THP     237006           -2.2%     231907      will-it-scale.per_thread_ops
> brk1/disable THP                997317           -2.0%     977778      will-it-scale.per_process_ops
> page_fault3/disable THP         467454           -1.8%     459251      will-it-scale.per_process_ops
> context_switch1/disable THP     224431           -1.3%     221567      will-it-scale.per_process_ops
> 
> Notes: for the above  values of test result, the higher is better.

I tried the same tests on my PowerPC victim VM (1024 CPUs, 11TB) and I can't
get reproducible results. The results have huge variation, even on the vanilla
kernel, and I can't state on any changes due to that.

I tried on smaller node (80 CPUs, 32G), and the tests ran better, but I didn't
measure any changes between the vanilla and the SPF patched ones:

test THP enabled		4.17.0-rc4-mm1	spf		delta
page_fault3_threads		2697.7		2683.5		-0.53%
page_fault2_threads		170660.6	169574.1	-0.64%
context_switch1_threads		6915269.2	6877507.3	-0.55%
context_switch1_processes	6478076.2	6529493.5	0.79%
brk1				243391.2	238527.5	-2.00%

Tests were run 10 times, no high variation detected.

Did you see high variation on your side ? How many times the test were run to
compute the average values ?

Thanks,
Laurent.


> 
> 2. Improvement: not found improvement based on the selected test cases.
> 
> 
> Best regards
> Haiyan Song
> ________________________________________
> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
> Sent: Monday, May 28, 2018 4:54 PM
> To: Song, HaiyanX
> Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
> Subject: Re: [PATCH v11 00/26] Speculative page faults
> 
> On 28/05/2018 10:22, Haiyan Song wrote:
>> Hi Laurent,
>>
>> Yes, these tests are done on V9 patch.
> 
> Do you plan to give this V11 a run ?
> 
>>
>>
>> Best regards,
>> Haiyan Song
>>
>> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:
>>> On 28/05/2018 07:23, Song, HaiyanX wrote:
>>>>
>>>> Some regression and improvements is found by LKP-tools(linux kernel performance) on V9 patch series
>>>> tested on Intel 4s Skylake platform.
>>>
>>> Hi,
>>>
>>> Thanks for reporting this benchmark results, but you mentioned the "V9 patch
>>> series" while responding to the v11 header series...
>>> Were these tests done on v9 or v11 ?
>>>
>>> Cheers,
>>> Laurent.
>>>
>>>>
>>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
>>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 patch series)
>>>> Commit id:
>>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f
>>>>     head commit: 0355322b3577eeab7669066df42c550a56801110
>>>> Benchmark suite: will-it-scale
>>>> Download link:
>>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests
>>>> Metrics:
>>>>     will-it-scale.per_process_ops=processes/nr_cpu
>>>>     will-it-scale.per_thread_ops=threads/nr_cpu
>>>> test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
>>>> THP: enable / disable
>>>> nr_task: 100%
>>>>
>>>> 1. Regressions:
>>>> a) THP enabled:
>>>> testcase                        base            change          head       metric
>>>> page_fault3/ enable THP         10092           -17.5%          8323       will-it-scale.per_thread_ops
>>>> page_fault2/ enable THP          8300           -17.2%          6869       will-it-scale.per_thread_ops
>>>> brk1/ enable THP                  957.67         -7.6%           885       will-it-scale.per_thread_ops
>>>> page_fault3/ enable THP        172821            -5.3%        163692       will-it-scale.per_process_ops
>>>> signal1/ enable THP              9125            -3.2%          8834       will-it-scale.per_process_ops
>>>>
>>>> b) THP disabled:
>>>> testcase                        base            change          head       metric
>>>> page_fault3/ disable THP        10107           -19.1%          8180       will-it-scale.per_thread_ops
>>>> page_fault2/ disable THP         8432           -17.8%          6931       will-it-scale.per_thread_ops
>>>> context_switch1/ disable THP   215389            -6.8%        200776       will-it-scale.per_thread_ops
>>>> brk1/ disable THP                 939.67         -6.6%           877.33    will-it-scale.per_thread_ops
>>>> page_fault3/ disable THP       173145            -4.7%        165064       will-it-scale.per_process_ops
>>>> signal1/ disable THP             9162            -3.9%          8802       will-it-scale.per_process_ops
>>>>
>>>> 2. Improvements:
>>>> a) THP enabled:
>>>> testcase                        base            change          head       metric
>>>> malloc1/ enable THP               66.33        +469.8%           383.67    will-it-scale.per_thread_ops
>>>> writeseek3/ enable THP          2531             +4.5%          2646       will-it-scale.per_thread_ops
>>>> signal1/ enable THP              989.33          +2.8%          1016       will-it-scale.per_thread_ops
>>>>
>>>> b) THP disabled:
>>>> testcase                        base            change          head       metric
>>>> malloc1/ disable THP              90.33        +417.3%           467.33    will-it-scale.per_thread_ops
>>>> read2/ disable THP             58934            +39.2%         82060       will-it-scale.per_thread_ops
>>>> page_fault1/ disable THP        8607            +36.4%         11736       will-it-scale.per_thread_ops
>>>> read1/ disable THP            314063            +12.7%        353934       will-it-scale.per_thread_ops
>>>> writeseek3/ disable THP         2452            +12.5%          2759       will-it-scale.per_thread_ops
>>>> signal1/ disable THP             971.33          +5.5%          1024       will-it-scale.per_thread_ops
>>>>
>>>> Notes: for above values in column "change", the higher value means that the related testcase result
>>>> on head commit is better than that on base commit for this benchmark.
>>>>
>>>>
>>>> Best regards
>>>> Haiyan Song
>>>>
>>>> ________________________________________
>>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
>>>> Sent: Thursday, May 17, 2018 7:06 PM
>>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi
>>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
>>>> Subject: [PATCH v11 00/26] Speculative page faults
>>>>
>>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
>>>> page fault without holding the mm semaphore [1].
>>>>
>>>> The idea is to try to handle user space page faults without holding the
>>>> mmap_sem. This should allow better concurrency for massively threaded
>>>> process since the page fault handler will not wait for other threads memory
>>>> layout change to be done, assuming that this change is done in another part
>>>> of the process's memory space. This type page fault is named speculative
>>>> page fault. If the speculative page fault fails because of a concurrency is
>>>> detected or because underlying PMD or PTE tables are not yet allocating, it
>>>> is failing its processing and a classic page fault is then tried.
>>>>
>>>> The speculative page fault (SPF) has to look for the VMA matching the fault
>>>> address without holding the mmap_sem, this is done by introducing a rwlock
>>>> which protects the access to the mm_rb tree. Previously this was done using
>>>> SRCU but it was introducing a lot of scheduling to process the VMA's
>>>> freeing operation which was hitting the performance by 20% as reported by
>>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is
>>>> limiting the locking contention to these operations which are expected to
>>>> be in a O(log n) order. In addition to ensure that the VMA is not freed in
>>>> our back a reference count is added and 2 services (get_vma() and
>>>> put_vma()) are introduced to handle the reference count. Once a VMA is
>>>> fetched from the RB tree using get_vma(), it must be later freed using
>>>> put_vma(). I can't see anymore the overhead I got while will-it-scale
>>>> benchmark anymore.
>>>>
>>>> The VMA's attributes checked during the speculative page fault processing
>>>> have to be protected against parallel changes. This is done by using a per
>>>> VMA sequence lock. This sequence lock allows the speculative page fault
>>>> handler to fast check for parallel changes in progress and to abort the
>>>> speculative page fault in that case.
>>>>
>>>> Once the VMA has been found, the speculative page fault handler would check
>>>> for the VMA's attributes to verify that the page fault has to be handled
>>>> correctly or not. Thus, the VMA is protected through a sequence lock which
>>>> allows fast detection of concurrent VMA changes. If such a change is
>>>> detected, the speculative page fault is aborted and a *classic* page fault
>>>> is tried.  VMA sequence lockings are added when VMA attributes which are
>>>> checked during the page fault are modified.
>>>>
>>>> When the PTE is fetched, the VMA is checked to see if it has been changed,
>>>> so once the page table is locked, the VMA is valid, so any other changes
>>>> leading to touching this PTE will need to lock the page table, so no
>>>> parallel change is possible at this time.
>>>>
>>>> The locking of the PTE is done with interrupts disabled, this allows
>>>> checking for the PMD to ensure that there is not an ongoing collapsing
>>>> operation. Since khugepaged is firstly set the PMD to pmd_none and then is
>>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd is
>>>> valid at the time the PTE is locked, we have the guarantee that the
>>>> collapsing operation will have to wait on the PTE lock to move forward.
>>>> This allows the SPF handler to map the PTE safely. If the PMD value is
>>>> different from the one recorded at the beginning of the SPF operation, the
>>>> classic page fault handler will be called to handle the operation while
>>>> holding the mmap_sem. As the PTE lock is done with the interrupts disabled,
>>>> the lock is done using spin_trylock() to avoid dead lock when handling a
>>>> page fault while a TLB invalidate is requested by another CPU holding the
>>>> PTE.
>>>>
>>>> In pseudo code, this could be seen as:
>>>>     speculative_page_fault()
>>>>     {
>>>>             vma = get_vma()
>>>>             check vma sequence count
>>>>             check vma's support
>>>>             disable interrupt
>>>>                   check pgd,p4d,...,pte
>>>>                   save pmd and pte in vmf
>>>>                   save vma sequence counter in vmf
>>>>             enable interrupt
>>>>             check vma sequence count
>>>>             handle_pte_fault(vma)
>>>>                     ..
>>>>                     page = alloc_page()
>>>>                     pte_map_lock()
>>>>                             disable interrupt
>>>>                                     abort if sequence counter has changed
>>>>                                     abort if pmd or pte has changed
>>>>                                     pte map and lock
>>>>                             enable interrupt
>>>>                     if abort
>>>>                        free page
>>>>                        abort
>>>>                     ...
>>>>     }
>>>>
>>>>     arch_fault_handler()
>>>>     {
>>>>             if (speculative_page_fault(&vma))
>>>>                goto done
>>>>     again:
>>>>             lock(mmap_sem)
>>>>             vma = find_vma();
>>>>             handle_pte_fault(vma);
>>>>             if retry
>>>>                unlock(mmap_sem)
>>>>                goto again;
>>>>     done:
>>>>             handle fault error
>>>>     }
>>>>
>>>> Support for THP is not done because when checking for the PMD, we can be
>>>> confused by an in progress collapsing operation done by khugepaged. The
>>>> issue is that pmd_none() could be true either if the PMD is not already
>>>> populated or if the underlying PTE are in the way to be collapsed. So we
>>>> cannot safely allocate a PMD if pmd_none() is true.
>>>>
>>>> This series add a new software performance event named 'speculative-faults'
>>>> or 'spf'. It counts the number of successful page fault event handled
>>>> speculatively. When recording 'faults,spf' events, the faults one is
>>>> counting the total number of page fault events while 'spf' is only counting
>>>> the part of the faults processed speculatively.
>>>>
>>>> There are some trace events introduced by this series. They allow
>>>> identifying why the page faults were not processed speculatively. This
>>>> doesn't take in account the faults generated by a monothreaded process
>>>> which directly processed while holding the mmap_sem. This trace events are
>>>> grouped in a system named 'pagefault', they are:
>>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back
>>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.
>>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported
>>>>  - pagefault:spf_vma_access : the VMA's access right are not respected
>>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in our
>>>>    back.
>>>>
>>>> To record all the related events, the easier is to run perf with the
>>>> following arguments :
>>>> $ perf stat -e 'faults,spf,pagefault:*' <command>
>>>>
>>>> There is also a dedicated vmstat counter showing the number of successful
>>>> page fault handled speculatively. I can be seen this way:
>>>> $ grep speculative_pgfault /proc/vmstat
>>>>
>>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is functional
>>>> on x86, PowerPC and arm64.
>>>>
>>>> ---------------------
>>>> Real Workload results
>>>>
>>>> As mentioned in previous email, we did non official runs using a "popular
>>>> in memory multithreaded database product" on 176 cores SMT8 Power system
>>>> which showed a 30% improvements in the number of transaction processed per
>>>> second. This run has been done on the v6 series, but changes introduced in
>>>> this new version should not impact the performance boost seen.
>>>>
>>>> Here are the perf data captured during 2 of these runs on top of the v8
>>>> series:
>>>>                 vanilla         spf
>>>> faults          89.418          101.364         +13%
>>>> spf                n/a           97.989
>>>>
>>>> With the SPF kernel, most of the page fault were processed in a speculative
>>>> way.
>>>>
>>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and gave
>>>> it a try on an android device. He reported that the application launch time
>>>> was improved in average by 6%, and for large applications (~100 threads) by
>>>> 20%.
>>>>
>>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qcom
>>>> MSM845 (8 cores) with 6GB (the less is better):
>>>>
>>>> Application                             4.9     4.9+spf delta
>>>> com.tencent.mm                          416     389     -7%
>>>> com.eg.android.AlipayGphone             1135    986     -13%
>>>> com.tencent.mtt                         455     454     0%
>>>> com.qqgame.hlddz                        1497    1409    -6%
>>>> com.autonavi.minimap                    711     701     -1%
>>>> com.tencent.tmgp.sgame                  788     748     -5%
>>>> com.immomo.momo                         501     487     -3%
>>>> com.tencent.peng                        2145    2112    -2%
>>>> com.smile.gifmaker                      491     461     -6%
>>>> com.baidu.BaiduMap                      479     366     -23%
>>>> com.taobao.taobao                       1341    1198    -11%
>>>> com.baidu.searchbox                     333     314     -6%
>>>> com.tencent.mobileqq                    394     384     -3%
>>>> com.sina.weibo                          907     906     0%
>>>> com.youku.phone                         816     731     -11%
>>>> com.happyelements.AndroidAnimal.qq      763     717     -6%
>>>> com.UCMobile                            415     411     -1%
>>>> com.tencent.tmgp.ak                     1464    1431    -2%
>>>> com.tencent.qqmusic                     336     329     -2%
>>>> com.sankuai.meituan                     1661    1302    -22%
>>>> com.netease.cloudmusic                  1193    1200    1%
>>>> air.tv.douyu.android                    4257    4152    -2%
>>>>
>>>> ------------------
>>>> Benchmarks results
>>>>
>>>> Base kernel is v4.17.0-rc4-mm1
>>>> SPF is BASE + this series
>>>>
>>>> Kernbench:
>>>> ----------
>>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15
>>>> kernel (kernel is build 5 times):
>>>>
>>>> Average Half load -j 8
>>>>                  Run    (std deviation)
>>>>                  BASE                   SPF
>>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%
>>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%
>>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%
>>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%
>>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%
>>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%
>>>>
>>>> Average Optimal load -j 16
>>>>                  Run    (std deviation)
>>>>                  BASE                   SPF
>>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%
>>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%
>>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%
>>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%
>>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%
>>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%
>>>>
>>>>
>>>> During a run on the SPF, perf events were captured:
>>>>  Performance counter stats for '../kernbench -M':
>>>>          526743764      faults
>>>>                210      spf
>>>>                  3      pagefault:spf_vma_changed
>>>>                  0      pagefault:spf_vma_noanon
>>>>               2278      pagefault:spf_vma_notsup
>>>>                  0      pagefault:spf_vma_access
>>>>                  0      pagefault:spf_pmd_changed
>>>>
>>>> Very few speculative page faults were recorded as most of the processes
>>>> involved are monothreaded (sounds that on this architecture some threads
>>>> were created during the kernel build processing).
>>>>
>>>> Here are the kerbench results on a 80 CPUs Power8 system:
>>>>
>>>> Average Half load -j 40
>>>>                  Run    (std deviation)
>>>>                  BASE                   SPF
>>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%
>>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%
>>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%
>>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%
>>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%
>>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%
>>>>
>>>> Average Optimal load -j 80
>>>>                  Run    (std deviation)
>>>>                  BASE                   SPF
>>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%
>>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%
>>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%
>>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%
>>>> Context Switches 223861  (138865)       225032  (139632)        0.52%
>>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%
>>>>
>>>> During a run on the SPF, perf events were captured:
>>>>  Performance counter stats for '../kernbench -M':
>>>>          116730856      faults
>>>>                  0      spf
>>>>                  3      pagefault:spf_vma_changed
>>>>                  0      pagefault:spf_vma_noanon
>>>>                476      pagefault:spf_vma_notsup
>>>>                  0      pagefault:spf_vma_access
>>>>                  0      pagefault:spf_pmd_changed
>>>>
>>>> Most of the processes involved are monothreaded so SPF is not activated but
>>>> there is no impact on the performance.
>>>>
>>>> Ebizzy:
>>>> -------
>>>> The test is counting the number of records per second it can manage, the
>>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get
>>>> consistent result I repeated the test 100 times and measure the average
>>>> result. The number is the record processes per second, the higher is the
>>>> best.
>>>>
>>>>                 BASE            SPF             delta
>>>> 16 CPUs x86 VM  742.57          1490.24         100.69%
>>>> 80 CPUs P8 node 13105.4         24174.23        84.46%
>>>>
>>>> Here are the performance counter read during a run on a 16 CPUs x86 VM:
>>>>  Performance counter stats for './ebizzy -mTt 16':
>>>>            1706379      faults
>>>>            1674599      spf
>>>>              30588      pagefault:spf_vma_changed
>>>>                  0      pagefault:spf_vma_noanon
>>>>                363      pagefault:spf_vma_notsup
>>>>                  0      pagefault:spf_vma_access
>>>>                  0      pagefault:spf_pmd_changed
>>>>
>>>> And the ones captured during a run on a 80 CPUs Power node:
>>>>  Performance counter stats for './ebizzy -mTt 80':
>>>>            1874773      faults
>>>>            1461153      spf
>>>>             413293      pagefault:spf_vma_changed
>>>>                  0      pagefault:spf_vma_noanon
>>>>                200      pagefault:spf_vma_notsup
>>>>                  0      pagefault:spf_vma_access
>>>>                  0      pagefault:spf_pmd_changed
>>>>
>>>> In ebizzy's case most of the page fault were handled in a speculative way,
>>>> leading the ebizzy performance boost.
>>>>
>>>> ------------------
>>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):
>>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahendran
>>>>    and Minchan Kim, hopefully.
>>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in
>>>>    __do_page_fault().
>>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails
>>>>    instead
>>>>    of aborting the speculative page fault handling. Dropping the now
>>>> useless
>>>>    trace event pagefault:spf_pte_lock.
>>>>  - No more try to reuse the fetched VMA during the speculative page fault
>>>>    handling when retrying is needed. This adds a lot of complexity and
>>>>    additional tests done didn't show a significant performance improvement.
>>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.
>>>>
>>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at-speculative-page-faults-tt965642.html#none
>>>> [2] https://patchwork.kernel.org/patch/9999687/
>>>>
>>>>
>>>> Laurent Dufour (20):
>>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT
>>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE
>>>>   mm: make pte_unmap_same compatible with SPF
>>>>   mm: introduce INIT_VMA()
>>>>   mm: protect VMA modifications using VMA sequence count
>>>>   mm: protect mremap() against SPF hanlder
>>>>   mm: protect SPF handler against anon_vma changes
>>>>   mm: cache some VMA fields in the vm_fault structure
>>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()
>>>>   mm: introduce __lru_cache_add_active_or_unevictable
>>>>   mm: introduce __vm_normal_page()
>>>>   mm: introduce __page_add_new_anon_rmap()
>>>>   mm: protect mm_rb tree with a rwlock
>>>>   mm: adding speculative page fault failure trace events
>>>>   perf: add a speculative page fault sw event
>>>>   perf tools: add support for the SPF perf event
>>>>   mm: add speculative page fault vmstats
>>>>   powerpc/mm: add speculative page fault
>>>>
>>>> Mahendran Ganesh (2):
>>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
>>>>   arm64/mm: add speculative page fault
>>>>
>>>> Peter Zijlstra (4):
>>>>   mm: prepare for FAULT_FLAG_SPECULATIVE
>>>>   mm: VMA sequence count
>>>>   mm: provide speculative fault infrastructure
>>>>   x86/mm: add speculative pagefault handling
>>>>
>>>>  arch/arm64/Kconfig                    |   1 +
>>>>  arch/arm64/mm/fault.c                 |  12 +
>>>>  arch/powerpc/Kconfig                  |   1 +
>>>>  arch/powerpc/mm/fault.c               |  16 +
>>>>  arch/x86/Kconfig                      |   1 +
>>>>  arch/x86/mm/fault.c                   |  27 +-
>>>>  fs/exec.c                             |   2 +-
>>>>  fs/proc/task_mmu.c                    |   5 +-
>>>>  fs/userfaultfd.c                      |  17 +-
>>>>  include/linux/hugetlb_inline.h        |   2 +-
>>>>  include/linux/migrate.h               |   4 +-
>>>>  include/linux/mm.h                    | 136 +++++++-
>>>>  include/linux/mm_types.h              |   7 +
>>>>  include/linux/pagemap.h               |   4 +-
>>>>  include/linux/rmap.h                  |  12 +-
>>>>  include/linux/swap.h                  |  10 +-
>>>>  include/linux/vm_event_item.h         |   3 +
>>>>  include/trace/events/pagefault.h      |  80 +++++
>>>>  include/uapi/linux/perf_event.h       |   1 +
>>>>  kernel/fork.c                         |   5 +-
>>>>  mm/Kconfig                            |  22 ++
>>>>  mm/huge_memory.c                      |   6 +-
>>>>  mm/hugetlb.c                          |   2 +
>>>>  mm/init-mm.c                          |   3 +
>>>>  mm/internal.h                         |  20 ++
>>>>  mm/khugepaged.c                       |   5 +
>>>>  mm/madvise.c                          |   6 +-
>>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++++++-----
>>>>  mm/mempolicy.c                        |  51 ++-
>>>>  mm/migrate.c                          |   6 +-
>>>>  mm/mlock.c                            |  13 +-
>>>>  mm/mmap.c                             | 229 ++++++++++---
>>>>  mm/mprotect.c                         |   4 +-
>>>>  mm/mremap.c                           |  13 +
>>>>  mm/nommu.c                            |   2 +-
>>>>  mm/rmap.c                             |   5 +-
>>>>  mm/swap.c                             |   6 +-
>>>>  mm/swap_state.c                       |   8 +-
>>>>  mm/vmstat.c                           |   5 +-
>>>>  tools/include/uapi/linux/perf_event.h |   1 +
>>>>  tools/perf/util/evsel.c               |   1 +
>>>>  tools/perf/util/parse-events.c        |   4 +
>>>>  tools/perf/util/parse-events.l        |   1 +
>>>>  tools/perf/util/python.c              |   1 +
>>>>  44 files changed, 1161 insertions(+), 211 deletions(-)
>>>>  create mode 100644 include/trace/events/pagefault.h
>>>>
>>>> --
>>>> 2.7.4
>>>>
>>>>
>>>
>>
> 

^ permalink raw reply	[flat|nested] 58+ messages in thread

* Re: [PATCH v11 00/26] Speculative page faults
  2018-06-11 15:15           ` Laurent Dufour
@ 2018-06-19  9:16               ` Haiyan Song
  0 siblings, 0 replies; 58+ messages in thread
From: Haiyan Song @ 2018-06-19  9:16 UTC (permalink / raw)
  To: Laurent Dufour
  Cc: akpm, mhocko, peterz, kirill, ak, dave, jack, Matthew Wilcox,
	khandual, aneesh.kumar, benh, mpe, paulus, Thomas Gleixner,
	Ingo Molnar, hpa, Will Deacon, Sergey Senozhatsky,
	sergey.senozhatsky.work, Andrea Arcangeli, Alexei Starovoitov,
	Wang, Kemi, Daniel Jordan, David Rientjes, Jerome Glisse,
	Ganesh Mahendran, Minchan Kim, Punit Agrawal, vinayak menon,
	Yang Shi, linux-kernel, linux-mm, haren, npiggin, bsingharora,
	paulmck, Tim Chen, linuxppc-dev, x86

[-- Attachment #1: Type: text/plain, Size: 31691 bytes --]

On Mon, Jun 11, 2018 at 05:15:22PM +0200, Laurent Dufour wrote:

Hi Laurent,

For perf date tested on Intel 4s Skylake platform, here attached the compare result
between base and head commit in attachment, which include the perf-profile comparision information.

And also attached some perf-profile.json captured from test result for page_fault2 and page_fault3 for
checking the regression, thanks.


Best regards,
Haiyan Song



> Hi Haiyan,
> 
> I don't have access to the same hardware you ran the test on, but I give a try
> to those test on a Power8 system (2 sockets, 5 cores/s, 8 threads/c, 80 CPUs 32G).
> I run each will-it-scale test 10 times and compute the average.
> 
> test THP enabled		4.17.0-rc4-mm1	spf		delta
> page_fault3_threads		2697.7		2683.5		-0.53%
> page_fault2_threads		170660.6	169574.1	-0.64%
> context_switch1_threads		6915269.2	6877507.3	-0.55%
> context_switch1_processes	6478076.2	6529493.5	0.79%
> rk1				243391.2	238527.5	-2.00%
> 
> Test were launched with the arguments '-t 80 -s 5', only the average report is
> taken in account. Note that page size is 64K by default on ppc64.
> 
> It would be nice if you could capture some perf data to figure out why the
> page_fault2/3 are showing such a performance regression.
> 
> Thanks,
> Laurent.
> 
> On 11/06/2018 09:49, Song, HaiyanX wrote:
> > Hi Laurent,
> > 
> > Regression test for v11 patch serials have been run, some regression is found by LKP-tools (linux kernel performance)
> > tested on Intel 4s skylake platform. This time only test the cases which have been run and found regressions on
> > V9 patch serials.
> > 
> > The regression result is sorted by the metric will-it-scale.per_thread_ops.
> > branch: Laurent-Dufour/Speculative-page-faults/20180520-045126
> > commit id:
> >   head commit : a7a8993bfe3ccb54ad468b9f1799649e4ad1ff12
> >   base commit : ba98a1cdad71d259a194461b3a61471b49b14df1
> > Benchmark: will-it-scale
> > Download link: https://github.com/antonblanchard/will-it-scale/tree/master
> > 
> > Metrics:
> >   will-it-scale.per_process_ops=processes/nr_cpu
> >   will-it-scale.per_thread_ops=threads/nr_cpu
> >   test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
> > THP: enable / disable
> > nr_task:100%
> > 
> > 1. Regressions:
> > 
> > a). Enable THP
> > testcase                          base           change      head           metric
> > page_fault3/enable THP           10519          -20.5%       8368      will-it-scale.per_thread_ops
> > page_fault2/enalbe THP            8281          -18.8%       6728      will-it-scale.per_thread_ops
> > brk1/eanble THP                 998475           -2.2%     976893      will-it-scale.per_process_ops
> > context_switch1/enable THP      223910           -1.3%     220930      will-it-scale.per_process_ops
> > context_switch1/enable THP      233722           -1.0%     231288      will-it-scale.per_thread_ops
> > 
> > b). Disable THP
> > page_fault3/disable THP          10856          -23.1%       8344      will-it-scale.per_thread_ops
> > page_fault2/disable THP           8147          -18.8%       6613      will-it-scale.per_thread_ops
> > brk1/disable THP                   957           -7.9%        881      will-it-scale.per_thread_ops
> > context_switch1/disable THP     237006           -2.2%     231907      will-it-scale.per_thread_ops
> > brk1/disable THP                997317           -2.0%     977778      will-it-scale.per_process_ops
> > page_fault3/disable THP         467454           -1.8%     459251      will-it-scale.per_process_ops
> > context_switch1/disable THP     224431           -1.3%     221567      will-it-scale.per_process_ops
> > 
> > Notes: for the above  values of test result, the higher is better.
> > 
> > 2. Improvement: not found improvement based on the selected test cases.
> > 
> > 
> > Best regards
> > Haiyan Song
> > ________________________________________
> > From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
> > Sent: Monday, May 28, 2018 4:54 PM
> > To: Song, HaiyanX
> > Cc: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi; linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
> > Subject: Re: [PATCH v11 00/26] Speculative page faults
> > 
> > On 28/05/2018 10:22, Haiyan Song wrote:
> >> Hi Laurent,
> >>
> >> Yes, these tests are done on V9 patch.
> > 
> > Do you plan to give this V11 a run ?
> > 
> >>
> >>
> >> Best regards,
> >> Haiyan Song
> >>
> >> On Mon, May 28, 2018 at 09:51:34AM +0200, Laurent Dufour wrote:
> >>> On 28/05/2018 07:23, Song, HaiyanX wrote:
> >>>>
> >>>> Some regression and improvements is found by LKP-tools(linux kernel performance) on V9 patch series
> >>>> tested on Intel 4s Skylake platform.
> >>>
> >>> Hi,
> >>>
> >>> Thanks for reporting this benchmark results, but you mentioned the "V9 patch
> >>> series" while responding to the v11 header series...
> >>> Were these tests done on v9 or v11 ?
> >>>
> >>> Cheers,
> >>> Laurent.
> >>>
> >>>>
> >>>> The regression result is sorted by the metric will-it-scale.per_thread_ops.
> >>>> Branch: Laurent-Dufour/Speculative-page-faults/20180316-151833 (V9 patch series)
> >>>> Commit id:
> >>>>     base commit: d55f34411b1b126429a823d06c3124c16283231f
> >>>>     head commit: 0355322b3577eeab7669066df42c550a56801110
> >>>> Benchmark suite: will-it-scale
> >>>> Download link:
> >>>> https://github.com/antonblanchard/will-it-scale/tree/master/tests
> >>>> Metrics:
> >>>>     will-it-scale.per_process_ops=processes/nr_cpu
> >>>>     will-it-scale.per_thread_ops=threads/nr_cpu
> >>>> test box: lkp-skl-4sp1(nr_cpu=192,memory=768G)
> >>>> THP: enable / disable
> >>>> nr_task: 100%
> >>>>
> >>>> 1. Regressions:
> >>>> a) THP enabled:
> >>>> testcase                        base            change          head       metric
> >>>> page_fault3/ enable THP         10092           -17.5%          8323       will-it-scale.per_thread_ops
> >>>> page_fault2/ enable THP          8300           -17.2%          6869       will-it-scale.per_thread_ops
> >>>> brk1/ enable THP                  957.67         -7.6%           885       will-it-scale.per_thread_ops
> >>>> page_fault3/ enable THP        172821            -5.3%        163692       will-it-scale.per_process_ops
> >>>> signal1/ enable THP              9125            -3.2%          8834       will-it-scale.per_process_ops
> >>>>
> >>>> b) THP disabled:
> >>>> testcase                        base            change          head       metric
> >>>> page_fault3/ disable THP        10107           -19.1%          8180       will-it-scale.per_thread_ops
> >>>> page_fault2/ disable THP         8432           -17.8%          6931       will-it-scale.per_thread_ops
> >>>> context_switch1/ disable THP   215389            -6.8%        200776       will-it-scale.per_thread_ops
> >>>> brk1/ disable THP                 939.67         -6.6%           877.33    will-it-scale.per_thread_ops
> >>>> page_fault3/ disable THP       173145            -4.7%        165064       will-it-scale.per_process_ops
> >>>> signal1/ disable THP             9162            -3.9%          8802       will-it-scale.per_process_ops
> >>>>
> >>>> 2. Improvements:
> >>>> a) THP enabled:
> >>>> testcase                        base            change          head       metric
> >>>> malloc1/ enable THP               66.33        +469.8%           383.67    will-it-scale.per_thread_ops
> >>>> writeseek3/ enable THP          2531             +4.5%          2646       will-it-scale.per_thread_ops
> >>>> signal1/ enable THP              989.33          +2.8%          1016       will-it-scale.per_thread_ops
> >>>>
> >>>> b) THP disabled:
> >>>> testcase                        base            change          head       metric
> >>>> malloc1/ disable THP              90.33        +417.3%           467.33    will-it-scale.per_thread_ops
> >>>> read2/ disable THP             58934            +39.2%         82060       will-it-scale.per_thread_ops
> >>>> page_fault1/ disable THP        8607            +36.4%         11736       will-it-scale.per_thread_ops
> >>>> read1/ disable THP            314063            +12.7%        353934       will-it-scale.per_thread_ops
> >>>> writeseek3/ disable THP         2452            +12.5%          2759       will-it-scale.per_thread_ops
> >>>> signal1/ disable THP             971.33          +5.5%          1024       will-it-scale.per_thread_ops
> >>>>
> >>>> Notes: for above values in column "change", the higher value means that the related testcase result
> >>>> on head commit is better than that on base commit for this benchmark.
> >>>>
> >>>>
> >>>> Best regards
> >>>> Haiyan Song
> >>>>
> >>>> ________________________________________
> >>>> From: owner-linux-mm@kvack.org [owner-linux-mm@kvack.org] on behalf of Laurent Dufour [ldufour@linux.vnet.ibm.com]
> >>>> Sent: Thursday, May 17, 2018 7:06 PM
> >>>> To: akpm@linux-foundation.org; mhocko@kernel.org; peterz@infradead.org; kirill@shutemov.name; ak@linux.intel.com; dave@stgolabs.net; jack@suse.cz; Matthew Wilcox; khandual@linux.vnet.ibm.com; aneesh.kumar@linux.vnet.ibm.com; benh@kernel.crashing.org; mpe@ellerman.id.au; paulus@samba.org; Thomas Gleixner; Ingo Molnar; hpa@zytor.com; Will Deacon; Sergey Senozhatsky; sergey.senozhatsky.work@gmail.com; Andrea Arcangeli; Alexei Starovoitov; Wang, Kemi; Daniel Jordan; David Rientjes; Jerome Glisse; Ganesh Mahendran; Minchan Kim; Punit Agrawal; vinayak menon; Yang Shi
> >>>> Cc: linux-kernel@vger.kernel.org; linux-mm@kvack.org; haren@linux.vnet.ibm.com; npiggin@gmail.com; bsingharora@gmail.com; paulmck@linux.vnet.ibm.com; Tim Chen; linuxppc-dev@lists.ozlabs.org; x86@kernel.org
> >>>> Subject: [PATCH v11 00/26] Speculative page faults
> >>>>
> >>>> This is a port on kernel 4.17 of the work done by Peter Zijlstra to handle
> >>>> page fault without holding the mm semaphore [1].
> >>>>
> >>>> The idea is to try to handle user space page faults without holding the
> >>>> mmap_sem. This should allow better concurrency for massively threaded
> >>>> process since the page fault handler will not wait for other threads memory
> >>>> layout change to be done, assuming that this change is done in another part
> >>>> of the process's memory space. This type page fault is named speculative
> >>>> page fault. If the speculative page fault fails because of a concurrency is
> >>>> detected or because underlying PMD or PTE tables are not yet allocating, it
> >>>> is failing its processing and a classic page fault is then tried.
> >>>>
> >>>> The speculative page fault (SPF) has to look for the VMA matching the fault
> >>>> address without holding the mmap_sem, this is done by introducing a rwlock
> >>>> which protects the access to the mm_rb tree. Previously this was done using
> >>>> SRCU but it was introducing a lot of scheduling to process the VMA's
> >>>> freeing operation which was hitting the performance by 20% as reported by
> >>>> Kemi Wang [2]. Using a rwlock to protect access to the mm_rb tree is
> >>>> limiting the locking contention to these operations which are expected to
> >>>> be in a O(log n) order. In addition to ensure that the VMA is not freed in
> >>>> our back a reference count is added and 2 services (get_vma() and
> >>>> put_vma()) are introduced to handle the reference count. Once a VMA is
> >>>> fetched from the RB tree using get_vma(), it must be later freed using
> >>>> put_vma(). I can't see anymore the overhead I got while will-it-scale
> >>>> benchmark anymore.
> >>>>
> >>>> The VMA's attributes checked during the speculative page fault processing
> >>>> have to be protected against parallel changes. This is done by using a per
> >>>> VMA sequence lock. This sequence lock allows the speculative page fault
> >>>> handler to fast check for parallel changes in progress and to abort the
> >>>> speculative page fault in that case.
> >>>>
> >>>> Once the VMA has been found, the speculative page fault handler would check
> >>>> for the VMA's attributes to verify that the page fault has to be handled
> >>>> correctly or not. Thus, the VMA is protected through a sequence lock which
> >>>> allows fast detection of concurrent VMA changes. If such a change is
> >>>> detected, the speculative page fault is aborted and a *classic* page fault
> >>>> is tried.  VMA sequence lockings are added when VMA attributes which are
> >>>> checked during the page fault are modified.
> >>>>
> >>>> When the PTE is fetched, the VMA is checked to see if it has been changed,
> >>>> so once the page table is locked, the VMA is valid, so any other changes
> >>>> leading to touching this PTE will need to lock the page table, so no
> >>>> parallel change is possible at this time.
> >>>>
> >>>> The locking of the PTE is done with interrupts disabled, this allows
> >>>> checking for the PMD to ensure that there is not an ongoing collapsing
> >>>> operation. Since khugepaged is firstly set the PMD to pmd_none and then is
> >>>> waiting for the other CPU to have caught the IPI interrupt, if the pmd is
> >>>> valid at the time the PTE is locked, we have the guarantee that the
> >>>> collapsing operation will have to wait on the PTE lock to move forward.
> >>>> This allows the SPF handler to map the PTE safely. If the PMD value is
> >>>> different from the one recorded at the beginning of the SPF operation, the
> >>>> classic page fault handler will be called to handle the operation while
> >>>> holding the mmap_sem. As the PTE lock is done with the interrupts disabled,
> >>>> the lock is done using spin_trylock() to avoid dead lock when handling a
> >>>> page fault while a TLB invalidate is requested by another CPU holding the
> >>>> PTE.
> >>>>
> >>>> In pseudo code, this could be seen as:
> >>>>     speculative_page_fault()
> >>>>     {
> >>>>             vma = get_vma()
> >>>>             check vma sequence count
> >>>>             check vma's support
> >>>>             disable interrupt
> >>>>                   check pgd,p4d,...,pte
> >>>>                   save pmd and pte in vmf
> >>>>                   save vma sequence counter in vmf
> >>>>             enable interrupt
> >>>>             check vma sequence count
> >>>>             handle_pte_fault(vma)
> >>>>                     ..
> >>>>                     page = alloc_page()
> >>>>                     pte_map_lock()
> >>>>                             disable interrupt
> >>>>                                     abort if sequence counter has changed
> >>>>                                     abort if pmd or pte has changed
> >>>>                                     pte map and lock
> >>>>                             enable interrupt
> >>>>                     if abort
> >>>>                        free page
> >>>>                        abort
> >>>>                     ...
> >>>>     }
> >>>>
> >>>>     arch_fault_handler()
> >>>>     {
> >>>>             if (speculative_page_fault(&vma))
> >>>>                goto done
> >>>>     again:
> >>>>             lock(mmap_sem)
> >>>>             vma = find_vma();
> >>>>             handle_pte_fault(vma);
> >>>>             if retry
> >>>>                unlock(mmap_sem)
> >>>>                goto again;
> >>>>     done:
> >>>>             handle fault error
> >>>>     }
> >>>>
> >>>> Support for THP is not done because when checking for the PMD, we can be
> >>>> confused by an in progress collapsing operation done by khugepaged. The
> >>>> issue is that pmd_none() could be true either if the PMD is not already
> >>>> populated or if the underlying PTE are in the way to be collapsed. So we
> >>>> cannot safely allocate a PMD if pmd_none() is true.
> >>>>
> >>>> This series add a new software performance event named 'speculative-faults'
> >>>> or 'spf'. It counts the number of successful page fault event handled
> >>>> speculatively. When recording 'faults,spf' events, the faults one is
> >>>> counting the total number of page fault events while 'spf' is only counting
> >>>> the part of the faults processed speculatively.
> >>>>
> >>>> There are some trace events introduced by this series. They allow
> >>>> identifying why the page faults were not processed speculatively. This
> >>>> doesn't take in account the faults generated by a monothreaded process
> >>>> which directly processed while holding the mmap_sem. This trace events are
> >>>> grouped in a system named 'pagefault', they are:
> >>>>  - pagefault:spf_vma_changed : if the VMA has been changed in our back
> >>>>  - pagefault:spf_vma_noanon : the vma->anon_vma field was not yet set.
> >>>>  - pagefault:spf_vma_notsup : the VMA's type is not supported
> >>>>  - pagefault:spf_vma_access : the VMA's access right are not respected
> >>>>  - pagefault:spf_pmd_changed : the upper PMD pointer has changed in our
> >>>>    back.
> >>>>
> >>>> To record all the related events, the easier is to run perf with the
> >>>> following arguments :
> >>>> $ perf stat -e 'faults,spf,pagefault:*' <command>
> >>>>
> >>>> There is also a dedicated vmstat counter showing the number of successful
> >>>> page fault handled speculatively. I can be seen this way:
> >>>> $ grep speculative_pgfault /proc/vmstat
> >>>>
> >>>> This series builds on top of v4.16-mmotm-2018-04-13-17-28 and is functional
> >>>> on x86, PowerPC and arm64.
> >>>>
> >>>> ---------------------
> >>>> Real Workload results
> >>>>
> >>>> As mentioned in previous email, we did non official runs using a "popular
> >>>> in memory multithreaded database product" on 176 cores SMT8 Power system
> >>>> which showed a 30% improvements in the number of transaction processed per
> >>>> second. This run has been done on the v6 series, but changes introduced in
> >>>> this new version should not impact the performance boost seen.
> >>>>
> >>>> Here are the perf data captured during 2 of these runs on top of the v8
> >>>> series:
> >>>>                 vanilla         spf
> >>>> faults          89.418          101.364         +13%
> >>>> spf                n/a           97.989
> >>>>
> >>>> With the SPF kernel, most of the page fault were processed in a speculative
> >>>> way.
> >>>>
> >>>> Ganesh Mahendran had backported the series on top of a 4.9 kernel and gave
> >>>> it a try on an android device. He reported that the application launch time
> >>>> was improved in average by 6%, and for large applications (~100 threads) by
> >>>> 20%.
> >>>>
> >>>> Here are the launch time Ganesh mesured on Android 8.0 on top of a Qcom
> >>>> MSM845 (8 cores) with 6GB (the less is better):
> >>>>
> >>>> Application                             4.9     4.9+spf delta
> >>>> com.tencent.mm                          416     389     -7%
> >>>> com.eg.android.AlipayGphone             1135    986     -13%
> >>>> com.tencent.mtt                         455     454     0%
> >>>> com.qqgame.hlddz                        1497    1409    -6%
> >>>> com.autonavi.minimap                    711     701     -1%
> >>>> com.tencent.tmgp.sgame                  788     748     -5%
> >>>> com.immomo.momo                         501     487     -3%
> >>>> com.tencent.peng                        2145    2112    -2%
> >>>> com.smile.gifmaker                      491     461     -6%
> >>>> com.baidu.BaiduMap                      479     366     -23%
> >>>> com.taobao.taobao                       1341    1198    -11%
> >>>> com.baidu.searchbox                     333     314     -6%
> >>>> com.tencent.mobileqq                    394     384     -3%
> >>>> com.sina.weibo                          907     906     0%
> >>>> com.youku.phone                         816     731     -11%
> >>>> com.happyelements.AndroidAnimal.qq      763     717     -6%
> >>>> com.UCMobile                            415     411     -1%
> >>>> com.tencent.tmgp.ak                     1464    1431    -2%
> >>>> com.tencent.qqmusic                     336     329     -2%
> >>>> com.sankuai.meituan                     1661    1302    -22%
> >>>> com.netease.cloudmusic                  1193    1200    1%
> >>>> air.tv.douyu.android                    4257    4152    -2%
> >>>>
> >>>> ------------------
> >>>> Benchmarks results
> >>>>
> >>>> Base kernel is v4.17.0-rc4-mm1
> >>>> SPF is BASE + this series
> >>>>
> >>>> Kernbench:
> >>>> ----------
> >>>> Here are the results on a 16 CPUs X86 guest using kernbench on a 4.15
> >>>> kernel (kernel is build 5 times):
> >>>>
> >>>> Average Half load -j 8
> >>>>                  Run    (std deviation)
> >>>>                  BASE                   SPF
> >>>> Elapsed Time     1448.65 (5.72312)      1455.84 (4.84951)       0.50%
> >>>> User    Time     10135.4 (30.3699)      10148.8 (31.1252)       0.13%
> >>>> System  Time     900.47  (2.81131)      923.28  (7.52779)       2.53%
> >>>> Percent CPU      761.4   (1.14018)      760.2   (0.447214)      -0.16%
> >>>> Context Switches 85380   (3419.52)      84748   (1904.44)       -0.74%
> >>>> Sleeps           105064  (1240.96)      105074  (337.612)       0.01%
> >>>>
> >>>> Average Optimal load -j 16
> >>>>                  Run    (std deviation)
> >>>>                  BASE                   SPF
> >>>> Elapsed Time     920.528 (10.1212)      927.404 (8.91789)       0.75%
> >>>> User    Time     11064.8 (981.142)      11085   (990.897)       0.18%
> >>>> System  Time     979.904 (84.0615)      1001.14 (82.5523)       2.17%
> >>>> Percent CPU      1089.5  (345.894)      1086.1  (343.545)       -0.31%
> >>>> Context Switches 159488  (78156.4)      158223  (77472.1)       -0.79%
> >>>> Sleeps           110566  (5877.49)      110388  (5617.75)       -0.16%
> >>>>
> >>>>
> >>>> During a run on the SPF, perf events were captured:
> >>>>  Performance counter stats for '../kernbench -M':
> >>>>          526743764      faults
> >>>>                210      spf
> >>>>                  3      pagefault:spf_vma_changed
> >>>>                  0      pagefault:spf_vma_noanon
> >>>>               2278      pagefault:spf_vma_notsup
> >>>>                  0      pagefault:spf_vma_access
> >>>>                  0      pagefault:spf_pmd_changed
> >>>>
> >>>> Very few speculative page faults were recorded as most of the processes
> >>>> involved are monothreaded (sounds that on this architecture some threads
> >>>> were created during the kernel build processing).
> >>>>
> >>>> Here are the kerbench results on a 80 CPUs Power8 system:
> >>>>
> >>>> Average Half load -j 40
> >>>>                  Run    (std deviation)
> >>>>                  BASE                   SPF
> >>>> Elapsed Time     117.152 (0.774642)     117.166 (0.476057)      0.01%
> >>>> User    Time     4478.52 (24.7688)      4479.76 (9.08555)       0.03%
> >>>> System  Time     131.104 (0.720056)     134.04  (0.708414)      2.24%
> >>>> Percent CPU      3934    (19.7104)      3937.2  (19.0184)       0.08%
> >>>> Context Switches 92125.4 (576.787)      92581.6 (198.622)       0.50%
> >>>> Sleeps           317923  (652.499)      318469  (1255.59)       0.17%
> >>>>
> >>>> Average Optimal load -j 80
> >>>>                  Run    (std deviation)
> >>>>                  BASE                   SPF
> >>>> Elapsed Time     107.73  (0.632416)     107.31  (0.584936)      -0.39%
> >>>> User    Time     5869.86 (1466.72)      5871.71 (1467.27)       0.03%
> >>>> System  Time     153.728 (23.8573)      157.153 (24.3704)       2.23%
> >>>> Percent CPU      5418.6  (1565.17)      5436.7  (1580.91)       0.33%
> >>>> Context Switches 223861  (138865)       225032  (139632)        0.52%
> >>>> Sleeps           330529  (13495.1)      332001  (14746.2)       0.45%
> >>>>
> >>>> During a run on the SPF, perf events were captured:
> >>>>  Performance counter stats for '../kernbench -M':
> >>>>          116730856      faults
> >>>>                  0      spf
> >>>>                  3      pagefault:spf_vma_changed
> >>>>                  0      pagefault:spf_vma_noanon
> >>>>                476      pagefault:spf_vma_notsup
> >>>>                  0      pagefault:spf_vma_access
> >>>>                  0      pagefault:spf_pmd_changed
> >>>>
> >>>> Most of the processes involved are monothreaded so SPF is not activated but
> >>>> there is no impact on the performance.
> >>>>
> >>>> Ebizzy:
> >>>> -------
> >>>> The test is counting the number of records per second it can manage, the
> >>>> higher is the best. I run it like this 'ebizzy -mTt <nrcpus>'. To get
> >>>> consistent result I repeated the test 100 times and measure the average
> >>>> result. The number is the record processes per second, the higher is the
> >>>> best.
> >>>>
> >>>>                 BASE            SPF             delta
> >>>> 16 CPUs x86 VM  742.57          1490.24         100.69%
> >>>> 80 CPUs P8 node 13105.4         24174.23        84.46%
> >>>>
> >>>> Here are the performance counter read during a run on a 16 CPUs x86 VM:
> >>>>  Performance counter stats for './ebizzy -mTt 16':
> >>>>            1706379      faults
> >>>>            1674599      spf
> >>>>              30588      pagefault:spf_vma_changed
> >>>>                  0      pagefault:spf_vma_noanon
> >>>>                363      pagefault:spf_vma_notsup
> >>>>                  0      pagefault:spf_vma_access
> >>>>                  0      pagefault:spf_pmd_changed
> >>>>
> >>>> And the ones captured during a run on a 80 CPUs Power node:
> >>>>  Performance counter stats for './ebizzy -mTt 80':
> >>>>            1874773      faults
> >>>>            1461153      spf
> >>>>             413293      pagefault:spf_vma_changed
> >>>>                  0      pagefault:spf_vma_noanon
> >>>>                200      pagefault:spf_vma_notsup
> >>>>                  0      pagefault:spf_vma_access
> >>>>                  0      pagefault:spf_pmd_changed
> >>>>
> >>>> In ebizzy's case most of the page fault were handled in a speculative way,
> >>>> leading the ebizzy performance boost.
> >>>>
> >>>> ------------------
> >>>> Changes since v10 (https://lkml.org/lkml/2018/4/17/572):
> >>>>  - Accounted for all review feedbacks from Punit Agrawal, Ganesh Mahendran
> >>>>    and Minchan Kim, hopefully.
> >>>>  - Remove unneeded check on CONFIG_SPECULATIVE_PAGE_FAULT in
> >>>>    __do_page_fault().
> >>>>  - Loop in pte_spinlock() and pte_map_lock() when pte try lock fails
> >>>>    instead
> >>>>    of aborting the speculative page fault handling. Dropping the now
> >>>> useless
> >>>>    trace event pagefault:spf_pte_lock.
> >>>>  - No more try to reuse the fetched VMA during the speculative page fault
> >>>>    handling when retrying is needed. This adds a lot of complexity and
> >>>>    additional tests done didn't show a significant performance improvement.
> >>>>  - Convert IS_ENABLED(CONFIG_NUMA) back to #ifdef due to build error.
> >>>>
> >>>> [1] http://linux-kernel.2935.n7.nabble.com/RFC-PATCH-0-6-Another-go-at-speculative-page-faults-tt965642.html#none
> >>>> [2] https://patchwork.kernel.org/patch/9999687/
> >>>>
> >>>>
> >>>> Laurent Dufour (20):
> >>>>   mm: introduce CONFIG_SPECULATIVE_PAGE_FAULT
> >>>>   x86/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
> >>>>   powerpc/mm: set ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
> >>>>   mm: introduce pte_spinlock for FAULT_FLAG_SPECULATIVE
> >>>>   mm: make pte_unmap_same compatible with SPF
> >>>>   mm: introduce INIT_VMA()
> >>>>   mm: protect VMA modifications using VMA sequence count
> >>>>   mm: protect mremap() against SPF hanlder
> >>>>   mm: protect SPF handler against anon_vma changes
> >>>>   mm: cache some VMA fields in the vm_fault structure
> >>>>   mm/migrate: Pass vm_fault pointer to migrate_misplaced_page()
> >>>>   mm: introduce __lru_cache_add_active_or_unevictable
> >>>>   mm: introduce __vm_normal_page()
> >>>>   mm: introduce __page_add_new_anon_rmap()
> >>>>   mm: protect mm_rb tree with a rwlock
> >>>>   mm: adding speculative page fault failure trace events
> >>>>   perf: add a speculative page fault sw event
> >>>>   perf tools: add support for the SPF perf event
> >>>>   mm: add speculative page fault vmstats
> >>>>   powerpc/mm: add speculative page fault
> >>>>
> >>>> Mahendran Ganesh (2):
> >>>>   arm64/mm: define ARCH_SUPPORTS_SPECULATIVE_PAGE_FAULT
> >>>>   arm64/mm: add speculative page fault
> >>>>
> >>>> Peter Zijlstra (4):
> >>>>   mm: prepare for FAULT_FLAG_SPECULATIVE
> >>>>   mm: VMA sequence count
> >>>>   mm: provide speculative fault infrastructure
> >>>>   x86/mm: add speculative pagefault handling
> >>>>
> >>>>  arch/arm64/Kconfig                    |   1 +
> >>>>  arch/arm64/mm/fault.c                 |  12 +
> >>>>  arch/powerpc/Kconfig                  |   1 +
> >>>>  arch/powerpc/mm/fault.c               |  16 +
> >>>>  arch/x86/Kconfig                      |   1 +
> >>>>  arch/x86/mm/fault.c                   |  27 +-
> >>>>  fs/exec.c                             |   2 +-
> >>>>  fs/proc/task_mmu.c                    |   5 +-
> >>>>  fs/userfaultfd.c                      |  17 +-
> >>>>  include/linux/hugetlb_inline.h        |   2 +-
> >>>>  include/linux/migrate.h               |   4 +-
> >>>>  include/linux/mm.h                    | 136 +++++++-
> >>>>  include/linux/mm_types.h              |   7 +
> >>>>  include/linux/pagemap.h               |   4 +-
> >>>>  include/linux/rmap.h                  |  12 +-
> >>>>  include/linux/swap.h                  |  10 +-
> >>>>  include/linux/vm_event_item.h         |   3 +
> >>>>  include/trace/events/pagefault.h      |  80 +++++
> >>>>  include/uapi/linux/perf_event.h       |   1 +
> >>>>  kernel/fork.c                         |   5 +-
> >>>>  mm/Kconfig                            |  22 ++
> >>>>  mm/huge_memory.c                      |   6 +-
> >>>>  mm/hugetlb.c                          |   2 +
> >>>>  mm/init-mm.c                          |   3 +
> >>>>  mm/internal.h                         |  20 ++
> >>>>  mm/khugepaged.c                       |   5 +
> >>>>  mm/madvise.c                          |   6 +-
> >>>>  mm/memory.c                           | 612 +++++++++++++++++++++++++++++-----
> >>>>  mm/mempolicy.c                        |  51 ++-
> >>>>  mm/migrate.c                          |   6 +-
> >>>>  mm/mlock.c                            |  13 +-
> >>>>  mm/mmap.c                             | 229 ++++++++++---
> >>>>  mm/mprotect.c