* Kernel BUG when registering the ring @ 2020-02-11 1:22 Glauber Costa 2020-02-11 3:25 ` Jens Axboe 0 siblings, 1 reply; 10+ messages in thread From: Glauber Costa @ 2020-02-11 1:22 UTC (permalink / raw) To: io-uring, Avi Kivity, Jens Axboe [-- Attachment #1: Type: text/plain, Size: 430 bytes --] Hello my dear io_uring friends Today I tried to run my tests on a different, more powerful hardware (70+ Hyperthreads) and it crashed on creating the ring. I don't recall anything fancy in my code for creating the ring - except maybe that I size the cq ring differently than the sq ring. The backtrace attached leads me to believe that we just accessed a null struct somewhere Hash is ba2db2d4d262f7ccf6fe86b00c3538056d7c5218 [-- Attachment #2: creation.txt --] [-- Type: text/plain, Size: 5666 bytes --] [ 894.918927] XFS (nvme0n1p1): Mounting V5 Filesystem [ 894.928964] XFS (nvme0n1p1): Ending clean mount [ 894.930111] xfs filesystem being mounted at /var/disk1 supports timestamps until 2038 (0x7fffffff) [ 901.000820] BUG: unable to handle page fault for address: 0000000000002088 [ 901.000887] #PF: supervisor read access in kernel mode [ 901.000927] #PF: error_code(0x0000) - not-present page [ 901.000969] PGD 174101b067 P4D 174101b067 PUD 17c30cd067 PMD 0 [ 901.001019] Oops: 0000 [#1] SMP NOPTI [ 901.001052] CPU: 40 PID: 2144 Comm: io_tester Not tainted 5.5.0+ #6 [ 901.001101] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [ 901.001187] RIP: 0010:__alloc_pages_nodemask+0x132/0x340 [ 901.001231] Code: 18 01 75 04 41 80 ce 80 89 e8 48 8b 54 24 08 8b 74 24 1c c1 e8 0c 48 8b 3c 24 83 e0 01 88 44 24 20 48 85 d2 0f 85 74 01 00 00 <3b> 77 08 0f 82 6b 01 00 00 48 89 7c 24 10 89 ea 48 8b 07 b9 00 02 [ 901.001370] RSP: 0018:ffffb8be4d0b7c28 EFLAGS: 00010246 [ 901.001413] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000e8e8 [ 901.001466] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000002080 [ 901.001499] RBP: 0000000000012cc0 R08: 0000000000000000 R09: 0000000000000002 [ 901.001516] R10: 0000000000000dc0 R11: ffff995c60400100 R12: 0000000000000000 [ 901.001534] R13: 0000000000012cc0 R14: 0000000000000001 R15: ffff995c60db00f0 [ 901.001552] FS: 00007f4d115ca900(0000) GS:ffff995c60d80000(0000) knlGS:0000000000000000 [ 901.001572] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 901.001586] CR2: 0000000000002088 CR3: 00000017cca66002 CR4: 00000000007606e0 [ 901.001604] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 901.001622] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 901.001640] PKRU: 55555554 [ 901.001647] Call Trace: [ 901.001663] alloc_slab_page+0x46/0x320 [ 901.001676] new_slab+0x9d/0x4e0 [ 901.001687] ___slab_alloc+0x507/0x6a0 [ 901.001702] ? io_wq_create+0xb4/0x2a0 [ 901.001713] __slab_alloc+0x1c/0x30 [ 901.001725] kmem_cache_alloc_node_trace+0xa6/0x260 [ 901.001738] io_wq_create+0xb4/0x2a0 [ 901.001750] io_uring_setup+0x97f/0xaa0 [ 901.001762] ? io_remove_personalities+0x30/0x30 [ 901.001776] ? io_poll_trigger_evfd+0x30/0x30 [ 901.001791] do_syscall_64+0x5b/0x1c0 [ 901.001806] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 901.001820] RIP: 0033:0x7f4d116cb1ed [ 901.001831] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 6b 5c 0c 00 f7 d8 64 89 01 48 [ 901.001875] RSP: 002b:00007fff641ddf58 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 [ 901.001894] RAX: ffffffffffffffda RBX: 00007fff641de0f0 RCX: 00007f4d116cb1ed [ 901.001911] RDX: 0000000000000000 RSI: 00007fff641ddfb0 RDI: 0000000000000080 [ 901.001928] RBP: 0000000000000080 R08: 0000000000000000 R09: 0000600000081c20 [ 901.002471] R10: 00007f4d115c9800 R11: 0000000000000202 R12: 00007fff641ddfb0 [ 901.002971] R13: 00007fff641de0f0 R14: 00007fff641de0c0 R15: 00007fff641de4e8 [ 901.003470] Modules linked in: ip6t_REJECT nf_reject_ipv6 ip6t_rpfilter ipt_REJECT nf_reject_ipv4 xt_conntrack ebtable_nat ebtable_broute ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat iptable_mangle iptable_raw iptable_security nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ib_isert iscsi_target_mod ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib vfat fat ib_umad intel_rapl_msr intel_rapl_common rpcrdma isst_if_common sunrpc rdma_ucm ib_iser skx_edac rdma_cm x86_pkg_temp_thermal intel_powerclamp iw_cm coretemp kvm_intel ib_cm libiscsi scsi_transport_iscsi kvm irqbypass crct10dif_pclmul crc32_pclmul i40iw ghash_clmulni_intel ib_uverbs iTCO_wdt iTCO_vendor_support intel_cstate ib_core ipmi_ssif intel_uncore joydev intel_rapl_perf mei_me i2c_i801 ioatdma switchtec pcspkr lpc_ich mei ipmi_si dca ipmi_devintf ipmi_msghandler dax_pmem dax_pmem_core acpi_power_meter acpi_pad [ 901.003504] ip_tables xfs libcrc32c rfkill nd_pmem nd_btt ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper cec drm i40e megaraid_sas crc32c_intel nvme nvme_core nfit libnvdimm wmi pkcs8_key_parser [ 901.009213] CR2: 0000000000002088 [ 901.009814] ---[ end trace 2bb8b12f7dc58981 ]--- [ 901.109907] RIP: 0010:__alloc_pages_nodemask+0x132/0x340 [ 901.110546] Code: 18 01 75 04 41 80 ce 80 89 e8 48 8b 54 24 08 8b 74 24 1c c1 e8 0c 48 8b 3c 24 83 e0 01 88 44 24 20 48 85 d2 0f 85 74 01 00 00 <3b> 77 08 0f 82 6b 01 00 00 48 89 7c 24 10 89 ea 48 8b 07 b9 00 02 [ 901.111761] RSP: 0018:ffffb8be4d0b7c28 EFLAGS: 00010246 [ 901.112368] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000e8e8 [ 901.112982] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000002080 [ 901.113596] RBP: 0000000000012cc0 R08: 0000000000000000 R09: 0000000000000002 [ 901.114206] R10: 0000000000000dc0 R11: ffff995c60400100 R12: 0000000000000000 [ 901.114821] R13: 0000000000012cc0 R14: 0000000000000001 R15: ffff995c60db00f0 [ 901.115418] FS: 00007f4d115ca900(0000) GS:ffff995c60d80000(0000) knlGS:0000000000000000 [ 901.116019] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 901.116619] CR2: 0000000000002088 CR3: 00000017cca66002 CR4: 00000000007606e0 [ 901.117233] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 901.117839] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 901.118444] PKRU: 55555554 ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: Kernel BUG when registering the ring 2020-02-11 1:22 Kernel BUG when registering the ring Glauber Costa @ 2020-02-11 3:25 ` Jens Axboe 2020-02-11 3:45 ` Glauber Costa 0 siblings, 1 reply; 10+ messages in thread From: Jens Axboe @ 2020-02-11 3:25 UTC (permalink / raw) To: Glauber Costa, io-uring, Avi Kivity On 2/10/20 6:22 PM, Glauber Costa wrote: > Hello my dear io_uring friends > > Today I tried to run my tests on a different, more powerful hardware > (70+ Hyperthreads) and it crashed on creating the ring. > > I don't recall anything fancy in my code for creating the ring - > except maybe that I size the cq ring differently than the sq ring. > > The backtrace attached leads me to believe that we just accessed a > null struct somewhere Yeah, but it's in the alloc code, it's not in io-wq/io_uring. Here's where it is crashing: struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data) { [...] for_each_node(node) { struct io_wqe *wqe; wqe = kzalloc_node(sizeof(struct io_wqe), GFP_KERNEL, node); I guess the node isn't online, and that's why it's crashing. Try the below for starters, it should get it going. diff --git a/fs/io-wq.c b/fs/io-wq.c index 182aa17dc2ca..3898165baccb 100644 --- a/fs/io-wq.c +++ b/fs/io-wq.c @@ -1115,8 +1116,11 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data) for_each_node(node) { struct io_wqe *wqe; + int alloc_node = node; - wqe = kzalloc_node(sizeof(struct io_wqe), GFP_KERNEL, node); + if (!node_online(alloc_node)) + alloc_node = NUMA_NO_NODE; + wqe = kzalloc_node(sizeof(struct io_wqe), GFP_KERNEL, alloc_node); if (!wqe) goto err; wq->wqes[node] = wqe; -- Jens Axboe ^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: Kernel BUG when registering the ring 2020-02-11 3:25 ` Jens Axboe @ 2020-02-11 3:45 ` Glauber Costa 2020-02-11 3:50 ` Jens Axboe 0 siblings, 1 reply; 10+ messages in thread From: Glauber Costa @ 2020-02-11 3:45 UTC (permalink / raw) To: Jens Axboe; +Cc: io-uring, Avi Kivity [-- Attachment #1: Type: text/plain, Size: 1826 bytes --] It crashes all the same New backtrace attached - looks very similar to the old one, although not identical. On Mon, Feb 10, 2020 at 10:25 PM Jens Axboe <axboe@kernel.dk> wrote: > > On 2/10/20 6:22 PM, Glauber Costa wrote: > > Hello my dear io_uring friends > > > > Today I tried to run my tests on a different, more powerful hardware > > (70+ Hyperthreads) and it crashed on creating the ring. > > > > I don't recall anything fancy in my code for creating the ring - > > except maybe that I size the cq ring differently than the sq ring. > > > > The backtrace attached leads me to believe that we just accessed a > > null struct somewhere > > Yeah, but it's in the alloc code, it's not in io-wq/io_uring. > Here's where it is crashing: > > struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data) > { > [...] > for_each_node(node) { > struct io_wqe *wqe; > > wqe = kzalloc_node(sizeof(struct io_wqe), GFP_KERNEL, node); > > I guess the node isn't online, and that's why it's crashing. Try the > below for starters, it should get it going. > > > diff --git a/fs/io-wq.c b/fs/io-wq.c > index 182aa17dc2ca..3898165baccb 100644 > --- a/fs/io-wq.c > +++ b/fs/io-wq.c > @@ -1115,8 +1116,11 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data) > > for_each_node(node) { > struct io_wqe *wqe; > + int alloc_node = node; > > - wqe = kzalloc_node(sizeof(struct io_wqe), GFP_KERNEL, node); > + if (!node_online(alloc_node)) > + alloc_node = NUMA_NO_NODE; > + wqe = kzalloc_node(sizeof(struct io_wqe), GFP_KERNEL, alloc_node); > if (!wqe) > goto err; > wq->wqes[node] = wqe; > > -- > Jens Axboe > [-- Attachment #2: newtrace.txt --] [-- Type: text/plain, Size: 4601 bytes --] [ 52.976723] Oops: 0000 [#1] SMP NOPTI [ 52.976763] CPU: 56 PID: 2107 Comm: io_wq_manager Not tainted 5.5.0+ #7 [ 52.976826] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019 [ 52.976923] RIP: 0010:__alloc_pages_nodemask+0x132/0x340 [ 52.976975] Code: 18 01 75 04 41 80 ce 80 89 e8 48 8b 54 24 08 8b 74 24 1c c1 e8 0c 48 8b 3c 24 83 e0 01 88 44 24 20 48 85 d2 0f 85 74 01 00 00 <3b> 77 08 0f 82 6b 01 00 00 48 89 7c 24 10 89 ea 48 8b 07 b9 00 02 [ 52.977144] RSP: 0018:ffffa48ece75bc88 EFLAGS: 00010246 [ 52.977198] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000e8e8 [ 52.977265] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000002080 [ 52.977332] RBP: 0000000000012cc0 R08: ffff8b54d83a8a00 R09: 0000000000000002 [ 52.977399] R10: 0000000000000dc0 R11: ffff8b54e0800100 R12: 0000000000000000 [ 52.977465] R13: 0000000000012cc0 R14: 0000000000000001 R15: ffff8b54e11300f0 [ 52.977530] FS: 0000000000000000(0000) GS:ffff8b54e1100000(0000) knlGS:0000000000000000 [ 52.977605] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 52.977660] CR2: 0000000000002088 CR3: 000000d7e660a004 CR4: 00000000007606e0 [ 52.977725] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 52.977791] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 52.977858] PKRU: 55555554 [ 52.977887] Call Trace: [ 52.977926] alloc_slab_page+0x46/0x320 [ 52.977967] new_slab+0x9d/0x4e0 [ 52.978004] ? account_entity_enqueue+0x9c/0xd0 [ 52.978055] ___slab_alloc+0x507/0x6a0 [ 52.978097] ? create_io_worker.isra.0+0x35/0x180 [ 52.978147] ? activate_task+0x7a/0x160 [ 52.978187] ? check_preempt_curr+0x4a/0x90 [ 52.978230] ? ttwu_do_wakeup+0x19/0x140 [ 52.978273] __slab_alloc+0x1c/0x30 [ 52.978312] kmem_cache_alloc_node_trace+0xa6/0x260 [ 52.978364] create_io_worker.isra.0+0x35/0x180 [ 52.978412] io_wq_manager+0xa4/0x250 [ 52.978448] kthread+0xf9/0x130 [ 52.978479] ? create_io_worker.isra.0+0x180/0x180 [ 52.978521] ? kthread_park+0x90/0x90 [ 52.978560] ret_from_fork+0x1f/0x40 [ 52.978598] Modules linked in: ip6t_REJECT nf_reject_ipv6 ip6t_rpfilter ipt_REJECT nf_reject_ipv4 xt_conntrack ebtable_nat ebtable_broute ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat iptable_mangle iptable_raw iptable_security nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ib_isert iscsi_target_mod ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib vfat fat ib_umad rpcrdma sunrpc rdma_ucm ib_iser rdma_cm intel_rapl_msr intel_rapl_common iw_cm ib_cm isst_if_common libiscsi scsi_transport_iscsi skx_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass i40iw crct10dif_pclmul crc32_pclmul iTCO_wdt ghash_clmulni_intel ib_uverbs iTCO_vendor_support intel_cstate ipmi_ssif ib_core intel_uncore joydev intel_rapl_perf ioatdma mei_me pcspkr lpc_ich i2c_i801 mei switchtec ipmi_si dca ipmi_devintf ipmi_msghandler dax_pmem dax_pmem_core acpi_power_meter acpi_pad [ 52.978655] ip_tables xfs libcrc32c rfkill nd_pmem nd_btt ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper cec drm i40e megaraid_sas crc32c_intel nvme nvme_core nfit libnvdimm wmi pkcs8_key_parser [ 52.994250] CR2: 0000000000002088 [ 52.995607] ---[ end trace 56b95aaef917fdfe ]--- [ 53.087074] RIP: 0010:__alloc_pages_nodemask+0x132/0x340 [ 53.087807] Code: 18 01 75 04 41 80 ce 80 89 e8 48 8b 54 24 08 8b 74 24 1c c1 e8 0c 48 8b 3c 24 83 e0 01 88 44 24 20 48 85 d2 0f 85 74 01 00 00 <3b> 77 08 0f 82 6b 01 00 00 48 89 7c 24 10 89 ea 48 8b 07 b9 00 02 [ 53.089181] RSP: 0018:ffffa48ece75bc88 EFLAGS: 00010246 [ 53.089845] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000e8e8 [ 53.090502] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000002080 [ 53.091141] RBP: 0000000000012cc0 R08: ffff8b54d83a8a00 R09: 0000000000000002 [ 53.091770] R10: 0000000000000dc0 R11: ffff8b54e0800100 R12: 0000000000000000 [ 53.092391] R13: 0000000000012cc0 R14: 0000000000000001 R15: ffff8b54e11300f0 [ 53.093020] FS: 0000000000000000(0000) GS:ffff8b54e1100000(0000) knlGS:0000000000000000 [ 53.093659] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 53.094298] CR2: 0000000000002088 CR3: 000000d7e660a004 CR4: 00000000007606e0 [ 53.094947] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 53.095588] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: Kernel BUG when registering the ring 2020-02-11 3:45 ` Glauber Costa @ 2020-02-11 3:50 ` Jens Axboe 2020-02-11 13:01 ` Glauber Costa 0 siblings, 1 reply; 10+ messages in thread From: Jens Axboe @ 2020-02-11 3:50 UTC (permalink / raw) To: Glauber Costa; +Cc: io-uring, Avi Kivity On 2/10/20 8:45 PM, Glauber Costa wrote: > It crashes all the same > > New backtrace attached - looks very similar to the old one, although > not identical. I missed the other spot we do the same thing... Try this. diff --git a/fs/io-wq.c b/fs/io-wq.c index 182aa17dc2ca..b8ef5a5483de 100644 --- a/fs/io-wq.c +++ b/fs/io-wq.c @@ -1115,12 +1116,15 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data) for_each_node(node) { struct io_wqe *wqe; + int alloc_node = node; - wqe = kzalloc_node(sizeof(struct io_wqe), GFP_KERNEL, node); + if (!node_online(alloc_node)) + alloc_node = NUMA_NO_NODE; + wqe = kzalloc_node(sizeof(struct io_wqe), GFP_KERNEL, alloc_node); if (!wqe) goto err; wq->wqes[node] = wqe; - wqe->node = node; + wqe->node = alloc_node; wqe->acct[IO_WQ_ACCT_BOUND].max_workers = bounded; atomic_set(&wqe->acct[IO_WQ_ACCT_BOUND].nr_running, 0); if (wq->user) { @@ -1128,7 +1132,6 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data) task_rlimit(current, RLIMIT_NPROC); } atomic_set(&wqe->acct[IO_WQ_ACCT_UNBOUND].nr_running, 0); - wqe->node = node; wqe->wq = wq; spin_lock_init(&wqe->lock); INIT_WQ_LIST(&wqe->work_list); -- Jens Axboe ^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: Kernel BUG when registering the ring 2020-02-11 3:50 ` Jens Axboe @ 2020-02-11 13:01 ` Glauber Costa 2020-02-11 18:58 ` Jens Axboe 0 siblings, 1 reply; 10+ messages in thread From: Glauber Costa @ 2020-02-11 13:01 UTC (permalink / raw) To: Jens Axboe; +Cc: io-uring, Avi Kivity This works. Thanks On Mon, Feb 10, 2020 at 10:50 PM Jens Axboe <axboe@kernel.dk> wrote: > > On 2/10/20 8:45 PM, Glauber Costa wrote: > > It crashes all the same > > > > New backtrace attached - looks very similar to the old one, although > > not identical. > > I missed the other spot we do the same thing... Try this. > > > diff --git a/fs/io-wq.c b/fs/io-wq.c > index 182aa17dc2ca..b8ef5a5483de 100644 > --- a/fs/io-wq.c > +++ b/fs/io-wq.c > @@ -1115,12 +1116,15 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data) > > for_each_node(node) { > struct io_wqe *wqe; > + int alloc_node = node; > > - wqe = kzalloc_node(sizeof(struct io_wqe), GFP_KERNEL, node); > + if (!node_online(alloc_node)) > + alloc_node = NUMA_NO_NODE; > + wqe = kzalloc_node(sizeof(struct io_wqe), GFP_KERNEL, alloc_node); > if (!wqe) > goto err; > wq->wqes[node] = wqe; > - wqe->node = node; > + wqe->node = alloc_node; > wqe->acct[IO_WQ_ACCT_BOUND].max_workers = bounded; > atomic_set(&wqe->acct[IO_WQ_ACCT_BOUND].nr_running, 0); > if (wq->user) { > @@ -1128,7 +1132,6 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data) > task_rlimit(current, RLIMIT_NPROC); > } > atomic_set(&wqe->acct[IO_WQ_ACCT_UNBOUND].nr_running, 0); > - wqe->node = node; > wqe->wq = wq; > spin_lock_init(&wqe->lock); > INIT_WQ_LIST(&wqe->work_list); > > -- > Jens Axboe > ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: Kernel BUG when registering the ring 2020-02-11 13:01 ` Glauber Costa @ 2020-02-11 18:58 ` Jens Axboe 2020-02-11 19:23 ` Glauber Costa 2020-02-12 22:31 ` Jann Horn 0 siblings, 2 replies; 10+ messages in thread From: Jens Axboe @ 2020-02-11 18:58 UTC (permalink / raw) To: Glauber Costa; +Cc: io-uring, Avi Kivity On 2/11/20 6:01 AM, Glauber Costa wrote: > This works. Can you try this one as well? diff --git a/fs/io-wq.c b/fs/io-wq.c index 182aa17dc2ca..2d741fb76098 100644 --- a/fs/io-wq.c +++ b/fs/io-wq.c @@ -699,11 +699,16 @@ static int io_wq_manager(void *data) /* create fixed workers */ refcount_set(&wq->refs, workers_to_create); for_each_node(node) { + if (!node_online(node)) + continue; if (!create_io_worker(wq, wq->wqes[node], IO_WQ_ACCT_BOUND)) goto err; workers_to_create--; } + while (workers_to_create--) + refcount_dec(&wq->refs); + complete(&wq->done); while (!kthread_should_stop()) { @@ -711,6 +716,9 @@ static int io_wq_manager(void *data) struct io_wqe *wqe = wq->wqes[node]; bool fork_worker[2] = { false, false }; + if (!node_online(node)) + continue; + spin_lock_irq(&wqe->lock); if (io_wqe_need_worker(wqe, IO_WQ_ACCT_BOUND)) fork_worker[IO_WQ_ACCT_BOUND] = true; @@ -849,6 +857,8 @@ void io_wq_cancel_all(struct io_wq *wq) for_each_node(node) { struct io_wqe *wqe = wq->wqes[node]; + if (!node_online(node)) + continue; io_wq_for_each_worker(wqe, io_wqe_worker_send_sig, NULL); } rcu_read_unlock(); @@ -929,6 +939,8 @@ enum io_wq_cancel io_wq_cancel_cb(struct io_wq *wq, work_cancel_fn *cancel, for_each_node(node) { struct io_wqe *wqe = wq->wqes[node]; + if (!node_online(node)) + continue; ret = io_wqe_cancel_cb_work(wqe, cancel, data); if (ret != IO_WQ_CANCEL_NOTFOUND) break; @@ -1021,6 +1033,8 @@ enum io_wq_cancel io_wq_cancel_work(struct io_wq *wq, struct io_wq_work *cwork) for_each_node(node) { struct io_wqe *wqe = wq->wqes[node]; + if (!node_online(node)) + continue; ret = io_wqe_cancel_work(wqe, &match); if (ret != IO_WQ_CANCEL_NOTFOUND) break; @@ -1050,6 +1064,8 @@ enum io_wq_cancel io_wq_cancel_pid(struct io_wq *wq, pid_t pid) for_each_node(node) { struct io_wqe *wqe = wq->wqes[node]; + if (!node_online(node)) + continue; ret = io_wqe_cancel_work(wqe, &match); if (ret != IO_WQ_CANCEL_NOTFOUND) break; @@ -1084,6 +1100,8 @@ void io_wq_flush(struct io_wq *wq) for_each_node(node) { struct io_wqe *wqe = wq->wqes[node]; + if (!node_online(node)) + continue; init_completion(&data.done); INIT_IO_WORK(&data.work, io_wq_flush_func); data.work.flags |= IO_WQ_WORK_INTERNAL; @@ -1115,12 +1133,15 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data) for_each_node(node) { struct io_wqe *wqe; + int alloc_node = node; - wqe = kzalloc_node(sizeof(struct io_wqe), GFP_KERNEL, node); + if (!node_online(alloc_node)) + alloc_node = NUMA_NO_NODE; + wqe = kzalloc_node(sizeof(struct io_wqe), GFP_KERNEL, alloc_node); if (!wqe) goto err; wq->wqes[node] = wqe; - wqe->node = node; + wqe->node = alloc_node; wqe->acct[IO_WQ_ACCT_BOUND].max_workers = bounded; atomic_set(&wqe->acct[IO_WQ_ACCT_BOUND].nr_running, 0); if (wq->user) { @@ -1128,7 +1149,6 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data) task_rlimit(current, RLIMIT_NPROC); } atomic_set(&wqe->acct[IO_WQ_ACCT_UNBOUND].nr_running, 0); - wqe->node = node; wqe->wq = wq; spin_lock_init(&wqe->lock); INIT_WQ_LIST(&wqe->work_list); @@ -1184,8 +1204,11 @@ static void __io_wq_destroy(struct io_wq *wq) kthread_stop(wq->manager); rcu_read_lock(); - for_each_node(node) + for_each_node(node) { + if (!node_online(node)) + continue; io_wq_for_each_worker(wq->wqes[node], io_wq_worker_wake, NULL); + } rcu_read_unlock(); wait_for_completion(&wq->done); -- Jens Axboe ^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: Kernel BUG when registering the ring 2020-02-11 18:58 ` Jens Axboe @ 2020-02-11 19:23 ` Glauber Costa 2020-02-11 19:24 ` Jens Axboe 2020-02-12 22:31 ` Jann Horn 1 sibling, 1 reply; 10+ messages in thread From: Glauber Costa @ 2020-02-11 19:23 UTC (permalink / raw) To: Jens Axboe; +Cc: io-uring, Avi Kivity Tested-by: Glauber Costa <glauber@scylladb.com> On Tue, Feb 11, 2020 at 1:58 PM Jens Axboe <axboe@kernel.dk> wrote: > > On 2/11/20 6:01 AM, Glauber Costa wrote: > > This works. > > Can you try this one as well? > > > diff --git a/fs/io-wq.c b/fs/io-wq.c > index 182aa17dc2ca..2d741fb76098 100644 > --- a/fs/io-wq.c > +++ b/fs/io-wq.c > @@ -699,11 +699,16 @@ static int io_wq_manager(void *data) > /* create fixed workers */ > refcount_set(&wq->refs, workers_to_create); > for_each_node(node) { > + if (!node_online(node)) > + continue; > if (!create_io_worker(wq, wq->wqes[node], IO_WQ_ACCT_BOUND)) > goto err; > workers_to_create--; > } > > + while (workers_to_create--) > + refcount_dec(&wq->refs); > + > complete(&wq->done); > > while (!kthread_should_stop()) { > @@ -711,6 +716,9 @@ static int io_wq_manager(void *data) > struct io_wqe *wqe = wq->wqes[node]; > bool fork_worker[2] = { false, false }; > > + if (!node_online(node)) > + continue; > + > spin_lock_irq(&wqe->lock); > if (io_wqe_need_worker(wqe, IO_WQ_ACCT_BOUND)) > fork_worker[IO_WQ_ACCT_BOUND] = true; > @@ -849,6 +857,8 @@ void io_wq_cancel_all(struct io_wq *wq) > for_each_node(node) { > struct io_wqe *wqe = wq->wqes[node]; > > + if (!node_online(node)) > + continue; > io_wq_for_each_worker(wqe, io_wqe_worker_send_sig, NULL); > } > rcu_read_unlock(); > @@ -929,6 +939,8 @@ enum io_wq_cancel io_wq_cancel_cb(struct io_wq *wq, work_cancel_fn *cancel, > for_each_node(node) { > struct io_wqe *wqe = wq->wqes[node]; > > + if (!node_online(node)) > + continue; > ret = io_wqe_cancel_cb_work(wqe, cancel, data); > if (ret != IO_WQ_CANCEL_NOTFOUND) > break; > @@ -1021,6 +1033,8 @@ enum io_wq_cancel io_wq_cancel_work(struct io_wq *wq, struct io_wq_work *cwork) > for_each_node(node) { > struct io_wqe *wqe = wq->wqes[node]; > > + if (!node_online(node)) > + continue; > ret = io_wqe_cancel_work(wqe, &match); > if (ret != IO_WQ_CANCEL_NOTFOUND) > break; > @@ -1050,6 +1064,8 @@ enum io_wq_cancel io_wq_cancel_pid(struct io_wq *wq, pid_t pid) > for_each_node(node) { > struct io_wqe *wqe = wq->wqes[node]; > > + if (!node_online(node)) > + continue; > ret = io_wqe_cancel_work(wqe, &match); > if (ret != IO_WQ_CANCEL_NOTFOUND) > break; > @@ -1084,6 +1100,8 @@ void io_wq_flush(struct io_wq *wq) > for_each_node(node) { > struct io_wqe *wqe = wq->wqes[node]; > > + if (!node_online(node)) > + continue; > init_completion(&data.done); > INIT_IO_WORK(&data.work, io_wq_flush_func); > data.work.flags |= IO_WQ_WORK_INTERNAL; > @@ -1115,12 +1133,15 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data) > > for_each_node(node) { > struct io_wqe *wqe; > + int alloc_node = node; > > - wqe = kzalloc_node(sizeof(struct io_wqe), GFP_KERNEL, node); > + if (!node_online(alloc_node)) > + alloc_node = NUMA_NO_NODE; > + wqe = kzalloc_node(sizeof(struct io_wqe), GFP_KERNEL, alloc_node); > if (!wqe) > goto err; > wq->wqes[node] = wqe; > - wqe->node = node; > + wqe->node = alloc_node; > wqe->acct[IO_WQ_ACCT_BOUND].max_workers = bounded; > atomic_set(&wqe->acct[IO_WQ_ACCT_BOUND].nr_running, 0); > if (wq->user) { > @@ -1128,7 +1149,6 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data) > task_rlimit(current, RLIMIT_NPROC); > } > atomic_set(&wqe->acct[IO_WQ_ACCT_UNBOUND].nr_running, 0); > - wqe->node = node; > wqe->wq = wq; > spin_lock_init(&wqe->lock); > INIT_WQ_LIST(&wqe->work_list); > @@ -1184,8 +1204,11 @@ static void __io_wq_destroy(struct io_wq *wq) > kthread_stop(wq->manager); > > rcu_read_lock(); > - for_each_node(node) > + for_each_node(node) { > + if (!node_online(node)) > + continue; > io_wq_for_each_worker(wq->wqes[node], io_wq_worker_wake, NULL); > + } > rcu_read_unlock(); > > wait_for_completion(&wq->done); > > -- > Jens Axboe > ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: Kernel BUG when registering the ring 2020-02-11 19:23 ` Glauber Costa @ 2020-02-11 19:24 ` Jens Axboe 0 siblings, 0 replies; 10+ messages in thread From: Jens Axboe @ 2020-02-11 19:24 UTC (permalink / raw) To: Glauber Costa; +Cc: io-uring, Avi Kivity On 2/11/20 12:23 PM, Glauber Costa wrote: > Tested-by: Glauber Costa <glauber@scylladb.com> Thanks! -- Jens Axboe ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: Kernel BUG when registering the ring 2020-02-11 18:58 ` Jens Axboe 2020-02-11 19:23 ` Glauber Costa @ 2020-02-12 22:31 ` Jann Horn 2020-02-13 15:20 ` Jens Axboe 1 sibling, 1 reply; 10+ messages in thread From: Jann Horn @ 2020-02-12 22:31 UTC (permalink / raw) To: Jens Axboe; +Cc: Glauber Costa, io-uring, Avi Kivity On Tue, Feb 11, 2020 at 7:58 PM Jens Axboe <axboe@kernel.dk> wrote: [...] > @@ -849,6 +857,8 @@ void io_wq_cancel_all(struct io_wq *wq) > for_each_node(node) { > struct io_wqe *wqe = wq->wqes[node]; > > + if (!node_online(node)) > + continue; > io_wq_for_each_worker(wqe, io_wqe_worker_send_sig, NULL); > } > rcu_read_unlock(); What is this going to do if a NUMA node is marked as offline (through a call to node_set_offline() from try_offline_node()) while it has a worker running, and then afterwards, with the worker still running, io_wq_cancel_all() is executed? Is that going to potentially hang because some op is still executing on that node's worker? Or is there a reason why that can't happen? [...] > @@ -1084,6 +1100,8 @@ void io_wq_flush(struct io_wq *wq) > for_each_node(node) { > struct io_wqe *wqe = wq->wqes[node]; > > + if (!node_online(node)) > + continue; > init_completion(&data.done); > INIT_IO_WORK(&data.work, io_wq_flush_func); > data.work.flags |= IO_WQ_WORK_INTERNAL; (io_wq_flush() is dead code since 05f3fb3c5397, right? Are there plans to use it again?) ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: Kernel BUG when registering the ring 2020-02-12 22:31 ` Jann Horn @ 2020-02-13 15:20 ` Jens Axboe 0 siblings, 0 replies; 10+ messages in thread From: Jens Axboe @ 2020-02-13 15:20 UTC (permalink / raw) To: Jann Horn; +Cc: Glauber Costa, io-uring, Avi Kivity On 2/12/20 3:31 PM, Jann Horn wrote: > On Tue, Feb 11, 2020 at 7:58 PM Jens Axboe <axboe@kernel.dk> wrote: > [...] >> @@ -849,6 +857,8 @@ void io_wq_cancel_all(struct io_wq *wq) >> for_each_node(node) { >> struct io_wqe *wqe = wq->wqes[node]; >> >> + if (!node_online(node)) >> + continue; >> io_wq_for_each_worker(wqe, io_wqe_worker_send_sig, NULL); >> } >> rcu_read_unlock(); > > What is this going to do if a NUMA node is marked as offline (through > a call to node_set_offline() from try_offline_node()) while it has a > worker running, and then afterwards, with the worker still running, > io_wq_cancel_all() is executed? Is that going to potentially hang > because some op is still executing on that node's worker? Or is there > a reason why that can't happen? I folded in this incremental last night, I think it's a better approach as well. > [...] >> @@ -1084,6 +1100,8 @@ void io_wq_flush(struct io_wq *wq) >> for_each_node(node) { >> struct io_wqe *wqe = wq->wqes[node]; >> >> + if (!node_online(node)) >> + continue; >> init_completion(&data.done); >> INIT_IO_WORK(&data.work, io_wq_flush_func); >> data.work.flags |= IO_WQ_WORK_INTERNAL; > > (io_wq_flush() is dead code since 05f3fb3c5397, right? Are there plans > to use it again?) Should probably just be removed for now, I generally don't like carrying dead code. It's easy enough to bring back if we need it, though I suspect if we do need it, we'll probably make it work like the workqueue flushing where we guarantee existing work is done at that point. diff --git a/fs/io-wq.c b/fs/io-wq.c index 2d741fb76098..0a5ab1a8f69a 100644 --- a/fs/io-wq.c +++ b/fs/io-wq.c @@ -837,7 +837,9 @@ static bool io_wq_for_each_worker(struct io_wqe *wqe, list_for_each_entry_rcu(worker, &wqe->all_list, all_list) { if (io_worker_get(worker)) { - ret = func(worker, data); + /* no task if node is/was offline */ + if (worker->task) + ret = func(worker, data); io_worker_release(worker); if (ret) break; @@ -857,8 +859,6 @@ void io_wq_cancel_all(struct io_wq *wq) for_each_node(node) { struct io_wqe *wqe = wq->wqes[node]; - if (!node_online(node)) - continue; io_wq_for_each_worker(wqe, io_wqe_worker_send_sig, NULL); } rcu_read_unlock(); @@ -939,8 +939,6 @@ enum io_wq_cancel io_wq_cancel_cb(struct io_wq *wq, work_cancel_fn *cancel, for_each_node(node) { struct io_wqe *wqe = wq->wqes[node]; - if (!node_online(node)) - continue; ret = io_wqe_cancel_cb_work(wqe, cancel, data); if (ret != IO_WQ_CANCEL_NOTFOUND) break; @@ -1033,8 +1031,6 @@ enum io_wq_cancel io_wq_cancel_work(struct io_wq *wq, struct io_wq_work *cwork) for_each_node(node) { struct io_wqe *wqe = wq->wqes[node]; - if (!node_online(node)) - continue; ret = io_wqe_cancel_work(wqe, &match); if (ret != IO_WQ_CANCEL_NOTFOUND) break; @@ -1064,8 +1060,6 @@ enum io_wq_cancel io_wq_cancel_pid(struct io_wq *wq, pid_t pid) for_each_node(node) { struct io_wqe *wqe = wq->wqes[node]; - if (!node_online(node)) - continue; ret = io_wqe_cancel_work(wqe, &match); if (ret != IO_WQ_CANCEL_NOTFOUND) break; @@ -1204,11 +1198,8 @@ static void __io_wq_destroy(struct io_wq *wq) kthread_stop(wq->manager); rcu_read_lock(); - for_each_node(node) { - if (!node_online(node)) - continue; + for_each_node(node) io_wq_for_each_worker(wq->wqes[node], io_wq_worker_wake, NULL); - } rcu_read_unlock(); wait_for_completion(&wq->done); -- Jens Axboe ^ permalink raw reply related [flat|nested] 10+ messages in thread
end of thread, other threads:[~2020-02-13 15:20 UTC | newest] Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2020-02-11 1:22 Kernel BUG when registering the ring Glauber Costa 2020-02-11 3:25 ` Jens Axboe 2020-02-11 3:45 ` Glauber Costa 2020-02-11 3:50 ` Jens Axboe 2020-02-11 13:01 ` Glauber Costa 2020-02-11 18:58 ` Jens Axboe 2020-02-11 19:23 ` Glauber Costa 2020-02-11 19:24 ` Jens Axboe 2020-02-12 22:31 ` Jann Horn 2020-02-13 15:20 ` Jens Axboe
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).