Re: [PATCH] x86/mem_sharing: don't lock parent during fork reset

[Jan Beulich <jbeulich@xxxxxxxx>]

On 17.09.2021 16:21, Tamas K Lengyel wrote:
> On Fri, Sep 17, 2021 at 3:26 AM Jan Beulich <jbeulich@xxxxxxxx> wrote:
>>
>> On 16.09.2021 17:04, Tamas K Lengyel wrote:
>>> During fork reset operation the parent domain doesn't need to be gathered 
>>> using
>>> rcu_lock_live_remote_domain_by_id as the fork reset doesn't modify anything 
>>> on
>>> the parent. The parent is also guaranteed to be paused while forks are 
>>> active.
>>> This patch reduces lock contention when performing resets in parallel.
>>
>> I'm a little in trouble following you here: RCU locks aren't really
>> locks in that sense, so "lock contention" seems misleading to me. I
>> can see that rcu_lock_domain_by_id()'s loop is extra overhead.
>>
>> Furthermore - does the parent being paused really mean the parent
>> can't go away behind the back of the fork reset? In fork() I see
>>
>>     if ( rc && rc != -ERESTART )
>>     {
>>         domain_unpause(d);
>>         put_domain(d);
>>         cd->parent = NULL;
>>     }
>>
>> i.e. the ref gets dropped before the parent pointer gets cleared. If
>> the parent having a reference kept was indeed properly guaranteed, I
>> agree the code change itself is fine.
>>
>> (The sequence looks correct at the other put_domain() site [dealing
>> with the success case of fork(), when the reference gets retained]
>> in domain_relinquish_resources().)
> 
> This code above you copied is when the fork() fails. Calling
> fork_reset() before fork() successfully returns is not a sane sequence
> and it is not "supported" by any means. If someone would try to do
> that it would be racy as-is already with or without this patch.
> Clearing the cd->parent pointer first here on the error path wouldn't
> guarantee that sequence to be safe or sane either. Adding an extra
> field to struct domain that signifies that "fork is complete" would be
> a way to make that safe. But since the toolstack using this interface
> is already sane (ie. never calls fork_reset before a successful fork)
> I really don't think that's necessary. It would just grow struct
> domain for very little benefit.

The point of this latter part of my comments wasn't to suggest that
fork-reset ought to work before fork completed. That's fine to not be
'"supported" by any means'. What your change here does, though, is to
add a dependency (maybe not the first one) on there being a ref held
as long as ->parent is non-NULL. That requirement is violated by the
error path I've quoted. IOW my request isn't really fork or even
mem-sharing specific, but it instead is asking that the code in
question please follow a common, safe model (as soon as at least one
such dependency exists).

If there are pre-existing cases where the wrong order of operations
is an issue, then adjusting that sequence in a separate prereq patch
might be better than folding the fix in here. Whereas if there isn't
any other such case or it's simply unknown (without extended audit)
whether there is, then I see no issue folding that adjustment in here.

Of course - you're the maintainer of this code, so if you think the
adjustment isn't needed, so be it. It's just that then I can't give
you an R-b, so you'd need someone else's for your change to actually
go in. (Of course you could also convince me of your pov, but for now
I can't see this happening.)

Jan