Thanks for the detailed reply!
On Jul 09, 2007, at 22:07:15, Nigel Cunningham wrote:
On Friday 06 July 2007 15:01:48 Kyle Moffett wrote:
Suppose hibernate is implemented like this:
(1) Userspace program calls sys_freeze_processes()
(a) Pokes all CPUs with IPMIs and tells them to finish the
currently running timeslot then stop
(b) Atomically sends SIGSTOP to all userspace processes in a
non-trappable way, except the calling process and any process
which is ptracing it.
(c) Returns to the calling process.
Ok. First, I'll ignore the specification that userspace does this -
I don't think it matters whether it's userspace or kernel that does
the suspending and I'm yet to see a good reason for it to be
[required to be] done from userspace.
The reason it's _required_ to be done from userspace is that
userspace is the only one which can figure out "These processes need
to run for suspend to work", and then let those processes continue
running after the freeze. The *ONLY* reason this even stops
processes at all is so we can do the post-device-mapper-snapshot code
with very little usably-free RAM (IE: only about 1MB for a standard
desktop system).
In this first step, you've reinvented the first part of the current
freezer implementation. The reason we don't use a real signal is
precisely so we can have an untrappable SIGSTOP. In this regard, I
particularly remember Win4Lin from a few years ago. It would die if
you sent it a real signal, so we had to do it this way. No doubt
there are other instances I'm not aware of.
Well, you *do* want it to have semi-signal semantics, processes which
receive it must not get back to userspace code so that they don't
start allocating more memory when we're trying to do the freeze. You
also don't want a process to be able to trap it (IE: like SIGSTOP or
SIGKILL).
On the other hand, it should be delivered asynchronously (IE: It
doesn't break an interruptable sleep or respond to most is-a-signal-
present checks). You don't actually care if its sleeping in the
kernel somewhere, just as long as it doesn't allocate much memory.
You would probably need a new signal "SIGFREEZE" which causes the
process to be ignored as runnable the next time they schedule but
never actually gets delivered, and a "SIGUNFREEZE" which does the
reverse. That way userspace could selectively resume processes based
on its policy of "this needs to run for hibernation".
(2) Userspace process sends SIGCONT to only those processes which
are necessary for sync and a device-mapper snapshot.
How do you determine which ones are needed?
It's userspace's job to know which ones are needed. For example, if
you are hibernating over NFS then you need to resume the various NFS/
RPC daemons and threads.
Why stop them in the first place?
So they aren't allocating memory when we are doing the device-mapper
snapshot.
(3) Userspace calls sys_snapshot_kernel(snapshot_overhead_pages)
(a) Kernel starts freeing memory and swapping stuff out to make
room for a copy of *kernel* memory (not pagecache, not process
RAM). It does the same for at least snapshot_overhead_pages
extra (used by userspace later). It then allocates this memory to
keep it from going away. Since most processes are stopped we
won't have much else competing with us for the RAM.
Ok. So now you also need processes running that are needed for
swapping, because freeing that memory might involve swapping. Fully
agree with the logic though (not really surprising - this is what I
do in Suspend2^wTuxOnIce).
(a) Kernel uses the device-mapper up-call-into-filesystem
machinery to get all mounted filesystems synced and ready for a DM
snapshot. This may include sending data via the userspace
processes resumed in (2). Any deadlocks here are userspace's
fault (see (2)). Will need some modification to handle doing
multiple blockdevs at a time. Anything using FUSE is basically
perma-synced anyways (no dep-handling needed), and anything using
loop should already be handled by DM. This includes allocating
memory for the basic snapshot
datastructures.
(b) At this point all blockdev operations should be halted and
disk caches flushed; that's all we care about.
(c) Go through the device tree and quiesce DMA and shut off
interrupts. Since all the disks are synced this is easy.
(d) Use IPMIs again to get all the CPUs together, which should
be easy as most processes are sleeping in IO or SIGSTOPed, and
we're getting no interrupts.
(e) One CPU turns off all interrupts on itself and takes an
atomic snapshot of kernel memory into the previously allocated
storage. Once again, does not include pagecache. The kernel also
records a list of what pages *are* included in the pagecache. It
then marks all userspace pages as copy-on-write.
Hotplugging cpus (when all those locking issues are taken care of)
is simpler. Prior to cpu hotplugging, I used IMPIs to put
secondary cpus into a tight loop, so I know it's possible to do it
this way too.
It may be simpler, but it really screws up things like cpusets,
processor affinity, etc. It also ties hibernation to the presently
very-flakey CPU-hotplug support, which is probably not what we want.
That way, though, you have less flexibility. What if a cpu really
is plugged in between hibernate and resume? With cpu hotplugging,
it's handled properly and transparently. Without cpu hotplugging,
you could be using uninitialised data after the atomic restore.
IMHO if the user pulls a CPU while the box is hibernated, then he/she
gets what he/she deserves. If you really want to support that, then
the user must do the hotplug operation *manually* before suspending.
Anything else is just going to be shooting ourselves in the foot
repeatedly.
Marking userspace as COW makes things more complicated, too. You
then have to add code to the COW handling to update the list of
pages that need to be saved, and you reduce the reliability of the
whole process. You can't predict beforehand how many of these COW
pages are going to be needed, and therefore can't know how much
memory to free earlier on in the process. If you run out of memory,
what will be the effect?
You could pretty easily have a spare 128MB swap partition somewhere
which is not used during system operation but is "swapon"ed by
userspace after the COW snapshot to provide extra backing store.
(f) That CPU finalizes the modified DM snapshot using the
previously-allocated memory.
(g) That CPU frees up the snapshot_overhead_pages memory
allocated during step (a) for userspace to use.
(h) The CPU does the equivalent of a "swapoff -a" without
overwriting any data already on any swap device(s).
You still need to remember what swap you're going to use to write
the image. You'll probably want to get this information (and
allocate the swap) sooner rather than later so that you're not
racing against the memory freeing earlier, and don't run into
issues with bmapping the pages or having enough memory to record
the bdevs & sector numbers (not usually an issue, but if swap is
highly fragmented...).
Who says we have to use this swap to write the image? That may be
the default use-case, but it's certainly shouldn't be mandatory.
Really, for the write-image-to-swap case you would just need to
preallocate sufficient memory for the bmap tables beforehand, then
populate them at this phase.
(i) The CPU then IPMI-signals the other CPUs to wake them up
(j) The kernel returns a FD-reference to the snapshot and the
read-only halves of the CoW pagecache to the process which called
sys_snapshot_kernel().
Readonly halves? I don't get that, sorry.
Well, each page is copy-on-write, so the FD reference would always
provide access to the original page data, whereas the processes may
end up copying the page so they can write to it. The trick would be
that shared pages need to remain shared between processes even after
the copy-on-write. This is likely to be the trickiest part.
(4) The userspace process now has a reference to the copy of the
kernel pages and the unmodified pagecache pages. Since 99% of the
processes aren't running, we aren't going to be having to CoW many
of the pagecache pages.
Mmm, but you still don't know how many.
Yes, but at this point we're basically running a segment of userspace
with full kernel services available. Like I said above we can just
add a dedicated 128MB swap device to provide some spare backing
store. When you start running low on memory it might even page out
to the swap device a part of the atomic copy of kernel memory.
(5) The userspace process uses read() or other syscalls to get
data out of the kernel-snapshot FD in small chunks, within its
snapshot_overhead_pages limit. It compresses these and writes
them out to the snapshot-storage blockdev (must not be mounted
during snapshot), or to any network server.
(6) The userspace process syncs the disks and halts the system.
Any changed filesystem pages after the pseudo-DM-snapshot should
have been stored in semi-volatile storage somewhere and will be
discarded on the next reboot.
Are you thinking the changed filesystem pages are caught by COW?
(AFAIUI, kernel writes aren't). If (as I expect), you're thinking
about filesystem writes to DM based storage, what about non DM-
based filesystem pages?
No, but a kernel write to a DM-snapshot calls the DM-snapshot code
which copies the segment(s) to the snapshot device and modifies them
there. Basically disk-filesystem pagecache pages would be synced and
protected by the DM snapshot, while anonymous memory pages would be
CoW-ed. And it might not be an unreasonable requirement to state
that the disk-based filesystems must all be mapped through DM-
snapshot devices (even just straight 1:1 linear mappings), so that
they can be trivially snapshotted.
So basically your hibernate-overhead would consist of:
(1) The pages necessary for the atomic snapshot of kernel
memory and the list of pagecache pages at that time
(2) A little memory necessary for the kernel non-persistent DM
snapshot datastructures.
(3) The snapshot_overhead_pages needed by userspace.
If you're using swap devices then you can save 99% of the state of
the running kernel with an initial swapout overhead of virtually
nothing beyond the size of the unswappable kernel memory.
FWIW, let me note an important variation from how Suspend2 works;
it might provide food for thought. In Suspend2, we treat the
processes that remain stopped throughout the whole process
specially. We write their data to disk before the atomic copy
(usually 70 or 80% of memory), and then use the memory they occupy
for the destination of the atomic copy. This further reduces the
amount of memory that has to be freed, almost always to zero.
I suppose you could record swap-outs done to SIGFREEZEd processes
specially, so that they would be swapped in again before resuming
userspace. That would effectively result in the same thing.
Cheers,
Kyle Moffett
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
