Re: [linus:master] [mm] 01b9da291c: stress-ng.switch.ops_per_sec 67.7% regression
From: Qi Zheng
Date: Fri May 15 2026 - 03:40:08 EST
Hi Shakeel,
On 5/14/26 9:40 PM, Shakeel Butt wrote:
May 14, 2026 at 12:46 AM, "Qi Zheng" <qi.zheng@xxxxxxxxx mailto:qi.zheng@xxxxxxxxx?to=%22Qi%20Zheng%22%20%3Cqi.zheng%40linux.dev%3E > wrote:
On 5/13/26 10:27 PM, Shakeel Butt wrote:
This change looks like it should be able to fix the ping-pong issue, but
On Wed, May 13, 2026 at 06:49:45AM -0700, Shakeel Butt wrote:
On 5/13/26 12:03 AM, Shakeel Butt wrote:
On Wed, May 13, 2026 at 10:10:34AM +0800, Qi Zheng wrote:
On Tue, May 12, 2026 at 08:56:52PM +0800, kernel test robot wrote:
Hello,
kernel test robot noticed a 67.7% regression of stress-ng.switch.ops_per_sec on:
commit: 01b9da291c4969354807b52956f4aae1f41b4924 ("mm: memcontrol: convert objcg to be per-memcg per-node type")
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git master
This is most probably due to shuffling of struct mem_cgroup and struct
mem_cgroup_per_node members.
Another possibility is that after objcg was split into per-node, the
slab accounting fast path is still designed assuming only one current
objcg per CPU:
struct obj_stock_pcp {
struct obj_cgroup *cached_objcg;
};
So it's may cause the following thrashing:
CPU stock cached = memcg/node0 objcg
free object tagged = memcg/node1 objcg
=> __refill_obj_stock --> objcg mismatch
=> drain_obj_stock()
=> cache switches to node1 objcg
next local allocation tagged = node0 objcg
=> mismatch again
=> drain_obj_stock()
Something like the following:
Actually I think this is the issue, we have ping pong threads running on
different nodes where though theu are in same cgroup but their current->obcg is
for local node and thus this ping pong is thrashing the per-cpu objcg stock.
The easier fix would be to compare objcg->memcg instead of just objcg during
draining and caching. In addition we can add support for multiple objcg per-cpu
stock caching.
From d756abe831a905d6fe32bad9a984fc619dafb7e0 Mon Sep 17 00:00:00 2001
From: Shakeel Butt <shakeel.butt@xxxxxxxxx>
Date: Wed, 13 May 2026 07:24:55 -0700
Subject: [PATCH] mm/memcontrol: skip obj_stock drain when refilled objcg
shares memcg
Signed-off-by: Shakeel Butt <shakeel.butt@xxxxxxxxx>
---
mm/memcontrol.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index d978e18b9b2d..01ed7a8e18ac 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -3318,6 +3318,7 @@ static void __refill_obj_stock(struct obj_cgroup *objcg,
unsigned int nr_bytes,
bool allow_uncharge)
{
+ struct obj_cgroup *cached;
unsigned int nr_pages = 0;
> if (!stock) {
@@ -3327,7 +3328,18 @@ static void __refill_obj_stock(struct obj_cgroup *objcg,
goto out;
}
> - if (READ_ONCE(stock->cached_objcg) != objcg) { /* reset if necessary */
+ cached = READ_ONCE(stock->cached_objcg);
+ if (cached != objcg &&
+ (!cached || obj_cgroup_memcg(cached) != obj_cgroup_memcg(objcg))) {
drain_obj_stock(stock);
obj_cgroup_get(objcg);
stock->nr_bytes = atomic_read(&objcg->nr_charged_bytes)
I stiil haven't reproduced the performance regression locally. I'll
continue testing it.
Same here, couldn't reproduce locally. It seems like we had to craft a scenario
where the pair pingpong threads get their current->objcg from different nodes.
I will try that.
I still haven't been able to reproduce the LKP results locally, but I
used an AI bot to generate a pingpong test case (pasted at the end) and
automatically ran the test on a physical machine. The results are as
follows:
parent: 8285917d6f
bad: 01b9da291c
fix: 01b9da291c + stock patch
| kernel | mq_ops/sec mean | vs parent | drain_obj_stock / round |
|--------|-----------------|-----------|-------------------------|
| parent | 9.743M | baseline | ~0 |
| bad | 7.821M | -19.73% | ~11.16M |
| fix | 9.274M | -4.81% | ~0 |
Probing the drain_obj_stock() calls confirms that the fix restores the
frequency to the parent's baseline.
And it seems that besides __refill_obj_stock(), we should also modify
__consume_obj_stock()?
Thanks,
Qi
=========
test case
=========
objcg_pingpong_mq.c
-------------------
#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <mqueue.h>
#include <pthread.h>
#include <sched.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <time.h>
#include <unistd.h>
#ifndef SYS_mq_timedsend
#define SYS_mq_timedsend __NR_mq_timedsend
#endif
#ifndef SYS_mq_timedreceive
#define SYS_mq_timedreceive __NR_mq_timedreceive
#endif
struct worker_arg {
mqd_t send_mqd;
mqd_t recv_mqd;
int cpu;
long count;
size_t msg_size;
int send_first;
};
static pthread_barrier_t start_barrier;
static void die(const char *what)
{
fprintf(stderr, "%s: %s\n", what, strerror(errno));
exit(1);
}
static int add_cpu(int **cpus, size_t *nr, size_t *cap, int cpu)
{
int *tmp;
if (*nr == *cap) {
size_t new_cap = *cap ? *cap * 2 : 64;
tmp = realloc(*cpus, new_cap * sizeof(**cpus));
if (!tmp)
return -1;
*cpus = tmp;
*cap = new_cap;
}
(*cpus)[(*nr)++] = cpu;
return 0;
}
static int read_cpulist(const char *path, int **cpus, size_t *nr)
{
char buf[4096];
char *p, *end;
size_t cap = 0;
int fd;
ssize_t len;
*cpus = NULL;
*nr = 0;
fd = open(path, O_RDONLY | O_CLOEXEC);
if (fd < 0)
return -1;
len = read(fd, buf, sizeof(buf) - 1);
close(fd);
if (len <= 0)
return -1;
buf[len] = '\0';
p = buf;
while (*p) {
long first, last, cpu;
while (*p == ',' || *p == '\n' || *p == '\t' || *p == ' ')
p++;
if (!*p)
break;
errno = 0;
first = strtol(p, &end, 10);
if (errno || end == p)
return -1;
p = end;
last = first;
if (*p == '-') {
p++;
errno = 0;
last = strtol(p, &end, 10);
if (errno || end == p || last < first)
return -1;
p = end;
}
for (cpu = first; cpu <= last; cpu++) {
if (add_cpu(cpus, nr, &cap, (int)cpu))
return -1;
}
}
return *nr ? 0 : -1;
}
static long read_cmdline_long(const char *key, long fallback)
{
char buf[4096];
char *p, *end;
int fd;
ssize_t len;
size_t key_len = strlen(key);
long val;
fd = open("/proc/cmdline", O_RDONLY | O_CLOEXEC);
if (fd < 0)
return fallback;
len = read(fd, buf, sizeof(buf) - 1);
close(fd);
if (len <= 0)
return fallback;
buf[len] = '\0';
p = buf;
while ((p = strstr(p, key))) {
if ((p == buf || p[-1] == ' ') && p[key_len] == '=') {
val = strtol(p + key_len + 1, &end, 10);
if (end != p + key_len + 1 && val >= 0)
return val;
}
p += key_len;
}
return fallback;
}
static void pin_cpu(int cpu)
{
cpu_set_t set;
CPU_ZERO(&set);
CPU_SET(cpu, &set);
if (sched_setaffinity(0, sizeof(set), &set)) {
fprintf(stderr, "sched_setaffinity(%d): %s\n", cpu,
strerror(errno));
exit(2);
}
}
static void *worker(void *data)
{
struct worker_arg *arg = data;
char *msg;
long i;
msg = malloc(arg->msg_size);
if (!msg)
die("malloc msg");
memset(msg, 0x5a, arg->msg_size);
pin_cpu(arg->cpu);
pthread_barrier_wait(&start_barrier);
for (i = 0; i < arg->count; i++) {
int ret[2];
if (arg->send_first) {
ret[0] = syscall(SYS_mq_timedsend, arg->send_mqd, msg,
arg->msg_size, 0, NULL);
ret[1] = syscall(SYS_mq_timedreceive, arg->recv_mqd,
msg, arg->msg_size, NULL, NULL);
} else {
ret[0] = syscall(SYS_mq_timedreceive, arg->recv_mqd,
msg, arg->msg_size, NULL, NULL);
ret[1] = syscall(SYS_mq_timedsend, arg->send_mqd, msg,
arg->msg_size, 0, NULL);
}
if (ret[0] < 0 || ret[1] < 0) {
fprintf(stderr, "mq failed cpu=%d iter=%ld: %s\n",
arg->cpu, i, strerror(errno));
exit(3);
}
}
free(msg);
return NULL;
}
static double nsec_diff(struct timespec a, struct timespec b)
{
return (double)(b.tv_sec - a.tv_sec) * 1000000000.0 +
(double)(b.tv_nsec - a.tv_nsec);
}
static void usage(const char *prog)
{
fprintf(stderr,
"usage: %s [-p pairs] [-n iterations] [-s msg_size]\n",
prog);
}
int main(int argc, char **argv)
{
long count = read_cmdline_long("pp_count", 100000);
long pairs = read_cmdline_long("pp_pairs", 0);
long msg_size_arg = read_cmdline_long("pp_size", 64);
struct mq_attr attr = {
.mq_flags = 0,
.mq_maxmsg = 1,
.mq_msgsize = 64,
.mq_curmsgs = 0,
};
struct rusage ru;
pthread_t *threads;
struct worker_arg *args;
struct timespec start, end;
int *node0_cpus, *node1_cpus;
size_t node0_nr, node1_nr;
long messages, mq_syscalls;
int opt, i;
while ((opt = getopt(argc, argv, "p:n:s:h")) != -1) {
switch (opt) {
case 'p':
pairs = atol(optarg);
break;
case 'n':
count = atol(optarg);
break;
case 's':
msg_size_arg = atol(optarg);
break;
default:
usage(argv[0]);
return opt == 'h' ? 0 : 1;
}
}
if (count <= 0)
count = 100000;
if (msg_size_arg <= 0)
msg_size_arg = 64;
if (msg_size_arg > 65536) {
fprintf(stderr, "msg_size too large: %ld\n", msg_size_arg);
return 1;
}
attr.mq_msgsize = msg_size_arg;
if (read_cpulist("/sys/devices/system/node/node0/cpulist",
&node0_cpus, &node0_nr) ||
read_cpulist("/sys/devices/system/node/node1/cpulist",
&node1_cpus, &node1_nr)) {
fprintf(stderr, "need at least two NUMA nodes with cpulist files\n");
return 1;
}
if (pairs <= 0 || pairs > (long)node0_nr || pairs > (long)node1_nr)
pairs = node0_nr < node1_nr ? (long)node0_nr : (long)node1_nr;
if (pairs <= 0) {
fprintf(stderr, "no CPU pairs available\n");
return 1;
}
threads = calloc(pairs * 2, sizeof(*threads));
args = calloc(pairs * 2, sizeof(*args));
if (!threads || !args)
die("calloc");
printf("CONFIG pairs=%ld count=%ld msg_size=%ld node0_cpus=%zu node1_cpus=%zu\n",
pairs, count, msg_size_arg, node0_nr, node1_nr);
printf("CPUS first=%d:%d last=%d:%d\n",
node0_cpus[0], node1_cpus[0],
node0_cpus[pairs - 1], node1_cpus[pairs - 1]);
fflush(stdout);
pthread_barrier_init(&start_barrier, NULL, pairs * 2 + 1);
for (i = 0; i < pairs; i++) {
char name_ab[64], name_ba[64];
mqd_t mqd_ab, mqd_ba;
snprintf(name_ab, sizeof(name_ab), "/objcg_pp_ab_%d_%ld", i,
(long)getpid());
snprintf(name_ba, sizeof(name_ba), "/objcg_pp_ba_%d_%ld", i,
(long)getpid());
mq_unlink(name_ab);
mq_unlink(name_ba);
mqd_ab = mq_open(name_ab, O_CREAT | O_RDWR, 0600, &attr);
mqd_ba = mq_open(name_ba, O_CREAT | O_RDWR, 0600, &attr);
if (mqd_ab == (mqd_t)-1 || mqd_ba == (mqd_t)-1)
die("mq_open");
mq_unlink(name_ab);
mq_unlink(name_ba);
args[i * 2] = (struct worker_arg) {
.send_mqd = mqd_ab,
.recv_mqd = mqd_ba,
.cpu = node0_cpus[i],
.count = count,
.msg_size = msg_size_arg,
.send_first = 1,
};
args[i * 2 + 1] = (struct worker_arg) {
.send_mqd = mqd_ba,
.recv_mqd = mqd_ab,
.cpu = node1_cpus[i],
.count = count,
.msg_size = msg_size_arg,
.send_first = 0,
};
if (pthread_create(&threads[i * 2], NULL, worker,
&args[i * 2]))
die("pthread_create");
if (pthread_create(&threads[i * 2 + 1], NULL, worker,
&args[i * 2 + 1]))
die("pthread_create");
}
clock_gettime(CLOCK_MONOTONIC, &start);
pthread_barrier_wait(&start_barrier);
for (i = 0; i < pairs * 2; i++)
pthread_join(threads[i], NULL);
clock_gettime(CLOCK_MONOTONIC, &end);
getrusage(RUSAGE_SELF, &ru);
messages = count * pairs * 2;
mq_syscalls = messages * 2;
printf("RESULT pairs=%ld messages=%ld mq_syscalls=%ld seconds=%.6f msg_per_sec=%.0f mq_ops_per_sec=%.0f user_sec=%.6f system_sec=%.6f voluntary_cs=%ld involuntary_cs=%ld\n",
pairs, messages, mq_syscalls, nsec_diff(start, end) / 1000000000.0,
(double)messages * 1000000000.0 / nsec_diff(start, end),
(double)mq_syscalls * 1000000000.0 / nsec_diff(start, end),
(double)ru.ru_utime.tv_sec + (double)ru.ru_utime.tv_usec / 1000000.0,
(double)ru.ru_stime.tv_sec + (double)ru.ru_stime.tv_usec / 1000000.0,
ru.ru_nvcsw, ru.ru_nivcsw);
return 0;
}
objcg_stock_probe.c
-------------------
#include <linux/atomic.h>
#include <linux/init.h>
#include <linux/kprobes.h>
#include <linux/module.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
#include <linux/uaccess.h>
static atomic64_t drain_hits;
static atomic64_t refill_hits;
static atomic64_t post_alloc_hits;
static atomic64_t free_hits;
static int drain_pre(struct kprobe *kp, struct pt_regs *regs)
{
atomic64_inc(&drain_hits);
return 0;
}
static int refill_pre(struct kprobe *kp, struct pt_regs *regs)
{
atomic64_inc(&refill_hits);
return 0;
}
static int post_alloc_pre(struct kprobe *kp, struct pt_regs *regs)
{
atomic64_inc(&post_alloc_hits);
return 0;
}
static int free_pre(struct kprobe *kp, struct pt_regs *regs)
{
atomic64_inc(&free_hits);
return 0;
}
static struct kprobe probes[] = {
{
.symbol_name = "drain_obj_stock",
.pre_handler = drain_pre,
},
{
.symbol_name = "__refill_obj_stock",
.pre_handler = refill_pre,
},
{
.symbol_name = "__memcg_slab_post_alloc_hook",
.pre_handler = post_alloc_pre,
},
{
.symbol_name = "__memcg_slab_free_hook",
.pre_handler = free_pre,
},
};
static struct kprobe *probe_ptrs[] = {
&probes[0],
&probes[1],
&probes[2],
&probes[3],
};
static void reset_counts(void)
{
atomic64_set(&drain_hits, 0);
atomic64_set(&refill_hits, 0);
atomic64_set(&post_alloc_hits, 0);
atomic64_set(&free_hits, 0);
}
static int counts_show(struct seq_file *m, void *v)
{
seq_printf(m, "drain_obj_stock=%lld\n",
atomic64_read(&drain_hits));
seq_printf(m, "__refill_obj_stock=%lld\n",
atomic64_read(&refill_hits));
seq_printf(m, "__memcg_slab_post_alloc_hook=%lld\n",
atomic64_read(&post_alloc_hits));
seq_printf(m, "__memcg_slab_free_hook=%lld\n",
atomic64_read(&free_hits));
return 0;
}
static int counts_open(struct inode *inode, struct file *file)
{
return single_open(file, counts_show, NULL);
}
static ssize_t counts_write(struct file *file, const char __user *buf,
size_t count, loff_t *ppos)
{
reset_counts();
return count;
}
static const struct proc_ops counts_fops = {
.proc_open = counts_open,
.proc_read = seq_read,
.proc_lseek = seq_lseek,
.proc_release = single_release,
.proc_write = counts_write,
};
static int __init objcg_stock_probe_init(void)
{
int ret;
reset_counts();
ret = register_kprobes(probe_ptrs, ARRAY_SIZE(probe_ptrs));
if (ret)
return ret;
if (!proc_create("objcg_stock_probe", 0600, NULL, &counts_fops)) {
unregister_kprobes(probe_ptrs, ARRAY_SIZE(probe_ptrs));
return -ENOMEM;
}
return 0;
}
static void __exit objcg_stock_probe_exit(void)
{
remove_proc_entry("objcg_stock_probe", NULL);
unregister_kprobes(probe_ptrs, ARRAY_SIZE(probe_ptrs));
}
module_init(objcg_stock_probe_init);
module_exit(objcg_stock_probe_exit);
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Count memcg obj stock kprobe hits for ping-pong tests");