Lets Build Provable Multicore Schedulers! Redha GOUICEM Whisper - - PowerPoint PPT Presentation

Let’s Build Provable Multicore Schedulers!

Redha GOUICEM

Whisper team, Sorbonne Universités, Inria, LIP6 Joint work with: Gilles MULLER, Julia LAWALL (Inria, LIP6), Julien SOPENA (LIP6, UPMC), Baptiste LEPERS, Willy ZWAENPOEL (EPFL), Jean-Pierre LOZI (UNICE), Nicolas PALIX (Université Grenoble-Alpes)

April 23, 2017

Redha GOUICEM Let’s Build Provable Multicore Schedulers! April 23, 2017 1/9

Context

Lozi et al. [EUROSYS’16] found bugs in the Linux scheduler, eg. violation

• f work conservation property

Work conservation: process waiting to be scheduled ⇒ no idle core

Redha GOUICEM Let’s Build Provable Multicore Schedulers! April 23, 2017 1/9

Context

Lozi et al. [EUROSYS’16] found bugs in the Linux scheduler, eg. violation

• f work conservation property

Work conservation: process waiting to be scheduled ⇒ no idle core Some cores are idle while others are overloaded

Redha GOUICEM Let’s Build Provable Multicore Schedulers! April 23, 2017 1/9

Problem: Finding bugs

Linux scheduler (CFS) is growing fast in terms of complexity (lines of code, variables, functions, structures) kernel/sched/fair.c codebase history:

2007 2009 2011 2013 2015 2017 Date 1000 2000 3000 4000 5000 6000 7000 8000 Number

Count Lines of Code

code comment 2007 2009 2011 2013 2015 2017 Date 50 100 150 200 250 300 Number

Functions

static_func func 2007 2009 2011 2013 2015 2017 Date 5 10 15 20 25 30 Number

Variables

static_var var 2007 2009 2011 2013 2015 2017 Date 1 2 3 4 5 6 Number

Struct

struct

./fair.c

⇒ difficult to maintain and add features

Redha GOUICEM Let’s Build Provable Multicore Schedulers! April 23, 2017 2/9

Contribution

Ipanema, a DSL for proved multicore schedulers Based on Bossa [HASE’05], an event-based DSL for single-core schedulers

Redha GOUICEM Let’s Build Provable Multicore Schedulers! April 23, 2017 3/9

Contribution

Ipanema, a DSL for proved multicore schedulers Based on Bossa [HASE’05], an event-based DSL for single-core schedulers

DSL policy Compiled Leon Code C compiler Leon compiler Scheduling events Compiled C policy (Kernel module) Kernel API Proofs Ipanema API Kernel hooks

Redha GOUICEM Let’s Build Provable Multicore Schedulers! April 23, 2017 3/9

Contribution

Ipanema = Bossa + load balancing + proofs

BEFORE READY RUNNING BLOCKED TERMINATED

new() yield() tick() schedule() block() unblock() block() exit() loadBalance() exit() exit()

Redha GOUICEM Let’s Build Provable Multicore Schedulers! April 23, 2017 4/9

Contribution

Ipanema = Bossa + load balancing + proofs

BEFORE READY RUNNING BLOCKED TERMINATED

new() yield() tick() schedule() block() unblock() block() exit() loadBalance() exit() exit()

All cores Stealable cores Stolen core Filter Select Steal 1 2 3 Redha GOUICEM Let’s Build Provable Multicore Schedulers! April 23, 2017 4/9

Contribution

Ipanema = Bossa + load balancing + proofs

BEFORE READY RUNNING BLOCKED TERMINATED

new() yield() tick() schedule() block() unblock() block() exit() loadBalance() exit() exit()

All cores Stealable cores Stolen core Filter Select Steal 1 2 3 Redha GOUICEM Let’s Build Provable Multicore Schedulers! April 23, 2017 4/9

Evaluation

Safety: generated kernel modules do not lead to kernel crashes or failures DSL expressivity: can we implement “all” scheduling policies ? Simplicity: can “anyone” write a scheduling policy ? Bug detection: do we prevent bugs that were found/fixed in the CFS ?

Redha GOUICEM Let’s Build Provable Multicore Schedulers! April 23, 2017 5/9

Code sample

thread = { int progress , load , last_sched , curr_quanta ; } core = { threads = { RUNNING thread current; shared READY set <thread > ready:order = { lowest progress }; BLOCKED blocked; TERMINATED terminated; } int load = sum(ready.load) + valid(current) ? 1024 : 0; }

handler ( thread_event e) { On new { core c = first(cores

• rder = { lowest

load }); e.target.load = 0; e.target.progress = 0; e.target => c.ready; } On detach { e.target => terminated; } On tick { update_progress (e.target ); if (e.target. curr_quanta >= max_quanta) { update_load (e.target , max_quanta ); e.target => ready; } } On schedule { thread t = first(ready );

• t. last_sched = now ();
• t. curr_quanta = 0;

t => current; } On unblock { core c = first(cores

• rder = { lowest

load }); e.target => c.ready; } On yield { update_progress (e.target ); update_load (e.target ,e.target. curr_quanta ); e.target => ready; } On block { update_progress (e.target ); update_load (e.target ,e.target. curr_quanta ); e.target => blocked; } }

Redha GOUICEM Let’s Build Provable Multicore Schedulers! April 23, 2017 6/9

Preliminary results

20 40 60 80 100

5 6 7 8 9

100

2 3 4 5 6 7 8 9

1000

Kernel build performance (lower is better)

# of make jobs runtime in s

cfs bl_simple_decl

Redha GOUICEM Let’s Build Provable Multicore Schedulers! April 23, 2017 7/9

Preliminary results (2)

Redha GOUICEM Let’s Build Provable Multicore Schedulers! April 23, 2017 8/9

Roadmap

What we have: Ipanema→C compiler Modified Linux-kernel for Ipanema: scheduling events hooks Simple policies written in Ipanema run on a modified Linux Work conservation proof in Leon for CFS-like balancing policies What remains to be done: Prove properties on policies (fairness, liveness, work conservation) Work on the Ipanema→Leon compiler to generate these proofs Evaluate

Redha GOUICEM Let’s Build Provable Multicore Schedulers! April 23, 2017 9/9

Roadmap

What we have: Ipanema→C compiler Modified Linux-kernel for Ipanema: scheduling events hooks Simple policies written in Ipanema run on a modified Linux Work conservation proof in Leon for CFS-like balancing policies What remains to be done: Prove properties on policies (fairness, liveness, work conservation) Work on the Ipanema→Leon compiler to generate these proofs Evaluate

Redha GOUICEM Let’s Build Provable Multicore Schedulers! April 23, 2017 9/9