1RCU Torture Test Operation 2 3 4CONFIG_RCU_TORTURE_TEST 5 6The CONFIG_RCU_TORTURE_TEST config option is available for all RCU 7implementations. It creates an rcutorture kernel module that can 8be loaded to run a torture test. The test periodically outputs 9status messages via printk(), which can be examined via the dmesg 10command (perhaps grepping for "torture"). The test is started 11when the module is loaded, and stops when the module is unloaded. 12 13CONFIG_RCU_TORTURE_TEST_RUNNABLE 14 15It is also possible to specify CONFIG_RCU_TORTURE_TEST=y, which will 16result in the tests being loaded into the base kernel. In this case, 17the CONFIG_RCU_TORTURE_TEST_RUNNABLE config option is used to specify 18whether the RCU torture tests are to be started immediately during 19boot or whether the /proc/sys/kernel/rcutorture_runnable file is used 20to enable them. This /proc file can be used to repeatedly pause and 21restart the tests, regardless of the initial state specified by the 22CONFIG_RCU_TORTURE_TEST_RUNNABLE config option. 23 24You will normally -not- want to start the RCU torture tests during boot 25(and thus the default is CONFIG_RCU_TORTURE_TEST_RUNNABLE=n), but doing 26this can sometimes be useful in finding boot-time bugs. 27 28 29MODULE PARAMETERS 30 31This module has the following parameters: 32 33fqs_duration Duration (in microseconds) of artificially induced bursts 34 of force_quiescent_state() invocations. In RCU 35 implementations having force_quiescent_state(), these 36 bursts help force races between forcing a given grace 37 period and that grace period ending on its own. 38 39fqs_holdoff Holdoff time (in microseconds) between consecutive calls 40 to force_quiescent_state() within a burst. 41 42fqs_stutter Wait time (in seconds) between consecutive bursts 43 of calls to force_quiescent_state(). 44 45gp_normal Make the fake writers use normal synchronous grace-period 46 primitives. 47 48gp_exp Make the fake writers use expedited synchronous grace-period 49 primitives. If both gp_normal and gp_exp are set, or 50 if neither gp_normal nor gp_exp are set, then randomly 51 choose the primitive so that about 50% are normal and 52 50% expedited. By default, neither are set, which 53 gives best overall test coverage. 54 55irqreader Says to invoke RCU readers from irq level. This is currently 56 done via timers. Defaults to "1" for variants of RCU that 57 permit this. (Or, more accurately, variants of RCU that do 58 -not- permit this know to ignore this variable.) 59 60n_barrier_cbs If this is nonzero, RCU barrier testing will be conducted, 61 in which case n_barrier_cbs specifies the number of 62 RCU callbacks (and corresponding kthreads) to use for 63 this testing. The value cannot be negative. If you 64 specify this to be non-zero when torture_type indicates a 65 synchronous RCU implementation (one for which a member of 66 the synchronize_rcu() rather than the call_rcu() family is 67 used -- see the documentation for torture_type below), an 68 error will be reported and no testing will be carried out. 69 70nfakewriters This is the number of RCU fake writer threads to run. Fake 71 writer threads repeatedly use the synchronous "wait for 72 current readers" function of the interface selected by 73 torture_type, with a delay between calls to allow for various 74 different numbers of writers running in parallel. 75 nfakewriters defaults to 4, which provides enough parallelism 76 to trigger special cases caused by multiple writers, such as 77 the synchronize_srcu() early return optimization. 78 79nreaders This is the number of RCU reading threads supported. 80 The default is twice the number of CPUs. Why twice? 81 To properly exercise RCU implementations with preemptible 82 read-side critical sections. 83 84onoff_interval 85 The number of seconds between each attempt to execute a 86 randomly selected CPU-hotplug operation. Defaults to 87 zero, which disables CPU hotplugging. In HOTPLUG_CPU=n 88 kernels, rcutorture will silently refuse to do any 89 CPU-hotplug operations regardless of what value is 90 specified for onoff_interval. 91 92onoff_holdoff The number of seconds to wait until starting CPU-hotplug 93 operations. This would normally only be used when 94 rcutorture was built into the kernel and started 95 automatically at boot time, in which case it is useful 96 in order to avoid confusing boot-time code with CPUs 97 coming and going. 98 99shuffle_interval 100 The number of seconds to keep the test threads affinitied 101 to a particular subset of the CPUs, defaults to 3 seconds. 102 Used in conjunction with test_no_idle_hz. 103 104shutdown_secs The number of seconds to run the test before terminating 105 the test and powering off the system. The default is 106 zero, which disables test termination and system shutdown. 107 This capability is useful for automated testing. 108 109stall_cpu The number of seconds that a CPU should be stalled while 110 within both an rcu_read_lock() and a preempt_disable(). 111 This stall happens only once per rcutorture run. 112 If you need multiple stalls, use modprobe and rmmod to 113 repeatedly run rcutorture. The default for stall_cpu 114 is zero, which prevents rcutorture from stalling a CPU. 115 116 Note that attempts to rmmod rcutorture while the stall 117 is ongoing will hang, so be careful what value you 118 choose for this module parameter! In addition, too-large 119 values for stall_cpu might well induce failures and 120 warnings in other parts of the kernel. You have been 121 warned! 122 123stall_cpu_holdoff 124 The number of seconds to wait after rcutorture starts 125 before stalling a CPU. Defaults to 10 seconds. 126 127stat_interval The number of seconds between output of torture 128 statistics (via printk()). Regardless of the interval, 129 statistics are printed when the module is unloaded. 130 Setting the interval to zero causes the statistics to 131 be printed -only- when the module is unloaded, and this 132 is the default. 133 134stutter The length of time to run the test before pausing for this 135 same period of time. Defaults to "stutter=5", so as 136 to run and pause for (roughly) five-second intervals. 137 Specifying "stutter=0" causes the test to run continuously 138 without pausing, which is the old default behavior. 139 140test_boost Whether or not to test the ability of RCU to do priority 141 boosting. Defaults to "test_boost=1", which performs 142 RCU priority-inversion testing only if the selected 143 RCU implementation supports priority boosting. Specifying 144 "test_boost=0" never performs RCU priority-inversion 145 testing. Specifying "test_boost=2" performs RCU 146 priority-inversion testing even if the selected RCU 147 implementation does not support RCU priority boosting, 148 which can be used to test rcutorture's ability to 149 carry out RCU priority-inversion testing. 150 151test_boost_interval 152 The number of seconds in an RCU priority-inversion test 153 cycle. Defaults to "test_boost_interval=7". It is 154 usually wise for this value to be relatively prime to 155 the value selected for "stutter". 156 157test_boost_duration 158 The number of seconds to do RCU priority-inversion testing 159 within any given "test_boost_interval". Defaults to 160 "test_boost_duration=4". 161 162test_no_idle_hz Whether or not to test the ability of RCU to operate in 163 a kernel that disables the scheduling-clock interrupt to 164 idle CPUs. Boolean parameter, "1" to test, "0" otherwise. 165 Defaults to omitting this test. 166 167torture_type The type of RCU to test, with string values as follows: 168 169 "rcu": rcu_read_lock(), rcu_read_unlock() and call_rcu(), 170 along with expedited, synchronous, and polling 171 variants. 172 173 "rcu_bh": rcu_read_lock_bh(), rcu_read_unlock_bh(), and 174 call_rcu_bh(), along with expedited and synchronous 175 variants. 176 177 "rcu_busted": This tests an intentionally incorrect version 178 of RCU in order to help test rcutorture itself. 179 180 "srcu": srcu_read_lock(), srcu_read_unlock() and 181 call_srcu(), along with expedited and 182 synchronous variants. 183 184 "sched": preempt_disable(), preempt_enable(), and 185 call_rcu_sched(), along with expedited, 186 synchronous, and polling variants. 187 188 "tasks": voluntary context switch and call_rcu_tasks(), 189 along with expedited and synchronous variants. 190 191 Defaults to "rcu". 192 193verbose Enable debug printk()s. Default is disabled. 194 195 196OUTPUT 197 198The statistics output is as follows: 199 200 rcu-torture:--- Start of test: nreaders=16 nfakewriters=4 stat_interval=30 verbose=0 test_no_idle_hz=1 shuffle_interval=3 stutter=5 irqreader=1 fqs_duration=0 fqs_holdoff=0 fqs_stutter=3 test_boost=1/0 test_boost_interval=7 test_boost_duration=4 201 rcu-torture: rtc: (null) ver: 155441 tfle: 0 rta: 155441 rtaf: 8884 rtf: 155440 rtmbe: 0 rtbe: 0 rtbke: 0 rtbre: 0 rtbf: 0 rtb: 0 nt: 3055767 202 rcu-torture: Reader Pipe: 727860534 34213 0 0 0 0 0 0 0 0 0 203 rcu-torture: Reader Batch: 727877838 17003 0 0 0 0 0 0 0 0 0 204 rcu-torture: Free-Block Circulation: 155440 155440 155440 155440 155440 155440 155440 155440 155440 155440 0 205 rcu-torture:--- End of test: SUCCESS: nreaders=16 nfakewriters=4 stat_interval=30 verbose=0 test_no_idle_hz=1 shuffle_interval=3 stutter=5 irqreader=1 fqs_duration=0 fqs_holdoff=0 fqs_stutter=3 test_boost=1/0 test_boost_interval=7 test_boost_duration=4 206 207The command "dmesg | grep torture:" will extract this information on 208most systems. On more esoteric configurations, it may be necessary to 209use other commands to access the output of the printk()s used by 210the RCU torture test. The printk()s use KERN_ALERT, so they should 211be evident. ;-) 212 213The first and last lines show the rcutorture module parameters, and the 214last line shows either "SUCCESS" or "FAILURE", based on rcutorture's 215automatic determination as to whether RCU operated correctly. 216 217The entries are as follows: 218 219o "rtc": The hexadecimal address of the structure currently visible 220 to readers. 221 222o "ver": The number of times since boot that the RCU writer task 223 has changed the structure visible to readers. 224 225o "tfle": If non-zero, indicates that the "torture freelist" 226 containing structures to be placed into the "rtc" area is empty. 227 This condition is important, since it can fool you into thinking 228 that RCU is working when it is not. :-/ 229 230o "rta": Number of structures allocated from the torture freelist. 231 232o "rtaf": Number of allocations from the torture freelist that have 233 failed due to the list being empty. It is not unusual for this 234 to be non-zero, but it is bad for it to be a large fraction of 235 the value indicated by "rta". 236 237o "rtf": Number of frees into the torture freelist. 238 239o "rtmbe": A non-zero value indicates that rcutorture believes that 240 rcu_assign_pointer() and rcu_dereference() are not working 241 correctly. This value should be zero. 242 243o "rtbe": A non-zero value indicates that one of the rcu_barrier() 244 family of functions is not working correctly. 245 246o "rtbke": rcutorture was unable to create the real-time kthreads 247 used to force RCU priority inversion. This value should be zero. 248 249o "rtbre": Although rcutorture successfully created the kthreads 250 used to force RCU priority inversion, it was unable to set them 251 to the real-time priority level of 1. This value should be zero. 252 253o "rtbf": The number of times that RCU priority boosting failed 254 to resolve RCU priority inversion. 255 256o "rtb": The number of times that rcutorture attempted to force 257 an RCU priority inversion condition. If you are testing RCU 258 priority boosting via the "test_boost" module parameter, this 259 value should be non-zero. 260 261o "nt": The number of times rcutorture ran RCU read-side code from 262 within a timer handler. This value should be non-zero only 263 if you specified the "irqreader" module parameter. 264 265o "Reader Pipe": Histogram of "ages" of structures seen by readers. 266 If any entries past the first two are non-zero, RCU is broken. 267 And rcutorture prints the error flag string "!!!" to make sure 268 you notice. The age of a newly allocated structure is zero, 269 it becomes one when removed from reader visibility, and is 270 incremented once per grace period subsequently -- and is freed 271 after passing through (RCU_TORTURE_PIPE_LEN-2) grace periods. 272 273 The output displayed above was taken from a correctly working 274 RCU. If you want to see what it looks like when broken, break 275 it yourself. ;-) 276 277o "Reader Batch": Another histogram of "ages" of structures seen 278 by readers, but in terms of counter flips (or batches) rather 279 than in terms of grace periods. The legal number of non-zero 280 entries is again two. The reason for this separate view is that 281 it is sometimes easier to get the third entry to show up in the 282 "Reader Batch" list than in the "Reader Pipe" list. 283 284o "Free-Block Circulation": Shows the number of torture structures 285 that have reached a given point in the pipeline. The first element 286 should closely correspond to the number of structures allocated, 287 the second to the number that have been removed from reader view, 288 and all but the last remaining to the corresponding number of 289 passes through a grace period. The last entry should be zero, 290 as it is only incremented if a torture structure's counter 291 somehow gets incremented farther than it should. 292 293Different implementations of RCU can provide implementation-specific 294additional information. For example, SRCU provides the following 295additional line: 296 297 srcu-torture: per-CPU(idx=1): 0(0,1) 1(0,1) 2(0,0) 3(0,1) 298 299This line shows the per-CPU counter state. The numbers in parentheses are 300the values of the "old" and "current" counters for the corresponding CPU. 301The "idx" value maps the "old" and "current" values to the underlying 302array, and is useful for debugging. 303 304 305USAGE 306 307The following script may be used to torture RCU: 308 309 #!/bin/sh 310 311 modprobe rcutorture 312 sleep 3600 313 rmmod rcutorture 314 dmesg | grep torture: 315 316The output can be manually inspected for the error flag of "!!!". 317One could of course create a more elaborate script that automatically 318checked for such errors. The "rmmod" command forces a "SUCCESS", 319"FAILURE", or "RCU_HOTPLUG" indication to be printk()ed. The first 320two are self-explanatory, while the last indicates that while there 321were no RCU failures, CPU-hotplug problems were detected. 322