Burst feature¶

This feature borrows time now against our future underrun, at the cost ofincreased interference against the other system users. All nicely bounded.

Traditional (UP-EDF) bandwidth control is something like:

(U = Sum u_i) <= 1

This guaranteeds both that every deadline is met and that the system isstable. After all, if U were > 1, then for every second of walltime,we’d have to run more than a second of program time, and obviously missour deadline, but the next deadline will be further out still, there isnever time to catch up, unbounded fail.

The burst feature observes that a workload doesn’t always executes the fullquota; this enables one to describe u_i as a statistical distribution.

For example, have u_i = {x,e}_i, where x is the p(95) and x+e p(100)(the traditional WCET). This effectively allows u to be smaller,increasing the efficiency (we can pack more tasks in the system), but atthe cost of missing deadlines when all the odds line up. However, itdoes maintain stability, since every overrun must be paired with anunderrun as long as our x is above the average.

That is, suppose we have 2 tasks, both specify a p(95) value, then wehave a p(95)*p(95) = 90.25% chance both tasks are within their quota andeverything is good. At the same time we have a p(5)p(5) = 0.25% chanceboth tasks will exceed their quota at the same time (guaranteed deadlinefail). Somewhere in between there’s a threshold where one exceeds andthe other doesn’t underrun enough to compensate; this depends on thespecific CDFs.

At the same time, we can say that the worst case deadline miss, will beSum e_i; that is, there is a bounded tardiness (under the assumptionthat x+e is indeed WCET).

The interference when using burst is valued by the possibilities formissing the deadline and the average WCET. Test results showed that whenthere many cgroups or CPU is under utilized, the interference islimited. More details are shown in:https://lore.kernel.org/lkml/5371BD36-55AE-4F71-B9D7-B86DC32E3D2B@linux.alibaba.com/

Management¶

Quota, period and burst are managed within the cpu subsystem via cgroupfs.

• cpu.cfs_quota_us: run-time replenished within a period (in microseconds)

• cpu.cfs_period_us: the length of a period (in microseconds)

• cpu.stat: exports throttling statistics [explained further below]

• cpu.cfs_burst_us: the maximum accumulated run-time (in microseconds)

The default values are:

cpu.cfs_period_us=100mscpu.cfs_quota_us=-1cpu.cfs_burst_us=0

A value of -1 for cpu.cfs_quota_us indicates that the group does not have anybandwidth restriction in place, such a group is described as an unconstrainedbandwidth group. This represents the traditional work-conserving behavior forCFS.

Writing any (valid) positive value(s) no smaller than cpu.cfs_burst_us willenact the specified bandwidth limit. The minimum quota allowed for the quota orperiod is 1ms. There is also an upper bound on the period length of 1s.Additional restrictions exist when bandwidth limits are used in a hierarchicalfashion, these are explained in more detail below.

Writing any negative value to cpu.cfs_quota_us will remove the bandwidth limitand return the group to an unconstrained state once more.

A value of 0 for cpu.cfs_burst_us indicates that the group can not accumulateany unused bandwidth. It makes the traditional bandwidth control behavior forCFS unchanged. Writing any (valid) positive value(s) no larger thancpu.cfs_quota_us into cpu.cfs_burst_us will enact the cap on unused bandwidthaccumulation.

Any updates to a group’s bandwidth specification will result in it becomingunthrottled if it is in a constrained state.

System wide settings¶

For efficiency run-time is transferred between the global pool and CPU local“silos” in a batch fashion. This greatly reduces global accounting pressureon large systems. The amount transferred each time such an update is requiredis described as the “slice”.

This is tunable via procfs:

/proc/sys/kernel/sched_cfs_bandwidth_slice_us (default=5ms)

Larger slice values will reduce transfer overheads, while smaller values allowfor more fine-grained consumption.

Statistics¶

A group’s bandwidth statistics are exported via 5 fields in cpu.stat.

cpu.stat:

• nr_periods: Number of enforcement intervals that have elapsed.

• nr_throttled: Number of times the group has been throttled/limited.

• throttled_time: The total time duration (in nanoseconds) for which entitiesof the group have been throttled.

• nr_bursts: Number of periods burst occurs.

• burst_time: Cumulative wall-time (in nanoseconds) that any CPUs has usedabove quota in respective periods.

This interface is read-only.

Hierarchical considerations¶

The interface enforces that an individual entity’s bandwidth is alwaysattainable, that is: max(c_i) <= C. However, over-subscription in theaggregate case is explicitly allowed to enable work-conserving semanticswithin a hierarchy:

e.g. Sum (c_i) may exceed C

[ Where C is the parent’s bandwidth, and c_i its children ]

There are two ways in which a group may become throttled:

1. it fully consumes its own quota within a period

2. a parent’s quota is fully consumed within its period

In case b) above, even though the child may have runtime remaining it will notbe allowed to until the parent’s runtime is refreshed.

CFS Bandwidth Quota Caveats¶

Once a slice is assigned to a cpu it does not expire. However all but 1ms ofthe slice may be returned to the global pool if all threads on that cpu becomeunrunnable. This is configured at compile time by the min_cfs_rq_runtimevariable. This is a performance tweak that helps prevent added contention onthe global lock.

The fact that cpu-local slices do not expire results in some interesting cornercases that should be understood.

For cgroup cpu constrained applications that are cpu limited this is arelatively moot point because they will naturally consume the entirety of theirquota as well as the entirety of each cpu-local slice in each period. As aresult it is expected that nr_periods roughly equal nr_throttled, and thatcpuacct.usage will increase roughly equal to cfs_quota_us in each period.

For highly-threaded, non-cpu bound applications this non-expiration nuanceallows applications to briefly burst past their quota limits by the amount ofunused slice on each cpu that the task group is running on (typically at most1ms per cpu or as defined by min_cfs_rq_runtime). This slight burst onlyapplies if quota had been assigned to a cpu and then not fully used or returnedin previous periods. This burst amount will not be transferred between cores.As a result, this mechanism still strictly limits the task group to quotaaverage usage, albeit over a longer time window than a single period. Thisalso limits the burst ability to no more than 1ms per cpu. This providesbetter more predictable user experience for highly threaded applications withsmall quota limits on high core count machines. It also eliminates thepropensity to throttle these applications while simultaneously using less thanquota amounts of cpu. Another way to say this, is that by allowing the unusedportion of a slice to remain valid across periods we have decreased thepossibility of wastefully expiring quota on cpu-local silos that don’t need afull slice’s amount of cpu time.

The interaction between cpu-bound and non-cpu-bound-interactive applicationsshould also be considered, especially when single core usage hits 100%. If yougave each of these applications half of a cpu-core and they both got scheduledon the same CPU it is theoretically possible that the non-cpu bound applicationwill use up to 1ms additional quota in some periods, thereby preventing thecpu-bound application from fully using its quota by that same amount. In theseinstances it will be up to the CFS algorithm (seeCFS Scheduler) todecide which application is chosen to run, as they will both be runnable andhave remaining quota. This runtime discrepancy will be made up in the followingperiods when the interactive application idles.

Examples¶

1. Limit a group to 1 CPU worth of runtime:

   If period is 250ms and quota is also 250ms, the group will get1 CPU worth of runtime every 250ms.# echo 250000 > cpu.cfs_quota_us /* quota = 250ms */# echo 250000 > cpu.cfs_period_us /* period = 250ms */

2. Limit a group to 2 CPUs worth of runtime on a multi-CPU machine

   With 500ms period and 1000ms quota, the group can get 2 CPUs worth ofruntime every 500ms:

   # echo 1000000 > cpu.cfs_quota_us /* quota = 1000ms */# echo 500000 > cpu.cfs_period_us /* period = 500ms */The larger period here allows for increased burst capacity.

3. Limit a group to 20% of 1 CPU.

   With 50ms period, 10ms quota will be equivalent to 20% of 1 CPU:

   # echo 10000 > cpu.cfs_quota_us /* quota = 10ms */# echo 50000 > cpu.cfs_period_us /* period = 50ms */

   By using a small period here we are ensuring a consistent latencyresponse at the expense of burst capacity.

4. Limit a group to 40% of 1 CPU, and allow accumulate up to 20% of 1 CPUadditionally, in case accumulation has been done.

   With 50ms period, 20ms quota will be equivalent to 40% of 1 CPU.And 10ms burst will be equivalent to 20% of 1 CPU:

   # echo 20000 > cpu.cfs_quota_us /* quota = 20ms */# echo 50000 > cpu.cfs_period_us /* period = 50ms */# echo 10000 > cpu.cfs_burst_us /* burst = 10ms */

   Larger buffer setting (no larger than quota) allows greater burst capacity.