Re: [PATCH] x86: prefer RDTSCP in rdtsc_ordered()

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 01/10/2024 11:02 am, Jan Beulich wrote:
> On 01.10.2024 11:45, Andrew Cooper wrote:
>> On 01/10/2024 9:12 am, Jan Beulich wrote:
>>> On 30.09.2024 18:40, Andrew Cooper wrote:
>>>> On 30/09/2024 4:08 pm, Jan Beulich wrote:
>>>>> --- a/xen/arch/x86/include/asm/msr.h
>>>>> +++ b/xen/arch/x86/include/asm/msr.h
>>>>> @@ -108,18 +108,30 @@ static inline uint64_t rdtsc(void)
>>>>>  
>>>>>  static inline uint64_t rdtsc_ordered(void)
>>>>>  {
>>>>> - /*
>>>>> -  * The RDTSC instruction is not ordered relative to memory access.
>>>>> -  * The Intel SDM and the AMD APM are both vague on this point, but
>>>>> -  * empirically an RDTSC instruction can be speculatively executed
>>>>> -  * before prior loads.  An RDTSC immediately after an appropriate
>>>>> -  * barrier appears to be ordered as a normal load, that is, it
>>>>> -  * provides the same ordering guarantees as reading from a global
>>>>> -  * memory location that some other imaginary CPU is updating
>>>>> -  * continuously with a time stamp.
>>>>> -  */
>>>>> - alternative("lfence", "mfence", X86_FEATURE_MFENCE_RDTSC);
>>>>> - return rdtsc();
>>>>> +    uint64_t low, high, aux;
>>>>> +
>>>>> +    /*
>>>>> +     * The RDTSC instruction is not ordered relative to memory access.
>>>>> +     * The Intel SDM and the AMD APM are both vague on this point, but
>>>>> +     * empirically an RDTSC instruction can be speculatively executed
>>>>> +     * before prior loads.
>>>> This part of the comment is stale now.  For RDTSC, AMD state:
>>>>
>>>> "This instruction is not serializing. Therefore, there is no guarantee
>>>> that all instructions have completed at the time the time-stamp counter
>>>> is read."
>>>>
>>>> and for RDTSCP:
>>>>
>>>> "Unlike the RDTSC instruction, RDTSCP forces all older instructions to
>>>> retire before reading the time-stamp counter."
>>>>
>>>> i.e. it's dispatch serialising, given our new post-Spectre terminology.
>>> I don't read that as truly "dispatch serializing";
>> That is precisely what dispatch serialising is and means.
>>
>> Both LFENCE and RDTSCP wait at dispatch until they're the only
>> instruction in the pipeline.  That is how they get the property of
>> waiting for all older instructions to retire before executing.
>>
>>> both Intel and AMD
>>> leave open whether subsequent insns would also be affected, or whether
>>> those could pass the RDTSCP.
>> Superscalar pipelines which can dispatch more than one uop per cycle can
>> issue LFENCE/RDTSCP concurrently with younger instructions.
>>
>> This is why LFENCE; JMP * was retracted as safe alternative to
>> retpoline, and why the Intel docs call out explicitly that you need
>> LFENCE following the RDTSC(P) if you want it to complete before
>> subsequent instructions start.
> Yet what you describe still only puts in place a relationship between
> RDTSCP and what follows. What I was saying is that there's no guarantee
> that insns following RDTSCP can't actually execute not only in parallel
> with RDTSCP, but also in parallel with / ahead of earlier insns.

I think you're reading too much into the fact that these passages aren't
identical.

They were written years apart, most likely by different authors.

>  Aiui
> LFENCE makes this guarantee. IOW in
>
>       ADD ...; LFENCE; SUB ...
>
> the SUB is guaranteed to dispatch only after the ADD, 

The guarantee made is that ADD has retired before LFENCE executes.

SDM: "Specifically, LFENCE does not execute until all prior instructions
have completed locally, and no later instruction begins execution until
LFENCE completes."

"completed locally" == "retired".

The APM doesn't have a description of "dispatch serialising" attached to
LFENCE.  However, the Managing Speculation whitepaper does state:

"Set an MSR in the processor so that LFENCE is a dispatch serializing
instruction and then use LFENCE in code streams to serialize dispatch
(LFENCE is faster than RDTSCP which is also dispatch serializing)."

which also doesn't define dispatch serialising, but does make the
statement which started this debate.

That said, the LFENCE_DISPATCH chicken really was AMD's "behave like
Intel" bit.

> whereas in
>
>       ADD ...; RDTSCP; SUB ...
>
> there doesn't appear to be such a guarantee; the only guarantee here is
> for RDTSCP to dispatch after the ADD.

SDM: "The RDTSCP instruction is not a serializing instruction, but it
does wait until all previous instructions have executed and all previous
loads are globally visible."

APM: "RDTSCP forces all older instructions to retire before reading the
timestamp counter."

Both have an explicit written guarantee that the ADD retires before
RDTSCP starts.


The thing which neither manual states, probably because the authors
thought it was too obvious to mention, is that dispatch is always in
(predicted) program order.  Consider the implications on dependency
tracking if the CPUs were to dispatch uops out of program order.

~Andrew