From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B53EE41B36A for ; Fri, 22 May 2026 14:23:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779459824; cv=none; b=YYM2ZI8SzJBb5vUDCe3eJAtHgNB5HsGjSgjqNUXRSDDh0YEBb8OpnRA4gfmdFkYKMS5EUAHo84lwYkkXWvgmEMyK+GXV10rQy0xv6pHCO22c49o0SleZcUEGukiyba9dsEF4hlrMg+LJbuGgp0nhwtC7JW2ACqEP7MRbtBYVjW4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779459824; c=relaxed/simple; bh=4r4E8fF8xlQ2gCDGhw11J9DZ3L6ugESsDuH1k5p0Uwc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=sz38ySGexHdwcUd5zr1PMqTAPCOJ3tbNsYleD+Ecyjive4kXPOIt07AjaCWoUDfQu9GaoHKdXWC69HkbE+Nzv+MFXTM8AYTzto0yAgv217/elcHz5hveLjgrtndNw1wttIsL50yTH07pA/aOPsKoCjDNyaWjtGZVQd35dp//tYk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=IaWqHuSX; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="IaWqHuSX" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 09D471F00A3D; Fri, 22 May 2026 14:23:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1779459821; bh=4b73HeUFL1BJFb9tKUFnj3I3fQCi1XJtQNXmwPghYI8=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=IaWqHuSXUgpMe4/lDFIwXOEhByFwpTQJaGOyoVuTTXq7iBljnkVbkJHrK3k1w1z8a iWq1g9DpzaWmI8n5ccngszzrJqVorI6HR8jmW0wmeDAMfMu3rO8d+QFbcbZwbbYap7 MZYSPhnjKzv2J6o2oA1R2rsn+ob2bQdl4Od5BvSDe87J+19Ke/4pngaa+9xZ3Hh6yS nkOMARNQXcCIGZyVXflVbpThl6fFscdog6OXvf64ecEJvNNJIi6dgfsA6MWA3PgLaP 30jl0Zrrvyngu8BjJh4T52YzUbi6H/TyRO5aMRfjXxiaqps/bFyAizuyxsT3okgZRG gZJwDS9T7TjaQ== From: "Vlastimil Babka (SUSE)" Date: Fri, 22 May 2026 16:23:20 +0200 Subject: [PATCH v3 1/2] mm, slab: add an optimistic __slab_try_return_freelist() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260522-b4-refill-optimistic-return-v3-1-2ba78ec1c6ed@kernel.org> References: <20260522-b4-refill-optimistic-return-v3-0-2ba78ec1c6ed@kernel.org> In-Reply-To: <20260522-b4-refill-optimistic-return-v3-0-2ba78ec1c6ed@kernel.org> To: Harry Yoo Cc: Hao Li , Christoph Lameter , David Rientjes , Roman Gushchin , Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, hu.shengming@zte.com.cn, Vinicius Costa Gomes , "Vlastimil Babka (SUSE)" X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=5302; i=vbabka@kernel.org; h=from:subject:message-id; bh=4r4E8fF8xlQ2gCDGhw11J9DZ3L6ugESsDuH1k5p0Uwc=; b=owGbwMvMwMG4+8GG0kuuHbMYT6slMWQJpD1Ku5u7zqSOO09x126BR3/k6jPvtQpVcZWV93Z53 8pv8VDtZPRnYWDkYLAUU2Sp3n3CUXSmssc0D9+PMINYmUCmSIs0MAABCwNfbmJeqZGOkZ6ptqGe IZChY8TAxSkAU13Syv6/4MLRy/3pejvmnVy5gF2SZeaR2Oov/Tvu+9jnrTHSyJeyNHETbPoYe6n xkY7Pu7X8U46lLc7XDhFVLH5/XH3hJxUfccG2cr64+SULO5cIM8zj8eb4EHxFl2H7ggqmaZzsWX n3rLbZRy0+vLNV1DKUZQ/LTd7+OaqiZ1UKeVyvBy7NvOCdt+HXikOHw/ZUxkjlPHyhv4NPYEEQr 7Kf9/y98w4Hv1op7VN9Sz5lI+8GqTeCt6ZcL/V8+rpUxNNX++65r5sjlj9SWbLnsMi3rn/R2YnP +5mlCmOniqXE8iycmHB0laOCCUPxY2bxAoXFEe9vKXQkCF/tOi519My785omRfuPlG1LkAk+cOB /yEQA X-Developer-Key: i=vbabka@kernel.org; a=openpgp; fpr=A940D434992C2E8E99103D50224FA7E7CC82A664 When we end up returning extraneous objects during refill to a slab where we just did a get_freelist_nofreeze(), it is likely no other CPU has freed objects to it meanwhile. We can then reattach the remainder of the freelist without having to walk the (potentially cache cold) freelist for finding its tail to connect slab->freelist to it. Add a __slab_try_return_freelist() function that does that. As suggested by Hao Li, it doesn't need to also return the slab to the partial list, because there's code in __refill_objects_node() that already does that for any slabs where we don't detach the freelist in the first place. So we just put the slab back to the pc.slabs list. It's no longer likely that the list will be empty now, so remove the unlikely() annotation. However, also change that code to add to the tail of the partial list instead of head to match what __slab_free() did and avoid a regression, that was reported for the earlier version by the kernel test robot [1]. This change will also affect slabs which were grabbed from the partial list and not refilled from even partially, but those should be much more rare than a partial refill. [1] https://lore.kernel.org/all/202605112204.9382cecf-lkp@intel.com/ Reviewed-by: Hao Li Signed-off-by: Vlastimil Babka (SUSE) --- mm/slub.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 48 insertions(+), 11 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index a7bd929bcb26..5816fcfc7a90 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -4326,7 +4326,8 @@ static inline bool pfmemalloc_match(struct slab *slab, gfp_t gfpflags) * Assumes this is performed only for caches without debugging so we * don't need to worry about adding the slab to the full list. */ -static inline void *get_freelist_nofreeze(struct kmem_cache *s, struct slab *slab) +static inline void *get_freelist_nofreeze(struct kmem_cache *s, struct slab *slab, + unsigned int *count) { struct freelist_counters old, new; @@ -4342,6 +4343,7 @@ static inline void *get_freelist_nofreeze(struct kmem_cache *s, struct slab *sla } while (!slab_update_freelist(s, slab, &old, &new, "get_freelist_nofreeze")); + *count = old.objects - old.inuse; return old.freelist; } @@ -5509,6 +5511,34 @@ static noinline void free_to_partial_list( } } +/* + * Try returning (remainder of) the freelist that we just detached from the + * slab. Optimistically assume the slab is still full, so we don't need to find + * the tail of the detached freelist. + * + * Fail if the slab isn't full anymore due to a cocurrent free. + */ +static bool __slab_try_return_freelist(struct kmem_cache *s, struct slab *slab, + void *head, int cnt) +{ + struct freelist_counters old, new; + + old.freelist = slab->freelist; + old.counters = slab->counters; + + if (old.freelist) + return false; + + new.freelist = head; + new.counters = old.counters; + new.inuse -= cnt; + + if (!slab_update_freelist(s, slab, &old, &new, "__slab_try_return_freelist")) + return false; + + return true; +} + /* * Slow path handling. This may still be called frequently since objects * have a longer lifetime than the cpu slabs in most processing loads. @@ -7120,41 +7150,48 @@ __refill_objects_node(struct kmem_cache *s, void **p, gfp_t gfp, unsigned int mi list_for_each_entry_safe(slab, slab2, &pc.slabs, slab_list) { + unsigned int count; + list_del(&slab->slab_list); - object = get_freelist_nofreeze(s, slab); + object = get_freelist_nofreeze(s, slab, &count); - while (object && refilled < max) { + while (count && refilled < max) { p[refilled] = object; object = get_freepointer(s, object); maybe_wipe_obj_freeptr(s, p[refilled]); refilled++; + count--; } /* * Freelist had more objects than we can accommodate, we need to - * free them back. We can treat it like a detached freelist, just - * need to find the tail object. + * free them back. First we try to be optimistic and assume the + * slab is stil full since we just detached its freelist. + * Otherwise we must need to find the tail object. */ - if (unlikely(object)) { + if (unlikely(count)) { void *head = object; void *tail; - int cnt = 0; + + if (__slab_try_return_freelist(s, slab, head, count)) { + list_add(&slab->slab_list, &pc.slabs); + break; + } do { tail = object; - cnt++; object = get_freepointer(s, object); } while (object); - __slab_free(s, slab, head, tail, cnt, _RET_IP_); + __slab_free(s, slab, head, tail, count, _RET_IP_); } if (refilled >= max) break; } - if (unlikely(!list_empty(&pc.slabs))) { + if (!list_empty(&pc.slabs)) { spin_lock_irqsave(&n->list_lock, flags); list_for_each_entry_safe(slab, slab2, &pc.slabs, slab_list) { @@ -7163,7 +7200,7 @@ __refill_objects_node(struct kmem_cache *s, void **p, gfp_t gfp, unsigned int mi continue; list_del(&slab->slab_list); - add_partial(n, slab, ADD_TO_HEAD); + add_partial(n, slab, ADD_TO_TAIL); } spin_unlock_irqrestore(&n->list_lock, flags); -- 2.54.0