From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8C13648034F for ; Thu, 13 Aug 2026 13:48:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=90.155.50.34 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786628918; cv=none; b=ZrwJt5jhF1uQcP06cafaDa8PfVWZkOUOJ1xDBgtHD6yYjtYGuy2qWGmubVxs41dFHFawyyfANc3MO5A49R69o4C8oPswOhAgXS78k2RT+qAk/ogESyGRSPEDfc9zif6lUpDPM4mhEQcveyau8rrsemkgYE1oDuWjKSorJwxZjjg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786628918; c=relaxed/simple; bh=nuOn/sDo7WxSDa9KRp8qWtwKCLGZKnovK9eyt54DJ/g=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=Ga4dZrquc7d3YhDjzW6YQE8HN400HnmZw13URYLgC5uWnoelwQNWhdknhd/zsmbDIhCQHdC3vdgmOLhznu8MZY0n1EZxIAHBCGnxXQ2xWz0FtDtkcDXqCC6ggQGH+ZM7Bhgf89YNMSmhVViSV+K8PawsBfFLg6SQiB/+N+1p8VI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org; spf=pass smtp.mailfrom=infradead.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b=oP9FDuCx; arc=none smtp.client-ip=90.155.50.34 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=infradead.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=infradead.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="oP9FDuCx" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=aX4lx2CxnJMgm0pCx87tPXVfgEgORol82tu7zrcQ68c=; b=oP9FDuCxu6vqYzziMZv+bRLx7u xiijoqMZuCHJ3/p/yC5Rtmk+Md4Ho3BwasiEESIIGqdv4E/VZRybNHx3dy6cRlz7MWzoQnBPDiY3h 87ZCCAv7e6Ywnqv3RZoGIPj+GRLPkf47c2yI/7ccS5E4IptB5Zi9ZOhLCt0t7vhRmkpNSa6UZLd49 OUHynfJbZ6PyX7BwLWmE2ajMk4XWMHsX6fDoKZmsV/WxhWXGE2eCBEfQRJ5MSlMpm1a1KiqBKAzC1 a8l+4XIkU6hw/gBuqOZYQTIopljR3+C+DM1Hc/wMbH2cDN6hcynItP0ZCVrA+aQJ5mdR949FDCY03 ZYdZUzEw==; Received: from 77-249-17-252.cable.dynamic.v4.ziggo.nl ([77.249.17.252] helo=noisy.programming.kicks-ass.net) by casper.infradead.org with esmtpsa (Exim 4.99.1 #2 (Red Hat Linux)) id 1wuVnE-00000003fkL-2k4l; Thu, 13 Aug 2026 13:48:24 +0000 Received: by noisy.programming.kicks-ass.net (Postfix, from userid 1000) id 9F8A8300382; Thu, 13 Aug 2026 15:48:23 +0200 (CEST) Date: Thu, 13 Aug 2026 15:48:23 +0200 From: Peter Zijlstra To: John Stultz Cc: LKML , Juri Lelli , Valentin Schneider , Connor O'Brien , Joel Fernandes , Qais Yousef , Ingo Molnar , Vincent Guittot , Dietmar Eggemann , Valentin Schneider , Steven Rostedt , Ben Segall , Zimuzo Ezeozue , Mel Gorman , Will Deacon , Waiman Long , Boqun Feng , "Paul E. McKenney" , Metin Kaya , Xuewen Yan , K Prateek Nayak , Thomas Gleixner , Daniel Lezcano , Suleiman Souhlal , Andrea Righi , kuyo chang , hupu , kernel-team@android.com Subject: Re: [RESEND][PATCH v31 8/9] sched: Add deactivated (sleeping) owner handling to find_proxy_task() Message-ID: <20260813134823.GP776954@noisy.programming.kicks-ass.net> References: <20260807035232.1881495-1-jstultz@google.com> <20260807035232.1881495-9-jstultz@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260807035232.1881495-9-jstultz@google.com> I'm slowly working my way through this one.. On Fri, Aug 07, 2026 at 03:52:14AM +0000, John Stultz wrote: > +static inline void proxy_remove_from_sleeping_owner(struct task_struct *p) > +{ > + struct task_struct *owner = READ_ONCE(p->sleeping_owner); > + > + if (owner) { > + /* > + * __proxy_remove_from_sleeping_owner() does a > + * put on owner to match the get done in > + * proxy_enqueue_on_owner(). If that put is the > + * last one and it frees owner, we'd be freeing > + * a lock we held. So get/put owner around its > + * usage her to ensure that doesn't happen. > + */ > + get_task_struct(owner); > + raw_spin_lock(&owner->blocked_lock); > + __proxy_remove_from_sleeping_owner(owner, p); > + raw_spin_unlock(&owner->blocked_lock); > + put_task_struct(owner); > + } > +} I am not convinced this is correct. Notably __proxy_remove_from_sleeping_owner() does nothing if p->sleeping_owner != owner. Additionally, owner is read without serialization. Either owner can change, and you need to: - verify p->sleeping_owner == owner once you've acquired owner->blocked_lock, and retry if it doesn't match or - explain that once ->sleeping_owner is !NULL, it cannot change and instead of NOP-ing out when ->sleeping_owner != owner, assert that it is. > @@ -6852,6 +7078,29 @@ static void proxy_migrate_task(struct rq *rq, struct rq_flags *rf, > proxy_reacquire_rq_lock(rq, rf); > } > > +static void proxy_enqueue_on_owner(struct rq *rq, struct task_struct *owner, > + struct task_struct *p) > +{ > + lockdep_assert_rq_held(rq); > + lockdep_assert_held(&owner->blocked_lock); > + /* > + * ttwu_activate() will pick them up and place them on whatever rq > + * @owner will run next. > + */ > + WARN_ON(p == owner); > + WARN_ON(!p->on_rq); > + WARN_ON(p->sleeping_owner); > + get_task_struct(owner); > + WRITE_ONCE(p->sleeping_owner, owner); > + /* > + * ttwu_do_activate must not have a chance to activate p > + * elsewhere before it's fully extricated from its old rq. > + */ > + list_add(&p->blocked_node, &owner->blocked_head); > + proxy_resched_idle(rq); > + block_task(rq, p, READ_ONCE(p->__state)); > +} Initially I thought you needed: smp_store_release(&p->sleeping_owner = owner); after the list_add, and a corresponding smp_load_acquire() in the function above. However since they both acquire ->blocked_lock (eventually) this works out. But it might want to have a comment along those lines. Random changed that happened whilst I was going over things. --- --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1261,11 +1261,11 @@ struct task_struct { struct mutex *blocked_on; /* lock we're blocked on */ raw_spinlock_t blocked_lock; #ifdef CONFIG_SCHED_PROXY_EXEC - struct list_head blocked_head; /* tasks blocked on this task */ + struct list_head blocked_head __guarded_by(&blocked_lock); /* tasks blocked on this task */ struct list_head blocked_node; /* our entry on someone elses blocked_head */ /* Node for list of tasks to process blocked_head list for blocked entitiy activations */ struct list_head blocked_activation_node; - struct task_struct *sleeping_owner; /* task our blocked_node is enqueued on */ + struct task_struct *sleeping_owner __guarded_by(&blocked_lock); /* task our blocked_node is enqueued on */ #endif /* --- a/include/linux/sched/task.h +++ b/include/linux/sched/task.h @@ -160,6 +160,7 @@ static inline void put_task_struct(struc } DEFINE_FREE(put_task, struct task_struct *, if (_T) put_task_struct(_T)) +DEFINE_GUARD(get_task, struct task_struct *, get_task_struct(_T), put_task_struct(_T)) static inline void put_task_struct_many(struct task_struct *t, int nr) { --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -2242,33 +2242,33 @@ void __proxy_remove_from_sleeping_owner( static inline void proxy_remove_from_sleeping_owner(struct task_struct *p) { - struct task_struct *owner = READ_ONCE(p->sleeping_owner); + struct task_struct *owner = data_race(READ_ONCE(p->sleeping_owner)); - if (owner) { - /* - * __proxy_remove_from_sleeping_owner() does a - * put on owner to match the get done in - * proxy_enqueue_on_owner(). If that put is the - * last one and it frees owner, we'd be freeing - * a lock we held. So get/put owner around its - * usage her to ensure that doesn't happen. - */ - get_task_struct(owner); - raw_spin_lock(&owner->blocked_lock); - __proxy_remove_from_sleeping_owner(owner, p); - raw_spin_unlock(&owner->blocked_lock); - put_task_struct(owner); - } + if (!owner) + return; + + /* + * __proxy_remove_from_sleeping_owner() does a + * put on owner to match the get done in + * proxy_enqueue_on_owner(). If that put is the + * last one and it frees owner, we'd be freeing + * a lock we held. So get/put owner around its + * usage her to ensure that doesn't happen. + */ + guard(get_task)(owner); + guard(raw_spinlock)(&owner->blocked_lock); + __proxy_remove_from_sleeping_owner(owner, p); } void activate_task(struct rq *rq, struct task_struct *p, int en_flags) { + lockdep_assert_rq_held(rq); + if (!sched_proxy_exec()) { __activate_task(rq, p, en_flags); return; } - lockdep_assert_rq_held(rq); proxy_remove_from_sleeping_owner(p); /* * By calling __activate_task() with blocked_lock held, we @@ -2276,10 +2276,9 @@ void activate_task(struct rq *rq, struct * such that no more blocked tasks will be enqueued on p * once we release p->blocked_lock. */ - raw_spin_lock(&p->blocked_lock); + guard(raw_spinlock)(&p->blocked_lock); WARN_ON(task_cpu(p) != cpu_of(rq)); __activate_task(rq, p, en_flags); - raw_spin_unlock(&p->blocked_lock); } #else static inline void proxy_remove_from_sleeping_owner(struct task_struct *p)