From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.8]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AEA351DA23 for ; Wed, 2 Sep 2026 00:04:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.8 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788307444; cv=none; b=Q1vHrY+zmULXpEz9wv/CresLXDES2HYaM2Q0DmZBFJamwj/ZMzmeynN+TE6MUjWEdNwuxO4ieEmFVWELPV7SRe6ohlH5G3+5jhOW+Zdr37eSBurJAWa84S88ol83S6MknZNAtUXlmDu4JfvDdSXQY+Pr8ySZkWx2wweOMcmOqXE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788307444; c=relaxed/simple; bh=hYvTU1//GIKznZB6qx0LqpWLR5jjVcFMotNPjEt1Klg=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=T7mnXkx82wYJkE3P4o773Rq5Zx+tPheM16KWreUVx8t3k1amaX4T0qGWT47XVSF+8PNBgx/Cvn1ZbmaD1luTdCPDinnWC+SwfW1ZWCdr6n8+nnGDNuedtgJL3tr565hvh0zTU8ErUI6UvEsF/P2zrLHGk9Rhnv2XPrrox6SkwUU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=UGzVQwo3; arc=none smtp.client-ip=192.198.163.8 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="UGzVQwo3" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1788307442; x=1819843442; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=hYvTU1//GIKznZB6qx0LqpWLR5jjVcFMotNPjEt1Klg=; b=UGzVQwo35QP1MlW888O6yDwwrt7awXl++XhSMAGoFzTO/cX6CBM/x7V3 l9K0K+YXAtSbBq+r7ueFrvBSNZ7c8+GnSYzvjtn8Ho4DLcE5rTdobtuBx 9n/QOPLHWudhxAIK/HDwtK5ypEj04dfNI8/izlzYuV8FJCkQFt54o5Ixq 7RzH9QQPxgXstYNR8jMz87Jdk+UfaTIH6kFeTlsXkxjfPngZvCn/5/lYj yU/QbmGgK/r5ujfzk1EJ5Pi10cyZ9Q4KeXzllP6oVnuL6GCfxthJvl6b4 /l+qQS/OVfFRVEmniiYsR0vZ3gTXz21t3hESsrgcqP6WnZXC8z4rmfRQi Q==; X-CSE-ConnectionGUID: z0Jy2U5aSWazVsn/5S6tOQ== X-CSE-MsgGUID: xvgeGZs4T+uAa8iqXk5xwQ== X-IronPort-AV: E=McAfee;i="6800,10657,11893"; a="106272963" X-IronPort-AV: E=Sophos;i="6.25,256,1779174000"; d="scan'208";a="106272963" Received: from fmviesa010.fm.intel.com ([10.60.135.150]) by fmvoesa102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 01 Sep 2026 17:03:57 -0700 X-CSE-ConnectionGUID: Abi1DXElS7aY064lABRYYg== X-CSE-MsgGUID: SMcmwTVlToS56ClLA5mEcQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.25,256,1779174000"; d="scan'208";a="265531794" Received: from b04f130c83f2.jf.intel.com ([10.165.154.98]) by fmviesa010.fm.intel.com with ESMTP; 01 Sep 2026 17:03:45 -0700 From: Tim Chen To: Peter Zijlstra , Ingo Molnar Cc: Tim Chen , Chen Yu , Hyunwoo Kim , Kees Cook , Christian Brauner , Alexander Viro , Jan Kara , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Valentin Schneider , K Prateek Nayak , Shrikanth Hegde , Qais Yousef , Aaron Lu , Srikar Dronamraju , Vineeth Remanan Pillai , linux-kernel@vger.kernel.org, linux-mm@kvack.org, "chen . yu @ linux . dev" Subject: [PATCH 2/2] sched/cache: Introduce task_struct->sched_cache_grp Date: Tue, 1 Sep 2026 17:08:56 -0700 Message-Id: X-Mailer: git-send-email 2.32.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Add a sched_cache_grp pointer to task_struct so that scheduler code can access the cache group directly via the task, without going through mm->sched_cache_grp. This decouples the scheduler's hot-path accesses from the mm_struct. Each task holds its own refcount on the sched_cache_group, separate from the reference held by its mm_struct. The reference is acquired in copy_mm() (fork) and exec_mmap() (exec), and released in exit_mm(). This fixes use after free problem when accessing sched_cache_grp in account_mm_sched() via mm as reported in https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/ Convert all scheduler code in fair.c and exit.c to use p->sched_cache_grp instead of p->mm->sched_cache_grp. Add sched_cache_group_get() to kernel/sched/cache_sched.c. Reported-by: Hyunwoo Kim Closes: https://lore.kernel.org/lkml/apPb-Dr4nPYuHQOK@v4bel/ Tested-by: Hyunwoo Kim Fixes: df0d98475954 ("sched/cache: Introduce infrastructure for cache-aware load balancing") Co-developed-by: Chen Yu Signed-off-by: Chen Yu Signed-off-by: Tim Chen --- fs/exec.c | 14 ++++ include/linux/sched.h | 3 + kernel/exit.c | 26 +++++-- kernel/fork.c | 23 ++++++ kernel/sched/cache_sched.c | 19 +++++ kernel/sched/fair.c | 142 +++++++++++++++++++++---------------- kernel/sched/sched.h | 3 + 7 files changed, 164 insertions(+), 66 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 745f6eb5279e..7a8a9954343e 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -882,6 +882,20 @@ static int exec_mmap(struct linux_binprm *bprm) active_mm = tsk->active_mm; tsk->active_mm = mm; tsk->mm = mm; +#ifdef CONFIG_SCHED_CACHE + { + struct sched_cache_group *old_grp, *new_grp; + + old_grp = rcu_dereference_protected(tsk->sched_cache_grp, true); + + /* Acquire the reference before publishing the pointer. */ + new_grp = sched_cache_group_get(mm->sched_cache_grp); + + rcu_assign_pointer(tsk->sched_cache_grp, new_grp); + if (old_grp) + sched_cache_group_put(old_grp); + } +#endif mm_init_cid(mm, tsk); exec_state = task_exec_state_replace(tsk, exec_state); /* diff --git a/include/linux/sched.h b/include/linux/sched.h index 1f254364f216..cab8e89b1462 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1434,6 +1434,7 @@ struct task_struct { #ifdef CONFIG_SCHED_CACHE struct callback_head cache_work; int preferred_llc; + struct sched_cache_group __rcu *sched_cache_grp; /* 1: task was enqueued to its preferred LLC, 0 otherwise */ int pref_llc_queued; #endif @@ -2418,6 +2419,8 @@ struct sched_cache_group { } ____cacheline_aligned_in_smp; void sched_cache_group_put(struct sched_cache_group *grp); +struct sched_cache_group *sched_cache_group_get(struct sched_cache_group *grp); +struct sched_cache_group *task_cache_group_get(struct task_struct *p); #else diff --git a/kernel/exit.c b/kernel/exit.c index 006edcc0c2c5..442535778ce1 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -552,23 +552,25 @@ void mm_update_next_owner(struct mm_struct *mm) * Subtract the memory footprint of the current task from * mm. */ -static void exit_mm_sched_cache(struct mm_struct *mm) +static void exit_mm_sched_cache(void) { + struct sched_cache_group *grp = + rcu_dereference_protected(current->sched_cache_grp, true); unsigned long fp, sub; - if (!current->total_numa_faults) + if (!grp || !current->total_numa_faults) return; /* * No lock protection due to performance considerations. * Make sure the group footprint does not become * negative. */ - fp = READ_ONCE(mm->sched_cache_grp->footprint); + fp = READ_ONCE(grp->footprint); sub = min(fp, current->total_numa_faults); - WRITE_ONCE(mm->sched_cache_grp->footprint, fp - sub); + WRITE_ONCE(grp->footprint, fp - sub); } #else -static inline void exit_mm_sched_cache(struct mm_struct *mm) +static inline void exit_mm_sched_cache(void) { } #endif /* CONFIG_SCHED_CACHE CONFIG_NUMA_BALANCING */ @@ -585,7 +587,19 @@ static void exit_mm(void) if (!mm) return; - exit_mm_sched_cache(mm); + exit_mm_sched_cache(); + +#ifdef CONFIG_SCHED_CACHE + { + struct sched_cache_group *grp = + rcu_dereference_protected(current->sched_cache_grp, true); + + rcu_assign_pointer(current->sched_cache_grp, NULL); + + if (grp) + sched_cache_group_put(grp); + } +#endif mmap_read_lock(mm); mmgrab_lazy_tlb(mm); diff --git a/kernel/fork.c b/kernel/fork.c index 416758c8a3d4..2e79548cb7c1 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1599,6 +1599,19 @@ static int copy_mm(u64 clone_flags, struct task_struct *tsk) tsk->mm = mm; tsk->active_mm = mm; +#ifdef CONFIG_SCHED_CACHE + { + /* + * A task holds its own reference on the group, separate from + * the reference held by its mm_struct. Acquire it before + * publishing the pointer. + */ + struct sched_cache_group *grp = + sched_cache_group_get(mm->sched_cache_grp); + + rcu_assign_pointer(tsk->sched_cache_grp, grp); + } +#endif return 0; } @@ -2599,6 +2612,16 @@ __latent_entropy struct task_struct *copy_process( bad_fork_cleanup_namespaces: exit_nsproxy_namespaces(p); bad_fork_cleanup_mm: +#ifdef CONFIG_SCHED_CACHE + /* + * copy_mm() took a task reference on the cache group; a failed fork + * never reaches exit_mm(), so release it here to avoid leaking the + * group and its per-CPU buffer. + */ + sched_cache_group_put(rcu_dereference_protected(p->sched_cache_grp, true)); + RCU_INIT_POINTER(p->sched_cache_grp, NULL); +#endif + if (p->mm) { mm_clear_owner(p->mm, p); mmput(p->mm); diff --git a/kernel/sched/cache_sched.c b/kernel/sched/cache_sched.c index d492df55f9d5..99d07e1e067c 100644 --- a/kernel/sched/cache_sched.c +++ b/kernel/sched/cache_sched.c @@ -1,6 +1,25 @@ // SPDX-License-Identifier: GPL-2.0-only #include "sched.h" +struct sched_cache_group *sched_cache_group_get(struct sched_cache_group *grp) +{ + /* + * refcount_inc_not_zero() is the acquire primitive for lockless + * (RCU) lookups; plain refcount_inc() would scribble the count if + * it already reached zero. Return NULL in that case. + */ + if (grp && !refcount_inc_not_zero(&grp->refcnt)) + grp = NULL; + + return grp; +} + +struct sched_cache_group *task_cache_group_get(struct task_struct *p) +{ + guard(rcu)(); + return sched_cache_group_get(rcu_dereference(p->sched_cache_grp)); +} + static void sched_cache_group_free_rcu(struct rcu_head *rcu) { struct sched_cache_group *grp = diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 8587dcbaa1cf..4226af32728a 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -1470,7 +1470,7 @@ static inline int get_sched_cache_scale(int mul) return (1 + (tol - 1) * mul); } -static bool exceed_llc_capacity(struct mm_struct *mm, int cpu) +static bool exceed_llc_capacity(struct sched_cache_group *grp, int cpu) { #ifdef CONFIG_NUMA_BALANCING unsigned long llc, footprint; @@ -1489,7 +1489,7 @@ static bool exceed_llc_capacity(struct mm_struct *mm, int cpu) * excluded. */ llc = sd->llc_bytes; - footprint = READ_ONCE(mm->sched_cache_grp->footprint); + footprint = READ_ONCE(grp->footprint); /* * Scale the LLC size by 256*llc_aggr_tolerance @@ -1518,7 +1518,7 @@ static bool exceed_llc_capacity(struct mm_struct *mm, int cpu) return false; } -static bool invalid_llc_nr(struct mm_struct *mm, struct task_struct *p, +static bool invalid_llc_nr(struct sched_cache_group *grp, struct task_struct *p, int cpu) { int scale; @@ -1534,7 +1534,7 @@ static bool invalid_llc_nr(struct mm_struct *mm, struct task_struct *p, if (scale == INT_MAX) return false; - return !fits_capacity((mm->sched_cache_grp->nr_running_avg * cpu_smt_num_threads), + return !fits_capacity((grp->nr_running_avg * cpu_smt_num_threads), (scale * per_cpu(sd_llc_size, cpu))); } @@ -1714,14 +1714,14 @@ static unsigned long fraction_mm_sched(struct rq *rq, return div64_u64(NICE_0_LOAD * pcpu_sched->runtime, rq->cpu_runtime + 1); } -static int get_pref_llc(struct task_struct *p, struct mm_struct *mm) +static int get_pref_llc(struct task_struct *p, struct sched_cache_group *grp) { int mm_sched_llc = -1, mm_sched_cpu; - if (!mm) + if (!grp) return -1; - mm_sched_cpu = READ_ONCE(mm->sched_cache_grp->cpu); + mm_sched_cpu = READ_ONCE(grp->cpu); if (mm_sched_cpu != -1) { mm_sched_llc = llc_id(mm_sched_cpu); @@ -1751,8 +1751,8 @@ static unsigned int task_running_on_cpu(int cpu, struct task_struct *p); static inline void account_mm_sched(struct rq *rq, struct task_struct *p, s64 delta_exec) { + struct sched_cache_group *grp = rcu_dereference_all(p->sched_cache_grp); struct sched_cache_time *pcpu_sched; - struct mm_struct *mm = p->mm; int mm_sched_llc = -1; unsigned long epoch; @@ -1763,16 +1763,12 @@ void account_mm_sched(struct rq *rq, struct task_struct *p, s64 delta_exec) return; /* * init_task, kthreads and user thread created - * by user_mode_thread() don't have mm. - * - * A kthread can temporarily adopt an mm via kthread_use_mm(), - * so p->mm alone does not imply a user task. + * by user_mode_thread() don't have a cache group. */ - if (!mm || p->flags & PF_KTHREAD || !mm->sched_cache_grp || - !mm->sched_cache_grp->pcpu_sched) + if (!grp || p->flags & PF_KTHREAD || !grp->pcpu_sched) return; - pcpu_sched = per_cpu_ptr(mm->sched_cache_grp->pcpu_sched, cpu_of(rq)); + pcpu_sched = per_cpu_ptr(grp->pcpu_sched, cpu_of(rq)); scoped_guard (raw_spinlock, &rq->cpu_epoch_lock) { __update_mm_sched(rq, pcpu_sched); @@ -1785,14 +1781,14 @@ void account_mm_sched(struct rq *rq, struct task_struct *p, s64 delta_exec) * If this process hasn't hit task_cache_work() for a while invalidate * its preferred state. */ - if ((long)(epoch - READ_ONCE(mm->sched_cache_grp->epoch)) > llc_epoch_affinity_timeout || - invalid_llc_nr(mm, p, cpu_of(rq)) || - exceed_llc_capacity(mm, cpu_of(rq))) { - if (READ_ONCE(mm->sched_cache_grp->cpu) != -1) - WRITE_ONCE(mm->sched_cache_grp->cpu, -1); + if ((long)(epoch - READ_ONCE(grp->epoch)) > llc_epoch_affinity_timeout || + invalid_llc_nr(grp, p, cpu_of(rq)) || + exceed_llc_capacity(grp, cpu_of(rq))) { + if (READ_ONCE(grp->cpu) != -1) + WRITE_ONCE(grp->cpu, -1); } - mm_sched_llc = get_pref_llc(p, mm); + mm_sched_llc = get_pref_llc(p, grp); /* task not on rq accounted later in account_entity_enqueue() */ if (task_running_on_cpu(rq->cpu, p) && @@ -1805,31 +1801,32 @@ void account_mm_sched(struct rq *rq, struct task_struct *p, s64 delta_exec) static void task_tick_cache(struct rq *rq, struct task_struct *p) { + struct sched_cache_group *grp = rcu_dereference_all(p->sched_cache_grp); struct callback_head *work = &p->cache_work; - struct mm_struct *mm = p->mm; unsigned long epoch; if (!sched_cache_enabled()) return; - if (!mm || p->flags & PF_KTHREAD || - !mm->sched_cache_grp->pcpu_sched) + if (!grp || p->flags & PF_KTHREAD || + !grp->pcpu_sched) return; epoch = rq->cpu_epoch; /* avoid moving backwards */ - if (time_after_eq(mm->sched_cache_grp->epoch, epoch)) + if (time_after_eq(grp->epoch, epoch)) return; - guard(raw_spinlock)(&mm->sched_cache_grp->lock); + guard(raw_spinlock)(&grp->lock); if (work->next == work) { task_work_add(p, work, TWA_RESUME); - WRITE_ONCE(mm->sched_cache_grp->epoch, epoch); + WRITE_ONCE(grp->epoch, epoch); } } -static void get_scan_cpumasks(cpumask_var_t cpus, struct task_struct *p) +static void get_scan_cpumasks(cpumask_var_t cpus, struct task_struct *p, + struct sched_cache_group *grp) { #ifdef CONFIG_NUMA_BALANCING int cpu, curr_cpu, nid, pref_nid; @@ -1837,7 +1834,7 @@ static void get_scan_cpumasks(cpumask_var_t cpus, struct task_struct *p) if (!static_branch_likely(&sched_numa_balancing)) goto out; - cpu = READ_ONCE(p->mm->sched_cache_grp->cpu); + cpu = READ_ONCE(grp->cpu); if (cpu != -1) nid = cpu_to_node(cpu); curr_cpu = task_cpu(p); @@ -1898,9 +1895,7 @@ static void task_cache_work(struct callback_head *work) unsigned long next_scan, now = jiffies; struct task_struct *p = current, *cur; unsigned long curr_m_a_occ = 0; - struct mm_struct *mm = p->mm; unsigned long m_a_occ = 0; - cpumask_var_t cpus; WARN_ON_ONCE(work != &p->cache_work); @@ -1909,32 +1904,44 @@ static void task_cache_work(struct callback_head *work) if (p->flags & PF_EXITING) return; - next_scan = READ_ONCE(mm->sched_cache_grp->next_scan); + /* + * A reference makes sure grp is not released by others. The rcu + * lock can not be held till after zalloc_cpumask_var() below, + * because the latter might sleep. + */ + struct sched_cache_group *grp __free(sched_cache_group_put) = + task_cache_group_get(p); + if (!grp) + return; + + next_scan = READ_ONCE(grp->next_scan); if (time_before(now, next_scan)) return; /* only 1 thread is allowed to scan */ - if (!try_cmpxchg(&mm->sched_cache_grp->next_scan, &next_scan, + if (!try_cmpxchg(&grp->next_scan, &next_scan, now + max_t(unsigned long, READ_ONCE(llc_epoch_period), 1))) return; curr_cpu = task_cpu(p); - if (invalid_llc_nr(mm, p, curr_cpu) || - exceed_llc_capacity(mm, curr_cpu)) { - if (READ_ONCE(mm->sched_cache_grp->cpu) != -1) - WRITE_ONCE(mm->sched_cache_grp->cpu, -1); + if (invalid_llc_nr(grp, p, curr_cpu) || + exceed_llc_capacity(grp, curr_cpu)) { + if (READ_ONCE(grp->cpu) != -1) + WRITE_ONCE(grp->cpu, -1); return; } + cpumask_var_t cpus __free(free_cpumask_var) = CPUMASK_VAR_NULL; + if (!zalloc_cpumask_var(&cpus, GFP_KERNEL)) return; scoped_guard (cpus_read_lock) { guard(rcu)(); - get_scan_cpumasks(cpus, p); + get_scan_cpumasks(cpus, p, grp); for_each_cpu(cpu, cpus) { /* XXX sched_cluster_active */ @@ -1946,8 +1953,6 @@ static void task_cache_work(struct callback_head *work) continue; for_each_cpu(i, sched_domain_span(sd)) { - struct sched_cache_group *grp = mm->sched_cache_grp; - occ = fraction_mm_sched(cpu_rq(i), per_cpu_ptr(grp->pcpu_sched, i)); a_occ += occ; @@ -1956,9 +1961,13 @@ static void task_cache_work(struct callback_head *work) m_cpu = i; } + /* + * rcu_access_pointer() is used because the + * pointer is only compared, never dereferenced. + */ cur = rcu_dereference_all(cpu_rq(i)->curr); if (cur && !(cur->flags & (PF_EXITING | PF_KTHREAD)) && - cur->mm == mm) + rcu_access_pointer(cur->sched_cache_grp) == grp) nr_running++; } @@ -1982,7 +1991,7 @@ static void task_cache_work(struct callback_head *work) m_a_cpu = m_cpu; } - if (llc_id(cpu) == llc_id(READ_ONCE(mm->sched_cache_grp->cpu))) + if (llc_id(cpu) == llc_id(READ_ONCE(grp->cpu))) curr_m_a_occ = a_occ; cpumask_andnot(cpus, cpus, sched_domain_span(sd)); @@ -2000,11 +2009,10 @@ static void task_cache_work(struct callback_head *work) * 3. 2X is chosen based on test results, as it delivers * the optimal performance gain so far. */ - WRITE_ONCE(mm->sched_cache_grp->cpu, m_a_cpu); + WRITE_ONCE(grp->cpu, m_a_cpu); } - update_avg_scale(&mm->sched_cache_grp->nr_running_avg, nr_running); - free_cpumask_var(cpus); + update_avg_scale(&grp->nr_running_avg, nr_running); } void init_sched_mm(struct task_struct *p) @@ -2013,6 +2021,13 @@ void init_sched_mm(struct task_struct *p) init_task_work(work, task_cache_work); work->next = work; + /* + * dup_task_struct() copies the parent's task_struct, including its + * sched_cache_grp, for which the child holds no reference. Clear it + * here - before copy_mm() runs - so the child never carries a + * borrowed pointer that the fork error path would put. + */ + RCU_INIT_POINTER(p->sched_cache_grp, NULL); /* * Reset new task's preference to avoid * polluting account_llc_enqueue(). @@ -3807,10 +3822,9 @@ static void task_numa_placement(struct task_struct *p) * heuristic and occasional lost updates are tolerable. * * If a task exits, its corresponding footprint must - * be subtracted from the mm->sched_cache_grp->footprint, - * otherwise the mm->sched_cache_grp->footprint will not - * converge: the exiting thread's footprint remains - * unchanged/undecayed in mm->sched_cache_grp->footprint. + * be subtracted from p->sched_cache_grp->footprint, + * otherwise the footprint will not converge: the + * exiting thread's footprint remains unchanged/undecayed. * See exit_mm(). * * Lost updates and unsynchronized subtraction @@ -3818,9 +3832,17 @@ static void task_numa_placement(struct task_struct *p) * go negative. Clamp to zero to prevent the * unsigned footprint from wrapping. */ - new_fp = (long)READ_ONCE(p->mm->sched_cache_grp->footprint) + diff; - WRITE_ONCE(p->mm->sched_cache_grp->footprint, - max(new_fp, 0L)); + { + struct sched_cache_group *grp; + + guard(rcu)(); + grp = rcu_dereference(p->sched_cache_grp); + + if (grp) { + new_fp = (long)READ_ONCE(grp->footprint) + diff; + WRITE_ONCE(grp->footprint, max(new_fp, 0L)); + } + } #endif } @@ -10730,23 +10752,23 @@ static enum llc_mig can_migrate_llc(int src_cpu, int dst_cpu, static enum llc_mig can_migrate_llc_task(int src_cpu, int dst_cpu, struct task_struct *p) { - struct mm_struct *mm; + struct sched_cache_group *grp; bool to_pref; int cpu; - mm = p->mm; - if (!mm || !mm->sched_cache_grp) + grp = rcu_dereference_all(p->sched_cache_grp); + if (!grp) return mig_unrestricted; - cpu = READ_ONCE(mm->sched_cache_grp->cpu); + cpu = READ_ONCE(grp->cpu); if (cpu < 0 || cpus_share_cache(src_cpu, dst_cpu)) return mig_unrestricted; /* skip cache aware load balance for too many threads */ - if (invalid_llc_nr(mm, p, dst_cpu) || - exceed_llc_capacity(mm, dst_cpu)) { - if (READ_ONCE(mm->sched_cache_grp->cpu) != -1) - WRITE_ONCE(mm->sched_cache_grp->cpu, -1); + if (invalid_llc_nr(grp, p, dst_cpu) || + exceed_llc_capacity(grp, dst_cpu)) { + if (READ_ONCE(grp->cpu) != -1) + WRITE_ONCE(grp->cpu, -1); return mig_unrestricted; } diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index e656c7059bf8..8b67af28a471 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -4145,6 +4145,9 @@ static inline bool sched_cache_enabled(void) return static_branch_unlikely(&sched_cache_active); } +DEFINE_FREE(sched_cache_group_put, struct sched_cache_group *, + sched_cache_group_put(_T)); + extern void sched_cache_active_set(void); #endif -- 2.32.0