[PATCH v14 0/3] sched: Restructure task_mm_cid_work for predictability

[PATCH v14 0/3] sched: Restructure task_mm_cid_work for predictability

[Gabriele Monaco]

This patchset moves the task_mm_cid_work to a preemptible and migratable
context. This reduces the impact of this work to the scheduling latency
of real time tasks.
The change makes the recurrence of the task a bit more predictable.

The behaviour causing latency was introduced in commit 223baf9d17f2
("sched: Fix performance regression introduced by mm_cid") which
introduced a task work tied to the scheduler tick.
That approach presents two possible issues:
* the task work runs before returning to user and causes, in fact, a
  scheduling latency (with order of magnitude significant in PREEMPT_RT)
* periodic tasks with short runtime are less likely to run during the
  tick, hence they might not run the task work at all

Patch 1 add support for prev_sum_exec_runtime to the RT, deadline and
sched_ext classes as it is supported by fair, this is required to avoid
calling rseq_preempt on tick if the runtime is below a threshold.

Patch 2 contains the main changes, removing the task_work on the
scheduler tick and using a timer scheduled more reliably during
__rseq_handle_notify_resume.

Patch 3 adds a selftest to validate the functionality of the
task_mm_cid_work (i.e. to compact the mm_cids).

Changes since V13:
* Use a timer instead of a work_struct to reduce switch overhead
* Enqueue the timer only if not pending
* Ensure the rseq_preempt on tick is done after the scan and only once
  (don't run on pending timer and always update last_cid_reset on get)

Changes since V12:
* Ensure the tick schedules the mm_cid compaction only once for tasks
  executing longer than 100ms (until the scan expires again)
* Execute an rseq_preempt from the tick only after compaction was done
  and the cid assignation changed

Changes since V11:
* Remove variable to make mm_cid_needs_scan more compact
* All patches reviewed

Changes since V10:
* Fix compilation errors with RSEQ and/or MM_CID disabled

Changes since V9:
* Simplify and move checks from task_queue_mm_cid to its call site

Changes since V8 [2]:
* Add support for prev_sum_exec_runtime to RT, deadline and sched_ext
* Avoid rseq_preempt on ticks unless executing for more than 100ms
* Queue the work on the unbound workqueue

Changes since V7:
* Schedule mm_cid compaction and update at every tick too
* mmgrab before scheduling the work

Changes since V6 [3]:
* Switch to a simple work_struct instead of a delayed work
* Schedule the work_struct in __rseq_handle_notify_resume
* Asynchronously disable the work but make sure mm is there while we run
* Remove first patch as merged independently
* Fix commit tag for test

Changes since V5:
* Punctuation

Changes since V4 [4]:
* Fixes on the selftest
    * Polished memory allocation and cleanup
    * Handle the test failure in main

Changes since V3 [5]:
* Fixes on the selftest
    * Minor style issues in comments and indentation
    * Use of perror where possible
    * Add a barrier to align threads execution
    * Improve test failure and error handling

Changes since V2 [6]:
* Change the order of the patches
* Merge patches changing the main delayed_work logic
* Improved self-test to spawn 1 less thread and use the main one instead

Changes since V1 [7]:
* Re-arm the delayed_work at each invocation
* Cancel the work synchronously at mmdrop
* Remove next scan fields and completely rely on the delayed_work
* Shrink mm_cid allocation with nr thread/affinity (Mathieu Desnoyers)
* Add self test

[1] - https://lore.kernel.org/lkml/20250414123630.177385-5-gmonaco@redhat.com
[2] - https://lore.kernel.org/lkml/20250220102639.141314-1-gmonaco@redhat.com
[3] - https://lore.kernel.org/lkml/20250210153253.460471-1-gmonaco@redhat.com
[4] - https://lore.kernel.org/lkml/20250113074231.61638-4-gmonaco@redhat.com
[5] - https://lore.kernel.org/lkml/20241216130909.240042-1-gmonaco@redhat.com
[6] - https://lore.kernel.org/lkml/20241213095407.271357-1-gmonaco@redhat.com
[7] - https://lore.kernel.org/lkml/20241205083110.180134-2-gmonaco@redhat.com

To: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
To: Peter Zijlstra <peterz@infradead.org>
To: Ingo Molnar <mingo@redhat.org>

Gabriele Monaco (3):
  sched: Add prev_sum_exec_runtime support for RT, DL and SCX classes
  sched: Move task_mm_cid_work to mm timer
  selftests/rseq: Add test for mm_cid compaction

 include/linux/mm_types.h                      |  23 +-
 include/linux/sched.h                         |   8 +-
 kernel/rseq.c                                 |   2 +
 kernel/sched/core.c                           | 103 ++++-----
 kernel/sched/deadline.c                       |   1 +
 kernel/sched/ext.c                            |   1 +
 kernel/sched/rt.c                             |   1 +
 kernel/sched/sched.h                          |   8 +-
 tools/testing/selftests/rseq/.gitignore       |   1 +
 tools/testing/selftests/rseq/Makefile         |   2 +-
 .../selftests/rseq/mm_cid_compaction_test.c   | 200 ++++++++++++++++++
 11 files changed, 293 insertions(+), 57 deletions(-)
 create mode 100644 tools/testing/selftests/rseq/mm_cid_compaction_test.c


base-commit: d7b8f8e20813f0179d8ef519541a3527e7661d3a
-- 
2.50.0

[PATCH v14 1/3] sched: Add prev_sum_exec_runtime support for RT, DL and SCX classes

[Gabriele Monaco]

The fair scheduling class relies on prev_sum_exec_runtime to compute the
duration of the task's runtime since it was last scheduled. This value
is currently not required by other scheduling classes but can be useful
to understand long running tasks and take certain actions (e.g. during a
scheduler tick).

Add support for prev_sum_exec_runtime to the RT, deadline and sched_ext
classes by simply assigning the sum_exec_runtime at each set_next_task.

Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
---
 kernel/sched/deadline.c | 1 +
 kernel/sched/ext.c      | 1 +
 kernel/sched/rt.c       | 1 +
 3 files changed, 3 insertions(+)

diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
index 89019a1408264..65ecd86bae37d 100644
--- a/kernel/sched/deadline.c
+++ b/kernel/sched/deadline.c
@@ -2389,6 +2389,7 @@ static void set_next_task_dl(struct rq *rq, struct task_struct *p, bool first)
 	p->se.exec_start = rq_clock_task(rq);
 	if (on_dl_rq(&p->dl))
 		update_stats_wait_end_dl(dl_rq, dl_se);
+	p->se.prev_sum_exec_runtime = p->se.sum_exec_runtime;
 
 	/* You can't push away the running task */
 	dequeue_pushable_dl_task(rq, p);
diff --git a/kernel/sched/ext.c b/kernel/sched/ext.c
index b498d867ba210..a4ac4386b9795 100644
--- a/kernel/sched/ext.c
+++ b/kernel/sched/ext.c
@@ -3255,6 +3255,7 @@ static void set_next_task_scx(struct rq *rq, struct task_struct *p, bool first)
 	}
 
 	p->se.exec_start = rq_clock_task(rq);
+	p->se.prev_sum_exec_runtime = p->se.sum_exec_runtime;
 
 	/* see dequeue_task_scx() on why we skip when !QUEUED */
 	if (SCX_HAS_OP(sch, running) && (p->scx.flags & SCX_TASK_QUEUED))
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index e40422c370335..2c70ff2042ee9 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -1693,6 +1693,7 @@ static inline void set_next_task_rt(struct rq *rq, struct task_struct *p, bool f
 	p->se.exec_start = rq_clock_task(rq);
 	if (on_rt_rq(&p->rt))
 		update_stats_wait_end_rt(rt_rq, rt_se);
+	p->se.prev_sum_exec_runtime = p->se.sum_exec_runtime;
 
 	/* The running task is never eligible for pushing */
 	dequeue_pushable_task(rq, p);
-- 
2.50.0

[PATCH v14 2/3] sched: Move task_mm_cid_work to mm timer

[Gabriele Monaco]

Currently, the task_mm_cid_work function is called in a task work
triggered by a scheduler tick to frequently compact the mm_cids of each
process. This can delay the execution of the corresponding thread for
the entire duration of the function, negatively affecting the response
in case of real time tasks. In practice, we observe task_mm_cid_work
increasing the latency of 30-35us on a 128 cores system, this order of
magnitude is meaningful under PREEMPT_RT.

Run the task_mm_cid_work in a new timer connected to the mm_struct
rather than in the task context before returning to userspace.

This timer is initialised with the mm and disabled before freeing it.
The timer is armed while returning to userspace in
__rseq_handle_notify_resume, with an expiration of MM_CID_SCAN_DELAY.
To make sure this happens predictably also on long running tasks,
trigger a call to __rseq_handle_notify_resume also from the scheduler
tick if the runtime exceeded a 100ms threshold.

The main advantage of this change is that the function can be offloaded
to a different CPU and even preempted by RT tasks.

Moreover, this new behaviour is more predictable with periodic tasks
with short runtime, which may rarely run during a scheduler tick.
Now, the timer is always scheduled when the task returns to userspace.

The timer is disabled during mmdrop, since the function cannot sleep in
all kernel configurations, we cannot wait for a possibly running timer
to terminate. Make sure the mm is valid in case the task is terminating
by reserving it with mmgrab/mmdrop, returning prematurely if the timer
handler is really the last user while it gets to run.
This situation is unlikely since the timer is not armed for exiting
tasks, but it cannot be ruled out.

Fixes: 223baf9d17f2 ("sched: Fix performance regression introduced by mm_cid")
Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
---
 include/linux/mm_types.h |  23 +++++++--
 include/linux/sched.h    |   8 ++-
 kernel/rseq.c            |   2 +
 kernel/sched/core.c      | 103 +++++++++++++++++++++------------------
 kernel/sched/sched.h     |   8 +--
 5 files changed, 88 insertions(+), 56 deletions(-)

diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index d6b91e8a66d6d..9c159cf70a16c 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -990,11 +990,11 @@ struct mm_struct {
 		 */
 		struct mm_cid __percpu *pcpu_cid;
 		/*
-		 * @mm_cid_next_scan: Next mm_cid scan (in jiffies).
+		 * @mm_cid_next_scan: Last mm_cid scan (in jiffies).
 		 *
-		 * When the next mm_cid scan is due (in jiffies).
+		 * When the last mm_cid scan occurred (in jiffies).
 		 */
-		unsigned long mm_cid_next_scan;
+		unsigned long mm_cid_last_scan;
 		/**
 		 * @nr_cpus_allowed: Number of CPUs allowed for mm.
 		 *
@@ -1017,6 +1017,10 @@ struct mm_struct {
 		 * mm nr_cpus_allowed updates.
 		 */
 		raw_spinlock_t cpus_allowed_lock;
+		/*
+		 * @cid_timer: Timer to run the mm_cid scan.
+		 */
+		struct timer_list cid_timer;
 #endif
 #ifdef CONFIG_MMU
 		atomic_long_t pgtables_bytes;	/* size of all page tables */
@@ -1321,6 +1325,8 @@ enum mm_cid_state {
 	MM_CID_LAZY_PUT = (1U << 31),
 };
 
+extern void task_mm_cid_scan(struct timer_list *timer);
+
 static inline bool mm_cid_is_unset(int cid)
 {
 	return cid == MM_CID_UNSET;
@@ -1393,12 +1399,14 @@ static inline int mm_alloc_cid_noprof(struct mm_struct *mm, struct task_struct *
 	if (!mm->pcpu_cid)
 		return -ENOMEM;
 	mm_init_cid(mm, p);
+	timer_setup(&mm->cid_timer, task_mm_cid_scan, TIMER_DEFERRABLE);
 	return 0;
 }
 #define mm_alloc_cid(...)	alloc_hooks(mm_alloc_cid_noprof(__VA_ARGS__))
 
 static inline void mm_destroy_cid(struct mm_struct *mm)
 {
+	timer_shutdown(&mm->cid_timer);
 	free_percpu(mm->pcpu_cid);
 	mm->pcpu_cid = NULL;
 }
@@ -1420,6 +1428,11 @@ static inline void mm_set_cpus_allowed(struct mm_struct *mm, const struct cpumas
 	WRITE_ONCE(mm->nr_cpus_allowed, cpumask_weight(mm_allowed));
 	raw_spin_unlock(&mm->cpus_allowed_lock);
 }
+
+static inline bool mm_cid_scan_pending(struct mm_struct *mm)
+{
+	return mm && timer_pending(&mm->cid_timer);
+}
 #else /* CONFIG_SCHED_MM_CID */
 static inline void mm_init_cid(struct mm_struct *mm, struct task_struct *p) { }
 static inline int mm_alloc_cid(struct mm_struct *mm, struct task_struct *p) { return 0; }
@@ -1430,6 +1443,10 @@ static inline unsigned int mm_cid_size(void)
 	return 0;
 }
 static inline void mm_set_cpus_allowed(struct mm_struct *mm, const struct cpumask *cpumask) { }
+static inline bool mm_cid_scan_pending(struct mm_struct *mm)
+{
+	return false;
+}
 #endif /* CONFIG_SCHED_MM_CID */
 
 struct mmu_gather;
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 4f78a64beb52c..e90bc52dece3e 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1432,7 +1432,7 @@ struct task_struct {
 	int				last_mm_cid;	/* Most recent cid in mm */
 	int				migrate_from_cpu;
 	int				mm_cid_active;	/* Whether cid bitmap is active */
-	struct callback_head		cid_work;
+	unsigned long			last_cid_reset;	/* Time of last reset in jiffies */
 #endif
 
 	struct tlbflush_unmap_batch	tlb_ubc;
@@ -2277,4 +2277,10 @@ static __always_inline void alloc_tag_restore(struct alloc_tag *tag, struct allo
 #define alloc_tag_restore(_tag, _old)		do {} while (0)
 #endif
 
+#ifdef CONFIG_SCHED_MM_CID
+extern void task_queue_mm_cid(struct task_struct *curr);
+#else
+static inline void task_queue_mm_cid(struct task_struct *curr) { }
+#endif
+
 #endif
diff --git a/kernel/rseq.c b/kernel/rseq.c
index b7a1ec327e811..9ce0f79e35bfb 100644
--- a/kernel/rseq.c
+++ b/kernel/rseq.c
@@ -441,6 +441,8 @@ void __rseq_handle_notify_resume(struct ksignal *ksig, struct pt_regs *regs)
 	}
 	if (unlikely(rseq_update_cpu_node_id(t)))
 		goto error;
+	if (!mm_cid_scan_pending(t->mm))
+		task_queue_mm_cid(t);
 	return;
 
 error:
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index ec68fc686bd74..ed316f0a31d9d 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4542,7 +4542,6 @@ static void __sched_fork(unsigned long clone_flags, struct task_struct *p)
 	p->wake_entry.u_flags = CSD_TYPE_TTWU;
 	p->migration_pending = NULL;
 #endif
-	init_sched_mm_cid(p);
 }
 
 DEFINE_STATIC_KEY_FALSE(sched_numa_balancing);
@@ -10594,37 +10593,15 @@ static void sched_mm_cid_remote_clear_weight(struct mm_struct *mm, int cpu,
 	sched_mm_cid_remote_clear(mm, pcpu_cid, cpu);
 }
 
-static void task_mm_cid_work(struct callback_head *work)
+void task_mm_cid_scan(struct timer_list *timer)
 {
-	unsigned long now = jiffies, old_scan, next_scan;
-	struct task_struct *t = current;
 	struct cpumask *cidmask;
-	struct mm_struct *mm;
+	struct mm_struct *mm = container_of(timer, struct mm_struct, cid_timer);
 	int weight, cpu;
 
-	WARN_ON_ONCE(t != container_of(work, struct task_struct, cid_work));
-
-	work->next = work;	/* Prevent double-add */
-	if (t->flags & PF_EXITING)
-		return;
-	mm = t->mm;
-	if (!mm)
-		return;
-	old_scan = READ_ONCE(mm->mm_cid_next_scan);
-	next_scan = now + msecs_to_jiffies(MM_CID_SCAN_DELAY);
-	if (!old_scan) {
-		unsigned long res;
-
-		res = cmpxchg(&mm->mm_cid_next_scan, old_scan, next_scan);
-		if (res != old_scan)
-			old_scan = res;
-		else
-			old_scan = next_scan;
-	}
-	if (time_before(now, old_scan))
-		return;
-	if (!try_cmpxchg(&mm->mm_cid_next_scan, &old_scan, next_scan))
-		return;
+	/* We are the last user, process already terminated. */
+	if (atomic_read(&mm->mm_count) == 1)
+		goto out_drop;
 	cidmask = mm_cidmask(mm);
 	/* Clear cids that were not recently used. */
 	for_each_possible_cpu(cpu)
@@ -10636,35 +10613,65 @@ static void task_mm_cid_work(struct callback_head *work)
 	 */
 	for_each_possible_cpu(cpu)
 		sched_mm_cid_remote_clear_weight(mm, cpu, weight);
+	WRITE_ONCE(mm->mm_cid_last_scan, jiffies);
+out_drop:
+	mmdrop(mm);
 }
 
-void init_sched_mm_cid(struct task_struct *t)
+void task_tick_mm_cid(struct rq *rq, struct task_struct *t)
 {
-	struct mm_struct *mm = t->mm;
-	int mm_users = 0;
+	u64 rtime = t->se.sum_exec_runtime - t->se.prev_sum_exec_runtime;
 
-	if (mm) {
-		mm_users = atomic_read(&mm->mm_users);
-		if (mm_users == 1)
-			mm->mm_cid_next_scan = jiffies + msecs_to_jiffies(MM_CID_SCAN_DELAY);
+	/*
+	 * If a task is running unpreempted for a long time, it won't get its
+	 * mm_cid compacted and won't update its mm_cid value after a
+	 * compaction occurs.
+	 * For such a task, this function does two things:
+	 * A) trigger the mm_cid recompaction,
+	 * B) trigger an update of the task's rseq->mm_cid field at some point
+	 * after recompaction, so it can get a mm_cid value closer to 0.
+	 * A change in the mm_cid triggers an rseq_preempt.
+	 *
+	 * B occurs once after the compaction work completes, both A and B
+	 * don't run as long as the compaction work is pending.
+	 */
+	if (!t->mm || (t->flags & (PF_EXITING | PF_KTHREAD)) ||
+	    mm_cid_scan_pending(t->mm))
+		return;
+	if (rtime < RSEQ_UNPREEMPTED_THRESHOLD)
+		return;
+	if (time_after(t->mm->mm_cid_last_scan, t->last_cid_reset)) {
+		/* Update mm_cid field */
+		int old_cid = t->mm_cid;
+
+		if (!t->mm_cid_active)
+			return;
+		mm_cid_snapshot_time(rq, t->mm);
+		mm_cid_put_lazy(t);
+		t->last_mm_cid = t->mm_cid = mm_cid_get(rq, t, t->mm);
+		if (old_cid != t->mm_cid)
+			rseq_preempt(t);
+	} else {
+		/* Trigger mm_cid recompaction */
+		rseq_set_notify_resume(t);
 	}
-	t->cid_work.next = &t->cid_work;	/* Protect against double add */
-	init_task_work(&t->cid_work, task_mm_cid_work);
 }
 
-void task_tick_mm_cid(struct rq *rq, struct task_struct *curr)
+void task_queue_mm_cid(struct task_struct *curr)
 {
-	struct callback_head *work = &curr->cid_work;
-	unsigned long now = jiffies;
+	int requeued;
 
-	if (!curr->mm || (curr->flags & (PF_EXITING | PF_KTHREAD)) ||
-	    work->next != work)
-		return;
-	if (time_before(now, READ_ONCE(curr->mm->mm_cid_next_scan)))
-		return;
-
-	/* No page allocation under rq lock */
-	task_work_add(curr, work, TWA_RESUME);
+	/*
+	 * @curr must be a user thread and the timer must not be pending.
+	 * Access to this timer is not serialised across threads sharing the
+	 * same mm: ensure racing threads don't postpone enqueued timers and
+	 * don't mmgrab() if they didn't enqueue the timer themselves.
+	 * mmgrab() is necessary to ensure the mm exists until the timer runs.
+	 */
+	requeued = timer_reduce(&curr->mm->cid_timer,
+				jiffies + msecs_to_jiffies(MM_CID_SCAN_DELAY));
+	if (!requeued && timer_pending(&curr->mm->cid_timer))
+		mmgrab(curr->mm);
 }
 
 void sched_mm_cid_exit_signals(struct task_struct *t)
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 475bb5998295e..3e72323fbde06 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -3606,14 +3606,14 @@ extern const char *preempt_modes[];
 
 #define SCHED_MM_CID_PERIOD_NS	(100ULL * 1000000)	/* 100ms */
 #define MM_CID_SCAN_DELAY	100			/* 100ms */
+#define RSEQ_UNPREEMPTED_THRESHOLD	SCHED_MM_CID_PERIOD_NS
 
 extern raw_spinlock_t cid_lock;
 extern int use_cid_lock;
 
 extern void sched_mm_cid_migrate_from(struct task_struct *t);
 extern void sched_mm_cid_migrate_to(struct rq *dst_rq, struct task_struct *t);
-extern void task_tick_mm_cid(struct rq *rq, struct task_struct *curr);
-extern void init_sched_mm_cid(struct task_struct *t);
+extern void task_tick_mm_cid(struct rq *rq, struct task_struct *t);
 
 static inline void __mm_cid_put(struct mm_struct *mm, int cid)
 {
@@ -3809,6 +3809,7 @@ static inline int mm_cid_get(struct rq *rq, struct task_struct *t,
 	int cid;
 
 	lockdep_assert_rq_held(rq);
+	t->last_cid_reset = jiffies;
 	cpumask = mm_cidmask(mm);
 	cid = __this_cpu_read(pcpu_cid->cid);
 	if (mm_cid_is_valid(cid)) {
@@ -3881,8 +3882,7 @@ static inline void switch_mm_cid(struct rq *rq,
 static inline void switch_mm_cid(struct rq *rq, struct task_struct *prev, struct task_struct *next) { }
 static inline void sched_mm_cid_migrate_from(struct task_struct *t) { }
 static inline void sched_mm_cid_migrate_to(struct rq *dst_rq, struct task_struct *t) { }
-static inline void task_tick_mm_cid(struct rq *rq, struct task_struct *curr) { }
-static inline void init_sched_mm_cid(struct task_struct *t) { }
+static inline void task_tick_mm_cid(struct rq *rq, struct task_struct *t) { }
 #endif /* !CONFIG_SCHED_MM_CID */
 
 extern u64 avg_vruntime(struct cfs_rq *cfs_rq);
-- 
2.50.0

Re: [PATCH v14 2/3] sched: Move task_mm_cid_work to mm timer

[Mathieu Desnoyers]

On 2025-07-07 10:48, Gabriele Monaco wrote:
[...]
>   
> -void task_tick_mm_cid(struct rq *rq, struct task_struct *curr)
> +void task_queue_mm_cid(struct task_struct *curr)
>   {
> -	struct callback_head *work = &curr->cid_work;
> -	unsigned long now = jiffies;
> +	int requeued;
>   
> -	if (!curr->mm || (curr->flags & (PF_EXITING | PF_KTHREAD)) ||
> -	    work->next != work)
> -		return;
> -	if (time_before(now, READ_ONCE(curr->mm->mm_cid_next_scan)))
> -		return;
> -
> -	/* No page allocation under rq lock */
> -	task_work_add(curr, work, TWA_RESUME);
> +	/*
> +	 * @curr must be a user thread and the timer must not be pending.
> +	 * Access to this timer is not serialised across threads sharing the
> +	 * same mm: ensure racing threads don't postpone enqueued timers and
> +	 * don't mmgrab() if they didn't enqueue the timer themselves.
> +	 * mmgrab() is necessary to ensure the mm exists until the timer runs.
> +	 */
> +	requeued = timer_reduce(&curr->mm->cid_timer,
> +				jiffies + msecs_to_jiffies(MM_CID_SCAN_DELAY));
> +	if (!requeued && timer_pending(&curr->mm->cid_timer))
> +		mmgrab(curr->mm);
>   }
>   
In v13 we had:

-	task_work_add(curr, work, TWA_RESUME);
+/* Call only when curr is a user thread. */
+void task_queue_mm_cid(struct task_struct *curr)
+{
+	/* Ensure the mm exists when we run. */
+	mmgrab(curr->mm);
+	queue_work(system_unbound_wq, &curr->mm->cid_work);
  }

The new pattern is to do mmgrab *after* timer_reduce has enqueued
the timer. This seems to be racy with timer execution. What prevents
the timer to run before mmgrab() is done ?

Thanks,

Mathieu

-- 
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com

Re: [PATCH v14 2/3] sched: Move task_mm_cid_work to mm timer

[kernel test robot]

Hello,

kernel test robot noticed "WARNING:inconsistent_lock_state" on:

commit: d06e66c6025e44136e6715d24c23fb821a415577 ("[PATCH v14 2/3] sched: Move task_mm_cid_work to mm timer")
url: https://github.com/intel-lab-lkp/linux/commits/Gabriele-Monaco/sched-Add-prev_sum_exec_runtime-support-for-RT-DL-and-SCX-classes/20250707-224959
patch link: https://lore.kernel.org/all/20250707144824.117014-3-gmonaco@redhat.com/
patch subject: [PATCH v14 2/3] sched: Move task_mm_cid_work to mm timer

in testcase: boot

config: x86_64-randconfig-003-20250708
compiler: gcc-11
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

(please refer to attached dmesg/kmsg for entire log/backtrace)


+-------------------------------------------------+------------+------------+
|                                                 | 50c1dc07ee | d06e66c602 |
+-------------------------------------------------+------------+------------+
| WARNING:inconsistent_lock_state                 | 0          | 12         |
| inconsistent{SOFTIRQ-ON-W}->{IN-SOFTIRQ-W}usage | 0          | 12         |
+-------------------------------------------------+------------+------------+


If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202507100606.90787fe6-lkp@intel.com


[   26.556715][    C0] WARNING: inconsistent lock state
[   26.557127][    C0] 6.16.0-rc5-00002-gd06e66c6025e #1 Tainted: G                T
[   26.557730][    C0] --------------------------------
[   26.558133][    C0] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
[   26.558662][    C0] stdbuf/386 [HC0[0]:SC1[1]:HE1:SE0] takes:
[ 26.559118][ C0] ffffffff870d4438 (pgd_lock){+.?.}-{3:3}, at: pgd_free (arch/x86/mm/pgtable.c:67 arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379) 
[   26.559786][    C0] {SOFTIRQ-ON-W} state was registered at:
[ 26.560232][ C0] mark_usage (kernel/locking/lockdep.c:4669) 
[ 26.560561][ C0] __lock_acquire (kernel/locking/lockdep.c:5194) 
[ 26.560929][ C0] lock_acquire (kernel/locking/lockdep.c:473 kernel/locking/lockdep.c:5873) 
[ 26.561267][ C0] _raw_spin_lock (include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) 
[ 26.561617][ C0] pgd_alloc (arch/x86/mm/pgtable.c:86 arch/x86/mm/pgtable.c:353) 
[ 26.561950][ C0] mm_init+0x64f/0xbfb 
[ 26.562342][ C0] mm_alloc (kernel/fork.c:1109) 
[ 26.562655][ C0] dma_resv_lockdep (drivers/dma-buf/dma-resv.c:784) 
[ 26.563020][ C0] do_one_initcall (init/main.c:1274) 
[ 26.563389][ C0] do_initcalls (init/main.c:1335 init/main.c:1352) 
[ 26.563744][ C0] kernel_init_freeable (init/main.c:1588) 
[ 26.564144][ C0] kernel_init (init/main.c:1476) 
[ 26.564402][ C0] ret_from_fork (arch/x86/kernel/process.c:154) 
[ 26.564633][ C0] ret_from_fork_asm (arch/x86/entry/entry_64.S:258) 
[   26.564871][    C0] irq event stamp: 4774
[ 26.565070][ C0] hardirqs last enabled at (4774): _raw_spin_unlock_irq (arch/x86/include/asm/irqflags.h:42 arch/x86/include/asm/irqflags.h:119 include/linux/spinlock_api_smp.h:159 kernel/locking/spinlock.c:202) 
[ 26.565526][ C0] hardirqs last disabled at (4773): _raw_spin_lock_irq (arch/x86/include/asm/preempt.h:80 include/linux/spinlock_api_smp.h:118 kernel/locking/spinlock.c:170) 
[ 26.565971][ C0] softirqs last enabled at (4256): local_bh_enable (include/linux/bottom_half.h:33) 
[ 26.566408][ C0] softirqs last disabled at (4771): __do_softirq (kernel/softirq.c:614) 
[   26.566823][    C0]
[   26.566823][    C0] other info that might help us debug this:
[   26.567198][    C0]  Possible unsafe locking scenario:
[   26.567198][    C0]
[   26.567548][    C0]        CPU0
[   26.567709][    C0]        ----
[   26.567869][    C0]   lock(pgd_lock);
[   26.568060][    C0]   <Interrupt>
[   26.568255][    C0]     lock(pgd_lock);
[   26.568452][    C0]
[   26.568452][    C0]  *** DEADLOCK ***
[   26.568452][    C0]
[   26.568830][    C0] 3 locks held by stdbuf/386:
[ 26.569056][ C0] #0: ffff888170d5c1a8 (&sb->s_type->i_mutex_key){++++}-{4:4}, at: lookup_slow (fs/namei.c:1834) 
[ 26.569535][ C0] #1: ffff888170cf5850 (&lockref->lock){+.+.}-{3:3}, at: d_alloc (include/linux/dcache.h:319 fs/dcache.c:1777) 
[ 26.569961][ C0] #2: ffffc90000007d40 ((&mm->cid_timer)){+.-.}-{0:0}, at: call_timer_fn (kernel/time/timer.c:1744) 
[   26.570421][    C0]
[   26.570421][    C0] stack backtrace:
[   26.570704][    C0] CPU: 0 UID: 0 PID: 386 Comm: stdbuf Tainted: G                T   6.16.0-rc5-00002-gd06e66c6025e #1 PREEMPT(voluntary)  39c5cbdaf5b4eb171776daa7d42daa95c0766676
[   26.570716][    C0] Tainted: [T]=RANDSTRUCT
[   26.570719][    C0] Call Trace:
[   26.570723][    C0]  <IRQ>
[ 26.570727][ C0] dump_stack_lvl (lib/dump_stack.c:122 (discriminator 4)) 
[ 26.570735][ C0] dump_stack (lib/dump_stack.c:130) 
[ 26.570740][ C0] print_usage_bug (kernel/locking/lockdep.c:4047) 
[ 26.570748][ C0] valid_state (kernel/locking/lockdep.c:4060) 
[ 26.570755][ C0] mark_lock_irq (kernel/locking/lockdep.c:4270) 
[ 26.570762][ C0] ? save_trace (kernel/locking/lockdep.c:592) 
[ 26.570773][ C0] ? mark_lock (kernel/locking/lockdep.c:4728 (discriminator 3)) 
[ 26.570780][ C0] mark_lock (kernel/locking/lockdep.c:4756) 
[ 26.570787][ C0] mark_usage (kernel/locking/lockdep.c:4645) 
[ 26.570796][ C0] __lock_acquire (kernel/locking/lockdep.c:5194) 
[ 26.570804][ C0] lock_acquire (kernel/locking/lockdep.c:473 kernel/locking/lockdep.c:5873) 
[ 26.570811][ C0] ? pgd_free (arch/x86/mm/pgtable.c:67 arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379) 
[ 26.570822][ C0] ? validate_chain (kernel/locking/lockdep.c:3826 kernel/locking/lockdep.c:3879) 
[ 26.570828][ C0] ? wake_up_new_task (kernel/sched/core.c:10597) 
[ 26.570839][ C0] _raw_spin_lock (include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) 
[ 26.570845][ C0] ? pgd_free (arch/x86/mm/pgtable.c:67 arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379) 
[ 26.570854][ C0] pgd_free (arch/x86/mm/pgtable.c:67 arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379) 
[ 26.570863][ C0] ? wake_up_new_task (kernel/sched/core.c:10597) 
[ 26.570873][ C0] __mmdrop (kernel/fork.c:681) 
[ 26.570882][ C0] ? wake_up_new_task (kernel/sched/core.c:10597) 
[ 26.570891][ C0] mmdrop (include/linux/sched/mm.h:55) 
[ 26.570901][ C0] task_mm_cid_scan (kernel/sched/core.c:10619 (discriminator 3)) 
[ 26.570910][ C0] ? lock_is_held (include/linux/lockdep.h:249) 
[ 26.570918][ C0] ? wake_up_new_task (kernel/sched/core.c:10597) 
[ 26.570928][ C0] call_timer_fn (arch/x86/include/asm/atomic.h:23 include/linux/atomic/atomic-arch-fallback.h:457 include/linux/jump_label.h:262 include/trace/events/timer.h:127 kernel/time/timer.c:1748) 
[ 26.570935][ C0] ? trace_timer_base_idle (kernel/time/timer.c:1724) 
[ 26.570943][ C0] ? wake_up_new_task (kernel/sched/core.c:10597) 
[ 26.570953][ C0] ? wake_up_new_task (kernel/sched/core.c:10597) 
[ 26.570962][ C0] __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2372) 
[ 26.570970][ C0] ? add_timer_global (kernel/time/timer.c:2343) 
[ 26.570977][ C0] ? __kasan_check_write (mm/kasan/shadow.c:38) 
[ 26.570988][ C0] ? do_raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116) 
[ 26.570996][ C0] ? __raw_spin_lock_init (kernel/locking/spinlock_debug.c:114) 
[ 26.571006][ C0] __run_timer_base (kernel/time/timer.c:2385) 
[ 26.571014][ C0] run_timer_base (kernel/time/timer.c:2394) 
[ 26.571021][ C0] run_timer_softirq (arch/x86/include/asm/atomic.h:23 include/linux/atomic/atomic-arch-fallback.h:457 include/linux/jump_label.h:262 kernel/time/timer.c:342 kernel/time/timer.c:2406) 
[ 26.571028][ C0] handle_softirqs (arch/x86/include/asm/atomic.h:23 include/linux/atomic/atomic-arch-fallback.h:457 include/linux/jump_label.h:262 include/trace/events/irq.h:142 kernel/softirq.c:580) 
[ 26.571039][ C0] __do_softirq (kernel/softirq.c:614) 
[ 26.571046][ C0] __irq_exit_rcu (kernel/softirq.c:453 kernel/softirq.c:680) 
[ 26.571055][ C0] irq_exit_rcu (kernel/softirq.c:698) 
[ 26.571064][ C0] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050 arch/x86/kernel/apic/apic.c:1050) 
[   26.571076][    C0]  </IRQ>
[   26.571078][    C0]  <TASK>
[ 26.571081][ C0] asm_sysvec_apic_timer_interrupt (arch/x86/include/asm/idtentry.h:574) 
[ 26.571088][ C0] RIP: 0010:d_alloc (fs/dcache.c:1778) 
[ 26.571100][ C0] Code: 8d 7c 24 50 b8 ff ff 37 00 ff 83 f8 00 00 00 48 89 fa 48 c1 e0 2a 48 c1 ea 03 80 3c 02 00 74 05 e8 5f f3 f6 ff 49 89 5c 24 50 <49> 8d bc 24 10 01 00 00 48 8d b3 20 01 00 00 e8 87 bc ff ff 4c 89
All code
========
   0:	8d 7c 24 50          	lea    0x50(%rsp),%edi
   4:	b8 ff ff 37 00       	mov    $0x37ffff,%eax
   9:	ff 83 f8 00 00 00    	incl   0xf8(%rbx)
   f:	48 89 fa             	mov    %rdi,%rdx
  12:	48 c1 e0 2a          	shl    $0x2a,%rax
  16:	48 c1 ea 03          	shr    $0x3,%rdx
  1a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
  1e:	74 05                	je     0x25
  20:	e8 5f f3 f6 ff       	call   0xfffffffffff6f384
  25:	49 89 5c 24 50       	mov    %rbx,0x50(%r12)
  2a:*	49 8d bc 24 10 01 00 	lea    0x110(%r12),%rdi		<-- trapping instruction
  31:	00 
  32:	48 8d b3 20 01 00 00 	lea    0x120(%rbx),%rsi
  39:	e8 87 bc ff ff       	call   0xffffffffffffbcc5
  3e:	4c                   	rex.WR
  3f:	89                   	.byte 0x89

Code starting with the faulting instruction
===========================================
   0:	49 8d bc 24 10 01 00 	lea    0x110(%r12),%rdi
   7:	00 
   8:	48 8d b3 20 01 00 00 	lea    0x120(%rbx),%rsi
   f:	e8 87 bc ff ff       	call   0xffffffffffffbc9b
  14:	4c                   	rex.WR
  15:	89                   	.byte 0x89


The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20250710/202507100606.90787fe6-lkp@intel.com



-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v14 2/3] sched: Move task_mm_cid_work to mm timer

[Mathieu Desnoyers]

On 2025-07-10 00:56, kernel test robot wrote:
> 
> 
> Hello,
> 
> kernel test robot noticed "WARNING:inconsistent_lock_state" on:
> 
> commit: d06e66c6025e44136e6715d24c23fb821a415577 ("[PATCH v14 2/3] sched: Move task_mm_cid_work to mm timer")
> url: https://github.com/intel-lab-lkp/linux/commits/Gabriele-Monaco/sched-Add-prev_sum_exec_runtime-support-for-RT-DL-and-SCX-classes/20250707-224959
> patch link: https://lore.kernel.org/all/20250707144824.117014-3-gmonaco@redhat.com/
> patch subject: [PATCH v14 2/3] sched: Move task_mm_cid_work to mm timer
> 
> in testcase: boot
> 
> config: x86_64-randconfig-003-20250708
> compiler: gcc-11
> test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
> 
> (please refer to attached dmesg/kmsg for entire log/backtrace)
> 
> 
> +-------------------------------------------------+------------+------------+
> |                                                 | 50c1dc07ee | d06e66c602 |
> +-------------------------------------------------+------------+------------+
> | WARNING:inconsistent_lock_state                 | 0          | 12         |
> | inconsistent{SOFTIRQ-ON-W}->{IN-SOFTIRQ-W}usage | 0          | 12         |
> +-------------------------------------------------+------------+------------+
> 

I suspect the issue comes from calling mmdrop(mm) from timer context in a scenario
where the mm_count can drop to 0.

This causes calls to pgd_free() and such to take the pgd_lock in softirq
context, when in other cases it's taken with softirqs enabled.

See "mmdrop_sched()" for RT. I think we need something similar for the
non-RT case, e.g. a:

static inline void __mmdrop_delayed(struct rcu_head *rhp)
{
         struct mm_struct *mm = container_of(rhp, struct mm_struct, delayed_drop);

         __mmdrop(mm);
}

static inline void mmdrop_timer(struct mm_struct *mm)
{
         /* Provides a full memory barrier. See mmdrop() */
         if (atomic_dec_and_test(&mm->mm_count))
                 call_rcu(&mm->delayed_drop, __mmdrop_delayed);
}

Thoughts ?

Thanks,

Mathieu

> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <oliver.sang@intel.com>
> | Closes: https://lore.kernel.org/oe-lkp/202507100606.90787fe6-lkp@intel.com
> 
> 
> [   26.556715][    C0] WARNING: inconsistent lock state
> [   26.557127][    C0] 6.16.0-rc5-00002-gd06e66c6025e #1 Tainted: G                T
> [   26.557730][    C0] --------------------------------
> [   26.558133][    C0] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
> [   26.558662][    C0] stdbuf/386 [HC0[0]:SC1[1]:HE1:SE0] takes:
> [ 26.559118][ C0] ffffffff870d4438 (pgd_lock){+.?.}-{3:3}, at: pgd_free (arch/x86/mm/pgtable.c:67 arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379)
> [   26.559786][    C0] {SOFTIRQ-ON-W} state was registered at:
> [ 26.560232][ C0] mark_usage (kernel/locking/lockdep.c:4669)
> [ 26.560561][ C0] __lock_acquire (kernel/locking/lockdep.c:5194)
> [ 26.560929][ C0] lock_acquire (kernel/locking/lockdep.c:473 kernel/locking/lockdep.c:5873)
> [ 26.561267][ C0] _raw_spin_lock (include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154)
> [ 26.561617][ C0] pgd_alloc (arch/x86/mm/pgtable.c:86 arch/x86/mm/pgtable.c:353)
> [ 26.561950][ C0] mm_init+0x64f/0xbfb
> [ 26.562342][ C0] mm_alloc (kernel/fork.c:1109)
> [ 26.562655][ C0] dma_resv_lockdep (drivers/dma-buf/dma-resv.c:784)
> [ 26.563020][ C0] do_one_initcall (init/main.c:1274)
> [ 26.563389][ C0] do_initcalls (init/main.c:1335 init/main.c:1352)
> [ 26.563744][ C0] kernel_init_freeable (init/main.c:1588)
> [ 26.564144][ C0] kernel_init (init/main.c:1476)
> [ 26.564402][ C0] ret_from_fork (arch/x86/kernel/process.c:154)
> [ 26.564633][ C0] ret_from_fork_asm (arch/x86/entry/entry_64.S:258)
> [   26.564871][    C0] irq event stamp: 4774
> [ 26.565070][ C0] hardirqs last enabled at (4774): _raw_spin_unlock_irq (arch/x86/include/asm/irqflags.h:42 arch/x86/include/asm/irqflags.h:119 include/linux/spinlock_api_smp.h:159 kernel/locking/spinlock.c:202)
> [ 26.565526][ C0] hardirqs last disabled at (4773): _raw_spin_lock_irq (arch/x86/include/asm/preempt.h:80 include/linux/spinlock_api_smp.h:118 kernel/locking/spinlock.c:170)
> [ 26.565971][ C0] softirqs last enabled at (4256): local_bh_enable (include/linux/bottom_half.h:33)
> [ 26.566408][ C0] softirqs last disabled at (4771): __do_softirq (kernel/softirq.c:614)
> [   26.566823][    C0]
> [   26.566823][    C0] other info that might help us debug this:
> [   26.567198][    C0]  Possible unsafe locking scenario:
> [   26.567198][    C0]
> [   26.567548][    C0]        CPU0
> [   26.567709][    C0]        ----
> [   26.567869][    C0]   lock(pgd_lock);
> [   26.568060][    C0]   <Interrupt>
> [   26.568255][    C0]     lock(pgd_lock);
> [   26.568452][    C0]
> [   26.568452][    C0]  *** DEADLOCK ***
> [   26.568452][    C0]
> [   26.568830][    C0] 3 locks held by stdbuf/386:
> [ 26.569056][ C0] #0: ffff888170d5c1a8 (&sb->s_type->i_mutex_key){++++}-{4:4}, at: lookup_slow (fs/namei.c:1834)
> [ 26.569535][ C0] #1: ffff888170cf5850 (&lockref->lock){+.+.}-{3:3}, at: d_alloc (include/linux/dcache.h:319 fs/dcache.c:1777)
> [ 26.569961][ C0] #2: ffffc90000007d40 ((&mm->cid_timer)){+.-.}-{0:0}, at: call_timer_fn (kernel/time/timer.c:1744)
> [   26.570421][    C0]
> [   26.570421][    C0] stack backtrace:
> [   26.570704][    C0] CPU: 0 UID: 0 PID: 386 Comm: stdbuf Tainted: G                T   6.16.0-rc5-00002-gd06e66c6025e #1 PREEMPT(voluntary)  39c5cbdaf5b4eb171776daa7d42daa95c0766676
> [   26.570716][    C0] Tainted: [T]=RANDSTRUCT
> [   26.570719][    C0] Call Trace:
> [   26.570723][    C0]  <IRQ>
> [ 26.570727][ C0] dump_stack_lvl (lib/dump_stack.c:122 (discriminator 4))
> [ 26.570735][ C0] dump_stack (lib/dump_stack.c:130)
> [ 26.570740][ C0] print_usage_bug (kernel/locking/lockdep.c:4047)
> [ 26.570748][ C0] valid_state (kernel/locking/lockdep.c:4060)
> [ 26.570755][ C0] mark_lock_irq (kernel/locking/lockdep.c:4270)
> [ 26.570762][ C0] ? save_trace (kernel/locking/lockdep.c:592)
> [ 26.570773][ C0] ? mark_lock (kernel/locking/lockdep.c:4728 (discriminator 3))
> [ 26.570780][ C0] mark_lock (kernel/locking/lockdep.c:4756)
> [ 26.570787][ C0] mark_usage (kernel/locking/lockdep.c:4645)
> [ 26.570796][ C0] __lock_acquire (kernel/locking/lockdep.c:5194)
> [ 26.570804][ C0] lock_acquire (kernel/locking/lockdep.c:473 kernel/locking/lockdep.c:5873)
> [ 26.570811][ C0] ? pgd_free (arch/x86/mm/pgtable.c:67 arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379)
> [ 26.570822][ C0] ? validate_chain (kernel/locking/lockdep.c:3826 kernel/locking/lockdep.c:3879)
> [ 26.570828][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
> [ 26.570839][ C0] _raw_spin_lock (include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154)
> [ 26.570845][ C0] ? pgd_free (arch/x86/mm/pgtable.c:67 arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379)
> [ 26.570854][ C0] pgd_free (arch/x86/mm/pgtable.c:67 arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379)
> [ 26.570863][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
> [ 26.570873][ C0] __mmdrop (kernel/fork.c:681)
> [ 26.570882][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
> [ 26.570891][ C0] mmdrop (include/linux/sched/mm.h:55)
> [ 26.570901][ C0] task_mm_cid_scan (kernel/sched/core.c:10619 (discriminator 3))
> [ 26.570910][ C0] ? lock_is_held (include/linux/lockdep.h:249)
> [ 26.570918][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
> [ 26.570928][ C0] call_timer_fn (arch/x86/include/asm/atomic.h:23 include/linux/atomic/atomic-arch-fallback.h:457 include/linux/jump_label.h:262 include/trace/events/timer.h:127 kernel/time/timer.c:1748)
> [ 26.570935][ C0] ? trace_timer_base_idle (kernel/time/timer.c:1724)
> [ 26.570943][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
> [ 26.570953][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
> [ 26.570962][ C0] __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2372)
> [ 26.570970][ C0] ? add_timer_global (kernel/time/timer.c:2343)
> [ 26.570977][ C0] ? __kasan_check_write (mm/kasan/shadow.c:38)
> [ 26.570988][ C0] ? do_raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 kernel/locking/spinlock_debug.c:116)
> [ 26.570996][ C0] ? __raw_spin_lock_init (kernel/locking/spinlock_debug.c:114)
> [ 26.571006][ C0] __run_timer_base (kernel/time/timer.c:2385)
> [ 26.571014][ C0] run_timer_base (kernel/time/timer.c:2394)
> [ 26.571021][ C0] run_timer_softirq (arch/x86/include/asm/atomic.h:23 include/linux/atomic/atomic-arch-fallback.h:457 include/linux/jump_label.h:262 kernel/time/timer.c:342 kernel/time/timer.c:2406)
> [ 26.571028][ C0] handle_softirqs (arch/x86/include/asm/atomic.h:23 include/linux/atomic/atomic-arch-fallback.h:457 include/linux/jump_label.h:262 include/trace/events/irq.h:142 kernel/softirq.c:580)
> [ 26.571039][ C0] __do_softirq (kernel/softirq.c:614)
> [ 26.571046][ C0] __irq_exit_rcu (kernel/softirq.c:453 kernel/softirq.c:680)
> [ 26.571055][ C0] irq_exit_rcu (kernel/softirq.c:698)
> [ 26.571064][ C0] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050 arch/x86/kernel/apic/apic.c:1050)
> [   26.571076][    C0]  </IRQ>
> [   26.571078][    C0]  <TASK>
> [ 26.571081][ C0] asm_sysvec_apic_timer_interrupt (arch/x86/include/asm/idtentry.h:574)
> [ 26.571088][ C0] RIP: 0010:d_alloc (fs/dcache.c:1778)
> [ 26.571100][ C0] Code: 8d 7c 24 50 b8 ff ff 37 00 ff 83 f8 00 00 00 48 89 fa 48 c1 e0 2a 48 c1 ea 03 80 3c 02 00 74 05 e8 5f f3 f6 ff 49 89 5c 24 50 <49> 8d bc 24 10 01 00 00 48 8d b3 20 01 00 00 e8 87 bc ff ff 4c 89
> All code
> ========
>     0:	8d 7c 24 50          	lea    0x50(%rsp),%edi
>     4:	b8 ff ff 37 00       	mov    $0x37ffff,%eax
>     9:	ff 83 f8 00 00 00    	incl   0xf8(%rbx)
>     f:	48 89 fa             	mov    %rdi,%rdx
>    12:	48 c1 e0 2a          	shl    $0x2a,%rax
>    16:	48 c1 ea 03          	shr    $0x3,%rdx
>    1a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
>    1e:	74 05                	je     0x25
>    20:	e8 5f f3 f6 ff       	call   0xfffffffffff6f384
>    25:	49 89 5c 24 50       	mov    %rbx,0x50(%r12)
>    2a:*	49 8d bc 24 10 01 00 	lea    0x110(%r12),%rdi		<-- trapping instruction
>    31:	00
>    32:	48 8d b3 20 01 00 00 	lea    0x120(%rbx),%rsi
>    39:	e8 87 bc ff ff       	call   0xffffffffffffbcc5
>    3e:	4c                   	rex.WR
>    3f:	89                   	.byte 0x89
> 
> Code starting with the faulting instruction
> ===========================================
>     0:	49 8d bc 24 10 01 00 	lea    0x110(%r12),%rdi
>     7:	00
>     8:	48 8d b3 20 01 00 00 	lea    0x120(%rbx),%rsi
>     f:	e8 87 bc ff ff       	call   0xffffffffffffbc9b
>    14:	4c                   	rex.WR
>    15:	89                   	.byte 0x89
> 
> 
> The kernel config and materials to reproduce are available at:
> https://download.01.org/0day-ci/archive/20250710/202507100606.90787fe6-lkp@intel.com
> 
> 
> 


-- 
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com

Re: [PATCH v14 2/3] sched: Move task_mm_cid_work to mm timer

[Gabriele Monaco]

On Thu, 2025-07-10 at 09:23 -0400, Mathieu Desnoyers wrote:
> On 2025-07-10 00:56, kernel test robot wrote:
> > 
> > 
> > Hello,
> > 
> > kernel test robot noticed "WARNING:inconsistent_lock_state" on:
> > 
> > commit: d06e66c6025e44136e6715d24c23fb821a415577 ("[PATCH v14 2/3]
> > sched: Move task_mm_cid_work to mm timer")
> > url:
> > https://github.com/intel-lab-lkp/linux/commits/Gabriele-Monaco/sched-Add-prev_sum_exec_runtime-support-for-RT-DL-and-SCX-classes/20250707-224959
> > patch link:
> > https://lore.kernel.org/all/20250707144824.117014-3-gmonaco@redhat.com/
> > patch subject: [PATCH v14 2/3] sched: Move task_mm_cid_work to mm
> > timer
> > 
> > in testcase: boot
> > 
> > config: x86_64-randconfig-003-20250708
> > compiler: gcc-11
> > test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp
> > 2 -m 16G
> > 
> > (please refer to attached dmesg/kmsg for entire log/backtrace)
> > 
> > 
> > +-------------------------------------------------+------------+---
> > ---------+
> > >                                                 | 50c1dc07ee |
> > > d06e66c602 |
> > +-------------------------------------------------+------------+---
> > ---------+
> > > WARNING:inconsistent_lock_state                 | 0          |
> > > 12         |
> > > inconsistent{SOFTIRQ-ON-W}->{IN-SOFTIRQ-W}usage | 0          |
> > > 12         |
> > +-------------------------------------------------+------------+---
> > ---------+
> > 
> 
> I suspect the issue comes from calling mmdrop(mm) from timer context
> in a scenario
> where the mm_count can drop to 0.
> 
> This causes calls to pgd_free() and such to take the pgd_lock in
> softirq
> context, when in other cases it's taken with softirqs enabled.
> 
> See "mmdrop_sched()" for RT. I think we need something similar for
> the
> non-RT case, e.g. a:
> 
> static inline void __mmdrop_delayed(struct rcu_head *rhp)
> {
>          struct mm_struct *mm = container_of(rhp, struct mm_struct,
> delayed_drop);
> 
>          __mmdrop(mm);
> }
> 
> static inline void mmdrop_timer(struct mm_struct *mm)
> {
>          /* Provides a full memory barrier. See mmdrop() */
>          if (atomic_dec_and_test(&mm->mm_count))
>                  call_rcu(&mm->delayed_drop, __mmdrop_delayed);
> }
> 
> Thoughts ?
> 

Thanks for the suggestion.

I noticed the problem is in the mmdrop over there, but I'm seeing this
is getting unnecessarily complicated.
I'm not sure it's worth going down this path, also considering pushing
the timer wheel like this might end up in unintended effects like it
happened with the workqueue.

I am going to try the alternative approach of running the scan in
batches [1] still using a task_work but triggering it from
__rseq_handle_notify_resume like here.
If that works in the original usecase, I guess it's better to keep it
that way.

What do you think?

Thanks,
Gabriele

[1] -
https://lore.kernel.org/lkml/20250217112317.258716-1-gmonaco@redhat.com

> Thanks,
> 
> Mathieu
> 
> > 
> > If you fix the issue in a separate patch/commit (i.e. not just a
> > new version of
> > the same patch/commit), kindly add following tags
> > > Reported-by: kernel test robot <oliver.sang@intel.com>
> > > Closes:
> > > https://lore.kernel.org/oe-lkp/202507100606.90787fe6-lkp@intel.com
> > 
> > 
> > [   26.556715][    C0] WARNING: inconsistent lock state
> > [   26.557127][    C0] 6.16.0-rc5-00002-gd06e66c6025e #1 Tainted:
> > G                T
> > [   26.557730][    C0] --------------------------------
> > [   26.558133][    C0] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-
> > W} usage.
> > [   26.558662][    C0] stdbuf/386 [HC0[0]:SC1[1]:HE1:SE0] takes:
> > [ 26.559118][ C0] ffffffff870d4438 (pgd_lock){+.?.}-{3:3}, at:
> > pgd_free (arch/x86/mm/pgtable.c:67 arch/x86/mm/pgtable.c:98
> > arch/x86/mm/pgtable.c:379)
> > [   26.559786][    C0] {SOFTIRQ-ON-W} state was registered at:
> > [ 26.560232][ C0] mark_usage (kernel/locking/lockdep.c:4669)
> > [ 26.560561][ C0] __lock_acquire (kernel/locking/lockdep.c:5194)
> > [ 26.560929][ C0] lock_acquire (kernel/locking/lockdep.c:473
> > kernel/locking/lockdep.c:5873)
> > [ 26.561267][ C0] _raw_spin_lock
> > (include/linux/spinlock_api_smp.h:134
> > kernel/locking/spinlock.c:154)
> > [ 26.561617][ C0] pgd_alloc (arch/x86/mm/pgtable.c:86
> > arch/x86/mm/pgtable.c:353)
> > [ 26.561950][ C0] mm_init+0x64f/0xbfb
> > [ 26.562342][ C0] mm_alloc (kernel/fork.c:1109)
> > [ 26.562655][ C0] dma_resv_lockdep (drivers/dma-buf/dma-resv.c:784)
> > [ 26.563020][ C0] do_one_initcall (init/main.c:1274)
> > [ 26.563389][ C0] do_initcalls (init/main.c:1335 init/main.c:1352)
> > [ 26.563744][ C0] kernel_init_freeable (init/main.c:1588)
> > [ 26.564144][ C0] kernel_init (init/main.c:1476)
> > [ 26.564402][ C0] ret_from_fork (arch/x86/kernel/process.c:154)
> > [ 26.564633][ C0] ret_from_fork_asm (arch/x86/entry/entry_64.S:258)
> > [   26.564871][    C0] irq event stamp: 4774
> > [ 26.565070][ C0] hardirqs last enabled at (4774):
> > _raw_spin_unlock_irq (arch/x86/include/asm/irqflags.h:42
> > arch/x86/include/asm/irqflags.h:119
> > include/linux/spinlock_api_smp.h:159 kernel/locking/spinlock.c:202)
> > [ 26.565526][ C0] hardirqs last disabled at (4773):
> > _raw_spin_lock_irq (arch/x86/include/asm/preempt.h:80
> > include/linux/spinlock_api_smp.h:118 kernel/locking/spinlock.c:170)
> > [ 26.565971][ C0] softirqs last enabled at (4256): local_bh_enable
> > (include/linux/bottom_half.h:33)
> > [ 26.566408][ C0] softirqs last disabled at (4771): __do_softirq
> > (kernel/softirq.c:614)
> > [   26.566823][    C0]
> > [   26.566823][    C0] other info that might help us debug this:
> > [   26.567198][    C0]  Possible unsafe locking scenario:
> > [   26.567198][    C0]
> > [   26.567548][    C0]        CPU0
> > [   26.567709][    C0]        ----
> > [   26.567869][    C0]   lock(pgd_lock);
> > [   26.568060][    C0]   <Interrupt>
> > [   26.568255][    C0]     lock(pgd_lock);
> > [   26.568452][    C0]
> > [   26.568452][    C0]  *** DEADLOCK ***
> > [   26.568452][    C0]
> > [   26.568830][    C0] 3 locks held by stdbuf/386:
> > [ 26.569056][ C0] #0: ffff888170d5c1a8 (&sb->s_type-
> > >i_mutex_key){++++}-{4:4}, at: lookup_slow (fs/namei.c:1834)
> > [ 26.569535][ C0] #1: ffff888170cf5850 (&lockref->lock){+.+.}-
> > {3:3}, at: d_alloc (include/linux/dcache.h:319 fs/dcache.c:1777)
> > [ 26.569961][ C0] #2: ffffc90000007d40 ((&mm->cid_timer)){+.-.}-
> > {0:0}, at: call_timer_fn (kernel/time/timer.c:1744)
> > [   26.570421][    C0]
> > [   26.570421][    C0] stack backtrace:
> > [   26.570704][    C0] CPU: 0 UID: 0 PID: 386 Comm: stdbuf Tainted:
> > G                T   6.16.0-rc5-00002-gd06e66c6025e #1
> > PREEMPT(voluntary)  39c5cbdaf5b4eb171776daa7d42daa95c0766676
> > [   26.570716][    C0] Tainted: [T]=RANDSTRUCT
> > [   26.570719][    C0] Call Trace:
> > [   26.570723][    C0]  <IRQ>
> > [ 26.570727][ C0] dump_stack_lvl (lib/dump_stack.c:122
> > (discriminator 4))
> > [ 26.570735][ C0] dump_stack (lib/dump_stack.c:130)
> > [ 26.570740][ C0] print_usage_bug (kernel/locking/lockdep.c:4047)
> > [ 26.570748][ C0] valid_state (kernel/locking/lockdep.c:4060)
> > [ 26.570755][ C0] mark_lock_irq (kernel/locking/lockdep.c:4270)
> > [ 26.570762][ C0] ? save_trace (kernel/locking/lockdep.c:592)
> > [ 26.570773][ C0] ? mark_lock (kernel/locking/lockdep.c:4728
> > (discriminator 3))
> > [ 26.570780][ C0] mark_lock (kernel/locking/lockdep.c:4756)
> > [ 26.570787][ C0] mark_usage (kernel/locking/lockdep.c:4645)
> > [ 26.570796][ C0] __lock_acquire (kernel/locking/lockdep.c:5194)
> > [ 26.570804][ C0] lock_acquire (kernel/locking/lockdep.c:473
> > kernel/locking/lockdep.c:5873)
> > [ 26.570811][ C0] ? pgd_free (arch/x86/mm/pgtable.c:67
> > arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379)
> > [ 26.570822][ C0] ? validate_chain (kernel/locking/lockdep.c:3826
> > kernel/locking/lockdep.c:3879)
> > [ 26.570828][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
> > [ 26.570839][ C0] _raw_spin_lock
> > (include/linux/spinlock_api_smp.h:134
> > kernel/locking/spinlock.c:154)
> > [ 26.570845][ C0] ? pgd_free (arch/x86/mm/pgtable.c:67
> > arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379)
> > [ 26.570854][ C0] pgd_free (arch/x86/mm/pgtable.c:67
> > arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379)
> > [ 26.570863][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
> > [ 26.570873][ C0] __mmdrop (kernel/fork.c:681)
> > [ 26.570882][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
> > [ 26.570891][ C0] mmdrop (include/linux/sched/mm.h:55)
> > [ 26.570901][ C0] task_mm_cid_scan (kernel/sched/core.c:10619
> > (discriminator 3))
> > [ 26.570910][ C0] ? lock_is_held (include/linux/lockdep.h:249)
> > [ 26.570918][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
> > [ 26.570928][ C0] call_timer_fn (arch/x86/include/asm/atomic.h:23
> > include/linux/atomic/atomic-arch-fallback.h:457
> > include/linux/jump_label.h:262 include/trace/events/timer.h:127
> > kernel/time/timer.c:1748)
> > [ 26.570935][ C0] ? trace_timer_base_idle
> > (kernel/time/timer.c:1724)
> > [ 26.570943][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
> > [ 26.570953][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
> > [ 26.570962][ C0] __run_timers (kernel/time/timer.c:1799
> > kernel/time/timer.c:2372)
> > [ 26.570970][ C0] ? add_timer_global (kernel/time/timer.c:2343)
> > [ 26.570977][ C0] ? __kasan_check_write (mm/kasan/shadow.c:38)
> > [ 26.570988][ C0] ? do_raw_spin_lock
> > (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-
> > arch-fallback.h:2170 include/linux/atomic/atomic-
> > instrumented.h:1302 include/asm-generic/qspinlock.h:111
> > kernel/locking/spinlock_debug.c:116)
> > [ 26.570996][ C0] ? __raw_spin_lock_init
> > (kernel/locking/spinlock_debug.c:114)
> > [ 26.571006][ C0] __run_timer_base (kernel/time/timer.c:2385)
> > [ 26.571014][ C0] run_timer_base (kernel/time/timer.c:2394)
> > [ 26.571021][ C0] run_timer_softirq
> > (arch/x86/include/asm/atomic.h:23 include/linux/atomic/atomic-arch-
> > fallback.h:457 include/linux/jump_label.h:262
> > kernel/time/timer.c:342 kernel/time/timer.c:2406)
> > [ 26.571028][ C0] handle_softirqs (arch/x86/include/asm/atomic.h:23
> > include/linux/atomic/atomic-arch-fallback.h:457
> > include/linux/jump_label.h:262 include/trace/events/irq.h:142
> > kernel/softirq.c:580)
> > [ 26.571039][ C0] __do_softirq (kernel/softirq.c:614)
> > [ 26.571046][ C0] __irq_exit_rcu (kernel/softirq.c:453
> > kernel/softirq.c:680)
> > [ 26.571055][ C0] irq_exit_rcu (kernel/softirq.c:698)
> > [ 26.571064][ C0] sysvec_apic_timer_interrupt
> > (arch/x86/kernel/apic/apic.c:1050 arch/x86/kernel/apic/apic.c:1050)
> > [   26.571076][    C0]  </IRQ>
> > [   26.571078][    C0]  <TASK>
> > [ 26.571081][ C0] asm_sysvec_apic_timer_interrupt
> > (arch/x86/include/asm/idtentry.h:574)
> > [ 26.571088][ C0] RIP: 0010:d_alloc (fs/dcache.c:1778)
> > [ 26.571100][ C0] Code: 8d 7c 24 50 b8 ff ff 37 00 ff 83 f8 00 00
> > 00 48 89 fa 48 c1 e0 2a 48 c1 ea 03 80 3c 02 00 74 05 e8 5f f3 f6
> > ff 49 89 5c 24 50 <49> 8d bc 24 10 01 00 00 48 8d b3 20 01 00 00 e8
> > 87 bc ff ff 4c 89
> > All code
> > ========
> >     0:	8d 7c 24 50          	lea    0x50(%rsp),%edi
> >     4:	b8 ff ff 37 00       	mov    $0x37ffff,%eax
> >     9:	ff 83 f8 00 00 00    	incl   0xf8(%rbx)
> >     f:	48 89 fa             	mov    %rdi,%rdx
> >    12:	48 c1 e0 2a          	shl    $0x2a,%rax
> >    16:	48 c1 ea 03          	shr    $0x3,%rdx
> >    1a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
> >    1e:	74 05                	je     0x25
> >    20:	e8 5f f3 f6 ff       	call   0xfffffffffff6f384
> >    25:	49 89 5c 24 50       	mov    %rbx,0x50(%r12)
> >    2a:*	49 8d bc 24 10 01 00 	lea   
> > 0x110(%r12),%rdi		<-- trapping instruction
> >    31:	00
> >    32:	48 8d b3 20 01 00 00 	lea    0x120(%rbx),%rsi
> >    39:	e8 87 bc ff ff       	call   0xffffffffffffbcc5
> >    3e:	4c                   	rex.WR
> >    3f:	89                   	.byte 0x89
> > 
> > Code starting with the faulting instruction
> > ===========================================
> >     0:	49 8d bc 24 10 01 00 	lea    0x110(%r12),%rdi
> >     7:	00
> >     8:	48 8d b3 20 01 00 00 	lea    0x120(%rbx),%rsi
> >     f:	e8 87 bc ff ff       	call   0xffffffffffffbc9b
> >    14:	4c                   	rex.WR
> >    15:	89                   	.byte 0x89
> > 
> > 
> > The kernel config and materials to reproduce are available at:
> > https://download.01.org/0day-ci/archive/20250710/202507100606.90787fe6-lkp@intel.com
> > 
> > 
> > 
> 

Re: [PATCH v14 2/3] sched: Move task_mm_cid_work to mm timer

[Mathieu Desnoyers]

On 2025-07-10 09:40, Gabriele Monaco wrote:
> 
> 
> On Thu, 2025-07-10 at 09:23 -0400, Mathieu Desnoyers wrote:
>> On 2025-07-10 00:56, kernel test robot wrote:
>>>
>>>
>>> Hello,
>>>
>>> kernel test robot noticed "WARNING:inconsistent_lock_state" on:
>>>
>>> commit: d06e66c6025e44136e6715d24c23fb821a415577 ("[PATCH v14 2/3]
>>> sched: Move task_mm_cid_work to mm timer")
>>> url:
>>> https://github.com/intel-lab-lkp/linux/commits/Gabriele-Monaco/sched-Add-prev_sum_exec_runtime-support-for-RT-DL-and-SCX-classes/20250707-224959
>>> patch link:
>>> https://lore.kernel.org/all/20250707144824.117014-3-gmonaco@redhat.com/
>>> patch subject: [PATCH v14 2/3] sched: Move task_mm_cid_work to mm
>>> timer
>>>
>>> in testcase: boot
>>>
>>> config: x86_64-randconfig-003-20250708
>>> compiler: gcc-11
>>> test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp
>>> 2 -m 16G
>>>
>>> (please refer to attached dmesg/kmsg for entire log/backtrace)
>>>
>>>
>>> +-------------------------------------------------+------------+---
>>> ---------+
>>>>                                                  | 50c1dc07ee |
>>>> d06e66c602 |
>>> +-------------------------------------------------+------------+---
>>> ---------+
>>>> WARNING:inconsistent_lock_state                 | 0          |
>>>> 12         |
>>>> inconsistent{SOFTIRQ-ON-W}->{IN-SOFTIRQ-W}usage | 0          |
>>>> 12         |
>>> +-------------------------------------------------+------------+---
>>> ---------+
>>>
>>
>> I suspect the issue comes from calling mmdrop(mm) from timer context
>> in a scenario
>> where the mm_count can drop to 0.
>>
>> This causes calls to pgd_free() and such to take the pgd_lock in
>> softirq
>> context, when in other cases it's taken with softirqs enabled.
>>
>> See "mmdrop_sched()" for RT. I think we need something similar for
>> the
>> non-RT case, e.g. a:
>>
>> static inline void __mmdrop_delayed(struct rcu_head *rhp)
>> {
>>           struct mm_struct *mm = container_of(rhp, struct mm_struct,
>> delayed_drop);
>>
>>           __mmdrop(mm);
>> }
>>
>> static inline void mmdrop_timer(struct mm_struct *mm)
>> {
>>           /* Provides a full memory barrier. See mmdrop() */
>>           if (atomic_dec_and_test(&mm->mm_count))
>>                   call_rcu(&mm->delayed_drop, __mmdrop_delayed);
>> }
>>
>> Thoughts ?
>>
> 
> Thanks for the suggestion.
> 
> I noticed the problem is in the mmdrop over there, but I'm seeing this
> is getting unnecessarily complicated.
> I'm not sure it's worth going down this path, also considering pushing
> the timer wheel like this might end up in unintended effects like it
> happened with the workqueue.
> 
> I am going to try the alternative approach of running the scan in
> batches [1] still using a task_work but triggering it from
> __rseq_handle_notify_resume like here.
> If that works in the original usecase, I guess it's better to keep it
> that way.
> 
> What do you think?

Yes, I think the batching approach makes sense considering the overhead
of worker threads when used periodically at 100ms intervals, the
complexity that arises from doing mmdrop() from timer context, and also
the fact that doing task_mm_cid_scan (iteration on all possible cpus)
from timer context may introduce latency on configurations that
implement timers with softirqs.

It will delay how much time it takes for cid compaction to react to
threads exiting though (wrt selftests/rseq: Add test for mm_cid
compaction). We will probably want to update this test to take into
account that the time it takes for compaction to complete depends on
the number of possible cpus.

Thanks,

Mathieu

> 
> Thanks,
> Gabriele
> 
> [1] -
> https://lore.kernel.org/lkml/20250217112317.258716-1-gmonaco@redhat.com
> 
>> Thanks,
>>
>> Mathieu
>>
>>>
>>> If you fix the issue in a separate patch/commit (i.e. not just a
>>> new version of
>>> the same patch/commit), kindly add following tags
>>>> Reported-by: kernel test robot <oliver.sang@intel.com>
>>>> Closes:
>>>> https://lore.kernel.org/oe-lkp/202507100606.90787fe6-lkp@intel.com
>>>
>>>
>>> [   26.556715][    C0] WARNING: inconsistent lock state
>>> [   26.557127][    C0] 6.16.0-rc5-00002-gd06e66c6025e #1 Tainted:
>>> G                T
>>> [   26.557730][    C0] --------------------------------
>>> [   26.558133][    C0] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-
>>> W} usage.
>>> [   26.558662][    C0] stdbuf/386 [HC0[0]:SC1[1]:HE1:SE0] takes:
>>> [ 26.559118][ C0] ffffffff870d4438 (pgd_lock){+.?.}-{3:3}, at:
>>> pgd_free (arch/x86/mm/pgtable.c:67 arch/x86/mm/pgtable.c:98
>>> arch/x86/mm/pgtable.c:379)
>>> [   26.559786][    C0] {SOFTIRQ-ON-W} state was registered at:
>>> [ 26.560232][ C0] mark_usage (kernel/locking/lockdep.c:4669)
>>> [ 26.560561][ C0] __lock_acquire (kernel/locking/lockdep.c:5194)
>>> [ 26.560929][ C0] lock_acquire (kernel/locking/lockdep.c:473
>>> kernel/locking/lockdep.c:5873)
>>> [ 26.561267][ C0] _raw_spin_lock
>>> (include/linux/spinlock_api_smp.h:134
>>> kernel/locking/spinlock.c:154)
>>> [ 26.561617][ C0] pgd_alloc (arch/x86/mm/pgtable.c:86
>>> arch/x86/mm/pgtable.c:353)
>>> [ 26.561950][ C0] mm_init+0x64f/0xbfb
>>> [ 26.562342][ C0] mm_alloc (kernel/fork.c:1109)
>>> [ 26.562655][ C0] dma_resv_lockdep (drivers/dma-buf/dma-resv.c:784)
>>> [ 26.563020][ C0] do_one_initcall (init/main.c:1274)
>>> [ 26.563389][ C0] do_initcalls (init/main.c:1335 init/main.c:1352)
>>> [ 26.563744][ C0] kernel_init_freeable (init/main.c:1588)
>>> [ 26.564144][ C0] kernel_init (init/main.c:1476)
>>> [ 26.564402][ C0] ret_from_fork (arch/x86/kernel/process.c:154)
>>> [ 26.564633][ C0] ret_from_fork_asm (arch/x86/entry/entry_64.S:258)
>>> [   26.564871][    C0] irq event stamp: 4774
>>> [ 26.565070][ C0] hardirqs last enabled at (4774):
>>> _raw_spin_unlock_irq (arch/x86/include/asm/irqflags.h:42
>>> arch/x86/include/asm/irqflags.h:119
>>> include/linux/spinlock_api_smp.h:159 kernel/locking/spinlock.c:202)
>>> [ 26.565526][ C0] hardirqs last disabled at (4773):
>>> _raw_spin_lock_irq (arch/x86/include/asm/preempt.h:80
>>> include/linux/spinlock_api_smp.h:118 kernel/locking/spinlock.c:170)
>>> [ 26.565971][ C0] softirqs last enabled at (4256): local_bh_enable
>>> (include/linux/bottom_half.h:33)
>>> [ 26.566408][ C0] softirqs last disabled at (4771): __do_softirq
>>> (kernel/softirq.c:614)
>>> [   26.566823][    C0]
>>> [   26.566823][    C0] other info that might help us debug this:
>>> [   26.567198][    C0]  Possible unsafe locking scenario:
>>> [   26.567198][    C0]
>>> [   26.567548][    C0]        CPU0
>>> [   26.567709][    C0]        ----
>>> [   26.567869][    C0]   lock(pgd_lock);
>>> [   26.568060][    C0]   <Interrupt>
>>> [   26.568255][    C0]     lock(pgd_lock);
>>> [   26.568452][    C0]
>>> [   26.568452][    C0]  *** DEADLOCK ***
>>> [   26.568452][    C0]
>>> [   26.568830][    C0] 3 locks held by stdbuf/386:
>>> [ 26.569056][ C0] #0: ffff888170d5c1a8 (&sb->s_type-
>>>> i_mutex_key){++++}-{4:4}, at: lookup_slow (fs/namei.c:1834)
>>> [ 26.569535][ C0] #1: ffff888170cf5850 (&lockref->lock){+.+.}-
>>> {3:3}, at: d_alloc (include/linux/dcache.h:319 fs/dcache.c:1777)
>>> [ 26.569961][ C0] #2: ffffc90000007d40 ((&mm->cid_timer)){+.-.}-
>>> {0:0}, at: call_timer_fn (kernel/time/timer.c:1744)
>>> [   26.570421][    C0]
>>> [   26.570421][    C0] stack backtrace:
>>> [   26.570704][    C0] CPU: 0 UID: 0 PID: 386 Comm: stdbuf Tainted:
>>> G                T   6.16.0-rc5-00002-gd06e66c6025e #1
>>> PREEMPT(voluntary)  39c5cbdaf5b4eb171776daa7d42daa95c0766676
>>> [   26.570716][    C0] Tainted: [T]=RANDSTRUCT
>>> [   26.570719][    C0] Call Trace:
>>> [   26.570723][    C0]  <IRQ>
>>> [ 26.570727][ C0] dump_stack_lvl (lib/dump_stack.c:122
>>> (discriminator 4))
>>> [ 26.570735][ C0] dump_stack (lib/dump_stack.c:130)
>>> [ 26.570740][ C0] print_usage_bug (kernel/locking/lockdep.c:4047)
>>> [ 26.570748][ C0] valid_state (kernel/locking/lockdep.c:4060)
>>> [ 26.570755][ C0] mark_lock_irq (kernel/locking/lockdep.c:4270)
>>> [ 26.570762][ C0] ? save_trace (kernel/locking/lockdep.c:592)
>>> [ 26.570773][ C0] ? mark_lock (kernel/locking/lockdep.c:4728
>>> (discriminator 3))
>>> [ 26.570780][ C0] mark_lock (kernel/locking/lockdep.c:4756)
>>> [ 26.570787][ C0] mark_usage (kernel/locking/lockdep.c:4645)
>>> [ 26.570796][ C0] __lock_acquire (kernel/locking/lockdep.c:5194)
>>> [ 26.570804][ C0] lock_acquire (kernel/locking/lockdep.c:473
>>> kernel/locking/lockdep.c:5873)
>>> [ 26.570811][ C0] ? pgd_free (arch/x86/mm/pgtable.c:67
>>> arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379)
>>> [ 26.570822][ C0] ? validate_chain (kernel/locking/lockdep.c:3826
>>> kernel/locking/lockdep.c:3879)
>>> [ 26.570828][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
>>> [ 26.570839][ C0] _raw_spin_lock
>>> (include/linux/spinlock_api_smp.h:134
>>> kernel/locking/spinlock.c:154)
>>> [ 26.570845][ C0] ? pgd_free (arch/x86/mm/pgtable.c:67
>>> arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379)
>>> [ 26.570854][ C0] pgd_free (arch/x86/mm/pgtable.c:67
>>> arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379)
>>> [ 26.570863][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
>>> [ 26.570873][ C0] __mmdrop (kernel/fork.c:681)
>>> [ 26.570882][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
>>> [ 26.570891][ C0] mmdrop (include/linux/sched/mm.h:55)
>>> [ 26.570901][ C0] task_mm_cid_scan (kernel/sched/core.c:10619
>>> (discriminator 3))
>>> [ 26.570910][ C0] ? lock_is_held (include/linux/lockdep.h:249)
>>> [ 26.570918][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
>>> [ 26.570928][ C0] call_timer_fn (arch/x86/include/asm/atomic.h:23
>>> include/linux/atomic/atomic-arch-fallback.h:457
>>> include/linux/jump_label.h:262 include/trace/events/timer.h:127
>>> kernel/time/timer.c:1748)
>>> [ 26.570935][ C0] ? trace_timer_base_idle
>>> (kernel/time/timer.c:1724)
>>> [ 26.570943][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
>>> [ 26.570953][ C0] ? wake_up_new_task (kernel/sched/core.c:10597)
>>> [ 26.570962][ C0] __run_timers (kernel/time/timer.c:1799
>>> kernel/time/timer.c:2372)
>>> [ 26.570970][ C0] ? add_timer_global (kernel/time/timer.c:2343)
>>> [ 26.570977][ C0] ? __kasan_check_write (mm/kasan/shadow.c:38)
>>> [ 26.570988][ C0] ? do_raw_spin_lock
>>> (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-
>>> arch-fallback.h:2170 include/linux/atomic/atomic-
>>> instrumented.h:1302 include/asm-generic/qspinlock.h:111
>>> kernel/locking/spinlock_debug.c:116)
>>> [ 26.570996][ C0] ? __raw_spin_lock_init
>>> (kernel/locking/spinlock_debug.c:114)
>>> [ 26.571006][ C0] __run_timer_base (kernel/time/timer.c:2385)
>>> [ 26.571014][ C0] run_timer_base (kernel/time/timer.c:2394)
>>> [ 26.571021][ C0] run_timer_softirq
>>> (arch/x86/include/asm/atomic.h:23 include/linux/atomic/atomic-arch-
>>> fallback.h:457 include/linux/jump_label.h:262
>>> kernel/time/timer.c:342 kernel/time/timer.c:2406)
>>> [ 26.571028][ C0] handle_softirqs (arch/x86/include/asm/atomic.h:23
>>> include/linux/atomic/atomic-arch-fallback.h:457
>>> include/linux/jump_label.h:262 include/trace/events/irq.h:142
>>> kernel/softirq.c:580)
>>> [ 26.571039][ C0] __do_softirq (kernel/softirq.c:614)
>>> [ 26.571046][ C0] __irq_exit_rcu (kernel/softirq.c:453
>>> kernel/softirq.c:680)
>>> [ 26.571055][ C0] irq_exit_rcu (kernel/softirq.c:698)
>>> [ 26.571064][ C0] sysvec_apic_timer_interrupt
>>> (arch/x86/kernel/apic/apic.c:1050 arch/x86/kernel/apic/apic.c:1050)
>>> [   26.571076][    C0]  </IRQ>
>>> [   26.571078][    C0]  <TASK>
>>> [ 26.571081][ C0] asm_sysvec_apic_timer_interrupt
>>> (arch/x86/include/asm/idtentry.h:574)
>>> [ 26.571088][ C0] RIP: 0010:d_alloc (fs/dcache.c:1778)
>>> [ 26.571100][ C0] Code: 8d 7c 24 50 b8 ff ff 37 00 ff 83 f8 00 00
>>> 00 48 89 fa 48 c1 e0 2a 48 c1 ea 03 80 3c 02 00 74 05 e8 5f f3 f6
>>> ff 49 89 5c 24 50 <49> 8d bc 24 10 01 00 00 48 8d b3 20 01 00 00 e8
>>> 87 bc ff ff 4c 89
>>> All code
>>> ========
>>>      0:	8d 7c 24 50          	lea    0x50(%rsp),%edi
>>>      4:	b8 ff ff 37 00       	mov    $0x37ffff,%eax
>>>      9:	ff 83 f8 00 00 00    	incl   0xf8(%rbx)
>>>      f:	48 89 fa             	mov    %rdi,%rdx
>>>     12:	48 c1 e0 2a          	shl    $0x2a,%rax
>>>     16:	48 c1 ea 03          	shr    $0x3,%rdx
>>>     1a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
>>>     1e:	74 05                	je     0x25
>>>     20:	e8 5f f3 f6 ff       	call   0xfffffffffff6f384
>>>     25:	49 89 5c 24 50       	mov    %rbx,0x50(%r12)
>>>     2a:*	49 8d bc 24 10 01 00 	lea
>>> 0x110(%r12),%rdi		<-- trapping instruction
>>>     31:	00
>>>     32:	48 8d b3 20 01 00 00 	lea    0x120(%rbx),%rsi
>>>     39:	e8 87 bc ff ff       	call   0xffffffffffffbcc5
>>>     3e:	4c                   	rex.WR
>>>     3f:	89                   	.byte 0x89
>>>
>>> Code starting with the faulting instruction
>>> ===========================================
>>>      0:	49 8d bc 24 10 01 00 	lea    0x110(%r12),%rdi
>>>      7:	00
>>>      8:	48 8d b3 20 01 00 00 	lea    0x120(%rbx),%rsi
>>>      f:	e8 87 bc ff ff       	call   0xffffffffffffbc9b
>>>     14:	4c                   	rex.WR
>>>     15:	89                   	.byte 0x89
>>>
>>>
>>> The kernel config and materials to reproduce are available at:
>>> https://download.01.org/0day-ci/archive/20250710/202507100606.90787fe6-lkp@intel.com
>>>
>>>
>>>
>>
> 


-- 
Mathieu Desnoyers
EfficiOS Inc.
https://www.efficios.com

Re: [PATCH v14 2/3] sched: Move task_mm_cid_work to mm timer

[Gabriele Monaco]

On Thu, 2025-07-10 at 12:56 +0800, kernel test robot wrote:
> 
> 
> Hello,
> 
> kernel test robot noticed "WARNING:inconsistent_lock_state" on:
> 
> commit: d06e66c6025e44136e6715d24c23fb821a415577 ("[PATCH v14 2/3]
> sched: Move task_mm_cid_work to mm timer")
> url:
> https://github.com/intel-lab-lkp/linux/commits/Gabriele-Monaco/sched-Add-prev_sum_exec_runtime-support-for-RT-DL-and-SCX-classes/20250707-224959
> patch link:
> https://lore.kernel.org/all/20250707144824.117014-3-gmonaco@redhat.com/
> patch subject: [PATCH v14 2/3] sched: Move task_mm_cid_work to mm
> timer
> 
> in testcase: boot
> 

It seems calling mmdrop in task_mm_cid_scan (previously
task_mm_cid_work) is not safe in some configurations as it runs from
softirq.

There are solutions to this (mmdrop asynchronously or find another way
to make sure the work runs with a valid mm), but this is getting
unnecessarily complicated.

I am going to proceed with the alternative approach of running the scan
in batches [1] by integrating the findings in this series for more
predictability but still using a task_work.

[1] -
https://lore.kernel.org/lkml/20250217112317.258716-1-gmonaco@redhat.com

Thanks,
Gabriele

> config: x86_64-randconfig-003-20250708
> compiler: gcc-11
> test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2
> -m 16G
> 
> (please refer to attached dmesg/kmsg for entire log/backtrace)
> 
> 
> +-------------------------------------------------+------------+-----
> -------+
> >                                                 | 50c1dc07ee |
> > d06e66c602 |
> +-------------------------------------------------+------------+-----
> -------+
> > WARNING:inconsistent_lock_state                 | 0          |
> > 12         |
> > inconsistent{SOFTIRQ-ON-W}->{IN-SOFTIRQ-W}usage | 0          |
> > 12         |
> +-------------------------------------------------+------------+-----
> -------+
> 
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new
> version of
> the same patch/commit), kindly add following tags
> > Reported-by: kernel test robot <oliver.sang@intel.com>
> > Closes:
> > https://lore.kernel.org/oe-lkp/202507100606.90787fe6-lkp@intel.com
> 
> 
> [   26.556715][    C0] WARNING: inconsistent lock state
> [   26.557127][    C0] 6.16.0-rc5-00002-gd06e66c6025e #1 Tainted:
> G                T
> [   26.557730][    C0] --------------------------------
> [   26.558133][    C0] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W}
> usage.
> [   26.558662][    C0] stdbuf/386 [HC0[0]:SC1[1]:HE1:SE0] takes:
> [ 26.559118][ C0] ffffffff870d4438 (pgd_lock){+.?.}-{3:3}, at:
> pgd_free (arch/x86/mm/pgtable.c:67 arch/x86/mm/pgtable.c:98
> arch/x86/mm/pgtable.c:379) 
> [   26.559786][    C0] {SOFTIRQ-ON-W} state was registered at:
> [ 26.560232][ C0] mark_usage (kernel/locking/lockdep.c:4669) 
> [ 26.560561][ C0] __lock_acquire (kernel/locking/lockdep.c:5194) 
> [ 26.560929][ C0] lock_acquire (kernel/locking/lockdep.c:473
> kernel/locking/lockdep.c:5873) 
> [ 26.561267][ C0] _raw_spin_lock
> (include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) 
> [ 26.561617][ C0] pgd_alloc (arch/x86/mm/pgtable.c:86
> arch/x86/mm/pgtable.c:353) 
> [ 26.561950][ C0] mm_init+0x64f/0xbfb 
> [ 26.562342][ C0] mm_alloc (kernel/fork.c:1109) 
> [ 26.562655][ C0] dma_resv_lockdep (drivers/dma-buf/dma-resv.c:784) 
> [ 26.563020][ C0] do_one_initcall (init/main.c:1274) 
> [ 26.563389][ C0] do_initcalls (init/main.c:1335 init/main.c:1352) 
> [ 26.563744][ C0] kernel_init_freeable (init/main.c:1588) 
> [ 26.564144][ C0] kernel_init (init/main.c:1476) 
> [ 26.564402][ C0] ret_from_fork (arch/x86/kernel/process.c:154) 
> [ 26.564633][ C0] ret_from_fork_asm (arch/x86/entry/entry_64.S:258) 
> [   26.564871][    C0] irq event stamp: 4774
> [ 26.565070][ C0] hardirqs last enabled at (4774):
> _raw_spin_unlock_irq (arch/x86/include/asm/irqflags.h:42
> arch/x86/include/asm/irqflags.h:119
> include/linux/spinlock_api_smp.h:159 kernel/locking/spinlock.c:202) 
> [ 26.565526][ C0] hardirqs last disabled at (4773):
> _raw_spin_lock_irq (arch/x86/include/asm/preempt.h:80
> include/linux/spinlock_api_smp.h:118 kernel/locking/spinlock.c:170) 
> [ 26.565971][ C0] softirqs last enabled at (4256): local_bh_enable
> (include/linux/bottom_half.h:33) 
> [ 26.566408][ C0] softirqs last disabled at (4771): __do_softirq
> (kernel/softirq.c:614) 
> [   26.566823][    C0]
> [   26.566823][    C0] other info that might help us debug this:
> [   26.567198][    C0]  Possible unsafe locking scenario:
> [   26.567198][    C0]
> [   26.567548][    C0]        CPU0
> [   26.567709][    C0]        ----
> [   26.567869][    C0]   lock(pgd_lock);
> [   26.568060][    C0]   <Interrupt>
> [   26.568255][    C0]     lock(pgd_lock);
> [   26.568452][    C0]
> [   26.568452][    C0]  *** DEADLOCK ***
> [   26.568452][    C0]
> [   26.568830][    C0] 3 locks held by stdbuf/386:
> [ 26.569056][ C0] #0: ffff888170d5c1a8 (&sb->s_type-
> >i_mutex_key){++++}-{4:4}, at: lookup_slow (fs/namei.c:1834) 
> [ 26.569535][ C0] #1: ffff888170cf5850 (&lockref->lock){+.+.}-{3:3},
> at: d_alloc (include/linux/dcache.h:319 fs/dcache.c:1777) 
> [ 26.569961][ C0] #2: ffffc90000007d40 ((&mm->cid_timer)){+.-.}-
> {0:0}, at: call_timer_fn (kernel/time/timer.c:1744) 
> [   26.570421][    C0]
> [   26.570421][    C0] stack backtrace:
> [   26.570704][    C0] CPU: 0 UID: 0 PID: 386 Comm: stdbuf Tainted:
> G                T   6.16.0-rc5-00002-gd06e66c6025e #1
> PREEMPT(voluntary)  39c5cbdaf5b4eb171776daa7d42daa95c0766676
> [   26.570716][    C0] Tainted: [T]=RANDSTRUCT
> [   26.570719][    C0] Call Trace:
> [   26.570723][    C0]  <IRQ>
> [ 26.570727][ C0] dump_stack_lvl (lib/dump_stack.c:122 (discriminator
> 4)) 
> [ 26.570735][ C0] dump_stack (lib/dump_stack.c:130) 
> [ 26.570740][ C0] print_usage_bug (kernel/locking/lockdep.c:4047) 
> [ 26.570748][ C0] valid_state (kernel/locking/lockdep.c:4060) 
> [ 26.570755][ C0] mark_lock_irq (kernel/locking/lockdep.c:4270) 
> [ 26.570762][ C0] ? save_trace (kernel/locking/lockdep.c:592) 
> [ 26.570773][ C0] ? mark_lock (kernel/locking/lockdep.c:4728
> (discriminator 3)) 
> [ 26.570780][ C0] mark_lock (kernel/locking/lockdep.c:4756) 
> [ 26.570787][ C0] mark_usage (kernel/locking/lockdep.c:4645) 
> [ 26.570796][ C0] __lock_acquire (kernel/locking/lockdep.c:5194) 
> [ 26.570804][ C0] lock_acquire (kernel/locking/lockdep.c:473
> kernel/locking/lockdep.c:5873) 
> [ 26.570811][ C0] ? pgd_free (arch/x86/mm/pgtable.c:67
> arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379) 
> [ 26.570822][ C0] ? validate_chain (kernel/locking/lockdep.c:3826
> kernel/locking/lockdep.c:3879) 
> [ 26.570828][ C0] ? wake_up_new_task (kernel/sched/core.c:10597) 
> [ 26.570839][ C0] _raw_spin_lock
> (include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) 
> [ 26.570845][ C0] ? pgd_free (arch/x86/mm/pgtable.c:67
> arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379) 
> [ 26.570854][ C0] pgd_free (arch/x86/mm/pgtable.c:67
> arch/x86/mm/pgtable.c:98 arch/x86/mm/pgtable.c:379) 
> [ 26.570863][ C0] ? wake_up_new_task (kernel/sched/core.c:10597) 
> [ 26.570873][ C0] __mmdrop (kernel/fork.c:681) 
> [ 26.570882][ C0] ? wake_up_new_task (kernel/sched/core.c:10597) 
> [ 26.570891][ C0] mmdrop (include/linux/sched/mm.h:55) 
> [ 26.570901][ C0] task_mm_cid_scan (kernel/sched/core.c:10619
> (discriminator 3)) 
> [ 26.570910][ C0] ? lock_is_held (include/linux/lockdep.h:249) 
> [ 26.570918][ C0] ? wake_up_new_task (kernel/sched/core.c:10597) 
> [ 26.570928][ C0] call_timer_fn (arch/x86/include/asm/atomic.h:23
> include/linux/atomic/atomic-arch-fallback.h:457
> include/linux/jump_label.h:262 include/trace/events/timer.h:127
> kernel/time/timer.c:1748) 
> [ 26.570935][ C0] ? trace_timer_base_idle (kernel/time/timer.c:1724) 
> [ 26.570943][ C0] ? wake_up_new_task (kernel/sched/core.c:10597) 
> [ 26.570953][ C0] ? wake_up_new_task (kernel/sched/core.c:10597) 
> [ 26.570962][ C0] __run_timers (kernel/time/timer.c:1799
> kernel/time/timer.c:2372) 
> [ 26.570970][ C0] ? add_timer_global (kernel/time/timer.c:2343) 
> [ 26.570977][ C0] ? __kasan_check_write (mm/kasan/shadow.c:38) 
> [ 26.570988][ C0] ? do_raw_spin_lock
> (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-
> fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302
> include/asm-generic/qspinlock.h:111
> kernel/locking/spinlock_debug.c:116) 
> [ 26.570996][ C0] ? __raw_spin_lock_init
> (kernel/locking/spinlock_debug.c:114) 
> [ 26.571006][ C0] __run_timer_base (kernel/time/timer.c:2385) 
> [ 26.571014][ C0] run_timer_base (kernel/time/timer.c:2394) 
> [ 26.571021][ C0] run_timer_softirq (arch/x86/include/asm/atomic.h:23
> include/linux/atomic/atomic-arch-fallback.h:457
> include/linux/jump_label.h:262 kernel/time/timer.c:342
> kernel/time/timer.c:2406) 
> [ 26.571028][ C0] handle_softirqs (arch/x86/include/asm/atomic.h:23
> include/linux/atomic/atomic-arch-fallback.h:457
> include/linux/jump_label.h:262 include/trace/events/irq.h:142
> kernel/softirq.c:580) 
> [ 26.571039][ C0] __do_softirq (kernel/softirq.c:614) 
> [ 26.571046][ C0] __irq_exit_rcu (kernel/softirq.c:453
> kernel/softirq.c:680) 
> [ 26.571055][ C0] irq_exit_rcu (kernel/softirq.c:698) 
> [ 26.571064][ C0] sysvec_apic_timer_interrupt
> (arch/x86/kernel/apic/apic.c:1050 arch/x86/kernel/apic/apic.c:1050) 
> [   26.571076][    C0]  </IRQ>
> [   26.571078][    C0]  <TASK>
> [ 26.571081][ C0] asm_sysvec_apic_timer_interrupt
> (arch/x86/include/asm/idtentry.h:574) 
> [ 26.571088][ C0] RIP: 0010:d_alloc (fs/dcache.c:1778) 
> [ 26.571100][ C0] Code: 8d 7c 24 50 b8 ff ff 37 00 ff 83 f8 00 00 00
> 48 89 fa 48 c1 e0 2a 48 c1 ea 03 80 3c 02 00 74 05 e8 5f f3 f6 ff 49
> 89 5c 24 50 <49> 8d bc 24 10 01 00 00 48 8d b3 20 01 00 00 e8 87 bc
> ff ff 4c 89
> All code
> ========
>    0:	8d 7c 24 50          	lea    0x50(%rsp),%edi
>    4:	b8 ff ff 37 00       	mov    $0x37ffff,%eax
>    9:	ff 83 f8 00 00 00    	incl   0xf8(%rbx)
>    f:	48 89 fa             	mov    %rdi,%rdx
>   12:	48 c1 e0 2a          	shl    $0x2a,%rax
>   16:	48 c1 ea 03          	shr    $0x3,%rdx
>   1a:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
>   1e:	74 05                	je     0x25
>   20:	e8 5f f3 f6 ff       	call   0xfffffffffff6f384
>   25:	49 89 5c 24 50       	mov    %rbx,0x50(%r12)
>   2a:*	49 8d bc 24 10 01 00 	lea   
> 0x110(%r12),%rdi		<-- trapping instruction
>   31:	00 
>   32:	48 8d b3 20 01 00 00 	lea    0x120(%rbx),%rsi
>   39:	e8 87 bc ff ff       	call   0xffffffffffffbcc5
>   3e:	4c                   	rex.WR
>   3f:	89                   	.byte 0x89
> 
> Code starting with the faulting instruction
> ===========================================
>    0:	49 8d bc 24 10 01 00 	lea    0x110(%r12),%rdi
>    7:	00 
>    8:	48 8d b3 20 01 00 00 	lea    0x120(%rbx),%rsi
>    f:	e8 87 bc ff ff       	call   0xffffffffffffbc9b
>   14:	4c                   	rex.WR
>   15:	89                   	.byte 0x89
> 
> 
> The kernel config and materials to reproduce are available at:
> https://download.01.org/0day-ci/archive/20250710/202507100606.90787fe6-lkp@intel.com
> 
> 

[PATCH v14 3/3] selftests/rseq: Add test for mm_cid compaction

[Gabriele Monaco]

A task in the kernel (task_mm_cid_work) runs somewhat periodically to
compact the mm_cid for each process. Add a test to validate that it runs
correctly and timely.

The test spawns 1 thread pinned to each CPU, then each thread, including
the main one, runs in short bursts for some time. During this period, the
mm_cids should be spanning all numbers between 0 and nproc.

At the end of this phase, a thread with high enough mm_cid (>= nproc/2)
is selected to be the new leader, all other threads terminate.

After some time, the only running thread should see 0 as mm_cid, if that
doesn't happen, the compaction mechanism didn't work and the test fails.

The test never fails if only 1 core is available, in which case, we
cannot test anything as the only available mm_cid is 0.

Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Acked-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Gabriele Monaco <gmonaco@redhat.com>
---
 tools/testing/selftests/rseq/.gitignore       |   1 +
 tools/testing/selftests/rseq/Makefile         |   2 +-
 .../selftests/rseq/mm_cid_compaction_test.c   | 200 ++++++++++++++++++
 3 files changed, 202 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/rseq/mm_cid_compaction_test.c

diff --git a/tools/testing/selftests/rseq/.gitignore b/tools/testing/selftests/rseq/.gitignore
index 0fda241fa62b0..b3920c59bf401 100644
--- a/tools/testing/selftests/rseq/.gitignore
+++ b/tools/testing/selftests/rseq/.gitignore
@@ -3,6 +3,7 @@ basic_percpu_ops_test
 basic_percpu_ops_mm_cid_test
 basic_test
 basic_rseq_op_test
+mm_cid_compaction_test
 param_test
 param_test_benchmark
 param_test_compare_twice
diff --git a/tools/testing/selftests/rseq/Makefile b/tools/testing/selftests/rseq/Makefile
index 0d0a5fae59547..bc4d940f66d40 100644
--- a/tools/testing/selftests/rseq/Makefile
+++ b/tools/testing/selftests/rseq/Makefile
@@ -17,7 +17,7 @@ OVERRIDE_TARGETS = 1
 TEST_GEN_PROGS = basic_test basic_percpu_ops_test basic_percpu_ops_mm_cid_test param_test \
 		param_test_benchmark param_test_compare_twice param_test_mm_cid \
 		param_test_mm_cid_benchmark param_test_mm_cid_compare_twice \
-		syscall_errors_test
+		syscall_errors_test mm_cid_compaction_test
 
 TEST_GEN_PROGS_EXTENDED = librseq.so
 
diff --git a/tools/testing/selftests/rseq/mm_cid_compaction_test.c b/tools/testing/selftests/rseq/mm_cid_compaction_test.c
new file mode 100644
index 0000000000000..7ddde3b657dd6
--- /dev/null
+++ b/tools/testing/selftests/rseq/mm_cid_compaction_test.c
@@ -0,0 +1,200 @@
+// SPDX-License-Identifier: LGPL-2.1
+#define _GNU_SOURCE
+#include <assert.h>
+#include <pthread.h>
+#include <sched.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stddef.h>
+
+#include "../kselftest.h"
+#include "rseq.h"
+
+#define VERBOSE 0
+#define printf_verbose(fmt, ...)                    \
+	do {                                        \
+		if (VERBOSE)                        \
+			printf(fmt, ##__VA_ARGS__); \
+	} while (0)
+
+/* 0.5 s */
+#define RUNNER_PERIOD 500000
+/* Number of runs before we terminate or get the token */
+#define THREAD_RUNS 5
+
+/*
+ * Number of times we check that the mm_cid were compacted.
+ * Checks are repeated every RUNNER_PERIOD.
+ */
+#define MM_CID_COMPACT_TIMEOUT 10
+
+struct thread_args {
+	int cpu;
+	int num_cpus;
+	pthread_mutex_t *token;
+	pthread_barrier_t *barrier;
+	pthread_t *tinfo;
+	struct thread_args *args_head;
+};
+
+static void __noreturn *thread_runner(void *arg)
+{
+	struct thread_args *args = arg;
+	int i, ret, curr_mm_cid;
+	cpu_set_t cpumask;
+
+	CPU_ZERO(&cpumask);
+	CPU_SET(args->cpu, &cpumask);
+	ret = pthread_setaffinity_np(pthread_self(), sizeof(cpumask), &cpumask);
+	if (ret) {
+		errno = ret;
+		perror("Error: failed to set affinity");
+		abort();
+	}
+	pthread_barrier_wait(args->barrier);
+
+	for (i = 0; i < THREAD_RUNS; i++)
+		usleep(RUNNER_PERIOD);
+	curr_mm_cid = rseq_current_mm_cid();
+	/*
+	 * We select one thread with high enough mm_cid to be the new leader.
+	 * All other threads (including the main thread) will terminate.
+	 * After some time, the mm_cid of the only remaining thread should
+	 * converge to 0, if not, the test fails.
+	 */
+	if (curr_mm_cid >= args->num_cpus / 2 &&
+	    !pthread_mutex_trylock(args->token)) {
+		printf_verbose(
+			"cpu%d has mm_cid=%d and will be the new leader.\n",
+			sched_getcpu(), curr_mm_cid);
+		for (i = 0; i < args->num_cpus; i++) {
+			if (args->tinfo[i] == pthread_self())
+				continue;
+			ret = pthread_join(args->tinfo[i], NULL);
+			if (ret) {
+				errno = ret;
+				perror("Error: failed to join thread");
+				abort();
+			}
+		}
+		pthread_barrier_destroy(args->barrier);
+		free(args->tinfo);
+		free(args->token);
+		free(args->barrier);
+		free(args->args_head);
+
+		for (i = 0; i < MM_CID_COMPACT_TIMEOUT; i++) {
+			curr_mm_cid = rseq_current_mm_cid();
+			printf_verbose("run %d: mm_cid=%d on cpu%d.\n", i,
+				       curr_mm_cid, sched_getcpu());
+			if (curr_mm_cid == 0)
+				exit(EXIT_SUCCESS);
+			usleep(RUNNER_PERIOD);
+		}
+		exit(EXIT_FAILURE);
+	}
+	printf_verbose("cpu%d has mm_cid=%d and is going to terminate.\n",
+		       sched_getcpu(), curr_mm_cid);
+	pthread_exit(NULL);
+}
+
+int test_mm_cid_compaction(void)
+{
+	cpu_set_t affinity;
+	int i, j, ret = 0, num_threads;
+	pthread_t *tinfo;
+	pthread_mutex_t *token;
+	pthread_barrier_t *barrier;
+	struct thread_args *args;
+
+	sched_getaffinity(0, sizeof(affinity), &affinity);
+	num_threads = CPU_COUNT(&affinity);
+	tinfo = calloc(num_threads, sizeof(*tinfo));
+	if (!tinfo) {
+		perror("Error: failed to allocate tinfo");
+		return -1;
+	}
+	args = calloc(num_threads, sizeof(*args));
+	if (!args) {
+		perror("Error: failed to allocate args");
+		ret = -1;
+		goto out_free_tinfo;
+	}
+	token = malloc(sizeof(*token));
+	if (!token) {
+		perror("Error: failed to allocate token");
+		ret = -1;
+		goto out_free_args;
+	}
+	barrier = malloc(sizeof(*barrier));
+	if (!barrier) {
+		perror("Error: failed to allocate barrier");
+		ret = -1;
+		goto out_free_token;
+	}
+	if (num_threads == 1) {
+		fprintf(stderr, "Cannot test on a single cpu. "
+				"Skipping mm_cid_compaction test.\n");
+		/* only skipping the test, this is not a failure */
+		goto out_free_barrier;
+	}
+	pthread_mutex_init(token, NULL);
+	ret = pthread_barrier_init(barrier, NULL, num_threads);
+	if (ret) {
+		errno = ret;
+		perror("Error: failed to initialise barrier");
+		goto out_free_barrier;
+	}
+	for (i = 0, j = 0; i < CPU_SETSIZE && j < num_threads; i++) {
+		if (!CPU_ISSET(i, &affinity))
+			continue;
+		args[j].num_cpus = num_threads;
+		args[j].tinfo = tinfo;
+		args[j].token = token;
+		args[j].barrier = barrier;
+		args[j].cpu = i;
+		args[j].args_head = args;
+		if (!j) {
+			/* The first thread is the main one */
+			tinfo[0] = pthread_self();
+			++j;
+			continue;
+		}
+		ret = pthread_create(&tinfo[j], NULL, thread_runner, &args[j]);
+		if (ret) {
+			errno = ret;
+			perror("Error: failed to create thread");
+			abort();
+		}
+		++j;
+	}
+	printf_verbose("Started %d threads.\n", num_threads);
+
+	/* Also main thread will terminate if it is not selected as leader */
+	thread_runner(&args[0]);
+
+	/* only reached in case of errors */
+out_free_barrier:
+	free(barrier);
+out_free_token:
+	free(token);
+out_free_args:
+	free(args);
+out_free_tinfo:
+	free(tinfo);
+
+	return ret;
+}
+
+int main(int argc, char **argv)
+{
+	if (!rseq_mm_cid_available()) {
+		fprintf(stderr, "Error: rseq_mm_cid unavailable\n");
+		return -1;
+	}
+	if (test_mm_cid_compaction())
+		return -1;
+	return 0;
+}
-- 
2.50.0