On Thu, Jun 17, 2021, at 2:28 AM, Peter Zijlstra wrote:
> On Thu, Jun 17, 2021 at 11:08:03AM +0200, Peter Zijlstra wrote:
>
> > diff --git a/kernel/fork.c b/kernel/fork.c
> > index e595e77913eb..57415cca088c 100644
> > --- a/kernel/fork.c
> > +++ b/kernel/fork.c
> > @@ -1104,6 +1104,8 @@ static inline void __mmput(struct mm_struct *mm)
> > }
> > if (mm->binfmt)
> > module_put(mm->binfmt->module);
> > +
> > + mm_unlazy_mm_count(mm);
> > mmdrop(mm);
> > }
> >
> > diff --git a/kernel/sched/core.c b/kernel/sched/core.c
> > index 8ac693d542f6..e102ec53c2f6 100644
> > --- a/kernel/sched/core.c
> > +++ b/kernel/sched/core.c
> > @@ -19,6 +19,7 @@
>
> > +/*
> > + * This converts all lazy_mm references to mm to mm_count refcounts. Our
> > + * caller holds an mm_count reference, so we don't need to worry about mm
> > + * being freed out from under us.
> > + */
> > +void mm_unlazy_mm_count(struct mm_struct *mm)
> > +{
> > + unsigned int drop_count = num_possible_cpus();
> > + int cpu;
> > +
> > + /*
> > + * mm_users is zero, so no cpu will set its rq->lazy_mm to mm.
> > + */
> > + WARN_ON_ONCE(atomic_read(&mm->mm_users) != 0);
> > +
> > + /* Grab enough references for the rest of this function. */
> > + atomic_add(drop_count, &mm->mm_count);
>
> So that had me puzzled for a little while. Would something like this be
> a better comment?
>
> /*
> * Because this can race with mmdrop_lazy(), mm_count must be
> * incremented before setting any rq->drop_mm value, otherwise
> * it is possible to free mm early.
> */
Nope, because the caller already did it. It's an optimization, but maybe it's a poorly done optimization -- I'd rather do two atomic ops than many.
How about:
drop_count = 0;
...
if (!drop_count) {
/* Collect lots of references. We'll drop the ones we don't use. */
drop_count = num_possible_cpus();
atomic_inc(drop_count, &->mm_count);
}
drop_count--;
