aboutsummaryrefslogtreecommitdiffstats
path: root/kernel/rcu
AgeCommit message (Collapse)AuthorFilesLines
2026-08-23Merge tag 'rcu.2026.08.18a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linuxLinus Torvalds16-401/+878
Pull RCU updates from Paul McKenney: "Make expedited grace periods expedite normal RCU callbacks Miscellaneous fixes: - Improve diagnostic output with character task states - Mark accesses to inform KCSAN of concurrency design - Move from kmalloc() to kmalloc_obj() - Documentation updates - Improve handling of RCU deferred quiescent states - Clean up unused function arguments and structure fields - Reduce show_rcu_gp_kthreads() stack space Tasks RCU updates: - Clean up after SRCU re-implementation of Tasks Trace RCU - Mark accesses to inform KCSAN of concurrency design - Add ->lazy_timer status to diagnostic output - Remove an unnecessary memory barrier - Fix a data race, courtesy of KCSAN - Documentation updates - Convert cond_resched_tasks_rcu_qs() from macro to static inline function SRCU updates: - Add Rust helpers for SRCU - Avoid losing queued work at cleanup_srcu_struct() time Torture-test updates: - Preparation work for immediate RCU priority deboosting - Test RCU readers from real interrupt handlers (as opposed to softirq) - Simplify code through use of cpumask_next_wrap() - Improve diagnostic output with character task states - Add rcutorture.nwriters parameter to allow lightweight stall testing, and rcutorture.stall_only to make doing so easier - Test an RCU Tasks Trace grace period implying an RCU grace period - Make RCU Tasks Trace torturing track reader batches - Fix a data race, courtesy of KCSAN - Plug a shuffle_tmp_mask memory leak on kthread spawn failure" * tag 'rcu.2026.08.18a' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: (59 commits) rcu: Add closing parenthesis in comment in rcu_read_unlock_strict() rcutorture: Make {,s}rcu_read_delay() better handle forward-progress testing rcutorture: Announce declining to forward-progress test torture: Don't leak shuffle_tmp_mask when shuffler kthread fails to start rcutorture: Use this_cpu_inc() for rcu_torture_count[] and rcu_torture_batch[] rcutorture: Make RCU Tasks Trace track Reader Batches rcutorture: Test RCU Tasks Trace GP implying RCU GP rcutorture: Add a stall_only module parameter rcutorture: Add nwriters module parameter rcutorture: Use task_state_to_char() for task-state reporting rcutorture: Use cpumask_next_wrap() in rcu_torture_preempt() rcutorture: Test RCU readers from hardware interrupt handlers rcutorture: Check for immediate deboosting at reader end srcu: Queue sdp->work when the delay timer is successfully deleted rcu-tasks: Convert cond_resched_tasks_rcu_qs() to static inline rcu-tasks: Fix some comments for call_rcu_tasks() and call_rcu_tasks_rude() rcu-tasks: Rename tasks_rcu_exit_srcu_stall_timer to tasks_rcu_exit_stall_timer rcu: Mark interrupts-enabled accesses to rdp->cpu_no_qs.s rcu: Reduce stack usage in show_rcu_gp_kthreads() rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs ...
2026-08-14Merge branches 'expcb.2026.07.24a', 'misc.2026.07.30a', 'rcu-tasks.2026.07.30a', 'srcu.2026.08.11a' and 'torture.2026.08.14a' into HEADPaul E. McKenney12-228/+438
Changes: Make expedited grace periods expedite normal RCU callbacks Miscellaneous fixes: * Improve diagnostic output with character task states. * Mark accesses to inform KCSAN of concurrency design. * Move from kmalloc() to kmalloc_obj(). * Documentation updates. * Improve handling of RCU deferred quiescent states. * Clean up unused function arguments and structure fields. * Reduce show_rcu_gp_kthreads() stack space. Tasks RCU updates: * Clean up after SRCU re-implementation of Tasks Trace RCU. * Mark accesses to inform KCSAN of concurrency design. * Add ->lazy_timer status to diagnostic output. * Remove an unnecessary memory barrier. * Fix a data race, courtesy of KCSAN. * Documentation updates. * Convert cond_resched_tasks_rcu_qs() from macro to static inline function. SRCU updates: * Add Rust helpers for SRCU. * Avoid losing queued work at cleanup_srcu_struct() time. Torture-test updates: * Preparation work for immediate RCU priority deboosting. * Test RCU readers from real interrupt handlers (as opposed to softirq). * Simplify code through use of cpumask_next_wrap(). * Improve diagnostic output with character task states. * Add rcutorture.nwriters parameter to allow lightweight stall testing, and rcutorture.stall_only to make doing so easier. * Test an RCU Tasks Trace grace period implying an RCU grace period. * Make RCU Tasks Trace torturing track reader batches. * Fix a data race, courtesy of KCSAN. * Plug a shuffle_tmp_mask memory leak on kthread spawn failure.
2026-08-14rcu: Add closing parenthesis in comment in rcu_read_unlock_strict()Paul E. McKenney1-1/+1
This comment is missing a closing parenthesis: * The in_atomic_preempt_off() check ensures that we come here holding * the last preempt_count (which will get dropped once we return to * __rcu_read_unlock(). This commit therefore adds it at the end of the sentence. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Make {,s}rcu_read_delay() better handle forward-progress testingPaul E. McKenney1-5/+11
The rcu_read_delay() and srcu_read_delay() functions are suppose to avoid (or at least to minimize) read-side delays during call_rcu()-based forward-progress testing. Although rcu_read_delay() does account for this by testing rcu_fwd_cb_nodelay, it only does so in some cases, and srcu_read_delay() does not bother at all. And rcutorture testing does occasionally turn up the MIN_FWD_CBS_LAUNDERED failure when running forward-progress tests on Tree SRCU flavors. This commit therefore makes both rcu_read_delay() and srcu_read_delay() take an immediate exit if rcu_fwd_cb_nodelay is set. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Announce declining to forward-progress testPaul E. McKenney1-3/+7
Currently, rcu_torture_fwd_prog_cr() announces function entry, but silently exits if rcu_fwd_emergency_stop is set or if there is no ->call() function available. This could cause confusion, leading people to believe that rcu_torture_fwd_prog_cr() is on the job when it is not. This commit therefore also announces the early exits from this function. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Use this_cpu_inc() for rcu_torture_count[] and rcu_torture_batch[]Paul E. McKenney1-2/+2
Currently __this_cpu_inc() is used to increment elements of both the rcu_torture_count[] and rcu_torture_batch[] arrays. However, this can fail when the increments can happen in interrupt handlers, as recently became possible. This commit therefore upgrades the uses of __this_cpu_inc() to the interrupt-safe this_cpu_inc(). KCSAN located this issue. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Make RCU Tasks Trace track Reader BatchesPaul E. McKenney2-1/+8
This commit adds the ->get_sp_seq and ->gp_diff fields to the tasks_tracing_ops structure so that RCU Tasks Trace rcutorture runs will track Reader Batch. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Test RCU Tasks Trace GP implying RCU GPPaul E. McKenney1-6/+16
An RCU Tasks Trace grace period is supposed to imply an RCU grace period, and this implication is relied on by BPF. But this is not currently tested. This commit therefore makes tasks_tracing_torture_read_lock() sometimes use rcu_read_lock() instead of rcu_read_lock_trace(), thus testing the required implication. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Add a stall_only module parameterPaul E. McKenney1-0/+18
This commit adds a stall_only module parameter that shuts off all rcutorture kthreads other than the RCU CPU stall-warning test kthreads. The purpose of this is to test production applictions' reactions to CPU stalls, and with minimal additional overhead. Or you can omit the stall-warning tests as well and get a heavy no-op, your choice! Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Add nwriters module parameterPaul E. McKenney1-6/+8
Believe it or not, there are people who would like to run rcutorture without actually torturing RCU. For example, some people would like to induce various types of stall warnings without placing any unnecessary additional overhead on their systems running in production. And rcutorture provides the stall_cpu, stall_cpu_holdoff, stall_no_softlockup, stall_cpu_irqsoff, stall_cpu_block, and stall_cpu_repeat module parameters in order to allow the user to force numerous types of stalls. In addition, rcutorture provides a great number of other module parameters to allow the user to reduce other overhead. But unfortunately, there is no way to turn of the rcu_torture_writer() portion of this torture test, which on my x86 laptop consumes somewhere between 40% and 45% of a CPU. Although this is quite lightweight for a torture test, it is not welcome on systems running production workloads. This commit therefore adds an nwriters module parameter that defaults to 1 but can be set to 0 in order to disable the rcu_torture_writer() portion of the torture test, but that cannot be set to any other value (that is what the fakewriters module parameter is for!). This reduces the overhead to well under 1% of a CPU, which is much more likely to be compatible with production workloads. Reported-by: Breno Leitao <leitao@debian.org> Reported-by: Puranjay Mohan <puranjay@kernel.org> Reported-by: Usama Arif <usama.arif@linux.dev> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Use task_state_to_char() for task-state reportingKunwu Chan1-2/+2
Use the kernel's standard symbolic task-state representation instead of printing raw hexadecimal task-state values. Suggested-by: Zqiang <qiang.zhang@linux.dev> Co-developed-by: Wang Lian <lianux.mm@gmail.com> Signed-off-by: Wang Lian <lianux.mm@gmail.com> Signed-off-by: Kunwu Chan <kunwu.chan@gmail.com> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Use cpumask_next_wrap() in rcu_torture_preempt()Paul E. McKenney1-3/+1
The rcu_torture_preempt() function uses cpumask_next(), and if that returns an out-of-bounds result, re-invokes cpumask_next() on -1. Which is exactly what cpumask_next_wrap() does. This commit therefore saves a couple of lines by instead using cpumask_next_wrap(). This was reported by metacode when asked to look for opportunities to use cpumask_next_wrap() in kernel/rcu. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Test RCU readers from hardware interrupt handlersPaul E. McKenney1-6/+71
Although rcutorture has long had the irqreader module parameter, this parameter results only in RCU readers in softirq handlers, specifically, timers. This commit therefore uses smp_call_function_single() to test RCU readers in real hardware interrupt handlers, thus providing the full effect from the irqreader module parameter. However, consistency/debug checks must account for the possibility that the smp_call_function_single() handler function is directly invoked from the idle loop, in which case, for example, in_hardirq() will return false. This commit uses a per-CPU variable to record being in the rcu_torture_irq() smp_call_function_single() handler function. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Check for immediate deboosting at reader endPaul E. McKenney3-0/+66
This commit adds a check for failure to have fully deboosted a multi-segmented RCU reader at the end of the full read-side critical section. This check only happens for fully task-level readers, because a a handler might have interrupted an already-boosted task-level RCU reader, and a reader in that handler could then cause false positives. The first failed check (due to an RCU reader that was not immediately deboosted) causes a splat, but only when the disabled-by-default deboost_timeliness_check module parameter is enabled. Regardless of the value of this parameter, it produces a list of the segments making up that RCU reader following a "Slow-deboost rcutorture reader segments" heading. Subsequent failures fail silently, all in the name of keeping console output down to a dull roar. Although most uses of RCU priority boosting serve as debugging aids, this might change, and in fact might already have changed. And allowing (for example) RCU priority boosting to persist until the next scheduler tick could cause an aggressively real-time system to miss sub-millisecond deadlines. So we do need to find this sort of problem during testing, and preferably not in the field. The name and type of the newly added rcu_torture_ops function pointer (named "->is_task_rcu_boosted()") may need to change should other end-of-reader checks be needed. But let's start simple. Oh, and Claude figured out that rcu_is_task_rcu_boosted() could be lockless. Perhaps there is hope for AI yet! ;-) [ paulmck: Apply Akira Yokosawa feedback. ] Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-11srcu: Queue sdp->work when the delay timer is successfully deletedZqiang1-1/+6
In the cleanup_srcu_struct() function, when iterating over per-cpu's srcu_data, timer_delete_sync(&sdp->delay_work) is called to cancel the delayed work before doing flush_work(&sdp->work). However, suppose that timer_delete_sync() returns 1, which means that it successfully deleted an pending timer before it had a chance to fire. But this also means that the sdp->work will not be queued, so that the subsequent flush_work(&sdp->work) will returns immediately without waiting for anything. Taken together, all of this means that any recently queued SRCU callbacks to not be invoked, which can result in memory leaks, hangs, or worse. Fix this by checking the return value of timer_delete_sync(), if it returns 1, explicitly queue sdp->work so that the callbacks will be invoked and the following flush_work() will correctly wait for all of those callbacks to finish executing. [ Zqiang: Apply feedback from Breno Leitao and kernel test robot. ] Signed-off-by: Zqiang <qiang.zhang@linux.dev> Tested-by: kernel test robot <oliver.sang@intel.com> Reviewed-by: Frederic Weisbecker <frederic@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-30rcu-tasks: Fix some comments for call_rcu_tasks() and call_rcu_tasks_rude()Zqiang1-4/+4
The comments for call_rcu_tasks() and call_rcu_tasks_rude() referred to "RCU read-side critical sections", which is ambiguous. specify "rcu-tasks" and "rcu-tasks rude" respectively to match the actual flavor being described. Signed-off-by: Zqiang <qiang.zhang@linux.dev> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-30rcu-tasks: Rename tasks_rcu_exit_srcu_stall_timer to tasks_rcu_exit_stall_timerZqiang1-8/+8
This 'commit 1612160b9127 ("rcu-tasks: Eliminate deadlocks involving do_exit() and RCU tasks")' has reimplemented the rcu_tasks_postscan(), and the synchronize_srcu() has been removed, this commit therefore rename tasks_rcu_exit_srcu_stall_timer to tasks_rcu_exit_stall_timer. Signed-off-by: Zqiang <qiang.zhang@linux.dev> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-30rcu: Mark interrupts-enabled accesses to rdp->cpu_no_qs.sPaul E. McKenney1-1/+1
The rdp->cpu_no_qs.s field is accessed only by the current CPU, but can be accessed both at task level and from interrupt handlers. All accesses from interrupts-enabled code must therefore be marked. This commit therefore converts from __this_cpu_read() to this_cpu_read(), but only in interrupts-enabled code, that is, the rcu_qs() function. KCSAN located this issue. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-30rcu: Reduce stack usage in show_rcu_gp_kthreads()Zqiang1-18/+29
When CONFIG_KASAN=y and CONFIG_KASAN_STACK=y builds, the show_rcu_gp_kthreads() exceeds the 1024-byte frame-size limit: make kernel/rcu/tree.o KCFLAGS="-fstack-usage" DESCEND objtool DESCEND bpf/resolve_btfids INSTALL libsubcmd_headers CC kernel/rcu/tree.o In file included from kernel/rcu/tree.c:4998: kernel/rcu/tree_stall.h: In function 'show_rcu_gp_kthreads': kernel/rcu/tree_stall.h:994:1: warning: the frame size of 1656 bytes is larger than 1024 bytes [-Wframe-larger-than=] grep show_rcu kernel/rcu/tree.su tree_nocb.h:1622:13:show_rcu_nocb_state 896 dynamic,bounded tree_stall.h:933:6:show_rcu_gp_kthreads 1784 dynamic,bounded tree_stall.h:1102:13:sysrq_show_rcu 16 static Wrap the pr_info() into two noinline_for_stack helpers function: show_rcu_state() print rcu_state status, and show_rcu_node() print single rcu_node status. After apply this change: grep show_rcu kernel/rcu/tree.su tree_stall.h:955:22:show_rcu_node 696 dynamic,bounded tree_stall.h:930:22:show_rcu_state 872 dynamic,bounded tree_nocb.h:1622:13:show_rcu_nocb_state 896 dynamic,bounded tree_stall.h:972:6:show_rcu_gp_kthreads 544 static tree_stall.h:1113:13:sysrq_show_rcu 16 static Signed-off-by: Zqiang <qiang.zhang@linux.dev> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-30rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qsItai Handler1-5/+5
rcu_all_qs() and rcu_note_context_switch() read/clear the per-CPU ->rcu_urgent_qs and ->rcu_need_heavy_qs flags with plain raw_cpu_read() and this_cpu_write(), while the RCU core clears them with WRITE_ONCE() in rcu_disable_urgency_upon_qs(). KCSAN flags the resulting same-CPU race: BUG: KCSAN: data-race in rcu_all_qs / rcu_disable_urgency_upon_qs It is benign -- the flags are advisory and rcu_all_qs() re-reads ->rcu_urgent_qs with smp_load_acquire() before acting on it -- but these are the last unmarked accesses to the two flags; every other access already uses READ_ONCE()/WRITE_ONCE()/smp_*. Mark them to match. No functional change. Reproduced on a PREEMPT_NONE, CONFIG_KCSAN_INTERRUPT_WATCHER=y kernel with a pthreads program whose threads (two per CPU) loop reading a large file: for (;;) { int fd = open("/proc/kallsyms", O_RDONLY); while (read(fd, buf, sizeof(buf)) > 0) ; close(fd); } The read()s drive cond_resched() -> rcu_all_qs() while the busy CPUs keep the grace period urgent, so the RCU core clears the flags concurrently. Fixes: 2dba13f0b6c2 ("rcu: Switch urgent quiescent-state requests to rcu_data structure") Signed-off-by: Itai Handler <itai.handler@gmail.com> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-30rcu: Remove unused rdp parameter from rcu_check_gp_start_stall()Zqiang3-6/+4
The rcu_check_gp_start_stall() works entirely on rnp parameter, and never uses it's rdp parameter. this commit therefore drop it, updating both callers and the declaration. No functional change. Signed-off-by: Zqiang <qiang.zhang@linux.dev> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-30rcu: Mark interrupts-enabled accesses to rdp->cpu_no_qs.b.normPaul E. McKenney2-5/+5
The rdp->cpu_no_qs.b.norm field is accessed only by the current CPU, but can be accessed both at task level and from interrupt handlers. All accesses from interrupts-enabled code must therefore be marked. This commit therefore converts from __this_cpu_read() to this_cpu_read(), from __this_cpu_write() to this_cpu_write(), and plain C-language accesses to READ_ONCE() and WRITE_ONCE(), but only in interrupts-enabled code. KCSAN located this issue. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-24rcu-tasks: Dump rtpcp->lazy_timer status in show_rcu_tasks_generic_gp_kthread()Zqiang1-2/+6
Add 'P' flag to the diagnostic line to indicate whether any per-cpu rtpcp's lazy_timer is pending. this helps diagnose stalls where rcu-task callbacks are queued but the kthread stay sleep because the lazy_timer has not yet fired and no grace period has started. The output is as follows: [ 31.319540][ T77] call_rcu_tasks() has failed boot-time tests. [ 31.320205][ T77] rcu_tasks: RTGS_WAIT_CBS(11) since 7518 g:4 i:0 kCuUP l:150000 Signed-off-by: Zqiang <qiang.zhang@linux.dev> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-24rcu-tasks: Update comments in call_rcu_tasks_generic()Zqiang1-1/+5
This commit updates the comment "We can't create the thread unless interrupts are enabled." from 'commit 4929c913bda5 ("rcu: Make call_rcu_tasks() tolerate first call with irqs disabled")' to be more clear and also to cover deferred wakeup and to take into account the fact that kthread creation has been move to core_initcall() time by 'commit c63eb17ff06d ("rcu: Create call_rcu_tasks() kthread at boot time")'. Signed-off-by: Zqiang <qiang.zhang@linux.dev> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-24rcu: Mark accesses to rdp->rcu_cpu_has_workPaul E. McKenney1-4/+4
Although the rdp->rcu_cpu_has_work field is accessed only by the corresponding CPU, it can be accessed by both interrupt handlers via invoke_rcu_core_kthread() and at task level via rcu_cpu_kthread(). This means that we need this_cpu_read() rather than __this_cpu_read(), this_cpu_write() rather than __this_cpu_write(), and READ_ONCE() rather than plain C-language loads. The exception is the boot-time rcu_spawn_core_kthreads(), which cannot race with kthreads that have not yet been spawned. This commit therefore makes it so. KCSAN located this issue. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-24rcu: Remove unused func parameter from callback-enqueue functionsJoel Fernandes3-9/+9
Ever since the kvfree_rcu() tracing moved out of the callback-enqueue path, rcutree_enqueue() no longer looks at the callback function pointer: By the time it is invoked, __call_rcu_common() has already stored the function into rhp->func, and the enqueue path only adds the rcu_head to the segmented callback list and emits tracepoints that do not take the function pointer. Nevertheless, the function pointer is still threaded through call_rcu_core(), call_rcu_nocb(), and rcutree_enqueue(), forcing each level to carry a dead argument. Remove the parameter from all three functions, from the no-CBs stub, and from the corresponding declarations. Anything needing the callback function can still get it from rhp->func. No functional change. Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-24rcu: Remove unused expedited_need_qs field from rcu_stateJoel Fernandes1-1/+0
The ->expedited_need_qs counter was part of the old expedited grace-period machinery that spun waiting for each CPU to check in. The current implementation instead tracks holdout CPUs via the rcu_node structures' ->expmask fields and waits on the ->exp_wq[] wait queues, so nothing reads or writes ->expedited_need_qs any longer. Remove the field to avoid wasting space in rcu_state and to keep readers of the expedited code from searching for nonexistent users. Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-24rcu: Use WRITE_ONCE() for ->rcu_need_heavy_qsPaul E. McKenney1-1/+2
Currently raw_cpu_write() is used to clear the ->rcu_need_heavy_qs field of the per-CPU rcu_data structure. However, on x86 this is a normal assignment, which does not play well with concurrent accesses. This commit therefore upgrades the uses of raw_cpu_write() to its concurrency-safe counterpart WRITE_ONCE() of an rdp pointer obtained from this_cpu_ptr(&rcu_data). KCSAN located this issue. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-24rcu: Use this_cpu_{read,write}() for ->cpu_no_qs.b.expPaul E. McKenney2-4/+4
Currently __this_cpu_read() and __this_cpu_write() is used to access the ->cpu_no_qs.b.exp field of the per-CPU rcu_data structure. However, this can fail when the accesses can happen in interrupt handlers, as recently started being exercised by rcutorture. This commit therefore upgrades the uses of __this_cpu_read() and __this_cpu_write() to their interrupt-safe counterparts this_cpu_read() and this_cpu_write(). KCSAN located this issue. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-24rcuscale: Add concurrent expedited GP threads for callback scaling testsPuranjay Mohan1-2/+82
Add nexp and exp_interval parameters to rcuscale that spawn kthreads running synchronize_rcu_expedited() in a loop. This generates concurrent expedited GP load while the normal writers measure GP or callback latency. When combined with gp_async=1 (which uses call_rcu() for writers), this tests how effectively callbacks benefit from expedited grace periods. With RCU callback expedited GP tracking, the async callbacks should complete faster because they piggyback on the expedited GPs rather than waiting for normal GPs. Reviewed-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-24rcu: Advance callbacks for expedited GP completion in rcu_core()Puranjay Mohan1-0/+17
Even when rcu_pending() triggers rcu_core(), the normal callback advancement path through note_gp_changes() -> __note_gp_changes() bails out when rdp->gp_seq == rnp->gp_seq (no normal GP change). Since expedited GPs do not update rnp->gp_seq, rcu_advance_cbs() is never called and callbacks remain stuck in RCU_WAIT_TAIL. Add a direct callback advancement block in rcu_core() that checks for GP completion via rcu_segcblist_nextgp() combined with poll_state_synchronize_rcu_full(). When detected, trylock rnp and call rcu_advance_cbs() to move completed callbacks to RCU_DONE_TAIL. Wake the GP kthread if rcu_advance_cbs() requests a new grace period. Uses trylock to avoid adding contention on rnp->lock. If the lock is contended, callbacks will be advanced on the next tick. Reviewed-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-24rcu: Detect expedited grace period completion in rcu_pending()Puranjay Mohan1-7/+31
rcu_pending() decides whether rcu_core() should run on the current CPU's timer tick. It does not account for expedited grace periods: after an expedited GP completes, a non-offloaded CPU's callbacks remain in RCU_WAIT_TAIL (not yet advanced to RCU_DONE_TAIL) and rcu_core() is never invoked to advance them. Detect that case via rcu_segcblist_nextgp() combined with a new memory-ordering-free poll variant, poll_state_synchronize_rcu_full_unordered(). This keeps rcu_pending() cheap: it runs on every tick that has pending callbacks, so it must not pay for the two memory barriers in poll_state_synchronize_rcu_full(). The check is only a hint to run rcu_core(); the ordered re-check and the actual callback advancement happen there. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Reviewed-by: Frederic Weisbecker <frederic@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-24rcu: Wake NOCB rcuog kthreads on expedited grace period completionPuranjay Mohan4-17/+94
When an expedited grace period completes, rcu_exp_wait_wake() wakes waiters on rnp->exp_wq[] but does not notify the NOCB rcuog kthreads. An rcuog kthread that is waiting for a grace period sleeps on the leaf rcu_node's ->nocb_gp_wq[] with a wait condition based on the grace-period state, so without a wakeup, callbacks on offloaded CPUs that could benefit from the expedited GP wait until the rcuog kthread wakes for some other reason (e.g. the next normal GP or a timer). Make the rcuog grace-period wait honour expedited GPs and wake it when one completes: - nocb_gp_wait() now records the grace period to wait for as a struct rcu_gp_seq (both normal and expedited), tracks the earliest pending normal and expedited sequence across the group, and releases the wait via poll_state_synchronize_rcu_full() so it wakes for whichever completes first. ->nocb_gp_seq is widened to struct rcu_gp_seq accordingly. - rcu_exp_wait_wake() calls the new rcu_nocb_exp_cleanup() on leaf nodes, which wakes both ->nocb_gp_wq[0] and ->nocb_gp_wq[1] (the expedited sequence does not share parity with the normal ->gp_seq the waiter indexed with). Both this path and rcu_nocb_gp_cleanup() use the shared rcu_nocb_cleanup_wake() helper, which checks swait_active() first; the smp_mb() in rcu_gp_cleanup()/rcu_exp_wait_wake() orders the grace-period state update before that check. A stub rcu_nocb_exp_cleanup() is provided for CONFIG_RCU_NOCB_CPU=n. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Reviewed-by: Frederic Weisbecker <frederic@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-24rcu: Update comments for gp_seq and expedited GP trackingPuranjay Mohan2-18/+31
Update documentation comments throughout the RCU callback infrastructure to reflect the transition from a single grace-period sequence number to the full struct rcu_gp_seq that tracks both normal and expedited grace periods. The ->gp_seq[] array documentation in rcu_segcblist.h is updated to describe dual (normal and expedited) GP tracking. The rcu_segcblist_advance(), rcu_segcblist_accelerate(), and rcu_advance_cbs() comments are updated to refer to the struct rcu_gp_seq state (gsp) instead of the old bare grace-period sequence number (seq). Reviewed-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Reviewed-by: Frederic Weisbecker <frederic@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-24rcu: Enable RCU callbacks to benefit from expedited grace periodsPuranjay Mohan4-24/+39
Currently, RCU callbacks only track normal grace-period sequence numbers. This means callbacks must wait for normal grace periods to complete even when expedited grace periods have already elapsed. Use the full struct rcu_gp_seq (which tracks both the normal and expedited grace-period sequences) throughout the callback infrastructure. rcu_segcblist_advance() now checks both normal and expedited GP completion via poll_state_synchronize_rcu_full(), and becomes parameterless since it reads the grace-period state internally. rcu_segcblist_accelerate() stores the full state (both sequences) instead of just the normal one. rcu_accelerate_cbs() and rcu_accelerate_cbs_unlocked() use get_state_synchronize_rcu_full() to capture both sequences, and the NOCB advance checks use poll_state_synchronize_rcu_full() instead of comparing only the normal sequence. srcu_segcblist_advance() becomes a standalone implementation because it compares SRCU sequences directly and cannot use poll_state_synchronize_rcu_full(), which reads RCU-specific globals. srcu_segcblist_accelerate() sets the ->exp field to RCU_GET_STATE_NOT_TRACKED so that poll_state_synchronize_rcu_full() compares only ->norm and ignores ->exp. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-23rcu-tasks: Remove smp_mb() in rcu_spawn_tasks_kthread_generic()Zqiang1-1/+0
For the smp_mb() after kthread_run() in rcu_spawn_tasks_kthread_generic() from these commits: 'commit eacd6f04a133 ("rcu-tasks: Move Tasks RCU to its own file")' 'commit 84a8f446ffd7 ("rcu: Defer rcu_tasks_kthread() creation till first call_rcu_tasks()")' the memory order pairing as follows: rcu_spawn_tasks_kthread() ->t = kthread_run(rcu_tasks_kthread, ...); ->smp_mb(); /* Ensure others see full kthread. */ ->WRITE_ONCE(rcu_tasks_kthread_ptr, t); call_rcu_tasks() ->if (READ_ONCE(rcu_tasks_kthread_ptr)) ->wake_up(&rcu_tasks_cbs_wq) ->try_to_wake_up() lock pi_lock ->smp_mb__after_spinlock() //see full kthread Because the 'commit d119357d0743 ("rcu-tasks: Treat only synchronous grace periods urgently")' moved the kthread_ptr assignment into the rcu_tasks_kthread() function, the following memory order pairings are sufficient: The runq's raw_spinlock/unlock(or smp_mb__after_spinlock()) from wake_up_process() in kthread_run() and __schedule() provides memory order barrier when the kthread is first scheduled, this ensures the kthread's func observes all of the kthread's initialization. The kthread's smp_store_release(&rtp->kthread_ptr, ...) in rcu_tasks_kthread() and smp_load_acquire(&rtp->kthread_ptr) in call_rcu_tasks_generic() compose release/acquire pairing, the cumulativity of smp_store_release() propagates visibility of the kthread's initialization through the scheduler chain. This commit therefore remove smp_mb() in rcu_spawn_tasks_kthread_generic(). Signed-off-by: Zqiang <qiang.zhang@linux.dev> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-23rcu-tasks: Dump rcu tasks status when the boot-test failedZqiang1-0/+5
This commit adds a dump RCU task status function to rcu tasks tests, used to obtain more information to help debug when the RCU tasks boot-time tests failed. Signed-off-by: Zqiang <qiang.zhang@linux.dev> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-23rcu-tasks: Remove unused struct rcu_tasks's->n_ipis_fails variablesZqiang1-4/+2
The RCU tasks trace has been reimplemented by 'commit c27cea4416a3 ("rcu: Re-implement RCU Tasks Trace in terms of SRCU-fast")', the rcu_tasks structure's->n_ipis_fails is no longer used, this commit therefore remove it. Signed-off-by: Zqiang <qiang.zhang@linux.dev> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-23rcu: clear defer_qs_pending in deferred-QS bail when nesting > 0Joel Fernandes1-1/+27
Paul McKenney noted that a softirq (or irq_work) handler arming for a deferred QS can fire and find rcu_preempt_depth() > 0 -- the task is still inside its outer reader, so rcu_preempt_need_deferred_qs() bails without reporting the QS. At that point the queued mechanism has been consumed but ->defer_qs_pending stays in DEFER_QS_PENDING. In the meantime, the only remaining path back to a quiescent state on this CPU may be a local_irq_disable()/_enable() pair that does not call preempt_check_resched() (it is just `sti`/`cli`). patch 6's unconditional set_need_resched_current() makes need_resched true, but without an irq_work being raised the next outer rcu_read_unlock_special() hits the P-gate at the arming code: if (rdp->defer_qs_pending != DEFER_QS_PENDING) { rdp->defer_qs_pending = DEFER_QS_PENDING; irq_work_queue_on(...); // <-- skipped } so no irq_work is queued for the hardirq-exit preempt_schedule_irq() path either. The deferred QS now waits until the next timer tick (or similar preempt-safe boundary), needlessly extending expedited grace period latency. Clear ->defer_qs_pending in the bail-out path of rcu_preempt_deferred_qs() when rcu_preempt_depth() > 0. The recursion guard semantics introduced by commit b41642c87716 ("rcu: Fix rcu_read_unlock() deadloop due to IRQ work"). The clear is also safe against fresh recursion at this exact program point: rcu_preempt_depth() > 0 guarantees we are still inside an outer reader, so any inner rcu_read_unlock() from tracing infrastructure brings nesting back to outer (>0), never to 0. The slow path of rcu_read_unlock_special() is structurally unreachable under that condition, so no recursive raise_softirq_irqoff()/irq_work_queue_on() can be triggered by the clear. Essentially, the mechanism will work to prevent the following recursion which Xiongfeng had previously reported: irq_exit() -> __irq_exit_rcu() -> tick_irq_exit() -> tick_nohz_irq_exit() -> tick_nohz_stop_sched_tick() -> trace_tick_stop() // BPF prog hooked here -> rcu_read_unlock_special() -> irq_work_queue_on(&rdp->defer_qs_iw, rdp->cpu) // self-IPI re-enters irq_exit Reported-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-23rcu: introduce rcu_defer_qs_clear() helperJoel Fernandes2-2/+7
Currently rdp->defer_qs_pending transitions from DEFER_QS_PENDING to DEFER_QS_IDLE at two sites: rcu_preempt_deferred_qs_irqrestore() and rcu_preempt_deferred_qs_handler() (depth>0 reset). Both write the IDLE value directly. Introduce a single inline helper rcu_defer_qs_clear() in tree.h and route both sites through it. This becomes the single PENDING->IDLE transition point for upcoming work. Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-23rcu: Use task_state_to_char() in stall-warning printsKunwu Chan1-6/+6
RCU stall warnings currently print task states as raw hexadecimal values, requiring developers to manually decode them. Use task_state_to_char() so that stall warnings show the same symbolic task-state representation used elsewhere in the kernel. For example: ->state=0x402 becomes ->state=I ->state=0x0 becomes ->state=R ->state=0x2 becomes ->state=D This improves readability while preserving the underlying diagnostic information. Suggested-by: Zqiang <qiang.zhang@linux.dev> Co-developed-by: Wang Lian <lianux.mm@gmail.com> Signed-off-by: Wang Lian <lianux.mm@gmail.com> Signed-off-by: Kunwu Chan <kunwu.chan@gmail.com> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-23rcu: Add RCU_GET_STATE_NOT_TRACKED for subsystems without expedited GPsPuranjay Mohan2-3/+13
SRCU and Tasks RCU do not track expedited grace periods. When their callback state is checked via poll_state_synchronize_rcu_full(), the uninitialized or zeroed exp field could cause false-positive completion detection. This commit adds an RCU_GET_STATE_NOT_TRACKED sentinel value (0x2) that these subsystems can place into exp to indicate that expedited GP tracking is not applicable. The expedited sequence check in poll_state_synchronize_rcu_full() is guarded to skip entries marked with this sentinel. This is needed to allow rcu_segcblist_advance() and rcu_accelerate_cbs() to work with both normal and expedited grace periods via get_state_synchronize_rcu_full() and poll_state_synchronize_rcu_full(). Reviewed-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Reviewed-by: Frederic Weisbecker <frederic@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-23rcu/segcblist: Track segment grace periods with struct rcu_gp_seqPuranjay Mohan4-34/+42
Change the type of the per-segment ->gp_seq[] array in struct rcu_segcblist from unsigned long to struct rcu_gp_seq. This prepares the callback tracking infrastructure to record both normal and expedited grace periods per segment. The rcu_segcblist_nextgp(), rcu_segcblist_advance(), and rcu_segcblist_accelerate() helpers now take a struct rcu_gp_seq * instead of an unsigned long, and all callers use the .norm field for comparisons and assignments. The SRCU and Tasks RCU wrappers construct a struct rcu_gp_seq with only .norm set and forward to the core helpers. No functional change: only the .norm field is used. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Reviewed-by: Frederic Weisbecker <frederic@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-23rcu/segcblist: Factor out rcu_segcblist_advance_compact() helperPuranjay Mohan1-18/+32
This commit extracts the tail-pointer cleanup and segment compaction logic from rcu_segcblist_advance() into a new static helper function, rcu_segcblist_advance_compact(). This shared logic will be reused by the upcoming srcu_segcblist_advance() standalone implementation, which cannot call the core rcu_segcblist_advance() because that function will use RCU-specific globals. No functional change. Reviewed-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Reviewed-by: Frederic Weisbecker <frederic@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-23rcu/segcblist: Add SRCU and Tasks RCU wrapper functionsPuranjay Mohan4-11/+23
Add srcu_segcblist_advance() and srcu_segcblist_accelerate() wrappers that forward to the core rcu_segcblist_advance() and rcu_segcblist_accelerate() functions, and switch all SRCU (srcutree.c) and Tasks RCU (tasks.h) callers to use these wrappers. This isolates SRCU and Tasks RCU from upcoming changes to the core advance/accelerate functions, which will switch to struct rcu_gp_seq for dual normal/expedited GP tracking. Because SRCU and Tasks RCU use only normal GP sequences, their wrappers will maintain the existing unsigned long interface. No functional change. Reviewed-by: Paul E. McKenney <paulmck@kernel.org> Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Reviewed-by: Frederic Weisbecker <frederic@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-23rcu: Rename struct rcu_gp_oldstate to rcu_gp_seqPuranjay Mohan4-57/+57
The polled grace-period state structure rcu_gp_oldstate holds a snapshot of the normal (and, on SMP, expedited) grace-period sequence numbers. Upcoming changes store this structure in the callback segment list, where the "oldstate" name reads poorly: there it represents the grace period a segment is waiting on and is also compared against the current grace-period state. Rename struct rcu_gp_oldstate to the more neutral struct rcu_gp_seq, and shorten its members rgos_norm and rgos_exp to norm and exp. Local variables and parameters of this type are renamed from rgosp/rgos to gsp/gs accordingly. While at it, provide a single definition of the structure in rcupdate.h rather than separate Tiny-RCU and Tree-RCU definitions, and give it the ->exp field unconditionally. Tiny RCU does not track expedited grace periods and leaves ->exp unused, but a single definition that always has ->exp lets the shared callback code in rcu_segcblist.c reference it without CONFIG_SMP guards, including on !SMP builds. No functional change. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Reviewed-by: Frederic Weisbecker <frederic@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-23rcu: Remove unused rdp parameter from trace_rcu_this_gp()Joel Fernandes2-15/+12
The trace_rcu_this_gp() wrapper forwards only the rcu_node structure's fields and the requested grace-period sequence number to the rcu_future_grace_period tracepoint. Its rcu_data pointer parameter has no users, but every one of the ten call sites must nevertheless come up with an rcu_data pointer to pass in. Remove the parameter and update all callers. This also allows rcu_future_gp_cleanup() to drop the local rcu_data pointer that existed solely to feed this trace call. No functional change. Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-15srcu: expose srcu_readers_active()Onur Özkan2-26/+1
This is needed by rust/helpers/srcu.c which now adds rust_helper_srcu_readers_active() as a wrapper around the SRCU helper for Rust callers. To achive this: 1- Move the srcu_readers_active() implementation from "kernel/rcu/srcutree.c" to "include/linux/srcutree.h". 2- Implement a matching srcu_readers_active() in "include/linux/srcutiny.h" and use it on the existing open-coded WARN_ON() check in cleanup_srcu_struct(). Signed-off-by: Onur Özkan <work@onurozkan.dev> Reviewed-by: Gary Guo <gary@garyguo.net> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-15srcu: make init_srcu_struct() consistently wrap __init_srcu_struct()Onur Özkan2-11/+12
Restructure the SRCU initialization functions so it always follows one direction: init_srcu_struct() -> __init_srcu_struct() -> lockdep or generic This uses the same wrapper style as mutex. It avoids the old confusing style where init_srcu_struct() and __init_srcu_struct() called each other in different configs. It also helps Rust side to have simpler helper for SRCU initialization. Signed-off-by: Onur Özkan <work@onurozkan.dev> Reviewed-by: Gary Guo <gary@garyguo.net> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Boqun Feng <boqun@kernel.org> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-07-15rcutorture: Abstract reader-segment dump into rcu_torture_dump_read_segs()Paul E. McKenney1-72/+76
This commit abstracts the open-coded dumping of reader segments in the rcu_torture_cleanup() function into a new rcu_torture_dump_read_segs() function. This abstraction will allow reader segments to be dumped for other purposes. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>