sched/cache: Keep nr_pref_llc_running in the runnable domain, to fix LLC mis-scheduling buggrafted

alb_break_llc() decides whether to break LLC preference during active
load balance. It does so by testing that every runnable fair task on the
source rq prefers its LLC:

	env->src_rq->nr_pref_llc_running == env->src_rq->cfs.h_nr_runnable

But the two counters cover different sets. nr_pref_llc_running is updated
in account_llc_enqueue()/account_llc_dequeue(), next to cfs_rq->nr_queued,
so it follows queued tasks. h_nr_runnable is updated in set_delayed()/
clear_delayed() and drops delay-dequeued tasks.

So under DELAY_DEQUEUE, a preferring task that goes to sleep stays counted
in nr_pref_llc_running while h_nr_runnable falls. The equality then breaks,
alb_break_llc() returns false, and active balance is free to pull a task
off its preferred LLC. Active balance only moves runnable tasks, and this
is the only LLC check it consults: once the stopper runs, LBF_ACTIVE_LB
skips the per-task test in can_migrate_task(). The runnable set is the one
we want.

Fix it on the counter side. A task should be counted in
nr_pref_llc_running exactly while it is both queued on its preferred LLC
(pref_llc_queued) and runnable (!sched_delayed). Define that membership
once in task_pref_llc_runnable(), and adjust the counter only through
pref_llc_running_inc()/pref_llc_running_dec() from the four sites that
change either input: account_llc_enqueue(), account_llc_dequeue(),
set_delayed() and clear_delayed(). Gating every update on the same
predicate keeps the delay, wake and dequeue paths from double-counting
or underflowing; see the comments at those sites for the ordering.

nr_llc_running and sd->llc_counts are not touched and stay on queued
semantics.

Fixes: 714059f79ff0 ("sched/cache: Handle moving single tasks to/from their preferred LLC")
Closes: https://lore.kernel.org/lkml/20260827135000.735138-1-zhanxusheng@xiaomi.com/
Reported-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Suggested-by: Chen Yu <yu.c.chen@intel.com>
Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Kayra Cizmeci <kayracizmeci@gmail.com>
Cc: <stable@kernel.org> # v7.2.x
Link: https://patch.msgid.link/06af61afedac32e6477f57feb4d658f6c411c3af.1790035273.git.tim.c.chen@linux.intel.com

1 files changed, 245 insertions, 0 deletions

diff --git a/Documentation/input/uinput.rst b/Documentation/input/uinput.rst
new file mode 100644
index 000000000..30fe80e32
--- /dev/null
+++ b/Documentation/input/uinput.rst
@@ -0,0 +1,245 @@
+=============
+uinput module
+=============
+
+Introduction
+============
+
+uinput is a kernel module that makes it possible to emulate input devices
+from userspace. By writing to /dev/uinput (or /dev/input/uinput) device, a
+process can create a virtual input device with specific capabilities. Once
+this virtual device is created, the process can send events through it,
+that will be delivered to userspace and in-kernel consumers.
+
+Interface
+=========
+
+::
+
+  linux/uinput.h
+
+The uinput header defines ioctls to create, set up, and destroy virtual
+devices.
+
+libevdev
+========
+
+libevdev is a wrapper library for evdev devices that provides interfaces to
+create uinput devices and send events. libevdev is less error-prone than
+accessing uinput directly, and should be considered for new software.
+
+For examples and more information about libevdev:
+https://www.freedesktop.org/software/libevdev/doc/latest/
+
+Examples
+========
+
+Keyboard events
+---------------
+
+This first example shows how to create a new virtual device, and how to
+send a key event. All default imports and error handlers were removed for
+the sake of simplicity.
+
+.. code-block:: c
+
+   #include <linux/uinput.h>
+
+   void emit(int fd, int type, int code, int val)
+   {
+      struct input_event ie;
+
+      ie.type = type;
+      ie.code = code;
+      ie.value = val;
+      /* timestamp values below are ignored */
+      ie.time.tv_sec = 0;
+      ie.time.tv_usec = 0;
+
+      write(fd, &ie, sizeof(ie));
+   }
+
+   int main(void)
+   {
+      struct uinput_setup usetup;
+
+      int fd = open("/dev/uinput", O_WRONLY | O_NONBLOCK);
+
+
+      /*
+       * The ioctls below will enable the device that is about to be
+       * created, to pass key events, in this case the space key.
+       */
+      ioctl(fd, UI_SET_EVBIT, EV_KEY);
+      ioctl(fd, UI_SET_KEYBIT, KEY_SPACE);
+
+      memset(&usetup, 0, sizeof(usetup));
+      usetup.id.bustype = BUS_USB;
+      usetup.id.vendor = 0x1234; /* sample vendor */
+      usetup.id.product = 0x5678; /* sample product */
+      strcpy(usetup.name, "Example device");
+
+      ioctl(fd, UI_DEV_SETUP, &usetup);
+      ioctl(fd, UI_DEV_CREATE);
+
+      /*
+       * On UI_DEV_CREATE the kernel will create the device node for this
+       * device. We are inserting a pause here so that userspace has time
+       * to detect, initialize the new device, and can start listening to
+       * the event, otherwise it will not notice the event we are about
+       * to send. This pause is only needed in our example code!
+       */
+      sleep(1);
+
+      /* Key press, report the event, send key release, and report again */
+      emit(fd, EV_KEY, KEY_SPACE, 1);
+      emit(fd, EV_SYN, SYN_REPORT, 0);
+      emit(fd, EV_KEY, KEY_SPACE, 0);
+      emit(fd, EV_SYN, SYN_REPORT, 0);
+
+      /*
+       * Give userspace some time to read the events before we destroy the
+       * device with UI_DEV_DESTROY.
+       */
+      sleep(1);
+
+      ioctl(fd, UI_DEV_DESTROY);
+      close(fd);
+
+      return 0;
+   }
+
+Mouse movements
+---------------
+
+This example shows how to create a virtual device that behaves like a physical
+mouse.
+
+.. code-block:: c
+
+   #include <linux/uinput.h>
+
+   /* emit function is identical to of the first example */
+
+   int main(void)
+   {
+      struct uinput_setup usetup;
+      int i = 50;
+
+      int fd = open("/dev/uinput", O_WRONLY | O_NONBLOCK);
+
+      /* enable mouse button left and relative events */
+      ioctl(fd, UI_SET_EVBIT, EV_KEY);
+      ioctl(fd, UI_SET_KEYBIT, BTN_LEFT);
+
+      ioctl(fd, UI_SET_EVBIT, EV_REL);
+      ioctl(fd, UI_SET_RELBIT, REL_X);
+      ioctl(fd, UI_SET_RELBIT, REL_Y);
+
+      memset(&usetup, 0, sizeof(usetup));
+      usetup.id.bustype = BUS_USB;
+      usetup.id.vendor = 0x1234; /* sample vendor */
+      usetup.id.product = 0x5678; /* sample product */
+      strcpy(usetup.name, "Example device");
+
+      ioctl(fd, UI_DEV_SETUP, &usetup);
+      ioctl(fd, UI_DEV_CREATE);
+
+      /*
+       * On UI_DEV_CREATE the kernel will create the device node for this
+       * device. We are inserting a pause here so that userspace has time
+       * to detect, initialize the new device, and can start listening to
+       * the event, otherwise it will not notice the event we are about
+       * to send. This pause is only needed in our example code!
+       */
+      sleep(1);
+
+      /* Move the mouse diagonally, 5 units per axis */
+      while (i--) {
+         emit(fd, EV_REL, REL_X, 5);
+         emit(fd, EV_REL, REL_Y, 5);
+         emit(fd, EV_SYN, SYN_REPORT, 0);
+         usleep(15000);
+      }
+
+      /*
+       * Give userspace some time to read the events before we destroy the
+       * device with UI_DEV_DESTROY.
+       */
+      sleep(1);
+
+      ioctl(fd, UI_DEV_DESTROY);
+      close(fd);
+
+      return 0;
+   }
+
+
+uinput old interface
+--------------------
+
+Before uinput version 5, there wasn't a dedicated ioctl to set up a virtual
+device. Programs supporting older versions of uinput interface need to fill
+a uinput_user_dev structure and write it to the uinput file descriptor to
+configure the new uinput device. New code should not use the old interface
+but interact with uinput via ioctl calls, or use libevdev.
+
+.. code-block:: c
+
+   #include <linux/uinput.h>
+
+   /* emit function is identical to of the first example */
+
+   int main(void)
+   {
+      struct uinput_user_dev uud;
+      int version, rc, fd;
+
+      fd = open("/dev/uinput", O_WRONLY | O_NONBLOCK);
+      rc = ioctl(fd, UI_GET_VERSION, &version);
+
+      if (rc == 0 && version >= 5) {
+         /* use UI_DEV_SETUP */
+         return 0;
+      }
+
+      /*
+       * The ioctls below will enable the device that is about to be
+       * created, to pass key events, in this case the space key.
+       */
+      ioctl(fd, UI_SET_EVBIT, EV_KEY);
+      ioctl(fd, UI_SET_KEYBIT, KEY_SPACE);
+
+      memset(&uud, 0, sizeof(uud));
+      snprintf(uud.name, UINPUT_MAX_NAME_SIZE, "uinput old interface");
+      write(fd, &uud, sizeof(uud));
+
+      ioctl(fd, UI_DEV_CREATE);
+
+      /*
+       * On UI_DEV_CREATE the kernel will create the device node for this
+       * device. We are inserting a pause here so that userspace has time
+       * to detect, initialize the new device, and can start listening to
+       * the event, otherwise it will not notice the event we are about
+       * to send. This pause is only needed in our example code!
+       */
+      sleep(1);
+
+      /* Key press, report the event, send key release, and report again */
+      emit(fd, EV_KEY, KEY_SPACE, 1);
+      emit(fd, EV_SYN, SYN_REPORT, 0);
+      emit(fd, EV_KEY, KEY_SPACE, 0);
+      emit(fd, EV_SYN, SYN_REPORT, 0);
+
+      /*
+       * Give userspace some time to read the events before we destroy the
+       * device with UI_DEV_DESTROY.
+       */
+      sleep(1);
+
+      ioctl(fd, UI_DEV_DESTROY);
+
+      close(fd);
+      return 0;
+   }
+