// include/linux/signal.h
static inline void sigaddset(sigset_t *set, int _sig)
{
    unsigned long sig = _sig - 1;
    if (_NSIG_WORDS == 1)
        set->sig[0] |= 1UL << sig;
    else
        set->sig[sig / _NSIG_BPW] |= 1UL << (sig % _NSIG_BPW);
}

static inline int sigismember(sigset_t *set, int _sig)
{
    unsigned long sig = _sig - 1;
    if (_NSIG_WORDS == 1)
        return 1 & (set->sig[0] >> sig);
    else
        return 1 & (set->sig[sig / _NSIG_BPW] >> (sig % _NSIG_BPW));
}

// include/linux/signal_types.h

// 待处理信号队列：位图 + 链表
struct sigpending {
    struct list_head list;   // sigqueue 链表（实时信号排队）
    sigset_t signal;         // 位图（标记哪些信号已投递）
};

// 单个排队信号节点
struct sigqueue {
    struct list_head list;
    int flags;
    kernel_siginfo_t info;   // 包含 si_signo/si_code/si_pid 等
    struct ucounts *ucounts;
};

// 用户态信号处理器描述
struct sigaction {
    __sighandler_t  sa_handler;   // SIG_DFL / SIG_IGN / 用户函数
    unsigned long   sa_flags;     // SA_RESTART / SA_SIGINFO / SA_NODEFER ...
    sigset_t        sa_mask;      // 处理期间额外屏蔽的信号
};

struct k_sigaction {
    struct sigaction sa;
};

// 信号处理器数组（线程组共享）
// include/linux/sched/signal.h
struct sighand_struct {
    spinlock_t          siglock;
    refcount_t          count;            // 引用计数，线程共享
    wait_queue_head_t   signalfd_wqh;
    struct k_sigaction  action[_NSIG];    // 64 个信号的处理器数组
};

// include/linux/sched/signal.h
struct signal_struct {
    refcount_t      sigcnt;
    atomic_t        live;
    int             nr_threads;
    struct list_head thread_head;

    wait_queue_head_t wait_chldexit;   // wait4() 等待子进程退出

    struct task_struct *curr_target;   // 信号负载均衡目标线程

    /* 进程级共享 pending 队列（发给整个线程组的信号） */
    struct sigpending shared_pending;

    int     group_exit_code;
    int     group_stop_count;
    unsigned int flags;   // SIGNAL_GROUP_EXIT / SIGNAL_STOP_STOPPED ...
    // ...
};

// kernel/signal.c:1453
int __kill_pgrp_info(int sig, struct kernel_siginfo *info, struct pid *pgrp)
{
    struct task_struct *p = NULL;
    int retval, success;

    success = 0;
    retval = -ESRCH;
    do_each_pid_task(pgrp, PIDTYPE_PGID, p) {
        int err = group_send_sig_info(sig, info, p, PIDTYPE_PGID);
        success |= !err;
        retval = err;
    } while_each_pid_task(pgrp, PIDTYPE_PGID, p);
    return success ? 0 : retval;
}

// kernel/signal.c:1078
static int __send_signal_locked(int sig, struct kernel_siginfo *info,
                struct task_struct *t, enum pid_type type, bool force)
{
    struct sigpending *pending;
    struct sigqueue *q;
    int override_rlimit;

    lockdep_assert_held(&t->sighand->siglock);

    if (!prepare_signal(sig, t, force))
        goto ret;   // 信号被忽略，直接返回

    // 进程组信号进 shared_pending，线程信号进私有 pending
    pending = (type != PIDTYPE_PID) ? &t->signal->shared_pending : &t->pending;

    // 不可靠信号（1-31）：已经在 pending 中则不重复入队
    if (legacy_queue(pending, sig))
        goto ret;

    // 实时信号：分配 sigqueue 节点加入链表
    if (sig < SIGRTMIN)
        override_rlimit = (is_si_special(info) || info->si_code >= 0);
    else
        override_rlimit = 0;

    q = __sigqueue_alloc(sig, t, GFP_ATOMIC, override_rlimit, 0);
    if (q) {
        list_add_tail(&q->list, &pending->list);   // 加入等待链表
        copy_siginfo(&q->info, info);
    } else if (sig >= SIGRTMIN && info->si_code != SI_USER) {
        // 实时信号队列溢出，返回 EAGAIN
        return -EAGAIN;
    }

out_set:
    signalfd_notify(t, sig);
    sigaddset(&pending->signal, sig);    // 在位图中置位
    complete_signal(sig, t, type);       // 选择目标线程并唤醒
    return 0;
}

static inline bool legacy_queue(struct sigpending *signals, int sig)
{
    return (sig < SIGRTMIN) && sigismember(&signals->signal, sig);
}

// kernel/signal.c:763
void signal_wake_up_state(struct task_struct *t, unsigned int state)
{
    lockdep_assert_held(&t->sighand->siglock);

    // 在 thread_info 中设置 TIF_SIGPENDING 标志
    set_tsk_thread_flag(t, TIF_SIGPENDING);

    // 唤醒处于 TASK_INTERRUPTIBLE 或 TASK_WAKEKILL 状态的线程
    if (!wake_up_state(t, state | TASK_INTERRUPTIBLE))
        kick_process(t);   // 如果目标在其他 CPU 上运行，发送 IPI
}

// arch/x86/kernel/signal.c:302
void arch_do_signal_or_restart(struct pt_regs *regs)
{
    struct ksignal ksig;

    if (get_signal(&ksig)) {
        /* 有信号需要投递，调用 handle_signal */
        handle_signal(&ksig, regs);
        return;
    }

    /* 没有信号处理器，检查是否需要重启系统调用 */
    if (syscall_get_nr(current, regs) != -1) {
        switch (syscall_get_error(current, regs)) {
        case -ERESTARTNOINTR:
            regs->ax = regs->orig_ax;
            regs->ip -= 2;   // 重新执行 syscall 指令
            break;
        // ...
        }
    }
    restore_saved_sigmask();
}

// kernel/signal.c:2709
if ((signal->flags & SIGNAL_GROUP_EXIT) || signal->group_exec_task) {
    ksig->info.si_signo = signr = SIGKILL;
    // 直接跳到 fatal 处理，不查 sighand->action
    goto fatal;
}

// arch/x86/kernel/signal.c:224
static void handle_signal(struct ksignal *ksig, struct pt_regs *regs)
{
    bool stepping, failed;
    struct fpu *fpu = &current->thread.fpu;

    /* 处理系统调用重启语义 */
    if (syscall_get_nr(current, regs) != -1) {
        switch (syscall_get_error(current, regs)) {
        case -ERESTART_RESTARTBLOCK:
        case -ERESTARTNOHAND:
            regs->ax = -EINTR;
            break;
        case -ERESTARTSYS:
            if (!(ksig->ka.sa.sa_flags & SA_RESTART)) {
                regs->ax = -EINTR;
                break;
            }
            fallthrough;
        case -ERESTARTNOINTR:
            regs->ax = regs->orig_ax;
            regs->ip -= 2;
            break;
        }
    }

    failed = (setup_rt_frame(ksig, regs) < 0);
    if (!failed) {
        regs->flags &= ~(X86_EFLAGS_DF|X86_EFLAGS_RF|X86_EFLAGS_TF);
        fpu__clear_user_states(fpu);
    }
    signal_setup_done(failed, ksig, stepping);
}

// arch/x86/include/asm/sigframe.h:59
struct rt_sigframe {
    char __user *pretcode;  // 指向 sigreturn trampoline
    struct ucontext uc;     // 保存的用户态上下文（含 pt_regs）
    struct siginfo info;    // 信号信息
    /* FP/XSAVE 状态紧跟其后 */
};

// include/linux/pipe_fs_i.h:58
struct pipe_inode_info {
    struct mutex mutex;
    wait_queue_head_t rd_wait, wr_wait;  // 读写等待队列
    unsigned int head;        // 写入位置（生产者指针）
    unsigned int tail;        // 读取位置（消费者指针）
    unsigned int max_usage;   // 可用槽数上限
    unsigned int ring_size;   // 环形数组总槽数（必须是 2 的幂）
    unsigned int readers;     // 当前读端 fd 引用计数
    unsigned int writers;     // 当前写端 fd 引用计数
    struct pipe_buffer *bufs; // 环形缓冲区数组
    struct user_struct *user;
    // ...
};

// 每个缓冲区槽指向一个物理页
struct pipe_buffer {
    struct page *page;
    unsigned int offset, len;
    const struct pipe_buf_operations *ops;
    unsigned int flags;   // PIPE_BUF_FLAG_CAN_MERGE 等
    unsigned long private;
};

// fs/pipe.c:416（关键片段）
static ssize_t pipe_write(struct kiocb *iocb, struct iov_iter *from)
{
    struct pipe_inode_info *pipe = filp->private_data;
    unsigned int head;

    __pipe_lock(pipe);

    if (!pipe->readers) {
        send_sig(SIGPIPE, current, 0);  // 无读端则发 SIGPIPE
        ret = -EPIPE;
        goto out;
    }

    head = pipe->head;
    was_empty = pipe_empty(head, pipe->tail);

    /* 尝试合并到上一个 buf（小写入优化） */
    if (chars && !was_empty) {
        unsigned int mask = pipe->ring_size - 1;
        struct pipe_buffer *buf = &pipe->bufs[(head - 1) & mask];
        if ((buf->flags & PIPE_BUF_FLAG_CAN_MERGE) &&
            offset + chars <= PAGE_SIZE) {
            ret = copy_page_from_iter(buf->page, offset, chars, from);
            buf->len += ret;
        }
    }

    for (;;) {
        head = pipe->head;
        if (!pipe_full(head, pipe->tail, pipe->max_usage)) {
            struct pipe_buffer *buf = &pipe->bufs[head & mask];
            /* 分配新页，写入数据，推进 head */
            pipe->head = head + 1;
        } else {
            /* 管道满，等待读者消费 */
            if (wait_event_interruptible_exclusive(pipe->wr_wait,
                    pipe_writable(pipe)) < 0)
                break;
        }
    }
    // ...
}

// ipc/mqueue.c:134
struct mqueue_inode_info {
    spinlock_t lock;
    struct inode vfs_inode;
    wait_queue_head_t wait_q;

    struct rb_root msg_tree;            // 消息按优先级存储（红黑树）
    struct rb_node *msg_tree_rightmost; // 最高优先级节点（O(1) 访问）
    struct posix_msg_tree_node *node_cache;
    struct mq_attr attr;

    struct sigevent notify;             // 消息到达时的通知方式
    struct pid *notify_owner;
    // 等待发送 / 等待接收的任务队列
    struct ext_wait_queue e_wait_q[2];

    unsigned long qsize;   // 队列已用内存
};

// ipc/mqueue.c:61
struct posix_msg_tree_node {
    struct rb_node   rb_node;    // 插入红黑树的节点
    struct list_head msg_list;   // 相同优先级的消息链表
    int              priority;
};

// ipc/sem.c:114
struct sem_array {
    struct kern_ipc_perm  sem_perm;       // IPC 权限（key/uid/gid/mode）
    time64_t              sem_ctime;
    struct list_head      pending_alter;  // 待执行的修改操作队列
    struct list_head      pending_const;  // 待执行的只读操作队列
    struct list_head      list_id;        // undo 请求链表
    int                   sem_nsems;      // 信号量个数
    int                   complex_count;
    unsigned int          use_global_lock;

    struct sem            sems[];         // 信号量值数组（柔性数组）
} __randomize_layout;

// ipc/msg.c:49
struct msg_queue {
    struct kern_ipc_perm q_perm;
    time64_t q_stime;           // 最后 msgsnd 时间
    time64_t q_rtime;           // 最后 msgrcv 时间
    unsigned long q_cbytes;     // 当前队列字节数
    unsigned long q_qnum;       // 消息数量
    unsigned long q_qbytes;     // 最大字节限制
    struct pid *q_lspid;        // 最后发送者 PID
    struct pid *q_lrpid;        // 最后接收者 PID

    struct list_head q_messages;   // 消息链表
    struct list_head q_receivers;  // 等待接收的进程
    struct list_head q_senders;    // 等待发送的进程（队列满时阻塞）
} __randomize_layout;

// include/net/af_unix.h:56
struct unix_sock {
    struct sock         sk;         // 必须是第一个成员
    struct unix_address *addr;      // 绑定的路径名地址
    struct path         path;       // 对应的 dentry/inode
    struct mutex        iolock, bindlock;
    struct sock         *peer;      // 连接的对端 socket
    struct list_head    link;
    atomic_long_t       inflight;   // 传输中的 FD 数量
    spinlock_t          lock;
    struct socket_wq    peer_wq;
    struct scm_stat     scm_stat;
};

// net/unix/af_unix.c:2160
static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
{
    struct sock *sk = sock->sk;
    struct sock *other = unix_peer(sk);  // 对端 socket

    err = scm_send(sock, msg, &scm, false);   // 处理辅助数据（SCM_RIGHTS 等）

    while (sent < len) {
        // 分配 sk_buff，将用户数据拷贝进去
        skb = sock_alloc_send_pskb(sk, size - data_len, data_len, ...);
        err = unix_scm_to_skb(&scm, skb, !fds_sent);  // 附加文件描述符
        err = skb_copy_datagram_from_iter(skb, 0, &msg->msg_iter, size);

        unix_state_lock(other);
        skb_queue_tail(&other->sk_receive_queue, skb);  // 直接放入对端接收队列
        unix_state_unlock(other);
        other->sk_data_ready(other);   // 唤醒对端
    }
}

// kernel/futex/futex.h:45
struct futex_hash_bucket {
    atomic_t        waiters;    // 该桶中等待者计数（用于快速路径优化）
    spinlock_t      lock;
    struct plist_head chain;   // 优先级排序的等待队列（用于 PI-futex）
} ____cacheline_aligned_in_smp;

// kernel/futex/waitwake.c:632
int futex_wait(u32 __user *uaddr, unsigned int flags, u32 val,
               ktime_t *abs_time, u32 bitset)
{
    struct futex_hash_bucket *hb;
    struct futex_q q = futex_q_init;

retry:
    /* 慢速路径：进入内核，锁定 hash bucket */
    ret = futex_wait_setup(uaddr, val, flags, &q, &hb);
    /*
     * futex_wait_setup 内部：
     * 1. get_futex_key()：计算哈希键
     * 2. futex_q_lock(q)：锁定 bucket，原子地增加 waiters 计数
     * 3. 再次读取 *uaddr，若已不等于 val 则返回 -EWOULDBLOCK
     *    （防止在用户态检查和内核入队之间漏掉 wake）
     */
    if (ret)
        goto out;

    /* 入队并调度睡眠，等待 FUTEX_WAKE */
    futex_wait_queue(hb, &q, to);

    if (!futex_unqueue(&q))
        goto out;   // 已被 wake，返回 0

    if (!signal_pending(current))
        goto retry; // 虚假唤醒，重试

    ret = -ERESTARTSYS;
    // ...
}

// kernel/futex/waitwake.c:143
int futex_wake(u32 __user *uaddr, unsigned int flags, int nr_wake, u32 bitset)
{
    struct futex_hash_bucket *hb;
    DEFINE_WAKE_Q(wake_q);

    ret = get_futex_key(uaddr, flags & FLAGS_SHARED, &key, FUTEX_READ);

    hb = futex_hash(&key);

    /* 快速路径：bucket 没有等待者，直接返回 */
    if (!futex_hb_waiters_pending(hb))
        return ret;

    spin_lock(&hb->lock);
    plist_for_each_entry_safe(this, next, &hb->chain, list) {
        if (futex_match(&this->key, &key)) {
            futex_wake_mark(&wake_q, this);  // 加入唤醒队列
            if (++ret >= nr_wake)
                break;
        }
    }
    spin_unlock(&hb->lock);
    wake_up_q(&wake_q);   // 批量唤醒
    return ret;
}

// kernel/sched/sched.h:2169
struct sched_class {

#ifdef CONFIG_UCLAMP_TASK
    int uclamp_enabled;
#endif

    void (*enqueue_task) (struct rq *rq, struct task_struct *p, int flags);
    void (*dequeue_task) (struct rq *rq, struct task_struct *p, int flags);
    void (*yield_task)   (struct rq *rq);
    bool (*yield_to_task)(struct rq *rq, struct task_struct *p);

    void (*check_preempt_curr)(struct rq *rq, struct task_struct *p, int flags);

    struct task_struct *(*pick_next_task)(struct rq *rq);

    void (*put_prev_task)(struct rq *rq, struct task_struct *p);
    void (*set_next_task)(struct rq *rq, struct task_struct *p, bool first);

    void (*task_tick)(struct rq *rq, struct task_struct *p, int queued);
    void (*task_fork)(struct task_struct *p);
    void (*task_dead)(struct task_struct *p);

    void (*update_curr)(struct rq *rq);
    /* ... */
};

// kernel/sched/sched.h:2272
extern const struct sched_class stop_sched_class;
extern const struct sched_class dl_sched_class;
extern const struct sched_class rt_sched_class;
extern const struct sched_class fair_sched_class;
extern const struct sched_class idle_sched_class;

// kernel/sched/sched.h:957
struct rq {
    raw_spinlock_t      __lock;

    unsigned int        nr_running;     // 当前 CPU 可运行任务总数

    struct cfs_rq       cfs;            // CFS 运行队列
    struct rt_rq        rt;             // RT 运行队列
    struct dl_rq        dl;             // DL 运行队列

    struct task_struct __rcu    *curr;  // 当前正在运行的任务
    struct task_struct          *idle;  // idle 任务
    struct task_struct          *stop;  // stop 任务

    u64                 clock;          // 队列时钟（纳秒）
    u64                 clock_task;     // 任务时钟（排除 irq/steal）

    atomic_t            nr_iowait;      // 等待 I/O 的任务数

    /* SMP 负载均衡 */
    unsigned long       next_balance;
    /* ... */
};

// kernel/sched/sched.h:550
struct cfs_rq {
    struct load_weight  load;           // 队列总权重
    unsigned int        nr_running;     // 直接成员数
    unsigned int        h_nr_running;   // 递归成员总数（组调度）

    u64                 exec_clock;     // 已执行的 CPU 时间
    u64                 min_vruntime;   // 队列中最小 vruntime（单调递增）

    struct rb_root_cached tasks_timeline; // 红黑树（按 vruntime 排序）

    struct sched_entity *curr;          // 当前运行的调度实体
    struct sched_entity *next;          // 被标记为"优先运行"的实体
    struct sched_entity *last;          // 刚被抢占的实体（尽量恢复）
    struct sched_entity *skip;          // 应跳过的实体

#ifdef CONFIG_FAIR_GROUP_SCHED
    struct rq           *rq;            // 所属 CPU 运行队列
    struct task_group   *tg;            // 所属任务组
#endif
};

// include/linux/sched.h:549
struct sched_entity {
    /* 负载均衡用 */
    struct load_weight      load;           // 实体权重（由 nice 值决定）
    struct rb_node          run_node;       // 红黑树节点
    struct list_head        group_node;
    unsigned int            on_rq;          // 是否在运行队列中

    u64                     exec_start;     // 本次运行开始时间
    u64                     sum_exec_runtime; // 累计实际运行时间
    u64                     vruntime;       // 虚拟运行时间（CFS 核心）
    u64                     prev_sum_exec_runtime; // 上次切换时的累计时间

    u64                     nr_migrations;  // 跨 CPU 迁移次数

#ifdef CONFIG_FAIR_GROUP_SCHED
    int                     depth;          // 层级深度
    struct sched_entity     *parent;        // 父调度实体
    struct cfs_rq           *cfs_rq;        // 所在 cfs_rq
    struct cfs_rq           *my_q;          // 若为 group，则为其拥有的 cfs_rq
    unsigned long           runnable_weight;
#endif
};

// kernel/sched/core.c:11459
const int sched_prio_to_weight[40] = {
 /* -20 */     88761,     71755,     56483,     46273,     36291,
 /* -15 */     29154,     23254,     18705,     14949,     11916,
 /* -10 */      9548,      7620,      6100,      4904,      3906,
 /*  -5 */      3121,      2501,      1991,      1586,      1277,
 /*   0 */      1024,       820,       655,       526,       423,
 /*   5 */       335,       272,       215,       172,       137,
 /*  10 */       110,        87,        70,        56,        45,
 /*  15 */        36,        29,        23,        18,        15,
};

// kernel/sched/fair.c:709
static inline u64 calc_delta_fair(u64 delta, struct sched_entity *se)
{
    if (unlikely(se->load.weight != NICE_0_LOAD))
        delta = __calc_delta(delta, NICE_0_LOAD, &se->load);

    return delta;
}

// kernel/sched/fair.c:897
static void update_curr(struct cfs_rq *cfs_rq)
{
    struct sched_entity *curr = cfs_rq->curr;
    u64 now = rq_clock_task(rq_of(cfs_rq));
    u64 delta_exec;

    if (unlikely(!curr))
        return;

    delta_exec = now - curr->exec_start;   // 本次运行的真实时间
    if (unlikely((s64)delta_exec <= 0))
        return;

    curr->exec_start = now;                // 重置开始时间

    curr->sum_exec_runtime += delta_exec;  // 累加真实运行时间

    curr->vruntime += calc_delta_fair(delta_exec, curr);  // 更新虚拟时间
    update_min_vruntime(cfs_rq);           // 更新队列基准线

    if (entity_is_task(curr)) {
        struct task_struct *curtask = task_of(curr);
        cgroup_account_cputime(curtask, delta_exec);  // cgroup 计费
    }

    account_cfs_rq_runtime(cfs_rq, delta_exec);  // 带宽控制计费
}

// kernel/sched/fair.c:643
static void __enqueue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se)
{
    rb_add_cached(&se->run_node, &cfs_rq->tasks_timeline, __entity_less);
}

static void __dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se)
{
    rb_erase_cached(&se->run_node, &cfs_rq->tasks_timeline);
}

struct sched_entity *__pick_first_entity(struct cfs_rq *cfs_rq)
{
    struct rb_node *left = rb_first_cached(&cfs_rq->tasks_timeline);

    if (!left)
        return NULL;

    return __node_2_se(left);
}

// kernel/sched/fair.c:5084
pick_next_entity(struct cfs_rq *cfs_rq, struct sched_entity *curr)
{
    struct sched_entity *left = __pick_first_entity(cfs_rq);
    struct sched_entity *se;

    /*
     * 若 curr 仍在队列中且其 vruntime 小于树中最左节点，优先考虑 curr
     */
    if (!left || (curr && entity_before(curr, left)))
        left = curr;

    se = left;  /* 理想情况下运行最左实体 */

    /* 避免运行 skip buddy（主动 yield 时标记）*/
    if (cfs_rq->skip && cfs_rq->skip == se) {
        struct sched_entity *second;
        /* 尝试选次优实体 */
        if (se == curr) {
            second = __pick_first_entity(cfs_rq);
        } else {
            second = __pick_next_entity(se);
            if (!second || (curr && entity_before(curr, second)))
                second = curr;
        }
        if (second && wakeup_preempt_entity(second, left) < 1)
            se = second;
    }

    /* next buddy：被标记为"下一个应运行"（wakeup 抢占提名） */
    if (cfs_rq->next && wakeup_preempt_entity(cfs_rq->next, left) < 1) {
        se = cfs_rq->next;
    } else if (cfs_rq->last && wakeup_preempt_entity(cfs_rq->last, left) < 1) {
        /* last buddy：尽量恢复刚被抢占的任务，减少上下文切换 */
        se = cfs_rq->last;
    }

    return se;
}

// kernel/sched/fair.c:6291
enqueue_task_fair(struct rq *rq, struct task_struct *p, int flags)
{
    struct cfs_rq *cfs_rq;
    struct sched_entity *se = &p->se;
    int task_new = !(flags & ENQUEUE_WAKEUP);

    util_est_enqueue(&rq->cfs, p);  // 更新利用率估计

    for_each_sched_entity(se) {
        if (se->on_rq)
            break;
        cfs_rq = cfs_rq_of(se);
        enqueue_entity(cfs_rq, se, flags);  // 插入 cfs_rq

        cfs_rq->h_nr_running++;

        if (cfs_rq_throttled(cfs_rq))  // 若队列被限流则停止向上传播
            goto enqueue_throttle;

        flags = ENQUEUE_WAKEUP;
    }

    /* 更新父层级的统计（组调度） */
    for_each_sched_entity(se) {
        cfs_rq = cfs_rq_of(se);
        update_load_avg(cfs_rq, se, UPDATE_TG);
        update_cfs_group(se);
        cfs_rq->h_nr_running++;
        if (cfs_rq_throttled(cfs_rq))
            goto enqueue_throttle;
    }

    add_nr_running(rq, 1);  // 全局 nr_running +1
    /* ... */
}

// kernel/sched/fair.c:4823
static void
enqueue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
{
    bool renorm = !(flags & ENQUEUE_WAKEUP) || (flags & ENQUEUE_MIGRATED);

    if (renorm && cfs_rq->curr == se)
        se->vruntime += cfs_rq->min_vruntime;  // 规范化（迁移后）

    update_curr(cfs_rq);  // 先更新当前进程的 vruntime

    if (renorm && cfs_rq->curr != se)
        se->vruntime += cfs_rq->min_vruntime;

    update_load_avg(cfs_rq, se, UPDATE_TG | DO_ATTACH);
    account_entity_enqueue(cfs_rq, se);  // 加入队列权重

    if (flags & ENQUEUE_WAKEUP)
        place_entity(cfs_rq, se, 0);  // 设置唤醒进程的初始 vruntime

    if (!curr)
        __enqueue_entity(cfs_rq, se);  // 插入红黑树
    se->on_rq = 1;
}

// kernel/sched/fair.c:4732
place_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int initial)
{
    u64 vruntime = cfs_rq->min_vruntime;  // 以队列基准线为起点

    if (initial && sched_feat(START_DEBIT))
        vruntime += sched_vslice(cfs_rq, se);  // 新进程：额外惩罚一个 vslice

    if (!initial) {
        unsigned long thresh;

        if (se_is_idle(se))
            thresh = sysctl_sched_min_granularity;
        else
            thresh = sysctl_sched_latency;  // 唤醒进程：补偿最多一个调度周期

        if (sched_feat(GENTLE_FAIR_SLEEPERS))
            thresh >>= 1;  // 只补偿一半，避免 sleeper 占便宜

        vruntime -= thresh;
    }

    /* 确保不倒退（防止 vruntime 溢出边界情况） */
    if (entity_is_long_sleeper(se))
        se->vruntime = vruntime;
    else
        se->vruntime = max_vruntime(se->vruntime, vruntime);
}

// kernel/sched/fair.c:6384
static void dequeue_task_fair(struct rq *rq, struct task_struct *p, int flags)
{
    struct cfs_rq *cfs_rq;
    struct sched_entity *se = &p->se;
    int task_sleep = flags & DEQUEUE_SLEEP;

    util_est_dequeue(&rq->cfs, p);

    for_each_sched_entity(se) {
        cfs_rq = cfs_rq_of(se);
        dequeue_entity(cfs_rq, se, flags);

        cfs_rq->h_nr_running--;

        if (cfs_rq_throttled(cfs_rq))
            goto dequeue_throttle;

        /* 若父队列中还有其他实体，停止向上传播 */
        if (cfs_rq->load.weight) {
            se = parent_entity(se);
            /* 进程主动睡眠时，提名父实体为 next_buddy，提升同组任务的调度优先级 */
            if (task_sleep && se && !throttled_hierarchy(cfs_rq))
                set_next_buddy(se);
            break;
        }
        flags |= DEQUEUE_SLEEP;
    }

    /* 更新父层级统计 */
    for_each_sched_entity(se) { /* ... */ }

    sub_nr_running(rq, 1);  // 全局 nr_running -1
}

// kernel/sched/fair.c:741
static u64 sched_slice(struct cfs_rq *cfs_rq, struct sched_entity *se)
{
    unsigned int nr_running = cfs_rq->nr_running;
    u64 slice;

    /* 调度周期：nr_running <= sched_nr_latency 时固定为 sysctl_sched_latency
     * 超过时按比例拉伸：period = nr_running × min_granularity
     */
    slice = __sched_period(nr_running + !se->on_rq);

    /* 按权重比例分配：slice = period × (se->weight / cfs_rq->total_weight) */
    for_each_sched_entity(se) {
        struct load_weight *load;
        struct cfs_rq *qcfs_rq = cfs_rq_of(se);
        /* ... 计算权重比 ... */
        slice = __calc_delta(slice, se->load.weight, load);
    }

    /* 确保不低于最小粒度 */
    /* ... */
    return slice;
}

// kernel/sched/fair.c:12064
static void task_tick_fair(struct rq *rq, struct task_struct *curr, int queued)
{
    struct cfs_rq *cfs_rq;
    struct sched_entity *se = &curr->se;

    for_each_sched_entity(se) {
        cfs_rq = cfs_rq_of(se);
        entity_tick(cfs_rq, se, queued);  // 每层 cfs_rq 都更新
    }

    if (static_branch_unlikely(&sched_numa_balancing))
        task_tick_numa(rq, curr);  // NUMA 平衡检查

    update_misfit_status(curr, rq);
    update_overutilized_status(task_rq(curr));
}

// kernel/sched/fair.c:4993
static void
check_preempt_tick(struct cfs_rq *cfs_rq, struct sched_entity *curr)
{
    unsigned long ideal_runtime, delta_exec;
    struct sched_entity *se;
    s64 delta;

    /* 当前进程的理想运行时间（sched_slice 与 sysctl_sched_latency 取小） */
    ideal_runtime = min_t(u64, sched_slice(cfs_rq, curr), sysctl_sched_latency);

    delta_exec = curr->sum_exec_runtime - curr->prev_sum_exec_runtime;
    if (delta_exec > ideal_runtime) {
        resched_curr(rq_of(cfs_rq));  // 设置 TIF_NEED_RESCHED
        clear_buddies(cfs_rq, curr);
        return;
    }

    /* 若运行时间不足最小粒度，不抢占（避免频繁切换） */
    if (delta_exec < sysctl_sched_min_granularity)
        return;

    /* 若当前进程的 vruntime 已超过红黑树最左节点 delta > ideal_runtime，抢占 */
    se = __pick_first_entity(cfs_rq);
    delta = curr->vruntime - se->vruntime;
    if (delta < 0)
        return;
    if (delta > ideal_runtime)
        resched_curr(rq_of(cfs_rq));
}

// kernel/sched/core.c:5602
void scheduler_tick(void)
{
    int cpu = smp_processor_id();
    struct rq *rq = cpu_rq(cpu);
    struct task_struct *curr = rq->curr;

    rq_lock(rq, &rf);
    update_rq_clock(rq);
    curr->sched_class->task_tick(rq, curr, 0);  // 调用调度类的 tick 方法
    calc_global_load_tick(rq);

    rq_unlock(rq, &rf);

#ifdef CONFIG_SMP
    rq->idle_balance = idle_cpu(cpu);
    trigger_load_balance(rq);  // 触发 SMP 负载均衡
#endif
}

// kernel/sched/fair.c:7855
static void check_preempt_wakeup(struct rq *rq, struct task_struct *p, int wake_flags)
{
    struct task_struct *curr = rq->curr;
    struct sched_entity *se = &curr->se, *pse = &p->se;
    struct cfs_rq *cfs_rq = task_cfs_rq(curr);

    /* SCHED_BATCH/SCHED_IDLE 进程不会通过 wakeup 抢占 */
    if (unlikely(p->policy != SCHED_NORMAL) || !sched_feat(WAKEUP_PREEMPTION))
        return;

    find_matching_se(&se, &pse);  // 找到公共祖先层级

    update_curr(cfs_rq_of(se));
    if (wakeup_preempt_entity(se, pse) == 1) {
        if (!next_buddy_marked)
            set_next_buddy(pse);  // 提名新任务为 next buddy
        goto preempt;
    }
    return;

preempt:
    resched_curr(rq);  // 设置重调度标志
}

// kernel/sched/fair.c:7810
wakeup_preempt_entity(struct sched_entity *curr, struct sched_entity *se)
{
    s64 gran, vdiff = curr->vruntime - se->vruntime;

    if (vdiff <= 0)
        return -1;  // 新任务 vruntime 更大，不抢占

    gran = wakeup_gran(se);  // 基于 sysctl_sched_wakeup_granularity 计算
    if (vdiff > gran)
        return 1;  // 差距超过粒度阈值，触发抢占

    return 0;
}

// kernel/sched/sched.h:369
struct task_group {
    struct cgroup_subsys_state css;  // cgroup 子系统状态

#ifdef CONFIG_FAIR_GROUP_SCHED
    struct sched_entity **se;        // 每个 CPU 的调度实体（该组在父队列中的代表）
    struct cfs_rq       **cfs_rq;   // 每个 CPU 的 CFS 运行队列
    unsigned long        shares;    // cpu.shares（cgroup v1）/ cpu.weight（v2）
#endif

    struct task_group   *parent;
    struct list_head     siblings;
    struct list_head     children;

    struct cfs_bandwidth cfs_bandwidth;  // CPU 带宽控制（quota/period）
};

// kernel/sched/fair.c:5400
static bool throttle_cfs_rq(struct cfs_rq *cfs_rq)
{
    struct cfs_bandwidth *cfs_b = tg_cfs_bandwidth(cfs_rq->tg);

    raw_spin_lock(&cfs_b->lock);
    if (__assign_cfs_rq_runtime(cfs_b, cfs_rq, 1)) {
        /* 有新配额分配，不需要限流 */
        dequeue = 0;
    } else {
        /* 将 cfs_rq 加入限流链表 */
        list_add_tail_rcu(&cfs_rq->throttled_list,
                          &cfs_b->throttled_cfs_rq);
    }
    raw_spin_unlock(&cfs_b->lock);

    if (!dequeue)
        return false;

    /* 从父 cfs_rq 中移除该组的调度实体 */
    se = cfs_rq->tg->se[cpu_of(rq_of(cfs_rq))];
    for_each_sched_entity(se) {
        dequeue_entity(qcfs_rq, se, DEQUEUE_SLEEP);
        /* ... */
    }
    sub_nr_running(rq, task_delta);
    /* ... */
}

// kernel/sched/fair.c:10733
static int load_balance(int this_cpu, struct rq *this_rq,
                        struct sched_domain *sd, enum cpu_idle_type idle,
                        int *continue_balancing)
{
    struct sched_group *group;
    struct rq *busiest;
    struct lb_env env = {
        .sd      = sd,
        .dst_cpu = this_cpu,
        .dst_rq  = this_rq,
        .idle    = idle,
        /* ... */
    };

    cpumask_and(cpus, sched_domain_span(sd), cpu_active_mask);

    group = find_busiest_group(&env);      // 在调度域中找最繁忙的组
    if (!group) goto out_balanced;

    busiest = find_busiest_queue(&env, group);  // 在组中找最繁忙的队列
    if (!busiest) goto out_balanced;

    env.src_cpu = busiest->cpu;
    env.src_rq  = busiest;

    /* 迁移任务 */
    ld_moved = detach_tasks(&env);
    if (ld_moved) {
        attach_tasks(&env);
        /* ... */
    }
    /* ... */
}

// kernel/sched/fair.c:10361
static struct sched_group *find_busiest_group(struct lb_env *env)
{
    /* 统计每个 sched_group 的负载 */
    update_sd_lb_stats(env, &sds);

    /* 处理特殊情况：misfit task、asym packing、imbalanced group */
    if (busiest->group_type == group_misfit_task) goto force_balance;
    if (busiest->group_type == group_asym_packing)  goto force_balance;

    /* 计算不平衡量 */
    calculate_imbalance(env, &sds);
    return sds.busiest;
}

// kernel/sched/fair.c:10490
static struct rq *find_busiest_queue(struct lb_env *env,
                                     struct sched_group *group)
{
    /* 遍历组内各 CPU，找 runnable_load 最大且允许迁移的队列 */
    for_each_cpu_and(i, sched_group_span(group), env->cpus) {
        /* 计算 rq 的 runnable load，选择最大值 */
        /* 排除亲和性不允许迁移的情况 */
    }
    return busiest;
}

// kernel/sched/fair.c:3188
static void task_tick_numa(struct rq *rq, struct task_struct *curr)
{
    /*
     * 周期性扫描任务的内存访问模式，
     * 通过页表保护位触发 NUMA hinting fault，
     * 统计各 NUMA 节点的访问热度，
     * 将任务迁移到访问最频繁的内存所在节点。
     */
    now = curr->se.sum_exec_runtime;
    period = (u64)curr->numa_scan_period * NSEC_PER_MSEC;

    if (now > curr->node_stamp + period) {
        curr->node_stamp += period;
        if (!time_before(jiffies, curr->mm->numa_next_scan))
            task_work_add(curr, work, TWA_RESUME);  // 触发 NUMA 扫描
    }
}

// kernel/sched/sched.h:273
struct rt_prio_array {
    DECLARE_BITMAP(bitmap, MAX_RT_PRIO+1);  // 位图：标记哪些优先级有任务
    struct list_head queue[MAX_RT_PRIO];    // 每个优先级对应一个 FIFO 链表
};

// kernel/sched/rt.c:1787
static struct task_struct *_pick_next_task_rt(struct rq *rq)
{
    struct sched_rt_entity *rt_se;
    struct rt_rq *rt_rq = &rq->rt;

    do {
        rt_se = pick_next_rt_entity(rt_rq);  // 从位图找最高优先级任务
        if (unlikely(!rt_se))
            return NULL;
        rt_rq = group_rt_rq(rt_se);
    } while (rt_rq);

    return rt_task_of(rt_se);
}