From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5599130E0D6 for ; Thu, 9 Jul 2026 02:07:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783562846; cv=none; b=cSHYGmoFXgY4+246Uco0CABdvKPubHHE5/kvxQ2oNAj3muWZK8Bt7Clo6snmSDwJLGMnbzm17JjlepAK5zJJlrhYcjhJ7H7Zpu5AxZpn/UbJ9lEmIKFggNCqKFkYmw2hheUAudk+DCEVFrHTj0nsdaqTX7mtMzc8/O7WvE0Sy5w= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783562846; c=relaxed/simple; bh=bGCXEppgfOYPnsMFUlPNVosuzJD5QFSk/mUFB7efAjY=; h=Date:To:From:Subject:Message-Id; b=jf+7yan2DsD/kRTwKHMqyJzXp9WU2zFlM6Cum2U3oz9XGgxi3lsJ1Ut3Cmv2bow8UYztFrERSn1gj+WIvRS6m/2pS+n1WlgytnKb23oaydCtQvJ2T97hH3GoIoqh9AGQjhPAWjg2PYqSOkfE0tC9uI+A+zyTusf2hXaGdRxOKP4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b=SY/GWtXM; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux-foundation.org header.i=@linux-foundation.org header.b="SY/GWtXM" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E2B441F000E9; Thu, 9 Jul 2026 02:07:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-foundation.org; s=korg; t=1783562845; bh=m6TjuORMhVleJwleYTJbuNh+P1TTBJ8wIZPLELaZ8+Y=; h=Date:To:From:Subject; b=SY/GWtXMS0CfVm/2C6LCy7mqIfAhaXn2PJfAZnh68JMZfLe9SRPMuIdjDqvzLsRJS 13gg01avgRAnDMC6FTT1RxFAUvKm1Neo8i7I3vnHu+4BhLuh3DjEWVbjn+r+0TzSmD PBpEr3vDAV9kK7LrdjFN6CpCw21tJfAnqJWNs07I= Date: Wed, 08 Jul 2026 19:07:24 -0700 To: mm-commits@vger.kernel.org,kas@kernel.org,akpm@linux-foundation.org From: Andrew Morton Subject: + userfaultfd-add-uffd_feature_rwp_async-for-async-fault-resolution.patch added to mm-new branch Message-Id: <20260709020724.E2B441F000E9@smtp.kernel.org> Precedence: bulk X-Mailing-List: mm-commits@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: The patch titled Subject: userfaultfd: add UFFD_FEATURE_RWP_ASYNC for async fault resolution has been added to the -mm mm-new branch. Its filename is userfaultfd-add-uffd_feature_rwp_async-for-async-fault-resolution.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/userfaultfd-add-uffd_feature_rwp_async-for-async-fault-resolution.patch This patch will later appear in the mm-new branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Note, mm-new is a provisional staging ground for work-in-progress patches, and acceptance into mm-new is a notification for others take notice and to finish up reviews. Please do not hesitate to respond to review feedback and post updated versions to replace or incrementally fixup patches in mm-new. The mm-new branch of mm.git is not included in linux-next If a few days of testing in mm-new is successful, the patch will me moved into mm.git's mm-unstable branch, which is included in linux-next Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via various branches at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there most days ------------------------------------------------------ From: "Kiryl Shutsemau (Meta)" Subject: userfaultfd: add UFFD_FEATURE_RWP_ASYNC for async fault resolution Date: Wed, 8 Jul 2026 12:14:13 +0100 Sync RWP delivers a message and blocks the faulting thread until the handler resolves the fault. For working-set tracking the VMM does not need the message: it just needs to know, at scan time, which pages were touched. Async RWP serves that use case — the kernel restores access in-place and the faulting thread continues without blocking. The VMM reconstructs the access pattern after the fact via PAGEMAP_SCAN: pages whose uffd bit is still set (inverted PAGE_IS_ACCESSED) were not re-accessed since the last RWP cycle. Worth calling out: async resolution upgrades writable private anon PTEs via pte_mkwrite() when can_change_pte_writable() allows, mirroring do_numa_page(). Without it, every re-access of an RWP'd writable page would COW-fault a second time. UFFD_FEATURE_RWP_ASYNC requires UFFD_FEATURE_RWP. Link: https://lore.kernel.org/20260708111417.173443-13-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau Assisted-by: Claude:claude-opus-4-6 Acked-by: Mike Rapoport (Microsoft) Cc: Andrea Arcangeli Cc: David Hildenbrand Cc: James Houghton Cc: Jonathan Corbet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Paolo Bonzini Cc: Peter Xu Cc: Sean Christopherson Cc: SeongJae Park Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton --- include/linux/userfaultfd_k.h | 6 +++++ include/uapi/linux/userfaultfd.h | 11 +++++++++ mm/huge_memory.c | 25 +++++++++++++++++++++- mm/hugetlb.c | 32 ++++++++++++++++++++++++++++- mm/memory.c | 27 ++++++++++++++++++++++-- mm/userfaultfd.c | 19 ++++++++++++++++- 6 files changed, 114 insertions(+), 6 deletions(-) --- a/include/linux/userfaultfd_k.h~userfaultfd-add-uffd_feature_rwp_async-for-async-fault-resolution +++ a/include/linux/userfaultfd_k.h @@ -286,6 +286,7 @@ extern void userfaultfd_unmap_complete(s struct list_head *uf); extern bool userfaultfd_wp_unpopulated(struct vm_area_struct *vma); extern bool userfaultfd_wp_async(struct vm_area_struct *vma); +extern bool userfaultfd_rwp_async(struct vm_area_struct *vma); static inline bool userfaultfd_wp_use_markers(struct vm_area_struct *vma) { @@ -463,6 +464,11 @@ static inline bool userfaultfd_wp_async( { return false; } + +static inline bool userfaultfd_rwp_async(struct vm_area_struct *vma) +{ + return false; +} static inline bool vma_has_uffd_without_event_remap(struct vm_area_struct *vma) { --- a/include/uapi/linux/userfaultfd.h~userfaultfd-add-uffd_feature_rwp_async-for-async-fault-resolution +++ a/include/uapi/linux/userfaultfd.h @@ -44,7 +44,8 @@ UFFD_FEATURE_POISON | \ UFFD_FEATURE_WP_ASYNC | \ UFFD_FEATURE_MOVE | \ - UFFD_FEATURE_RWP) + UFFD_FEATURE_RWP | \ + UFFD_FEATURE_RWP_ASYNC) #define UFFD_API_IOCTLS \ ((__u64)1 << _UFFDIO_REGISTER | \ (__u64)1 << _UFFDIO_UNREGISTER | \ @@ -243,6 +244,13 @@ struct uffdio_api { * UFFDIO_REGISTER_MODE_RWP for read-write protection tracking. * Pages are made inaccessible via UFFDIO_RWPROTECT and faults * are delivered when the pages are re-accessed. + * + * UFFD_FEATURE_RWP_ASYNC indicates asynchronous mode for + * UFFDIO_REGISTER_MODE_RWP. When set, faults on read-write + * protected pages are auto-resolved by the kernel (PTE + * permissions restored immediately) without delivering a message + * to the userfaultfd handler. Use PAGEMAP_SCAN with inverted + * PAGE_IS_ACCESSED to find pages that were not re-accessed. */ #define UFFD_FEATURE_PAGEFAULT_FLAG_WP (1<<0) #define UFFD_FEATURE_EVENT_FORK (1<<1) @@ -262,6 +270,7 @@ struct uffdio_api { #define UFFD_FEATURE_WP_ASYNC (1<<15) #define UFFD_FEATURE_MOVE (1<<16) #define UFFD_FEATURE_RWP (1<<17) +#define UFFD_FEATURE_RWP_ASYNC (1<<18) __u64 features; __u64 ioctls; --- a/mm/huge_memory.c~userfaultfd-add-uffd_feature_rwp_async-for-async-fault-resolution +++ a/mm/huge_memory.c @@ -2204,7 +2204,30 @@ static inline bool can_change_pmd_writab vm_fault_t do_huge_pmd_uffd_rwp(struct vm_fault *vmf) { - return handle_userfault(vmf, VM_UFFD_RWP); + struct vm_area_struct *vma = vmf->vma; + pmd_t pmd; + + if (!userfaultfd_rwp_async(vma)) + return handle_userfault(vmf, VM_UFFD_RWP); + + vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd); + if (unlikely(!pmd_same(pmdp_get(vmf->pmd), vmf->orig_pmd))) { + spin_unlock(vmf->ptl); + return 0; + } + pmd = pmd_modify(vmf->orig_pmd, vma->vm_page_prot); + /* pmd_modify() preserves _PAGE_UFFD; drop it on resolution */ + pmd = pmd_clear_uffd(pmd); + pmd = pmd_mkyoung(pmd); + if (!pmd_write(pmd) && + vma_wants_manual_pte_write_upgrade(vma) && + can_change_pmd_writable(vma, vmf->address, pmd)) + pmd = pmd_mkwrite(pmd, vma); + set_pmd_at(vma->vm_mm, vmf->address & HPAGE_PMD_MASK, + vmf->pmd, pmd); + update_mmu_cache_pmd(vma, vmf->address, vmf->pmd); + spin_unlock(vmf->ptl); + return 0; } /* NUMA hinting page fault entry point for trans huge pmds */ --- a/mm/hugetlb.c~userfaultfd-add-uffd_feature_rwp_async-for-async-fault-resolution +++ a/mm/hugetlb.c @@ -6111,7 +6111,37 @@ vm_fault_t hugetlb_fault(struct mm_struc */ if (pte_protnone(vmf.orig_pte) && vma_is_accessible(vma) && userfaultfd_rwp(vma) && huge_pte_uffd(vmf.orig_pte)) { - return hugetlb_handle_userfault(&vmf, mapping, VM_UFFD_RWP); + spinlock_t *ptl; + pte_t pte; + + /* Sync: drop hugetlb locks before blocking in handle_userfault() */ + if (!userfaultfd_rwp_async(vma)) + return hugetlb_handle_userfault(&vmf, mapping, VM_UFFD_RWP); + + ptl = huge_pte_lock(h, mm, vmf.pte); + pte = huge_ptep_get(mm, vmf.address, vmf.pte); + if (pte_protnone(pte) && huge_pte_uffd(pte)) { + unsigned int shift = huge_page_shift(h); + + pte = huge_pte_modify(pte, vma->vm_page_prot); + pte = arch_make_huge_pte(pte, shift, vma->vm_flags); + /* huge_pte_modify() preserves _PAGE_UFFD; drop it on resolution */ + pte = huge_pte_clear_uffd(pte); + pte = pte_mkyoung(pte); + /* + * Unlike do_uffd_rwp(), do not upgrade to writable + * here. Hugetlb lacks a can_change_huge_pte_writable() + * equivalent, so a write access will take a separate + * COW fault — acceptable for the rare private hugetlb + * case. + */ + set_huge_pte_at(mm, vmf.address, vmf.pte, pte, + huge_page_size(h)); + update_mmu_cache(vma, vmf.address, vmf.pte); + } + spin_unlock(ptl); + ret = 0; + goto out_mutex; } /* --- a/mm/memory.c~userfaultfd-add-uffd_feature_rwp_async-for-async-fault-resolution +++ a/mm/memory.c @@ -6146,8 +6146,31 @@ static void numa_rebuild_large_mapping(s static vm_fault_t do_uffd_rwp(struct vm_fault *vmf) { - pte_unmap(vmf->pte); - return handle_userfault(vmf, VM_UFFD_RWP); + pte_t pte; + + if (!userfaultfd_rwp_async(vmf->vma)) { + /* Sync mode: unmap PTE and deliver to userfaultfd handler */ + pte_unmap(vmf->pte); + return handle_userfault(vmf, VM_UFFD_RWP); + } + + spin_lock(vmf->ptl); + if (unlikely(!pte_same(ptep_get(vmf->pte), vmf->orig_pte))) { + pte_unmap_unlock(vmf->pte, vmf->ptl); + return 0; + } + pte = pte_modify(vmf->orig_pte, vmf->vma->vm_page_prot); + /* pte_modify() preserves _PAGE_UFFD; drop it on resolution */ + pte = pte_clear_uffd(pte); + pte = pte_mkyoung(pte); + if (!pte_write(pte) && + vma_wants_manual_pte_write_upgrade(vmf->vma) && + can_change_pte_writable(vmf->vma, vmf->address, pte)) + pte = pte_mkwrite(pte, vmf->vma); + set_pte_at(vmf->vma->vm_mm, vmf->address, vmf->pte, pte); + update_mmu_cache(vmf->vma, vmf->address, vmf->pte); + pte_unmap_unlock(vmf->pte, vmf->ptl); + return 0; } static vm_fault_t do_numa_page(struct vm_fault *vmf) --- a/mm/userfaultfd.c~userfaultfd-add-uffd_feature_rwp_async-for-async-fault-resolution +++ a/mm/userfaultfd.c @@ -2496,6 +2496,11 @@ static bool userfaultfd_wp_async_ctx(str return ctx && (ctx->features & UFFD_FEATURE_WP_ASYNC); } +static bool userfaultfd_rwp_async_ctx(struct userfaultfd_ctx *ctx) +{ + return ctx && (ctx->features & UFFD_FEATURE_RWP_ASYNC); +} + /* * Whether WP_UNPOPULATED is enabled on the uffd context. It is only * meaningful when userfaultfd_wp()==true on the vma and when it's @@ -4428,6 +4433,11 @@ bool userfaultfd_wp_async(struct vm_area return userfaultfd_wp_async_ctx(vma->vm_userfaultfd_ctx.ctx); } +bool userfaultfd_rwp_async(struct vm_area_struct *vma) +{ + return userfaultfd_rwp_async_ctx(vma->vm_userfaultfd_ctx.ctx); +} + static inline unsigned int uffd_ctx_features(__u64 user_features) { /* @@ -4531,6 +4541,12 @@ static int userfaultfd_api(struct userfa if (features & UFFD_FEATURE_WP_ASYNC) features |= UFFD_FEATURE_WP_UNPOPULATED; + ret = -EINVAL; + /* RWP_ASYNC requires RWP */ + if ((features & UFFD_FEATURE_RWP_ASYNC) && + !(features & UFFD_FEATURE_RWP)) + goto err_out; + /* report all available features and ioctls to userland */ uffdio_api.features = UFFD_API_FEATURES; #ifndef CONFIG_HAVE_ARCH_USERFAULTFD_MINOR @@ -4553,7 +4569,8 @@ static int userfaultfd_api(struct userfa * but not actually usable. */ if (VM_UFFD_RWP == VM_NONE || !pgtable_supports_uffd()) - uffdio_api.features &= ~UFFD_FEATURE_RWP; + uffdio_api.features &= + ~(UFFD_FEATURE_RWP | UFFD_FEATURE_RWP_ASYNC); ret = -EINVAL; if (features & ~uffdio_api.features) _ Patches currently in -mm which might be from kas@kernel.org are mm-hugetlb-fix-swap-entry-corruption-when-clearing-uffd-wp-at-fork.patch fs-proc-task_mmu-fix-pagemap_scan-written-state-for-unpopulated-ptes.patch mm-decouple-protnone-helpers-from-config_numa_balancing.patch mm-rename-uffd-wp-pte-bit-macros-to-uffd.patch mm-rename-uffd-wp-pte-accessors-to-uffd.patch userfaultfd-test-uffd-vma-flags-through-the-vma_flags_t-api.patch mm-add-vm_uffd_rwp-vma-flag.patch mm-add-mm_cp_uffd_rwp-change_protection-flag.patch mm-preserve-rwp-marker-across-pte-rewrites.patch mm-handle-vm_uffd_rwp-in-khugepaged-rmap-and-gup.patch userfaultfd-add-uffdio_register_mode_rwp-and-uffdio_rwprotect-plumbing.patch mm-userfaultfd-add-rwp-fault-delivery-and-expose-uffdio_register_mode_rwp.patch mm-pagemap-add-page_is_accessed-for-rwp-tracking.patch userfaultfd-add-uffd_feature_rwp_async-for-async-fault-resolution.patch userfaultfd-add-uffdio_set_mode-for-runtime-sync-async-toggle.patch selftests-mm-add-userfaultfd-rwp-tests.patch documentation-userfaultfd-document-rwp-working-set-tracking.patch