From: Kiryl Shutsemau <kas@kernel.org>
To: James Houghton <jthoughton@google.com>
Cc: Lance Yang <lance.yang@linux.dev>,
Andrew Morton <akpm@linux-foundation.org>,
david@kernel.org, ljs@kernel.org, ziy@nvidia.com,
baolin.wang@linux.alibaba.com, liam@infradead.org,
nico.pache@linux.dev, ryan.roberts@arm.com, dev.jain@arm.com,
baohua@kernel.org, usama.arif@linux.dev, shy828301@gmail.com,
zokeefe@google.com, hughd@google.com, linux-mm@kvack.org,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: Re: [PATCH] mm/khugepaged: Don't collapse uffd-minor-registered VMAs
Date: Wed, 2 Sep 2026 11:27:42 +0100 [thread overview]
Message-ID: <apf5xBqj5560JlMD@thinkstation> (raw)
In-Reply-To: <CADrL8HW3=n8VqW+7YSb2kyhkHidNKGy32+2s7A0OfF+oYoAifg@mail.gmail.com>
On Mon, Aug 31, 2026 at 09:51:33AM -0700, James Houghton wrote:
> On Fri, Aug 28, 2026 at 10:26 PM Lance Yang <lance.yang@linux.dev> wrote:
> > >On Fri, Aug 28, 2026 at 12:50:04AM +0000, James Houghton wrote:
> > >>If userspace implements post-copy live migration using userfaultfd minor
> > >>faults, this situation is currently possible:
> > >>1. The VMA for guest memory is userfaultfd-minor-registered and nothing
> > >> is mapped in the page tables.
> > >>2. A stale copy of a page is present in a naturally-aligned THP (from
> > >> pre-copy live migration).
> > >>3. khugepaged collapses the mapping of the THP, installs a PMD.
> >
> > Ouch ... I missed this earlier. The problem is real, but this commit
> > message describes the wrong trigger.
> >
> > Background khugepaged calls try_collapse_pte_mapped_thp() with
> > install_pmd=false, so it cannot install the PMD or trigger this
> > sequence. MADV_COLLAPSE passes install_pmd=true and installs the PMD.
> >
> > So the problem described here can only be triggered by MADV_COLLAPSE,
> > whether it comes through madvise() or process_madvise(), no?
>
> Oh yeah, you're right. In our downstream version, `install_pmd` is set
> to true for the khugepaged collapse path; I missed that it was false
> upstream. Sorry about that. :(
>
> So we can definitely remove cc:stable, there is no bug here.
>
> WRT the semantics of process_madvise(MADV_COLLAPSE) and normal
> madvise(MADV_COLLAPSE), I think it makes sense to always disallow
> collapsing of UFFD-minor VMAs, whether MADV_COLLAPSE comes from our
> own process or another. UFFD-minor faults are intended to be resolved
> only with UFFDIO_CONTINUE, and until someone asks for it, I don't
> really see a need to make MADV_COLLAPSE actually work to resolve minor
> faults. I don't think userspace can *rely* on MADV_COLLAPSE resolving
> minor faults either.
It is safer to go with stricter policy: reject always. We can always
relax it later if there is a use-case and reasoning about the interface
is solid. We don't have it yet.
--
Kiryl Shutsemau / Kirill A. Shutemov
next prev parent reply other threads:[~2026-09-02 10:27 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-28 0:50 [PATCH] mm/khugepaged: Don't collapse uffd-minor-registered VMAs James Houghton
2026-08-28 9:47 ` Lance Yang
2026-08-28 13:07 ` Kiryl Shutsemau
2026-08-29 4:15 ` Lance Yang
2026-08-29 6:03 ` Lance Yang
2026-08-28 19:07 ` James Houghton
2026-08-29 5:26 ` Lance Yang
2026-08-31 16:51 ` James Houghton
2026-09-02 10:27 ` Kiryl Shutsemau [this message]
2026-09-02 20:41 ` James Houghton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=apf5xBqj5560JlMD@thinkstation \
--to=kas@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=baohua@kernel.org \
--cc=baolin.wang@linux.alibaba.com \
--cc=david@kernel.org \
--cc=dev.jain@arm.com \
--cc=hughd@google.com \
--cc=jthoughton@google.com \
--cc=lance.yang@linux.dev \
--cc=liam@infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=ljs@kernel.org \
--cc=nico.pache@linux.dev \
--cc=ryan.roberts@arm.com \
--cc=shy828301@gmail.com \
--cc=stable@vger.kernel.org \
--cc=usama.arif@linux.dev \
--cc=ziy@nvidia.com \
--cc=zokeefe@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.