From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f49.google.com (mail-qv1-f49.google.com [209.85.219.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 44B6E368D72 for ; Fri, 10 Jul 2026 16:31:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783701102; cv=none; b=jq4dmWO0aUq1BLrpTpeFw+C+DVrvGz0/7jS5gD2e+Tk0AQhcqMPwDk2nY0ilImaVxOUbTwXgLybnDiTMhAVkfetJKVEhIPCB+U+z7o30QSEaxaDqnGD1Xwq3PT2mF6dgnGLmqPXjCS0rEfvoOSyKMwMtOqzkwkx3qAv8i4WKBi8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783701102; c=relaxed/simple; bh=Sbx8vXWqQQ/M0W9UlsuLQM8Ua5Q1vedFs+JL66TJWSc=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=ByIwuXx0jlB2OK1R69A8FlZ8TsfL6E0qRuuwmNqnyNsp58rPK1XJdr2cPlAavXVdOWHpOyNh89k0eHhpdtUoysyoKyFOZQhTyvCBdNJ81V+MAB2mbzJqo+ZM2/8s+deM+koBRp2ijk4SS4AeZNDbdpK6UMiZZyaQQ6bSpY94oqs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca; spf=pass smtp.mailfrom=ziepe.ca; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b=C9B0DUBQ; arc=none smtp.client-ip=209.85.219.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="C9B0DUBQ" Received: by mail-qv1-f49.google.com with SMTP id 6a1803df08f44-9030f8ea3b3so6977996d6.1 for ; Fri, 10 Jul 2026 09:31:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; t=1783701099; x=1784305899; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=ihr9TBqVvOWsgDH+NpkUYsK2K2fCkLkiaNuX2IHUYwY=; b=C9B0DUBQrFvmPqU9NSXU7hegpl7ojs8/mhmMnr9+I8B5xI9cbJN4vquMR+TKjoSRbe hRVqntMatUOMVwQ77aec0J9Doya+aG8IZxs5XirF5Ku3Ah35eFZG0l4ACmfIwbWBJMhX oVNossKW2Twv3Vh/obtosrQ/pXr9DDd7KelvhktBuY09jEM5IGYcXMOnzEoGs6Q/7Jdj K7AUzEdbaXOvsXR0zmLhfvAaQjl+FLj+w+DzYga35xmOl5qsbr94OSq0jOzS2tfeoYeK 6EJs8zXW2Mz1qdRSBb4NWbEFf6BK3WwdCTjumyD2SidvzWStaTThJnCiasO0muhiqMZ2 k0bw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783701099; x=1784305899; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=ihr9TBqVvOWsgDH+NpkUYsK2K2fCkLkiaNuX2IHUYwY=; b=FwwASjQDmp8jCIfayne+DRNGf9/8JbDP5vfml3din0UOA5NxAwdJRaBhaJLScjQXpp 3Qtm0mVqHchVOl5xFDWUEQgN8ig6Zrf8iWXyD7aBEJGUwCeWYxtWJC1YqlHlh5bpbwTl qT9RRKpPw8W74VsJgKTfIUoHFz7kPuuP5mImaSDY4CTbnvarVcj4ofMTZOMljISOVg/b hc8iT026P8sgdUya6sQa2uft7BXZCjYWDveSJPsKsiGCwezvioQRxv/O+v09BMf/qCeP wtKjNcKTace7jyiolilGoozOT8c1zHjNTLdNn9qkIgwqTZnju89ldIzrLMbydZhCwdRE 2rGg== X-Forwarded-Encrypted: i=1; AHgh+Rohd2f1f8nuYdzLrzeV08snQj5s/fobw0YRzNOzfTKBX9lqBnA83afiBLI0Jcddl6kyNVgL2yswRigAHZ4=@vger.kernel.org X-Gm-Message-State: AOJu0Ywp6WoeHP0Pg1xMgKkEy+QPINokbIRyl1FXjJOJWmuczXJKJcpw jh4jo3C0U/FU/LDG4IgTCFkmp/kP7IjNOAP0RWHJQcezGuHeCMhDUTTqZ8HtNlf4Knw= X-Gm-Gg: AfdE7cntVEIKIq57Jyf6Mc9/qbh29L5IrABsKl5hqxIw4BHLl12qdG0G2O6BCh8rQRD PG5AGfQ6Ez1D3KWHY0bpGp7Tpp4V2EIWrqZYarPR4v2NwRhHqHJlAd1WPX9h1ZBAy2BwOdkFeYW v9OIXBXlGlESLaxgGjo1DxC2UOu4zgLhQvPN6Bh3DZpZp47DndlkqojGIXC0oKkdccjPeghqx26 IWe6jcJOVW2xWPfogepGVcR6F1teEVy7Riszm29Ly+9B4o32Vd0qXe5eci0eZ1SFV66q4wjaHXQ q5KwZ7WE1wRGNQOMiD0pl4smEV3AnQMBKzmIzxcXA9zog01X/t9Lbbe4423zn+eyN1ATDlPI1u3 uQjq4YZ5QNuneB842fcHthptRN1g3Y6WZcZDuz9UvzJZcOZSACUjQJgewUb4/UITf1V8uN34= X-Received: by 2002:a05:6214:4710:b0:903:12c9:cba6 with SMTP id 6a1803df08f44-90312c9dcb8mr32500716d6.47.1783701099176; Fri, 10 Jul 2026 09:31:39 -0700 (PDT) Received: from ziepe.ca ([159.2.72.92]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8ffd56c4cd1sm44753226d6.16.2026.07.10.09.31.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 10 Jul 2026 09:31:38 -0700 (PDT) Received: from jgg by wakko with local (Exim 4.97) (envelope-from ) id 1wiE8X-00000007Xks-3Vyo; Fri, 10 Jul 2026 13:31:37 -0300 Date: Fri, 10 Jul 2026 13:31:37 -0300 From: Jason Gunthorpe To: Stanislav Kinsburskii Cc: airlied@gmail.com, akhilesh@ee.iitb.ac.in, akpm@linux-foundation.org, corbet@lwn.net, dakr@kernel.org, david@kernel.org, decui@microsoft.com, haiyangz@microsoft.com, kees@kernel.org, kys@microsoft.com, leon@kernel.org, liam@infradead.org, lizhi.hou@amd.com, ljs@kernel.org, longli@microsoft.com, lyude@redhat.com, maarten.lankhorst@linux.intel.com, mamin506@gmail.com, mhocko@suse.com, mripard@kernel.org, nouveau@lists.freedesktop.org, ogabbay@kernel.org, oleg@redhat.com, rppt@kernel.org, shuah@kernel.org, simona@ffwll.ch, skhan@linuxfoundation.org, surenb@google.com, tzimmermann@suse.de, vbabka@kernel.org, wei.liu@kernel.org, dri-devel@lists.freedesktop.org, linux-mm@kvack.org, linux-doc@vger.kernel.org, linux-hyperv@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-rdma@vger.kernel.org Subject: Re: [PATCH v7 1/8] mm/hmm: move page fault handling out of walk callbacks Message-ID: <20260710163137.GQ118978@ziepe.ca> References: <178345345668.660027.2952911919681614557.stgit@skinsburskii> <178345361483.660027.16455119612963295072.stgit@skinsburskii> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <178345361483.660027.16455119612963295072.stgit@skinsburskii> On Tue, Jul 07, 2026 at 12:46:54PM -0700, Stanislav Kinsburskii wrote: > hmm_range_fault() currently triggers page faults from inside the page-table > walk callbacks: hmm_vma_walk_pmd(), hmm_vma_walk_pud(), > hmm_vma_walk_hugetlb_entry() and the pte-level helper all call > hmm_vma_fault(), which in turn calls handle_mm_fault() while the walker > still holds nested locks. The pte spinlock is dropped explicitly by each > caller, and the hugetlb path manually drops and retakes > hugetlb_vma_lock_read around the fault to dodge a deadlock against the walk > framework's unconditional unlock. > > This layering does not extend cleanly to fault handlers that may release > mmap_lock (VM_FAULT_RETRY, VM_FAULT_COMPLETED). If the lock is dropped > while walk_page_range() is mid-traversal, the VMA can be freed before the > walk framework's matching hugetlb_vma_unlock_read(), turning that unlock > into a use-after-free. > > Split the responsibilities the way get_user_pages() does. Walk callbacks > become inspect-only: when they detect a range that needs to be faulted in, > they record it in struct hmm_vma_walk and return a private sentinel > (HMM_FAULT_PENDING). The outer loop in hmm_range_fault() then drops out of > walk_page_range(), invokes a new helper hmm_do_fault() that calls > handle_mm_fault() with only mmap_lock held, and restarts the walk so the > now-present entries are collected into hmm_pfns. > > No functional change for existing callers. As a side effect the hugetlb > callback no longer needs the hugetlb_vma_{un}lock_read dance, and every > fault-path exit from the callbacks now releases the pte spinlock on a > single, common path. This refactor is also a precursor for adding an > unlockable variant of hmm_range_fault() in a follow-up patch. > > Signed-off-by: Stanislav Kinsburskii > --- > mm/hmm.c | 118 +++++++++++++++++++++++++++++++++++++++----------------------- > 1 file changed, 75 insertions(+), 43 deletions(-) Reviewed-by: Jason Gunthorpe Jason