Re: [RFC -mm] mm, userfaultfd, THP: Avoid waiting when PMD under THP migration

[Zi Yan]

On 4 Nov 2017, at 23:01, huang ying wrote:

> On Fri, Nov 3, 2017 at 11:00 PM, Zi Yan <zi.yan@xxxxxxxxxxxxxx> wrote:
> > On 3 Nov 2017, at 3:52, Huang, Ying wrote:
> >
> > > From: Huang Ying <ying.huang@xxxxxxxxx>
> > >
> > > If THP migration is enabled, the following situation is possible,
> > >
> > > - A THP is mapped at source address
> > > - Migration is started to move the THP to another node
> > > - Page fault occurs
> > > - The PMD (migration entry) is copied to the destination address in 
> > > mremap
> >
> > You mean the page fault path follows the source address and sees 
> > pmd_none() now
> > because mremap() clears it and remaps the page with dest address.
> > Otherwise, it seems not possible to get into handle_userfault(), 
> > since it is called in
> > pmd_none() branch inside do_huge_pmd_anonymous_page().
> >
> >
> > > That is, it is possible for handle_userfault() encounter a PMD entry
> > > which has been handled but !pmd_present().  In the current
> > > implementation, we will wait for such PMD entries, which may cause
> > > unnecessary waiting, and potential soft lockup.
> >
> > handle_userfault() should only see pmd_none() in the situation you 
> > describe,
> > whereas !pmd_present() (migration entry case) should lead to
> > pmd_migration_entry_wait().
>
> Yes.  This is my understanding of the source code too.  And I
> described it in the original patch description too.  I just want to
> make sure whether it is possible that !pmd_none() and !pmd_present()
> for a PMD in userfaultfd_must_wait().  And, whether it is possible for
> us to implement PMD mapping copying in UFFDIO_COPY in the future?

Thanks for clarifying it. We both agree that !pmd_present(), which means
PMD migration entry, does not get into userfaultfd_must_wait(),
then there seems to be no issue with current code yet.

However, the if (!pmd_present(_pmd)) in userfaultfd_must_wait() does not 
match
the exact condition. How about the patch below? It can catch pmd 
migration entries,
which are only possible in x86_64 at the moment.

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 1c713fd5b3e6..dda25444a6ee 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -294,9 +294,11 @@ static inline bool userfaultfd_must_wait(struct 
userfaultfd_ctx *ctx,
         * pmd_trans_unstable) of the pmd.
         */
        _pmd = READ_ONCE(*pmd);
-       if (!pmd_present(_pmd))
+       if (pmd_none(_pmd))
                goto out;

+       VM_BUG_ON(thp_migration_supported() && 
is_pmd_migration_entry(_pmd));
+
        ret = false;
        if (pmd_trans_huge(_pmd))
                goto out;



â
Best Regards,
Yan Zi