On Fri, 10 Jul 2026 14:26:35 -0700 Stanislav Kinsburskii
<[email protected]> wrote:
> hmm_range_fault() requires the caller to hold the mmap read lock for the
> duration of the call. This is incompatible with mappings whose fault
> handler may release the mmap lock, notably userfaultfd-managed regions,
> where handle_mm_fault() can return VM_FAULT_RETRY or VM_FAULT_COMPLETED
> after dropping the lock. Drivers that need to populate device page tables
> for such mappings have no way to do so today.
>
> Add hmm_range_fault_unlocked_timeout() for callers that do not need to hold
> mmap_lock across any work outside the HMM fault itself. The helper takes
> mmap_read_lock_killable() internally, calls the common HMM fault
> implementation, and releases the lock before returning if it is still held.
> The timeout is specified in jiffies; passing 0 retries indefinitely, while
> a non-zero timeout makes the helper return -EBUSY when the retry budget
> expires.
>
> When handle_mm_fault() drops mmap_lock, or when the range is invalidated,
> hmm_range_fault_unlocked_timeout() refreshes range->notifier_seq and
> retries the walk internally. If the lock was dropped, the retry deadline is
> also restarted because a lock-dropping fault handler made progress.
> Ordinary -EBUSY retries keep the existing deadline, preserving the caller's
> timeout policy for repeated mmu-notifier invalidations.
>
> The caller only needs to perform the usual post-success
> mmu_interval_read_retry() check while holding its update lock before
> consuming the pfns. If mmap_lock acquisition is interrupted or a fatal
> signal is pending during retry handling, -EINTR is returned instead.
>
> The common implementation conditionally sets FAULT_FLAG_ALLOW_RETRY and
> FAULT_FLAG_KILLABLE only for hmm_range_fault_unlocked_timeout(). The
> existing hmm_range_fault() path still passes no locked state, does not
> allow handle_mm_fault() to drop mmap_lock, and remains a thin wrapper
> preserving the existing API contract for current callers.
>
> The previous refactor that moved page fault handling out of the page-table
> walk callbacks is what makes this change small. Faults now run after
> walk_page_range() has unwound, with only mmap_lock held, so dropping it
> does not interact with the walker's pte spinlock or hugetlb_vma_lock.
> Hugetlb regions therefore participate in the unlocked path uniformly with
> PTE- and PMD-level mappings; no special case is required.
>
> Documentation/mm/hmm.rst is updated with a description of the new API and
> the recommended caller pattern.
>
> ...
>
A trivial thing:
> +int hmm_range_fault_unlocked_timeout(struct hmm_range *range,
> + unsigned long timeout)
> +{
> + struct mm_struct *mm = range->notifier->mm;
> + unsigned long deadline = 0;
> + bool locked = false;
This could be local to the do loop and it needn't be initialized.
> + int ret;
> +
> + do {
> + if (fatal_signal_pending(current))
> + return -EINTR;
> +
> + if (timeout) {
> + /*
> + * If the previous fault dropped mmap_lock, then the
> fault
> + * handler made progress. Restart the retry timeout in
> that
> + * case, but keep the existing deadline for ordinary
> -EBUSY
> + * retries.
> + */
> + if (!locked)
> + deadline = jiffies + timeout;
> +
> + if (time_after(jiffies, deadline))
> + return -EBUSY;
> + }
> +
> + range->notifier_seq =
> + mmu_interval_read_begin(range->notifier);
> +
> + ret = mmap_read_lock_killable(mm);
> + if (ret)
> + return ret;
> +
> + locked = true;
> + ret = hmm_range_fault_locked(range, &locked);
> + if (locked)
> + mmap_read_unlock(mm);
> + } while (ret == -EBUSY);
> +
> + return ret;
> +}
> +EXPORT_SYMBOL(hmm_range_fault_unlocked_timeout);
> +
