On Fri, Jul 10, 2026 at 03:12:09PM -0700, Andrew Morton wrote:
> On Fri, 10 Jul 2026 14:26:35 -0700 Stanislav Kinsburskii
> <[email protected]> wrote:
>
> > hmm_range_fault() requires the caller to hold the mmap read lock for the
> > duration of the call. This is incompatible with mappings whose fault
> > handler may release the mmap lock, notably userfaultfd-managed regions,
> > where handle_mm_fault() can return VM_FAULT_RETRY or VM_FAULT_COMPLETED
> > after dropping the lock. Drivers that need to populate device page tables
> > for such mappings have no way to do so today.
> >
> > Add hmm_range_fault_unlocked_timeout() for callers that do not need to hold
> > mmap_lock across any work outside the HMM fault itself. The helper takes
> > mmap_read_lock_killable() internally, calls the common HMM fault
> > implementation, and releases the lock before returning if it is still held.
> > The timeout is specified in jiffies; passing 0 retries indefinitely, while
> > a non-zero timeout makes the helper return -EBUSY when the retry budget
> > expires.
> >
> > When handle_mm_fault() drops mmap_lock, or when the range is invalidated,
> > hmm_range_fault_unlocked_timeout() refreshes range->notifier_seq and
> > retries the walk internally. If the lock was dropped, the retry deadline is
> > also restarted because a lock-dropping fault handler made progress.
> > Ordinary -EBUSY retries keep the existing deadline, preserving the caller's
> > timeout policy for repeated mmu-notifier invalidations.
> >
> > The caller only needs to perform the usual post-success
> > mmu_interval_read_retry() check while holding its update lock before
> > consuming the pfns. If mmap_lock acquisition is interrupted or a fatal
> > signal is pending during retry handling, -EINTR is returned instead.
> >
> > The common implementation conditionally sets FAULT_FLAG_ALLOW_RETRY and
> > FAULT_FLAG_KILLABLE only for hmm_range_fault_unlocked_timeout(). The
> > existing hmm_range_fault() path still passes no locked state, does not
> > allow handle_mm_fault() to drop mmap_lock, and remains a thin wrapper
> > preserving the existing API contract for current callers.
> >
> > The previous refactor that moved page fault handling out of the page-table
> > walk callbacks is what makes this change small. Faults now run after
> > walk_page_range() has unwound, with only mmap_lock held, so dropping it
> > does not interact with the walker's pte spinlock or hugetlb_vma_lock.
> > Hugetlb regions therefore participate in the unlocked path uniformly with
> > PTE- and PMD-level mappings; no special case is required.
> >
> > Documentation/mm/hmm.rst is updated with a description of the new API and
> > the recommended caller pattern.
> >
> > ...
> >
>
> A trivial thing:
>
> > +int hmm_range_fault_unlocked_timeout(struct hmm_range *range,
> > + unsigned long timeout)
> > +{
> > + struct mm_struct *mm = range->notifier->mm;
> > + unsigned long deadline = 0;
> > + bool locked = false;
>
> This could be local to the do loop and it needn't be initialized.
>
Unfortunately, it can’t, because its state is mutated in
hmm_range_fault_locked() and the resulting state needs to be preserved
across iterations of the loop as deadline reset depends on it.
Thanks,
Stanislav
> > + int ret;
> > +
> > + do {
> > + if (fatal_signal_pending(current))
> > + return -EINTR;
> > +
> > + if (timeout) {
> > + /*
> > + * If the previous fault dropped mmap_lock, then the
> > fault
> > + * handler made progress. Restart the retry timeout in
> > that
> > + * case, but keep the existing deadline for ordinary
> > -EBUSY
> > + * retries.
> > + */
> > + if (!locked)
> > + deadline = jiffies + timeout;
> > +
> > + if (time_after(jiffies, deadline))
> > + return -EBUSY;
> > + }
> > +
> > + range->notifier_seq =
> > + mmu_interval_read_begin(range->notifier);
> > +
> > + ret = mmap_read_lock_killable(mm);
> > + if (ret)
> > + return ret;
> > +
> > + locked = true;
> > + ret = hmm_range_fault_locked(range, &locked);
> > + if (locked)
> > + mmap_read_unlock(mm);
> > + } while (ret == -EBUSY);
> > +
> > + return ret;
> > +}
> > +EXPORT_SYMBOL(hmm_range_fault_unlocked_timeout);
> > +
>
