On 3 Nov 2017, at 3:52, Huang, Ying wrote:

> From: Huang Ying <ying.huang@intel.com>
>
> If THP migration is enabled, the following situation is possible,
>
> - A THP is mapped at source address
> - Migration is started to move the THP to another node
> - Page fault occurs
> - The PMD (migration entry) is copied to the destination address in mremap
>

You mean the page fault path follows the source address and sees pmd_none() now
because mremap() clears it and remaps the page with dest address.
Otherwise, it seems not possible to get into handle_userfault(), since it is called in
pmd_none() branch inside do_huge_pmd_anonymous_page().


> That is, it is possible for handle_userfault() encounter a PMD entry
> which has been handled but !pmd_present().  In the current
> implementation, we will wait for such PMD entries, which may cause
> unnecessary waiting, and potential soft lockup.

handle_userfault() should only see pmd_none() in the situation you describe,
whereas !pmd_present() (migration entry case) should lead to
pmd_migration_entry_wait().

Am I missing anything here?


--
Best Regards
Yan Zi