Commit 234b239b authored by Andres Lagar-Cavilla's avatar Andres Lagar-Cavilla Committed by Paolo Bonzini
Browse files

kvm: Faults which trigger IO release the mmap_sem

When KVM handles a tdp fault it uses FOLL_NOWAIT. If the guest memory
has been swapped out or is behind a filemap, this will trigger async
readahead and return immediately. The rationale is that KVM will kick
back the guest with an "async page fault" and allow for some other
guest process to take over.

If async PFs are enabled the fault is retried asap from an async
workqueue. If not, it's retried immediately in the same code path. In
either case the retry will not relinquish the mmap semaphore and will
block on the IO. This is a bad thing, as other mmap semaphore users
now stall as a function of swap or filemap latency.

This patch ensures both the regular and async PF path re-enter the
fault allowing for the mmap semaphore to be relinquished in the case
of IO wait.
Reviewed-by: default avatarRadim Krčmář <>
Signed-off-by: default avatarAndres Lagar-Cavilla <>
Acked-by: default avatarAndrew Morton <>
Signed-off-by: default avatarPaolo Bonzini <>
parent b4619660
......@@ -198,6 +198,17 @@ int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, unsigned long hva,
int kvm_async_pf_wakeup_all(struct kvm_vcpu *vcpu);
* Carry out a gup that requires IO. Allow the mm to relinquish the mmap
* semaphore if the filemap/swap has to wait on a page lock. pagep == NULL
* controls whether we retry the gup one more time to completion in that case.
* Typically this is called after a FAULT_FLAG_RETRY_NOWAIT in the main tdp
* handler.
int kvm_get_user_page_io(struct task_struct *tsk, struct mm_struct *mm,
unsigned long addr, bool write_fault,
struct page **pagep);
enum {
......@@ -1985,6 +1985,7 @@ static inline struct page *follow_page(struct vm_area_struct *vma,
#define FOLL_HWPOISON 0x100 /* check page is hwpoisoned */
#define FOLL_NUMA 0x200 /* force NUMA hinting page fault */
#define FOLL_MIGRATION 0x400 /* wait for page to replace migration entry */
#define FOLL_TRIED 0x800 /* a retry, previous pass started an IO */
typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr,
void *data);
......@@ -281,6 +281,10 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
fault_flags |= FAULT_FLAG_ALLOW_RETRY;
if (*flags & FOLL_NOWAIT)
if (*flags & FOLL_TRIED) {
fault_flags |= FAULT_FLAG_TRIED;
ret = handle_mm_fault(mm, vma, address, fault_flags);
if (ret & VM_FAULT_ERROR) {
......@@ -80,9 +80,7 @@ static void async_pf_execute(struct work_struct *work)
get_user_pages(NULL, mm, addr, 1, 1, 0, NULL, NULL);
kvm_get_user_page_io(NULL, mm, addr, 1, NULL);
kvm_async_page_present_sync(vcpu, apf);
......@@ -1122,6 +1122,43 @@ static int get_user_page_nowait(struct task_struct *tsk, struct mm_struct *mm,
return __get_user_pages(tsk, mm, start, 1, flags, page, NULL, NULL);
int kvm_get_user_page_io(struct task_struct *tsk, struct mm_struct *mm,
unsigned long addr, bool write_fault,
struct page **pagep)
int npages;
int locked = 1;
(pagep ? FOLL_GET : 0) |
(write_fault ? FOLL_WRITE : 0);
* If retrying the fault, we get here *not* having allowed the filemap
* to wait on the page lock. We should now allow waiting on the IO with
* the mmap semaphore released.
npages = __get_user_pages(tsk, mm, addr, 1, flags, pagep, NULL,
if (!locked) {
VM_BUG_ON(npages != -EBUSY);
if (!pagep)
return 0;
* The previous call has now waited on the IO. Now we can
* retry and complete. Pass TRIED to ensure we do not re
* schedule async IO (see e.g. filemap_fault).
npages = __get_user_pages(tsk, mm, addr, 1, flags | FOLL_TRIED,
pagep, NULL, NULL);
return npages;
static inline int check_user_page_hwpoison(unsigned long addr)
......@@ -1184,9 +1221,15 @@ static int hva_to_pfn_slow(unsigned long addr, bool *async, bool write_fault,
npages = get_user_page_nowait(current, current->mm,
addr, write_fault, page);
} else
npages = get_user_pages_fast(addr, 1, write_fault,
} else {
* By now we have tried gup_fast, and possibly async_pf, and we
* are certainly not atomic. Time to retry the gup, allowing
* mmap semaphore to be relinquished in the case of IO.
npages = kvm_get_user_page_io(current, current->mm, addr,
write_fault, page);
if (npages != 1)
return npages;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment