Re: [PATCH mm-unstable v1] selftests/vm: cow: Add COW tests for collapsing of PTE-mapped anon THP

From: David Hildenbrand
Date: Wed Mar 22 2023 - 07:43:16 EST

On 16.03.23 00:28, Zach O'Keefe wrote:

Currently, anonymous PTE-mapped THPs cannot be collapsed in-place:
collapsing (e.g., via MADV_COLLAPSE) implies allocating a fresh THP and
mapping that new THP via a PMD: as it's a fresh anon THP, it will get the
exclusive flag set on the head page and everybody is happy.

However, if the kernel would ever support in-place collapse of anonymous
THPs (replacing a page table mapping each sub-page of a THP via PTEs with a
single PMD mapping the complete THP), exclusivity information stored for
each sub-page would have to be collapsed accordingly:

(1) All PTEs map !exclusive anon sub-pages: the in-place collapsed THP
must not not have the exclusive flag set on the head page mapped by
the PMD. This is the easiest case to handle ("simply don't set any
exclusive flags").

(2) All PTEs map exclusive anon sub-pages: when collapsing, we have to
clear the exclusive flag from all tail pages and only leave the
exclusive flag set for the head page. Otherwise, fork() after
collapse would not clear the exclusive flags from the tail pages
and we'd be in trouble once PTE-mapping the shared THP when writing
to shared tail pages that still have the exclusive flag set. This
would effectively revert what the PTE-mapping code does when
propagating the exclusive flag to all sub-pages.

(3) PTEs map a mixture of exclusive and !exclusive anon sub-pages (can
happen e.g., due to MADV_DONTFORK before fork()). We must not
collapse the THP in-place, otherwise bad things may happen:
the exclusive flags of sub-pages would get ignored and the
exclusive flag of the head page would get used instead.

Now that we have MADV_COLLAPSE in place to trigger collapsing a THP,
let's add some test cases that would bail out early, if we'd
voluntarily/accidantially unlock in-place collapse for anon THPs and
forget about taking proper care of exclusive flags.

Hey David,

Sorry for the (very) delayed review. As our helpful syncs offline, I'm in a
better place to understand the intent of these tests.

Thanks for the review and sorry for the late reply!


On Wed, Jan 4, 2023 at 6:49 AM David Hildenbrand <david@xxxxxxxxxx> wrote:

Running the test on a kernel with MADV_COLLAPSE support:
# [INFO] Anonymous THP tests
# [RUN] Basic COW after fork() when collapsing before fork()
ok 169 No leak from parent into child
# [RUN] Basic COW after fork() when collapsing after fork() (fully shared)
ok 170 # SKIP MADV_COLLAPSE failed: Invalid argument
# [RUN] Basic COW after fork() when collapsing after fork() (lower shared)
ok 171 No leak from parent into child
# [RUN] Basic COW after fork() when collapsing after fork() (upper shared)
ok 172 No leak from parent into child

For now, MADV_COLLAPSE always seems to fail if all PTEs map shared
sub-pages.

Thanks for pointing this out. I have had a TODO / pending patch to verify this
for awhile. It seems this is due to some old requirement of requiring a single
writeable pte. I don't know this history well here, but I don't think it's

Interesting. A single writable PTE would indicate that at least some part of the range is exclusive (!shared) without looking at mapcounts. But of course, it's an unreliable check.

required anymore, and, as this test shows, prevents collapse of
pte-mapped-hugepage shared across fork().

[...]


+#ifndef MADV_COLLAPSE
+#define MADV_COLLAPSE 25
+#endif
+
static size_t pagesize;
static int pagemap_fd;
static size_t thpsize;
@@ -1178,6 +1182,228 @@ static int tests_per_anon_test_case(void)
return tests;
}

+enum anon_thp_collapse_test {
+ ANON_THP_COLLAPSE_UNSHARED,

OK, so this test checks case 2: we see all PG_anon_exclusive, and need to make
sure we clear the bit on tails. Had we not, after fork(), the bit would still be
set on tails (since copy_huge_pmd() -> page_try_dup_anon_rmap() only clears it
on head), and so write to said tails would go through after wp fault, and since
collapse was in-place, this leaks data from parent to child.

+ ANON_THP_COLLAPSE_FULLY_SHARED,

This checks case 1: we see all !PG_anon_exclusive, we aught to set the flag on
head page in parent, after fork(). Had we not, subsequent write will be allowed
to go through after wp fault and hit backing page -- which, since collapse was
in-place, is same as child, leaking data.

+ ANON_THP_COLLAPSE_LOWER_SHARED,
+ ANON_THP_COLLAPSE_UPPER_SHARED,

IIUC, this check only partially tests case 3. Had we introduced a bug where we
set PG_anon_exclusive on the head in this mixed-case, it's very similar to
ANON_THP_COLLAPSE_FULLY_SHARED.

However, if we decided to still attempt in-place collapse, and cleared the bit
in the parent, then the write here will be CoW'd and we won't see data leak
into the child. In order for problems to occur, we'd need something to trip
the improper CoW. The example you've shared with me was a io_uring fixed buffer
mapping the non-shared pages, which, after CoW, would disagree.

That said, I'm not sure the extra work required to catch this case is worth the
effort.

Yes, just like most tests, covering all corner cases takes a lot of effort and is probably not worth it. Wiring up io_uring (also used in the file already for these purposes) would be possible, however the initial tests are really more targeted at "bail out early" and to catch the obvious things one might miss when collapsing THP.

IOW: when people ignore exclusivity information when collapsing; the failing tests would directly tell you what needs to be done: better not mess with case #3. So IMHO, the basic tests for #3 are sufficient to express "see, you did it wrong: better be careful".

There are scenarios where we could handle #3: for example, if we're the only one mapping all sub-pages of a THP and there are no other references (i.e., page_count() == 512), we could collapse and mark the head page exclusive (clearing the marker from any tail pages). Once we really want to optimize these cases, we can add more such tests.

--
Thanks,

David / dhildenb