[LTP] [PATCH 0/4] Don't derive kernel granularities from getpagesize()

[LTP] [PATCH 0/4] Don't derive kernel granularities from getpagesize()

[Wake Liu via ltp]

Hi,

Several tests derive kernel internal granularities from getpagesize():
the size of a pipe buffer, the granularity memory is faulted in and
cached with, or the page size reported by PROCMAP_QUERY. On mainline
kernels all of these are the same value, so the assumption never shows.

Android runs LTP on x86_64 emulators that boot a 4K kernel with the
page size emulation of the Android Common Kernels [1], enabled by
page_shift=14 on the kernel command line. It is not part of mainline.
The kernel reports a 16K page size to userspace through AT_PAGESZ and
enforces 16K alignment for mmap() and friends, while it keeps using 4K
pages internally. Interfaces that userspace commonly relies on, such as
mincore() and /proc/pid/pagemap, are emulated as well, but pipe
buffers, page fault, page cache and memcg accounting granularity, and
the KernelPageSize reported in smaps and by PROCMAP_QUERY keep
reflecting the real 4K kernel page size.

Android has carried local workarounds for these tests so far. This
series instead makes the tests rely on what the kernel reports, or
populate memory independently of the page size, so that Android can run
them unmodified. The patches are grouped by the assumption they remove.
None of them alters the behavior on kernels where both page sizes are
equal, and none adds emulation specific code to the tests.

Tested on:
- x86_64 with a 4K page size (Debian, 7.1 kernel), where epoll_wait06,
  ioctl10 and signal06 pass before and after the series, and all
  changed tests compile without warnings with gcc and clang.
- An Android x86_64 emulator with a 4K page size (6.6 kernel), where
  the results are the same before and after the series.
- An Android x86_64 Cuttlefish device running 6.18.32-android17 with
  page_shift=14, where all of the patched tests fail without the series
  and pass with it.

Changes to pipe2_04 and msync04 for the same setup alter what those
tests check, so I will send them separately.

[1] https://source.android.com/docs/core/architecture/16kb-page-size/getting-started-cf-x86-64-pgagnostic

Wake Liu (4):
  epoll_wait06, fcntl35: Don't assume a pipe buffer is getpagesize()
  memcg, userfaultfd07: Populate whole pages instead of single bytes
  ioctl10: Compare vma_page_size with KernelPageSize from smaps
  signal06: Allocate the alternate signal stack with mmap()

 .../controllers/memcg/control/mem_process.c   | 11 +++---
 .../kernel/controllers/memcg/memcontrol02.c   | 13 +++----
 .../kernel/syscalls/epoll_wait/epoll_wait06.c | 15 +++++---
 testcases/kernel/syscalls/fcntl/fcntl35.c     | 20 ++++++++++-
 testcases/kernel/syscalls/ioctl/ioctl10.c     | 34 ++++++++++++++++++-
 testcases/kernel/syscalls/signal/signal06.c   | 15 +++++---
 .../syscalls/userfaultfd/userfaultfd07.c      | 11 ++++--
 7 files changed, 95 insertions(+), 24 deletions(-)


base-commit: 0ee0ca5460402f6219df4da3e28b7c4aa4b8207d
-- 
2.56.0.567.gdb80ae8cd5-goog


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH 1/4] epoll_wait06, fcntl35: Don't assume a pipe buffer is getpagesize()

[Wake Liu via ltp]

A pipe consists of pipe buffers of one kernel page each, but both tests
assume that a pipe buffer is getpagesize() bytes.

epoll_wait06 sets the pipe capacity to getpagesize() and expects the
pipe to consist of a single buffer, so that reading half of the data
does not release a buffer and raise EPOLLOUT. fcntl35 expects the
default capacity of a pipe created by a privileged user, which is 16
pipe buffers (PIPE_DEF_BUFFERS), to be 16 * getpagesize().

Neither holds when the kernel reports a larger page size to userspace
than it uses internally, as with the 16K page size emulation that
Android uses on x86_64. There the pipe of epoll_wait06 consists of four
4K buffers, reading half of the data releases two of them, and the
test fails with:

  TFAIL: SAFE_EPOLL_WAIT(epfd, &evt_receive, 1, 0) (1) != 0 (0)

fcntl35 gets a default capacity of 65536 bytes instead of the expected
262144.

Get the size of a pipe buffer from the kernel instead, by shrinking a
pipe to its minimum capacity with F_SETPIPE_SZ. The unprivileged case
of fcntl35 needs no change, as setting pipe-max-size to getpagesize()
still caps the capacity at getpagesize() bytes. Nothing changes on
kernels where both page sizes are equal.

Signed-off-by: Wake Liu <wakel@google.com>
---
 .../kernel/syscalls/epoll_wait/epoll_wait06.c | 15 +++++++++-----
 testcases/kernel/syscalls/fcntl/fcntl35.c     | 20 ++++++++++++++++++-
 2 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/testcases/kernel/syscalls/epoll_wait/epoll_wait06.c b/testcases/kernel/syscalls/epoll_wait/epoll_wait06.c
index 622830d55..ce4e2d5bc 100644
--- a/testcases/kernel/syscalls/epoll_wait/epoll_wait06.c
+++ b/testcases/kernel/syscalls/epoll_wait/epoll_wait06.c
@@ -32,13 +32,18 @@ static int epfd;
 
 static void setup(void)
 {
-	write_size = getpagesize();
-	read_size = write_size / 2;
-
 	SAFE_PIPE2(fds, O_NONBLOCK);
 
-	/* EPOLLOUT will be raised when buffer became empty after becoming full */
-	SAFE_FCNTL(fds[1], F_SETPIPE_SZ, write_size);
+	/*
+	 * EPOLLOUT will be raised when buffer became empty after becoming full.
+	 *
+	 * Shrink the pipe to its minimum capacity, which is a single pipe
+	 * buffer, so that reading only half of the data doesn't release any
+	 * buffer. Use the capacity reported by the kernel rather than
+	 * assuming it matches getpagesize().
+	 */
+	write_size = SAFE_FCNTL(fds[1], F_SETPIPE_SZ, 1);
+	read_size = write_size / 2;
 }
 
 static void cleanup(void)
diff --git a/testcases/kernel/syscalls/fcntl/fcntl35.c b/testcases/kernel/syscalls/fcntl/fcntl35.c
index d17812fd0..a240500d4 100644
--- a/testcases/kernel/syscalls/fcntl/fcntl35.c
+++ b/testcases/kernel/syscalls/fcntl/fcntl35.c
@@ -44,10 +44,28 @@ static struct tcase {
 	{&test_max_priv, 0, "a privileged user"}
 };
 
+/*
+ * The pipe capacity is a multiple of the size of a pipe buffer, which is one
+ * page of the kernel. Get it by shrinking a pipe to its minimum capacity,
+ * rather than assuming it matches getpagesize().
+ */
+static int get_pipe_buf_size(void)
+{
+	int fds[2], size;
+
+	SAFE_PIPE(fds);
+	size = SAFE_FCNTL(fds[1], F_SETPIPE_SZ, 1);
+	SAFE_CLOSE(fds[0]);
+	SAFE_CLOSE(fds[1]);
+
+	return size;
+}
+
 static void setup(void)
 {
 	test_max_unpriv = getpagesize();
-	test_max_priv = test_max_unpriv * 16;
+	/* The default capacity is 16 pipe buffers (PIPE_DEF_BUFFERS) */
+	test_max_priv = get_pipe_buf_size() * 16;
 
 	if (!access(PATH_FS_PIPE_MAX_SIZE, F_OK)) {
 		SAFE_FILE_SCANF(PATH_FS_PIPE_MAX_SIZE, "%d", &pipe_max_unpriv);
-- 
2.56.0.567.gdb80ae8cd5-goog


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH 2/4] memcg, userfaultfd07: Populate whole pages instead of single bytes

[Wake Liu via ltp]

memcontrol02 and mem_process, the helper of memcg_control_test.sh,
fault in their memory by writing one byte per getpagesize() bytes, and
userfaultfd07 populates the page cache of its memfd by writing a single
byte. All of them assume that this populates whole pages of
getpagesize() bytes.

That is not the case when the kernel faults in and caches memory in
smaller units than the page size it reports to userspace, as with the
16K page size emulation that Android uses on x86_64. Only one in four
4K pages gets populated there, so memcontrol02 sees only about a
quarter of the expected 50M in memory.current, mem_process stays below
the memory limit it is supposed to exceed, and UFFDIO_CONTINUE in
userfaultfd07 fails for the part of the page that is not in the page
cache:

  TBROK: ioctl(4,UFFDIO_CONTINUE,...) failed: EAGAIN/EWOULDBLOCK (11)

Write the whole buffers instead. Nothing changes on kernels where both
page sizes are equal.

Signed-off-by: Wake Liu <wakel@google.com>
---

Notes:
    alloc_anon() in memcontrol_common.h, used by memcontrol03 and
    memcontrol04, writes one byte per page as well. It frees the buffer
    right away, so GCC and Clang would drop a plain memset() there as a
    dead store and it needs a different fix. I will look at it
    separately.

 .../kernel/controllers/memcg/control/mem_process.c  | 11 ++++++-----
 testcases/kernel/controllers/memcg/memcontrol02.c   | 13 +++++++------
 .../kernel/syscalls/userfaultfd/userfaultfd07.c     | 11 +++++++++--
 3 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/testcases/kernel/controllers/memcg/control/mem_process.c b/testcases/kernel/controllers/memcg/control/mem_process.c
index 8ecabb272..f32189cc2 100644
--- a/testcases/kernel/controllers/memcg/control/mem_process.c
+++ b/testcases/kernel/controllers/memcg/control/mem_process.c
@@ -10,6 +10,7 @@
 #include <fcntl.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <unistd.h>
 
 /*
@@ -49,14 +50,14 @@ void process_options(int argc, char **argv)
 
 /*
  * touch_memory: force physical memory allocation
+ *
+ * Write the whole area rather than one byte per getpagesize(), so that it
+ * gets fully populated regardless of the granularity the kernel faults in
+ * memory with.
  */
 void touch_memory(char *p)
 {
-	int i;
-	int pagesize = getpagesize();
-
-	for (i = 0; i < (int)memsize; i += pagesize)
-		p[i] = 0xef;
+	memset(p, 0xef, memsize);
 }
 
 void mem_map(void)
diff --git a/testcases/kernel/controllers/memcg/memcontrol02.c b/testcases/kernel/controllers/memcg/memcontrol02.c
index 52096f697..6687c6e84 100644
--- a/testcases/kernel/controllers/memcg/memcontrol02.c
+++ b/testcases/kernel/controllers/memcg/memcontrol02.c
@@ -27,7 +27,6 @@
 #define _GNU_SOURCE
 #include "memcontrol_common.h"
 
-static size_t page_size;
 static struct tst_cg_group *cg_child;
 static int fd = -1;
 static int file_to_all_error = 10;
@@ -35,14 +34,18 @@ static int file_to_all_error = 10;
 static void alloc_anon_50M_check(void)
 {
 	const ssize_t size = MB(50);
-	char *buf, *ptr;
+	char *buf;
 	ssize_t anon, current;
 	const char *const anon_key_fmt =
 		TST_CG_VER_IS_V1(tst_cg, "memory") ? "rss %zd" : "anon %zd";
 
 	buf = SAFE_MALLOC(size);
-	for (ptr = buf; ptr < buf + size; ptr += page_size)
-		*ptr = 0;
+	/*
+	 * Write the whole buffer rather than one byte per getpagesize(), so
+	 * that it gets fully populated regardless of the granularity the
+	 * kernel faults in memory with.
+	 */
+	memset(buf, 1, size);
 
 	SAFE_CG_SCANF(cg_child, "memory.current", "%zd", &current);
 	TST_EXP_EXPR(current >= size,
@@ -113,8 +116,6 @@ static void test_memcg_current(unsigned int n)
 
 static void setup(void)
 {
-	page_size = SAFE_SYSCONF(_SC_PAGESIZE);
-
 	switch (tst_fs_type(TMPDIR)) {
 	case TST_VFAT_MAGIC:
 	case TST_EXFAT_MAGIC:
diff --git a/testcases/kernel/syscalls/userfaultfd/userfaultfd07.c b/testcases/kernel/syscalls/userfaultfd/userfaultfd07.c
index e0a1b0d23..dce6d8827 100644
--- a/testcases/kernel/syscalls/userfaultfd/userfaultfd07.c
+++ b/testcases/kernel/syscalls/userfaultfd/userfaultfd07.c
@@ -32,7 +32,7 @@ static void setup(void)
 
 static void set_pages(void)
 {
-	char ch = 'A';
+	char *buf;
 
 	page_size = SAFE_SYSCONF(_SC_PAGE_SIZE);
 
@@ -45,8 +45,15 @@ static void set_pages(void)
 	/*
 	 * Populate page cache so that after MADV_DONTNEED the next access
 	 * can generate a MINOR fault rather than a MISSING fault.
+	 *
+	 * Write the whole page, as UFFDIO_CONTINUE needs the page cache to
+	 * cover the whole range and the kernel may cache memory in units
+	 * smaller than getpagesize().
 	 */
-	SAFE_PWRITE(1, memfd, &ch, 1, 0);
+	buf = SAFE_MALLOC(page_size);
+	memset(buf, 'A', page_size);
+	SAFE_PWRITE(1, memfd, buf, page_size, 0);
+	free(buf);
 
 	page = SAFE_MMAP(NULL, page_size, PROT_READ, MAP_SHARED, memfd, 0);
 }
-- 
2.56.0.567.gdb80ae8cd5-goog


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH 3/4] ioctl10: Compare vma_page_size with KernelPageSize from smaps

[Wake Liu via ltp]

PROCMAP_QUERY returns in vma_page_size the page size the kernel uses to
back the VMA, i.e. vma_kernel_pagesize(), which /proc/$PID/smaps shows
as KernelPageSize. The test compares it with getpagesize() instead,
which is only correct as long as the kernel page size equals the page
size reported to userspace.

That is not the case with the 16K page size emulation that Android uses
on x86_64, where the kernel keeps using 4K pages internally:

  TFAIL: q->vma_page_size (4096) != getpagesize() (16384)

Compare it with KernelPageSize of the same VMA in /proc/self/smaps
instead. This also cross-checks the two kernel interfaces, the same way
the other fields are checked against /proc/self/maps. Nothing changes
on kernels where both page sizes are equal.

Signed-off-by: Wake Liu <wakel@google.com>
---
 testcases/kernel/syscalls/ioctl/ioctl10.c | 34 ++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/testcases/kernel/syscalls/ioctl/ioctl10.c b/testcases/kernel/syscalls/ioctl/ioctl10.c
index 8a4f8ae40..5dd2a866d 100644
--- a/testcases/kernel/syscalls/ioctl/ioctl10.c
+++ b/testcases/kernel/syscalls/ioctl/ioctl10.c
@@ -28,6 +28,7 @@
 #include "lapi/ioctl.h"
 
 #define PROC_MAP_PATH "/proc/self/maps"
+#define PROC_SMAPS_PATH "/proc/self/smaps"
 
 struct map_entry {
 	unsigned long vm_start;
@@ -86,6 +87,37 @@ static void parse_maps_file(const char *filename, const char *keyword, struct ma
 	tst_brk(TFAIL, "parse maps file /proc/self/maps failed");
 }
 
+/*
+ * vma_page_size is the page size the kernel uses to back the VMA, which is
+ * reported as KernelPageSize in /proc/self/smaps. It is not necessarily
+ * equal to getpagesize(), e.g. for hugetlb mappings or when the kernel
+ * reports a larger page size to userspace than it uses internally.
+ */
+static unsigned long get_kernel_page_size(unsigned long vm_start)
+{
+	FILE *fp = SAFE_FOPEN(PROC_SMAPS_PATH, "r");
+	unsigned long start, end, size_kb;
+	char line[1024];
+	int found = 0;
+
+	while (fgets(line, sizeof(line), fp)) {
+		if (sscanf(line, "%lx-%lx ", &start, &end) == 2) {
+			found = start == vm_start;
+			continue;
+		}
+
+		if (found && sscanf(line, "KernelPageSize: %lu kB", &size_kb) == 1) {
+			SAFE_FCLOSE(fp);
+			return size_kb * 1024;
+		}
+	}
+
+	SAFE_FCLOSE(fp);
+	tst_brk(TBROK, "KernelPageSize of %lx not found in %s",
+		vm_start, PROC_SMAPS_PATH);
+	return 0;
+}
+
 static void verify_ioctl(void)
 {
 	struct map_entry entry;
@@ -107,7 +139,7 @@ static void verify_ioctl(void)
 	TST_EXP_EQ_LU(q->vma_flags, entry.vm_flags);
 	TST_EXP_EQ_LU(q->vma_start, entry.vm_start);
 	TST_EXP_EQ_LU(q->vma_end, entry.vm_end);
-	TST_EXP_EQ_LU(q->vma_page_size, getpagesize());
+	TST_EXP_EQ_LU(q->vma_page_size, get_kernel_page_size(entry.vm_start));
 	TST_EXP_EQ_LU(q->vma_offset, entry.vm_pgoff);
 	TST_EXP_EQ_LU(q->inode, entry.vm_inode);
 	TST_EXP_EQ_LU(q->dev_major, entry.vm_major);
-- 
2.56.0.567.gdb80ae8cd5-goog


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH 4/4] signal06: Allocate the alternate signal stack with mmap()

[Wake Liu via ltp]

The test mprotect()s the alternate signal stack, which is a statically
allocated array of 4096 * 10 bytes aligned to 4096 bytes. That only
works if the page size is 4096 bytes. With a larger page size,
mprotect() either fails with EINVAL because the stack is not page
aligned or, since the length gets rounded up to the page size, also
write protects the variables placed after the array. The main thread
then faults on them over and over again and the test hangs until it
times out.

That happens with the 16K page size emulation that Android uses on
x86_64. With the stack at 0x53c000, mprotect() of its 40960 bytes
covers memory up to 0x548000 and the main thread keeps faulting right
after the end of the stack:

  --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_ACCERR, si_addr=0x546008}

Allocate the stack with mmap() and size it based on getpagesize().
Nothing changes with a 4096 byte page size.

Signed-off-by: Wake Liu <wakel@google.com>
---
 testcases/kernel/syscalls/signal/signal06.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/testcases/kernel/syscalls/signal/signal06.c b/testcases/kernel/syscalls/signal/signal06.c
index cf0706ea4..e464fc661 100644
--- a/testcases/kernel/syscalls/signal/signal06.c
+++ b/testcases/kernel/syscalls/signal/signal06.c
@@ -48,6 +48,7 @@
 #include <errno.h>
 
 #include "test.h"
+#include "tso_safe_macros.h"
 #include "lapi/syscalls.h"
 
 char *TCID = "signal06";
@@ -61,7 +62,8 @@ int TST_TOTAL = 5;
 volatile double D;
 volatile int FLAGE;
 
-char altstack[4096 * 10] __attribute__((aligned(4096)));
+static char *altstack;
+static size_t altstack_size;
 
 void test(void)
 {
@@ -99,12 +101,12 @@ void *tfunc(void *arg LTP_ATTRIBUTE_UNUSED)
 
 	for (i = -1; ; i *= -1) {
 		if (i == -1) {
-			TEST(mprotect(altstack, sizeof(altstack), PROT_READ));
+			TEST(mprotect(altstack, altstack_size, PROT_READ));
 			if (TEST_RETURN == -1)
 				tst_brkm(TBROK | TTERRNO, NULL, "mprotect failed");
 		}
 
-		TEST(mprotect(altstack, sizeof(altstack), PROT_READ | PROT_WRITE));
+		TEST(mprotect(altstack, altstack_size, PROT_READ | PROT_WRITE));
 		if (TEST_RETURN == -1)
 			tst_brkm(TBROK | TTERRNO, NULL, "mprotect failed");
 
@@ -120,9 +122,14 @@ int main(int ac, char **av)
 
 	tst_parse_opts(ac, av, NULL, NULL);
 
+	/* mprotect() needs the stack to be aligned to the runtime page size */
+	altstack_size = getpagesize() * 10;
+	altstack = SAFE_MMAP(NULL, NULL, altstack_size, PROT_READ | PROT_WRITE,
+			     MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+
 	stack_t st = {
 		.ss_sp = altstack,
-		.ss_size = sizeof(altstack),
+		.ss_size = altstack_size,
 		.ss_flags = SS_ONSTACK,
 	};
 
-- 
2.56.0.567.gdb80ae8cd5-goog


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp