On 4/22/22 3:29 PM, Axel Rasmussen wrote:

This not being included was just a simple oversight. There are certain features (like minor fault support) which are only enabled on shared mappings, so without including hugetlb_shared we actually lose a significant amount of test coverage.

Signed-off-by: Axel Rasmussen axelrasmussen@google.com

tools/testing/selftests/vm/run_vmtests.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/vm/run_vmtests.sh b/tools/testing/selftests/vm/run_vmtests.sh index a2302b5faaf2..5065dbd89bdb 100755 --- a/tools/testing/selftests/vm/run_vmtests.sh +++ b/tools/testing/selftests/vm/run_vmtests.sh @@ -121,9 +121,11 @@ run_test ./gup_test -a run_test ./gup_test -ct -F 0x1 0 19 0x1000 run_test ./userfaultfd anon 20 16 -# Test requires source and destination huge pages. Size of source -# (half_ufd_size_MB) is passed as argument to test. +# Hugetlb tests require source and destination huge pages. Pass in half the +# size ($half_ufd_size_MB), which is used for *each*. run_test ./userfaultfd hugetlb "$half_ufd_size_MB" 32 +run_test ./userfaultfd hugetlb_shared "$half_ufd_size_MB" 32 "$mnt"/uffd-test +rm -f "$mnt"/uffd-test run_test ./userfaultfd shmem 20 16 #cleanup

Looks good to me.

Reviewed-by: Shuah Khan skhan@linuxfoundation.org

thanks, -- Shuah

You're right, [1] says _IO is appropriate for ioctls which only take an integer argument. I'll send a v3 with this fix, although I might wait a bit for any other review comments before doing so. Thanks for taking a look!

https://www.kernel.org/doc/html/latest/driver-api/ioctl.html

On Mon, Apr 25, 2022 at 1:32 PM Dmitry V. Levin ldv@altlinux.org wrote:

On Fri, Apr 22, 2022 at 02:29:41PM -0700, Axel Rasmussen wrote: [...]

...

--- a/include/uapi/linux/userfaultfd.h +++ b/include/uapi/linux/userfaultfd.h @@ -12,6 +12,10 @@

#include <linux/types.h>

+/* ioctls for /dev/userfaultfd */ +#define USERFAULTFD_IOC 0xAA +#define USERFAULTFD_IOC_NEW _IOWR(USERFAULTFD_IOC, 0x00, int)

Why this new ioctl is defined using _IOWR()? Since it neither reads from user memory nor writes into user memory, it should rather be defined using _IO(), shouldn't it?

-- ldv

Axel,

On Fri, Apr 22, 2022 at 02:29:41PM -0700, Axel Rasmussen wrote:

@@ -65,6 +66,8 @@ struct userfaultfd_ctx { unsigned int flags; /* features requested from the userspace */ unsigned int features;

• /* whether or not to handle kernel faults */
• bool handle_kernel_faults;

Could you help explain why we need this bool? I failed to figure out myself on the difference against "!(ctx->flags & UFFD_USER_MODE_ONLY)".

Thanks,

On Tue, Apr 26, 2022 at 9:16 AM Shuah Khan skhan@linuxfoundation.org wrote:

On 4/22/22 3:29 PM, Axel Rasmussen wrote:

...

We clearly want to ensure both userfaultfd(2) and /dev/userfaultfd keep working into the future, so just run the test twice, using each interface.

Signed-off-by: Axel Rasmussen axelrasmussen@google.com

tools/testing/selftests/vm/userfaultfd.c | 31 ++++++++++++++++++++++-- 1 file changed, 29 insertions(+), 2 deletions(-)

diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c index 92a4516f8f0d..12ae742a9981 100644 --- a/tools/testing/selftests/vm/userfaultfd.c +++ b/tools/testing/selftests/vm/userfaultfd.c @@ -77,6 +77,9 @@ static int bounces; #define TEST_SHMEM 3 static int test_type;

+/* test using /dev/userfaultfd, instead of userfaultfd(2) */ +static bool test_dev_userfaultfd;

• /* exercise the test_uffdio_*_eexist every ALARM_INTERVAL_SECS */ #define ALARM_INTERVAL_SECS 10 static volatile bool test_uffdio_copy_eexist = true;

@@ -383,13 +386,31 @@ static void assert_expected_ioctls_present(uint64_t mode, uint64_t ioctls) } }

+static void __userfaultfd_open_dev(void) +{

• int fd;
  

• uffd = -1;
  

• fd = open("/dev/userfaultfd", O_RDWR | O_CLOEXEC);
  

• if (fd < 0)
  

•         return;
  

• uffd = ioctl(fd, USERFAULTFD_IOC_NEW,
  

•              O_CLOEXEC | O_NONBLOCK | UFFD_USER_MODE_ONLY);
  

• close(fd);
  

+}

• static void userfaultfd_open(uint64_t *features) { struct uffdio_api uffdio_api;

• uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK | UFFD_USER_MODE_ONLY);
  

• if (test_dev_userfaultfd)
  

•         __userfaultfd_open_dev();
  

• else
  

•         uffd = syscall(__NR_userfaultfd,
  

•                        O_CLOEXEC | O_NONBLOCK | UFFD_USER_MODE_ONLY);
  if (uffd < 0)
  

•         err("userfaultfd syscall not available in this kernel");
  

•         err("creating userfaultfd failed");
  

This isn't an error as in test failure. This will be a skip because of unmet dependencies. Also if this test requires root access, please check for that and make that a skip as well.

Testing with the userfaultfd syscall doesn't require any special permissions (root or otherwise).

But testing with /dev/userfaultfd will require access to that device node, which is root:root by default, but the system administrator may have changed this. In general I think this will only fail due to a) lack of kernel support or b) lack of permissions though, so always exiting with KSFT_SKIP here seems reasonable. I'll make that change in v3.

...

  uffd_flags = fcntl(uffd, F_GETFD, NULL);

  uffdio_api.api = UFFD_API;

@@ -1698,6 +1719,12 @@ int main(int argc, char **argv) } printf("nr_pages: %lu, nr_pages_per_cpu: %lu\n", nr_pages, nr_pages_per_cpu);

• test_dev_userfaultfd = false;
  

• if (userfaultfd_stress())
  

•         return 1;
  

• test_dev_userfaultfd = true;
  return userfaultfd_stress();
  

  }

thanks, -- Shuah

On 4/22/22 3:29 PM, Axel Rasmussen wrote:

Explain the different ways to create a new userfaultfd, and how access control works for each way.

Signed-off-by: Axel Rasmussen axelrasmussen@google.com

Documentation/admin-guide/mm/userfaultfd.rst | 38 ++++++++++++++++++-- Documentation/admin-guide/sysctl/vm.rst | 3 ++ 2 files changed, 39 insertions(+), 2 deletions(-)

diff --git a/Documentation/admin-guide/mm/userfaultfd.rst b/Documentation/admin-guide/mm/userfaultfd.rst index 6528036093e1..4c079b5377d4 100644 --- a/Documentation/admin-guide/mm/userfaultfd.rst +++ b/Documentation/admin-guide/mm/userfaultfd.rst @@ -17,7 +17,10 @@ of the ``PROT_NONE+SIGSEGV`` trick. Design ====== -Userfaults are delivered and resolved through the ``userfaultfd`` syscall.

Please keep this sentence in there and rephrase it to indicate how it was done in the past.

Also explain here why this new approach is better than the syscall approach before getting into the below details.

+Userspace creates a new userfaultfd, initializes it, and registers one or more +regions of virtual memory with it. Then, any page faults which occur within the +region(s) result in a message being delivered to the userfaultfd, notifying +userspace of the fault. The ``userfaultfd`` (aside from registering and unregistering virtual memory ranges) provides two primary functionalities: @@ -39,7 +42,7 @@ Vmas are not suitable for page- (or hugepage) granular fault tracking when dealing with virtual address spaces that could span Terabytes. Too many vmas would be needed for that.> -The ``userfaultfd`` once opened by invoking the syscall, can also be +The ``userfaultfd``, once created, can also be

This is sentence is too short and would look odd. Combine the sentences so it renders well in the generated doc.

passed using unix domain sockets to a manager process, so the same manager process could handle the userfaults of a multitude of different processes without them being aware about what is going on @@ -50,6 +53,37 @@ is a corner case that would currently return ``-EBUSY``). API === +Creating a userfaultfd +----------------------

+There are two mechanisms to create a userfaultfd. There are various ways to +restrict this too, since userfaultfds which handle kernel page faults have +historically been a useful tool for exploiting the kernel.

+The first is the userfaultfd(2) syscall. Access to this is controlled in several +ways:

+- By default, the userfaultfd will be able to handle kernel page faults. This

• can be disabled by passing in UFFD_USER_MODE_ONLY.

+- If vm.unprivileged_userfaultfd is 0, then the caller must *either* have

• CAP_SYS_PTRACE, or pass in UFFD_USER_MODE_ONLY.

+- If vm.unprivileged_userfaultfd is 1, then no particular privilege is needed to

• use this syscall, even if UFFD_USER_MODE_ONLY is *not* set.

+Alternatively, userfaultfds can be created by opening /dev/userfaultfd, and +issuing a USERFAULTFD_IOC_NEW ioctl to this device. Access to this device is

New ioctl? I thought we are moving away from using ioctls?

+controlled via normal filesystem permissions (user/group/mode for example) - no +additional permission (capability/sysctl) is needed to be able to handle kernel +faults this way. This is useful because it allows e.g. a specific user or group +to be able to create kernel-fault-handling userfaultfds, without allowing it +more broadly, or granting more privileges in addition to that particular ability +(CAP_SYS_PTRACE). In other words, it allows permissions to be minimized.

+Initializing up a userfaultfd +------------------------

This will generate doc warn very likley - extend the dashes to the entire length of the subtitle.

When first opened the ``userfaultfd`` must be enabled invoking the ``UFFDIO_API`` ioctl specifying a ``uffdio_api.api`` value set to ``UFFD_API`` (or a later API version) which will specify the ``read/POLLIN`` protocol diff --git a/Documentation/admin-guide/sysctl/vm.rst b/Documentation/admin-guide/sysctl/vm.rst index f4804ce37c58..8682d5fbc8ea 100644 --- a/Documentation/admin-guide/sysctl/vm.rst +++ b/Documentation/admin-guide/sysctl/vm.rst @@ -880,6 +880,9 @@ calls without any restrictions. The default value is 0. +An alternative to this sysctl / the userfaultfd(2) syscall is to create +userfaultfds via /dev/userfaultfd. See +Documentation/admin-guide/mm/userfaultfd.rst. user_reserve_kbytes ===================

thanks, -- Shuah

On Tue, Apr 26, 2022 at 9:56 AM Shuah Khan skhan@linuxfoundation.org wrote:

On 4/22/22 3:29 PM, Axel Rasmussen wrote:

...

Instead of always testing both userfaultfd(2) and /dev/userfaultfd, let the user choose which to test.

As with other test features, change the behavior based on a new command line flag. Introduce the idea of "test mods", which are generic (not specific to a test type) modifications to the behavior of the test. This is sort of borrowed from this RFC patch series [1], but simplified a bit.

The benefit is, in "typical" configurations this test is somewhat slow (say, 30sec or something). Testing both clearly doubles it, so it may not always be desirable, as users are likely to use one or the other, but never both, in the "real world".

Signed-off-by: Axel Rasmussen axelrasmussen@google.com

tools/testing/selftests/vm/userfaultfd.c | 41 +++++++++++++++++------- 1 file changed, 30 insertions(+), 11 deletions(-)

diff --git a/tools/testing/selftests/vm/userfaultfd.c b/tools/testing/selftests/vm/userfaultfd.c index 12ae742a9981..274522704e40 100644 --- a/tools/testing/selftests/vm/userfaultfd.c +++ b/tools/testing/selftests/vm/userfaultfd.c @@ -142,8 +142,17 @@ static void usage(void) { fprintf(stderr, "\nUsage: ./userfaultfd <test type> <MiB> <bounces> " "[hugetlbfs_file]\n\n");

Remove the extra blank line here.

...

  fprintf(stderr, "Supported <test type>: anon, hugetlb, "
          "hugetlb_shared, shmem\n\n");

Remove the extra blank line here.

...

• fprintf(stderr, "'Test mods' can be joined to the test type string with a ':'. "
  

•         "Supported mods:\n");
  

• fprintf(stderr, "\tdev - Use /dev/userfaultfd instead of userfaultfd(2)\n");
  

• fprintf(stderr, "\nExample test mod usage:\n");
  

• fprintf(stderr, "# Run anonymous memory test with /dev/userfaultfd:\n");
  

• fprintf(stderr, "./userfaultfd anon:dev 100 99999\n\n");
  

• fprintf(stderr, "Examples:\n\n");
  fprintf(stderr, "%s", examples);
  

Update examples above with new test cases if any.

Will fix the above comments in v3.

...

  exit(1);

@@ -1610,8 +1619,6 @@ unsigned long default_huge_page_size(void)

static void set_test_type(const char *type) {

• uint64_t features = UFFD_API_FEATURES;
  

• if (!strcmp(type, "anon")) {
          test_type = TEST_ANON;
          uffd_test_ops = &anon_uffd_test_ops;
  

@@ -1631,10 +1638,28 @@ static void set_test_type(const char *type) test_type = TEST_SHMEM; uffd_test_ops = &shmem_uffd_test_ops; test_uffdio_minor = true;

• } else {
  

•         err("Unknown test type: %s", type);
  

• }
  

At this point, it might make it so much easier and maintainable if we were to use getopt instead of parsing options.

Agreed, I'd like that as well. But, since it's a bigger refactor that affects all test types, I think it may be cleaner to leave it for a follow-up series.

...

+}

+static void parse_test_type_arg(const char *raw_type) +{

• char *buf = strdup(raw_type);
  

• uint64_t features = UFFD_API_FEATURES;
  

• while (buf) {
  

•         const char *token = strsep(&buf, ":");
  

•         if (!test_type)
  

•                 set_test_type(token);
  

•         else if (!strcmp(token, "dev"))
  

•                 test_dev_userfaultfd = true;
  

•         else
  

•                 err("unrecognized test mod '%s'", token);
  }
  
  

• if (!test_type)
  

•         err("failed to parse test type argument: '%s'", raw_type);
  

• if (test_type == TEST_HUGETLB)
          page_size = default_huge_page_size();
  else
  

@@ -1681,7 +1706,7 @@ int main(int argc, char **argv) err("failed to arm SIGALRM"); alarm(ALARM_INTERVAL_SECS);

• set_test_type(argv[1]);
  

• parse_test_type_arg(argv[1]);
  
  nr_cpus = sysconf(_SC_NPROCESSORS_ONLN);
  nr_pages_per_cpu = atol(argv[2]) * 1024*1024 / page_size /
  

@@ -1719,12 +1744,6 @@ int main(int argc, char **argv) } printf("nr_pages: %lu, nr_pages_per_cpu: %lu\n", nr_pages, nr_pages_per_cpu);

• test_dev_userfaultfd = false;
  

• if (userfaultfd_stress())
  

•         return 1;
  

• test_dev_userfaultfd = true;
  return userfaultfd_stress();
  

  }

Same comments as before on fail vs. skip conditions to watch out for and report them correctly.

I think in v3 things will be correct. Basically, in the skip cases we just exit(KSFT_SKIP) directly, instead of relying on the return value here. I'll take a pass and double check though before sending v3.

thanks, -- Shuah

On 4/22/22 3:29 PM, Axel Rasmussen wrote:

This new mode was recently added to the userfaultfd selftest. We want to exercise both userfaultfd(2) as well as /dev/userfaultfd, so add both test cases to the script.

Signed-off-by: Axel Rasmussen axelrasmussen@google.com

tools/testing/selftests/vm/run_vmtests.sh | 5 +++++ 1 file changed, 5 insertions(+)

diff --git a/tools/testing/selftests/vm/run_vmtests.sh b/tools/testing/selftests/vm/run_vmtests.sh index 5065dbd89bdb..57f01505c719 100755 --- a/tools/testing/selftests/vm/run_vmtests.sh +++ b/tools/testing/selftests/vm/run_vmtests.sh @@ -121,12 +121,17 @@ run_test ./gup_test -a run_test ./gup_test -ct -F 0x1 0 19 0x1000 run_test ./userfaultfd anon 20 16 +run_test ./userfaultfd anon:dev 20 16 # Hugetlb tests require source and destination huge pages. Pass in half the # size ($half_ufd_size_MB), which is used for *each*. run_test ./userfaultfd hugetlb "$half_ufd_size_MB" 32 +run_test ./userfaultfd hugetlb:dev "$half_ufd_size_MB" 32 run_test ./userfaultfd hugetlb_shared "$half_ufd_size_MB" 32 "$mnt"/uffd-test rm -f "$mnt"/uffd-test +run_test ./userfaultfd hugetlb_shared:dev "$half_ufd_size_MB" 32 "$mnt"/uffd-test +rm -f "$mnt"/uffd-test run_test ./userfaultfd shmem 20 16 +run_test ./userfaultfd shmem:dev 20 16 #cleanup umount "$mnt"

Looks good to me.

Reviewed-by: Shuah Khan skhan@linuxfoundation.org

thanks, -- Shuah