On Mon, 2 Mar 2026 12:13:24 +0000 Lorenzo Stoakes <[email protected]> wrote:
Hi Lorenzo, Thanks for looking into this. > > But looking at the various flags, I see there's a VM_SPECIAL. I'm wondering > > if that is what we should use? > > VM_SPECIAL is not a VMA flag, it's a bitmask of all the flags which cause us > not > to permit things like splitting/merging of VMAs (because we can't safely do > them), i.e. that are one or more of: Yep, I knew it wasn't a flag, and actually picked it because it looked to have the flags we may have wanted. > > VM_IO - Memory-mapped I/O range. > > VM_PFNMAP - A mapping without struct folio's/page's backing them, e.g. > perhaps a > raw kernel mapping. > > VM_MIXEDMAP - A combination of page/folio-backed memory and/or PFN-backed > memory. > > VM_DONTEXPAND - Disallow expansion of memory in mremap(). > > You already set VM_DONTEXPAND so you get these semantics already. > > Setting VM_IO just to trigger a failure case in madvise() feels like a hack? I > guess it'd do the trick though, but you're not going to be able to reclaim > that > memory, and you might get some unexpected behaviour in code paths that assume > VM_IO means it's memory-mapped I/O... (for instance GUP will stop working, if > you need that). Well, we don't reclaim that memory anyway. > > I'd take a step back and wonder why you are wanting to not allow copying on > fork? Is this kernel-allocated memory? In which case you should set > VM_MIXEDMAP > or VM_PFNMAP as appropriate... If not and it has a folio etc. then it seems > like > strange semantics. > > Are you really bothered also by users doing strange things? Maybe the solution > is to tolerate a fork-copy even if it's broken? I presume somethings straight > up > breaks right now? Yeah, right now the accounting gets screwed up as the mappings get out of sync when it is forked. > > Without more context that I don't really have much time to acquire it's hard > to > know what to advise. Fair enough, let me explain everything then ;-) This is a mapping of the ftrace ring buffer to user space. Until recently, the only way user space could get access to the ftrace ring buffer was to either read it, or splice() it to a file/pipe/whatever. The way the ftrace ring buffer works is that it is made up of a bunch of sub-buffers (must be multiple of PAGE_SIZE and usually is a single page). There is one sub-buffer called the "reader-page" which writers never write to (with an exception out of scope for understanding the mappings). The "reader-page" is a sub-buffer that belongs to the reader. When the reader is finish with it and wants to read more of the buffer, an operation is performed to swap the current reader-page with one of the pages that the writers have. The new page is now owned by the reader and writers will leave it alone. This allows readers to do a zero copy splice of the data in the ring buffer. Now we added a feature to memory map this buffer to user space. The reader-page and writer sub-buffers are all mapped read-only into the user's memory address. Another page is mapped called the "meta page" which tells user space how to read the buffer (which sub-buffer is the current reader-page and the order of the write sub-buffers). The read-page is what user space will read directly, and when it is done, it does an ioctl() on the file descriptor for the buffer: /sys/kernel/tracing/per_cpu/cpu*/trace_pipe_raw One command of the ioctl() will tell the kernel to swap the reader-page with a writer sub-buffer. The meta page is updated and the user space application can read that. Now the meta page is unique per ring buffer and not per process. If there's a fork, any change to the meta page will affect all processes that have this mapped. If two processes map the same buffer, one process will see any updates in its meta page that another process does to it. Now there is nothing wrong with doing that, accept the user space processes will likely get confused. And we currently allow two separate tasks to mmap it at the same time (maybe we shouldn't have!). What we didn't allow was forking, as the code didn't update the proper accounting. It needs to know that the buffer is mapped because it handles splice differently. As the pages are mapped to user space, the kernel can't just allow splice to steal a page and send it off to whatever pipe. Instead it makes a copy of the page (basically killing the performance splice() gives it in the first place). We originally added the DONTFORK so that we didn't need to handle the fork case, but I'm guessing that you are suggesting that we should do that instead of preventing it from being duplicated on fork. Am I correct? -- Steve
