[hwasan] Madvise away unused shadow.

[eugenis]

Summary

Whenever a large shadow region is tagged to zero, madvise(DONT_NEED)
as much of it as possible.

This reduces shadow RSS on Android by 45% or so, and total memory use
by 2-4%, probably even more on long running multithreaded programs.
CPU time seems to be in the noise.

[pcc]

compiler-rt/lib/hwasan/hwasan_poisoning.cc

35–37

This code would work without the ifs, right?

[eugenis]

a test case

[pcc]

compiler-rt/test/hwasan/TestCases/Linux/release-shadow.c

35

Can't this just be open("/proc/self/statm", O_RDONLY);?

[eugenis]

.

[eugenis]

compiler-rt/test/hwasan/TestCases/Linux/release-shadow.c

35

I suppose it could.

[pcc]

LGTM

compiler-rt/lib/hwasan/hwasan.cc

SetCommonFlagsDefaults();
     cf.CopyFrom(*common_flags());
     cf.external_symbolizer_path = GetEnv("HWASAN_SYMBOLIZER_PATH");
     cf.malloc_context_size = 20;
     cf.handle_ioctl = true;
     // FIXME: test and enable.
     cf.check_printf = false;
     cf.intercept_tls_get_addr = true;
     cf.exitcode = 99;
+    // 8 shadow pages ~512kB, small enough to cover common stack sizes.
+    cf.clear_shadow_mmap_threshold = 4096 * (SANITIZER_ANDROID ? 2 : 8);
     // Sigtrap is used in error reporting.
     cf.handle_sigtrap = kHandleSignalExclusive;
 
 #if SANITIZER_ANDROID
     // Let platform handle other signals. It is better at reporting them then we
     // are.
     cf.handle_segv = kHandleSignalNo;
     cf.handle_sigbus = kHandleSignalNo;

compiler-rt/lib/hwasan/hwasan_poisoning.cc

 //
 //===----------------------------------------------------------------------===//
 
 #include "hwasan_poisoning.h"
 
 #include "hwasan_mapping.h"
 #include "interception/interception.h"
 #include "sanitizer_common/sanitizer_common.h"
+#include "sanitizer_common/sanitizer_linux.h"
 
 namespace __hwasan {
 
 uptr TagMemoryAligned(uptr p, uptr size, tag_t tag) {
   CHECK(IsAligned(p, kShadowAlignment));
   CHECK(IsAligned(size, kShadowAlignment));
   uptr shadow_start = MemToShadow(p);
   uptr shadow_size = MemToShadowSize(size);
+
+  uptr page_size = GetPageSizeCached();
+  uptr page_start = RoundUpTo(shadow_start, page_size);
+  uptr page_end = RoundDownTo(shadow_start + shadow_size, page_size);
+  uptr threshold = common_flags()->clear_shadow_mmap_threshold;
+  if (SANITIZER_LINUX &&
+      UNLIKELY(page_end >= page_start + threshold && tag == 0)) {
+    internal_memset((void *)shadow_start, tag, page_start - shadow_start);
+    internal_memset((void *)page_end, tag,
+                    shadow_start + shadow_size - page_end);
+    // For an anonymous private mapping MADV_DONTNEED will return a zero page on
+    // Linux.
+    ReleaseMemoryPagesToOSAndZeroFill(page_start, page_end);
+  } else {
     internal_memset((void *)shadow_start, tag, shadow_size);
+  }
   return AddTagToPointer(p, tag);
 }
 
 uptr TagMemory(uptr p, uptr size, tag_t tag) {
   uptr start = RoundDownTo(p, kShadowAlignment);
   uptr end = RoundUpTo(p + size, kShadowAlignment);
   return TagMemoryAligned(start, end - start, tag);
 }
 
 }  // namespace __hwasan

compiler-rt/lib/sanitizer_common/sanitizer_linux.h

 
 // Matches a library's file name against a base name (stripping path and version
 // information).
 bool LibraryNameIs(const char *full_name, const char *base_name);
 
 // Call cb for each region mapped by map.
 void ForEachMappedRegion(link_map *map, void (*cb)(const void *, uptr));
 
+// Releases memory pages entirely within the [beg, end] address range.
+// The pages no longer count toward RSS; reads are guaranteed to return 0.
+// Requires (but does not verify!) that pages are MAP_PRIVATE.
+INLINE void ReleaseMemoryPagesToOSAndZeroFill(uptr beg, uptr end) {
+  // man madvise on Linux promises zero-fill for anonymous private pages.
+  // Testing shows the same behaviour for private (but not anonymous) mappings
+  // of shm_open() files, as long as the underlying file is untouched.
+  CHECK(SANITIZER_LINUX);
+  ReleaseMemoryPagesToOS(beg, end);
+}
+
 #if SANITIZER_ANDROID
 
 #if defined(__aarch64__)
 # define __get_tls() \
     ({ void** __v; __asm__("mrs %0, tpidr_el0" : "=r"(__v)); __v; })
 #elif defined(__arm__)
 # define __get_tls() \
     ({ void** __v; __asm__("mrc p15, 0, %0, c13, c0, 3" : "=r"(__v)); __v; })

compiler-rt/test/hwasan/TestCases/Linux/release-shadow.c

+// Test that tagging a large region to 0 reduces RSS.
+// RUN: %clang_hwasan -mllvm -hwasan-instrument-stack=0 %s -o %t && %run %t 2>&1
+
+#include <assert.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/mman.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <sanitizer/hwasan_interface.h>
+
+char statm_path[100];
+
+const unsigned char kTag = 42;
+const size_t kNumShadowPages = 256;
+const size_t kNumPages = 16 * kNumShadowPages;
+const size_t kPageSize = 4096;
+const size_t kMapSize = kNumPages * kPageSize;
+
+void sync_rss() {
+  char *page = (char *)mmap(0, kPageSize, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
+  // Linux kernel updates RSS counters after a set number of page faults.
+  for (int i = 0; i < 1000; ++i) {
+    page[0] = 42;
+    madvise(page, kPageSize, MADV_DONTNEED);
+  }
+  munmap(page, kPageSize);
+}
+
+size_t current_rss() {
+  sync_rss();
+  int statm_fd = open(statm_path, O_RDONLY);
+  assert(statm_fd >= 0);
+
+  char buf[100];
+  assert(read(statm_fd, &buf, sizeof(buf)) > 0);
+  size_t size, rss;
+  assert(sscanf(buf, "%zu %zu", &size, &rss) == 2);
+
+  close(statm_fd);
+  return rss;
+}
+
+void test_rss_difference(void *p) {
+  __hwasan_tag_memory(p, kTag, kMapSize);
+  size_t rss_before = current_rss();
+  __hwasan_tag_memory(p, 0, kMapSize);
+  size_t rss_after = current_rss();
+  fprintf(stderr, "%zu -> %zu\n", rss_before, rss_after);
+  assert(rss_before > rss_after);
+  size_t diff = rss_before - rss_after;
+  fprintf(stderr, "diff %zu\n", diff);
+  // Check that the difference is at least close to kNumShadowPages.
+  assert(diff > kNumShadowPages / 4 * 3);
+}
+
+int main() {
+  snprintf(statm_path, sizeof(statm_path), "/proc/%d/statm", getpid());
+
+  fprintf(stderr, "starting rss %zu\n", current_rss());
+  fprintf(stderr, "shadow pages: %zu\n", kNumShadowPages);
+
+  void *p = mmap(0, kMapSize, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
+  fprintf(stderr, "p = %p\n", p);
+
+  test_rss_difference(p);
+  test_rss_difference(p);
+  test_rss_difference(p);
+
+  return 0;
+}