permissive.h 2.7 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394
  1. /* SPDX-License-Identifier: GPL-2.0 */
  2. /*
  3. * Special rules for ignoring entire classes of data-racy memory accesses. None
  4. * of the rules here imply that such data races are generally safe!
  5. *
  6. * All rules in this file can be configured via CONFIG_KCSAN_PERMISSIVE. Keep
  7. * them separate from core code to make it easier to audit.
  8. *
  9. * Copyright (C) 2019, Google LLC.
  10. */
  11. #ifndef _KERNEL_KCSAN_PERMISSIVE_H
  12. #define _KERNEL_KCSAN_PERMISSIVE_H
  13. #include <linux/bitops.h>
  14. #include <linux/sched.h>
  15. #include <linux/types.h>
  16. /*
  17. * Access ignore rules based on address.
  18. */
  19. static __always_inline bool kcsan_ignore_address(const volatile void *ptr)
  20. {
  21. if (!IS_ENABLED(CONFIG_KCSAN_PERMISSIVE))
  22. return false;
  23. /*
  24. * Data-racy bitops on current->flags are too common, ignore completely
  25. * for now.
  26. */
  27. return ptr == &current->flags;
  28. }
  29. /*
  30. * Data race ignore rules based on access type and value change patterns.
  31. */
  32. static bool
  33. kcsan_ignore_data_race(size_t size, int type, u64 old, u64 new, u64 diff)
  34. {
  35. if (!IS_ENABLED(CONFIG_KCSAN_PERMISSIVE))
  36. return false;
  37. /*
  38. * Rules here are only for plain read accesses, so that we still report
  39. * data races between plain read-write accesses.
  40. */
  41. if (type || size > sizeof(long))
  42. return false;
  43. /*
  44. * A common pattern is checking/setting just 1 bit in a variable; for
  45. * example:
  46. *
  47. * if (flags & SOME_FLAG) { ... }
  48. *
  49. * and elsewhere flags is updated concurrently:
  50. *
  51. * flags |= SOME_OTHER_FLAG; // just 1 bit
  52. *
  53. * While it is still recommended that such accesses be marked
  54. * appropriately, in many cases these types of data races are so common
  55. * that marking them all is often unrealistic and left to maintainer
  56. * preference.
  57. *
  58. * The assumption in all cases is that with all known compiler
  59. * optimizations (including those that tear accesses), because no more
  60. * than 1 bit changed, the plain accesses are safe despite the presence
  61. * of data races.
  62. *
  63. * The rules here will ignore the data races if we observe no more than
  64. * 1 bit changed.
  65. *
  66. * Of course many operations can effecively change just 1 bit, but the
  67. * general assuption that data races involving 1-bit changes can be
  68. * tolerated still applies.
  69. *
  70. * And in case a true bug is missed, the bug likely manifests as a
  71. * reportable data race elsewhere.
  72. */
  73. if (hweight64(diff) == 1) {
  74. /*
  75. * Exception: Report data races where the values look like
  76. * ordinary booleans (one of them was 0 and the 0th bit was
  77. * changed) More often than not, they come with interesting
  78. * memory ordering requirements, so let's report them.
  79. */
  80. if (!((!old || !new) && diff == 1))
  81. return true;
  82. }
  83. return false;
  84. }
  85. #endif /* _KERNEL_KCSAN_PERMISSIVE_H */