blob: 498b1eb3c1cdae249051281062d2af8a41b6000c [file] [log] [blame]
Marco Elverdfd402a2019-11-14 19:02:54 +01001// SPDX-License-Identifier: GPL-2.0
2
3#include <linux/atomic.h>
4#include <linux/bug.h>
5#include <linux/delay.h>
6#include <linux/export.h>
7#include <linux/init.h>
Marco Elver1e6ee2f2020-02-04 18:21:10 +01008#include <linux/kernel.h>
Marco Elver80d4c472020-02-07 19:59:10 +01009#include <linux/moduleparam.h>
Marco Elverdfd402a2019-11-14 19:02:54 +010010#include <linux/percpu.h>
11#include <linux/preempt.h>
12#include <linux/random.h>
13#include <linux/sched.h>
14#include <linux/uaccess.h>
15
16#include "atomic.h"
17#include "encoding.h"
18#include "kcsan.h"
19
Marco Elver80d4c472020-02-07 19:59:10 +010020static bool kcsan_early_enable = IS_ENABLED(CONFIG_KCSAN_EARLY_ENABLE);
21static unsigned int kcsan_udelay_task = CONFIG_KCSAN_UDELAY_TASK;
22static unsigned int kcsan_udelay_interrupt = CONFIG_KCSAN_UDELAY_INTERRUPT;
23static long kcsan_skip_watch = CONFIG_KCSAN_SKIP_WATCH;
24
25#ifdef MODULE_PARAM_PREFIX
26#undef MODULE_PARAM_PREFIX
27#endif
28#define MODULE_PARAM_PREFIX "kcsan."
29module_param_named(early_enable, kcsan_early_enable, bool, 0);
30module_param_named(udelay_task, kcsan_udelay_task, uint, 0644);
31module_param_named(udelay_interrupt, kcsan_udelay_interrupt, uint, 0644);
32module_param_named(skip_watch, kcsan_skip_watch, long, 0644);
33
Marco Elverdfd402a2019-11-14 19:02:54 +010034bool kcsan_enabled;
35
36/* Per-CPU kcsan_ctx for interrupts */
37static DEFINE_PER_CPU(struct kcsan_ctx, kcsan_cpu_ctx) = {
Ingo Molnar5cbaefe2019-11-20 10:41:43 +010038 .disable_count = 0,
39 .atomic_next = 0,
40 .atomic_nest_count = 0,
41 .in_flat_atomic = false,
Marco Elverdfd402a2019-11-14 19:02:54 +010042};
43
44/*
45 * Helper macros to index into adjacent slots slots, starting from address slot
46 * itself, followed by the right and left slots.
47 *
48 * The purpose is 2-fold:
49 *
50 * 1. if during insertion the address slot is already occupied, check if
51 * any adjacent slots are free;
52 * 2. accesses that straddle a slot boundary due to size that exceeds a
53 * slot's range may check adjacent slots if any watchpoint matches.
54 *
55 * Note that accesses with very large size may still miss a watchpoint; however,
56 * given this should be rare, this is a reasonable trade-off to make, since this
57 * will avoid:
58 *
59 * 1. excessive contention between watchpoint checks and setup;
60 * 2. larger number of simultaneous watchpoints without sacrificing
61 * performance.
62 *
63 * Example: SLOT_IDX values for KCSAN_CHECK_ADJACENT=1, where i is [0, 1, 2]:
64 *
65 * slot=0: [ 1, 2, 0]
66 * slot=9: [10, 11, 9]
67 * slot=63: [64, 65, 63]
68 */
Ingo Molnar5cbaefe2019-11-20 10:41:43 +010069#define NUM_SLOTS (1 + 2*KCSAN_CHECK_ADJACENT)
Marco Elverdfd402a2019-11-14 19:02:54 +010070#define SLOT_IDX(slot, i) (slot + ((i + KCSAN_CHECK_ADJACENT) % NUM_SLOTS))
71
72/*
Ingo Molnar5cbaefe2019-11-20 10:41:43 +010073 * SLOT_IDX_FAST is used in the fast-path. Not first checking the address's primary
Marco Elverd591ec32020-02-06 16:46:24 +010074 * slot (middle) is fine if we assume that races occur rarely. The set of
Marco Elverdfd402a2019-11-14 19:02:54 +010075 * indices {SLOT_IDX(slot, i) | i in [0, NUM_SLOTS)} is equivalent to
76 * {SLOT_IDX_FAST(slot, i) | i in [0, NUM_SLOTS)}.
77 */
78#define SLOT_IDX_FAST(slot, i) (slot + i)
79
80/*
81 * Watchpoints, with each entry encoded as defined in encoding.h: in order to be
82 * able to safely update and access a watchpoint without introducing locking
83 * overhead, we encode each watchpoint as a single atomic long. The initial
84 * zero-initialized state matches INVALID_WATCHPOINT.
85 *
86 * Add NUM_SLOTS-1 entries to account for overflow; this helps avoid having to
Ingo Molnar5cbaefe2019-11-20 10:41:43 +010087 * use more complicated SLOT_IDX_FAST calculation with modulo in the fast-path.
Marco Elverdfd402a2019-11-14 19:02:54 +010088 */
Ingo Molnar5cbaefe2019-11-20 10:41:43 +010089static atomic_long_t watchpoints[CONFIG_KCSAN_NUM_WATCHPOINTS + NUM_SLOTS-1];
Marco Elverdfd402a2019-11-14 19:02:54 +010090
91/*
92 * Instructions to skip watching counter, used in should_watch(). We use a
93 * per-CPU counter to avoid excessive contention.
94 */
95static DEFINE_PER_CPU(long, kcsan_skip);
96
Marco Elver5c361422020-01-07 17:31:04 +010097static __always_inline atomic_long_t *find_watchpoint(unsigned long addr,
98 size_t size,
99 bool expect_write,
100 long *encoded_watchpoint)
Marco Elverdfd402a2019-11-14 19:02:54 +0100101{
102 const int slot = watchpoint_slot(addr);
103 const unsigned long addr_masked = addr & WATCHPOINT_ADDR_MASK;
104 atomic_long_t *watchpoint;
105 unsigned long wp_addr_masked;
106 size_t wp_size;
107 bool is_write;
108 int i;
109
110 BUILD_BUG_ON(CONFIG_KCSAN_NUM_WATCHPOINTS < NUM_SLOTS);
111
112 for (i = 0; i < NUM_SLOTS; ++i) {
113 watchpoint = &watchpoints[SLOT_IDX_FAST(slot, i)];
114 *encoded_watchpoint = atomic_long_read(watchpoint);
115 if (!decode_watchpoint(*encoded_watchpoint, &wp_addr_masked,
116 &wp_size, &is_write))
117 continue;
118
119 if (expect_write && !is_write)
120 continue;
121
122 /* Check if the watchpoint matches the access. */
123 if (matching_access(wp_addr_masked, wp_size, addr_masked, size))
124 return watchpoint;
125 }
126
127 return NULL;
128}
129
Ingo Molnar5cbaefe2019-11-20 10:41:43 +0100130static inline atomic_long_t *
131insert_watchpoint(unsigned long addr, size_t size, bool is_write)
Marco Elverdfd402a2019-11-14 19:02:54 +0100132{
133 const int slot = watchpoint_slot(addr);
134 const long encoded_watchpoint = encode_watchpoint(addr, size, is_write);
135 atomic_long_t *watchpoint;
136 int i;
137
138 /* Check slot index logic, ensuring we stay within array bounds. */
139 BUILD_BUG_ON(SLOT_IDX(0, 0) != KCSAN_CHECK_ADJACENT);
Ingo Molnar5cbaefe2019-11-20 10:41:43 +0100140 BUILD_BUG_ON(SLOT_IDX(0, KCSAN_CHECK_ADJACENT+1) != 0);
141 BUILD_BUG_ON(SLOT_IDX(CONFIG_KCSAN_NUM_WATCHPOINTS-1, KCSAN_CHECK_ADJACENT) != ARRAY_SIZE(watchpoints)-1);
142 BUILD_BUG_ON(SLOT_IDX(CONFIG_KCSAN_NUM_WATCHPOINTS-1, KCSAN_CHECK_ADJACENT+1) != ARRAY_SIZE(watchpoints) - NUM_SLOTS);
Marco Elverdfd402a2019-11-14 19:02:54 +0100143
144 for (i = 0; i < NUM_SLOTS; ++i) {
145 long expect_val = INVALID_WATCHPOINT;
146
147 /* Try to acquire this slot. */
148 watchpoint = &watchpoints[SLOT_IDX(slot, i)];
Ingo Molnar5cbaefe2019-11-20 10:41:43 +0100149 if (atomic_long_try_cmpxchg_relaxed(watchpoint, &expect_val, encoded_watchpoint))
Marco Elverdfd402a2019-11-14 19:02:54 +0100150 return watchpoint;
151 }
152
153 return NULL;
154}
155
156/*
157 * Return true if watchpoint was successfully consumed, false otherwise.
158 *
159 * This may return false if:
160 *
161 * 1. another thread already consumed the watchpoint;
162 * 2. the thread that set up the watchpoint already removed it;
163 * 3. the watchpoint was removed and then re-used.
164 */
Marco Elver5c361422020-01-07 17:31:04 +0100165static __always_inline bool
Ingo Molnar5cbaefe2019-11-20 10:41:43 +0100166try_consume_watchpoint(atomic_long_t *watchpoint, long encoded_watchpoint)
Marco Elverdfd402a2019-11-14 19:02:54 +0100167{
Ingo Molnar5cbaefe2019-11-20 10:41:43 +0100168 return atomic_long_try_cmpxchg_relaxed(watchpoint, &encoded_watchpoint, CONSUMED_WATCHPOINT);
Marco Elverdfd402a2019-11-14 19:02:54 +0100169}
170
171/*
172 * Return true if watchpoint was not touched, false if consumed.
173 */
174static inline bool remove_watchpoint(atomic_long_t *watchpoint)
175{
Ingo Molnar5cbaefe2019-11-20 10:41:43 +0100176 return atomic_long_xchg_relaxed(watchpoint, INVALID_WATCHPOINT) != CONSUMED_WATCHPOINT;
Marco Elverdfd402a2019-11-14 19:02:54 +0100177}
178
Marco Elver5c361422020-01-07 17:31:04 +0100179static __always_inline struct kcsan_ctx *get_ctx(void)
Marco Elverdfd402a2019-11-14 19:02:54 +0100180{
181 /*
Ingo Molnar5cbaefe2019-11-20 10:41:43 +0100182 * In interrupts, use raw_cpu_ptr to avoid unnecessary checks, that would
Marco Elverdfd402a2019-11-14 19:02:54 +0100183 * also result in calls that generate warnings in uaccess regions.
184 */
185 return in_task() ? &current->kcsan_ctx : raw_cpu_ptr(&kcsan_cpu_ctx);
186}
187
Marco Elver1e6ee2f2020-02-04 18:21:10 +0100188static __always_inline bool
189is_atomic(const volatile void *ptr, size_t size, int type)
Marco Elverdfd402a2019-11-14 19:02:54 +0100190{
Marco Elver1e6ee2f2020-02-04 18:21:10 +0100191 struct kcsan_ctx *ctx;
Marco Elverdfd402a2019-11-14 19:02:54 +0100192
Marco Elver1e6ee2f2020-02-04 18:21:10 +0100193 if ((type & KCSAN_ACCESS_ATOMIC) != 0)
194 return true;
195
Marco Elverd591ec32020-02-06 16:46:24 +0100196 /*
197 * Unless explicitly declared atomic, never consider an assertion access
198 * as atomic. This allows using them also in atomic regions, such as
199 * seqlocks, without implicitly changing their semantics.
200 */
201 if ((type & KCSAN_ACCESS_ASSERT) != 0)
202 return false;
203
Marco Elver1e6ee2f2020-02-04 18:21:10 +0100204 if (IS_ENABLED(CONFIG_KCSAN_ASSUME_PLAIN_WRITES_ATOMIC) &&
205 (type & KCSAN_ACCESS_WRITE) != 0 && size <= sizeof(long) &&
206 IS_ALIGNED((unsigned long)ptr, size))
207 return true; /* Assume aligned writes up to word size are atomic. */
208
209 ctx = get_ctx();
Marco Elverdfd402a2019-11-14 19:02:54 +0100210 if (unlikely(ctx->atomic_next > 0)) {
211 /*
212 * Because we do not have separate contexts for nested
213 * interrupts, in case atomic_next is set, we simply assume that
214 * the outer interrupt set atomic_next. In the worst case, we
215 * will conservatively consider operations as atomic. This is a
216 * reasonable trade-off to make, since this case should be
217 * extremely rare; however, even if extremely rare, it could
218 * lead to false positives otherwise.
219 */
220 if ((hardirq_count() >> HARDIRQ_SHIFT) < 2)
221 --ctx->atomic_next; /* in task, or outer interrupt */
222 return true;
223 }
224 if (unlikely(ctx->atomic_nest_count > 0 || ctx->in_flat_atomic))
225 return true;
226
227 return kcsan_is_atomic(ptr);
228}
229
Marco Elver1e6ee2f2020-02-04 18:21:10 +0100230static __always_inline bool
231should_watch(const volatile void *ptr, size_t size, int type)
Marco Elverdfd402a2019-11-14 19:02:54 +0100232{
233 /*
234 * Never set up watchpoints when memory operations are atomic.
235 *
236 * Need to check this first, before kcsan_skip check below: (1) atomics
237 * should not count towards skipped instructions, and (2) to actually
238 * decrement kcsan_atomic_next for consecutive instruction stream.
239 */
Marco Elver1e6ee2f2020-02-04 18:21:10 +0100240 if (is_atomic(ptr, size, type))
Marco Elverdfd402a2019-11-14 19:02:54 +0100241 return false;
242
243 if (this_cpu_dec_return(kcsan_skip) >= 0)
244 return false;
245
246 /*
247 * NOTE: If we get here, kcsan_skip must always be reset in slow path
248 * via reset_kcsan_skip() to avoid underflow.
249 */
250
251 /* this operation should be watched */
252 return true;
253}
254
255static inline void reset_kcsan_skip(void)
256{
Marco Elver80d4c472020-02-07 19:59:10 +0100257 long skip_count = kcsan_skip_watch -
Marco Elverdfd402a2019-11-14 19:02:54 +0100258 (IS_ENABLED(CONFIG_KCSAN_SKIP_WATCH_RANDOMIZE) ?
Marco Elver80d4c472020-02-07 19:59:10 +0100259 prandom_u32_max(kcsan_skip_watch) :
Marco Elverdfd402a2019-11-14 19:02:54 +0100260 0);
261 this_cpu_write(kcsan_skip, skip_count);
262}
263
Marco Elver5c361422020-01-07 17:31:04 +0100264static __always_inline bool kcsan_is_enabled(void)
Marco Elverdfd402a2019-11-14 19:02:54 +0100265{
266 return READ_ONCE(kcsan_enabled) && get_ctx()->disable_count == 0;
267}
268
269static inline unsigned int get_delay(void)
270{
Marco Elver80d4c472020-02-07 19:59:10 +0100271 unsigned int delay = in_task() ? kcsan_udelay_task : kcsan_udelay_interrupt;
Marco Elverdfd402a2019-11-14 19:02:54 +0100272 return delay - (IS_ENABLED(CONFIG_KCSAN_DELAY_RANDOMIZE) ?
273 prandom_u32_max(delay) :
274 0);
275}
276
277/*
278 * Pull everything together: check_access() below contains the performance
279 * critical operations; the fast-path (including check_access) functions should
280 * all be inlinable by the instrumentation functions.
281 *
282 * The slow-path (kcsan_found_watchpoint, kcsan_setup_watchpoint) are
283 * non-inlinable -- note that, we prefix these with "kcsan_" to ensure they can
284 * be filtered from the stacktrace, as well as give them unique names for the
285 * UACCESS whitelist of objtool. Each function uses user_access_save/restore(),
286 * since they do not access any user memory, but instrumentation is still
287 * emitted in UACCESS regions.
288 */
289
290static noinline void kcsan_found_watchpoint(const volatile void *ptr,
Ingo Molnar5cbaefe2019-11-20 10:41:43 +0100291 size_t size,
Marco Elver47144ec2020-01-10 19:48:33 +0100292 int type,
Marco Elverdfd402a2019-11-14 19:02:54 +0100293 atomic_long_t *watchpoint,
294 long encoded_watchpoint)
295{
296 unsigned long flags;
297 bool consumed;
298
299 if (!kcsan_is_enabled())
300 return;
301 /*
302 * Consume the watchpoint as soon as possible, to minimize the chances
303 * of !consumed. Consuming the watchpoint must always be guarded by
304 * kcsan_is_enabled() check, as otherwise we might erroneously
305 * triggering reports when disabled.
306 */
307 consumed = try_consume_watchpoint(watchpoint, encoded_watchpoint);
308
309 /* keep this after try_consume_watchpoint */
310 flags = user_access_save();
311
312 if (consumed) {
Marco Elver47144ec2020-01-10 19:48:33 +0100313 kcsan_report(ptr, size, type, true, raw_smp_processor_id(),
Marco Elverdfd402a2019-11-14 19:02:54 +0100314 KCSAN_REPORT_CONSUMED_WATCHPOINT);
315 } else {
316 /*
317 * The other thread may not print any diagnostics, as it has
318 * already removed the watchpoint, or another thread consumed
319 * the watchpoint before this thread.
320 */
321 kcsan_counter_inc(KCSAN_COUNTER_REPORT_RACES);
322 }
Marco Elverd591ec32020-02-06 16:46:24 +0100323
324 if ((type & KCSAN_ACCESS_ASSERT) != 0)
325 kcsan_counter_inc(KCSAN_COUNTER_ASSERT_FAILURES);
326 else
327 kcsan_counter_inc(KCSAN_COUNTER_DATA_RACES);
Marco Elverdfd402a2019-11-14 19:02:54 +0100328
329 user_access_restore(flags);
330}
331
Ingo Molnar5cbaefe2019-11-20 10:41:43 +0100332static noinline void
Marco Elver47144ec2020-01-10 19:48:33 +0100333kcsan_setup_watchpoint(const volatile void *ptr, size_t size, int type)
Marco Elverdfd402a2019-11-14 19:02:54 +0100334{
Marco Elver47144ec2020-01-10 19:48:33 +0100335 const bool is_write = (type & KCSAN_ACCESS_WRITE) != 0;
Marco Elverd591ec32020-02-06 16:46:24 +0100336 const bool is_assert = (type & KCSAN_ACCESS_ASSERT) != 0;
Marco Elverdfd402a2019-11-14 19:02:54 +0100337 atomic_long_t *watchpoint;
338 union {
339 u8 _1;
340 u16 _2;
341 u32 _4;
342 u64 _8;
343 } expect_value;
344 bool value_change = false;
345 unsigned long ua_flags = user_access_save();
346 unsigned long irq_flags;
347
348 /*
349 * Always reset kcsan_skip counter in slow-path to avoid underflow; see
350 * should_watch().
351 */
352 reset_kcsan_skip();
353
354 if (!kcsan_is_enabled())
355 goto out;
356
357 if (!check_encodable((unsigned long)ptr, size)) {
358 kcsan_counter_inc(KCSAN_COUNTER_UNENCODABLE_ACCESSES);
359 goto out;
360 }
361
362 /*
363 * Disable interrupts & preemptions to avoid another thread on the same
364 * CPU accessing memory locations for the set up watchpoint; this is to
365 * avoid reporting races to e.g. CPU-local data.
366 *
367 * An alternative would be adding the source CPU to the watchpoint
368 * encoding, and checking that watchpoint-CPU != this-CPU. There are
369 * several problems with this:
370 * 1. we should avoid stealing more bits from the watchpoint encoding
371 * as it would affect accuracy, as well as increase performance
372 * overhead in the fast-path;
373 * 2. if we are preempted, but there *is* a genuine data race, we
374 * would *not* report it -- since this is the common case (vs.
375 * CPU-local data accesses), it makes more sense (from a data race
376 * detection point of view) to simply disable preemptions to ensure
377 * as many tasks as possible run on other CPUs.
Marco Elverf1bc9622020-01-15 17:25:12 +0100378 *
379 * Use raw versions, to avoid lockdep recursion via IRQ flags tracing.
Marco Elverdfd402a2019-11-14 19:02:54 +0100380 */
Marco Elverf1bc9622020-01-15 17:25:12 +0100381 raw_local_irq_save(irq_flags);
Marco Elverdfd402a2019-11-14 19:02:54 +0100382
383 watchpoint = insert_watchpoint((unsigned long)ptr, size, is_write);
384 if (watchpoint == NULL) {
385 /*
Ingo Molnar5cbaefe2019-11-20 10:41:43 +0100386 * Out of capacity: the size of 'watchpoints', and the frequency
387 * with which should_watch() returns true should be tweaked so
Marco Elverdfd402a2019-11-14 19:02:54 +0100388 * that this case happens very rarely.
389 */
390 kcsan_counter_inc(KCSAN_COUNTER_NO_CAPACITY);
391 goto out_unlock;
392 }
393
394 kcsan_counter_inc(KCSAN_COUNTER_SETUP_WATCHPOINTS);
395 kcsan_counter_inc(KCSAN_COUNTER_USED_WATCHPOINTS);
396
397 /*
398 * Read the current value, to later check and infer a race if the data
399 * was modified via a non-instrumented access, e.g. from a device.
400 */
401 switch (size) {
402 case 1:
403 expect_value._1 = READ_ONCE(*(const u8 *)ptr);
404 break;
405 case 2:
406 expect_value._2 = READ_ONCE(*(const u16 *)ptr);
407 break;
408 case 4:
409 expect_value._4 = READ_ONCE(*(const u32 *)ptr);
410 break;
411 case 8:
412 expect_value._8 = READ_ONCE(*(const u64 *)ptr);
413 break;
414 default:
415 break; /* ignore; we do not diff the values */
416 }
417
418 if (IS_ENABLED(CONFIG_KCSAN_DEBUG)) {
419 kcsan_disable_current();
420 pr_err("KCSAN: watching %s, size: %zu, addr: %px [slot: %d, encoded: %lx]\n",
421 is_write ? "write" : "read", size, ptr,
422 watchpoint_slot((unsigned long)ptr),
423 encode_watchpoint((unsigned long)ptr, size, is_write));
424 kcsan_enable_current();
425 }
426
427 /*
428 * Delay this thread, to increase probability of observing a racy
429 * conflicting access.
430 */
431 udelay(get_delay());
432
433 /*
434 * Re-read value, and check if it is as expected; if not, we infer a
435 * racy access.
436 */
437 switch (size) {
438 case 1:
439 value_change = expect_value._1 != READ_ONCE(*(const u8 *)ptr);
440 break;
441 case 2:
442 value_change = expect_value._2 != READ_ONCE(*(const u16 *)ptr);
443 break;
444 case 4:
445 value_change = expect_value._4 != READ_ONCE(*(const u32 *)ptr);
446 break;
447 case 8:
448 value_change = expect_value._8 != READ_ONCE(*(const u64 *)ptr);
449 break;
450 default:
451 break; /* ignore; we do not diff the values */
452 }
453
454 /* Check if this access raced with another. */
455 if (!remove_watchpoint(watchpoint)) {
456 /*
457 * No need to increment 'data_races' counter, as the racing
458 * thread already did.
Marco Elverd591ec32020-02-06 16:46:24 +0100459 *
460 * Count 'assert_failures' for each failed ASSERT access,
461 * therefore both this thread and the racing thread may
462 * increment this counter.
Marco Elverdfd402a2019-11-14 19:02:54 +0100463 */
Marco Elverd591ec32020-02-06 16:46:24 +0100464 if (is_assert)
465 kcsan_counter_inc(KCSAN_COUNTER_ASSERT_FAILURES);
466
467 /*
468 * - If we were not able to observe a value change due to size
469 * constraints, always assume a value change.
470 * - If the access type is an assertion, we also always assume a
471 * value change to always report the race.
472 */
473 value_change = value_change || size > 8 || is_assert;
474
475 kcsan_report(ptr, size, type, value_change, smp_processor_id(),
476 KCSAN_REPORT_RACE_SIGNAL);
Marco Elverdfd402a2019-11-14 19:02:54 +0100477 } else if (value_change) {
478 /* Inferring a race, since the value should not have changed. */
Marco Elverd591ec32020-02-06 16:46:24 +0100479
Marco Elverdfd402a2019-11-14 19:02:54 +0100480 kcsan_counter_inc(KCSAN_COUNTER_RACES_UNKNOWN_ORIGIN);
Marco Elverd591ec32020-02-06 16:46:24 +0100481 if (is_assert)
482 kcsan_counter_inc(KCSAN_COUNTER_ASSERT_FAILURES);
483
484 if (IS_ENABLED(CONFIG_KCSAN_REPORT_RACE_UNKNOWN_ORIGIN) || is_assert)
Marco Elver47144ec2020-01-10 19:48:33 +0100485 kcsan_report(ptr, size, type, true,
Marco Elverdfd402a2019-11-14 19:02:54 +0100486 smp_processor_id(),
487 KCSAN_REPORT_RACE_UNKNOWN_ORIGIN);
488 }
489
490 kcsan_counter_dec(KCSAN_COUNTER_USED_WATCHPOINTS);
491out_unlock:
Marco Elverf1bc9622020-01-15 17:25:12 +0100492 raw_local_irq_restore(irq_flags);
Marco Elverdfd402a2019-11-14 19:02:54 +0100493out:
494 user_access_restore(ua_flags);
495}
496
497static __always_inline void check_access(const volatile void *ptr, size_t size,
498 int type)
499{
500 const bool is_write = (type & KCSAN_ACCESS_WRITE) != 0;
501 atomic_long_t *watchpoint;
502 long encoded_watchpoint;
503
504 /*
Marco Elvered95f952020-02-05 11:14:19 +0100505 * Do nothing for 0 sized check; this comparison will be optimized out
506 * for constant sized instrumentation (__tsan_{read,write}N).
507 */
508 if (unlikely(size == 0))
509 return;
510
511 /*
Marco Elverdfd402a2019-11-14 19:02:54 +0100512 * Avoid user_access_save in fast-path: find_watchpoint is safe without
513 * user_access_save, as the address that ptr points to is only used to
514 * check if a watchpoint exists; ptr is never dereferenced.
515 */
516 watchpoint = find_watchpoint((unsigned long)ptr, size, !is_write,
517 &encoded_watchpoint);
518 /*
519 * It is safe to check kcsan_is_enabled() after find_watchpoint in the
Marco Elverd591ec32020-02-06 16:46:24 +0100520 * slow-path, as long as no state changes that cause a race to be
Marco Elverdfd402a2019-11-14 19:02:54 +0100521 * detected and reported have occurred until kcsan_is_enabled() is
522 * checked.
523 */
524
525 if (unlikely(watchpoint != NULL))
Marco Elver47144ec2020-01-10 19:48:33 +0100526 kcsan_found_watchpoint(ptr, size, type, watchpoint,
Marco Elverdfd402a2019-11-14 19:02:54 +0100527 encoded_watchpoint);
Marco Elver1e6ee2f2020-02-04 18:21:10 +0100528 else if (unlikely(should_watch(ptr, size, type)))
Marco Elver47144ec2020-01-10 19:48:33 +0100529 kcsan_setup_watchpoint(ptr, size, type);
Marco Elverdfd402a2019-11-14 19:02:54 +0100530}
531
532/* === Public interface ===================================================== */
533
534void __init kcsan_init(void)
535{
536 BUG_ON(!in_task());
537
538 kcsan_debugfs_init();
539
540 /*
541 * We are in the init task, and no other tasks should be running;
542 * WRITE_ONCE without memory barrier is sufficient.
543 */
Marco Elver80d4c472020-02-07 19:59:10 +0100544 if (kcsan_early_enable)
Marco Elverdfd402a2019-11-14 19:02:54 +0100545 WRITE_ONCE(kcsan_enabled, true);
546}
547
548/* === Exported interface =================================================== */
549
550void kcsan_disable_current(void)
551{
552 ++get_ctx()->disable_count;
553}
554EXPORT_SYMBOL(kcsan_disable_current);
555
556void kcsan_enable_current(void)
557{
558 if (get_ctx()->disable_count-- == 0) {
559 /*
560 * Warn if kcsan_enable_current() calls are unbalanced with
561 * kcsan_disable_current() calls, which causes disable_count to
562 * become negative and should not happen.
563 */
564 kcsan_disable_current(); /* restore to 0, KCSAN still enabled */
565 kcsan_disable_current(); /* disable to generate warning */
566 WARN(1, "Unbalanced %s()", __func__);
567 kcsan_enable_current();
568 }
569}
570EXPORT_SYMBOL(kcsan_enable_current);
571
572void kcsan_nestable_atomic_begin(void)
573{
574 /*
575 * Do *not* check and warn if we are in a flat atomic region: nestable
576 * and flat atomic regions are independent from each other.
577 * See include/linux/kcsan.h: struct kcsan_ctx comments for more
578 * comments.
579 */
580
581 ++get_ctx()->atomic_nest_count;
582}
583EXPORT_SYMBOL(kcsan_nestable_atomic_begin);
584
585void kcsan_nestable_atomic_end(void)
586{
587 if (get_ctx()->atomic_nest_count-- == 0) {
588 /*
589 * Warn if kcsan_nestable_atomic_end() calls are unbalanced with
590 * kcsan_nestable_atomic_begin() calls, which causes
591 * atomic_nest_count to become negative and should not happen.
592 */
593 kcsan_nestable_atomic_begin(); /* restore to 0 */
594 kcsan_disable_current(); /* disable to generate warning */
595 WARN(1, "Unbalanced %s()", __func__);
596 kcsan_enable_current();
597 }
598}
599EXPORT_SYMBOL(kcsan_nestable_atomic_end);
600
601void kcsan_flat_atomic_begin(void)
602{
603 get_ctx()->in_flat_atomic = true;
604}
605EXPORT_SYMBOL(kcsan_flat_atomic_begin);
606
607void kcsan_flat_atomic_end(void)
608{
609 get_ctx()->in_flat_atomic = false;
610}
611EXPORT_SYMBOL(kcsan_flat_atomic_end);
612
613void kcsan_atomic_next(int n)
614{
615 get_ctx()->atomic_next = n;
616}
617EXPORT_SYMBOL(kcsan_atomic_next);
618
619void __kcsan_check_access(const volatile void *ptr, size_t size, int type)
620{
621 check_access(ptr, size, type);
622}
623EXPORT_SYMBOL(__kcsan_check_access);
624
625/*
626 * KCSAN uses the same instrumentation that is emitted by supported compilers
627 * for ThreadSanitizer (TSAN).
628 *
629 * When enabled, the compiler emits instrumentation calls (the functions
630 * prefixed with "__tsan" below) for all loads and stores that it generated;
631 * inline asm is not instrumented.
632 *
633 * Note that, not all supported compiler versions distinguish aligned/unaligned
634 * accesses, but e.g. recent versions of Clang do. We simply alias the unaligned
635 * version to the generic version, which can handle both.
636 */
637
638#define DEFINE_TSAN_READ_WRITE(size) \
639 void __tsan_read##size(void *ptr) \
640 { \
641 check_access(ptr, size, 0); \
642 } \
643 EXPORT_SYMBOL(__tsan_read##size); \
644 void __tsan_unaligned_read##size(void *ptr) \
645 __alias(__tsan_read##size); \
646 EXPORT_SYMBOL(__tsan_unaligned_read##size); \
647 void __tsan_write##size(void *ptr) \
648 { \
649 check_access(ptr, size, KCSAN_ACCESS_WRITE); \
650 } \
651 EXPORT_SYMBOL(__tsan_write##size); \
652 void __tsan_unaligned_write##size(void *ptr) \
653 __alias(__tsan_write##size); \
654 EXPORT_SYMBOL(__tsan_unaligned_write##size)
655
656DEFINE_TSAN_READ_WRITE(1);
657DEFINE_TSAN_READ_WRITE(2);
658DEFINE_TSAN_READ_WRITE(4);
659DEFINE_TSAN_READ_WRITE(8);
660DEFINE_TSAN_READ_WRITE(16);
661
662void __tsan_read_range(void *ptr, size_t size)
663{
664 check_access(ptr, size, 0);
665}
666EXPORT_SYMBOL(__tsan_read_range);
667
668void __tsan_write_range(void *ptr, size_t size)
669{
670 check_access(ptr, size, KCSAN_ACCESS_WRITE);
671}
672EXPORT_SYMBOL(__tsan_write_range);
673
674/*
675 * The below are not required by KCSAN, but can still be emitted by the
676 * compiler.
677 */
678void __tsan_func_entry(void *call_pc)
679{
680}
681EXPORT_SYMBOL(__tsan_func_entry);
682void __tsan_func_exit(void)
683{
684}
685EXPORT_SYMBOL(__tsan_func_exit);
686void __tsan_init(void)
687{
688}
689EXPORT_SYMBOL(__tsan_init);