0001
0002
0003
0004
0005
0006
0007
0008
0009
0010
0011
0012
0013
0014
0015
0016 #define pr_fmt(fmt) "kcsan_test: " fmt
0017
0018 #include <kunit/test.h>
0019 #include <linux/atomic.h>
0020 #include <linux/bitops.h>
0021 #include <linux/jiffies.h>
0022 #include <linux/kcsan-checks.h>
0023 #include <linux/kernel.h>
0024 #include <linux/mutex.h>
0025 #include <linux/sched.h>
0026 #include <linux/seqlock.h>
0027 #include <linux/spinlock.h>
0028 #include <linux/string.h>
0029 #include <linux/timer.h>
0030 #include <linux/torture.h>
0031 #include <linux/tracepoint.h>
0032 #include <linux/types.h>
0033 #include <trace/events/printk.h>
0034
0035 #define KCSAN_TEST_REQUIRES(test, cond) do { \
0036 if (!(cond)) \
0037 kunit_skip((test), "Test requires: " #cond); \
0038 } while (0)
0039
0040 #ifdef CONFIG_CC_HAS_TSAN_COMPOUND_READ_BEFORE_WRITE
0041 #define __KCSAN_ACCESS_RW(alt) (KCSAN_ACCESS_COMPOUND | KCSAN_ACCESS_WRITE)
0042 #else
0043 #define __KCSAN_ACCESS_RW(alt) (alt)
0044 #endif
0045
0046
0047 static void (*access_kernels[2])(void);
0048
0049 static struct task_struct **threads;
0050 static unsigned long end_time;
0051
0052
0053 static struct {
0054 spinlock_t lock;
0055 int nlines;
0056 char lines[3][512];
0057 } observed = {
0058 .lock = __SPIN_LOCK_UNLOCKED(observed.lock),
0059 };
0060
0061
0062 static __no_kcsan inline void
0063 begin_test_checks(void (*func1)(void), void (*func2)(void))
0064 {
0065 kcsan_disable_current();
0066
0067
0068
0069
0070
0071 end_time = jiffies + msecs_to_jiffies(CONFIG_KCSAN_REPORT_ONCE_IN_MS + 500);
0072
0073
0074 smp_store_release(&access_kernels[0], func1);
0075 smp_store_release(&access_kernels[1], func2);
0076 }
0077
0078
0079 static __no_kcsan inline bool
0080 end_test_checks(bool stop)
0081 {
0082 if (!stop && time_before(jiffies, end_time)) {
0083
0084 might_sleep();
0085 return false;
0086 }
0087
0088 kcsan_enable_current();
0089 return true;
0090 }
0091
0092
0093
0094
0095
0096 __no_kcsan
0097 static void probe_console(void *ignore, const char *buf, size_t len)
0098 {
0099 unsigned long flags;
0100 int nlines;
0101
0102
0103
0104
0105
0106
0107
0108 spin_lock_irqsave(&observed.lock, flags);
0109 nlines = observed.nlines;
0110
0111 if (strnstr(buf, "BUG: KCSAN: ", len) && strnstr(buf, "test_", len)) {
0112
0113
0114
0115
0116
0117
0118 strscpy(observed.lines[0], buf, min(len + 1, sizeof(observed.lines[0])));
0119 nlines = 1;
0120 } else if ((nlines == 1 || nlines == 2) && strnstr(buf, "bytes by", len)) {
0121 strscpy(observed.lines[nlines++], buf, min(len + 1, sizeof(observed.lines[0])));
0122
0123 if (strnstr(buf, "race at unknown origin", len)) {
0124 if (WARN_ON(nlines != 2))
0125 goto out;
0126
0127
0128 strcpy(observed.lines[nlines++], "<none>");
0129 }
0130 }
0131
0132 out:
0133 WRITE_ONCE(observed.nlines, nlines);
0134 spin_unlock_irqrestore(&observed.lock, flags);
0135 }
0136
0137
0138 __no_kcsan
0139 static bool report_available(void)
0140 {
0141 return READ_ONCE(observed.nlines) == ARRAY_SIZE(observed.lines);
0142 }
0143
0144
0145 struct expect_report {
0146
0147 struct {
0148 void *fn;
0149 void *addr;
0150 size_t size;
0151 int type;
0152 } access[2];
0153 };
0154
0155
0156 __no_kcsan
0157 static bool __report_matches(const struct expect_report *r)
0158 {
0159 const bool is_assert = (r->access[0].type | r->access[1].type) & KCSAN_ACCESS_ASSERT;
0160 bool ret = false;
0161 unsigned long flags;
0162 typeof(observed.lines) expect;
0163 const char *end;
0164 char *cur;
0165 int i;
0166
0167
0168 if (!report_available())
0169 return false;
0170
0171
0172
0173
0174 cur = expect[0];
0175 end = &expect[0][sizeof(expect[0]) - 1];
0176 cur += scnprintf(cur, end - cur, "BUG: KCSAN: %s in ",
0177 is_assert ? "assert: race" : "data-race");
0178 if (r->access[1].fn) {
0179 char tmp[2][64];
0180 int cmp;
0181
0182
0183 scnprintf(tmp[0], sizeof(tmp[0]), "%pS", r->access[0].fn);
0184 scnprintf(tmp[1], sizeof(tmp[1]), "%pS", r->access[1].fn);
0185 cmp = strcmp(tmp[0], tmp[1]);
0186 cur += scnprintf(cur, end - cur, "%ps / %ps",
0187 cmp < 0 ? r->access[0].fn : r->access[1].fn,
0188 cmp < 0 ? r->access[1].fn : r->access[0].fn);
0189 } else {
0190 scnprintf(cur, end - cur, "%pS", r->access[0].fn);
0191
0192 cur = strchr(expect[0], '+');
0193 if (cur)
0194 *cur = '\0';
0195 }
0196
0197
0198 cur = expect[1];
0199 end = &expect[1][sizeof(expect[1]) - 1];
0200 if (!r->access[1].fn)
0201 cur += scnprintf(cur, end - cur, "race at unknown origin, with ");
0202
0203
0204 for (i = 0; i < 2; ++i) {
0205 const int ty = r->access[i].type;
0206 const char *const access_type =
0207 (ty & KCSAN_ACCESS_ASSERT) ?
0208 ((ty & KCSAN_ACCESS_WRITE) ?
0209 "assert no accesses" :
0210 "assert no writes") :
0211 ((ty & KCSAN_ACCESS_WRITE) ?
0212 ((ty & KCSAN_ACCESS_COMPOUND) ?
0213 "read-write" :
0214 "write") :
0215 "read");
0216 const bool is_atomic = (ty & KCSAN_ACCESS_ATOMIC);
0217 const bool is_scoped = (ty & KCSAN_ACCESS_SCOPED);
0218 const char *const access_type_aux =
0219 (is_atomic && is_scoped) ? " (marked, reordered)"
0220 : (is_atomic ? " (marked)"
0221 : (is_scoped ? " (reordered)" : ""));
0222
0223 if (i == 1) {
0224
0225 cur = expect[2];
0226 end = &expect[2][sizeof(expect[2]) - 1];
0227
0228 if (!r->access[1].fn) {
0229
0230 strcpy(cur, "<none>");
0231 break;
0232 }
0233 }
0234
0235 cur += scnprintf(cur, end - cur, "%s%s to ", access_type,
0236 access_type_aux);
0237
0238 if (r->access[i].addr)
0239 cur += scnprintf(cur, end - cur, "0x%px of %zu bytes",
0240 r->access[i].addr, r->access[i].size);
0241 }
0242
0243 spin_lock_irqsave(&observed.lock, flags);
0244 if (!report_available())
0245 goto out;
0246
0247
0248 ret = strstr(observed.lines[0], expect[0]) &&
0249
0250 ((strstr(observed.lines[1], expect[1]) &&
0251 strstr(observed.lines[2], expect[2])) ||
0252 (strstr(observed.lines[1], expect[2]) &&
0253 strstr(observed.lines[2], expect[1])));
0254 out:
0255 spin_unlock_irqrestore(&observed.lock, flags);
0256 return ret;
0257 }
0258
0259 static __always_inline const struct expect_report *
0260 __report_set_scoped(struct expect_report *r, int accesses)
0261 {
0262 BUILD_BUG_ON(accesses > 3);
0263
0264 if (accesses & 1)
0265 r->access[0].type |= KCSAN_ACCESS_SCOPED;
0266 else
0267 r->access[0].type &= ~KCSAN_ACCESS_SCOPED;
0268
0269 if (accesses & 2)
0270 r->access[1].type |= KCSAN_ACCESS_SCOPED;
0271 else
0272 r->access[1].type &= ~KCSAN_ACCESS_SCOPED;
0273
0274 return r;
0275 }
0276
0277 __no_kcsan
0278 static bool report_matches_any_reordered(struct expect_report *r)
0279 {
0280 return __report_matches(__report_set_scoped(r, 0)) ||
0281 __report_matches(__report_set_scoped(r, 1)) ||
0282 __report_matches(__report_set_scoped(r, 2)) ||
0283 __report_matches(__report_set_scoped(r, 3));
0284 }
0285
0286 #ifdef CONFIG_KCSAN_WEAK_MEMORY
0287
0288 #define report_matches report_matches_any_reordered
0289 #else
0290 #define report_matches __report_matches
0291 #endif
0292
0293
0294
0295 static long test_sink;
0296 static long test_var;
0297
0298 static long test_array[3 * PAGE_SIZE / sizeof(long)];
0299 static struct {
0300 long val[8];
0301 } test_struct;
0302 static DEFINE_SEQLOCK(test_seqlock);
0303 static DEFINE_SPINLOCK(test_spinlock);
0304 static DEFINE_MUTEX(test_mutex);
0305
0306
0307
0308
0309
0310 __no_kcsan
0311 static noinline void sink_value(long v) { WRITE_ONCE(test_sink, v); }
0312
0313
0314
0315
0316
0317 static noinline void test_delay(int iter)
0318 {
0319 while (iter--)
0320 sink_value(READ_ONCE(test_sink));
0321 }
0322
0323 static noinline void test_kernel_read(void) { sink_value(test_var); }
0324
0325 static noinline void test_kernel_write(void)
0326 {
0327 test_var = READ_ONCE_NOCHECK(test_sink) + 1;
0328 }
0329
0330 static noinline void test_kernel_write_nochange(void) { test_var = 42; }
0331
0332
0333 static noinline void test_kernel_write_nochange_rcu(void) { test_var = 42; }
0334
0335 static noinline void test_kernel_read_atomic(void)
0336 {
0337 sink_value(READ_ONCE(test_var));
0338 }
0339
0340 static noinline void test_kernel_write_atomic(void)
0341 {
0342 WRITE_ONCE(test_var, READ_ONCE_NOCHECK(test_sink) + 1);
0343 }
0344
0345 static noinline void test_kernel_atomic_rmw(void)
0346 {
0347
0348 __atomic_fetch_add(&test_var, 1, __ATOMIC_RELAXED);
0349 }
0350
0351 __no_kcsan
0352 static noinline void test_kernel_write_uninstrumented(void) { test_var++; }
0353
0354 static noinline void test_kernel_data_race(void) { data_race(test_var++); }
0355
0356 static noinline void test_kernel_assert_writer(void)
0357 {
0358 ASSERT_EXCLUSIVE_WRITER(test_var);
0359 }
0360
0361 static noinline void test_kernel_assert_access(void)
0362 {
0363 ASSERT_EXCLUSIVE_ACCESS(test_var);
0364 }
0365
0366 #define TEST_CHANGE_BITS 0xff00ff00
0367
0368 static noinline void test_kernel_change_bits(void)
0369 {
0370 if (IS_ENABLED(CONFIG_KCSAN_IGNORE_ATOMICS)) {
0371
0372
0373
0374
0375 kcsan_nestable_atomic_begin();
0376 test_var ^= TEST_CHANGE_BITS;
0377 kcsan_nestable_atomic_end();
0378 } else
0379 WRITE_ONCE(test_var, READ_ONCE(test_var) ^ TEST_CHANGE_BITS);
0380 }
0381
0382 static noinline void test_kernel_assert_bits_change(void)
0383 {
0384 ASSERT_EXCLUSIVE_BITS(test_var, TEST_CHANGE_BITS);
0385 }
0386
0387 static noinline void test_kernel_assert_bits_nochange(void)
0388 {
0389 ASSERT_EXCLUSIVE_BITS(test_var, ~TEST_CHANGE_BITS);
0390 }
0391
0392
0393
0394
0395
0396 static noinline void test_enter_scope(void)
0397 {
0398 int x = 0;
0399
0400
0401 READ_ONCE(test_sink);
0402 kcsan_check_read(&x, sizeof(x));
0403 }
0404
0405 static noinline void test_kernel_assert_writer_scoped(void)
0406 {
0407 ASSERT_EXCLUSIVE_WRITER_SCOPED(test_var);
0408 test_enter_scope();
0409 }
0410
0411 static noinline void test_kernel_assert_access_scoped(void)
0412 {
0413 ASSERT_EXCLUSIVE_ACCESS_SCOPED(test_var);
0414 test_enter_scope();
0415 }
0416
0417 static noinline void test_kernel_rmw_array(void)
0418 {
0419 int i;
0420
0421 for (i = 0; i < ARRAY_SIZE(test_array); ++i)
0422 test_array[i]++;
0423 }
0424
0425 static noinline void test_kernel_write_struct(void)
0426 {
0427 kcsan_check_write(&test_struct, sizeof(test_struct));
0428 kcsan_disable_current();
0429 test_struct.val[3]++;
0430 kcsan_enable_current();
0431 }
0432
0433 static noinline void test_kernel_write_struct_part(void)
0434 {
0435 test_struct.val[3] = 42;
0436 }
0437
0438 static noinline void test_kernel_read_struct_zero_size(void)
0439 {
0440 kcsan_check_read(&test_struct.val[3], 0);
0441 }
0442
0443 static noinline void test_kernel_jiffies_reader(void)
0444 {
0445 sink_value((long)jiffies);
0446 }
0447
0448 static noinline void test_kernel_seqlock_reader(void)
0449 {
0450 unsigned int seq;
0451
0452 do {
0453 seq = read_seqbegin(&test_seqlock);
0454 sink_value(test_var);
0455 } while (read_seqretry(&test_seqlock, seq));
0456 }
0457
0458 static noinline void test_kernel_seqlock_writer(void)
0459 {
0460 unsigned long flags;
0461
0462 write_seqlock_irqsave(&test_seqlock, flags);
0463 test_var++;
0464 write_sequnlock_irqrestore(&test_seqlock, flags);
0465 }
0466
0467 static noinline void test_kernel_atomic_builtins(void)
0468 {
0469
0470
0471
0472
0473 __atomic_load_n(&test_var, __ATOMIC_RELAXED);
0474 }
0475
0476 static noinline void test_kernel_xor_1bit(void)
0477 {
0478
0479 kcsan_nestable_atomic_begin();
0480 test_var ^= 0x10000;
0481 kcsan_nestable_atomic_end();
0482 }
0483
0484 #define TEST_KERNEL_LOCKED(name, acquire, release) \
0485 static noinline void test_kernel_##name(void) \
0486 { \
0487 long *flag = &test_struct.val[0]; \
0488 long v = 0; \
0489 if (!(acquire)) \
0490 return; \
0491 while (v++ < 100) { \
0492 test_var++; \
0493 barrier(); \
0494 } \
0495 release; \
0496 test_delay(10); \
0497 }
0498
0499 TEST_KERNEL_LOCKED(with_memorder,
0500 cmpxchg_acquire(flag, 0, 1) == 0,
0501 smp_store_release(flag, 0));
0502 TEST_KERNEL_LOCKED(wrong_memorder,
0503 cmpxchg_relaxed(flag, 0, 1) == 0,
0504 WRITE_ONCE(*flag, 0));
0505 TEST_KERNEL_LOCKED(atomic_builtin_with_memorder,
0506 __atomic_compare_exchange_n(flag, &v, 1, 0, __ATOMIC_ACQUIRE, __ATOMIC_RELAXED),
0507 __atomic_store_n(flag, 0, __ATOMIC_RELEASE));
0508 TEST_KERNEL_LOCKED(atomic_builtin_wrong_memorder,
0509 __atomic_compare_exchange_n(flag, &v, 1, 0, __ATOMIC_RELAXED, __ATOMIC_RELAXED),
0510 __atomic_store_n(flag, 0, __ATOMIC_RELAXED));
0511
0512
0513
0514
0515
0516
0517
0518
0519
0520 static void test_barrier_nothreads(struct kunit *test)
0521 {
0522 #ifdef CONFIG_KCSAN_WEAK_MEMORY
0523 struct kcsan_scoped_access *reorder_access = ¤t->kcsan_ctx.reorder_access;
0524 #else
0525 struct kcsan_scoped_access *reorder_access = NULL;
0526 #endif
0527 arch_spinlock_t arch_spinlock = __ARCH_SPIN_LOCK_UNLOCKED;
0528 atomic_t dummy;
0529
0530 KCSAN_TEST_REQUIRES(test, reorder_access != NULL);
0531 KCSAN_TEST_REQUIRES(test, IS_ENABLED(CONFIG_SMP));
0532
0533 #define __KCSAN_EXPECT_BARRIER(access_type, barrier, order_before, name) \
0534 do { \
0535 reorder_access->type = (access_type) | KCSAN_ACCESS_SCOPED; \
0536 reorder_access->size = sizeof(test_var); \
0537 barrier; \
0538 KUNIT_EXPECT_EQ_MSG(test, reorder_access->size, \
0539 order_before ? 0 : sizeof(test_var), \
0540 "improperly instrumented type=(" #access_type "): " name); \
0541 } while (0)
0542 #define KCSAN_EXPECT_READ_BARRIER(b, o) __KCSAN_EXPECT_BARRIER(0, b, o, #b)
0543 #define KCSAN_EXPECT_WRITE_BARRIER(b, o) __KCSAN_EXPECT_BARRIER(KCSAN_ACCESS_WRITE, b, o, #b)
0544 #define KCSAN_EXPECT_RW_BARRIER(b, o) __KCSAN_EXPECT_BARRIER(KCSAN_ACCESS_COMPOUND | KCSAN_ACCESS_WRITE, b, o, #b)
0545
0546
0547
0548
0549
0550 spin_lock(&test_spinlock);
0551 spin_unlock(&test_spinlock);
0552 mutex_lock(&test_mutex);
0553 mutex_unlock(&test_mutex);
0554
0555
0556 test_var = 0;
0557 while (test_var++ < 1000000 && reorder_access->size != sizeof(test_var))
0558 __kcsan_check_read(&test_var, sizeof(test_var));
0559 KUNIT_ASSERT_EQ(test, reorder_access->size, sizeof(test_var));
0560
0561 kcsan_nestable_atomic_begin();
0562
0563 KCSAN_EXPECT_READ_BARRIER(mb(), true);
0564 KCSAN_EXPECT_READ_BARRIER(wmb(), false);
0565 KCSAN_EXPECT_READ_BARRIER(rmb(), true);
0566 KCSAN_EXPECT_READ_BARRIER(smp_mb(), true);
0567 KCSAN_EXPECT_READ_BARRIER(smp_wmb(), false);
0568 KCSAN_EXPECT_READ_BARRIER(smp_rmb(), true);
0569 KCSAN_EXPECT_READ_BARRIER(dma_wmb(), false);
0570 KCSAN_EXPECT_READ_BARRIER(dma_rmb(), true);
0571 KCSAN_EXPECT_READ_BARRIER(smp_mb__before_atomic(), true);
0572 KCSAN_EXPECT_READ_BARRIER(smp_mb__after_atomic(), true);
0573 KCSAN_EXPECT_READ_BARRIER(smp_mb__after_spinlock(), true);
0574 KCSAN_EXPECT_READ_BARRIER(smp_store_mb(test_var, 0), true);
0575 KCSAN_EXPECT_READ_BARRIER(smp_load_acquire(&test_var), false);
0576 KCSAN_EXPECT_READ_BARRIER(smp_store_release(&test_var, 0), true);
0577 KCSAN_EXPECT_READ_BARRIER(xchg(&test_var, 0), true);
0578 KCSAN_EXPECT_READ_BARRIER(xchg_release(&test_var, 0), true);
0579 KCSAN_EXPECT_READ_BARRIER(xchg_relaxed(&test_var, 0), false);
0580 KCSAN_EXPECT_READ_BARRIER(cmpxchg(&test_var, 0, 0), true);
0581 KCSAN_EXPECT_READ_BARRIER(cmpxchg_release(&test_var, 0, 0), true);
0582 KCSAN_EXPECT_READ_BARRIER(cmpxchg_relaxed(&test_var, 0, 0), false);
0583 KCSAN_EXPECT_READ_BARRIER(atomic_read(&dummy), false);
0584 KCSAN_EXPECT_READ_BARRIER(atomic_read_acquire(&dummy), false);
0585 KCSAN_EXPECT_READ_BARRIER(atomic_set(&dummy, 0), false);
0586 KCSAN_EXPECT_READ_BARRIER(atomic_set_release(&dummy, 0), true);
0587 KCSAN_EXPECT_READ_BARRIER(atomic_add(1, &dummy), false);
0588 KCSAN_EXPECT_READ_BARRIER(atomic_add_return(1, &dummy), true);
0589 KCSAN_EXPECT_READ_BARRIER(atomic_add_return_acquire(1, &dummy), false);
0590 KCSAN_EXPECT_READ_BARRIER(atomic_add_return_release(1, &dummy), true);
0591 KCSAN_EXPECT_READ_BARRIER(atomic_add_return_relaxed(1, &dummy), false);
0592 KCSAN_EXPECT_READ_BARRIER(atomic_fetch_add(1, &dummy), true);
0593 KCSAN_EXPECT_READ_BARRIER(atomic_fetch_add_acquire(1, &dummy), false);
0594 KCSAN_EXPECT_READ_BARRIER(atomic_fetch_add_release(1, &dummy), true);
0595 KCSAN_EXPECT_READ_BARRIER(atomic_fetch_add_relaxed(1, &dummy), false);
0596 KCSAN_EXPECT_READ_BARRIER(test_and_set_bit(0, &test_var), true);
0597 KCSAN_EXPECT_READ_BARRIER(test_and_clear_bit(0, &test_var), true);
0598 KCSAN_EXPECT_READ_BARRIER(test_and_change_bit(0, &test_var), true);
0599 KCSAN_EXPECT_READ_BARRIER(clear_bit_unlock(0, &test_var), true);
0600 KCSAN_EXPECT_READ_BARRIER(__clear_bit_unlock(0, &test_var), true);
0601 KCSAN_EXPECT_READ_BARRIER(arch_spin_lock(&arch_spinlock), false);
0602 KCSAN_EXPECT_READ_BARRIER(arch_spin_unlock(&arch_spinlock), true);
0603 KCSAN_EXPECT_READ_BARRIER(spin_lock(&test_spinlock), false);
0604 KCSAN_EXPECT_READ_BARRIER(spin_unlock(&test_spinlock), true);
0605 KCSAN_EXPECT_READ_BARRIER(mutex_lock(&test_mutex), false);
0606 KCSAN_EXPECT_READ_BARRIER(mutex_unlock(&test_mutex), true);
0607
0608 KCSAN_EXPECT_WRITE_BARRIER(mb(), true);
0609 KCSAN_EXPECT_WRITE_BARRIER(wmb(), true);
0610 KCSAN_EXPECT_WRITE_BARRIER(rmb(), false);
0611 KCSAN_EXPECT_WRITE_BARRIER(smp_mb(), true);
0612 KCSAN_EXPECT_WRITE_BARRIER(smp_wmb(), true);
0613 KCSAN_EXPECT_WRITE_BARRIER(smp_rmb(), false);
0614 KCSAN_EXPECT_WRITE_BARRIER(dma_wmb(), true);
0615 KCSAN_EXPECT_WRITE_BARRIER(dma_rmb(), false);
0616 KCSAN_EXPECT_WRITE_BARRIER(smp_mb__before_atomic(), true);
0617 KCSAN_EXPECT_WRITE_BARRIER(smp_mb__after_atomic(), true);
0618 KCSAN_EXPECT_WRITE_BARRIER(smp_mb__after_spinlock(), true);
0619 KCSAN_EXPECT_WRITE_BARRIER(smp_store_mb(test_var, 0), true);
0620 KCSAN_EXPECT_WRITE_BARRIER(smp_load_acquire(&test_var), false);
0621 KCSAN_EXPECT_WRITE_BARRIER(smp_store_release(&test_var, 0), true);
0622 KCSAN_EXPECT_WRITE_BARRIER(xchg(&test_var, 0), true);
0623 KCSAN_EXPECT_WRITE_BARRIER(xchg_release(&test_var, 0), true);
0624 KCSAN_EXPECT_WRITE_BARRIER(xchg_relaxed(&test_var, 0), false);
0625 KCSAN_EXPECT_WRITE_BARRIER(cmpxchg(&test_var, 0, 0), true);
0626 KCSAN_EXPECT_WRITE_BARRIER(cmpxchg_release(&test_var, 0, 0), true);
0627 KCSAN_EXPECT_WRITE_BARRIER(cmpxchg_relaxed(&test_var, 0, 0), false);
0628 KCSAN_EXPECT_WRITE_BARRIER(atomic_read(&dummy), false);
0629 KCSAN_EXPECT_WRITE_BARRIER(atomic_read_acquire(&dummy), false);
0630 KCSAN_EXPECT_WRITE_BARRIER(atomic_set(&dummy, 0), false);
0631 KCSAN_EXPECT_WRITE_BARRIER(atomic_set_release(&dummy, 0), true);
0632 KCSAN_EXPECT_WRITE_BARRIER(atomic_add(1, &dummy), false);
0633 KCSAN_EXPECT_WRITE_BARRIER(atomic_add_return(1, &dummy), true);
0634 KCSAN_EXPECT_WRITE_BARRIER(atomic_add_return_acquire(1, &dummy), false);
0635 KCSAN_EXPECT_WRITE_BARRIER(atomic_add_return_release(1, &dummy), true);
0636 KCSAN_EXPECT_WRITE_BARRIER(atomic_add_return_relaxed(1, &dummy), false);
0637 KCSAN_EXPECT_WRITE_BARRIER(atomic_fetch_add(1, &dummy), true);
0638 KCSAN_EXPECT_WRITE_BARRIER(atomic_fetch_add_acquire(1, &dummy), false);
0639 KCSAN_EXPECT_WRITE_BARRIER(atomic_fetch_add_release(1, &dummy), true);
0640 KCSAN_EXPECT_WRITE_BARRIER(atomic_fetch_add_relaxed(1, &dummy), false);
0641 KCSAN_EXPECT_WRITE_BARRIER(test_and_set_bit(0, &test_var), true);
0642 KCSAN_EXPECT_WRITE_BARRIER(test_and_clear_bit(0, &test_var), true);
0643 KCSAN_EXPECT_WRITE_BARRIER(test_and_change_bit(0, &test_var), true);
0644 KCSAN_EXPECT_WRITE_BARRIER(clear_bit_unlock(0, &test_var), true);
0645 KCSAN_EXPECT_WRITE_BARRIER(__clear_bit_unlock(0, &test_var), true);
0646 KCSAN_EXPECT_WRITE_BARRIER(arch_spin_lock(&arch_spinlock), false);
0647 KCSAN_EXPECT_WRITE_BARRIER(arch_spin_unlock(&arch_spinlock), true);
0648 KCSAN_EXPECT_WRITE_BARRIER(spin_lock(&test_spinlock), false);
0649 KCSAN_EXPECT_WRITE_BARRIER(spin_unlock(&test_spinlock), true);
0650 KCSAN_EXPECT_WRITE_BARRIER(mutex_lock(&test_mutex), false);
0651 KCSAN_EXPECT_WRITE_BARRIER(mutex_unlock(&test_mutex), true);
0652
0653 KCSAN_EXPECT_RW_BARRIER(mb(), true);
0654 KCSAN_EXPECT_RW_BARRIER(wmb(), true);
0655 KCSAN_EXPECT_RW_BARRIER(rmb(), true);
0656 KCSAN_EXPECT_RW_BARRIER(smp_mb(), true);
0657 KCSAN_EXPECT_RW_BARRIER(smp_wmb(), true);
0658 KCSAN_EXPECT_RW_BARRIER(smp_rmb(), true);
0659 KCSAN_EXPECT_RW_BARRIER(dma_wmb(), true);
0660 KCSAN_EXPECT_RW_BARRIER(dma_rmb(), true);
0661 KCSAN_EXPECT_RW_BARRIER(smp_mb__before_atomic(), true);
0662 KCSAN_EXPECT_RW_BARRIER(smp_mb__after_atomic(), true);
0663 KCSAN_EXPECT_RW_BARRIER(smp_mb__after_spinlock(), true);
0664 KCSAN_EXPECT_RW_BARRIER(smp_store_mb(test_var, 0), true);
0665 KCSAN_EXPECT_RW_BARRIER(smp_load_acquire(&test_var), false);
0666 KCSAN_EXPECT_RW_BARRIER(smp_store_release(&test_var, 0), true);
0667 KCSAN_EXPECT_RW_BARRIER(xchg(&test_var, 0), true);
0668 KCSAN_EXPECT_RW_BARRIER(xchg_release(&test_var, 0), true);
0669 KCSAN_EXPECT_RW_BARRIER(xchg_relaxed(&test_var, 0), false);
0670 KCSAN_EXPECT_RW_BARRIER(cmpxchg(&test_var, 0, 0), true);
0671 KCSAN_EXPECT_RW_BARRIER(cmpxchg_release(&test_var, 0, 0), true);
0672 KCSAN_EXPECT_RW_BARRIER(cmpxchg_relaxed(&test_var, 0, 0), false);
0673 KCSAN_EXPECT_RW_BARRIER(atomic_read(&dummy), false);
0674 KCSAN_EXPECT_RW_BARRIER(atomic_read_acquire(&dummy), false);
0675 KCSAN_EXPECT_RW_BARRIER(atomic_set(&dummy, 0), false);
0676 KCSAN_EXPECT_RW_BARRIER(atomic_set_release(&dummy, 0), true);
0677 KCSAN_EXPECT_RW_BARRIER(atomic_add(1, &dummy), false);
0678 KCSAN_EXPECT_RW_BARRIER(atomic_add_return(1, &dummy), true);
0679 KCSAN_EXPECT_RW_BARRIER(atomic_add_return_acquire(1, &dummy), false);
0680 KCSAN_EXPECT_RW_BARRIER(atomic_add_return_release(1, &dummy), true);
0681 KCSAN_EXPECT_RW_BARRIER(atomic_add_return_relaxed(1, &dummy), false);
0682 KCSAN_EXPECT_RW_BARRIER(atomic_fetch_add(1, &dummy), true);
0683 KCSAN_EXPECT_RW_BARRIER(atomic_fetch_add_acquire(1, &dummy), false);
0684 KCSAN_EXPECT_RW_BARRIER(atomic_fetch_add_release(1, &dummy), true);
0685 KCSAN_EXPECT_RW_BARRIER(atomic_fetch_add_relaxed(1, &dummy), false);
0686 KCSAN_EXPECT_RW_BARRIER(test_and_set_bit(0, &test_var), true);
0687 KCSAN_EXPECT_RW_BARRIER(test_and_clear_bit(0, &test_var), true);
0688 KCSAN_EXPECT_RW_BARRIER(test_and_change_bit(0, &test_var), true);
0689 KCSAN_EXPECT_RW_BARRIER(clear_bit_unlock(0, &test_var), true);
0690 KCSAN_EXPECT_RW_BARRIER(__clear_bit_unlock(0, &test_var), true);
0691 KCSAN_EXPECT_RW_BARRIER(arch_spin_lock(&arch_spinlock), false);
0692 KCSAN_EXPECT_RW_BARRIER(arch_spin_unlock(&arch_spinlock), true);
0693 KCSAN_EXPECT_RW_BARRIER(spin_lock(&test_spinlock), false);
0694 KCSAN_EXPECT_RW_BARRIER(spin_unlock(&test_spinlock), true);
0695 KCSAN_EXPECT_RW_BARRIER(mutex_lock(&test_mutex), false);
0696 KCSAN_EXPECT_RW_BARRIER(mutex_unlock(&test_mutex), true);
0697
0698 #ifdef clear_bit_unlock_is_negative_byte
0699 KCSAN_EXPECT_READ_BARRIER(clear_bit_unlock_is_negative_byte(0, &test_var), true);
0700 KCSAN_EXPECT_WRITE_BARRIER(clear_bit_unlock_is_negative_byte(0, &test_var), true);
0701 KCSAN_EXPECT_RW_BARRIER(clear_bit_unlock_is_negative_byte(0, &test_var), true);
0702 #endif
0703 kcsan_nestable_atomic_end();
0704 }
0705
0706
0707 __no_kcsan
0708 static void test_basic(struct kunit *test)
0709 {
0710 struct expect_report expect = {
0711 .access = {
0712 { test_kernel_write, &test_var, sizeof(test_var), KCSAN_ACCESS_WRITE },
0713 { test_kernel_read, &test_var, sizeof(test_var), 0 },
0714 },
0715 };
0716 struct expect_report never = {
0717 .access = {
0718 { test_kernel_read, &test_var, sizeof(test_var), 0 },
0719 { test_kernel_read, &test_var, sizeof(test_var), 0 },
0720 },
0721 };
0722 bool match_expect = false;
0723 bool match_never = false;
0724
0725 begin_test_checks(test_kernel_write, test_kernel_read);
0726 do {
0727 match_expect |= report_matches(&expect);
0728 match_never = report_matches(&never);
0729 } while (!end_test_checks(match_never));
0730 KUNIT_EXPECT_TRUE(test, match_expect);
0731 KUNIT_EXPECT_FALSE(test, match_never);
0732 }
0733
0734
0735
0736
0737
0738 __no_kcsan
0739 static void test_concurrent_races(struct kunit *test)
0740 {
0741 struct expect_report expect = {
0742 .access = {
0743
0744 { test_kernel_rmw_array, NULL, 0, __KCSAN_ACCESS_RW(KCSAN_ACCESS_WRITE) },
0745 { test_kernel_rmw_array, NULL, 0, __KCSAN_ACCESS_RW(0) },
0746 },
0747 };
0748 struct expect_report never = {
0749 .access = {
0750 { test_kernel_rmw_array, NULL, 0, 0 },
0751 { test_kernel_rmw_array, NULL, 0, 0 },
0752 },
0753 };
0754 bool match_expect = false;
0755 bool match_never = false;
0756
0757 begin_test_checks(test_kernel_rmw_array, test_kernel_rmw_array);
0758 do {
0759 match_expect |= report_matches(&expect);
0760 match_never |= report_matches(&never);
0761 } while (!end_test_checks(false));
0762 KUNIT_EXPECT_TRUE(test, match_expect);
0763 KUNIT_EXPECT_FALSE(test, match_never);
0764 }
0765
0766
0767 __no_kcsan
0768 static void test_novalue_change(struct kunit *test)
0769 {
0770 struct expect_report expect_rw = {
0771 .access = {
0772 { test_kernel_write_nochange, &test_var, sizeof(test_var), KCSAN_ACCESS_WRITE },
0773 { test_kernel_read, &test_var, sizeof(test_var), 0 },
0774 },
0775 };
0776 struct expect_report expect_ww = {
0777 .access = {
0778 { test_kernel_write_nochange, &test_var, sizeof(test_var), KCSAN_ACCESS_WRITE },
0779 { test_kernel_write_nochange, &test_var, sizeof(test_var), KCSAN_ACCESS_WRITE },
0780 },
0781 };
0782 bool match_expect = false;
0783
0784 test_kernel_write_nochange();
0785 begin_test_checks(test_kernel_write_nochange, test_kernel_read);
0786 do {
0787 match_expect = report_matches(&expect_rw) || report_matches(&expect_ww);
0788 } while (!end_test_checks(match_expect));
0789 if (IS_ENABLED(CONFIG_KCSAN_REPORT_VALUE_CHANGE_ONLY))
0790 KUNIT_EXPECT_FALSE(test, match_expect);
0791 else
0792 KUNIT_EXPECT_TRUE(test, match_expect);
0793 }
0794
0795
0796
0797
0798
0799 __no_kcsan
0800 static void test_novalue_change_exception(struct kunit *test)
0801 {
0802 struct expect_report expect_rw = {
0803 .access = {
0804 { test_kernel_write_nochange_rcu, &test_var, sizeof(test_var), KCSAN_ACCESS_WRITE },
0805 { test_kernel_read, &test_var, sizeof(test_var), 0 },
0806 },
0807 };
0808 struct expect_report expect_ww = {
0809 .access = {
0810 { test_kernel_write_nochange_rcu, &test_var, sizeof(test_var), KCSAN_ACCESS_WRITE },
0811 { test_kernel_write_nochange_rcu, &test_var, sizeof(test_var), KCSAN_ACCESS_WRITE },
0812 },
0813 };
0814 bool match_expect = false;
0815
0816 test_kernel_write_nochange_rcu();
0817 begin_test_checks(test_kernel_write_nochange_rcu, test_kernel_read);
0818 do {
0819 match_expect = report_matches(&expect_rw) || report_matches(&expect_ww);
0820 } while (!end_test_checks(match_expect));
0821 KUNIT_EXPECT_TRUE(test, match_expect);
0822 }
0823
0824
0825 __no_kcsan
0826 static void test_unknown_origin(struct kunit *test)
0827 {
0828 struct expect_report expect = {
0829 .access = {
0830 { test_kernel_read, &test_var, sizeof(test_var), 0 },
0831 { NULL },
0832 },
0833 };
0834 bool match_expect = false;
0835
0836 begin_test_checks(test_kernel_write_uninstrumented, test_kernel_read);
0837 do {
0838 match_expect = report_matches(&expect);
0839 } while (!end_test_checks(match_expect));
0840 if (IS_ENABLED(CONFIG_KCSAN_REPORT_RACE_UNKNOWN_ORIGIN))
0841 KUNIT_EXPECT_TRUE(test, match_expect);
0842 else
0843 KUNIT_EXPECT_FALSE(test, match_expect);
0844 }
0845
0846
0847 __no_kcsan
0848 static void test_write_write_assume_atomic(struct kunit *test)
0849 {
0850 struct expect_report expect = {
0851 .access = {
0852 { test_kernel_write, &test_var, sizeof(test_var), KCSAN_ACCESS_WRITE },
0853 { test_kernel_write, &test_var, sizeof(test_var), KCSAN_ACCESS_WRITE },
0854 },
0855 };
0856 bool match_expect = false;
0857
0858 begin_test_checks(test_kernel_write, test_kernel_write);
0859 do {
0860 sink_value(READ_ONCE(test_var));
0861 match_expect = report_matches(&expect);
0862 } while (!end_test_checks(match_expect));
0863 if (IS_ENABLED(CONFIG_KCSAN_ASSUME_PLAIN_WRITES_ATOMIC))
0864 KUNIT_EXPECT_FALSE(test, match_expect);
0865 else
0866 KUNIT_EXPECT_TRUE(test, match_expect);
0867 }
0868
0869
0870
0871
0872
0873 __no_kcsan
0874 static void test_write_write_struct(struct kunit *test)
0875 {
0876 struct expect_report expect = {
0877 .access = {
0878 { test_kernel_write_struct, &test_struct, sizeof(test_struct), KCSAN_ACCESS_WRITE },
0879 { test_kernel_write_struct, &test_struct, sizeof(test_struct), KCSAN_ACCESS_WRITE },
0880 },
0881 };
0882 bool match_expect = false;
0883
0884 begin_test_checks(test_kernel_write_struct, test_kernel_write_struct);
0885 do {
0886 match_expect = report_matches(&expect);
0887 } while (!end_test_checks(match_expect));
0888 KUNIT_EXPECT_TRUE(test, match_expect);
0889 }
0890
0891
0892
0893
0894
0895 __no_kcsan
0896 static void test_write_write_struct_part(struct kunit *test)
0897 {
0898 struct expect_report expect = {
0899 .access = {
0900 { test_kernel_write_struct, &test_struct, sizeof(test_struct), KCSAN_ACCESS_WRITE },
0901 { test_kernel_write_struct_part, &test_struct.val[3], sizeof(test_struct.val[3]), KCSAN_ACCESS_WRITE },
0902 },
0903 };
0904 bool match_expect = false;
0905
0906 begin_test_checks(test_kernel_write_struct, test_kernel_write_struct_part);
0907 do {
0908 match_expect = report_matches(&expect);
0909 } while (!end_test_checks(match_expect));
0910 KUNIT_EXPECT_TRUE(test, match_expect);
0911 }
0912
0913
0914 __no_kcsan
0915 static void test_read_atomic_write_atomic(struct kunit *test)
0916 {
0917 bool match_never = false;
0918
0919 begin_test_checks(test_kernel_read_atomic, test_kernel_write_atomic);
0920 do {
0921 match_never = report_available();
0922 } while (!end_test_checks(match_never));
0923 KUNIT_EXPECT_FALSE(test, match_never);
0924 }
0925
0926
0927 __no_kcsan
0928 static void test_read_plain_atomic_write(struct kunit *test)
0929 {
0930 struct expect_report expect = {
0931 .access = {
0932 { test_kernel_read, &test_var, sizeof(test_var), 0 },
0933 { test_kernel_write_atomic, &test_var, sizeof(test_var), KCSAN_ACCESS_WRITE | KCSAN_ACCESS_ATOMIC },
0934 },
0935 };
0936 bool match_expect = false;
0937
0938 KCSAN_TEST_REQUIRES(test, !IS_ENABLED(CONFIG_KCSAN_IGNORE_ATOMICS));
0939
0940 begin_test_checks(test_kernel_read, test_kernel_write_atomic);
0941 do {
0942 match_expect = report_matches(&expect);
0943 } while (!end_test_checks(match_expect));
0944 KUNIT_EXPECT_TRUE(test, match_expect);
0945 }
0946
0947
0948 __no_kcsan
0949 static void test_read_plain_atomic_rmw(struct kunit *test)
0950 {
0951 struct expect_report expect = {
0952 .access = {
0953 { test_kernel_read, &test_var, sizeof(test_var), 0 },
0954 { test_kernel_atomic_rmw, &test_var, sizeof(test_var),
0955 KCSAN_ACCESS_COMPOUND | KCSAN_ACCESS_WRITE | KCSAN_ACCESS_ATOMIC },
0956 },
0957 };
0958 bool match_expect = false;
0959
0960 KCSAN_TEST_REQUIRES(test, !IS_ENABLED(CONFIG_KCSAN_IGNORE_ATOMICS));
0961
0962 begin_test_checks(test_kernel_read, test_kernel_atomic_rmw);
0963 do {
0964 match_expect = report_matches(&expect);
0965 } while (!end_test_checks(match_expect));
0966 KUNIT_EXPECT_TRUE(test, match_expect);
0967 }
0968
0969
0970 __no_kcsan
0971 static void test_zero_size_access(struct kunit *test)
0972 {
0973 struct expect_report expect = {
0974 .access = {
0975 { test_kernel_write_struct, &test_struct, sizeof(test_struct), KCSAN_ACCESS_WRITE },
0976 { test_kernel_write_struct, &test_struct, sizeof(test_struct), KCSAN_ACCESS_WRITE },
0977 },
0978 };
0979 struct expect_report never = {
0980 .access = {
0981 { test_kernel_write_struct, &test_struct, sizeof(test_struct), KCSAN_ACCESS_WRITE },
0982 { test_kernel_read_struct_zero_size, &test_struct.val[3], 0, 0 },
0983 },
0984 };
0985 bool match_expect = false;
0986 bool match_never = false;
0987
0988 begin_test_checks(test_kernel_write_struct, test_kernel_read_struct_zero_size);
0989 do {
0990 match_expect |= report_matches(&expect);
0991 match_never = report_matches(&never);
0992 } while (!end_test_checks(match_never));
0993 KUNIT_EXPECT_TRUE(test, match_expect);
0994 KUNIT_EXPECT_FALSE(test, match_never);
0995 }
0996
0997
0998 __no_kcsan
0999 static void test_data_race(struct kunit *test)
1000 {
1001 bool match_never = false;
1002
1003 begin_test_checks(test_kernel_data_race, test_kernel_data_race);
1004 do {
1005 match_never = report_available();
1006 } while (!end_test_checks(match_never));
1007 KUNIT_EXPECT_FALSE(test, match_never);
1008 }
1009
1010 __no_kcsan
1011 static void test_assert_exclusive_writer(struct kunit *test)
1012 {
1013 struct expect_report expect = {
1014 .access = {
1015 { test_kernel_assert_writer, &test_var, sizeof(test_var), KCSAN_ACCESS_ASSERT },
1016 { test_kernel_write_nochange, &test_var, sizeof(test_var), KCSAN_ACCESS_WRITE },
1017 },
1018 };
1019 bool match_expect = false;
1020
1021 begin_test_checks(test_kernel_assert_writer, test_kernel_write_nochange);
1022 do {
1023 match_expect = report_matches(&expect);
1024 } while (!end_test_checks(match_expect));
1025 KUNIT_EXPECT_TRUE(test, match_expect);
1026 }
1027
1028 __no_kcsan
1029 static void test_assert_exclusive_access(struct kunit *test)
1030 {
1031 struct expect_report expect = {
1032 .access = {
1033 { test_kernel_assert_access, &test_var, sizeof(test_var), KCSAN_ACCESS_ASSERT | KCSAN_ACCESS_WRITE },
1034 { test_kernel_read, &test_var, sizeof(test_var), 0 },
1035 },
1036 };
1037 bool match_expect = false;
1038
1039 begin_test_checks(test_kernel_assert_access, test_kernel_read);
1040 do {
1041 match_expect = report_matches(&expect);
1042 } while (!end_test_checks(match_expect));
1043 KUNIT_EXPECT_TRUE(test, match_expect);
1044 }
1045
1046 __no_kcsan
1047 static void test_assert_exclusive_access_writer(struct kunit *test)
1048 {
1049 struct expect_report expect_access_writer = {
1050 .access = {
1051 { test_kernel_assert_access, &test_var, sizeof(test_var), KCSAN_ACCESS_ASSERT | KCSAN_ACCESS_WRITE },
1052 { test_kernel_assert_writer, &test_var, sizeof(test_var), KCSAN_ACCESS_ASSERT },
1053 },
1054 };
1055 struct expect_report expect_access_access = {
1056 .access = {
1057 { test_kernel_assert_access, &test_var, sizeof(test_var), KCSAN_ACCESS_ASSERT | KCSAN_ACCESS_WRITE },
1058 { test_kernel_assert_access, &test_var, sizeof(test_var), KCSAN_ACCESS_ASSERT | KCSAN_ACCESS_WRITE },
1059 },
1060 };
1061 struct expect_report never = {
1062 .access = {
1063 { test_kernel_assert_writer, &test_var, sizeof(test_var), KCSAN_ACCESS_ASSERT },
1064 { test_kernel_assert_writer, &test_var, sizeof(test_var), KCSAN_ACCESS_ASSERT },
1065 },
1066 };
1067 bool match_expect_access_writer = false;
1068 bool match_expect_access_access = false;
1069 bool match_never = false;
1070
1071 begin_test_checks(test_kernel_assert_access, test_kernel_assert_writer);
1072 do {
1073 match_expect_access_writer |= report_matches(&expect_access_writer);
1074 match_expect_access_access |= report_matches(&expect_access_access);
1075 match_never |= report_matches(&never);
1076 } while (!end_test_checks(match_never));
1077 KUNIT_EXPECT_TRUE(test, match_expect_access_writer);
1078 KUNIT_EXPECT_TRUE(test, match_expect_access_access);
1079 KUNIT_EXPECT_FALSE(test, match_never);
1080 }
1081
1082 __no_kcsan
1083 static void test_assert_exclusive_bits_change(struct kunit *test)
1084 {
1085 struct expect_report expect = {
1086 .access = {
1087 { test_kernel_assert_bits_change, &test_var, sizeof(test_var), KCSAN_ACCESS_ASSERT },
1088 { test_kernel_change_bits, &test_var, sizeof(test_var),
1089 KCSAN_ACCESS_WRITE | (IS_ENABLED(CONFIG_KCSAN_IGNORE_ATOMICS) ? 0 : KCSAN_ACCESS_ATOMIC) },
1090 },
1091 };
1092 bool match_expect = false;
1093
1094 begin_test_checks(test_kernel_assert_bits_change, test_kernel_change_bits);
1095 do {
1096 match_expect = report_matches(&expect);
1097 } while (!end_test_checks(match_expect));
1098 KUNIT_EXPECT_TRUE(test, match_expect);
1099 }
1100
1101 __no_kcsan
1102 static void test_assert_exclusive_bits_nochange(struct kunit *test)
1103 {
1104 bool match_never = false;
1105
1106 begin_test_checks(test_kernel_assert_bits_nochange, test_kernel_change_bits);
1107 do {
1108 match_never = report_available();
1109 } while (!end_test_checks(match_never));
1110 KUNIT_EXPECT_FALSE(test, match_never);
1111 }
1112
1113 __no_kcsan
1114 static void test_assert_exclusive_writer_scoped(struct kunit *test)
1115 {
1116 struct expect_report expect_start = {
1117 .access = {
1118 { test_kernel_assert_writer_scoped, &test_var, sizeof(test_var), KCSAN_ACCESS_ASSERT | KCSAN_ACCESS_SCOPED },
1119 { test_kernel_write_nochange, &test_var, sizeof(test_var), KCSAN_ACCESS_WRITE },
1120 },
1121 };
1122 struct expect_report expect_inscope = {
1123 .access = {
1124 { test_enter_scope, &test_var, sizeof(test_var), KCSAN_ACCESS_ASSERT | KCSAN_ACCESS_SCOPED },
1125 { test_kernel_write_nochange, &test_var, sizeof(test_var), KCSAN_ACCESS_WRITE },
1126 },
1127 };
1128 bool match_expect_start = false;
1129 bool match_expect_inscope = false;
1130
1131 begin_test_checks(test_kernel_assert_writer_scoped, test_kernel_write_nochange);
1132 do {
1133 match_expect_start |= report_matches(&expect_start);
1134 match_expect_inscope |= report_matches(&expect_inscope);
1135 } while (!end_test_checks(match_expect_inscope));
1136 KUNIT_EXPECT_TRUE(test, match_expect_start);
1137 KUNIT_EXPECT_FALSE(test, match_expect_inscope);
1138 }
1139
1140 __no_kcsan
1141 static void test_assert_exclusive_access_scoped(struct kunit *test)
1142 {
1143 struct expect_report expect_start1 = {
1144 .access = {
1145 { test_kernel_assert_access_scoped, &test_var, sizeof(test_var), KCSAN_ACCESS_ASSERT | KCSAN_ACCESS_WRITE | KCSAN_ACCESS_SCOPED },
1146 { test_kernel_read, &test_var, sizeof(test_var), 0 },
1147 },
1148 };
1149 struct expect_report expect_start2 = {
1150 .access = { expect_start1.access[0], expect_start1.access[0] },
1151 };
1152 struct expect_report expect_inscope = {
1153 .access = {
1154 { test_enter_scope, &test_var, sizeof(test_var), KCSAN_ACCESS_ASSERT | KCSAN_ACCESS_WRITE | KCSAN_ACCESS_SCOPED },
1155 { test_kernel_read, &test_var, sizeof(test_var), 0 },
1156 },
1157 };
1158 bool match_expect_start = false;
1159 bool match_expect_inscope = false;
1160
1161 begin_test_checks(test_kernel_assert_access_scoped, test_kernel_read);
1162 end_time += msecs_to_jiffies(1000);
1163 do {
1164 match_expect_start |= report_matches(&expect_start1) || report_matches(&expect_start2);
1165 match_expect_inscope |= report_matches(&expect_inscope);
1166 } while (!end_test_checks(match_expect_inscope));
1167 KUNIT_EXPECT_TRUE(test, match_expect_start);
1168 KUNIT_EXPECT_FALSE(test, match_expect_inscope);
1169 }
1170
1171
1172
1173
1174
1175
1176 __no_kcsan
1177 static void test_jiffies_noreport(struct kunit *test)
1178 {
1179 bool match_never = false;
1180
1181 begin_test_checks(test_kernel_jiffies_reader, test_kernel_jiffies_reader);
1182 do {
1183 match_never = report_available();
1184 } while (!end_test_checks(match_never));
1185 KUNIT_EXPECT_FALSE(test, match_never);
1186 }
1187
1188
1189 __no_kcsan
1190 static void test_seqlock_noreport(struct kunit *test)
1191 {
1192 bool match_never = false;
1193
1194 begin_test_checks(test_kernel_seqlock_reader, test_kernel_seqlock_writer);
1195 do {
1196 match_never = report_available();
1197 } while (!end_test_checks(match_never));
1198 KUNIT_EXPECT_FALSE(test, match_never);
1199 }
1200
1201
1202
1203
1204
1205
1206
1207
1208 static void test_atomic_builtins(struct kunit *test)
1209 {
1210 bool match_never = false;
1211
1212 begin_test_checks(test_kernel_atomic_builtins, test_kernel_atomic_builtins);
1213 do {
1214 long tmp;
1215
1216 kcsan_enable_current();
1217
1218 __atomic_store_n(&test_var, 42L, __ATOMIC_RELAXED);
1219 KUNIT_EXPECT_EQ(test, 42L, __atomic_load_n(&test_var, __ATOMIC_RELAXED));
1220
1221 KUNIT_EXPECT_EQ(test, 42L, __atomic_exchange_n(&test_var, 20, __ATOMIC_RELAXED));
1222 KUNIT_EXPECT_EQ(test, 20L, test_var);
1223
1224 tmp = 20L;
1225 KUNIT_EXPECT_TRUE(test, __atomic_compare_exchange_n(&test_var, &tmp, 30L,
1226 0, __ATOMIC_RELAXED,
1227 __ATOMIC_RELAXED));
1228 KUNIT_EXPECT_EQ(test, tmp, 20L);
1229 KUNIT_EXPECT_EQ(test, test_var, 30L);
1230 KUNIT_EXPECT_FALSE(test, __atomic_compare_exchange_n(&test_var, &tmp, 40L,
1231 1, __ATOMIC_RELAXED,
1232 __ATOMIC_RELAXED));
1233 KUNIT_EXPECT_EQ(test, tmp, 30L);
1234 KUNIT_EXPECT_EQ(test, test_var, 30L);
1235
1236 KUNIT_EXPECT_EQ(test, 30L, __atomic_fetch_add(&test_var, 1, __ATOMIC_RELAXED));
1237 KUNIT_EXPECT_EQ(test, 31L, __atomic_fetch_sub(&test_var, 1, __ATOMIC_RELAXED));
1238 KUNIT_EXPECT_EQ(test, 30L, __atomic_fetch_and(&test_var, 0xf, __ATOMIC_RELAXED));
1239 KUNIT_EXPECT_EQ(test, 14L, __atomic_fetch_xor(&test_var, 0xf, __ATOMIC_RELAXED));
1240 KUNIT_EXPECT_EQ(test, 1L, __atomic_fetch_or(&test_var, 0xf0, __ATOMIC_RELAXED));
1241 KUNIT_EXPECT_EQ(test, 241L, __atomic_fetch_nand(&test_var, 0xf, __ATOMIC_RELAXED));
1242 KUNIT_EXPECT_EQ(test, -2L, test_var);
1243
1244 __atomic_thread_fence(__ATOMIC_SEQ_CST);
1245 __atomic_signal_fence(__ATOMIC_SEQ_CST);
1246
1247 kcsan_disable_current();
1248
1249 match_never = report_available();
1250 } while (!end_test_checks(match_never));
1251 KUNIT_EXPECT_FALSE(test, match_never);
1252 }
1253
1254 __no_kcsan
1255 static void test_1bit_value_change(struct kunit *test)
1256 {
1257 struct expect_report expect = {
1258 .access = {
1259 { test_kernel_read, &test_var, sizeof(test_var), 0 },
1260 { test_kernel_xor_1bit, &test_var, sizeof(test_var), __KCSAN_ACCESS_RW(KCSAN_ACCESS_WRITE) },
1261 },
1262 };
1263 bool match = false;
1264
1265 begin_test_checks(test_kernel_read, test_kernel_xor_1bit);
1266 do {
1267 match = IS_ENABLED(CONFIG_KCSAN_PERMISSIVE)
1268 ? report_available()
1269 : report_matches(&expect);
1270 } while (!end_test_checks(match));
1271 if (IS_ENABLED(CONFIG_KCSAN_PERMISSIVE))
1272 KUNIT_EXPECT_FALSE(test, match);
1273 else
1274 KUNIT_EXPECT_TRUE(test, match);
1275 }
1276
1277 __no_kcsan
1278 static void test_correct_barrier(struct kunit *test)
1279 {
1280 struct expect_report expect = {
1281 .access = {
1282 { test_kernel_with_memorder, &test_var, sizeof(test_var), __KCSAN_ACCESS_RW(KCSAN_ACCESS_WRITE) },
1283 { test_kernel_with_memorder, &test_var, sizeof(test_var), __KCSAN_ACCESS_RW(0) },
1284 },
1285 };
1286 bool match_expect = false;
1287
1288 test_struct.val[0] = 0;
1289 begin_test_checks(test_kernel_with_memorder, test_kernel_with_memorder);
1290 do {
1291 match_expect = report_matches_any_reordered(&expect);
1292 } while (!end_test_checks(match_expect));
1293 KUNIT_EXPECT_FALSE(test, match_expect);
1294 }
1295
1296 __no_kcsan
1297 static void test_missing_barrier(struct kunit *test)
1298 {
1299 struct expect_report expect = {
1300 .access = {
1301 { test_kernel_wrong_memorder, &test_var, sizeof(test_var), __KCSAN_ACCESS_RW(KCSAN_ACCESS_WRITE) },
1302 { test_kernel_wrong_memorder, &test_var, sizeof(test_var), __KCSAN_ACCESS_RW(0) },
1303 },
1304 };
1305 bool match_expect = false;
1306
1307 test_struct.val[0] = 0;
1308 begin_test_checks(test_kernel_wrong_memorder, test_kernel_wrong_memorder);
1309 do {
1310 match_expect = report_matches_any_reordered(&expect);
1311 } while (!end_test_checks(match_expect));
1312 if (IS_ENABLED(CONFIG_KCSAN_WEAK_MEMORY))
1313 KUNIT_EXPECT_TRUE(test, match_expect);
1314 else
1315 KUNIT_EXPECT_FALSE(test, match_expect);
1316 }
1317
1318 __no_kcsan
1319 static void test_atomic_builtins_correct_barrier(struct kunit *test)
1320 {
1321 struct expect_report expect = {
1322 .access = {
1323 { test_kernel_atomic_builtin_with_memorder, &test_var, sizeof(test_var), __KCSAN_ACCESS_RW(KCSAN_ACCESS_WRITE) },
1324 { test_kernel_atomic_builtin_with_memorder, &test_var, sizeof(test_var), __KCSAN_ACCESS_RW(0) },
1325 },
1326 };
1327 bool match_expect = false;
1328
1329 test_struct.val[0] = 0;
1330 begin_test_checks(test_kernel_atomic_builtin_with_memorder,
1331 test_kernel_atomic_builtin_with_memorder);
1332 do {
1333 match_expect = report_matches_any_reordered(&expect);
1334 } while (!end_test_checks(match_expect));
1335 KUNIT_EXPECT_FALSE(test, match_expect);
1336 }
1337
1338 __no_kcsan
1339 static void test_atomic_builtins_missing_barrier(struct kunit *test)
1340 {
1341 struct expect_report expect = {
1342 .access = {
1343 { test_kernel_atomic_builtin_wrong_memorder, &test_var, sizeof(test_var), __KCSAN_ACCESS_RW(KCSAN_ACCESS_WRITE) },
1344 { test_kernel_atomic_builtin_wrong_memorder, &test_var, sizeof(test_var), __KCSAN_ACCESS_RW(0) },
1345 },
1346 };
1347 bool match_expect = false;
1348
1349 test_struct.val[0] = 0;
1350 begin_test_checks(test_kernel_atomic_builtin_wrong_memorder,
1351 test_kernel_atomic_builtin_wrong_memorder);
1352 do {
1353 match_expect = report_matches_any_reordered(&expect);
1354 } while (!end_test_checks(match_expect));
1355 if (IS_ENABLED(CONFIG_KCSAN_WEAK_MEMORY))
1356 KUNIT_EXPECT_TRUE(test, match_expect);
1357 else
1358 KUNIT_EXPECT_FALSE(test, match_expect);
1359 }
1360
1361
1362
1363
1364
1365
1366
1367
1368 static const void *nthreads_gen_params(const void *prev, char *desc)
1369 {
1370 long nthreads = (long)prev;
1371
1372 if (nthreads < 0 || nthreads >= 32)
1373 nthreads = 0;
1374 else if (!nthreads)
1375 nthreads = 2;
1376 else if (nthreads < 5)
1377 nthreads++;
1378 else if (nthreads == 5)
1379 nthreads = 8;
1380 else
1381 nthreads *= 2;
1382
1383 if (!preempt_model_preemptible() ||
1384 !IS_ENABLED(CONFIG_KCSAN_INTERRUPT_WATCHER)) {
1385
1386
1387
1388
1389
1390 const long min_unused_cpus = preempt_model_none() ? 2 : 0;
1391 const long min_required_cpus = 2 + min_unused_cpus;
1392
1393 if (num_online_cpus() < min_required_cpus) {
1394 pr_err_once("Too few online CPUs (%u < %ld) for test\n",
1395 num_online_cpus(), min_required_cpus);
1396 nthreads = 0;
1397 } else if (nthreads >= num_online_cpus() - min_unused_cpus) {
1398
1399 nthreads = -(num_online_cpus() - min_unused_cpus);
1400 pr_warn_once("Limiting number of threads to %ld (only %d online CPUs)\n",
1401 -nthreads, num_online_cpus());
1402 }
1403 }
1404
1405 snprintf(desc, KUNIT_PARAM_DESC_SIZE, "threads=%ld", abs(nthreads));
1406 return (void *)nthreads;
1407 }
1408
1409 #define KCSAN_KUNIT_CASE(test_name) KUNIT_CASE_PARAM(test_name, nthreads_gen_params)
1410 static struct kunit_case kcsan_test_cases[] = {
1411 KUNIT_CASE(test_barrier_nothreads),
1412 KCSAN_KUNIT_CASE(test_basic),
1413 KCSAN_KUNIT_CASE(test_concurrent_races),
1414 KCSAN_KUNIT_CASE(test_novalue_change),
1415 KCSAN_KUNIT_CASE(test_novalue_change_exception),
1416 KCSAN_KUNIT_CASE(test_unknown_origin),
1417 KCSAN_KUNIT_CASE(test_write_write_assume_atomic),
1418 KCSAN_KUNIT_CASE(test_write_write_struct),
1419 KCSAN_KUNIT_CASE(test_write_write_struct_part),
1420 KCSAN_KUNIT_CASE(test_read_atomic_write_atomic),
1421 KCSAN_KUNIT_CASE(test_read_plain_atomic_write),
1422 KCSAN_KUNIT_CASE(test_read_plain_atomic_rmw),
1423 KCSAN_KUNIT_CASE(test_zero_size_access),
1424 KCSAN_KUNIT_CASE(test_data_race),
1425 KCSAN_KUNIT_CASE(test_assert_exclusive_writer),
1426 KCSAN_KUNIT_CASE(test_assert_exclusive_access),
1427 KCSAN_KUNIT_CASE(test_assert_exclusive_access_writer),
1428 KCSAN_KUNIT_CASE(test_assert_exclusive_bits_change),
1429 KCSAN_KUNIT_CASE(test_assert_exclusive_bits_nochange),
1430 KCSAN_KUNIT_CASE(test_assert_exclusive_writer_scoped),
1431 KCSAN_KUNIT_CASE(test_assert_exclusive_access_scoped),
1432 KCSAN_KUNIT_CASE(test_jiffies_noreport),
1433 KCSAN_KUNIT_CASE(test_seqlock_noreport),
1434 KCSAN_KUNIT_CASE(test_atomic_builtins),
1435 KCSAN_KUNIT_CASE(test_1bit_value_change),
1436 KCSAN_KUNIT_CASE(test_correct_barrier),
1437 KCSAN_KUNIT_CASE(test_missing_barrier),
1438 KCSAN_KUNIT_CASE(test_atomic_builtins_correct_barrier),
1439 KCSAN_KUNIT_CASE(test_atomic_builtins_missing_barrier),
1440 {},
1441 };
1442
1443
1444
1445
1446 __no_kcsan
1447 static void access_thread_timer(struct timer_list *timer)
1448 {
1449 static atomic_t cnt = ATOMIC_INIT(0);
1450 unsigned int idx;
1451 void (*func)(void);
1452
1453 idx = (unsigned int)atomic_inc_return(&cnt) % ARRAY_SIZE(access_kernels);
1454
1455 func = smp_load_acquire(&access_kernels[idx]);
1456 if (func)
1457 func();
1458 }
1459
1460
1461 __no_kcsan
1462 static int access_thread(void *arg)
1463 {
1464 struct timer_list timer;
1465 unsigned int cnt = 0;
1466 unsigned int idx;
1467 void (*func)(void);
1468
1469 timer_setup_on_stack(&timer, access_thread_timer, 0);
1470 do {
1471 might_sleep();
1472
1473 if (!timer_pending(&timer))
1474 mod_timer(&timer, jiffies + 1);
1475 else {
1476
1477 idx = cnt++ % ARRAY_SIZE(access_kernels);
1478
1479 func = smp_load_acquire(&access_kernels[idx]);
1480 if (func)
1481 func();
1482 }
1483 } while (!torture_must_stop());
1484 del_timer_sync(&timer);
1485 destroy_timer_on_stack(&timer);
1486
1487 torture_kthread_stopping("access_thread");
1488 return 0;
1489 }
1490
1491 __no_kcsan
1492 static int test_init(struct kunit *test)
1493 {
1494 unsigned long flags;
1495 int nthreads;
1496 int i;
1497
1498 spin_lock_irqsave(&observed.lock, flags);
1499 for (i = 0; i < ARRAY_SIZE(observed.lines); ++i)
1500 observed.lines[i][0] = '\0';
1501 observed.nlines = 0;
1502 spin_unlock_irqrestore(&observed.lock, flags);
1503
1504 if (strstr(test->name, "nothreads"))
1505 return 0;
1506
1507 if (!torture_init_begin((char *)test->name, 1))
1508 return -EBUSY;
1509
1510 if (WARN_ON(threads))
1511 goto err;
1512
1513 for (i = 0; i < ARRAY_SIZE(access_kernels); ++i) {
1514 if (WARN_ON(access_kernels[i]))
1515 goto err;
1516 }
1517
1518 nthreads = abs((long)test->param_value);
1519 if (WARN_ON(!nthreads))
1520 goto err;
1521
1522 threads = kcalloc(nthreads + 1, sizeof(struct task_struct *), GFP_KERNEL);
1523 if (WARN_ON(!threads))
1524 goto err;
1525
1526 threads[nthreads] = NULL;
1527 for (i = 0; i < nthreads; ++i) {
1528 if (torture_create_kthread(access_thread, NULL, threads[i]))
1529 goto err;
1530 }
1531
1532 torture_init_end();
1533
1534 return 0;
1535
1536 err:
1537 kfree(threads);
1538 threads = NULL;
1539 torture_init_end();
1540 return -EINVAL;
1541 }
1542
1543 __no_kcsan
1544 static void test_exit(struct kunit *test)
1545 {
1546 struct task_struct **stop_thread;
1547 int i;
1548
1549 if (strstr(test->name, "nothreads"))
1550 return;
1551
1552 if (torture_cleanup_begin())
1553 return;
1554
1555 for (i = 0; i < ARRAY_SIZE(access_kernels); ++i)
1556 WRITE_ONCE(access_kernels[i], NULL);
1557
1558 if (threads) {
1559 for (stop_thread = threads; *stop_thread; stop_thread++)
1560 torture_stop_kthread(reader_thread, *stop_thread);
1561
1562 kfree(threads);
1563 threads = NULL;
1564 }
1565
1566 torture_cleanup_end();
1567 }
1568
1569 __no_kcsan
1570 static void register_tracepoints(struct tracepoint *tp, void *ignore)
1571 {
1572 check_trace_callback_type_console(probe_console);
1573 if (!strcmp(tp->name, "console"))
1574 WARN_ON(tracepoint_probe_register(tp, probe_console, NULL));
1575 }
1576
1577 __no_kcsan
1578 static void unregister_tracepoints(struct tracepoint *tp, void *ignore)
1579 {
1580 if (!strcmp(tp->name, "console"))
1581 tracepoint_probe_unregister(tp, probe_console, NULL);
1582 }
1583
1584 static int kcsan_suite_init(struct kunit_suite *suite)
1585 {
1586
1587
1588
1589
1590
1591 for_each_kernel_tracepoint(register_tracepoints, NULL);
1592 return 0;
1593 }
1594
1595 static void kcsan_suite_exit(struct kunit_suite *suite)
1596 {
1597 for_each_kernel_tracepoint(unregister_tracepoints, NULL);
1598 tracepoint_synchronize_unregister();
1599 }
1600
1601 static struct kunit_suite kcsan_test_suite = {
1602 .name = "kcsan",
1603 .test_cases = kcsan_test_cases,
1604 .init = test_init,
1605 .exit = test_exit,
1606 .suite_init = kcsan_suite_init,
1607 .suite_exit = kcsan_suite_exit,
1608 };
1609
1610 kunit_test_suites(&kcsan_test_suite);
1611
1612 MODULE_LICENSE("GPL v2");
1613 MODULE_AUTHOR("Marco Elver <elver@google.com>");