mirror of
https://github.com/torvalds/linux.git
synced 2026-05-28 17:13:52 +02:00
773b24bced
When enabling Clang's Context Analysis (aka. Thread Safety Analysis) on
kernel/futex/core.o (see Peter's changes at [1]), in arm64 LTO builds we
could see:
| kernel/futex/core.c:982:1: warning: spinlock 'atomic ? __u.__val : q->lock_ptr' is still held at the end of function [-Wthread-safety-analysis]
| 982 | }
| | ^
| kernel/futex/core.c:976:2: note: spinlock acquired here
| 976 | spin_lock(lock_ptr);
| | ^
| kernel/futex/core.c:982:1: warning: expecting spinlock 'q->lock_ptr' to be held at the end of function [-Wthread-safety-analysis]
| 982 | }
| | ^
| kernel/futex/core.c:966:6: note: spinlock acquired here
| 966 | void futex_q_lockptr_lock(struct futex_q *q)
| | ^
| 2 warnings generated.
Where we have:
extern void futex_q_lockptr_lock(struct futex_q *q) __acquires(q->lock_ptr);
..
void futex_q_lockptr_lock(struct futex_q *q)
{
spinlock_t *lock_ptr;
/*
* See futex_unqueue() why lock_ptr can change.
*/
guard(rcu)();
retry:
>> lock_ptr = READ_ONCE(q->lock_ptr);
spin_lock(lock_ptr);
...
}
At the time of the above report (prior to removal of the 'atomic' flag),
Clang Thread Safety Analysis's alias analysis resolved 'lock_ptr' to
'atomic ? __u.__val : q->lock_ptr' (now just '__u.__val'), and used
this as the identity of the context lock given it cannot "see through"
the inline assembly; however, we want 'q->lock_ptr' as the canonical
context lock.
While for code generation the compiler simplified to '__u.__val' for
pointers (8 byte case -> 'atomic' was set), TSA's analysis (a) happens
much earlier on the AST, and (b) would be the wrong deduction.
Now that we've gotten rid of the 'atomic' ternary comparison, we can
return '__u.__val' through a pointer that we initialize with '&x', but
then update via a pointer-to-pointer. When READ_ONCE()'ing a context
lock pointer, TSA's alias analysis does not invalidate the initial alias
when updated through the pointer-to-pointer, and we make it effectively
"see through" the __READ_ONCE().
Code generation is unchanged.
Link: https://lkml.kernel.org/r/20260121110704.221498346@infradead.org [1]
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202601221040.TeM0ihff-lkp@intel.com/
Cc: Peter Zijlstra <peterz@infradead.org>
Tested-by: Boqun Feng <boqun@kernel.org>
Reviewed-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Will Deacon <will@kernel.org>
84 lines
2.3 KiB
C
84 lines
2.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* Copyright (C) 2020 Google LLC.
|
|
*/
|
|
#ifndef __ASM_RWONCE_H
|
|
#define __ASM_RWONCE_H
|
|
|
|
#if defined(CONFIG_LTO) && !defined(__ASSEMBLER__)
|
|
|
|
#include <linux/compiler_types.h>
|
|
#include <asm/alternative-macros.h>
|
|
|
|
#ifndef BUILD_VDSO
|
|
|
|
#define __LOAD_RCPC(sfx, regs...) \
|
|
ALTERNATIVE( \
|
|
"ldar" #sfx "\t" #regs, \
|
|
".arch_extension rcpc\n" \
|
|
"ldapr" #sfx "\t" #regs, \
|
|
ARM64_HAS_LDAPR)
|
|
|
|
/*
|
|
* Replace this with typeof_unqual() when minimum compiler versions are
|
|
* increased to GCC 14 and Clang 19. For the time being, we need this
|
|
* workaround, which relies on function return values dropping qualifiers.
|
|
*/
|
|
#define __rwonce_typeof_unqual(x) typeof(({ \
|
|
__diag_push() \
|
|
__diag_ignore_all("-Wignored-qualifiers", "") \
|
|
((typeof(x)(*)(void))0)(); \
|
|
__diag_pop() }))
|
|
|
|
/*
|
|
* When building with LTO, there is an increased risk of the compiler
|
|
* converting an address dependency headed by a READ_ONCE() invocation
|
|
* into a control dependency and consequently allowing for harmful
|
|
* reordering by the CPU.
|
|
*
|
|
* Ensure that such transformations are harmless by overriding the generic
|
|
* READ_ONCE() definition with one that provides RCpc acquire semantics
|
|
* when building with LTO.
|
|
*/
|
|
#define __READ_ONCE(x) \
|
|
({ \
|
|
auto __x = &(x); \
|
|
auto __ret = (__rwonce_typeof_unqual(*__x) *)__x; \
|
|
/* Hides alias reassignment from Clang's -Wthread-safety. */ \
|
|
auto __retp = &__ret; \
|
|
union { typeof(*__ret) __val; char __c[1]; } __u; \
|
|
*__retp = &__u.__val; \
|
|
switch (sizeof(x)) { \
|
|
case 1: \
|
|
asm volatile(__LOAD_RCPC(b, %w0, %1) \
|
|
: "=r" (*(__u8 *)__u.__c) \
|
|
: "Q" (*__x) : "memory"); \
|
|
break; \
|
|
case 2: \
|
|
asm volatile(__LOAD_RCPC(h, %w0, %1) \
|
|
: "=r" (*(__u16 *)__u.__c) \
|
|
: "Q" (*__x) : "memory"); \
|
|
break; \
|
|
case 4: \
|
|
asm volatile(__LOAD_RCPC(, %w0, %1) \
|
|
: "=r" (*(__u32 *)__u.__c) \
|
|
: "Q" (*__x) : "memory"); \
|
|
break; \
|
|
case 8: \
|
|
asm volatile(__LOAD_RCPC(, %0, %1) \
|
|
: "=r" (*(__u64 *)__u.__c) \
|
|
: "Q" (*__x) : "memory"); \
|
|
break; \
|
|
default: \
|
|
__u.__val = *(volatile typeof(*__x) *)__x; \
|
|
} \
|
|
*__ret; \
|
|
})
|
|
|
|
#endif /* !BUILD_VDSO */
|
|
#endif /* CONFIG_LTO && !__ASSEMBLER__ */
|
|
|
|
#include <asm-generic/rwonce.h>
|
|
|
|
#endif /* __ASM_RWONCE_H */
|