Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
From:   Dmitry Vyukov <dvyukov@google.com>
Date:   Mon, 26 Jun 2023 19:21:34 +0200
Message-ID: <CACT4Y+bif9Wek-g10F5y0aLbH=JbCcqryi2nOUAFxGFo0O2B9A@mail.gmail.com>
Subject: Thread-safety annotations for irq/rcu/atomic contexts
To:     clang-built-linux <clang-built-linux@googlegroups.com>,
        Lukas Bulwahn <lukas.bulwahn@gmail.com>
Cc:     LKML <linux-kernel@vger.kernel.org>, Marco Elver <elver@google.com>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Hi,

Previous Lukas' attempt to apply clang thread-safety annotations to the kernel:
https://clangbuiltlinux.github.io/CBL-meetup-2020-slides/lukas/tsa.pdf

I am thinking if the annotations can be used to check for functions
that must/must not be called from irq/atomic/rcu_read/etc contexts.
Namely, we create global fake locks that denote these contexts, then
annotate spin_lock_irqsave/irqrestore/etc as taking releasing these
locks, and finally annotate functions are requiring/excluding these
contexts:

void foo() require(irq_context);
void bar() exclude(irq_context);
void baz() require(rcu_read_context);

This may help to catch "suspicious RCU usage", "scheduling while
atomic" and similar bug types statically. I suspect it may also be
simpler (?) to do rather than annotating all normal locks.

Does it make any sense?