From nobody Thu Oct 2 10:55:48 2025 Received: from mail-wm1-f74.google.com (mail-wm1-f74.google.com [209.85.128.74]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 05E56314D16 for ; Thu, 18 Sep 2025 14:06:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.74 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758204386; cv=none; b=P+uk/8vUXun52FWRpNeMIy7xB4DKSvWyjC6m7i5I1bBinwgFDPm4bUq+Stm0hywYybVzJtIeGDmh5dHGAHQQYYpYAqoN6twLgV/W7KgpcMjb5x+5LrbS57eKCA8ZIrpIGC3Si2NoWMRe06RuwOW7pDkEJLtbsJuDMJGoXypRGhY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1758204386; c=relaxed/simple; bh=/MeW5F7ttix9WlkBnpTwOdLX6aNcpSlr0jVnFQ0tmdk=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=KpPm/7xRHXy2sAXB+LyOVaTyM/PYgKSlthGb6tWsuPBFfOFU3rUmn6KqRrSrNmefOrlqVqNVcX3dBYojDlQs+Hg3I1APueiC6xbq1F2FDVp+Yw+P4pgO8KQagS1JxaUQZ7ZdCtqtQJjhEz24wru+cM8mO15DsWQes9VpgX6pIBs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--elver.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=2XUigOd6; arc=none smtp.client-ip=209.85.128.74 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--elver.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="2XUigOd6" Received: by mail-wm1-f74.google.com with SMTP id 5b1f17b1804b1-45f2c1556aeso3813725e9.3 for ; Thu, 18 Sep 2025 07:06:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1758204381; x=1758809181; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=ELhsFQQQ03C4hLdoxnucw/8+AkmAKW9zLdfFvUdcDbU=; b=2XUigOd6cafSJ2PXRUf9LgSTfbJ9U7Uhx2jcr5nE/PWRR/+lLYdFcAVfDFkAVuhzBc SbTEB6ifUQMplP3GjSPCU+8EKKeU7sXskac777AcitsqBmTK0V+ilTCh/ejOUcBM/LFy OLr0v4AT/brKPXbjsGUtyd+JcXFiWZ9l/2M7e4pjc+ezaXXuxgdZE9bisq9GeQTCVHi+ kUpd7g178OSYRuIQiRlBZl1bcCDUz1H30cbwPgRSTkJxXBzRTUUilEMR4mjZHe7QFGwj MLlR+Sji90icggmnOr+Zx527vhe7Xz8WOEGTWzybKpKsw8EnbEzzxXMcRnWjC+6OllY/ 1cNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1758204381; x=1758809181; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=ELhsFQQQ03C4hLdoxnucw/8+AkmAKW9zLdfFvUdcDbU=; b=EHRKxRDOid2zYT+OC1g7KEhfhFFzEGVit1AKyyyha+Li+xDEZai+KGQdYkAbMw8xDt iYss5GhjyBcp0szIs6eL8JQo8ZEt4cPlbIw8SeZYcgDHZ2NVTb8tfur6ZhwZBSfARfE6 XoQ2rGZamxM89YV/RW21SygLO501VabctI3O2BzFPYhlQTn7EcfMOQUu8jn3qZYp4zzQ yvABnqKJyX9+/k1qD2GxqjRZZly3yeS4mF/Az0vMHzF6djTsv9ZdQH9Dtbz0LvOJz8Nt bsabBTnPICmoPEV06ihJ6g3mit6DzGq51V/5/p9RVyCvO0gxpsVGq4ikAh0tSpMp5SOS sJ1A== X-Forwarded-Encrypted: i=1; AJvYcCW9xcfdyX+MNlP24IO206epB/D5CVXu6CcEoJAJfIAgEuWslgrYGUAZkndbHsolZfurMCbJtjGItysCnUU=@vger.kernel.org X-Gm-Message-State: AOJu0YyqTlPd61YzC6chfAdM0fGfqO+LAFx0nSgIiY6H5qyhxcRknjaX k1cBFUG9bVADFYx+dgj/A5W/2j6ypVlvW1rvp0b45IC+5EPWxEXa5qkurm37e2Y+esnTAr0jt8Y orA== X-Google-Smtp-Source: AGHT+IHcd1Qh8kOAFxc/2t8MroiNimpccwG9uYdP8O4l5R/dxiF/pFNNICl8HtyF7NtKGjMQxkNUnXtHWQ== X-Received: from wmbbi7.prod.google.com ([2002:a05:600c:3d87:b0:45d:d522:48a9]) (user=elver job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:2a93:b0:462:cd41:c2f8 with SMTP id 5b1f17b1804b1-464c6761397mr28424195e9.5.1758204381270; Thu, 18 Sep 2025 07:06:21 -0700 (PDT) Date: Thu, 18 Sep 2025 15:59:31 +0200 In-Reply-To: <20250918140451.1289454-1-elver@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20250918140451.1289454-1-elver@google.com> X-Mailer: git-send-email 2.51.0.384.g4c02a37b29-goog Message-ID: <20250918140451.1289454-21-elver@google.com> Subject: [PATCH v3 20/35] locking/ww_mutex: Support Clang's capability analysis From: Marco Elver To: elver@google.com, Peter Zijlstra , Boqun Feng , Ingo Molnar , Will Deacon Cc: "David S. Miller" , Luc Van Oostenryck , "Paul E. McKenney" , Alexander Potapenko , Arnd Bergmann , Bart Van Assche , Bill Wendling , Christoph Hellwig , Dmitry Vyukov , Eric Dumazet , Frederic Weisbecker , Greg Kroah-Hartman , Herbert Xu , Ian Rogers , Jann Horn , Joel Fernandes , Jonathan Corbet , Josh Triplett , Justin Stitt , Kees Cook , Kentaro Takeda , Lukas Bulwahn , Mark Rutland , Mathieu Desnoyers , Miguel Ojeda , Nathan Chancellor , Neeraj Upadhyay , Nick Desaulniers , Steven Rostedt , Tetsuo Handa , Thomas Gleixner , Thomas Graf , Uladzislau Rezki , Waiman Long , kasan-dev@googlegroups.com, linux-crypto@vger.kernel.org, linux-doc@vger.kernel.org, linux-kbuild@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-security-module@vger.kernel.org, linux-sparse@vger.kernel.org, llvm@lists.linux.dev, rcu@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add support for Clang's capability analysis for ww_mutex. The programming model for ww_mutex is subtly more complex than other locking primitives when using ww_acquire_ctx. Encoding the respective pre-conditions for ww_mutex lock/unlock based on ww_acquire_ctx state using Clang's capability analysis makes incorrect use of the API harder. Signed-off-by: Marco Elver --- v3: * __assert -> __assume rename v2: * New patch. --- .../dev-tools/capability-analysis.rst | 3 +- include/linux/ww_mutex.h | 22 ++++-- lib/test_capability-analysis.c | 69 +++++++++++++++++++ 3 files changed, 87 insertions(+), 7 deletions(-) diff --git a/Documentation/dev-tools/capability-analysis.rst b/Documentatio= n/dev-tools/capability-analysis.rst index 9fb964e94920..2b89d346723b 100644 --- a/Documentation/dev-tools/capability-analysis.rst +++ b/Documentation/dev-tools/capability-analysis.rst @@ -82,7 +82,8 @@ Supported Kernel Primitives =20 Currently the following synchronization primitives are supported: `raw_spinlock_t`, `spinlock_t`, `rwlock_t`, `mutex`, `seqlock_t`, -`bit_spinlock`, RCU, SRCU (`srcu_struct`), `rw_semaphore`, `local_lock_t`. +`bit_spinlock`, RCU, SRCU (`srcu_struct`), `rw_semaphore`, `local_lock_t`, +`ww_mutex`. =20 For capabilities with an initialization function (e.g., `spin_lock_init()`= ), calling this function on the capability instance before initializing any diff --git a/include/linux/ww_mutex.h b/include/linux/ww_mutex.h index 45ff6f7a872b..549d75aee76a 100644 --- a/include/linux/ww_mutex.h +++ b/include/linux/ww_mutex.h @@ -44,7 +44,7 @@ struct ww_class { unsigned int is_wait_die; }; =20 -struct ww_mutex { +struct_with_capability(ww_mutex) { struct WW_MUTEX_BASE base; struct ww_acquire_ctx *ctx; #ifdef DEBUG_WW_MUTEXES @@ -52,7 +52,7 @@ struct ww_mutex { #endif }; =20 -struct ww_acquire_ctx { +struct_with_capability(ww_acquire_ctx) { struct task_struct *task; unsigned long stamp; unsigned int acquired; @@ -107,6 +107,7 @@ struct ww_acquire_ctx { */ static inline void ww_mutex_init(struct ww_mutex *lock, struct ww_class *ww_class) + __assumes_cap(lock) { ww_mutex_base_init(&lock->base, ww_class->mutex_name, &ww_class->mutex_ke= y); lock->ctx =3D NULL; @@ -141,6 +142,7 @@ static inline void ww_mutex_init(struct ww_mutex *lock, */ static inline void ww_acquire_init(struct ww_acquire_ctx *ctx, struct ww_class *ww_class) + __acquires(ctx) __no_capability_analysis { ctx->task =3D current; ctx->stamp =3D atomic_long_inc_return_relaxed(&ww_class->stamp); @@ -179,6 +181,7 @@ static inline void ww_acquire_init(struct ww_acquire_ct= x *ctx, * data structures. */ static inline void ww_acquire_done(struct ww_acquire_ctx *ctx) + __releases(ctx) __acquires_shared(ctx) __no_capability_analysis { #ifdef DEBUG_WW_MUTEXES lockdep_assert_held(ctx); @@ -196,6 +199,7 @@ static inline void ww_acquire_done(struct ww_acquire_ct= x *ctx) * mutexes have been released with ww_mutex_unlock. */ static inline void ww_acquire_fini(struct ww_acquire_ctx *ctx) + __releases_shared(ctx) __no_capability_analysis { #ifdef CONFIG_DEBUG_LOCK_ALLOC mutex_release(&ctx->first_lock_dep_map, _THIS_IP_); @@ -245,7 +249,8 @@ static inline void ww_acquire_fini(struct ww_acquire_ct= x *ctx) * * A mutex acquired with this function must be released with ww_mutex_unlo= ck. */ -extern int /* __must_check */ ww_mutex_lock(struct ww_mutex *lock, struct = ww_acquire_ctx *ctx); +extern int /* __must_check */ ww_mutex_lock(struct ww_mutex *lock, struct = ww_acquire_ctx *ctx) + __cond_acquires(0, lock) __must_hold(ctx); =20 /** * ww_mutex_lock_interruptible - acquire the w/w mutex, interruptible @@ -278,7 +283,8 @@ extern int /* __must_check */ ww_mutex_lock(struct ww_m= utex *lock, struct ww_acq * A mutex acquired with this function must be released with ww_mutex_unlo= ck. */ extern int __must_check ww_mutex_lock_interruptible(struct ww_mutex *lock, - struct ww_acquire_ctx *ctx); + struct ww_acquire_ctx *ctx) + __cond_acquires(0, lock) __must_hold(ctx); =20 /** * ww_mutex_lock_slow - slowpath acquiring of the w/w mutex @@ -305,6 +311,7 @@ extern int __must_check ww_mutex_lock_interruptible(str= uct ww_mutex *lock, */ static inline void ww_mutex_lock_slow(struct ww_mutex *lock, struct ww_acquire_ctx *ctx) + __acquires(lock) __must_hold(ctx) __no_capability_analysis { int ret; #ifdef DEBUG_WW_MUTEXES @@ -342,6 +349,7 @@ ww_mutex_lock_slow(struct ww_mutex *lock, struct ww_acq= uire_ctx *ctx) static inline int __must_check ww_mutex_lock_slow_interruptible(struct ww_mutex *lock, struct ww_acquire_ctx *ctx) + __cond_acquires(0, lock) __must_hold(ctx) { #ifdef DEBUG_WW_MUTEXES DEBUG_LOCKS_WARN_ON(!ctx->contending_lock); @@ -349,10 +357,11 @@ ww_mutex_lock_slow_interruptible(struct ww_mutex *loc= k, return ww_mutex_lock_interruptible(lock, ctx); } =20 -extern void ww_mutex_unlock(struct ww_mutex *lock); +extern void ww_mutex_unlock(struct ww_mutex *lock) __releases(lock); =20 extern int __must_check ww_mutex_trylock(struct ww_mutex *lock, - struct ww_acquire_ctx *ctx); + struct ww_acquire_ctx *ctx) + __cond_acquires(true, lock) __must_hold(ctx); =20 /*** * ww_mutex_destroy - mark a w/w mutex unusable @@ -363,6 +372,7 @@ extern int __must_check ww_mutex_trylock(struct ww_mute= x *lock, * this function is called. */ static inline void ww_mutex_destroy(struct ww_mutex *lock) + __must_not_hold(lock) { #ifndef CONFIG_PREEMPT_RT mutex_destroy(&lock->base); diff --git a/lib/test_capability-analysis.c b/lib/test_capability-analysis.c index e506dadb3933..12fd9716f0a4 100644 --- a/lib/test_capability-analysis.c +++ b/lib/test_capability-analysis.c @@ -14,6 +14,7 @@ #include #include #include +#include =20 /* * Test that helper macros work as expected. @@ -523,3 +524,71 @@ static void __used test_local_trylock(void) local_unlock(&test_local_trylock_data.lock); } } + +static DEFINE_WD_CLASS(ww_class); + +struct test_ww_mutex_data { + struct ww_mutex mtx; + int counter __guarded_by(&mtx); +}; + +static void __used test_ww_mutex_init(struct test_ww_mutex_data *d) +{ + ww_mutex_init(&d->mtx, &ww_class); + d->counter =3D 0; +} + +static void __used test_ww_mutex_lock_noctx(struct test_ww_mutex_data *d) +{ + if (!ww_mutex_lock(&d->mtx, NULL)) { + d->counter++; + ww_mutex_unlock(&d->mtx); + } + + if (!ww_mutex_lock_interruptible(&d->mtx, NULL)) { + d->counter++; + ww_mutex_unlock(&d->mtx); + } + + if (ww_mutex_trylock(&d->mtx, NULL)) { + d->counter++; + ww_mutex_unlock(&d->mtx); + } + + ww_mutex_lock_slow(&d->mtx, NULL); + d->counter++; + ww_mutex_unlock(&d->mtx); + + ww_mutex_destroy(&d->mtx); +} + +static void __used test_ww_mutex_lock_ctx(struct test_ww_mutex_data *d) +{ + struct ww_acquire_ctx ctx; + + ww_acquire_init(&ctx, &ww_class); + + if (!ww_mutex_lock(&d->mtx, &ctx)) { + d->counter++; + ww_mutex_unlock(&d->mtx); + } + + if (!ww_mutex_lock_interruptible(&d->mtx, &ctx)) { + d->counter++; + ww_mutex_unlock(&d->mtx); + } + + if (ww_mutex_trylock(&d->mtx, &ctx)) { + d->counter++; + ww_mutex_unlock(&d->mtx); + } + + ww_mutex_lock_slow(&d->mtx, &ctx); + d->counter++; + ww_mutex_unlock(&d->mtx); + + ww_acquire_done(&ctx); + ww_acquire_fini(&ctx); + + ww_mutex_destroy(&d->mtx); +} --=20 2.51.0.384.g4c02a37b29-goog