Documentation/dev-tools/kmsan.rst

95 incorrect shadow/origin values, likely leading to false positives. Functions
132 KMSAN shadow memory
135 KMSAN associates a metadata byte (also called shadow byte) with every byte of
136 kernel memory. A bit in the shadow byte is set iff the corresponding bit of the
138 setting its shadow bytes to ``0xff``) is called poisoning, marking it
139 initialized (setting the shadow bytes to ``0x00``) is called unpoisoning.
146 Compiler instrumentation also tracks the shadow values as they are used along
148 ``mm/kmsan/`` to persist shadow values.
150 The shadow value of a basic or compound type is an array of bytes of the same
152 When a value is read from memory, its shadow memory is also obtained and
155 shadow of the result depending on those values and their shadows.
163 In this case the shadow of ``a`` is ``0``, shadow of ``b`` is ``0xffffffff``,
164 shadow of ``c`` is ``0xffffff00``. This means that the upper three bytes of
179 shadow. For every instruction that takes one or more values, the origin of the
211 If ``a`` is initialized and ``b`` is not, the shadow of the result would be
237 pair of pointers to the shadow and origin addresses of the given memory::
240     void *shadow, *origin;
250 The compiler makes sure that for every loaded value its shadow and origin
251 values are read from memory. When a value is stored to memory, its shadow and
306 initialized or copied, making sure shadow and origin values are copied alongside
316 For each use of a value the compiler emits a shadow check that calls
379 1. Each ``struct page`` instance contains two pointers to its shadow and
384     struct page *shadow, *origin;
388 At boot-time, the kernel allocates shadow and origin pages for every available
393 This means that in general for two contiguous memory pages their shadow/origin
395 boundary of a memory block, accesses to shadow/origin memory may potentially
406 pages with non-contiguous metadata, it returns pointers to fake shadow/origin regions::
415 range, its shadow and origin. KMSAN reduces the vmalloc area by 3/4, making only
417 area contains shadow memory for the first quarter, the third one holds the
418 origins. A small part of the fourth quarter contains shadow and origins for the
423 shadow and origin pages are similarly mapped into contiguous regions.