Documentation/dev-tools/kmsan.rst

95 incorrect shadow/origin values, likely leading to false positives. Functions
125 KMSAN shadow memory
128 KMSAN associates a metadata byte (also called shadow byte) with every byte of
129 kernel memory. A bit in the shadow byte is set iff the corresponding bit of the
131 setting its shadow bytes to ``0xff``) is called poisoning, marking it
132 initialized (setting the shadow bytes to ``0x00``) is called unpoisoning.
139 Compiler instrumentation also tracks the shadow values as they are used along
141 ``mm/kmsan/`` to persist shadow values.
143 The shadow value of a basic or compound type is an array of bytes of the same
145 When a value is read from memory, its shadow memory is also obtained and
148 shadow of the result depending on those values and their shadows.
156 In this case the shadow of ``a`` is ``0``, shadow of ``b`` is ``0xffffffff``,
157 shadow of ``c`` is ``0xffffff00``. This means that the upper three bytes of
172 shadow. For every instruction that takes one or more values, the origin of the
204 If ``a`` is initialized and ``b`` is not, the shadow of the result would be
226 Shadow manipulation
230 pair of pointers to the shadow and origin addresses of the given memory::
233     void *shadow, *origin;
243 The compiler makes sure that for every loaded value its shadow and origin
244 values are read from memory. When a value is stored to memory, its shadow and
299 initialized or copied, making sure shadow and origin values are copied alongside
309 For each use of a value the compiler emits a shadow check that calls
372 1. Each ``struct page`` instance contains two pointers to its shadow and
377     struct page *shadow, *origin;
381 At boot-time, the kernel allocates shadow and origin pages for every available
386 This means that in general for two contiguous memory pages their shadow/origin
388 boundary of a memory block, accesses to shadow/origin memory may potentially
399 pages with non-contiguous metadata, it returns pointers to fake shadow/origin regions::
408 range, its shadow and origin. KMSAN reduces the vmalloc area by 3/4, making only
410 area contains shadow memory for the first quarter, the third one holds the
411 origins. A small part of the fourth quarter contains shadow and origins for the
416 shadow and origin pages are similarly mapped into contiguous regions.