* [RFC PATCH] gcc-plugins: Add a plugin to ease debugging of memory ordering bugs
@ 2026-10-18 15:26 Gautam Menghani
2026-10-22 16:21 ` kernel test robot
0 siblings, 1 reply; 2+ messages in thread
From: Gautam Menghani @ 2026-10-18 15:26 UTC (permalink / raw)
To: kees, maddy, chleroy, ritesh.list, sshegde
Cc: linux-hardening, linuxppc-dev, linux-kernel
On CPUs that support out of order execution, barriers are used to make
sure that if a cpu updates a variable, all other cpus see the correct
value. However, sometimes developers forget to put the barriers in the
right place and this ends up causing bugs.
Introduce a new plugin that can insert barriers after every load/store
to memory to make it easy to verify if a given bug is due to a missing
barrier.
Testing:
To test this plugin on IBM Power systems, I reverted the commit
bb9b52bd51dc ("KVM: PPC: Book3S HV: Add missing barriers to XIVE code and document them").
I was able to see lockups in the KVM guest with the commit reverted. I
then used the barriers plugin to insert barriers, and noticed that the
lockups were no longer observed in the KVM guest.
Assisted-by: LLM IBM-Bob
Signed-off-by: Gautam Menghani <gautam@linux.ibm.com>
---
scripts/Makefile.gcc-plugins | 2 +
scripts/gcc-plugins/Kconfig | 6 ++
scripts/gcc-plugins/barriers_plugin.c | 134 ++++++++++++++++++++++++++
3 files changed, 142 insertions(+)
create mode 100644 scripts/gcc-plugins/barriers_plugin.c
diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins
index b0e1423b09c2..cefc1cdad8df 100644
--- a/scripts/Makefile.gcc-plugins
+++ b/scripts/Makefile.gcc-plugins
@@ -8,6 +8,8 @@ ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY
endif
export DISABLE_LATENT_ENTROPY_PLUGIN
+gcc-plugin-$(CONFIG_GCC_PLUGIN_BARRIERS) += barriers_plugin.so
+
# All the plugin CFLAGS are collected here in case a build target needs to
# filter them out of the KBUILD_CFLAGS.
GCC_PLUGINS_CFLAGS := $(strip $(addprefix -fplugin=$(objtree)/scripts/gcc-plugins/, $(gcc-plugin-y)) $(gcc-plugin-cflags-y)) -DGCC_PLUGINS
diff --git a/scripts/gcc-plugins/Kconfig b/scripts/gcc-plugins/Kconfig
index 6b34ba19358d..d73e00fbb732 100644
--- a/scripts/gcc-plugins/Kconfig
+++ b/scripts/gcc-plugins/Kconfig
@@ -36,4 +36,10 @@ config GCC_PLUGIN_LATENT_ENTROPY
* https://grsecurity.net/
* https://pax.grsecurity.net/
+config GCC_PLUGIN_BARRIERS
+ bool "Insert barriers after every load/store"
+ help
+ By saying Y here barriers will be inserted after every load/store
+ instruction.
+
endif
diff --git a/scripts/gcc-plugins/barriers_plugin.c b/scripts/gcc-plugins/barriers_plugin.c
new file mode 100644
index 000000000000..54ee8b12e77b
--- /dev/null
+++ b/scripts/gcc-plugins/barriers_plugin.c
@@ -0,0 +1,134 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#include "gcc-common.h"
+
+#if defined(__powerpc__)
+# define BARRIER_ASM "sync"
+#else
+# define BARRIER_ASM "" /* compiler barrier only: asm volatile("" ::: "memory") */
+#endif
+
+__visible int plugin_is_GPL_compatible;
+
+static struct plugin_info barriers_plugin_info = {
+ .version = PLUGIN_VERSION,
+ .help = "Insert barriers after every load/store instruction\n"
+};
+
+/*
+ * Return true if this GIMPLE statement performs a non-stack memory access.
+ */
+static bool is_mem_based(tree expr)
+{
+ switch (TREE_CODE(expr)) {
+ case MEM_REF:
+ case INDIRECT_REF:
+ case TARGET_MEM_REF:
+ return true;
+ case COMPONENT_REF:
+ return is_mem_based(TREE_OPERAND(expr, 0));
+ default:
+ return false;
+ }
+}
+
+static bool gimple_has_mem_access(gimple stmt)
+{
+ if (gimple_code(stmt) == GIMPLE_CALL)
+ return true;
+
+ if (gimple_code(stmt) != GIMPLE_ASSIGN)
+ return false;
+
+ if (is_mem_based(gimple_assign_lhs(stmt)))
+ return true;
+
+ if (is_mem_based(gimple_assign_rhs1(stmt)))
+ return true;
+
+ return false;
+}
+
+/*
+ * Build a GIMPLE statement for "asm volatile(<barrier_instn> ::: "memory");".
+ */
+static gasm *build_mb_asm(void)
+{
+ vec <tree, va_gc> *clobbers = NULL;
+ gasm *stmt;
+ tree clob = build_tree_list(NULL_TREE, build_const_char_string(7, "memory"));
+
+ vec_safe_push(clobbers, clob);
+ stmt = gimple_build_asm_vec(BARRIER_ASM, NULL, NULL, clobbers, NULL);
+ gimple_asm_set_volatile(stmt, true);
+ return stmt;
+}
+
+static unsigned int insert_barriers_execute(void)
+{
+ basic_block bb;
+ unsigned int i;
+ gimple_stmt_iterator *gsi_p;
+ gimple stmt;
+ gasm *barrier;
+
+ FOR_EACH_BB_FN(bb, cfun) {
+ /*
+ * Collect the iterator positions of all memory-accessing
+ * statements first, then insert. Inserting while iterating
+ * would visit the newly-added asm statements on the next step.
+ */
+ auto_vec <gimple_stmt_iterator> to_instrument;
+
+ for (gimple_stmt_iterator gsi = gsi_start_bb(bb);
+ !gsi_end_p(gsi); gsi_next(&gsi)) {
+ stmt = gsi_stmt(gsi);
+ if (!is_gimple_debug(stmt) && gimple_has_mem_access(stmt))
+ to_instrument.safe_push(gsi);
+ }
+
+ FOR_EACH_VEC_ELT(to_instrument, i, gsi_p) {
+ barrier = build_mb_asm();
+ gsi_insert_after(gsi_p, barrier, GSI_CONTINUE_LINKING);
+ update_stmt(barrier);
+ }
+ }
+ return 0;
+}
+
+#define PASS_NAME insert_barriers
+#define NO_GATE
+#define PROPERTIES_REQUIRED PROP_gimple_any
+
+#include "gcc-generate-gimple-pass.h"
+
+__visible int plugin_init(struct plugin_name_args *plugin_info,
+ struct plugin_gcc_version *version)
+{
+ const char * const plugin_name = plugin_info->base_name;
+ const int argc = plugin_info->argc;
+ const struct plugin_argument * const argv = plugin_info->argv;
+ int i = 0;
+
+ /*
+ * Run before "ssa", the entry to the main GIMPLE optimization pipeline.
+ * At this point no memory-access reordering has occurred yet, so the
+ * inserted barrier statements are seen by
+ * all subsequent passes and act as both compiler and hardware barriers,
+ * exactly like the kernel's smp_mb() macro.
+ */
+ PASS_INFO(insert_barriers, "ssa", 1, PASS_POS_INSERT_BEFORE);
+
+ if (!plugin_default_version_check(version, &gcc_version)) {
+ error(G_("incompatible gcc/plugin versions"));
+ return 1;
+ }
+
+ /* Give the information about the plugin */
+ register_callback(plugin_name, PLUGIN_INFO, NULL,
+ &barriers_plugin_info);
+
+ register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL,
+ &insert_barriers_pass_info);
+
+ return 0;
+}
\ No newline at end of file
--
2.55.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [RFC PATCH] gcc-plugins: Add a plugin to ease debugging of memory ordering bugs
2026-10-18 15:26 [RFC PATCH] gcc-plugins: Add a plugin to ease debugging of memory ordering bugs Gautam Menghani
@ 2026-10-22 16:21 ` kernel test robot
0 siblings, 0 replies; 2+ messages in thread
From: kernel test robot @ 2026-10-22 16:21 UTC (permalink / raw)
To: Gautam Menghani; +Cc: oe-kbuild-all
Hi Gautam,
[This is a private test report for your RFC patch.]
kernel test robot noticed the following build errors:
[auto build test ERROR on kees/for-next/hardening]
[also build test ERROR on v7.3]
[cannot apply to linus/master next-20261021]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Gautam-Menghani/gcc-plugins-Add-a-plugin-to-ease-debugging-of-memory-ordering-bugs/20261018-205606
base: https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening
patch link: https://lore.kernel.org/r/20261018152608.1323494-1-gautam%40linux.ibm.com
patch subject: [RFC PATCH] gcc-plugins: Add a plugin to ease debugging of memory ordering bugs
config: um-allyesconfig (https://download.01.org/0day-ci/archive/20261023/202610230010.G5QozV51-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261023/202610230010.G5QozV51-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202610230010.G5QozV51-lkp@intel.com/
All errors (new ones prefixed by >>):
In file included from <command-line>:
net/core/skbuff.c: In function 'skb_extensions_init':
>> include/linux/compiler_types.h:702:45: error: call to '__compiletime_assert_1377' declared with attribute error: BUILD_BUG_ON failed: skb_ext_total_length() > 255
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^
include/linux/compiler_types.h:683:25: note: in definition of macro '__compiletime_assert'
683 | prefix ## suffix(); \
| ^~~~~~
include/linux/compiler_types.h:702:9: note: in expansion of macro '_compiletime_assert'
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:40:37: note: in expansion of macro 'compiletime_assert'
40 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
| ^~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:51:9: note: in expansion of macro 'BUILD_BUG_ON_MSG'
51 | BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition)
| ^~~~~~~~~~~~~~~~
net/core/skbuff.c:5188:9: note: in expansion of macro 'BUILD_BUG_ON'
5188 | BUILD_BUG_ON(skb_ext_total_length() > 255);
| ^~~~~~~~~~~~
--
In file included from <command-line>:
lib/tests/ffs_kunit.c: In function 'build_test___fls.isra':
>> include/linux/compiler_types.h:702:45: error: call to '__compiletime_assert_246' declared with attribute error: BUILD_BUG_ON failed: init___fls < 32
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^
include/linux/compiler_types.h:683:25: note: in definition of macro '__compiletime_assert'
683 | prefix ## suffix(); \
| ^~~~~~
include/linux/compiler_types.h:702:9: note: in expansion of macro '_compiletime_assert'
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:40:37: note: in expansion of macro 'compiletime_assert'
40 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
| ^~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:51:9: note: in expansion of macro 'BUILD_BUG_ON_MSG'
51 | BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition)
| ^~~~~~~~~~~~~~~~
lib/tests/ffs_kunit.c:510:9: note: in expansion of macro 'BUILD_BUG_ON'
510 | BUILD_BUG_ON(init_##func < 32); \
| ^~~~~~~~~~~~
lib/tests/ffs_kunit.c:521:1: note: in expansion of macro 'CREATE_WRAPPER'
521 | CREATE_WRAPPER(__fls)
| ^~~~~~~~~~~~~~
lib/tests/ffs_kunit.c: In function 'build_test_fls.isra':
>> include/linux/compiler_types.h:702:45: error: call to '__compiletime_assert_244' declared with attribute error: BUILD_BUG_ON failed: init_fls < 32
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^
include/linux/compiler_types.h:683:25: note: in definition of macro '__compiletime_assert'
683 | prefix ## suffix(); \
| ^~~~~~
include/linux/compiler_types.h:702:9: note: in expansion of macro '_compiletime_assert'
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:40:37: note: in expansion of macro 'compiletime_assert'
40 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
| ^~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:51:9: note: in expansion of macro 'BUILD_BUG_ON_MSG'
51 | BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition)
| ^~~~~~~~~~~~~~~~
lib/tests/ffs_kunit.c:510:9: note: in expansion of macro 'BUILD_BUG_ON'
510 | BUILD_BUG_ON(init_##func < 32); \
| ^~~~~~~~~~~~
lib/tests/ffs_kunit.c:519:1: note: in expansion of macro 'CREATE_WRAPPER'
519 | CREATE_WRAPPER(fls)
| ^~~~~~~~~~~~~~
--
In file included from <command-line>:
drivers/vfio/pci/virtio/legacy_io.c: In function 'virtiovf_init_legacy_io':
>> include/linux/compiler_types.h:702:45: error: call to '__compiletime_assert_1024' declared with attribute error: BUILD_BUG_ON failed: !is_power_of_2(virtvdev->bar0_virtual_buf_size)
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^
include/linux/compiler_types.h:683:25: note: in definition of macro '__compiletime_assert'
683 | prefix ## suffix(); \
| ^~~~~~
include/linux/compiler_types.h:702:9: note: in expansion of macro '_compiletime_assert'
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:40:37: note: in expansion of macro 'compiletime_assert'
40 | #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
| ^~~~~~~~~~~~~~~~~~
include/linux/build_bug.h:51:9: note: in expansion of macro 'BUILD_BUG_ON_MSG'
51 | BUILD_BUG_ON_MSG(condition, "BUILD_BUG_ON failed: " #condition)
| ^~~~~~~~~~~~~~~~
drivers/vfio/pci/virtio/legacy_io.c:377:9: note: in expansion of macro 'BUILD_BUG_ON'
377 | BUILD_BUG_ON(!is_power_of_2(virtvdev->bar0_virtual_buf_size));
| ^~~~~~~~~~~~
vim +/__compiletime_assert_1377 +702 include/linux/compiler_types.h
eb5c2d4b45e3d2 Will Deacon 2020-07-21 688
eb5c2d4b45e3d2 Will Deacon 2020-07-21 689 #define _compiletime_assert(condition, msg, prefix, suffix) \
eb5c2d4b45e3d2 Will Deacon 2020-07-21 690 __compiletime_assert(condition, msg, prefix, suffix)
eb5c2d4b45e3d2 Will Deacon 2020-07-21 691
eb5c2d4b45e3d2 Will Deacon 2020-07-21 692 /**
eb5c2d4b45e3d2 Will Deacon 2020-07-21 693 * compiletime_assert - break build and emit msg if condition is false
eb5c2d4b45e3d2 Will Deacon 2020-07-21 694 * @condition: a compile-time constant condition to check
eb5c2d4b45e3d2 Will Deacon 2020-07-21 695 * @msg: a message to emit if condition is false
eb5c2d4b45e3d2 Will Deacon 2020-07-21 696 *
eb5c2d4b45e3d2 Will Deacon 2020-07-21 697 * In tradition of POSIX assert, this macro will break the build if the
eb5c2d4b45e3d2 Will Deacon 2020-07-21 698 * supplied condition is *false*, emitting the supplied error message if the
eb5c2d4b45e3d2 Will Deacon 2020-07-21 699 * compiler has support to do so.
eb5c2d4b45e3d2 Will Deacon 2020-07-21 700 */
eb5c2d4b45e3d2 Will Deacon 2020-07-21 701 #define compiletime_assert(condition, msg) \
eb5c2d4b45e3d2 Will Deacon 2020-07-21 @702 _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
eb5c2d4b45e3d2 Will Deacon 2020-07-21 703
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-22 16:23 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-18 15:26 [RFC PATCH] gcc-plugins: Add a plugin to ease debugging of memory ordering bugs Gautam Menghani
2026-10-22 16:21 ` kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.