]>
Commit | Line | Data |
---|---|---|
dfd402a4 ME |
1 | # SPDX-License-Identifier: GPL-2.0-only |
2 | ||
3 | config HAVE_ARCH_KCSAN | |
4 | bool | |
5 | ||
0e1aa5b6 | 6 | config HAVE_KCSAN_COMPILER |
e68dcd8e ME |
7 | def_bool (CC_IS_CLANG && $(cc-option,-fsanitize=thread -mllvm -tsan-distinguish-volatile=1)) || \ |
8 | (CC_IS_GCC && $(cc-option,-fsanitize=thread --param tsan-distinguish-volatile=1)) | |
0e1aa5b6 ME |
9 | help |
10 | For the list of compilers that support KCSAN, please see | |
11 | <file:Documentation/dev-tools/kcsan.rst>. | |
12 | ||
ea91a1d4 AB |
13 | config KCSAN_KCOV_BROKEN |
14 | def_bool KCOV && CC_HAS_SANCOV_TRACE_PC | |
15 | depends on CC_IS_CLANG | |
16 | depends on !$(cc-option,-Werror=unused-command-line-argument -fsanitize=thread -fsanitize-coverage=trace-pc) | |
17 | help | |
18 | Some versions of clang support either KCSAN and KCOV but not the | |
19 | combination of the two. | |
20 | See https://bugs.llvm.org/show_bug.cgi?id=45831 for the status | |
21 | in newer releases. | |
22 | ||
dfd402a4 | 23 | menuconfig KCSAN |
eba9c444 | 24 | bool "KCSAN: dynamic data race detector" |
0e1aa5b6 ME |
25 | depends on HAVE_ARCH_KCSAN && HAVE_KCSAN_COMPILER |
26 | depends on DEBUG_KERNEL && !KASAN | |
ea91a1d4 | 27 | depends on !KCSAN_KCOV_BROKEN |
8cfbb04f | 28 | select STACKTRACE |
dfd402a4 | 29 | help |
eba9c444 IM |
30 | The Kernel Concurrency Sanitizer (KCSAN) is a dynamic |
31 | data-race detector that relies on compile-time instrumentation. | |
32 | KCSAN uses a watchpoint-based sampling approach to detect races. | |
d591ec3d | 33 | |
eba9c444 IM |
34 | While KCSAN's primary purpose is to detect data races, it |
35 | also provides assertions to check data access constraints. | |
36 | These assertions can expose bugs that do not manifest as | |
37 | data races. | |
8cfbb04f ME |
38 | |
39 | See <file:Documentation/dev-tools/kcsan.rst> for more details. | |
dfd402a4 ME |
40 | |
41 | if KCSAN | |
42 | ||
2402d0ea ME |
43 | config KCSAN_VERBOSE |
44 | bool "Show verbose reports with more information about system state" | |
45 | depends on PROVE_LOCKING | |
46 | help | |
47 | If enabled, reports show more information about the system state that | |
48 | may help better analyze and debug races. This includes held locks and | |
49 | IRQ trace events. | |
50 | ||
51 | While this option should generally be benign, we call into more | |
52 | external functions on report generation; if a race report is | |
53 | generated from any one of them, system stability may suffer due to | |
54 | deadlocks or recursion. If in doubt, say N. | |
55 | ||
dfd402a4 ME |
56 | config KCSAN_DEBUG |
57 | bool "Debugging of KCSAN internals" | |
dfd402a4 ME |
58 | |
59 | config KCSAN_SELFTEST | |
60 | bool "Perform short selftests on boot" | |
61 | default y | |
62 | help | |
1fe84fd4 ME |
63 | Run KCSAN selftests on boot. On test failure, causes the kernel to |
64 | panic. Recommended to be enabled, ensuring critical functionality | |
65 | works as intended. | |
66 | ||
67 | config KCSAN_TEST | |
68 | tristate "KCSAN test for integrated runtime behaviour" | |
69 | depends on TRACEPOINTS && KUNIT | |
70 | select TORTURE_TEST | |
71 | help | |
72 | KCSAN test focusing on behaviour of the integrated runtime. Tests | |
73 | various race scenarios, and verifies the reports generated to | |
74 | console. Makes use of KUnit for test organization, and the Torture | |
75 | framework for test thread control. | |
76 | ||
77 | Each test case may run at least up to KCSAN_REPORT_ONCE_IN_MS | |
78 | milliseconds. Test run duration may be optimized by building the | |
79 | kernel and KCSAN test with KCSAN_REPORT_ONCE_IN_MS set to a lower | |
80 | than default value. | |
81 | ||
82 | Say Y here if you want the test to be built into the kernel and run | |
83 | during boot; say M if you want the test to build as a module; say N | |
84 | if you are unsure. | |
dfd402a4 ME |
85 | |
86 | config KCSAN_EARLY_ENABLE | |
87 | bool "Early enable during boot" | |
88 | default y | |
89 | help | |
90 | If KCSAN should be enabled globally as soon as possible. KCSAN can | |
91 | later be enabled/disabled via debugfs. | |
92 | ||
93 | config KCSAN_NUM_WATCHPOINTS | |
94 | int "Number of available watchpoints" | |
95 | default 64 | |
96 | help | |
97 | Total number of available watchpoints. An address range maps into a | |
98 | specific watchpoint slot as specified in kernel/kcsan/encoding.h. | |
99 | Although larger number of watchpoints may not be usable due to | |
100 | limited number of CPUs, a larger value helps to improve performance | |
101 | due to reducing cache-line contention. The chosen default is a | |
102 | conservative value; we should almost never observe "no_capacity" | |
103 | events (see /sys/kernel/debug/kcsan). | |
104 | ||
105 | config KCSAN_UDELAY_TASK | |
106 | int "Delay in microseconds (for tasks)" | |
107 | default 80 | |
108 | help | |
109 | For tasks, the microsecond delay after setting up a watchpoint. | |
110 | ||
111 | config KCSAN_UDELAY_INTERRUPT | |
112 | int "Delay in microseconds (for interrupts)" | |
113 | default 20 | |
114 | help | |
115 | For interrupts, the microsecond delay after setting up a watchpoint. | |
116 | Interrupts have tighter latency requirements, and their delay should | |
117 | be lower than for tasks. | |
118 | ||
119 | config KCSAN_DELAY_RANDOMIZE | |
120 | bool "Randomize above delays" | |
121 | default y | |
122 | help | |
123 | If delays should be randomized, where the maximum is KCSAN_UDELAY_*. | |
5cbaefe9 IM |
124 | If false, the chosen delays are always the KCSAN_UDELAY_* values |
125 | as defined above. | |
dfd402a4 ME |
126 | |
127 | config KCSAN_SKIP_WATCH | |
128 | int "Skip instructions before setting up watchpoint" | |
129 | default 4000 | |
130 | help | |
131 | The number of per-CPU memory operations to skip, before another | |
132 | watchpoint is set up, i.e. one in KCSAN_WATCH_SKIP per-CPU | |
133 | memory operations are used to set up a watchpoint. A smaller value | |
134 | results in more aggressive race detection, whereas a larger value | |
135 | improves system performance at the cost of missing some races. | |
136 | ||
137 | config KCSAN_SKIP_WATCH_RANDOMIZE | |
138 | bool "Randomize watchpoint instruction skip count" | |
139 | default y | |
140 | help | |
141 | If instruction skip count should be randomized, where the maximum is | |
142 | KCSAN_WATCH_SKIP. If false, the chosen value is always | |
143 | KCSAN_WATCH_SKIP. | |
144 | ||
48b1fc19 ME |
145 | config KCSAN_INTERRUPT_WATCHER |
146 | bool "Interruptible watchers" | |
147 | help | |
148 | If enabled, a task that set up a watchpoint may be interrupted while | |
149 | delayed. This option will allow KCSAN to detect races between | |
150 | interrupted tasks and other threads of execution on the same CPU. | |
151 | ||
152 | Currently disabled by default, because not all safe per-CPU access | |
153 | primitives and patterns may be accounted for, and therefore could | |
154 | result in false positives. | |
155 | ||
05f9a406 | 156 | config KCSAN_REPORT_ONCE_IN_MS |
d591ec3d | 157 | int "Duration in milliseconds, in which any given race is only reported once" |
05f9a406 ME |
158 | default 3000 |
159 | help | |
d591ec3d ME |
160 | Any given race is only reported once in the defined time window. |
161 | Different races may still generate reports within a duration that is | |
162 | smaller than the duration defined here. This allows rate limiting | |
163 | reporting to avoid flooding the console with reports. Setting this | |
164 | to 0 disables rate limiting. | |
05f9a406 | 165 | |
1e6ee2f0 ME |
166 | # The main purpose of the below options is to control reported data races (e.g. |
167 | # in fuzzer configs), and are not expected to be switched frequently by other | |
168 | # users. We could turn some of them into boot parameters, but given they should | |
169 | # not be switched normally, let's keep them here to simplify configuration. | |
170 | # | |
171 | # The defaults below are chosen to be very conservative, and may miss certain | |
172 | # bugs. | |
dfd402a4 ME |
173 | |
174 | config KCSAN_REPORT_RACE_UNKNOWN_ORIGIN | |
175 | bool "Report races of unknown origin" | |
176 | default y | |
177 | help | |
178 | If KCSAN should report races where only one access is known, and the | |
179 | conflicting access is of unknown origin. This type of race is | |
180 | reported if it was only possible to infer a race due to a data value | |
181 | change while an access is being delayed on a watchpoint. | |
182 | ||
183 | config KCSAN_REPORT_VALUE_CHANGE_ONLY | |
184 | bool "Only report races where watcher observed a data value change" | |
185 | default y | |
186 | help | |
5cbaefe9 | 187 | If enabled and a conflicting write is observed via a watchpoint, but |
dfd402a4 ME |
188 | the data value of the memory location was observed to remain |
189 | unchanged, do not report the data race. | |
190 | ||
1e6ee2f0 ME |
191 | config KCSAN_ASSUME_PLAIN_WRITES_ATOMIC |
192 | bool "Assume that plain aligned writes up to word size are atomic" | |
193 | default y | |
194 | help | |
195 | Assume that plain aligned writes up to word size are atomic by | |
196 | default, and also not subject to other unsafe compiler optimizations | |
197 | resulting in data races. This will cause KCSAN to not report data | |
198 | races due to conflicts where the only plain accesses are aligned | |
199 | writes up to word size: conflicts between marked reads and plain | |
200 | aligned writes up to word size will not be reported as data races; | |
201 | notice that data races between two conflicting plain aligned writes | |
202 | will also not be reported. | |
203 | ||
dfd402a4 ME |
204 | config KCSAN_IGNORE_ATOMICS |
205 | bool "Do not instrument marked atomic accesses" | |
dfd402a4 | 206 | help |
a249a732 ME |
207 | Never instrument marked atomic accesses. This option can be used for |
208 | additional filtering. Conflicting marked atomic reads and plain | |
209 | writes will never be reported as a data race, however, will cause | |
210 | plain reads and marked writes to result in "unknown origin" reports. | |
211 | If combined with CONFIG_KCSAN_REPORT_RACE_UNKNOWN_ORIGIN=n, data | |
212 | races where at least one access is marked atomic will never be | |
213 | reported. | |
214 | ||
215 | Similar to KCSAN_ASSUME_PLAIN_WRITES_ATOMIC, but including unaligned | |
216 | accesses, conflicting marked atomic reads and plain writes will not | |
217 | be reported as data races; however, unlike that option, data races | |
218 | due to two conflicting plain writes will be reported (aligned and | |
219 | unaligned, if CONFIG_KCSAN_ASSUME_PLAIN_WRITES_ATOMIC=n). | |
dfd402a4 ME |
220 | |
221 | endif # KCSAN |