Commit | Line | Data |
---|---|---|
dfd402a4 ME |
1 | # SPDX-License-Identifier: GPL-2.0-only |
2 | ||
3 | config HAVE_ARCH_KCSAN | |
4 | bool | |
5 | ||
0e1aa5b6 | 6 | config HAVE_KCSAN_COMPILER |
e68dcd8e ME |
7 | def_bool (CC_IS_CLANG && $(cc-option,-fsanitize=thread -mllvm -tsan-distinguish-volatile=1)) || \ |
8 | (CC_IS_GCC && $(cc-option,-fsanitize=thread --param tsan-distinguish-volatile=1)) | |
0e1aa5b6 ME |
9 | help |
10 | For the list of compilers that support KCSAN, please see | |
11 | <file:Documentation/dev-tools/kcsan.rst>. | |
12 | ||
ea91a1d4 AB |
13 | config KCSAN_KCOV_BROKEN |
14 | def_bool KCOV && CC_HAS_SANCOV_TRACE_PC | |
15 | depends on CC_IS_CLANG | |
16 | depends on !$(cc-option,-Werror=unused-command-line-argument -fsanitize=thread -fsanitize-coverage=trace-pc) | |
17 | help | |
18 | Some versions of clang support either KCSAN and KCOV but not the | |
19 | combination of the two. | |
20 | See https://bugs.llvm.org/show_bug.cgi?id=45831 for the status | |
21 | in newer releases. | |
22 | ||
dfd402a4 | 23 | menuconfig KCSAN |
eba9c444 | 24 | bool "KCSAN: dynamic data race detector" |
0e1aa5b6 ME |
25 | depends on HAVE_ARCH_KCSAN && HAVE_KCSAN_COMPILER |
26 | depends on DEBUG_KERNEL && !KASAN | |
ea91a1d4 | 27 | depends on !KCSAN_KCOV_BROKEN |
8cfbb04f | 28 | select STACKTRACE |
dfd402a4 | 29 | help |
eba9c444 IM |
30 | The Kernel Concurrency Sanitizer (KCSAN) is a dynamic |
31 | data-race detector that relies on compile-time instrumentation. | |
32 | KCSAN uses a watchpoint-based sampling approach to detect races. | |
d591ec3d | 33 | |
eba9c444 IM |
34 | While KCSAN's primary purpose is to detect data races, it |
35 | also provides assertions to check data access constraints. | |
36 | These assertions can expose bugs that do not manifest as | |
37 | data races. | |
8cfbb04f ME |
38 | |
39 | See <file:Documentation/dev-tools/kcsan.rst> for more details. | |
dfd402a4 ME |
40 | |
41 | if KCSAN | |
42 | ||
bec4a247 ME |
43 | # Compiler capabilities that should not fail the test if they are unavailable. |
44 | config CC_HAS_TSAN_COMPOUND_READ_BEFORE_WRITE | |
45 | def_bool (CC_IS_CLANG && $(cc-option,-fsanitize=thread -mllvm -tsan-compound-read-before-write=1)) || \ | |
46 | (CC_IS_GCC && $(cc-option,-fsanitize=thread --param tsan-compound-read-before-write=1)) | |
47 | ||
2402d0ea ME |
48 | config KCSAN_VERBOSE |
49 | bool "Show verbose reports with more information about system state" | |
50 | depends on PROVE_LOCKING | |
51 | help | |
52 | If enabled, reports show more information about the system state that | |
53 | may help better analyze and debug races. This includes held locks and | |
54 | IRQ trace events. | |
55 | ||
56 | While this option should generally be benign, we call into more | |
57 | external functions on report generation; if a race report is | |
58 | generated from any one of them, system stability may suffer due to | |
59 | deadlocks or recursion. If in doubt, say N. | |
60 | ||
dfd402a4 ME |
61 | config KCSAN_DEBUG |
62 | bool "Debugging of KCSAN internals" | |
dfd402a4 ME |
63 | |
64 | config KCSAN_SELFTEST | |
65 | bool "Perform short selftests on boot" | |
66 | default y | |
67 | help | |
1fe84fd4 ME |
68 | Run KCSAN selftests on boot. On test failure, causes the kernel to |
69 | panic. Recommended to be enabled, ensuring critical functionality | |
70 | works as intended. | |
71 | ||
72 | config KCSAN_TEST | |
73 | tristate "KCSAN test for integrated runtime behaviour" | |
74 | depends on TRACEPOINTS && KUNIT | |
75 | select TORTURE_TEST | |
76 | help | |
77 | KCSAN test focusing on behaviour of the integrated runtime. Tests | |
78 | various race scenarios, and verifies the reports generated to | |
79 | console. Makes use of KUnit for test organization, and the Torture | |
80 | framework for test thread control. | |
81 | ||
82 | Each test case may run at least up to KCSAN_REPORT_ONCE_IN_MS | |
83 | milliseconds. Test run duration may be optimized by building the | |
84 | kernel and KCSAN test with KCSAN_REPORT_ONCE_IN_MS set to a lower | |
85 | than default value. | |
86 | ||
87 | Say Y here if you want the test to be built into the kernel and run | |
88 | during boot; say M if you want the test to build as a module; say N | |
89 | if you are unsure. | |
dfd402a4 ME |
90 | |
91 | config KCSAN_EARLY_ENABLE | |
92 | bool "Early enable during boot" | |
93 | default y | |
94 | help | |
95 | If KCSAN should be enabled globally as soon as possible. KCSAN can | |
96 | later be enabled/disabled via debugfs. | |
97 | ||
98 | config KCSAN_NUM_WATCHPOINTS | |
99 | int "Number of available watchpoints" | |
100 | default 64 | |
101 | help | |
102 | Total number of available watchpoints. An address range maps into a | |
103 | specific watchpoint slot as specified in kernel/kcsan/encoding.h. | |
104 | Although larger number of watchpoints may not be usable due to | |
105 | limited number of CPUs, a larger value helps to improve performance | |
106 | due to reducing cache-line contention. The chosen default is a | |
107 | conservative value; we should almost never observe "no_capacity" | |
108 | events (see /sys/kernel/debug/kcsan). | |
109 | ||
110 | config KCSAN_UDELAY_TASK | |
111 | int "Delay in microseconds (for tasks)" | |
112 | default 80 | |
113 | help | |
114 | For tasks, the microsecond delay after setting up a watchpoint. | |
115 | ||
116 | config KCSAN_UDELAY_INTERRUPT | |
117 | int "Delay in microseconds (for interrupts)" | |
118 | default 20 | |
119 | help | |
120 | For interrupts, the microsecond delay after setting up a watchpoint. | |
121 | Interrupts have tighter latency requirements, and their delay should | |
122 | be lower than for tasks. | |
123 | ||
124 | config KCSAN_DELAY_RANDOMIZE | |
125 | bool "Randomize above delays" | |
126 | default y | |
127 | help | |
128 | If delays should be randomized, where the maximum is KCSAN_UDELAY_*. | |
5cbaefe9 IM |
129 | If false, the chosen delays are always the KCSAN_UDELAY_* values |
130 | as defined above. | |
dfd402a4 ME |
131 | |
132 | config KCSAN_SKIP_WATCH | |
133 | int "Skip instructions before setting up watchpoint" | |
134 | default 4000 | |
135 | help | |
136 | The number of per-CPU memory operations to skip, before another | |
137 | watchpoint is set up, i.e. one in KCSAN_WATCH_SKIP per-CPU | |
138 | memory operations are used to set up a watchpoint. A smaller value | |
139 | results in more aggressive race detection, whereas a larger value | |
140 | improves system performance at the cost of missing some races. | |
141 | ||
142 | config KCSAN_SKIP_WATCH_RANDOMIZE | |
143 | bool "Randomize watchpoint instruction skip count" | |
144 | default y | |
145 | help | |
146 | If instruction skip count should be randomized, where the maximum is | |
147 | KCSAN_WATCH_SKIP. If false, the chosen value is always | |
148 | KCSAN_WATCH_SKIP. | |
149 | ||
48b1fc19 ME |
150 | config KCSAN_INTERRUPT_WATCHER |
151 | bool "Interruptible watchers" | |
152 | help | |
153 | If enabled, a task that set up a watchpoint may be interrupted while | |
154 | delayed. This option will allow KCSAN to detect races between | |
155 | interrupted tasks and other threads of execution on the same CPU. | |
156 | ||
157 | Currently disabled by default, because not all safe per-CPU access | |
158 | primitives and patterns may be accounted for, and therefore could | |
159 | result in false positives. | |
160 | ||
05f9a406 | 161 | config KCSAN_REPORT_ONCE_IN_MS |
d591ec3d | 162 | int "Duration in milliseconds, in which any given race is only reported once" |
05f9a406 ME |
163 | default 3000 |
164 | help | |
d591ec3d ME |
165 | Any given race is only reported once in the defined time window. |
166 | Different races may still generate reports within a duration that is | |
167 | smaller than the duration defined here. This allows rate limiting | |
168 | reporting to avoid flooding the console with reports. Setting this | |
169 | to 0 disables rate limiting. | |
05f9a406 | 170 | |
1e6ee2f0 ME |
171 | # The main purpose of the below options is to control reported data races (e.g. |
172 | # in fuzzer configs), and are not expected to be switched frequently by other | |
173 | # users. We could turn some of them into boot parameters, but given they should | |
174 | # not be switched normally, let's keep them here to simplify configuration. | |
175 | # | |
176 | # The defaults below are chosen to be very conservative, and may miss certain | |
177 | # bugs. | |
dfd402a4 ME |
178 | |
179 | config KCSAN_REPORT_RACE_UNKNOWN_ORIGIN | |
180 | bool "Report races of unknown origin" | |
181 | default y | |
182 | help | |
183 | If KCSAN should report races where only one access is known, and the | |
184 | conflicting access is of unknown origin. This type of race is | |
185 | reported if it was only possible to infer a race due to a data value | |
186 | change while an access is being delayed on a watchpoint. | |
187 | ||
188 | config KCSAN_REPORT_VALUE_CHANGE_ONLY | |
189 | bool "Only report races where watcher observed a data value change" | |
190 | default y | |
191 | help | |
5cbaefe9 | 192 | If enabled and a conflicting write is observed via a watchpoint, but |
dfd402a4 ME |
193 | the data value of the memory location was observed to remain |
194 | unchanged, do not report the data race. | |
195 | ||
1e6ee2f0 ME |
196 | config KCSAN_ASSUME_PLAIN_WRITES_ATOMIC |
197 | bool "Assume that plain aligned writes up to word size are atomic" | |
198 | default y | |
199 | help | |
200 | Assume that plain aligned writes up to word size are atomic by | |
201 | default, and also not subject to other unsafe compiler optimizations | |
202 | resulting in data races. This will cause KCSAN to not report data | |
203 | races due to conflicts where the only plain accesses are aligned | |
204 | writes up to word size: conflicts between marked reads and plain | |
205 | aligned writes up to word size will not be reported as data races; | |
206 | notice that data races between two conflicting plain aligned writes | |
207 | will also not be reported. | |
208 | ||
dfd402a4 ME |
209 | config KCSAN_IGNORE_ATOMICS |
210 | bool "Do not instrument marked atomic accesses" | |
dfd402a4 | 211 | help |
a249a732 ME |
212 | Never instrument marked atomic accesses. This option can be used for |
213 | additional filtering. Conflicting marked atomic reads and plain | |
214 | writes will never be reported as a data race, however, will cause | |
215 | plain reads and marked writes to result in "unknown origin" reports. | |
216 | If combined with CONFIG_KCSAN_REPORT_RACE_UNKNOWN_ORIGIN=n, data | |
217 | races where at least one access is marked atomic will never be | |
218 | reported. | |
219 | ||
220 | Similar to KCSAN_ASSUME_PLAIN_WRITES_ATOMIC, but including unaligned | |
221 | accesses, conflicting marked atomic reads and plain writes will not | |
222 | be reported as data races; however, unlike that option, data races | |
223 | due to two conflicting plain writes will be reported (aligned and | |
224 | unaligned, if CONFIG_KCSAN_ASSUME_PLAIN_WRITES_ATOMIC=n). | |
dfd402a4 ME |
225 | |
226 | endif # KCSAN |