0001 # SPDX-License-Identifier: GPL-2.0-only
0002
0003 config HAVE_ARCH_KCSAN
0004 bool
0005
0006 config HAVE_KCSAN_COMPILER
0007 def_bool (CC_IS_CLANG && $(cc-option,-fsanitize=thread -mllvm -tsan-distinguish-volatile=1)) || \
0008 (CC_IS_GCC && $(cc-option,-fsanitize=thread --param tsan-distinguish-volatile=1))
0009 help
0010 For the list of compilers that support KCSAN, please see
0011 <file:Documentation/dev-tools/kcsan.rst>.
0012
0013 menuconfig KCSAN
0014 bool "KCSAN: dynamic data race detector"
0015 depends on HAVE_ARCH_KCSAN && HAVE_KCSAN_COMPILER
0016 depends on DEBUG_KERNEL && !KASAN
0017 select STACKTRACE
0018 help
0019 The Kernel Concurrency Sanitizer (KCSAN) is a dynamic
0020 data-race detector that relies on compile-time instrumentation.
0021 KCSAN uses a watchpoint-based sampling approach to detect races.
0022
0023 While KCSAN's primary purpose is to detect data races, it
0024 also provides assertions to check data access constraints.
0025 These assertions can expose bugs that do not manifest as
0026 data races.
0027
0028 See <file:Documentation/dev-tools/kcsan.rst> for more details.
0029
0030 if KCSAN
0031
0032 config CC_HAS_TSAN_COMPOUND_READ_BEFORE_WRITE
0033 def_bool (CC_IS_CLANG && $(cc-option,-fsanitize=thread -mllvm -tsan-compound-read-before-write=1)) || \
0034 (CC_IS_GCC && $(cc-option,-fsanitize=thread --param tsan-compound-read-before-write=1))
0035 help
0036 The compiler instruments plain compound read-write operations
0037 differently (++, --, +=, -=, |=, &=, etc.), which allows KCSAN to
0038 distinguish them from other plain accesses. This is currently
0039 supported by Clang 12 or later.
0040
0041 config KCSAN_VERBOSE
0042 bool "Show verbose reports with more information about system state"
0043 depends on PROVE_LOCKING
0044 help
0045 If enabled, reports show more information about the system state that
0046 may help better analyze and debug races. This includes held locks and
0047 IRQ trace events.
0048
0049 While this option should generally be benign, we call into more
0050 external functions on report generation; if a race report is
0051 generated from any one of them, system stability may suffer due to
0052 deadlocks or recursion. If in doubt, say N.
0053
0054 config KCSAN_SELFTEST
0055 bool "Perform short selftests on boot"
0056 default y
0057 help
0058 Run KCSAN selftests on boot. On test failure, causes the kernel to
0059 panic. Recommended to be enabled, ensuring critical functionality
0060 works as intended.
0061
0062 config KCSAN_KUNIT_TEST
0063 tristate "KCSAN test for integrated runtime behaviour" if !KUNIT_ALL_TESTS
0064 default KUNIT_ALL_TESTS
0065 depends on TRACEPOINTS && KUNIT
0066 select TORTURE_TEST
0067 help
0068 KCSAN test focusing on behaviour of the integrated runtime. Tests
0069 various race scenarios, and verifies the reports generated to
0070 console. Makes use of KUnit for test organization, and the Torture
0071 framework for test thread control.
0072
0073 Each test case may run at least up to KCSAN_REPORT_ONCE_IN_MS
0074 milliseconds. Test run duration may be optimized by building the
0075 kernel and KCSAN test with KCSAN_REPORT_ONCE_IN_MS set to a lower
0076 than default value.
0077
0078 Say Y here if you want the test to be built into the kernel and run
0079 during boot; say M if you want the test to build as a module; say N
0080 if you are unsure.
0081
0082 config KCSAN_EARLY_ENABLE
0083 bool "Early enable during boot"
0084 default y
0085 help
0086 If KCSAN should be enabled globally as soon as possible. KCSAN can
0087 later be enabled/disabled via debugfs.
0088
0089 config KCSAN_NUM_WATCHPOINTS
0090 int "Number of available watchpoints"
0091 default 64
0092 help
0093 Total number of available watchpoints. An address range maps into a
0094 specific watchpoint slot as specified in kernel/kcsan/encoding.h.
0095 Although larger number of watchpoints may not be usable due to
0096 limited number of CPUs, a larger value helps to improve performance
0097 due to reducing cache-line contention. The chosen default is a
0098 conservative value; we should almost never observe "no_capacity"
0099 events (see /sys/kernel/debug/kcsan).
0100
0101 config KCSAN_UDELAY_TASK
0102 int "Delay in microseconds (for tasks)"
0103 default 80
0104 help
0105 For tasks, the microsecond delay after setting up a watchpoint.
0106
0107 config KCSAN_UDELAY_INTERRUPT
0108 int "Delay in microseconds (for interrupts)"
0109 default 20
0110 help
0111 For interrupts, the microsecond delay after setting up a watchpoint.
0112 Interrupts have tighter latency requirements, and their delay should
0113 be lower than for tasks.
0114
0115 config KCSAN_DELAY_RANDOMIZE
0116 bool "Randomize above delays"
0117 default y
0118 help
0119 If delays should be randomized, where the maximum is KCSAN_UDELAY_*.
0120 If false, the chosen delays are always the KCSAN_UDELAY_* values
0121 as defined above.
0122
0123 config KCSAN_SKIP_WATCH
0124 int "Skip instructions before setting up watchpoint"
0125 default 4000
0126 help
0127 The number of per-CPU memory operations to skip, before another
0128 watchpoint is set up, i.e. one in KCSAN_WATCH_SKIP per-CPU
0129 memory operations are used to set up a watchpoint. A smaller value
0130 results in more aggressive race detection, whereas a larger value
0131 improves system performance at the cost of missing some races.
0132
0133 config KCSAN_SKIP_WATCH_RANDOMIZE
0134 bool "Randomize watchpoint instruction skip count"
0135 default y
0136 help
0137 If instruction skip count should be randomized, where the maximum is
0138 KCSAN_WATCH_SKIP. If false, the chosen value is always
0139 KCSAN_WATCH_SKIP.
0140
0141 config KCSAN_INTERRUPT_WATCHER
0142 bool "Interruptible watchers" if !KCSAN_STRICT
0143 default KCSAN_STRICT
0144 help
0145 If enabled, a task that set up a watchpoint may be interrupted while
0146 delayed. This option will allow KCSAN to detect races between
0147 interrupted tasks and other threads of execution on the same CPU.
0148
0149 Currently disabled by default, because not all safe per-CPU access
0150 primitives and patterns may be accounted for, and therefore could
0151 result in false positives.
0152
0153 config KCSAN_REPORT_ONCE_IN_MS
0154 int "Duration in milliseconds, in which any given race is only reported once"
0155 default 3000
0156 help
0157 Any given race is only reported once in the defined time window.
0158 Different races may still generate reports within a duration that is
0159 smaller than the duration defined here. This allows rate limiting
0160 reporting to avoid flooding the console with reports. Setting this
0161 to 0 disables rate limiting.
0162
0163 # The main purpose of the below options is to control reported data races, and
0164 # are not expected to be switched frequently by non-testers or at runtime.
0165 # The defaults are chosen to be conservative, and can miss certain bugs.
0166
0167 config KCSAN_REPORT_RACE_UNKNOWN_ORIGIN
0168 bool "Report races of unknown origin"
0169 default y
0170 help
0171 If KCSAN should report races where only one access is known, and the
0172 conflicting access is of unknown origin. This type of race is
0173 reported if it was only possible to infer a race due to a data value
0174 change while an access is being delayed on a watchpoint.
0175
0176 config KCSAN_STRICT
0177 bool "Strict data-race checking"
0178 help
0179 KCSAN will report data races with the strictest possible rules, which
0180 closely aligns with the rules defined by the Linux-kernel memory
0181 consistency model (LKMM).
0182
0183 config KCSAN_WEAK_MEMORY
0184 bool "Enable weak memory modeling to detect missing memory barriers"
0185 default y
0186 depends on KCSAN_STRICT
0187 # We can either let objtool nop __tsan_func_{entry,exit}() and builtin
0188 # atomics instrumentation in .noinstr.text, or use a compiler that can
0189 # implement __no_kcsan to really remove all instrumentation.
0190 depends on !ARCH_WANTS_NO_INSTR || HAVE_NOINSTR_HACK || \
0191 CC_IS_GCC || CLANG_VERSION >= 140000
0192 select OBJTOOL if HAVE_NOINSTR_HACK
0193 help
0194 Enable support for modeling a subset of weak memory, which allows
0195 detecting a subset of data races due to missing memory barriers.
0196
0197 Depends on KCSAN_STRICT, because the options strenghtening certain
0198 plain accesses by default (depending on !KCSAN_STRICT) reduce the
0199 ability to detect any data races invoving reordered accesses, in
0200 particular reordered writes.
0201
0202 Weak memory modeling relies on additional instrumentation and may
0203 affect performance.
0204
0205 config KCSAN_REPORT_VALUE_CHANGE_ONLY
0206 bool "Only report races where watcher observed a data value change"
0207 default y
0208 depends on !KCSAN_STRICT
0209 help
0210 If enabled and a conflicting write is observed via a watchpoint, but
0211 the data value of the memory location was observed to remain
0212 unchanged, do not report the data race.
0213
0214 config KCSAN_ASSUME_PLAIN_WRITES_ATOMIC
0215 bool "Assume that plain aligned writes up to word size are atomic"
0216 default y
0217 depends on !KCSAN_STRICT
0218 help
0219 Assume that plain aligned writes up to word size are atomic by
0220 default, and also not subject to other unsafe compiler optimizations
0221 resulting in data races. This will cause KCSAN to not report data
0222 races due to conflicts where the only plain accesses are aligned
0223 writes up to word size: conflicts between marked reads and plain
0224 aligned writes up to word size will not be reported as data races;
0225 notice that data races between two conflicting plain aligned writes
0226 will also not be reported.
0227
0228 config KCSAN_IGNORE_ATOMICS
0229 bool "Do not instrument marked atomic accesses"
0230 depends on !KCSAN_STRICT
0231 help
0232 Never instrument marked atomic accesses. This option can be used for
0233 additional filtering. Conflicting marked atomic reads and plain
0234 writes will never be reported as a data race, however, will cause
0235 plain reads and marked writes to result in "unknown origin" reports.
0236 If combined with CONFIG_KCSAN_REPORT_RACE_UNKNOWN_ORIGIN=n, data
0237 races where at least one access is marked atomic will never be
0238 reported.
0239
0240 Similar to KCSAN_ASSUME_PLAIN_WRITES_ATOMIC, but including unaligned
0241 accesses, conflicting marked atomic reads and plain writes will not
0242 be reported as data races; however, unlike that option, data races
0243 due to two conflicting plain writes will be reported (aligned and
0244 unaligned, if CONFIG_KCSAN_ASSUME_PLAIN_WRITES_ATOMIC=n).
0245
0246 config KCSAN_PERMISSIVE
0247 bool "Enable all additional permissive rules"
0248 depends on KCSAN_REPORT_VALUE_CHANGE_ONLY
0249 help
0250 Enable additional permissive rules to ignore certain classes of data
0251 races (also see kernel/kcsan/permissive.h). None of the permissive
0252 rules imply that such data races are generally safe, but can be used
0253 to further reduce reported data races due to data-racy patterns
0254 common across the kernel.
0255
0256 endif # KCSAN
