forked from Minki/linux
0e1aa5b621
The first version of Clang that supports -tsan-distinguish-volatile will
be able to support KCSAN. The first Clang release to do so, will be
Clang 11. This is due to satisfying all the following requirements:
1. Never emit calls to __tsan_func_{entry,exit}.
2. __no_kcsan functions should not call anything, not even
kcsan_{enable,disable}_current(), when using __{READ,WRITE}_ONCE => Requires
leaving them plain!
3. Support atomic_{read,set}*() with KCSAN, which rely on
arch_atomic_{read,set}*() using __{READ,WRITE}_ONCE() => Because of
#2, rely on Clang 11's -tsan-distinguish-volatile support. We will
double-instrument atomic_{read,set}*(), but that's reasonable given
it's still lower cost than the data_race() variant due to avoiding 2
extra calls (kcsan_{en,dis}able_current() calls).
4. __always_inline functions inlined into __no_kcsan functions are never
instrumented.
5. __always_inline functions inlined into instrumented functions are
instrumented.
6. __no_kcsan_or_inline functions may be inlined into __no_kcsan functions =>
Implies leaving 'noinline' off of __no_kcsan_or_inline.
7. Because of #6, __no_kcsan and __no_kcsan_or_inline functions should never be
spuriously inlined into instrumented functions, causing the accesses of the
__no_kcsan function to be instrumented.
Older versions of Clang do not satisfy #3. The latest GCC currently
doesn't support at least #1, #3, and #7.
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Will Deacon <will@kernel.org>
Link: https://lkml.kernel.org/r/CANpmjNMTsY_8241bS7=XAfqvZHFLrVEkv_uM4aDUWE_kh3Rvbw@mail.gmail.com
Link: https://lkml.kernel.org/r/20200521142047.169334-7-elver@google.com
200 lines
7.5 KiB
Plaintext
200 lines
7.5 KiB
Plaintext
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
config HAVE_ARCH_KCSAN
|
|
bool
|
|
|
|
config HAVE_KCSAN_COMPILER
|
|
def_bool CC_IS_CLANG && $(cc-option,-fsanitize=thread -mllvm -tsan-distinguish-volatile=1)
|
|
help
|
|
For the list of compilers that support KCSAN, please see
|
|
<file:Documentation/dev-tools/kcsan.rst>.
|
|
|
|
config KCSAN_KCOV_BROKEN
|
|
def_bool KCOV && CC_HAS_SANCOV_TRACE_PC
|
|
depends on CC_IS_CLANG
|
|
depends on !$(cc-option,-Werror=unused-command-line-argument -fsanitize=thread -fsanitize-coverage=trace-pc)
|
|
help
|
|
Some versions of clang support either KCSAN and KCOV but not the
|
|
combination of the two.
|
|
See https://bugs.llvm.org/show_bug.cgi?id=45831 for the status
|
|
in newer releases.
|
|
|
|
menuconfig KCSAN
|
|
bool "KCSAN: dynamic data race detector"
|
|
depends on HAVE_ARCH_KCSAN && HAVE_KCSAN_COMPILER
|
|
depends on DEBUG_KERNEL && !KASAN
|
|
depends on !KCSAN_KCOV_BROKEN
|
|
select STACKTRACE
|
|
help
|
|
The Kernel Concurrency Sanitizer (KCSAN) is a dynamic
|
|
data-race detector that relies on compile-time instrumentation.
|
|
KCSAN uses a watchpoint-based sampling approach to detect races.
|
|
|
|
While KCSAN's primary purpose is to detect data races, it
|
|
also provides assertions to check data access constraints.
|
|
These assertions can expose bugs that do not manifest as
|
|
data races.
|
|
|
|
See <file:Documentation/dev-tools/kcsan.rst> for more details.
|
|
|
|
if KCSAN
|
|
|
|
config KCSAN_VERBOSE
|
|
bool "Show verbose reports with more information about system state"
|
|
depends on PROVE_LOCKING
|
|
help
|
|
If enabled, reports show more information about the system state that
|
|
may help better analyze and debug races. This includes held locks and
|
|
IRQ trace events.
|
|
|
|
While this option should generally be benign, we call into more
|
|
external functions on report generation; if a race report is
|
|
generated from any one of them, system stability may suffer due to
|
|
deadlocks or recursion. If in doubt, say N.
|
|
|
|
config KCSAN_DEBUG
|
|
bool "Debugging of KCSAN internals"
|
|
|
|
config KCSAN_SELFTEST
|
|
bool "Perform short selftests on boot"
|
|
default y
|
|
help
|
|
Run KCSAN selftests on boot. On test failure, causes the kernel to panic.
|
|
|
|
config KCSAN_EARLY_ENABLE
|
|
bool "Early enable during boot"
|
|
default y
|
|
help
|
|
If KCSAN should be enabled globally as soon as possible. KCSAN can
|
|
later be enabled/disabled via debugfs.
|
|
|
|
config KCSAN_NUM_WATCHPOINTS
|
|
int "Number of available watchpoints"
|
|
default 64
|
|
help
|
|
Total number of available watchpoints. An address range maps into a
|
|
specific watchpoint slot as specified in kernel/kcsan/encoding.h.
|
|
Although larger number of watchpoints may not be usable due to
|
|
limited number of CPUs, a larger value helps to improve performance
|
|
due to reducing cache-line contention. The chosen default is a
|
|
conservative value; we should almost never observe "no_capacity"
|
|
events (see /sys/kernel/debug/kcsan).
|
|
|
|
config KCSAN_UDELAY_TASK
|
|
int "Delay in microseconds (for tasks)"
|
|
default 80
|
|
help
|
|
For tasks, the microsecond delay after setting up a watchpoint.
|
|
|
|
config KCSAN_UDELAY_INTERRUPT
|
|
int "Delay in microseconds (for interrupts)"
|
|
default 20
|
|
help
|
|
For interrupts, the microsecond delay after setting up a watchpoint.
|
|
Interrupts have tighter latency requirements, and their delay should
|
|
be lower than for tasks.
|
|
|
|
config KCSAN_DELAY_RANDOMIZE
|
|
bool "Randomize above delays"
|
|
default y
|
|
help
|
|
If delays should be randomized, where the maximum is KCSAN_UDELAY_*.
|
|
If false, the chosen delays are always the KCSAN_UDELAY_* values
|
|
as defined above.
|
|
|
|
config KCSAN_SKIP_WATCH
|
|
int "Skip instructions before setting up watchpoint"
|
|
default 4000
|
|
help
|
|
The number of per-CPU memory operations to skip, before another
|
|
watchpoint is set up, i.e. one in KCSAN_WATCH_SKIP per-CPU
|
|
memory operations are used to set up a watchpoint. A smaller value
|
|
results in more aggressive race detection, whereas a larger value
|
|
improves system performance at the cost of missing some races.
|
|
|
|
config KCSAN_SKIP_WATCH_RANDOMIZE
|
|
bool "Randomize watchpoint instruction skip count"
|
|
default y
|
|
help
|
|
If instruction skip count should be randomized, where the maximum is
|
|
KCSAN_WATCH_SKIP. If false, the chosen value is always
|
|
KCSAN_WATCH_SKIP.
|
|
|
|
config KCSAN_INTERRUPT_WATCHER
|
|
bool "Interruptible watchers"
|
|
help
|
|
If enabled, a task that set up a watchpoint may be interrupted while
|
|
delayed. This option will allow KCSAN to detect races between
|
|
interrupted tasks and other threads of execution on the same CPU.
|
|
|
|
Currently disabled by default, because not all safe per-CPU access
|
|
primitives and patterns may be accounted for, and therefore could
|
|
result in false positives.
|
|
|
|
config KCSAN_REPORT_ONCE_IN_MS
|
|
int "Duration in milliseconds, in which any given race is only reported once"
|
|
default 3000
|
|
help
|
|
Any given race is only reported once in the defined time window.
|
|
Different races may still generate reports within a duration that is
|
|
smaller than the duration defined here. This allows rate limiting
|
|
reporting to avoid flooding the console with reports. Setting this
|
|
to 0 disables rate limiting.
|
|
|
|
# The main purpose of the below options is to control reported data races (e.g.
|
|
# in fuzzer configs), and are not expected to be switched frequently by other
|
|
# users. We could turn some of them into boot parameters, but given they should
|
|
# not be switched normally, let's keep them here to simplify configuration.
|
|
#
|
|
# The defaults below are chosen to be very conservative, and may miss certain
|
|
# bugs.
|
|
|
|
config KCSAN_REPORT_RACE_UNKNOWN_ORIGIN
|
|
bool "Report races of unknown origin"
|
|
default y
|
|
help
|
|
If KCSAN should report races where only one access is known, and the
|
|
conflicting access is of unknown origin. This type of race is
|
|
reported if it was only possible to infer a race due to a data value
|
|
change while an access is being delayed on a watchpoint.
|
|
|
|
config KCSAN_REPORT_VALUE_CHANGE_ONLY
|
|
bool "Only report races where watcher observed a data value change"
|
|
default y
|
|
help
|
|
If enabled and a conflicting write is observed via a watchpoint, but
|
|
the data value of the memory location was observed to remain
|
|
unchanged, do not report the data race.
|
|
|
|
config KCSAN_ASSUME_PLAIN_WRITES_ATOMIC
|
|
bool "Assume that plain aligned writes up to word size are atomic"
|
|
default y
|
|
help
|
|
Assume that plain aligned writes up to word size are atomic by
|
|
default, and also not subject to other unsafe compiler optimizations
|
|
resulting in data races. This will cause KCSAN to not report data
|
|
races due to conflicts where the only plain accesses are aligned
|
|
writes up to word size: conflicts between marked reads and plain
|
|
aligned writes up to word size will not be reported as data races;
|
|
notice that data races between two conflicting plain aligned writes
|
|
will also not be reported.
|
|
|
|
config KCSAN_IGNORE_ATOMICS
|
|
bool "Do not instrument marked atomic accesses"
|
|
help
|
|
Never instrument marked atomic accesses. This option can be used for
|
|
additional filtering. Conflicting marked atomic reads and plain
|
|
writes will never be reported as a data race, however, will cause
|
|
plain reads and marked writes to result in "unknown origin" reports.
|
|
If combined with CONFIG_KCSAN_REPORT_RACE_UNKNOWN_ORIGIN=n, data
|
|
races where at least one access is marked atomic will never be
|
|
reported.
|
|
|
|
Similar to KCSAN_ASSUME_PLAIN_WRITES_ATOMIC, but including unaligned
|
|
accesses, conflicting marked atomic reads and plain writes will not
|
|
be reported as data races; however, unlike that option, data races
|
|
due to two conflicting plain writes will be reported (aligned and
|
|
unaligned, if CONFIG_KCSAN_ASSUME_PLAIN_WRITES_ATOMIC=n).
|
|
|
|
endif # KCSAN
|