?sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget#/translations/zh_CN/dev-tools/kcsanmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/zh_TW/dev-tools/kcsanmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/it_IT/dev-tools/kcsanmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/ja_JP/dev-tools/kcsanmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/ko_KR/dev-tools/kcsanmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hPortuguese (Brazilian)}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/pt_BR/dev-tools/kcsanmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/sp_SP/dev-tools/kcsanmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhh=/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan.rsthKubh)}(hCopyright (C) 2019, Google LLC.h]hCopyright (C) 2019, Google LLC.}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubhsection)}(hhh](htitle)}(h$Kernel Concurrency Sanitizer (KCSAN)h]h$Kernel Concurrency Sanitizer (KCSAN)}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh paragraph)}(hThe Kernel Concurrency Sanitizer (KCSAN) is a dynamic race detector, which relies on compile-time instrumentation, and uses a watchpoint-based sampling approach to detect races. KCSAN's primary purpose is to detect `data races`_.h](hThe Kernel Concurrency Sanitizer (KCSAN) is a dynamic race detector, which relies on compile-time instrumentation, and uses a watchpoint-based sampling approach to detect races. KCSAN’s primary purpose is to detect }(hhhhhNhNubh reference)}(h `data races`_h]h data races}(hhhhhNhNubah}(h]h ]h"]h$]h&]name data racesrefid data-racesuh1hhhresolvedKubh.}(hhhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hhh](h)}(hUsageh]hUsage}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhK ubh)}(hKCSAN is supported by both GCC and Clang. With GCC we require version 11 or later, and with Clang also require version 11 or later.h]hKCSAN is supported by both GCC and Clang. With GCC we require version 11 or later, and with Clang also require version 11 or later.}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(h+To enable KCSAN configure the kernel with::h]h*To enable KCSAN configure the kernel with:}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh literal_block)}(hCONFIG_KCSAN = yh]hCONFIG_KCSAN = y}hjCsbah}(h]h ]h"]h$]h&]hhuh1jAhhhKhjhhubh)}(hKCSAN provides several other configuration options to customize behaviour (see the respective help text in ``lib/Kconfig.kcsan`` for more info).h](hkKCSAN provides several other configuration options to customize behaviour (see the respective help text in }(hjQhhhNhNubhliteral)}(h``lib/Kconfig.kcsan``h]hlib/Kconfig.kcsan}(hj[hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjQubh for more info).}(hjQhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hhh](h)}(h Error reportsh]h Error reports}(hjvhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjshhhhhKubh)}(h,A typical data race report looks like this::h]h+A typical data race report looks like this:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjshhubjB)}(hX================================================================== BUG: KCSAN: data-race in test_kernel_read / test_kernel_write write to 0xffffffffc009a628 of 8 bytes by task 487 on cpu 0: test_kernel_write+0x1d/0x30 access_thread+0x89/0xd0 kthread+0x23e/0x260 ret_from_fork+0x22/0x30 read to 0xffffffffc009a628 of 8 bytes by task 488 on cpu 6: test_kernel_read+0x10/0x20 access_thread+0x89/0xd0 kthread+0x23e/0x260 ret_from_fork+0x22/0x30 value changed: 0x00000000000009a6 -> 0x00000000000009b2 Reported by Kernel Concurrency Sanitizer on: CPU: 6 PID: 488 Comm: access_thread Not tainted 5.12.0-rc2+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 ==================================================================h]hX================================================================== BUG: KCSAN: data-race in test_kernel_read / test_kernel_write write to 0xffffffffc009a628 of 8 bytes by task 487 on cpu 0: test_kernel_write+0x1d/0x30 access_thread+0x89/0xd0 kthread+0x23e/0x260 ret_from_fork+0x22/0x30 read to 0xffffffffc009a628 of 8 bytes by task 488 on cpu 6: test_kernel_read+0x10/0x20 access_thread+0x89/0xd0 kthread+0x23e/0x260 ret_from_fork+0x22/0x30 value changed: 0x00000000000009a6 -> 0x00000000000009b2 Reported by Kernel Concurrency Sanitizer on: CPU: 6 PID: 488 Comm: access_thread Not tainted 5.12.0-rc2+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 ==================================================================}hjsbah}(h]h ]h"]h$]h&]hhuh1jAhhhKhjshhubh)}(hX8The header of the report provides a short summary of the functions involved in the race. It is followed by the access types and stack traces of the 2 threads involved in the data race. If KCSAN also observed a value change, the observed old value and new value are shown on the "value changed" line respectively.h]hX<The header of the report provides a short summary of the functions involved in the race. It is followed by the access types and stack traces of the 2 threads involved in the data race. If KCSAN also observed a value change, the observed old value and new value are shown on the “value changed” line respectively.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK3hjshhubh)}(h@The other less common type of data race report looks like this::h]h?The other less common type of data race report looks like this:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK8hjshhubjB)}(hXv================================================================== BUG: KCSAN: data-race in test_kernel_rmw_array+0x71/0xd0 race at unknown origin, with read to 0xffffffffc009bdb0 of 8 bytes by task 515 on cpu 2: test_kernel_rmw_array+0x71/0xd0 access_thread+0x89/0xd0 kthread+0x23e/0x260 ret_from_fork+0x22/0x30 value changed: 0x0000000000002328 -> 0x0000000000002329 Reported by Kernel Concurrency Sanitizer on: CPU: 2 PID: 515 Comm: access_thread Not tainted 5.12.0-rc2+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 ==================================================================h]hXv================================================================== BUG: KCSAN: data-race in test_kernel_rmw_array+0x71/0xd0 race at unknown origin, with read to 0xffffffffc009bdb0 of 8 bytes by task 515 on cpu 2: test_kernel_rmw_array+0x71/0xd0 access_thread+0x89/0xd0 kthread+0x23e/0x260 ret_from_fork+0x22/0x30 value changed: 0x0000000000002328 -> 0x0000000000002329 Reported by Kernel Concurrency Sanitizer on: CPU: 2 PID: 515 Comm: access_thread Not tainted 5.12.0-rc2+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 ==================================================================}hjsbah}(h]h ]h"]h$]h&]hhuh1jAhhhK:hjshhubh)}(hXThis report is generated where it was not possible to determine the other racing thread, but a race was inferred due to the data value of the watched memory location having changed. These reports always show a "value changed" line. A common reason for reports of this type are missing instrumentation in the racing thread, but could also occur due to e.g. DMA accesses. Such reports are shown only if ``CONFIG_KCSAN_REPORT_RACE_UNKNOWN_ORIGIN=y``, which is enabled by default.h](hXThis report is generated where it was not possible to determine the other racing thread, but a race was inferred due to the data value of the watched memory location having changed. These reports always show a “value changed” line. A common reason for reports of this type are missing instrumentation in the racing thread, but could also occur due to e.g. DMA accesses. Such reports are shown only if }(hjhhhNhNubjZ)}(h-``CONFIG_KCSAN_REPORT_RACE_UNKNOWN_ORIGIN=y``h]h)CONFIG_KCSAN_REPORT_RACE_UNKNOWN_ORIGIN=y}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh, which is enabled by default.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKJhjshhubeh}(h] error-reportsah ]h"] error reportsah$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(hSelective analysish]hSelective analysis}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKSubh)}(hIt may be desirable to disable data race detection for specific accesses, functions, compilation units, or entire subsystems. For static blacklisting, the below options are available:h]hIt may be desirable to disable data race detection for specific accesses, functions, compilation units, or entire subsystems. For static blacklisting, the below options are available:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKUhjhhubh bullet_list)}(hhh](h list_item)}(hX"KCSAN understands the ``data_race(expr)`` annotation, which tells KCSAN that any data races due to accesses in ``expr`` should be ignored and resulting behaviour when encountering a data race is deemed safe. Please see `"Marking Shared-Memory Accesses" in the LKMM`_ for more information. h]h)}(hX!KCSAN understands the ``data_race(expr)`` annotation, which tells KCSAN that any data races due to accesses in ``expr`` should be ignored and resulting behaviour when encountering a data race is deemed safe. Please see `"Marking Shared-Memory Accesses" in the LKMM`_ for more information.h](hKCSAN understands the }(hjhhhNhNubjZ)}(h``data_race(expr)``h]hdata_race(expr)}(hj$hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubhF annotation, which tells KCSAN that any data races due to accesses in }(hjhhhNhNubjZ)}(h``expr``h]hexpr}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubhe should be ignored and resulting behaviour when encountering a data race is deemed safe. Please see }(hjhhhNhNubh)}(h/`"Marking Shared-Memory Accesses" in the LKMM`_h]h0“Marking Shared-Memory Accesses” in the LKMM}(hjHhhhNhNubah}(h]h ]h"]h$]h&]name,"Marking Shared-Memory Accesses" in the LKMMrefuri{https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/tools/memory-model/Documentation/access-marking.txtuh1hhjj Kubh for more information.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKYhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hXSimilar to ``data_race(...)``, the type qualifier ``__data_racy`` can be used to document that all data races due to accesses to a variable are intended and should be ignored by KCSAN:: struct foo { ... int __data_racy stats_counter; ... }; h](h)}(hSimilar to ``data_race(...)``, the type qualifier ``__data_racy`` can be used to document that all data races due to accesses to a variable are intended and should be ignored by KCSAN::h](h Similar to }(hjnhhhNhNubjZ)}(h``data_race(...)``h]hdata_race(...)}(hjvhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjnubh, the type qualifier }(hjnhhhNhNubjZ)}(h``__data_racy``h]h __data_racy}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjnubhw can be used to document that all data races due to accesses to a variable are intended and should be ignored by KCSAN:}(hjnhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK^hjjubjB)}(hBstruct foo { ... int __data_racy stats_counter; ... };h]hBstruct foo { ... int __data_racy stats_counter; ... };}hjsbah}(h]h ]h"]h$]h&]hhuh1jAhhhKbhjjubeh}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hXDisabling data race detection for entire functions can be accomplished by using the function attribute ``__no_kcsan``:: __no_kcsan void foo(void) { ... To dynamically limit for which functions to generate reports, see the `DebugFS interface`_ blacklist/whitelist feature. h](h)}(hwDisabling data race detection for entire functions can be accomplished by using the function attribute ``__no_kcsan``::h](hgDisabling data race detection for entire functions can be accomplished by using the function attribute }(hjhhhNhNubjZ)}(h``__no_kcsan``h]h __no_kcsan}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhhjubjB)}(h#__no_kcsan void foo(void) { ...h]h#__no_kcsan void foo(void) { ...}hjsbah}(h]h ]h"]h$]h&]hhuh1jAhhhKkhjubh)}(hwTo dynamically limit for which functions to generate reports, see the `DebugFS interface`_ blacklist/whitelist feature.h](hFTo dynamically limit for which functions to generate reports, see the }(hjhhhNhNubh)}(h`DebugFS interface`_h]hDebugFS interface}(hjhhhNhNubah}(h]h ]h"]h$]h&]nameDebugFS interfacejdebugfs-interfaceuh1hhjj Kubh blacklist/whitelist feature.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKohjubeh}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hzTo disable data race detection for a particular compilation unit, add to the ``Makefile``:: KCSAN_SANITIZE_file.o := n h](h)}(h[To disable data race detection for a particular compilation unit, add to the ``Makefile``::h](hMTo disable data race detection for a particular compilation unit, add to the }(hjhhhNhNubjZ)}(h ``Makefile``h]hMakefile}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKrhjubjB)}(hKCSAN_SANITIZE_file.o := nh]hKCSAN_SANITIZE_file.o := n}hj3sbah}(h]h ]h"]h$]h&]hhuh1jAhhhKuhjubeh}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hTo disable data race detection for all compilation units listed in a ``Makefile``, add to the respective ``Makefile``:: KCSAN_SANITIZE := n h](h)}(hwTo disable data race detection for all compilation units listed in a ``Makefile``, add to the respective ``Makefile``::h](hETo disable data race detection for all compilation units listed in a }(hjKhhhNhNubjZ)}(h ``Makefile``h]hMakefile}(hjShhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjKubh, add to the respective }(hjKhhhNhNubjZ)}(h ``Makefile``h]hMakefile}(hjehhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjKubh:}(hjKhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKwhjGubjB)}(hKCSAN_SANITIZE := nh]hKCSAN_SANITIZE := n}hj}sbah}(h]h ]h"]h$]h&]hhuh1jAhhhKzhjGubeh}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h]h ]h"]h$]h&]bullet*uh1jhhhKYhjhhubhtarget)}(h.. _"Marking Shared-Memory Accesses" in the LKMM: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/tools/memory-model/Documentation/access-marking.txth]h}(h]*marking-shared-memory-accesses-in-the-lkmmah ]h"],"marking shared-memory accesses" in the lkmmah$]h&]jXjYuh1jhK|hjhhhhnj referencedKubh)}(hFurthermore, it is possible to tell KCSAN to show or hide entire classes of data races, depending on preferences. These can be changed via the following Kconfig options:h]hFurthermore, it is possible to tell KCSAN to show or hide entire classes of data races, depending on preferences. These can be changed via the following Kconfig options:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK~hjhhubj)}(hhh](j)}(h``CONFIG_KCSAN_REPORT_VALUE_CHANGE_ONLY``: If enabled and a conflicting write is observed via a watchpoint, but the data value of the memory location was observed to remain unchanged, do not report the data race. h]h)}(h``CONFIG_KCSAN_REPORT_VALUE_CHANGE_ONLY``: If enabled and a conflicting write is observed via a watchpoint, but the data value of the memory location was observed to remain unchanged, do not report the data race.h](jZ)}(h)``CONFIG_KCSAN_REPORT_VALUE_CHANGE_ONLY``h]h%CONFIG_KCSAN_REPORT_VALUE_CHANGE_ONLY}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh: If enabled and a conflicting write is observed via a watchpoint, but the data value of the memory location was observed to remain unchanged, do not report the data race.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hX\``CONFIG_KCSAN_ASSUME_PLAIN_WRITES_ATOMIC``: Assume that plain aligned writes up to word size are atomic by default. Assumes that such writes are not subject to unsafe compiler optimizations resulting in data races. The option causes KCSAN to not report data races due to conflicts where the only plain accesses are aligned writes up to word size. h]h)}(hX[``CONFIG_KCSAN_ASSUME_PLAIN_WRITES_ATOMIC``: Assume that plain aligned writes up to word size are atomic by default. Assumes that such writes are not subject to unsafe compiler optimizations resulting in data races. The option causes KCSAN to not report data races due to conflicts where the only plain accesses are aligned writes up to word size.h](jZ)}(h+``CONFIG_KCSAN_ASSUME_PLAIN_WRITES_ATOMIC``h]h'CONFIG_KCSAN_ASSUME_PLAIN_WRITES_ATOMIC}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubhX0: Assume that plain aligned writes up to word size are atomic by default. Assumes that such writes are not subject to unsafe compiler optimizations resulting in data races. The option causes KCSAN to not report data races due to conflicts where the only plain accesses are aligned writes up to word size.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hX``CONFIG_KCSAN_PERMISSIVE``: Enable additional permissive rules to ignore certain classes of common data races. Unlike the above, the rules are more complex involving value-change patterns, access type, and address. This option depends on ``CONFIG_KCSAN_REPORT_VALUE_CHANGE_ONLY=y``. For details please see the ``kernel/kcsan/permissive.h``. Testers and maintainers that only focus on reports from specific subsystems and not the whole kernel are recommended to disable this option. h]h)}(hX``CONFIG_KCSAN_PERMISSIVE``: Enable additional permissive rules to ignore certain classes of common data races. Unlike the above, the rules are more complex involving value-change patterns, access type, and address. This option depends on ``CONFIG_KCSAN_REPORT_VALUE_CHANGE_ONLY=y``. For details please see the ``kernel/kcsan/permissive.h``. Testers and maintainers that only focus on reports from specific subsystems and not the whole kernel are recommended to disable this option.h](jZ)}(h``CONFIG_KCSAN_PERMISSIVE``h]hCONFIG_KCSAN_PERMISSIVE}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj ubh: Enable additional permissive rules to ignore certain classes of common data races. Unlike the above, the rules are more complex involving value-change patterns, access type, and address. This option depends on }(hj hhhNhNubjZ)}(h+``CONFIG_KCSAN_REPORT_VALUE_CHANGE_ONLY=y``h]h'CONFIG_KCSAN_REPORT_VALUE_CHANGE_ONLY=y}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj ubh. For details please see the }(hj hhhNhNubjZ)}(h``kernel/kcsan/permissive.h``h]hkernel/kcsan/permissive.h}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj ubh. Testers and maintainers that only focus on reports from specific subsystems and not the whole kernel are recommended to disable this option.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h]h ]h"]h$]h&]jjuh1jhhhKhjhhubh)}(hTo use the strictest possible rules, select ``CONFIG_KCSAN_STRICT=y``, which configures KCSAN to follow the Linux-kernel memory consistency model (LKMM) as closely as possible.h](h,To use the strictest possible rules, select }(hjUhhhNhNubjZ)}(h``CONFIG_KCSAN_STRICT=y``h]hCONFIG_KCSAN_STRICT=y}(hj]hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjUubhk, which configures KCSAN to follow the Linux-kernel memory consistency model (LKMM) as closely as possible.}(hjUhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubeh}(h]selective-analysisah ]h"]selective analysisah$]h&]uh1hhjhhhhhKSubh)}(hhh](h)}(hDebugFS interfaceh]hDebugFS interface}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhj}hhhhhKubh)}(hFThe file ``/sys/kernel/debug/kcsan`` provides the following interface:h](h The file }(hjhhhNhNubjZ)}(h``/sys/kernel/debug/kcsan``h]h/sys/kernel/debug/kcsan}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh" provides the following interface:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhj}hhubj)}(hhh](j)}(hHReading ``/sys/kernel/debug/kcsan`` returns various runtime statistics. h]h)}(hGReading ``/sys/kernel/debug/kcsan`` returns various runtime statistics.h](hReading }(hjhhhNhNubjZ)}(h``/sys/kernel/debug/kcsan``h]h/sys/kernel/debug/kcsan}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh$ returns various runtime statistics.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hgWriting ``on`` or ``off`` to ``/sys/kernel/debug/kcsan`` allows turning KCSAN on or off, respectively. h]h)}(hfWriting ``on`` or ``off`` to ``/sys/kernel/debug/kcsan`` allows turning KCSAN on or off, respectively.h](hWriting }(hjhhhNhNubjZ)}(h``on``h]hon}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh or }(hjhhhNhNubjZ)}(h``off``h]hoff}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh to }(hjhhhNhNubjZ)}(h``/sys/kernel/debug/kcsan``h]h/sys/kernel/debug/kcsan}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh. allows turning KCSAN on or off, respectively.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hWriting ``!some_func_name`` to ``/sys/kernel/debug/kcsan`` adds ``some_func_name`` to the report filter list, which (by default) blacklists reporting data races where either one of the top stackframes are a function in the list. h]h)}(hWriting ``!some_func_name`` to ``/sys/kernel/debug/kcsan`` adds ``some_func_name`` to the report filter list, which (by default) blacklists reporting data races where either one of the top stackframes are a function in the list.h](hWriting }(hj-hhhNhNubjZ)}(h``!some_func_name``h]h!some_func_name}(hj5hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj-ubh to }(hj-hhhNhNubjZ)}(h``/sys/kernel/debug/kcsan``h]h/sys/kernel/debug/kcsan}(hjGhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj-ubh adds }(hj-hhhNhNubjZ)}(h``some_func_name``h]hsome_func_name}(hjYhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj-ubh to the report filter list, which (by default) blacklists reporting data races where either one of the top stackframes are a function in the list.}(hj-hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhj)ubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hXWriting either ``blacklist`` or ``whitelist`` to ``/sys/kernel/debug/kcsan`` changes the report filtering behaviour. For example, the blacklist feature can be used to silence frequently occurring data races; the whitelist feature can help with reproduction and testing of fixes. h]h)}(hXWriting either ``blacklist`` or ``whitelist`` to ``/sys/kernel/debug/kcsan`` changes the report filtering behaviour. For example, the blacklist feature can be used to silence frequently occurring data races; the whitelist feature can help with reproduction and testing of fixes.h](hWriting either }(hj{hhhNhNubjZ)}(h ``blacklist``h]h blacklist}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj{ubh or }(hj{hhhNhNubjZ)}(h ``whitelist``h]h whitelist}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj{ubh to }(hj{hhhNhNubjZ)}(h``/sys/kernel/debug/kcsan``h]h/sys/kernel/debug/kcsan}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj{ubh changes the report filtering behaviour. For example, the blacklist feature can be used to silence frequently occurring data races; the whitelist feature can help with reproduction and testing of fixes.}(hj{hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjwubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h]h ]h"]h$]h&]jjuh1jhhhKhj}hhubeh}(h]jah ]h"]debugfs interfaceah$]h&]uh1hhjhhhhhKjKubh)}(hhh](h)}(hTuning performanceh]hTuning performance}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hCore parameters that affect KCSAN's overall performance and bug detection ability are exposed as kernel command-line arguments whose defaults can also be changed via the corresponding Kconfig options.h]hCore parameters that affect KCSAN’s overall performance and bug detection ability are exposed as kernel command-line arguments whose defaults can also be changed via the corresponding Kconfig options.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj)}(hhh](j)}(hXY``kcsan.skip_watch`` (``CONFIG_KCSAN_SKIP_WATCH``): Number of per-CPU memory operations to skip, before another watchpoint is set up. Setting up watchpoints more frequently will result in the likelihood of races to be observed to increase. This parameter has the most significant impact on overall system performance and race detection ability. h]h)}(hXX``kcsan.skip_watch`` (``CONFIG_KCSAN_SKIP_WATCH``): Number of per-CPU memory operations to skip, before another watchpoint is set up. Setting up watchpoints more frequently will result in the likelihood of races to be observed to increase. This parameter has the most significant impact on overall system performance and race detection ability.h](jZ)}(h``kcsan.skip_watch``h]hkcsan.skip_watch}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh (}(hjhhhNhNubjZ)}(h``CONFIG_KCSAN_SKIP_WATCH``h]hCONFIG_KCSAN_SKIP_WATCH}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubhX'): Number of per-CPU memory operations to skip, before another watchpoint is set up. Setting up watchpoints more frequently will result in the likelihood of races to be observed to increase. This parameter has the most significant impact on overall system performance and race detection ability.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(h``kcsan.udelay_task`` (``CONFIG_KCSAN_UDELAY_TASK``): For tasks, the microsecond delay to stall execution after a watchpoint has been set up. Larger values result in the window in which we may observe a race to increase. h]h)}(h``kcsan.udelay_task`` (``CONFIG_KCSAN_UDELAY_TASK``): For tasks, the microsecond delay to stall execution after a watchpoint has been set up. Larger values result in the window in which we may observe a race to increase.h](jZ)}(h``kcsan.udelay_task``h]hkcsan.udelay_task}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj0ubh (}(hj0hhhNhNubjZ)}(h``CONFIG_KCSAN_UDELAY_TASK``h]hCONFIG_KCSAN_UDELAY_TASK}(hjFhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj0ubh): For tasks, the microsecond delay to stall execution after a watchpoint has been set up. Larger values result in the window in which we may observe a race to increase.}(hj0hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhj,ubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hX``kcsan.udelay_interrupt`` (``CONFIG_KCSAN_UDELAY_INTERRUPT``): For interrupts, the microsecond delay to stall execution after a watchpoint has been set up. Interrupts have tighter latency requirements, and their delay should generally be smaller than the one chosen for tasks. h]h)}(hX``kcsan.udelay_interrupt`` (``CONFIG_KCSAN_UDELAY_INTERRUPT``): For interrupts, the microsecond delay to stall execution after a watchpoint has been set up. Interrupts have tighter latency requirements, and their delay should generally be smaller than the one chosen for tasks.h](jZ)}(h``kcsan.udelay_interrupt``h]hkcsan.udelay_interrupt}(hjlhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjhubh (}(hjhhhhNhNubjZ)}(h!``CONFIG_KCSAN_UDELAY_INTERRUPT``h]hCONFIG_KCSAN_UDELAY_INTERRUPT}(hj~hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjhubh): For interrupts, the microsecond delay to stall execution after a watchpoint has been set up. Interrupts have tighter latency requirements, and their delay should generally be smaller than the one chosen for tasks.}(hjhhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjdubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h]h ]h"]h$]h&]jjuh1jhhhKhjhhubh)}(hEThey may be tweaked at runtime via ``/sys/module/kcsan/parameters/``.h](h#They may be tweaked at runtime via }(hjhhhNhNubjZ)}(h!``/sys/module/kcsan/parameters/``h]h/sys/module/kcsan/parameters/}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubeh}(h]tuning-performanceah ]h"]tuning performanceah$]h&]uh1hhjhhhhhKubeh}(h]usageah ]h"]usageah$]h&]uh1hhhhhhhhK ubh)}(hhh](h)}(h Data Racesh]h Data Races}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hXaIn an execution, two memory accesses form a *data race* if they *conflict*, they happen concurrently in different threads, and at least one of them is a *plain access*; they *conflict* if both access the same memory location, and at least one is a write. For a more thorough discussion and definition, see `"Plain Accesses and Data Races" in the LKMM`_.h](h,In an execution, two memory accesses form a }(hjhhhNhNubhemphasis)}(h *data race*h]h data race}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh if they }(hjhhhNhNubj)}(h *conflict*h]hconflict}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhO, they happen concurrently in different threads, and at least one of them is a }(hjhhhNhNubj)}(h*plain access*h]h plain access}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh; they }(hjhhhNhNubj)}(h *conflict*h]hconflict}(hj#hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhz if both access the same memory location, and at least one is a write. For a more thorough discussion and definition, see }(hjhhhNhNubh)}(h.`"Plain Accesses and Data Races" in the LKMM`_h]h/“Plain Accesses and Data Races” in the LKMM}(hj5hhhNhNubah}(h]h ]h"]h$]h&]name+"Plain Accesses and Data Races" in the LKMMjXhttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/tools/memory-model/Documentation/explanation.txt?id=8f6629c004b193d23612641c3607e785819e97ab#n2164uh1hhjj Kubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubj)}(h.. _"Plain Accesses and Data Races" in the LKMM: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/tools/memory-model/Documentation/explanation.txt?id=8f6629c004b193d23612641c3607e785819e97ab#n2164h]h}(h])plain-accesses-and-data-races-in-the-lkmmah ]h"]+"plain accesses and data races" in the lkmmah$]h&]jXjEuh1jhKhjhhhhjKubh)}(hhh](h)}(hBRelationship with the Linux-Kernel Memory Consistency Model (LKMM)h]hBRelationship with the Linux-Kernel Memory Consistency Model (LKMM)}(hj_hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj\hhhhhKubh)}(hXThe LKMM defines the propagation and ordering rules of various memory operations, which gives developers the ability to reason about concurrent code. Ultimately this allows to determine the possible executions of concurrent code, and if that code is free from data races.h]hXThe LKMM defines the propagation and ordering rules of various memory operations, which gives developers the ability to reason about concurrent code. Ultimately this allows to determine the possible executions of concurrent code, and if that code is free from data races.}(hjmhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj\hhubh)}(hXKCSAN is aware of *marked atomic operations* (``READ_ONCE``, ``WRITE_ONCE``, ``atomic_*``, etc.), and a subset of ordering guarantees implied by memory barriers. With ``CONFIG_KCSAN_WEAK_MEMORY=y``, KCSAN models load or store buffering, and can detect missing ``smp_mb()``, ``smp_wmb()``, ``smp_rmb()``, ``smp_store_release()``, and all ``atomic_*`` operations with equivalent implied barriers.h](hKCSAN is aware of }(hj{hhhNhNubj)}(h*marked atomic operations*h]hmarked atomic operations}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhj{ubh (}(hj{hhhNhNubjZ)}(h ``READ_ONCE``h]h READ_ONCE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj{ubh, }(hj{hhhNhNubjZ)}(h``WRITE_ONCE``h]h WRITE_ONCE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj{ubh, }(hj{hhhNhNubjZ)}(h ``atomic_*``h]hatomic_*}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj{ubhN, etc.), and a subset of ordering guarantees implied by memory barriers. With }(hj{hhhNhNubjZ)}(h``CONFIG_KCSAN_WEAK_MEMORY=y``h]hCONFIG_KCSAN_WEAK_MEMORY=y}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj{ubh?, KCSAN models load or store buffering, and can detect missing }(hj{hhhNhNubjZ)}(h ``smp_mb()``h]hsmp_mb()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj{ubh, }hj{sbjZ)}(h ``smp_wmb()``h]h smp_wmb()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj{ubh, }hj{sbjZ)}(h ``smp_rmb()``h]h smp_rmb()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj{ubh, }hj{sbjZ)}(h``smp_store_release()``h]hsmp_store_release()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj{ubh , and all }(hj{hhhNhNubjZ)}(h ``atomic_*``h]hatomic_*}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj{ubh- operations with equivalent implied barriers.}(hj{hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhj\hhubh)}(hX<Note, KCSAN will not report all data races due to missing memory ordering, specifically where a memory barrier would be required to prohibit subsequent memory operation from reordering before the barrier. Developers should therefore carefully consider the required memory ordering requirements that remain unchecked.h]hX<Note, KCSAN will not report all data races due to missing memory ordering, specifically where a memory barrier would be required to prohibit subsequent memory operation from reordering before the barrier. Developers should therefore carefully consider the required memory ordering requirements that remain unchecked.}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj\hhubeh}(h]@relationship-with-the-linux-kernel-memory-consistency-model-lkmmah ]h"]Brelationship with the linux-kernel memory consistency model (lkmm)ah$]h&]uh1hhjhhhhhKubeh}(h]jah ]h"] data racesah$]h&]uh1hhhhhhhhKjKubh)}(hhh](h)}(h Race Detection Beyond Data Racesh]h Race Detection Beyond Data Races}(hj]hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjZhhhhhKubh)}(hX~For code with complex concurrency design, race-condition bugs may not always manifest as data races. Race conditions occur if concurrently executing operations result in unexpected system behaviour. On the other hand, data races are defined at the C-language level. The following macros can be used to check properties of concurrent code where bugs would not manifest as data races.h]hX~For code with complex concurrency design, race-condition bugs may not always manifest as data races. Race conditions occur if concurrently executing operations result in unexpected system behaviour. On the other hand, data races are defined at the C-language level. The following macros can be used to check properties of concurrent code where bugs would not manifest as data races.}(hjkhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjZhhubhindex)}(hhh]h}(h]h ]h"]h$]h&]entries](single!ASSERT_EXCLUSIVE_WRITER (C macro)c.ASSERT_EXCLUSIVE_WRITERhNtauh1jyhjZhhhNhNubhdesc)}(hhh](hdesc_signature)}(hASSERT_EXCLUSIVE_WRITERh]hdesc_signature_line)}(hASSERT_EXCLUSIVE_WRITERh]h desc_name)}(hASSERT_EXCLUSIVE_WRITERh]h desc_sig_name)}(hjh]hASSERT_EXCLUSIVE_WRITER}(hjhhhNhNubah}(h]h ]nah"]h$]h&]uh1jhjubah}(h]h ](sig-namedescnameeh"]h$]h&]hhuh1jhjhhh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMTubah}(h]h ]h"]h$]h&]hhƌ add_permalinkuh1jsphinx_line_type declaratorhjhhhjhMTubah}(h]jah ](sig sig-objecteh"]h$]h&] is_multiline _toc_parts) _toc_namehuh1jhjhMThjhhubh desc_content)}(hhh]h}(h]h ]h"]h$]h&]uh1jhjhhhjhMTubeh}(h]h ](cmacroeh"]h$]h&]domainjobjtypejdesctypejnoindex noindexentrynocontentsentryuh1jhhhjZhNhNubh)}(h!``ASSERT_EXCLUSIVE_WRITER (var)``h]jZ)}(hjh]hASSERT_EXCLUSIVE_WRITER (var)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMVhjZhhubh block_quote)}(h'assert no concurrent writes to **var** h]h)}(h&assert no concurrent writes to **var**h](hassert no concurrent writes to }(hj hhhNhNubhstrong)}(h**var**h]hvar}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubeh}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMThj ubah}(h]h ]h"]h$]h&]uh1jhj# hMThjZhhubh container)}(hXa**Parameters** ``var`` variable to assert on **Description** Assert that there are no concurrent writes to **var**; other readers are allowed. This assertion can be used to specify properties of concurrent code, where violation cannot be detected as a normal data race. For example, if we only have a single writer, but multiple concurrent readers, to avoid data races, all these accesses must be marked; even concurrent marked writes racing with the single writer are bugs. Unfortunately, due to being marked, they are no longer data races. For cases like these, we can use the macro as follows: .. code-block:: c void writer(void) { spin_lock(&update_foo_lock); ASSERT_EXCLUSIVE_WRITER(shared_foo); WRITE_ONCE(shared_foo, ...); spin_unlock(&update_foo_lock); } void reader(void) { // update_foo_lock does not need to be held! ... = READ_ONCE(shared_foo); } **Note** ASSERT_EXCLUSIVE_WRITER_SCOPED(), if applicable, performs more thorough checking if a clear scope where no concurrent writes are expected exists.h](h)}(h**Parameters**h]j )}(hj2 h]h Parameters}(hj4 hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj0 ubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMXhj, ubhdefinition_list)}(hhh]hdefinition_list_item)}(h``var`` variable to assert on h](hterm)}(h``var``h]jZ)}(hjW h]hvar}(hjY hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjU ubah}(h]h ]h"]h$]h&]uh1jS h]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMphjO ubh definition)}(hhh]h)}(hvariable to assert onh]hvariable to assert on}(hjr hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjl hMphjo ubah}(h]h ]h"]h$]h&]uh1jm hjO ubeh}(h]h ]h"]h$]h&]uh1jM hjl hMphjJ ubah}(h]h ]h"]h$]h&]uh1jH hj, ubh)}(h**Description**h]j )}(hj h]h Description}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMrhj, ubh)}(hAssert that there are no concurrent writes to **var**; other readers are allowed. This assertion can be used to specify properties of concurrent code, where violation cannot be detected as a normal data race.h](h.Assert that there are no concurrent writes to }(hj hhhNhNubj )}(h**var**h]hvar}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubh; other readers are allowed. This assertion can be used to specify properties of concurrent code, where violation cannot be detected as a normal data race.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMUhj, ubh)}(hXFFor example, if we only have a single writer, but multiple concurrent readers, to avoid data races, all these accesses must be marked; even concurrent marked writes racing with the single writer are bugs. Unfortunately, due to being marked, they are no longer data races. For cases like these, we can use the macro as follows:h]hXFFor example, if we only have a single writer, but multiple concurrent readers, to avoid data races, all these accesses must be marked; even concurrent marked writes racing with the single writer are bugs. Unfortunately, due to being marked, they are no longer data races. For cases like these, we can use the macro as follows:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMYhj, ubjB)}(hX#void writer(void) { spin_lock(&update_foo_lock); ASSERT_EXCLUSIVE_WRITER(shared_foo); WRITE_ONCE(shared_foo, ...); spin_unlock(&update_foo_lock); } void reader(void) { // update_foo_lock does not need to be held! ... = READ_ONCE(shared_foo); }h]hX#void writer(void) { spin_lock(&update_foo_lock); ASSERT_EXCLUSIVE_WRITER(shared_foo); WRITE_ONCE(shared_foo, ...); spin_unlock(&update_foo_lock); } void reader(void) { // update_foo_lock does not need to be held! ... = READ_ONCE(shared_foo); }}hj sbah}(h]h ]h"]h$]h&]hhƌforcelanguagejhighlight_args}uh1jAh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhM_hj, ubh)}(h**Note**h]j )}(hj h]hNote}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMlhj, ubh)}(hASSERT_EXCLUSIVE_WRITER_SCOPED(), if applicable, performs more thorough checking if a clear scope where no concurrent writes are expected exists.h]hASSERT_EXCLUSIVE_WRITER_SCOPED(), if applicable, performs more thorough checking if a clear scope where no concurrent writes are expected exists.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMmhj, ubeh}(h]h ] kernelindentah"]h$]h&]uh1j* hjZhhhNhNubjz)}(hhh]h}(h]h ]h"]h$]h&]entries](j(ASSERT_EXCLUSIVE_WRITER_SCOPED (C macro) c.ASSERT_EXCLUSIVE_WRITER_SCOPEDhNtauh1jyhjZhhhNhNubj)}(hhh](j)}(hASSERT_EXCLUSIVE_WRITER_SCOPEDh]j)}(hASSERT_EXCLUSIVE_WRITER_SCOPEDh]j)}(hASSERT_EXCLUSIVE_WRITER_SCOPEDh]j)}(hj. h]hASSERT_EXCLUSIVE_WRITER_SCOPED}(hj8 hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj4 ubah}(h]h ](jjeh"]h$]h&]hhuh1jhj0 hhh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMubah}(h]h ]h"]h$]h&]hhjuh1jjjhj, hhhjK hMubah}(h]j' ah ](jjeh"]h$]h&]jj)jhuh1jhjK hMhj) hhubj)}(hhh]h}(h]h ]h"]h$]h&]uh1jhj) hhhjK hMubeh}(h]h ](jmacroeh"]h$]h&]jjjjd jjd jjjuh1jhhhjZhNhNubh)}(h(``ASSERT_EXCLUSIVE_WRITER_SCOPED (var)``h]jZ)}(hjj h]h$ASSERT_EXCLUSIVE_WRITER_SCOPED (var)}(hjl hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjh ubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjZhhubj )}(h0assert no concurrent writes to **var** in scope h]h)}(h/assert no concurrent writes to **var** in scopeh](hassert no concurrent writes to }(hj hhhNhNubj )}(h**var**h]hvar}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubh in scope}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubah}(h]h ]h"]h$]h&]uh1jhj hMhjZhhubj+ )}(hX**Parameters** ``var`` variable to assert on **Description** Scoped variant of ASSERT_EXCLUSIVE_WRITER(). Assert that there are no concurrent writes to **var** for the duration of the scope in which it is introduced. This provides a better way to fully cover the enclosing scope, compared to multiple ASSERT_EXCLUSIVE_WRITER(), and increases the likelihood for KCSAN to detect racing accesses. For example, it allows finding race-condition bugs that only occur due to state changes within the scope itself: .. code-block:: c void writer(void) { spin_lock(&update_foo_lock); { ASSERT_EXCLUSIVE_WRITER_SCOPED(shared_foo); WRITE_ONCE(shared_foo, 42); ... // shared_foo should still be 42 here! } spin_unlock(&update_foo_lock); } void buggy(void) { if (READ_ONCE(shared_foo) == 42) WRITE_ONCE(shared_foo, 1); // bug! }h](h)}(h**Parameters**h]j )}(hj h]h Parameters}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubjI )}(hhh]jN )}(h``var`` variable to assert on h](jT )}(h``var``h]jZ)}(hj h]hvar}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj ubah}(h]h ]h"]h$]h&]uh1jS h]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubjn )}(hhh]h)}(hvariable to assert onh]hvariable to assert on}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hMhj ubah}(h]h ]h"]h$]h&]uh1jm hj ubeh}(h]h ]h"]h$]h&]uh1jM hj hMhj ubah}(h]h ]h"]h$]h&]uh1jH hj ubh)}(h**Description**h]j )}(hj h]h Description}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubh)}(h,Scoped variant of ASSERT_EXCLUSIVE_WRITER().h]h,Scoped variant of ASSERT_EXCLUSIVE_WRITER().}(hj! hhhNhNubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubh)}(hXAssert that there are no concurrent writes to **var** for the duration of the scope in which it is introduced. This provides a better way to fully cover the enclosing scope, compared to multiple ASSERT_EXCLUSIVE_WRITER(), and increases the likelihood for KCSAN to detect racing accesses.h](h.Assert that there are no concurrent writes to }(hj0 hhhNhNubj )}(h**var**h]hvar}(hj8 hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj0 ubh for the duration of the scope in which it is introduced. This provides a better way to fully cover the enclosing scope, compared to multiple ASSERT_EXCLUSIVE_WRITER(), and increases the likelihood for KCSAN to detect racing accesses.}(hj0 hhhNhNubeh}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubh)}(hpFor example, it allows finding race-condition bugs that only occur due to state changes within the scope itself:h]hpFor example, it allows finding race-condition bugs that only occur due to state changes within the scope itself:}(hjQ hhhNhNubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubjB)}(hXvoid writer(void) { spin_lock(&update_foo_lock); { ASSERT_EXCLUSIVE_WRITER_SCOPED(shared_foo); WRITE_ONCE(shared_foo, 42); ... // shared_foo should still be 42 here! } spin_unlock(&update_foo_lock); } void buggy(void) { if (READ_ONCE(shared_foo) == 42) WRITE_ONCE(shared_foo, 1); // bug! }h]hXvoid writer(void) { spin_lock(&update_foo_lock); { ASSERT_EXCLUSIVE_WRITER_SCOPED(shared_foo); WRITE_ONCE(shared_foo, 42); ... // shared_foo should still be 42 here! } spin_unlock(&update_foo_lock); } void buggy(void) { if (READ_ONCE(shared_foo) == 42) WRITE_ONCE(shared_foo, 1); // bug! }}hj` sbah}(h]h ]h"]h$]h&]hhj j jj }uh1jAh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubeh}(h]h ] kernelindentah"]h$]h&]uh1j* hjZhhhNhNubjz)}(hhh]h}(h]h ]h"]h$]h&]entries](j!ASSERT_EXCLUSIVE_ACCESS (C macro)c.ASSERT_EXCLUSIVE_ACCESShNtauh1jyhjZhhhNhNubj)}(hhh](j)}(hASSERT_EXCLUSIVE_ACCESSh]j)}(hASSERT_EXCLUSIVE_ACCESSh]j)}(hASSERT_EXCLUSIVE_ACCESSh]j)}(hj h]hASSERT_EXCLUSIVE_ACCESS}(hj hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhj ubah}(h]h ](jjeh"]h$]h&]hhuh1jhj hhh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMubah}(h]h ]h"]h$]h&]hhjuh1jjjhj hhhj hMubah}(h]j ah ](jjeh"]h$]h&]jj)jhuh1jhj hMhj hhubj)}(hhh]h}(h]h ]h"]h$]h&]uh1jhj hhhj hMubeh}(h]h ](jmacroeh"]h$]h&]jjjj jj jjjuh1jhhhjZhNhNubh)}(h!``ASSERT_EXCLUSIVE_ACCESS (var)``h]jZ)}(hj h]hASSERT_EXCLUSIVE_ACCESS (var)}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj ubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjZhhubj )}(h)assert no concurrent accesses to **var** h]h)}(h(assert no concurrent accesses to **var**h](h!assert no concurrent accesses to }(hj hhhNhNubj )}(h**var**h]hvar}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubeh}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubah}(h]h ]h"]h$]h&]uh1jhj hMhjZhhubj+ )}(hX**Parameters** ``var`` variable to assert on **Description** Assert that there are no concurrent accesses to **var** (no readers nor writers). This assertion can be used to specify properties of concurrent code, where violation cannot be detected as a normal data race. For example, where exclusive access is expected after determining no other users of an object are left, but the object is not actually freed. We can check that this property actually holds as follows: .. code-block:: c if (refcount_dec_and_test(&obj->refcnt)) { ASSERT_EXCLUSIVE_ACCESS(*obj); do_some_cleanup(obj); release_for_reuse(obj); } **Note** 1. ASSERT_EXCLUSIVE_ACCESS_SCOPED(), if applicable, performs more thorough checking if a clear scope where no concurrent accesses are expected exists. 2. For cases where the object is freed, `KASAN `_ is a better fit to detect use-after-free bugs.h](h)}(h**Parameters**h]j )}(hj h]h Parameters}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubjI )}(hhh]jN )}(h``var`` variable to assert on h](jT )}(h``var``h]jZ)}(hj( h]hvar}(hj* hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj& ubah}(h]h ]h"]h$]h&]uh1jS h]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj" ubjn )}(hhh]h)}(hvariable to assert onh]hvariable to assert on}(hjA hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj= hMhj> ubah}(h]h ]h"]h$]h&]uh1jm hj" ubeh}(h]h ]h"]h$]h&]uh1jM hj= hMhj ubah}(h]h ]h"]h$]h&]uh1jH hj ubh)}(h**Description**h]j )}(hjc h]h Description}(hje hhhNhNubah}(h]h ]h"]h$]h&]uh1j hja ubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubh)}(hAssert that there are no concurrent accesses to **var** (no readers nor writers). This assertion can be used to specify properties of concurrent code, where violation cannot be detected as a normal data race.h](h0Assert that there are no concurrent accesses to }(hjy hhhNhNubj )}(h**var**h]hvar}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjy ubh (no readers nor writers). This assertion can be used to specify properties of concurrent code, where violation cannot be detected as a normal data race.}(hjy hhhNhNubeh}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubh)}(hFor example, where exclusive access is expected after determining no other users of an object are left, but the object is not actually freed. We can check that this property actually holds as follows:h]hFor example, where exclusive access is expected after determining no other users of an object are left, but the object is not actually freed. We can check that this property actually holds as follows:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubjB)}(hif (refcount_dec_and_test(&obj->refcnt)) { ASSERT_EXCLUSIVE_ACCESS(*obj); do_some_cleanup(obj); release_for_reuse(obj); }h]hif (refcount_dec_and_test(&obj->refcnt)) { ASSERT_EXCLUSIVE_ACCESS(*obj); do_some_cleanup(obj); release_for_reuse(obj); }}hj sbah}(h]h ]h"]h$]h&]hhj j jj }uh1jAh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubh)}(h**Note**h]j )}(hj h]hNote}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubhenumerated_list)}(hhh](j)}(hASSERT_EXCLUSIVE_ACCESS_SCOPED(), if applicable, performs more thorough checking if a clear scope where no concurrent accesses are expected exists. h]h)}(hASSERT_EXCLUSIVE_ACCESS_SCOPED(), if applicable, performs more thorough checking if a clear scope where no concurrent accesses are expected exists.h]hASSERT_EXCLUSIVE_ACCESS_SCOPED(), if applicable, performs more thorough checking if a clear scope where no concurrent accesses are expected exists.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hiFor cases where the object is freed, `KASAN `_ is a better fit to detect use-after-free bugs.h]h)}(hiFor cases where the object is freed, `KASAN `_ is a better fit to detect use-after-free bugs.h](h%For cases where the object is freed, }(hj hhhNhNubh)}(h`KASAN `_h]hKASAN}(hj hhhNhNubah}(h]h ]h"]h$]h&]nameKASANjX kasan.htmluh1hhj ubj)}(h h]h}(h]kasanah ]h"]kasanah$]h&]refurij uh1jjKhj ubh/ is a better fit to detect use-after-free bugs.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]enumtypearabicprefixhsuffix.uh1j hj ubeh}(h]h ] kernelindentah"]h$]h&]uh1j* hjZhhhNhNubjz)}(hhh]h}(h]h ]h"]h$]h&]entries](j(ASSERT_EXCLUSIVE_ACCESS_SCOPED (C macro) c.ASSERT_EXCLUSIVE_ACCESS_SCOPEDhNtauh1jyhjZhhhNhNubj)}(hhh](j)}(hASSERT_EXCLUSIVE_ACCESS_SCOPEDh]j)}(hASSERT_EXCLUSIVE_ACCESS_SCOPEDh]j)}(hASSERT_EXCLUSIVE_ACCESS_SCOPEDh]j)}(hjO h]hASSERT_EXCLUSIVE_ACCESS_SCOPED}(hjY hhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjU ubah}(h]h ](jjeh"]h$]h&]hhuh1jhjQ hhh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMubah}(h]h ]h"]h$]h&]hhjuh1jjjhjM hhhjl hMubah}(h]jH ah ](jjeh"]h$]h&]jj)jhuh1jhjl hMhjJ hhubj)}(hhh]h}(h]h ]h"]h$]h&]uh1jhjJ hhhjl hMubeh}(h]h ](jmacroeh"]h$]h&]jjjj jj jjjuh1jhhhjZhNhNubh)}(h(``ASSERT_EXCLUSIVE_ACCESS_SCOPED (var)``h]jZ)}(hj h]h$ASSERT_EXCLUSIVE_ACCESS_SCOPED (var)}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj ubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjZhhubj )}(h2assert no concurrent accesses to **var** in scope h]h)}(h1assert no concurrent accesses to **var** in scopeh](h!assert no concurrent accesses to }(hj hhhNhNubj )}(h**var**h]hvar}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubh in scope}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubah}(h]h ]h"]h$]h&]uh1jhj hMhjZhhubj+ )}(hX**Parameters** ``var`` variable to assert on **Description** Scoped variant of ASSERT_EXCLUSIVE_ACCESS(). Assert that there are no concurrent accesses to **var** (no readers nor writers) for the entire duration of the scope in which it is introduced. This provides a better way to fully cover the enclosing scope, compared to multiple ASSERT_EXCLUSIVE_ACCESS(), and increases the likelihood for KCSAN to detect racing accesses.h](h)}(h**Parameters**h]j )}(hj h]h Parameters}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubjI )}(hhh]jN )}(h``var`` variable to assert on h](jT )}(h``var``h]jZ)}(hj h]hvar}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj ubah}(h]h ]h"]h$]h&]uh1jS h]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.h8hMhj ubjn )}(hhh]h)}(hvariable to assert onh]hvariable to assert on}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhMhjubah}(h]h ]h"]h$]h&]uh1jm hj ubeh}(h]h ]h"]h$]h&]uh1jM hjhMhj ubah}(h]h ]h"]h$]h&]uh1jH hj ubh)}(h**Description**h]j )}(hj,h]h Description}(hj.hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj*ubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubh)}(h,Scoped variant of ASSERT_EXCLUSIVE_ACCESS().h]h,Scoped variant of ASSERT_EXCLUSIVE_ACCESS().}(hjBhhhNhNubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubh)}(hXAAssert that there are no concurrent accesses to **var** (no readers nor writers) for the entire duration of the scope in which it is introduced. This provides a better way to fully cover the enclosing scope, compared to multiple ASSERT_EXCLUSIVE_ACCESS(), and increases the likelihood for KCSAN to detect racing accesses.h](h0Assert that there are no concurrent accesses to }(hjQhhhNhNubj )}(h**var**h]hvar}(hjYhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjQubhX  (no readers nor writers) for the entire duration of the scope in which it is introduced. This provides a better way to fully cover the enclosing scope, compared to multiple ASSERT_EXCLUSIVE_ACCESS(), and increases the likelihood for KCSAN to detect racing accesses.}(hjQhhhNhNubeh}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhj ubeh}(h]h ] kernelindentah"]h$]h&]uh1j* hjZhhhNhNubjz)}(hhh]h}(h]h ]h"]h$]h&]entries](jASSERT_EXCLUSIVE_BITS (C macro)c.ASSERT_EXCLUSIVE_BITShNtauh1jyhjZhhhNhNubj)}(hhh](j)}(hASSERT_EXCLUSIVE_BITSh]j)}(hASSERT_EXCLUSIVE_BITSh]j)}(hASSERT_EXCLUSIVE_BITSh]j)}(hjh]hASSERT_EXCLUSIVE_BITS}(hjhhhNhNubah}(h]h ]jah"]h$]h&]uh1jhjubah}(h]h ](jjeh"]h$]h&]hhuh1jhjhhh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMubah}(h]h ]h"]h$]h&]hhjuh1jjjhjhhhjhMubah}(h]jah ](jjeh"]h$]h&]jj)jhuh1jhjhMhjhhubj)}(hhh]h}(h]h ]h"]h$]h&]uh1jhjhhhjhMubeh}(h]h ](jmacroeh"]h$]h&]jjjjjjjjjuh1jhhhjZhNhNubh)}(h%``ASSERT_EXCLUSIVE_BITS (var, mask)``h]jZ)}(hjh]h!ASSERT_EXCLUSIVE_BITS (var, mask)}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjZhhubj )}(h9assert no concurrent writes to subset of bits in **var** h]h)}(h8assert no concurrent writes to subset of bits in **var**h](h1assert no concurrent writes to subset of bits in }(hjhhhNhNubj )}(h**var**h]hvar}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubeh}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjubah}(h]h ]h"]h$]h&]uh1jhjhMhjZhhubj+ )}(hX**Parameters** ``var`` variable to assert on ``mask`` only check for modifications to bits set in **mask** **Description** Bit-granular variant of ASSERT_EXCLUSIVE_WRITER(). Assert that there are no concurrent writes to a subset of bits in **var**; concurrent readers are permitted. This assertion captures more detailed bit-level properties, compared to the other (word granularity) assertions. Only the bits set in **mask** are checked for concurrent modifications, while ignoring the remaining bits, i.e. concurrent writes (or reads) to ~mask bits are ignored. Use this for variables, where some bits must not be modified concurrently, yet other bits are expected to be modified concurrently. For example, variables where, after initialization, some bits are read-only, but other bits may still be modified concurrently. A reader may wish to assert that this is true as follows: .. code-block:: c ASSERT_EXCLUSIVE_BITS(flags, READ_ONLY_MASK); foo = (READ_ONCE(flags) & READ_ONLY_MASK) >> READ_ONLY_SHIFT; **Note** The access that immediately follows ASSERT_EXCLUSIVE_BITS() is assumed to access the masked bits only, and KCSAN optimistically assumes it is therefore safe, even in the presence of data races, and marking it with READ_ONCE() is optional from KCSAN's point-of-view. We caution, however, that it may still be advisable to do so, since we cannot reason about all compiler optimizations when it comes to bit manipulations (on the reader and writer side). If you are sure nothing can go wrong, we can write the above simply as: .. code-block:: c ASSERT_EXCLUSIVE_BITS(flags, READ_ONLY_MASK); foo = (flags & READ_ONLY_MASK) >> READ_ONLY_SHIFT; Another example, where this may be used, is when certain bits of **var** may only be modified when holding the appropriate lock, but other bits may still be modified concurrently. Writers, where other bits may change concurrently, could use the assertion as follows: .. code-block:: c spin_lock(&foo_lock); ASSERT_EXCLUSIVE_BITS(flags, FOO_MASK); old_flags = flags; new_flags = (old_flags & ~FOO_MASK) | (new_foo << FOO_SHIFT); if (cmpxchg(&flags, old_flags, new_flags) != old_flags) { ... } spin_unlock(&foo_lock);h](h)}(h**Parameters**h]j )}(hj h]h Parameters}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjubjI )}(hhh](jN )}(h``var`` variable to assert on h](jT )}(h``var``h]jZ)}(hj*h]hvar}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhj(ubah}(h]h ]h"]h$]h&]uh1jS h]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhM hj$ubjn )}(hhh]h)}(hvariable to assert onh]hvariable to assert on}(hjChhhNhNubah}(h]h ]h"]h$]h&]uh1hhj?hM hj@ubah}(h]h ]h"]h$]h&]uh1jm hj$ubeh}(h]h ]h"]h$]h&]uh1jM hj?hM hj!ubjN )}(h>``mask`` only check for modifications to bits set in **mask** h](jT )}(h``mask``h]jZ)}(hjch]hmask}(hjehhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjaubah}(h]h ]h"]h$]h&]uh1jS h]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhM hj]ubjn )}(hhh]h)}(h4only check for modifications to bits set in **mask**h](h,only check for modifications to bits set in }(hj|hhhNhNubj )}(h**mask**h]hmask}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hj|ubeh}(h]h ]h"]h$]h&]uh1hhjxhM hjyubah}(h]h ]h"]h$]h&]uh1jm hj]ubeh}(h]h ]h"]h$]h&]uh1jM hjxhM hj!ubeh}(h]h ]h"]h$]h&]uh1jH hjubh)}(h**Description**h]j )}(hjh]h Description}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhM hjubh)}(h2Bit-granular variant of ASSERT_EXCLUSIVE_WRITER().h]h2Bit-granular variant of ASSERT_EXCLUSIVE_WRITER().}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjubh)}(hXAssert that there are no concurrent writes to a subset of bits in **var**; concurrent readers are permitted. This assertion captures more detailed bit-level properties, compared to the other (word granularity) assertions. Only the bits set in **mask** are checked for concurrent modifications, while ignoring the remaining bits, i.e. concurrent writes (or reads) to ~mask bits are ignored.h](hBAssert that there are no concurrent writes to a subset of bits in }(hjhhhNhNubj )}(h**var**h]hvar}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh; concurrent readers are permitted. This assertion captures more detailed bit-level properties, compared to the other (word granularity) assertions. Only the bits set in }(hjhhhNhNubj )}(h**mask**h]hmask}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh are checked for concurrent modifications, while ignoring the remaining bits, i.e. concurrent writes (or reads) to ~mask bits are ignored.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjubh)}(hUse this for variables, where some bits must not be modified concurrently, yet other bits are expected to be modified concurrently.h]hUse this for variables, where some bits must not be modified concurrently, yet other bits are expected to be modified concurrently.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjubh)}(hFor example, variables where, after initialization, some bits are read-only, but other bits may still be modified concurrently. A reader may wish to assert that this is true as follows:h]hFor example, variables where, after initialization, some bits are read-only, but other bits may still be modified concurrently. A reader may wish to assert that this is true as follows:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjubjB)}(hkASSERT_EXCLUSIVE_BITS(flags, READ_ONLY_MASK); foo = (READ_ONCE(flags) & READ_ONLY_MASK) >> READ_ONLY_SHIFT;h]hkASSERT_EXCLUSIVE_BITS(flags, READ_ONLY_MASK); foo = (READ_ONCE(flags) & READ_ONLY_MASK) >> READ_ONLY_SHIFT;}hj"sbah}(h]h ]h"]h$]h&]hhj j jj }uh1jAh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjubh)}(h**Note**h]j )}(hj4h]hNote}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj2ubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjubh)}(hX The access that immediately follows ASSERT_EXCLUSIVE_BITS() is assumed to access the masked bits only, and KCSAN optimistically assumes it is therefore safe, even in the presence of data races, and marking it with READ_ONCE() is optional from KCSAN's point-of-view. We caution, however, that it may still be advisable to do so, since we cannot reason about all compiler optimizations when it comes to bit manipulations (on the reader and writer side). If you are sure nothing can go wrong, we can write the above simply as:h]hX The access that immediately follows ASSERT_EXCLUSIVE_BITS() is assumed to access the masked bits only, and KCSAN optimistically assumes it is therefore safe, even in the presence of data races, and marking it with READ_ONCE() is optional from KCSAN’s point-of-view. We caution, however, that it may still be advisable to do so, since we cannot reason about all compiler optimizations when it comes to bit manipulations (on the reader and writer side). If you are sure nothing can go wrong, we can write the above simply as:}(hjJhhhNhNubah}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjubjB)}(h`ASSERT_EXCLUSIVE_BITS(flags, READ_ONLY_MASK); foo = (flags & READ_ONLY_MASK) >> READ_ONLY_SHIFT;h]h`ASSERT_EXCLUSIVE_BITS(flags, READ_ONLY_MASK); foo = (flags & READ_ONLY_MASK) >> READ_ONLY_SHIFT;}hjYsbah}(h]h ]h"]h$]h&]hhj j jj }uh1jAh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjubh)}(hX Another example, where this may be used, is when certain bits of **var** may only be modified when holding the appropriate lock, but other bits may still be modified concurrently. Writers, where other bits may change concurrently, could use the assertion as follows:h](hAAnother example, where this may be used, is when certain bits of }(hjihhhNhNubj )}(h**var**h]hvar}(hjqhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjiubh may only be modified when holding the appropriate lock, but other bits may still be modified concurrently. Writers, where other bits may change concurrently, could use the assertion as follows:}(hjihhhNhNubeh}(h]h ]h"]h$]h&]uh1hh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjubjB)}(hspin_lock(&foo_lock); ASSERT_EXCLUSIVE_BITS(flags, FOO_MASK); old_flags = flags; new_flags = (old_flags & ~FOO_MASK) | (new_foo << FOO_SHIFT); if (cmpxchg(&flags, old_flags, new_flags) != old_flags) { ... } spin_unlock(&foo_lock);h]hspin_lock(&foo_lock); ASSERT_EXCLUSIVE_BITS(flags, FOO_MASK); old_flags = flags; new_flags = (old_flags & ~FOO_MASK) | (new_foo << FOO_SHIFT); if (cmpxchg(&flags, old_flags, new_flags) != old_flags) { ... } spin_unlock(&foo_lock);}hjsbah}(h]h ]h"]h$]h&]hhj j jj }uh1jAh]/var/lib/git/docbuild/linux/Documentation/dev-tools/kcsan:238: ./include/linux/kcsan-checks.hhMhjubeh}(h]h ] kernelindentah"]h$]h&]uh1j* hjZhhhNhNubeh}(h] race-detection-beyond-data-racesah ]h"] race detection beyond data racesah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hImplementation Detailsh]hImplementation Details}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hXCKCSAN relies on observing that two accesses happen concurrently. Crucially, we want to (a) increase the chances of observing races (especially for races that manifest rarely), and (b) be able to actually observe them. We can accomplish (a) by injecting various delays, and (b) by using address watchpoints (or breakpoints).h]hXCKCSAN relies on observing that two accesses happen concurrently. Crucially, we want to (a) increase the chances of observing races (especially for races that manifest rarely), and (b) be able to actually observe them. We can accomplish (a) by injecting various delays, and (b) by using address watchpoints (or breakpoints).}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hXIf we deliberately stall a memory access, while we have a watchpoint for its address set up, and then observe the watchpoint to fire, two accesses to the same address just raced. Using hardware watchpoints, this is the approach taken in `DataCollider `_. Unlike DataCollider, KCSAN does not use hardware watchpoints, but instead relies on compiler instrumentation and "soft watchpoints".h](hIf we deliberately stall a memory access, while we have a watchpoint for its address set up, and then observe the watchpoint to fire, two accesses to the same address just raced. Using hardware watchpoints, this is the approach taken in }(hjhhhNhNubh)}(hV`DataCollider `_h]h DataCollider}(hjhhhNhNubah}(h]h ]h"]h$]h&]name DataColliderjXDhttp://usenix.org/legacy/events/osdi10/tech/full_papers/Erickson.pdfuh1hhjubj)}(hG h]h}(h] datacolliderah ]h"] datacolliderah$]h&]refurijuh1jjKhjubh. Unlike DataCollider, KCSAN does not use hardware watchpoints, but instead relies on compiler instrumentation and “soft watchpoints”.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(hX-In KCSAN, watchpoints are implemented using an efficient encoding that stores access type, size, and address in a long; the benefits of using "soft watchpoints" are portability and greater flexibility. KCSAN then relies on the compiler instrumenting plain accesses. For each instrumented plain access:h]hX1In KCSAN, watchpoints are implemented using an efficient encoding that stores access type, size, and address in a long; the benefits of using “soft watchpoints” are portability and greater flexibility. KCSAN then relies on the compiler instrumenting plain accesses. For each instrumented plain access:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj )}(hhh](j)}(hxCheck if a matching watchpoint exists; if yes, and at least one access is a write, then we encountered a racing access. h]h)}(hwCheck if a matching watchpoint exists; if yes, and at least one access is a write, then we encountered a racing access.h]hwCheck if a matching watchpoint exists; if yes, and at least one access is a write, then we encountered a racing access.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM hj ubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hlPeriodically, if no matching watchpoint exists, set up a watchpoint and stall for a small randomized delay. h]h)}(hkPeriodically, if no matching watchpoint exists, set up a watchpoint and stall for a small randomized delay.h]hkPeriodically, if no matching watchpoint exists, set up a watchpoint and stall for a small randomized delay.}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM hj!ubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hAlso check the data value before the delay, and re-check the data value after delay; if the values mismatch, we infer a race of unknown origin. h]h)}(hAlso check the data value before the delay, and re-check the data value after delay; if the values mismatch, we infer a race of unknown origin.h]hAlso check the data value before the delay, and re-check the data value after delay; if the values mismatch, we infer a race of unknown origin.}(hj=hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj9ubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h]h ]h"]h$]h&]j0 j1 j2 hj3 j4 uh1j hjhhhhhM ubh)}(hXTo detect data races between plain and marked accesses, KCSAN also annotates marked accesses, but only to check if a watchpoint exists; i.e. KCSAN never sets up a watchpoint on marked accesses. By never setting up watchpoints for marked operations, if all accesses to a variable that is accessed concurrently are properly marked, KCSAN will never trigger a watchpoint and therefore never report the accesses.h]hXTo detect data races between plain and marked accesses, KCSAN also annotates marked accesses, but only to check if a watchpoint exists; i.e. KCSAN never sets up a watchpoint on marked accesses. By never setting up watchpoints for marked operations, if all accesses to a variable that is accessed concurrently are properly marked, KCSAN will never trigger a watchpoint and therefore never report the accesses.}(hjWhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hhh](h)}(hModeling Weak Memoryh]hModeling Weak Memory}(hjhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjehhhhhMubh)}(hX9KCSAN's approach to detecting data races due to missing memory barriers is based on modeling access reordering (with ``CONFIG_KCSAN_WEAK_MEMORY=y``). Each plain memory access for which a watchpoint is set up, is also selected for simulated reordering within the scope of its function (at most 1 in-flight access).h](hwKCSAN’s approach to detecting data races due to missing memory barriers is based on modeling access reordering (with }(hjvhhhNhNubjZ)}(h``CONFIG_KCSAN_WEAK_MEMORY=y``h]hCONFIG_KCSAN_WEAK_MEMORY=y}(hj~hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjvubh). Each plain memory access for which a watchpoint is set up, is also selected for simulated reordering within the scope of its function (at most 1 in-flight access).}(hjvhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMhjehhubh)}(hOnce an access has been selected for reordering, it is checked along every other access until the end of the function scope. If an appropriate memory barrier is encountered, the access will no longer be considered for simulated reordering.h]hOnce an access has been selected for reordering, it is checked along every other access until the end of the function scope. If an appropriate memory barrier is encountered, the access will no longer be considered for simulated reordering.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM"hjehhubh)}(hWhen the result of a memory operation should be ordered by a barrier, KCSAN can then detect data races where the conflict only occurs as a result of a missing barrier. Consider the example::h]hWhen the result of a memory operation should be ordered by a barrier, KCSAN can then detect data races where the conflict only occurs as a result of a missing barrier. Consider the example:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM'hjehhubjB)}(hXint x, flag; void T1(void) { x = 1; // data race! WRITE_ONCE(flag, 1); // correct: smp_store_release(&flag, 1) } void T2(void) { while (!READ_ONCE(flag)); // correct: smp_load_acquire(&flag) ... = x; // data race! }h]hXint x, flag; void T1(void) { x = 1; // data race! WRITE_ONCE(flag, 1); // correct: smp_store_release(&flag, 1) } void T2(void) { while (!READ_ONCE(flag)); // correct: smp_load_acquire(&flag) ... = x; // data race! }}hjsbah}(h]h ]h"]h$]h&]hhuh1jAhhhM+hjehhubh)}(hXWhen weak memory modeling is enabled, KCSAN can consider ``x`` in ``T1`` for simulated reordering. After the write of ``flag``, ``x`` is again checked for concurrent accesses: because ``T2`` is able to proceed after the write of ``flag``, a data race is detected. With the correct barriers in place, ``x`` would not be considered for reordering after the proper release of ``flag``, and no data race would be detected.h](h9When weak memory modeling is enabled, KCSAN can consider }(hjhhhNhNubjZ)}(h``x``h]hx}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh in }(hjhhhNhNubjZ)}(h``T1``h]hT1}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh. for simulated reordering. After the write of }(hjhhhNhNubjZ)}(h``flag``h]hflag}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh, }(hjhhhNhNubjZ)}(h``x``h]hx}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh3 is again checked for concurrent accesses: because }(hjhhhNhNubjZ)}(h``T2``h]hT2}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh' is able to proceed after the write of }(hjhhhNhNubjZ)}(h``flag``h]hflag}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh?, a data race is detected. With the correct barriers in place, }(hjhhhNhNubjZ)}(h``x``h]hx}(hj4hhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubhD would not be considered for reordering after the proper release of }(hjhhhNhNubjZ)}(h``flag``h]hflag}(hjFhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh%, and no data race would be detected.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM7hjehhubh)}(hXDeliberate trade-offs in complexity but also practical limitations mean only a subset of data races due to missing memory barriers can be detected. With currently available compiler support, the implementation is limited to modeling the effects of "buffering" (delaying accesses), since the runtime cannot "prefetch" accesses. Also recall that watchpoints are only set up for plain accesses, and the only access type for which KCSAN simulates reordering. This means reordering of marked accesses is not modeled.h]hXDeliberate trade-offs in complexity but also practical limitations mean only a subset of data races due to missing memory barriers can be detected. With currently available compiler support, the implementation is limited to modeling the effects of “buffering” (delaying accesses), since the runtime cannot “prefetch” accesses. Also recall that watchpoints are only set up for plain accesses, and the only access type for which KCSAN simulates reordering. This means reordering of marked accesses is not modeled.}(hj^hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM>hjehhubh)}(hX/A consequence of the above is that acquire operations do not require barrier instrumentation (no prefetching). Furthermore, marked accesses introducing address or control dependencies do not require special handling (the marked access cannot be reordered, later dependent accesses cannot be prefetched).h]hX/A consequence of the above is that acquire operations do not require barrier instrumentation (no prefetching). Furthermore, marked accesses introducing address or control dependencies do not require special handling (the marked access cannot be reordered, later dependent accesses cannot be prefetched).}(hjlhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMFhjehhubeh}(h]modeling-weak-memoryah ]h"]modeling weak memoryah$]h&]uh1hhjhhhhhMubh)}(hhh](h)}(hKey Propertiesh]hKey Properties}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMLubj )}(hhh](j)}(h**Memory Overhead:** The overall memory overhead is only a few MiB depending on configuration. The current implementation uses a small array of longs to encode watchpoint information, which is negligible. h]h)}(h**Memory Overhead:** The overall memory overhead is only a few MiB depending on configuration. The current implementation uses a small array of longs to encode watchpoint information, which is negligible.h](j )}(h**Memory Overhead:**h]hMemory Overhead:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh The overall memory overhead is only a few MiB depending on configuration. The current implementation uses a small array of longs to encode watchpoint information, which is negligible.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMNhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(hX**Performance Overhead:** KCSAN's runtime aims to be minimal, using an efficient watchpoint encoding that does not require acquiring any shared locks in the fast-path. For kernel boot on a system with 8 CPUs: - 5.0x slow-down with the default KCSAN config; - 2.8x slow-down from runtime fast-path overhead only (set very large ``KCSAN_SKIP_WATCH`` and unset ``KCSAN_SKIP_WATCH_RANDOMIZE``). h](h)}(h**Performance Overhead:** KCSAN's runtime aims to be minimal, using an efficient watchpoint encoding that does not require acquiring any shared locks in the fast-path. For kernel boot on a system with 8 CPUs:h](j )}(h**Performance Overhead:**h]hPerformance Overhead:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubh KCSAN’s runtime aims to be minimal, using an efficient watchpoint encoding that does not require acquiring any shared locks in the fast-path. For kernel boot on a system with 8 CPUs:}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMRhjubj)}(hhh](j)}(h-5.0x slow-down with the default KCSAN config;h]h)}(hjh]h-5.0x slow-down with the default KCSAN config;}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMVhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h2.8x slow-down from runtime fast-path overhead only (set very large ``KCSAN_SKIP_WATCH`` and unset ``KCSAN_SKIP_WATCH_RANDOMIZE``). h]h)}(h2.8x slow-down from runtime fast-path overhead only (set very large ``KCSAN_SKIP_WATCH`` and unset ``KCSAN_SKIP_WATCH_RANDOMIZE``).h](hD2.8x slow-down from runtime fast-path overhead only (set very large }(hjhhhNhNubjZ)}(h``KCSAN_SKIP_WATCH``h]hKCSAN_SKIP_WATCH}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh and unset }(hjhhhNhNubjZ)}(h``KCSAN_SKIP_WATCH_RANDOMIZE``h]hKCSAN_SKIP_WATCH_RANDOMIZE}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jYhjubh).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMWhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]j-uh1jhhhMVhjubeh}(h]h ]h"]h$]h&]uh1jhjhhhNhNubj)}(h**Annotation Overheads:** Minimal annotations are required outside the KCSAN runtime. As a result, maintenance overheads are minimal as the kernel evolves. h]h)}(h**Annotation Overheads:** Minimal annotations are required outside the KCSAN runtime. As a result, maintenance overheads are minimal as the kernel evolves.h](j )}(h**Annotation Overheads:**h]hAnnotation Overheads:}(hjGhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjCubh Minimal annotations are required outside the KCSAN runtime. As a result, maintenance overheads are minimal as the kernel evolves.}(hjChhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMZhj?ubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(h**Detects Racy Writes from Devices:** Due to checking data values upon setting up watchpoints, racy writes from devices can also be detected. h]h)}(h**Detects Racy Writes from Devices:** Due to checking data values upon setting up watchpoints, racy writes from devices can also be detected.h](j )}(h%**Detects Racy Writes from Devices:**h]h!Detects Racy Writes from Devices:}(hjmhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjiubhh Due to checking data values upon setting up watchpoints, racy writes from devices can also be detected.}(hjihhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM^hjeubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(h**Memory Ordering:** KCSAN is aware of only a subset of LKMM ordering rules; this may result in missed data races (false negatives). h]h)}(h**Memory Ordering:** KCSAN is aware of only a subset of LKMM ordering rules; this may result in missed data races (false negatives).h](j )}(h**Memory Ordering:**h]hMemory Ordering:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubhp KCSAN is aware of only a subset of LKMM ordering rules; this may result in missed data races (false negatives).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMahjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubj)}(h**Analysis Accuracy:** For observed executions, due to using a sampling strategy, the analysis is *unsound* (false negatives possible), but aims to be complete (no false positives). h]h)}(h**Analysis Accuracy:** For observed executions, due to using a sampling strategy, the analysis is *unsound* (false negatives possible), but aims to be complete (no false positives).h](j )}(h**Analysis Accuracy:**h]hAnalysis Accuracy:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hjubhL For observed executions, due to using a sampling strategy, the analysis is }(hjhhhNhNubj)}(h *unsound*h]hunsound}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhJ (false negatives possible), but aims to be complete (no false positives).}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMdhjubah}(h]h ]h"]h$]h&]uh1jhjhhhhhNubeh}(h]h ]h"]h$]h&]j0 j1 j2 hj3 j4 uh1j hjhhhhhMNubeh}(h]key-propertiesah ]h"]key propertiesah$]h&]uh1hhjhhhhhMLubeh}(h]implementation-detailsah ]h"]implementation detailsah$]h&]uh1hhhhhhhhKubh)}(hhh](h)}(hAlternatives Consideredh]hAlternatives Considered}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMiubh)}(hXAn alternative data race detection approach for the kernel can be found in the `Kernel Thread Sanitizer (KTSAN) `_. KTSAN is a happens-before data race detector, which explicitly establishes the happens-before order between memory operations, which can then be used to determine data races as defined in `Data Races`_.h](hOAn alternative data race detection approach for the kernel can be found in the }(hjhhhNhNubh)}(he`Kernel Thread Sanitizer (KTSAN) `_h]hKernel Thread Sanitizer (KTSAN)}(hjhhhNhNubah}(h]h ]h"]h$]h&]nameKernel Thread Sanitizer (KTSAN)jX@https://github.com/google/kernel-sanitizers/blob/master/KTSAN.mduh1hhjubj)}(hC h]h}(h]kernel-thread-sanitizer-ktsanah ]h"]kernel thread sanitizer (ktsan)ah$]h&]refurij(uh1jjKhjubh. KTSAN is a happens-before data race detector, which explicitly establishes the happens-before order between memory operations, which can then be used to determine data races as defined in }(hjhhhNhNubh)}(h `Data Races`_h]h Data Races}(hj:hhhNhNubah}(h]h ]h"]h$]h&]name Data Racesjjuh1hhjj Kubh.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMkhjhhubh)}(hX8To build a correct happens-before relation, KTSAN must be aware of all ordering rules of the LKMM and synchronization primitives. Unfortunately, any omission leads to large numbers of false positives, which is especially detrimental in the context of the kernel which includes numerous custom synchronization mechanisms. To track the happens-before relation, KTSAN's implementation requires metadata for each memory location (shadow memory), which for each page corresponds to 4 pages of shadow memory, and can translate into overhead of tens of GiB on a large system.h]hX:To build a correct happens-before relation, KTSAN must be aware of all ordering rules of the LKMM and synchronization primitives. Unfortunately, any omission leads to large numbers of false positives, which is especially detrimental in the context of the kernel which includes numerous custom synchronization mechanisms. To track the happens-before relation, KTSAN’s implementation requires metadata for each memory location (shadow memory), which for each page corresponds to 4 pages of shadow memory, and can translate into overhead of tens of GiB on a large system.}(hjThhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMrhjhhubeh}(h]alternatives-consideredah ]h"]alternatives consideredah$]h&]uh1hhhhhhhhMiubeh}(h]"kernel-concurrency-sanitizer-kcsanah ]h"]$kernel concurrency sanitizer (kcsan)ah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerjerror_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourcehnj _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}( data races](hj:e,"marking shared-memory accesses" in the lkmm]jHadebugfs interface]ja+"plain accesses and data races" in the lkmm]j5aurefids}nameids}(jojljjjjjzjwjjjjjjjWjjYjVjPjMjjj j jjjjjj|jjjgjdj2j/u nametypes}(jojjjzjjjjWjYjPjj jjjjjgj2uh}(jlhjjjjsjwjjjjj}jjjjjVjPjMj\jjZjjj' j, j j j j jH jM jjjjjjj|jejjjdjj/j)u footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages] transformerN include_log] decorationNhhub.