-sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget#/translations/zh_CN/dev-tools/kmsanmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/zh_TW/dev-tools/kmsanmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/it_IT/dev-tools/kmsanmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/ja_JP/dev-tools/kmsanmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/ko_KR/dev-tools/kmsanmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/sp_SP/dev-tools/kmsanmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhh=/var/lib/git/docbuild/linux/Documentation/dev-tools/kmsan.rsthKubh)}(hCopyright (C) 2022, Google LLC.h]hCopyright (C) 2022, Google LLC.}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubhsection)}(hhh](htitle)}(hKernel Memory Sanitizer (KMSAN)h]hKernel Memory Sanitizer (KMSAN)}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh paragraph)}(hKMSAN is a dynamic error detector aimed at finding uses of uninitialized values. It is based on compiler instrumentation, and is quite similar to the userspace `MemorySanitizer tool`_.h](hKMSAN is a dynamic error detector aimed at finding uses of uninitialized values. It is based on compiler instrumentation, and is quite similar to the userspace }(hhhhhNhNubh reference)}(h`MemorySanitizer tool`_h]hMemorySanitizer tool}(hhhhhNhNubah}(h]h ]h"]h$]h&]nameMemorySanitizer toolrefuri0https://clang.llvm.org/docs/MemorySanitizer.htmluh1hhhٌresolvedKubh.}(hhhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hAn important note is that KMSAN is not intended for production use, because it drastically increases kernel memory footprint and slows the whole system down.h]hAn important note is that KMSAN is not intended for production use, because it drastically increases kernel memory footprint and slows the whole system down.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh)}(hhh](h)}(hUsageh]hUsage}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(hBuilding the kernelh]hBuilding the kernel}(hj"hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhKubh)}(hIn order to build a kernel with KMSAN you will need a fresh Clang (14.0.6+). Please refer to `LLVM documentation`_ for the instructions on how to build Clang.h](h]In order to build a kernel with KMSAN you will need a fresh Clang (14.0.6+). Please refer to }(hj0hhhNhNubh)}(h`LLVM documentation`_h]hLLVM documentation}(hj8hhhNhNubah}(h]h ]h"]h$]h&]nameLLVM documentationh)https://llvm.org/docs/GettingStarted.htmluh1hhj0hKubh, for the instructions on how to build Clang.}(hj0hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhjhhubh)}(h=Now configure and build the kernel with CONFIG_KMSAN enabled.h]h=Now configure and build the kernel with CONFIG_KMSAN enabled.}(hjShhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjhhubeh}(h]building-the-kernelah ]h"]building the kernelah$]h&]uh1hhjhhhhhKubh)}(hhh](h)}(hExample reporth]hExample report}(hjlhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjihhhhhKubh)}(h&Here is an example of a KMSAN report::h]h%Here is an example of a KMSAN report:}(hjzhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjihhubh literal_block)}(hX+===================================================== BUG: KMSAN: uninit-value in test_uninit_kmsan_check_memory+0x1be/0x380 [kmsan_test] test_uninit_kmsan_check_memory+0x1be/0x380 mm/kmsan/kmsan_test.c:273 kunit_run_case_internal lib/kunit/test.c:333 kunit_try_run_case+0x206/0x420 lib/kunit/test.c:374 kunit_generic_run_threadfn_adapter+0x6d/0xc0 lib/kunit/try-catch.c:28 kthread+0x721/0x850 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 ??:? Uninit was stored to memory at: do_uninit_local_array+0xfa/0x110 mm/kmsan/kmsan_test.c:260 test_uninit_kmsan_check_memory+0x1a2/0x380 mm/kmsan/kmsan_test.c:271 kunit_run_case_internal lib/kunit/test.c:333 kunit_try_run_case+0x206/0x420 lib/kunit/test.c:374 kunit_generic_run_threadfn_adapter+0x6d/0xc0 lib/kunit/try-catch.c:28 kthread+0x721/0x850 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 ??:? Local variable uninit created at: do_uninit_local_array+0x4a/0x110 mm/kmsan/kmsan_test.c:256 test_uninit_kmsan_check_memory+0x1a2/0x380 mm/kmsan/kmsan_test.c:271 Bytes 4-7 of 8 are uninitialized Memory access of size 8 starts at ffff888083fe3da0 CPU: 0 PID: 6731 Comm: kunit_try_catch Tainted: G B E 5.16.0-rc3+ #104 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 =====================================================h]hX+===================================================== BUG: KMSAN: uninit-value in test_uninit_kmsan_check_memory+0x1be/0x380 [kmsan_test] test_uninit_kmsan_check_memory+0x1be/0x380 mm/kmsan/kmsan_test.c:273 kunit_run_case_internal lib/kunit/test.c:333 kunit_try_run_case+0x206/0x420 lib/kunit/test.c:374 kunit_generic_run_threadfn_adapter+0x6d/0xc0 lib/kunit/try-catch.c:28 kthread+0x721/0x850 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 ??:? Uninit was stored to memory at: do_uninit_local_array+0xfa/0x110 mm/kmsan/kmsan_test.c:260 test_uninit_kmsan_check_memory+0x1a2/0x380 mm/kmsan/kmsan_test.c:271 kunit_run_case_internal lib/kunit/test.c:333 kunit_try_run_case+0x206/0x420 lib/kunit/test.c:374 kunit_generic_run_threadfn_adapter+0x6d/0xc0 lib/kunit/try-catch.c:28 kthread+0x721/0x850 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 ??:? Local variable uninit created at: do_uninit_local_array+0x4a/0x110 mm/kmsan/kmsan_test.c:256 test_uninit_kmsan_check_memory+0x1a2/0x380 mm/kmsan/kmsan_test.c:271 Bytes 4-7 of 8 are uninitialized Memory access of size 8 starts at ffff888083fe3da0 CPU: 0 PID: 6731 Comm: kunit_try_catch Tainted: G B E 5.16.0-rc3+ #104 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 =====================================================}hjsbah}(h]h ]h"]h$]h&]hhuh1jhhhKhjihhubh)}(hThe report says that the local variable ``uninit`` was created uninitialized in ``do_uninit_local_array()``. The third stack trace corresponds to the place where this variable was created.h](h(The report says that the local variable }(hjhhhNhNubhliteral)}(h ``uninit``h]huninit}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh was created uninitialized in }(hjhhhNhNubj)}(h``do_uninit_local_array()``h]hdo_uninit_local_array()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhQ. The third stack trace corresponds to the place where this variable was created.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKKMSAN instruments every inline assembly output with a call to:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMFhj hhubj)}(hkmsan.cstate`` to hold the metadata for function parameters and return values.h](h2When running in a kernel task context, KMSAN uses }(hj hhhNhNubj)}(h``current->kmsan.cstate``h]hcurrent->kmsan.cstate}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh@ to hold the metadata for function parameters and return values.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMnhj hhubh)}(hBut in the case the kernel is running in the interrupt, softirq or NMI context, where ``current`` is unavailable, KMSAN switches to per-cpu interrupt state::h](hVBut in the case the kernel is running in the interrupt, softirq or NMI context, where }(hj hhhNhNubj)}(h ``current``h]hcurrent}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh; is unavailable, KMSAN switches to per-cpu interrupt state:}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMqhj hhubj)}(h3DEFINE_PER_CPU(struct kmsan_ctx, kmsan_percpu_ctx);h]h3DEFINE_PER_CPU(struct kmsan_ctx, kmsan_percpu_ctx);}hj sbah}(h]h ]h"]h$]h&]hhuh1jhhhMthj hhubeh}(h]kmsan-contextsah ]h"]kmsan contextsah$]h&]uh1hhjW hhhhhMlubh)}(hhh](h)}(hMetadata allocationh]hMetadata allocation}(hj' hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj$ hhhhhMwubh)}(hHThere are several places in the kernel for which the metadata is stored.h]hHThere are several places in the kernel for which the metadata is stored.}(hj5 hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMyhj$ hhubh)}(hW1. Each ``struct page`` instance contains two pointers to its shadow and origin pages::h](h1. Each }(hjC hhhNhNubj)}(h``struct page``h]h struct page}(hjK hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjC ubh? instance contains two pointers to its shadow and origin pages:}(hjC hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM{hj$ hhubj)}(h`_. In Proceedings of CGO 2015.h](hE. Stepanov, K. Serebryany. }(hj hhhNhNubh)}(h`MemorySanitizer: fast detector of uninitialized memory use in C++ `_h]hAMemorySanitizer: fast detector of uninitialized memory use in C++}(hj hhhNhNubah}(h]h ]h"]h$]h&]nameAMemorySanitizer: fast detector of uninitialized memory use in C++hYhttps://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43308.pdfuh1hhj ubhtarget)}(h\ h]h}(h]>memorysanitizer-fast-detector-of-uninitialized-memory-use-in-cah ]h"]Amemorysanitizer: fast detector of uninitialized memory use in c++ah$]h&]refurij uh1j referencedKhj ubh. In Proceedings of CGO 2015.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMhj hhubj )}(hJ.. _MemorySanitizer tool: https://clang.llvm.org/docs/MemorySanitizer.htmlh]h}(h]memorysanitizer-toolah ]h"]memorysanitizer toolah$]h&]hhuh1j hMhj hhhhj Kubj )}(hA.. _LLVM documentation: https://llvm.org/docs/GettingStarted.htmlh]h}(h]llvm-documentationah ]h"]llvm documentationah$]h&]hjHuh1j hMhj hhhhj Kubj )}(h\.. _LKML discussion: https://lore.kernel.org/all/20220614144853.3693273-1-glider@google.com/h]h}(h]lkml-discussionah ]h"]lkml discussionah$]h&]hjuh1j hMhj hhhhj Kubeh}(h] referencesah ]h"] referencesah$]h&]uh1hhhhhhhhMubeh}(h]kernel-memory-sanitizer-kmsanah ]h"]kernel memory sanitizer (kmsan)ah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerj. error_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourceh _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}(memorysanitizer tool](hjnellvm documentation]j8alkml discussion]jaurefids}nameids}(j j jRjOjfjcjjjJjGjjj j jjj%j"jjjT jQ jjjjjj|j j j j j j jL jI j j j j j! j j j} j j j j j j j j j j u nametypes}(j jRjfjjJjj jj%jjT jjjj j j jL j j j! j j j j j j uh}(j hjOjjcjjjijGjjjUj jjjj"jjjjQ j(jjYjjj|jj jj j" j j jI j j jW j j j j j} j$ j j j j j j j j j j u footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages] transformerN include_log] decorationNhhub.