sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget#/translations/zh_CN/dev-tools/kmsanmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/zh_TW/dev-tools/kmsanmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/it_IT/dev-tools/kmsanmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/ja_JP/dev-tools/kmsanmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/ko_KR/dev-tools/kmsanmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hPortuguese (Brazilian)}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/pt_BR/dev-tools/kmsanmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget#/translations/sp_SP/dev-tools/kmsanmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhcomment)}(h SPDX-License-Identifier: GPL-2.0h]h SPDX-License-Identifier: GPL-2.0}hhsbah}(h]h ]h"]h$]h&] xml:spacepreserveuh1hhhhhh=/var/lib/git/docbuild/linux/Documentation/dev-tools/kmsan.rsthKubh)}(hCopyright (C) 2022, Google LLC.h]hCopyright (C) 2022, Google LLC.}hhsbah}(h]h ]h"]h$]h&]hhuh1hhhhhhhhKubhsection)}(hhh](htitle)}(hKernel Memory Sanitizer (KMSAN)h]hKernel Memory Sanitizer (KMSAN)}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhhhKubh paragraph)}(hKMSAN is a dynamic error detector aimed at finding uses of uninitialized values. It is based on compiler instrumentation, and is quite similar to the userspace `MemorySanitizer tool`_.h](hKMSAN is a dynamic error detector aimed at finding uses of uninitialized values. It is based on compiler instrumentation, and is quite similar to the userspace }(hhhhhNhNubh reference)}(h`MemorySanitizer tool`_h]hMemorySanitizer tool}(hhhhhNhNubah}(h]h ]h"]h$]h&]nameMemorySanitizer toolrefuri0https://clang.llvm.org/docs/MemorySanitizer.htmluh1hhhresolvedKubh.}(hhhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hAn important note is that KMSAN is not intended for production use, because it drastically increases kernel memory footprint and slows the whole system down.h]hAn important note is that KMSAN is not intended for production use, because it drastically increases kernel memory footprint and slows the whole system down.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh)}(hhh](h)}(hUsageh]hUsage}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj"hhhhhKubh)}(hhh](h)}(hBuilding the kernelh]hBuilding the kernel}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj3hhhhhKubh)}(hIn order to build a kernel with KMSAN you will need a fresh Clang (14.0.6+). Please refer to `LLVM documentation`_ for the instructions on how to build Clang.h](h]In order to build a kernel with KMSAN you will need a fresh Clang (14.0.6+). Please refer to }(hjDhhhNhNubh)}(h`LLVM documentation`_h]hLLVM documentation}(hjLhhhNhNubah}(h]h ]h"]h$]h&]nameLLVM documentationj)https://llvm.org/docs/GettingStarted.htmluh1hhjDj Kubh, for the instructions on how to build Clang.}(hjDhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKhj3hhubh)}(h=Now configure and build the kernel with CONFIG_KMSAN enabled.h]h=Now configure and build the kernel with CONFIG_KMSAN enabled.}(hjghhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj3hhubeh}(h]building-the-kernelah ]h"]building the kernelah$]h&]uh1hhj"hhhhhKubh)}(hhh](h)}(hExample reporth]hExample report}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhj}hhhhhKubh)}(h&Here is an example of a KMSAN report::h]h%Here is an example of a KMSAN report:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj}hhubh literal_block)}(hX+===================================================== BUG: KMSAN: uninit-value in test_uninit_kmsan_check_memory+0x1be/0x380 [kmsan_test] test_uninit_kmsan_check_memory+0x1be/0x380 mm/kmsan/kmsan_test.c:273 kunit_run_case_internal lib/kunit/test.c:333 kunit_try_run_case+0x206/0x420 lib/kunit/test.c:374 kunit_generic_run_threadfn_adapter+0x6d/0xc0 lib/kunit/try-catch.c:28 kthread+0x721/0x850 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 ??:? Uninit was stored to memory at: do_uninit_local_array+0xfa/0x110 mm/kmsan/kmsan_test.c:260 test_uninit_kmsan_check_memory+0x1a2/0x380 mm/kmsan/kmsan_test.c:271 kunit_run_case_internal lib/kunit/test.c:333 kunit_try_run_case+0x206/0x420 lib/kunit/test.c:374 kunit_generic_run_threadfn_adapter+0x6d/0xc0 lib/kunit/try-catch.c:28 kthread+0x721/0x850 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 ??:? Local variable uninit created at: do_uninit_local_array+0x4a/0x110 mm/kmsan/kmsan_test.c:256 test_uninit_kmsan_check_memory+0x1a2/0x380 mm/kmsan/kmsan_test.c:271 Bytes 4-7 of 8 are uninitialized Memory access of size 8 starts at ffff888083fe3da0 CPU: 0 PID: 6731 Comm: kunit_try_catch Tainted: G B E 5.16.0-rc3+ #104 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 =====================================================h]hX+===================================================== BUG: KMSAN: uninit-value in test_uninit_kmsan_check_memory+0x1be/0x380 [kmsan_test] test_uninit_kmsan_check_memory+0x1be/0x380 mm/kmsan/kmsan_test.c:273 kunit_run_case_internal lib/kunit/test.c:333 kunit_try_run_case+0x206/0x420 lib/kunit/test.c:374 kunit_generic_run_threadfn_adapter+0x6d/0xc0 lib/kunit/try-catch.c:28 kthread+0x721/0x850 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 ??:? Uninit was stored to memory at: do_uninit_local_array+0xfa/0x110 mm/kmsan/kmsan_test.c:260 test_uninit_kmsan_check_memory+0x1a2/0x380 mm/kmsan/kmsan_test.c:271 kunit_run_case_internal lib/kunit/test.c:333 kunit_try_run_case+0x206/0x420 lib/kunit/test.c:374 kunit_generic_run_threadfn_adapter+0x6d/0xc0 lib/kunit/try-catch.c:28 kthread+0x721/0x850 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 ??:? Local variable uninit created at: do_uninit_local_array+0x4a/0x110 mm/kmsan/kmsan_test.c:256 test_uninit_kmsan_check_memory+0x1a2/0x380 mm/kmsan/kmsan_test.c:271 Bytes 4-7 of 8 are uninitialized Memory access of size 8 starts at ffff888083fe3da0 CPU: 0 PID: 6731 Comm: kunit_try_catch Tainted: G B E 5.16.0-rc3+ #104 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 =====================================================}hjsbah}(h]h ]h"]h$]h&]hhuh1jhhhKhj}hhubh)}(hThe report says that the local variable ``uninit`` was created uninitialized in ``do_uninit_local_array()``. The third stack trace corresponds to the place where this variable was created.h](h(The report says that the local variable }(hjhhhNhNubhliteral)}(h ``uninit``h]huninit}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubh was created uninitialized in }(hjhhhNhNubj)}(h``do_uninit_local_array()``h]hdo_uninit_local_array()}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhjubhQ. The third stack trace corresponds to the place where this variable was created.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhKKMSAN instruments every inline assembly output with a call to:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMFhj hhubj)}(hkmsan.cstate`` to hold the metadata for function parameters and return values.h](h2When running in a kernel task context, KMSAN uses }(hj hhhNhNubj)}(h``current->kmsan.cstate``h]hcurrent->kmsan.cstate}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh@ to hold the metadata for function parameters and return values.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMnhj hhubh)}(hBut in the case the kernel is running in the interrupt, softirq or NMI context, where ``current`` is unavailable, KMSAN switches to per-cpu interrupt state::h](hVBut in the case the kernel is running in the interrupt, softirq or NMI context, where }(hj hhhNhNubj)}(h ``current``h]hcurrent}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhj ubh; is unavailable, KMSAN switches to per-cpu interrupt state:}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMqhj hhubj)}(h3DEFINE_PER_CPU(struct kmsan_ctx, kmsan_percpu_ctx);h]h3DEFINE_PER_CPU(struct kmsan_ctx, kmsan_percpu_ctx);}hj" sbah}(h]h ]h"]h$]h&]hhuh1jhhhMthj hhubeh}(h]kmsan-contextsah ]h"]kmsan contextsah$]h&]uh1hhjk hhhhhMlubh)}(hhh](h)}(hMetadata allocationh]hMetadata allocation}(hj; hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj8 hhhhhMwubh)}(hHThere are several places in the kernel for which the metadata is stored.h]hHThere are several places in the kernel for which the metadata is stored.}(hjI hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMyhj8 hhubh)}(hW1. Each ``struct page`` instance contains two pointers to its shadow and origin pages::h](h1. Each }(hjW hhhNhNubj)}(h``struct page``h]h struct page}(hj_ hhhNhNubah}(h]h ]h"]h$]h&]uh1jhjW ubh? instance contains two pointers to its shadow and origin pages:}(hjW hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM{hj8 hhubj)}(h`_. In Proceedings of CGO 2015.h](hE. Stepanov, K. Serebryany. }(hj hhhNhNubh)}(h`MemorySanitizer: fast detector of uninitialized memory use in C++ `_h]hAMemorySanitizer: fast detector of uninitialized memory use in C++}(hj hhhNhNubah}(h]h ]h"]h$]h&]nameAMemorySanitizer: fast detector of uninitialized memory use in C++jYhttps://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43308.pdfuh1hhj ubhtarget)}(h\ h]h}(h]>memorysanitizer-fast-detector-of-uninitialized-memory-use-in-cah ]h"]Amemorysanitizer: fast detector of uninitialized memory use in c++ah$]h&]refurij uh1j referencedKhj ubh. In Proceedings of CGO 2015.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMhj hhubj )}(hJ.. _MemorySanitizer tool: https://clang.llvm.org/docs/MemorySanitizer.htmlh]h}(h]memorysanitizer-toolah ]h"]memorysanitizer toolah$]h&]jjuh1j hMhj hhhhj Kubj )}(hA.. _LLVM documentation: https://llvm.org/docs/GettingStarted.htmlh]h}(h]llvm-documentationah ]h"]llvm documentationah$]h&]jj\uh1j hMhj hhhhj Kubj )}(h\.. _LKML discussion: https://lore.kernel.org/all/20220614144853.3693273-1-glider@google.com/h]h}(h]lkml-discussionah ]h"]lkml discussionah$]h&]jjuh1j hMhj hhhhj Kubeh}(h] referencesah ]h"] referencesah$]h&]uh1hhhhhhhhMubeh}(h]kernel-memory-sanitizer-kmsanah ]h"]kernel memory sanitizer (kmsan)ah$]h&]uh1hhhhhhhhKubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerjB error_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourcehnj _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}(memorysanitizer tool](hjellvm documentation]jLalkml discussion]jaurefids}nameids}(j j jfjcjzjwjjj^j[jjj j jjj9j6j1j.jh je jjjjjjj3 j0 j j j j j` j] j j j j j5 j2 j j j j j j j j j j j j u nametypes}(j jfjzjj^jj jj9j1jh jjjj3 j j j` j j j5 j j j j j j uh}(j hjcj"jwj3jj}j[jjjij jjjj6jj.j je j<jjmjjjjj0 jj j6 j j j] j j jk j j j2 j j j8 j j j j j j j j j j u footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}Rparse_messages]transform_messages] transformerN include_log] decorationNhhub.