lib/Kconfig.kfence

Source file repositories/reference/linux-study-clean/lib/Kconfig.kfence

File Facts

System
Linux kernel
Corpus path
lib/Kconfig.kfence
Extension
.kfence
Size
3633 bytes
Lines
100
Domain
Kernel Services
Bucket
lib
Inferred role
Kernel Services: lib
Status
atlas-only

Why This File Exists

Shared kernel service surface used by multiple subsystems, including helpers, cryptography, virtualization support, and async I/O infrastructure.

Dependency Surface

Detected Declarations

Annotated Snippet

# SPDX-License-Identifier: GPL-2.0-only

config HAVE_ARCH_KFENCE
	bool

menuconfig KFENCE
	bool "KFENCE: low-overhead sampling-based memory safety error detector"
	depends on HAVE_ARCH_KFENCE
	select STACKTRACE
	select IRQ_WORK
	help
	  KFENCE is a low-overhead sampling-based detector of heap out-of-bounds
	  access, use-after-free, and invalid-free errors. KFENCE is designed
	  to have negligible cost to permit enabling it in production
	  environments.

	  See <file:Documentation/dev-tools/kfence.rst> for more details.

	  Note that, KFENCE is not a substitute for explicit testing with tools
	  such as KASAN. KFENCE can detect a subset of bugs that KASAN can
	  detect, albeit at very different performance profiles. If you can
	  afford to use KASAN, continue using KASAN, for example in test
	  environments. If your kernel targets production use, and cannot
	  enable KASAN due to its cost, consider using KFENCE.

if KFENCE

config KFENCE_SAMPLE_INTERVAL
	int "Default sample interval in milliseconds"
	default 100
	help
	  The KFENCE sample interval determines the frequency with which heap
	  allocations will be guarded by KFENCE. May be overridden via boot
	  parameter "kfence.sample_interval".

	  Set this to 0 to disable KFENCE by default, in which case only
	  setting "kfence.sample_interval" to a non-zero value enables KFENCE.

config KFENCE_NUM_OBJECTS
	int "Number of guarded objects available"
	range 1 65535
	default 255
	help
	  The number of guarded objects available. For each KFENCE object, 2
	  pages are required; with one containing the object and two adjacent
	  ones used as guard pages.

config KFENCE_DEFERRABLE
	bool "Use a deferrable timer to trigger allocations"
	help
	  Use a deferrable timer to trigger allocations. This avoids forcing
	  CPU wake-ups if the system is idle, at the risk of a less predictable
	  sample interval.

	  Warning: The KUnit test suite fails with this option enabled - due to
	  the unpredictability of the sample interval!

	  Say N if you are unsure.

config KFENCE_STATIC_KEYS
	bool "Use static keys to set up allocations" if EXPERT
	depends on JUMP_LABEL
	help
	  Use static keys (static branches) to set up KFENCE allocations. This
	  option is only recommended when using very large sample intervals, or
	  performance has carefully been evaluated with this option.

	  Using static keys comes with trade-offs that need to be carefully
	  evaluated given target workloads and system architectures. Notably,
	  enabling and disabling static keys invoke IPI broadcasts, the latency

Annotation

Implementation Notes