blob: db101857b2c98c8e1f306620be41287b41f43a25 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001Introduction
2------------
3
Daniel Walkere95be9a2006-10-04 02:15:21 -07004The configuration database is a collection of configuration options
Linus Torvalds1da177e2005-04-16 15:20:36 -07005organized in a tree structure:
6
7 +- Code maturity level options
8 | +- Prompt for development and/or incomplete code/drivers
9 +- General setup
10 | +- Networking support
11 | +- System V IPC
12 | +- BSD Process Accounting
13 | +- Sysctl support
14 +- Loadable module support
15 | +- Enable loadable module support
16 | +- Set version information on all module symbols
17 | +- Kernel module loader
18 +- ...
19
20Every entry has its own dependencies. These dependencies are used
21to determine the visibility of an entry. Any child entry is only
22visible if its parent entry is also visible.
23
24Menu entries
25------------
26
Randy Dunlap0486bc92007-11-12 16:17:55 -080027Most entries define a config option; all other entries help to organize
Linus Torvalds1da177e2005-04-16 15:20:36 -070028them. A single configuration option is defined like this:
29
30config MODVERSIONS
31 bool "Set version information on all module symbols"
Robert P. J. Daybef1f402006-12-12 20:04:19 +010032 depends on MODULES
Linus Torvalds1da177e2005-04-16 15:20:36 -070033 help
34 Usually, modules have to be recompiled whenever you switch to a new
35 kernel. ...
36
37Every line starts with a key word and can be followed by multiple
38arguments. "config" starts a new config entry. The following lines
39define attributes for this config option. Attributes can be the type of
40the config option, input prompt, dependencies, help text and default
41values. A config option can be defined multiple times with the same
42name, but every definition can have only a single input prompt and the
43type must not conflict.
44
45Menu attributes
46---------------
47
48A menu entry can have a number of attributes. Not all of them are
49applicable everywhere (see syntax).
50
51- type definition: "bool"/"tristate"/"string"/"hex"/"int"
52 Every config option must have a type. There are only two basic types:
Randy Dunlap0486bc92007-11-12 16:17:55 -080053 tristate and string; the other types are based on these two. The type
Linus Torvalds1da177e2005-04-16 15:20:36 -070054 definition optionally accepts an input prompt, so these two examples
55 are equivalent:
56
57 bool "Networking support"
58 and
59 bool
60 prompt "Networking support"
61
62- input prompt: "prompt" <prompt> ["if" <expr>]
63 Every menu entry can have at most one prompt, which is used to display
64 to the user. Optionally dependencies only for this prompt can be added
65 with "if".
66
67- default value: "default" <expr> ["if" <expr>]
68 A config option can have any number of default values. If multiple
69 default values are visible, only the first defined one is active.
Jan Engelhardt83dcde42006-07-27 22:14:29 +020070 Default values are not limited to the menu entry where they are
71 defined. This means the default can be defined somewhere else or be
Linus Torvalds1da177e2005-04-16 15:20:36 -070072 overridden by an earlier definition.
73 The default value is only assigned to the config symbol if no other
74 value was set by the user (via the input prompt above). If an input
75 prompt is visible the default value is presented to the user and can
76 be overridden by him.
Jan Engelhardt83dcde42006-07-27 22:14:29 +020077 Optionally, dependencies only for this default value can be added with
Linus Torvalds1da177e2005-04-16 15:20:36 -070078 "if".
79
Randy Dunlap6e66b902007-10-19 10:53:48 -070080- type definition + default value:
81 "def_bool"/"def_tristate" <expr> ["if" <expr>]
82 This is a shorthand notation for a type definition plus a value.
83 Optionally dependencies for this default value can be added with "if".
84
85- dependencies: "depends on" <expr>
Linus Torvalds1da177e2005-04-16 15:20:36 -070086 This defines a dependency for this menu entry. If multiple
Jan Engelhardt83dcde42006-07-27 22:14:29 +020087 dependencies are defined, they are connected with '&&'. Dependencies
Linus Torvalds1da177e2005-04-16 15:20:36 -070088 are applied to all other options within this menu entry (which also
89 accept an "if" expression), so these two examples are equivalent:
90
91 bool "foo" if BAR
92 default y if BAR
93 and
94 depends on BAR
95 bool "foo"
96 default y
97
98- reverse dependencies: "select" <symbol> ["if" <expr>]
99 While normal dependencies reduce the upper limit of a symbol (see
100 below), reverse dependencies can be used to force a lower limit of
101 another symbol. The value of the current menu symbol is used as the
102 minimal value <symbol> can be set to. If <symbol> is selected multiple
103 times, the limit is set to the largest selection.
104 Reverse dependencies can only be used with boolean or tristate
105 symbols.
Jarek Poplawskif8a74592007-08-10 13:01:04 -0700106 Note:
Matthew Wilcoxdfecbec2008-04-19 14:45:11 -0600107 select should be used with care. select will force
108 a symbol to a value without visiting the dependencies.
109 By abusing select you are able to select a symbol FOO even
110 if FOO depends on BAR that is not set.
111 In general use select only for non-visible symbols
112 (no prompts anywhere) and for symbols with no dependencies.
113 That will limit the usefulness but on the other hand avoid
114 the illegal configurations all over.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700115
Michal Marekdf835c22010-11-26 17:15:11 +0100116- limiting menu display: "visible if" <expr>
117 This attribute is only applicable to menu blocks, if the condition is
118 false, the menu block is not displayed to the user (the symbols
119 contained there can still be selected by other symbols, though). It is
Masanari Iida40e47122012-03-04 23:16:11 +0900120 similar to a conditional "prompt" attribute for individual menu
Michal Marekdf835c22010-11-26 17:15:11 +0100121 entries. Default value of "visible" is true.
122
Linus Torvalds1da177e2005-04-16 15:20:36 -0700123- numerical ranges: "range" <symbol> <symbol> ["if" <expr>]
124 This allows to limit the range of possible input values for int
125 and hex symbols. The user can only input a value which is larger than
126 or equal to the first symbol and smaller than or equal to the second
127 symbol.
128
129- help text: "help" or "---help---"
130 This defines a help text. The end of the help text is determined by
131 the indentation level, this means it ends at the first line which has
132 a smaller indentation than the first line of the help text.
133 "---help---" and "help" do not differ in behaviour, "---help---" is
Matt LaPlante53cb4722006-10-03 22:55:17 +0200134 used to help visually separate configuration logic from help within
Linus Torvalds1da177e2005-04-16 15:20:36 -0700135 the file as an aid to developers.
136
Roman Zippel93449082008-01-14 04:50:54 +0100137- misc options: "option" <symbol>[=<value>]
138 Various less common options can be defined via this option syntax,
139 which can modify the behaviour of the menu entry and its config
140 symbol. These options are currently possible:
141
142 - "defconfig_list"
143 This declares a list of default entries which can be used when
144 looking for the default configuration (which is used when the main
145 .config doesn't exists yet.)
146
147 - "modules"
148 This declares the symbol to be used as the MODULES symbol, which
149 enables the third modular state for all config symbols.
Yann E. MORINe0627812013-09-03 22:22:26 +0200150 At most one symbol may have the "modules" option set.
Roman Zippel93449082008-01-14 04:50:54 +0100151
152 - "env"=<value>
153 This imports the environment variable into Kconfig. It behaves like
154 a default, except that the value comes from the environment, this
155 also means that the behaviour when mixing it with normal defaults is
156 undefined at this point. The symbol is currently not exported back
157 to the build environment (if this is desired, it can be done via
158 another symbol).
Linus Torvalds1da177e2005-04-16 15:20:36 -0700159
Josh Triplett5d2acfc2014-04-07 15:39:09 -0700160 - "allnoconfig_y"
161 This declares the symbol as one that should have the value y when
162 using "allnoconfig". Used for symbols that hide other symbols.
163
Linus Torvalds1da177e2005-04-16 15:20:36 -0700164Menu dependencies
165-----------------
166
167Dependencies define the visibility of a menu entry and can also reduce
168the input range of tristate symbols. The tristate logic used in the
169expressions uses one more state than normal boolean logic to express the
170module state. Dependency expressions have the following syntax:
171
172<expr> ::= <symbol> (1)
173 <symbol> '=' <symbol> (2)
174 <symbol> '!=' <symbol> (3)
175 '(' <expr> ')' (4)
176 '!' <expr> (5)
177 <expr> '&&' <expr> (6)
178 <expr> '||' <expr> (7)
179
180Expressions are listed in decreasing order of precedence.
181
182(1) Convert the symbol into an expression. Boolean and tristate symbols
183 are simply converted into the respective expression values. All
184 other symbol types result in 'n'.
185(2) If the values of both symbols are equal, it returns 'y',
186 otherwise 'n'.
187(3) If the values of both symbols are equal, it returns 'n',
188 otherwise 'y'.
189(4) Returns the value of the expression. Used to override precedence.
190(5) Returns the result of (2-/expr/).
191(6) Returns the result of min(/expr/, /expr/).
192(7) Returns the result of max(/expr/, /expr/).
193
194An expression can have a value of 'n', 'm' or 'y' (or 0, 1, 2
Li Zefan4280eae2010-04-14 11:44:05 +0800195respectively for calculations). A menu entry becomes visible when its
Linus Torvalds1da177e2005-04-16 15:20:36 -0700196expression evaluates to 'm' or 'y'.
197
Randy Dunlap0486bc92007-11-12 16:17:55 -0800198There are two types of symbols: constant and non-constant symbols.
199Non-constant symbols are the most common ones and are defined with the
200'config' statement. Non-constant symbols consist entirely of alphanumeric
Linus Torvalds1da177e2005-04-16 15:20:36 -0700201characters or underscores.
202Constant symbols are only part of expressions. Constant symbols are
Jan Engelhardt83dcde42006-07-27 22:14:29 +0200203always surrounded by single or double quotes. Within the quote, any
Linus Torvalds1da177e2005-04-16 15:20:36 -0700204other character is allowed and the quotes can be escaped using '\'.
205
206Menu structure
207--------------
208
209The position of a menu entry in the tree is determined in two ways. First
210it can be specified explicitly:
211
212menu "Network device support"
Robert P. J. Daybef1f402006-12-12 20:04:19 +0100213 depends on NET
Linus Torvalds1da177e2005-04-16 15:20:36 -0700214
215config NETDEVICES
216 ...
217
218endmenu
219
220All entries within the "menu" ... "endmenu" block become a submenu of
221"Network device support". All subentries inherit the dependencies from
222the menu entry, e.g. this means the dependency "NET" is added to the
223dependency list of the config option NETDEVICES.
224
225The other way to generate the menu structure is done by analyzing the
226dependencies. If a menu entry somehow depends on the previous entry, it
227can be made a submenu of it. First, the previous (parent) symbol must
228be part of the dependency list and then one of these two conditions
229must be true:
230- the child entry must become invisible, if the parent is set to 'n'
231- the child entry must only be visible, if the parent is visible
232
233config MODULES
234 bool "Enable loadable module support"
235
236config MODVERSIONS
237 bool "Set version information on all module symbols"
Robert P. J. Daybef1f402006-12-12 20:04:19 +0100238 depends on MODULES
Linus Torvalds1da177e2005-04-16 15:20:36 -0700239
240comment "module support disabled"
Robert P. J. Daybef1f402006-12-12 20:04:19 +0100241 depends on !MODULES
Linus Torvalds1da177e2005-04-16 15:20:36 -0700242
243MODVERSIONS directly depends on MODULES, this means it's only visible if
Dirk Gouders3e2ba952016-04-29 11:02:08 +0200244MODULES is different from 'n'. The comment on the other hand is only
245visible when MODULES is set to 'n'.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700246
247
248Kconfig syntax
249--------------
250
251The configuration file describes a series of menu entries, where every
252line starts with a keyword (except help texts). The following keywords
253end a menu entry:
254- config
255- menuconfig
256- choice/endchoice
257- comment
258- menu/endmenu
259- if/endif
260- source
261The first five also start the definition of a menu entry.
262
263config:
264
265 "config" <symbol>
266 <config options>
267
268This defines a config symbol <symbol> and accepts any of above
269attributes as options.
270
271menuconfig:
272 "menuconfig" <symbol>
273 <config options>
274
Matt LaPlante53cb4722006-10-03 22:55:17 +0200275This is similar to the simple config entry above, but it also gives a
Linus Torvalds1da177e2005-04-16 15:20:36 -0700276hint to front ends, that all suboptions should be displayed as a
277separate list of options.
278
279choices:
280
Yann E. MORIN0719e1d2010-12-16 00:19:00 +0100281 "choice" [symbol]
Linus Torvalds1da177e2005-04-16 15:20:36 -0700282 <choice options>
283 <choice block>
284 "endchoice"
285
Jan Engelhardt83dcde42006-07-27 22:14:29 +0200286This defines a choice group and accepts any of the above attributes as
Dirk Gouders032a3182016-04-29 12:43:38 +0200287options. A choice can only be of type bool or tristate. If no type is
288specified for a choice, it's type will be determined by the type of
289the first choice element in the group or remain unknown if none of the
290choice elements have a type specified, as well.
291
292While a boolean choice only allows a single config entry to be
293selected, a tristate choice also allows any number of config entries
294to be set to 'm'. This can be used if multiple drivers for a single
295hardware exists and only a single driver can be compiled/loaded into
296the kernel, but all drivers can be compiled as modules.
297
Linus Torvalds1da177e2005-04-16 15:20:36 -0700298A choice accepts another option "optional", which allows to set the
299choice to 'n' and no entry needs to be selected.
Yann E. MORIN0719e1d2010-12-16 00:19:00 +0100300If no [symbol] is associated with a choice, then you can not have multiple
301definitions of that choice. If a [symbol] is associated to the choice,
302then you may define the same choice (ie. with the same entries) in another
303place.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700304
305comment:
306
307 "comment" <prompt>
308 <comment options>
309
310This defines a comment which is displayed to the user during the
311configuration process and is also echoed to the output files. The only
312possible options are dependencies.
313
314menu:
315
316 "menu" <prompt>
317 <menu options>
318 <menu block>
319 "endmenu"
320
321This defines a menu block, see "Menu structure" above for more
Michal Marekdf835c22010-11-26 17:15:11 +0100322information. The only possible options are dependencies and "visible"
323attributes.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700324
325if:
326
327 "if" <expr>
328 <if block>
329 "endif"
330
331This defines an if block. The dependency expression <expr> is appended
332to all enclosed menu entries.
333
334source:
335
336 "source" <prompt>
337
338This reads the specified configuration file. This file is always parsed.
Randy Dunlap6e66b902007-10-19 10:53:48 -0700339
340mainmenu:
341
342 "mainmenu" <prompt>
343
344This sets the config program's title bar if the config program chooses
Arnaud Lacombe8ea13e22010-08-16 22:55:31 -0400345to use it. It should be placed at the top of the configuration, before any
346other statement.
Randy Dunlap0486bc92007-11-12 16:17:55 -0800347
348
349Kconfig hints
350-------------
351This is a collection of Kconfig tips, most of which aren't obvious at
352first glance and most of which have become idioms in several Kconfig
353files.
354
Sam Ravnborg9b3e4da2008-01-28 21:49:46 +0100355Adding common features and make the usage configurable
356~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
357It is a common idiom to implement a feature/functionality that are
358relevant for some architectures but not all.
359The recommended way to do so is to use a config variable named HAVE_*
360that is defined in a common Kconfig file and selected by the relevant
361architectures.
362An example is the generic IOMAP functionality.
363
364We would in lib/Kconfig see:
365
366# Generic IOMAP is used to ...
367config HAVE_GENERIC_IOMAP
368
369config GENERIC_IOMAP
370 depends on HAVE_GENERIC_IOMAP && FOO
371
372And in lib/Makefile we would see:
373obj-$(CONFIG_GENERIC_IOMAP) += iomap.o
374
375For each architecture using the generic IOMAP functionality we would see:
376
377config X86
378 select ...
379 select HAVE_GENERIC_IOMAP
380 select ...
381
382Note: we use the existing config option and avoid creating a new
383config variable to select HAVE_GENERIC_IOMAP.
384
385Note: the use of the internal config variable HAVE_GENERIC_IOMAP, it is
386introduced to overcome the limitation of select which will force a
387config option to 'y' no matter the dependencies.
388The dependencies are moved to the symbol GENERIC_IOMAP and we avoid the
389situation where select forces a symbol equals to 'y'.
390
Randy Dunlap0486bc92007-11-12 16:17:55 -0800391Build as module only
392~~~~~~~~~~~~~~~~~~~~
393To restrict a component build to module-only, qualify its config symbol
394with "depends on m". E.g.:
395
396config FOO
397 depends on BAR && m
398
399limits FOO to module (=m) or disabled (=n).
Luis R. Rodriguez1c199f22015-10-07 16:16:33 -0700400
401Kconfig recursive dependency limitations
402~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
403
404If you've hit the Kconfig error: "recursive dependency detected" you've run
405into a recursive dependency issue with Kconfig, a recursive dependency can be
406summarized as a circular dependency. The kconfig tools need to ensure that
407Kconfig files comply with specified configuration requirements. In order to do
408that kconfig must determine the values that are possible for all Kconfig
409symbols, this is currently not possible if there is a circular relation
410between two or more Kconfig symbols. For more details refer to the "Simple
411Kconfig recursive issue" subsection below. Kconfig does not do recursive
412dependency resolution; this has a few implications for Kconfig file writers.
413We'll first explain why this issues exists and then provide an example
414technical limitation which this brings upon Kconfig developers. Eager
415developers wishing to try to address this limitation should read the next
416subsections.
417
418Simple Kconfig recursive issue
419~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
420
421Read: Documentation/kbuild/Kconfig.recursion-issue-01
422
423Test with:
424
425make KBUILD_KCONFIG=Documentation/kbuild/Kconfig.recursion-issue-01 allnoconfig
426
427Cumulative Kconfig recursive issue
428~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
429
430Read: Documentation/kbuild/Kconfig.recursion-issue-02
431
432Test with:
433
434make KBUILD_KCONFIG=Documentation/kbuild/Kconfig.recursion-issue-02 allnoconfig
435
436Practical solutions to kconfig recursive issue
437~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
438
439Developers who run into the recursive Kconfig issue have three options
440at their disposal. We document them below and also provide a list of
441historical issues resolved through these different solutions.
442
443 a) Remove any superfluous "select FOO" or "depends on FOO"
444 b) Match dependency semantics:
445 b1) Swap all "select FOO" to "depends on FOO" or,
446 b2) Swap all "depends on FOO" to "select FOO"
447
448The resolution to a) can be tested with the sample Kconfig file
449Documentation/kbuild/Kconfig.recursion-issue-01 through the removal
450of the "select CORE" from CORE_BELL_A_ADVANCED as that is implicit already
451since CORE_BELL_A depends on CORE. At times it may not be possible to remove
452some dependency criteria, for such cases you can work with solution b).
453
454The two different resolutions for b) can be tested in the sample Kconfig file
455Documentation/kbuild/Kconfig.recursion-issue-02.
456
457Below is a list of examples of prior fixes for these types of recursive issues;
458all errors appear to involve one or more select's and one or more "depends on".
459
460commit fix
461====== ===
46206b718c01208 select A -> depends on A
463c22eacfe82f9 depends on A -> depends on B
4646a91e854442c select A -> depends on A
465118c565a8f2e select A -> select B
466f004e5594705 select A -> depends on A
467c7861f37b4c6 depends on A -> (null)
46880c69915e5fb select A -> (null) (1)
469c2218e26c0d0 select A -> depends on A (1)
470d6ae99d04e1c select A -> depends on A
47195ca19cf8cbf select A -> depends on A
4728f057d7bca54 depends on A -> (null)
4738f057d7bca54 depends on A -> select A
474a0701f04846e select A -> depends on A
4750c8b92f7f259 depends on A -> (null)
476e4e9e0540928 select A -> depends on A (2)
4777453ea886e87 depends on A > (null) (1)
4787b1fff7e4fdf select A -> depends on A
47986c747d2a4f0 select A -> depends on A
480d9f9ab51e55e select A -> depends on A
4810c51a4d8abd6 depends on A -> select A (3)
482e98062ed6dc4 select A -> depends on A (3)
48391e5d284a7f1 select A -> (null)
484
485(1) Partial (or no) quote of error.
486(2) That seems to be the gist of that fix.
487(3) Same error.
488
489Future kconfig work
490~~~~~~~~~~~~~~~~~~~
491
492Work on kconfig is welcomed on both areas of clarifying semantics and on
493evaluating the use of a full SAT solver for it. A full SAT solver can be
494desirable to enable more complex dependency mappings and / or queries,
495for instance on possible use case for a SAT solver could be that of handling
496the current known recursive dependency issues. It is not known if this would
497address such issues but such evaluation is desirable. If support for a full SAT
498solver proves too complex or that it cannot address recursive dependency issues
499Kconfig should have at least clear and well defined semantics which also
500addresses and documents limitations or requirements such as the ones dealing
501with recursive dependencies.
502
503Further work on both of these areas is welcomed on Kconfig. We elaborate
504on both of these in the next two subsections.
505
506Semantics of Kconfig
507~~~~~~~~~~~~~~~~~~~~
508
509The use of Kconfig is broad, Linux is now only one of Kconfig's users:
510one study has completed a broad analysis of Kconfig use in 12 projects [0].
511Despite its widespread use, and although this document does a reasonable job
512in documenting basic Kconfig syntax a more precise definition of Kconfig
513semantics is welcomed. One project deduced Kconfig semantics through
514the use of the xconfig configurator [1]. Work should be done to confirm if
515the deduced semantics matches our intended Kconfig design goals.
516
517Having well defined semantics can be useful for tools for practical
518evaluation of depenencies, for instance one such use known case was work to
519express in boolean abstraction of the inferred semantics of Kconfig to
520translate Kconfig logic into boolean formulas and run a SAT solver on this to
521find dead code / features (always inactive), 114 dead features were found in
522Linux using this methodology [1] (Section 8: Threats to validity).
523
524Confirming this could prove useful as Kconfig stands as one of the the leading
525industrial variability modeling languages [1] [2]. Its study would help
526evaluate practical uses of such languages, their use was only theoretical
527and real world requirements were not well understood. As it stands though
528only reverse engineering techniques have been used to deduce semantics from
529variability modeling languages such as Kconfig [3].
530
531[0] http://www.eng.uwaterloo.ca/~shshe/kconfig_semantics.pdf
532[1] http://gsd.uwaterloo.ca/sites/default/files/vm-2013-berger.pdf
533[2] http://gsd.uwaterloo.ca/sites/default/files/ase241-berger_0.pdf
534[3] http://gsd.uwaterloo.ca/sites/default/files/icse2011.pdf
535
536Full SAT solver for Kconfig
537~~~~~~~~~~~~~~~~~~~~~~~~~~~
538
539Although SAT solvers [0] haven't yet been used by Kconfig directly, as noted in
540the previous subsection, work has been done however to express in boolean
541abstraction the inferred semantics of Kconfig to translate Kconfig logic into
542boolean formulas and run a SAT solver on it [1]. Another known related project
543is CADOS [2] (former VAMOS [3]) and the tools, mainly undertaker [4], which has
544been introduced first with [5]. The basic concept of undertaker is to exract
545variability models from Kconfig, and put them together with a propositional
546formula extracted from CPP #ifdefs and build-rules into a SAT solver in order
547to find dead code, dead files, and dead symbols. If using a SAT solver is
548desirable on Kconfig one approach would be to evaluate repurposing such efforts
549somehow on Kconfig. There is enough interest from mentors of existing projects
550to not only help advise how to integrate this work upstream but also help
551maintain it long term. Interested developers should visit:
552
553http://kernelnewbies.org/KernelProjects/kconfig-sat
554
555[0] http://www.cs.cornell.edu/~sabhar/chapters/SATSolvers-KR-Handbook.pdf
556[1] http://gsd.uwaterloo.ca/sites/default/files/vm-2013-berger.pdf
557[2] https://cados.cs.fau.de
558[3] https://vamos.cs.fau.de
559[4] https://undertaker.cs.fau.de
560[5] https://www4.cs.fau.de/Publications/2011/tartler_11_eurosys.pdf