kcov: initial implementation

Implement a device (/dev/kcov) that exposes coverage info for the
kernel. This will be especially useful for coverage-based fuzzing (e.g.
syzkaller).

Exclude a lot of functions which would crash/otherwise interfere in the
coverage, including only processing coverage callbacks when not handling
an irq.
This commit is contained in:
Matheus
2026-10-06 11:05:58 -03:00
parent 111a8696d8
commit e4a4896b4b
14 changed files with 581 additions and 25 deletions
+1 -1
View File
@@ -116,7 +116,7 @@ void arch_extracontext_save(extracontext_t *context) {
}
}
void arch_extracontext_load(extracontext_t *context) {
KCOV_DISABLED void arch_extracontext_load(extracontext_t *context) {
if (current_thread()->proc && current_thread()->proc->ldt)
arch_gdt_set_ldt(current_thread()->proc->ldt, 0xffff);
else
+1 -1
View File
@@ -140,7 +140,7 @@ bool arch_cpu_smap_enabled(void) {
return has_smap;
}
void arch_nmi_isr(context_t *ctx) {
KCOV_DISABLED void arch_nmi_isr(context_t *ctx) {
// we are in an NMI context, running on IST0
// first load the proper gsbase to get access to cpu-local variables.
// the pointer to cpu's data is at the beggining of the stack so after the context struct.
+3 -2
View File
@@ -9,6 +9,7 @@
#include <kernel/alloc.h>
#include <kernel/init.h>
#include <arch/context.h>
#include <kernel/kcov.h>
#include <arch/prof.h>
DEFINE_KERNEL_ARGUMENT(nosmp, bool);
@@ -21,12 +22,12 @@ static volatile struct limine_mp_request smprequest = {
size_t arch_smp_cpusawake = 1;
// for panic. if the nosmp argument is given to the kernel, this is what the APs will jump to
static void cpuwakeuphalt(struct limine_mp_info *info) {
KCOV_DISABLED static void cpuwakeuphalt(struct limine_mp_info *info) {
asm("cli");
for (;;) CPU_HALT();
}
static void cpuwakeup(struct limine_mp_info *info) {
KCOV_DISABLED static void cpuwakeup(struct limine_mp_info *info) {
cpu_set((cpu_t *)info->extra_argument);
arch_gdt_reload();