kcov: initial implementation

Implement a device (/dev/kcov) that exposes coverage info for the
kernel. This will be especially useful for coverage-based fuzzing (e.g.
syzkaller).

Exclude a lot of functions which would crash/otherwise interfere in the
coverage, including only processing coverage callbacks when not handling
an irq.

kernel-src/include/kernel/kcov.h

@@ -0,0 +1,43 @@
+#ifndef _KCOV_H
+#define _KCOV_H
+
+#include <stdint.h>
+#include <stddef.h>
+#include <mutex.h>
+
+#ifdef KCOV_ENABLED
+#define KCOV_DISABLED __attribute__((no_sanitize_coverage))
+#else
+#define KCOV_DISABLED
+#endif
+
+#define KCOV_MODE_DISABLED 0
+#define KCOV_MODE_PC 1
+#define KCOV_MODE_CMP 2
+
+#define KCOV_CMP_FLAGS_CONST 1
+#define KCOV_CMP_FLAGS_8BIT 0
+#define KCOV_CMP_FLAGS_16BIT 2
+#define KCOV_CMP_FLAGS_32BIT 4
+#define KCOV_CMP_FLAGS_64BIT 6
+
+typedef struct {
+	unsigned int mode;
+	mutex_t mapping_mutex;
+	unsigned int entry_count; // protected by mutex
+	uint64_t *buffer; // pointer protected by mutex
+	size_t mappings; // protected by mutex
+	unsigned int refcount;
+	unsigned int minor;
+	void *vnode_handle;
+} kcov_t;
+
+void kcov_publish_pc(uint64_t pc);
+void kcov_publish_cmp(uint64_t pc, uint64_t v1, uint64_t v2, uint64_t flags);
+int kcov_set_buffer_size(unsigned int entry_count);
+int kcov_set_mode(unsigned int mode);
+void kcov_hold(kcov_t *kcov);
+void kcov_release(kcov_t *kcov);
+void kcov_free_buffer(kcov_t *kcov);
+
+#endif

kernel-src/include/kernel/thread.h

@@ -6,6 +6,7 @@
 #include <kernel/abi.h>
 #include <kernel/signal.h>
 #include <kernel/event.h>
+#include <kernel/kcov.h>
 
 #define THREAD_FLAGS_QUEUED 1
 #define THREAD_FLAGS_RUNNING 2
@@ -31,6 +32,9 @@ typedef struct thread_t {
 	struct cpu_t *cpu;
 	struct cpu_t *cputarget;
 	struct cpu_t *last_cpu;
+#ifdef KCOV_ENABLED
+	kcov_t *kcov;
+#endif
 	context_t context;
 	extracontext_t extracontext;
 	void *kernelstack;

kernel-src/include/x86-64/arch/cpu.h

@@ -122,41 +122,47 @@ void arch_cpu_user_access_end(void);
 bool arch_cpu_smep_enabled(void);
 bool arch_cpu_smap_enabled(void);
 
-static inline __attribute__((always_inline)) thread_t *current_thread(void) {
+KCOV_DISABLED static inline __attribute__((always_inline)) thread_t *current_thread(void) {
 	thread_t *thread;
 	asm volatile ("mov %%gs:0, %%rax" : "=a"(thread) : : "memory");
 	return thread;
 }
 
-static inline __attribute__((always_inline)) cpu_t *current_cpu(void) {
+KCOV_DISABLED static inline __attribute__((always_inline)) cpu_t *current_cpu(void) {
 	cpu_t *cpu;
 	asm volatile ("mov %%gs:8, %%rax" : "=a"(cpu) : : "memory");
 	return cpu;
 }
 
-static inline __attribute__((always_inline)) mm_context_t *current_mm_context(void) {
+KCOV_DISABLED static inline __attribute__((always_inline)) mm_context_t *current_mm_context(void) {
 	mm_context_t *context;
 	asm volatile ("mov %%gs:16, %%rax" : "=a"(context) : : "memory");
 	return context;
 }
 
-static inline __attribute__((always_inline)) void set_current_mm_context(mm_context_t *context) {
+KCOV_DISABLED static inline __attribute__((always_inline)) void set_current_mm_context(mm_context_t *context) {
 	asm volatile ("mov %%rax, %%gs:16" : : "a"(context) : "memory");
 }
 
-static inline __attribute__((always_inline)) long current_cpu_internal_id(void) {
+KCOV_DISABLED static inline __attribute__((always_inline)) long current_cpu_internal_id(void) {
 	long id;
 	asm volatile ("mov %%gs:32, %%rax" : "=a"(id) : : "memory");
 	return id;
 }
 
-static inline __attribute__((always_inline)) long current_cpu_id(void) {
+KCOV_DISABLED static inline __attribute__((always_inline)) long current_cpu_id(void) {
 	long id;
 	asm volatile ("mov %%gs:24, %%rax" : "=a"(id) : : "memory");
 	return id;
 }
 
-static inline void cpu_set(cpu_t *ptr) {
+KCOV_DISABLED static inline __attribute__((always_inline)) unsigned long current_irq_depth(void) {
+	long depth;
+	asm volatile ("mov %%gs:48, %%rax" : "=a"(depth) : : "memory");
+	return depth;
+}
+
+KCOV_DISABLED static inline __attribute__((always_inline)) void cpu_set(cpu_t *ptr) {
 	ptr->self = ptr;
 	wrmsr(MSR_GSBASE, (uint64_t)ptr);
 }

kernel-src/include/x86-64/arch/msr.h

@@ -2,6 +2,7 @@
 #define _MSR_H
 
 #include <stdint.h>
+#include <kernel/kcov.h>
 
 #define MSR_IA32APICBASE 0x1B
 #define MSR_PERF_FIXED_CTR2 0x30b
@@ -20,13 +21,13 @@
 
 #define MSR_KVM_SYSTEM_TIME_NEW 0x4b564d01
 
-static inline uint64_t rdmsr(uint32_t which) {
+KCOV_DISABLED static inline uint64_t rdmsr(uint32_t which) {
 	uint64_t low,high;
 	asm volatile("rdmsr" : "=a"(low), "=d"(high) : "c"(which));
 	return (high << 32) | low;
 }
 
-static inline void wrmsr(uint32_t which, uint64_t value) {
+KCOV_DISABLED static inline void wrmsr(uint32_t which, uint64_t value) {
 	uint32_t low = value & 0xFFFFFFFF;
 	uint32_t high = (value >> 32) & 0xFFFFFFFF;
 	asm volatile("wrmsr" : : "a"(low), "d"(high), "c"(which));