kcov: initial implementation

Implement a device (/dev/kcov) that exposes coverage info for the
kernel. This will be especially useful for coverage-based fuzzing (e.g.
syzkaller).

Exclude a lot of functions which would crash/otherwise interfere in the
coverage, including only processing coverage callbacks when not handling
an irq.
This commit is contained in:
Matheus
2026-10-06 11:05:58 -03:00
parent 111a8696d8
commit e4a4896b4b
14 changed files with 581 additions and 25 deletions
+13 -7
View File
@@ -122,41 +122,47 @@ void arch_cpu_user_access_end(void);
bool arch_cpu_smep_enabled(void);
bool arch_cpu_smap_enabled(void);
static inline __attribute__((always_inline)) thread_t *current_thread(void) {
KCOV_DISABLED static inline __attribute__((always_inline)) thread_t *current_thread(void) {
thread_t *thread;
asm volatile ("mov %%gs:0, %%rax" : "=a"(thread) : : "memory");
return thread;
}
static inline __attribute__((always_inline)) cpu_t *current_cpu(void) {
KCOV_DISABLED static inline __attribute__((always_inline)) cpu_t *current_cpu(void) {
cpu_t *cpu;
asm volatile ("mov %%gs:8, %%rax" : "=a"(cpu) : : "memory");
return cpu;
}
static inline __attribute__((always_inline)) mm_context_t *current_mm_context(void) {
KCOV_DISABLED static inline __attribute__((always_inline)) mm_context_t *current_mm_context(void) {
mm_context_t *context;
asm volatile ("mov %%gs:16, %%rax" : "=a"(context) : : "memory");
return context;
}
static inline __attribute__((always_inline)) void set_current_mm_context(mm_context_t *context) {
KCOV_DISABLED static inline __attribute__((always_inline)) void set_current_mm_context(mm_context_t *context) {
asm volatile ("mov %%rax, %%gs:16" : : "a"(context) : "memory");
}
static inline __attribute__((always_inline)) long current_cpu_internal_id(void) {
KCOV_DISABLED static inline __attribute__((always_inline)) long current_cpu_internal_id(void) {
long id;
asm volatile ("mov %%gs:32, %%rax" : "=a"(id) : : "memory");
return id;
}
static inline __attribute__((always_inline)) long current_cpu_id(void) {
KCOV_DISABLED static inline __attribute__((always_inline)) long current_cpu_id(void) {
long id;
asm volatile ("mov %%gs:24, %%rax" : "=a"(id) : : "memory");
return id;
}
static inline void cpu_set(cpu_t *ptr) {
KCOV_DISABLED static inline __attribute__((always_inline)) unsigned long current_irq_depth(void) {
long depth;
asm volatile ("mov %%gs:48, %%rax" : "=a"(depth) : : "memory");
return depth;
}
KCOV_DISABLED static inline __attribute__((always_inline)) void cpu_set(cpu_t *ptr) {
ptr->self = ptr;
wrmsr(MSR_GSBASE, (uint64_t)ptr);
}
+3 -2
View File
@@ -2,6 +2,7 @@
#define _MSR_H
#include <stdint.h>
#include <kernel/kcov.h>
#define MSR_IA32APICBASE 0x1B
#define MSR_PERF_FIXED_CTR2 0x30b
@@ -20,13 +21,13 @@
#define MSR_KVM_SYSTEM_TIME_NEW 0x4b564d01
static inline uint64_t rdmsr(uint32_t which) {
KCOV_DISABLED static inline uint64_t rdmsr(uint32_t which) {
uint64_t low,high;
asm volatile("rdmsr" : "=a"(low), "=d"(high) : "c"(which));
return (high << 32) | low;
}
static inline void wrmsr(uint32_t which, uint64_t value) {
KCOV_DISABLED static inline void wrmsr(uint32_t which, uint64_t value) {
uint32_t low = value & 0xFFFFFFFF;
uint32_t high = (value >> 32) & 0xFFFFFFFF;
asm volatile("wrmsr" : : "a"(low), "d"(high), "c"(which));