CVS log for src/sys/sys/kcov.h

Up to [cvs.NetBSD.org] / src / sys / sys

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

Register eight vHCI buses, and use separate KCOV mailboxes for them.

Introduce kcov_silence_enter() and kcov_silence_leave(), to allow to
temporarily disable KCOV on the current lwp. Should be used in the rare
but problematic cases where extreme noise is introduced by an
uninteresting subsystem.

Use this capability to silence KCOV during the LOCKDEBUG lookups. This
divides the size of the KCOV output by more than two in my KCOV+vHCI
tests.

Introduce KCOV remote support. This allows to collect KCOV coverage on
threads other than curlwp, which is useful when fuzzing components that
defer processing, such as the network stack (partially runs in softints)
and the USB stack (partially runs in uhub kthreads).

A subsystem that whishes to provide coverage for its threads creates a
"mailbox" via kcov_remote_register() and gives it a (subsystem, id)
identifier. There is one mailbox per "target lwp". The target lwp(s)
must then call kcov_remote_enter() and kcov_remote_leave() with the
identifier, to respectively enable and disable coverage within the
thread.

On the userland side, the fuzzer has access to the mailboxes on the
system with the KCOV_IOC_REMOTE_ATTACH and KCOV_IOC_REMOTE_DETACH ioctls.
When attached to a mailbox with a given identifier, the KCOV_IOC_ENABLE,
KCOV_IOC_DISABLE and mmap() operations will affect the mailbox.

As a demonstrator, the vHCI subsystem is changed to use KCOV mailboxes.
When the vHCI bus attaches it creates as many mailboxes as it has USB
ports, each mailbox being associated with a distinct port. Uhub is changed
to enable KCOV coverage in usbd_new_device(). With that in place, all of
the USB enumeration procedure can be traced with KCOV.

Merge changes from current as of 20200406

Drop specificdata from KCOV, kMSan doesn't interact well with it. Also
reduces the overhead.

Sync with HEAD

file kcov.h was added on branch phil-wifi on 2019-06-10 22:09:57 +0000

Drop no longer needed macros KCOV_STORE() KCOV_LOAD() in kcov(4)

Corrently KCOV_STORE() and KCOV_LOAD() are equivalent to x=y.

Obtained from <R3x>

Rely on volatile operations in KCOV data types

Extra atomicity isn't needed and makes maintenance burden between CPUs.

Fixes build issue on NetBSD/i386 reported by <msaitoh>

Add support for trace type selection in kcov(4)

Allow to specify mode in KCOV_IOC_ENABLE synchronizing the functionality
with Linux, FreeBSD and OpenBSD. As a NetBSD (and OpenBSD) specific of
the ioctl(2) interface, the mode argument has to be specified as &value
rather than value.

There are 3 modes available:
 1. KCOV_MODE_NONE       -- no trace specified, useful for testing purposes
 2. KCOV_MODE_TRACE_PC   -- trace the kernel program counter
 3. KCOV_MODE_TRACE_CMP  -- trace comparison instructions and switch statements

Adapt the ATF tests and documentation for new API.

The KCOV_MODE_TRACE_CMP mode is implemented but still awaits for the
GCC 8.x upgrade or selection of Clang/LLVM as the kernel compiler.

Obtained from OpenBSD and adapted for NetBSD by myself.

Fix typo in kcov.h

Should fix i386.

Add KCOV_LOAD() and KCOV_STORE() - new helper macros

New macros prefer 64-bit atomic operations whenever accessible.

As a fallback they use volatile move operations that are not known
to have negative effect in KCOV even if interrupted in the middle of
operation.

Enable kcov_basic and kcov_thread tests on targets without
__HAVE_ATOMIC64_OPS.

Add KCOV - kernel code coverage tracing device

The KCOV driver implements collection of code coverage inside the kernel.
It can be enabled on a per process basis from userland, allowing the kernel
program counter to be collected during syscalls triggered by the same
process.

The device is oriented towards kernel fuzzers, in particular syzkaller.

Currently the only supported coverage type is -fsanitize-coverage=trace-pc.

The KCOV driver was initially developed in Linux. A driver based on the
same concept was then implemented in FreeBSD and OpenBSD.

Documentation is borrowed from OpenBSD and ATF tests from FreeBSD.

This patch has been prepared by Siddharth Muralee, improved by <maxv>
and polished by myself before importing into the mainline tree.

All ATF tests pass.