[PATCH v2] kernel: add kcov code coverage

[Dmitry Vyukov]

On Fri, Jan 22, 2016 at 12:55 PM, Mark Rutland <mark.rutland at arm.com> wrote:
> On Mon, Jan 18, 2016 at 09:09:43PM +0100, Dmitry Vyukov wrote:
>> On Mon, Jan 18, 2016 at 8:44 PM, Dmitry Vyukov <dvyukov at google.com> wrote:
>> > I've got several comments regarding the 4-byte compressed PCs. We've
>> > also discussed this internally.
>> > As the result in v4 I made it possible to export both compressed
>> > 4-byte PCs and full 8-byte PCs.
>> > Now init ioctl accepts the following struct and kernel can say whether
>> > it will export 4- or 8-byte PCs:
>> >
>> > struct kcov_init_trace {
>> >         unsigned long        flags; /* In: reserved, must be 0. */
>> >         unsigned long        size; /* In: trace buffer size. */
>> >         unsigned long        version;  /* Out: trace format, currently 1. */
>> >         /*
>> >          * Output.
>> >          * pc_size can be 4 or 8. If pc_size = 4 on a 64-bit arch,
>> >          * returned PCs are compressed by subtracting pc_base and then
>> >          * truncating to 4 bytes.
>> >          */
>> >         unsigned long        pc_size;
>> >         unsigned long        pc_base;
>> > };
>> >
>> > So for KASLR or other archs we can just export full 8-byte PCs.
>> >
>> > Regarding KASLR and dynamically loaded modules. I've looked at my
>> > use-case and concluded
>> > that most of the time I can work with "non-stable" PCs within a single
>> > VM. Whenever I need to
>> > store PCs persistently or send to another machine, I think I can
>> > "canonicalize" PCs using
>> > /proc/modules and /proc/kallsyms to something like (module hash,
>> > module offset). So kernel does
>> > not need to do this during coverage collection.
>>
>> On second though, maybe it's better to just always export unsigned long PCs...
>> Need to measure how much memory coverage information consumes,
>> and how much slower it is with uint64 PCs. Maybe I can live with large PCs,
>> or maybe I can make syzkaller require !KASLR and compress PCs in user-space...
>> Need to think about this more.
>
> I can imagine we might keep the expanded module range even in the
> absence of full KASLR, though I don't know how realistic that thought
> is.


The last version of the patch just exposes PCs as unsigned longs
without any compression. So it should not be a problem (at least for
kernel, now it's user responsibility to make sense out of the PCs).