mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-24 16:57:53 +07:00
eec028c938
Patch series " kcov: collect coverage from usb and vhost", v3. This patchset extends kcov to allow collecting coverage from backgound kernel threads. This extension requires custom annotations for each of the places where coverage collection is desired. This patchset implements this for hub events in the USB subsystem and for vhost workers. See the first patch description for details about the kcov extension. The other two patches apply this kcov extension to USB and vhost. Examples of other subsystems that might potentially benefit from this when custom annotations are added (the list is based on process_one_work() callers for bugs recently reported by syzbot): 1. fs: writeback wb_workfn() worker, 2. net: addrconf_dad_work()/addrconf_verify_work() workers, 3. net: neigh_periodic_work() worker, 4. net/p9: p9_write_work()/p9_read_work() workers, 5. block: blk_mq_run_work_fn() worker. These patches have been used to enable coverage-guided USB fuzzing with syzkaller for the last few years, see the details here: https://github.com/google/syzkaller/blob/master/docs/linux/external_fuzzing_usb.md This patchset has been pushed to the public Linux kernel Gerrit instance: https://linux-review.googlesource.com/c/linux/kernel/git/torvalds/linux/+/1524 This patch (of 3): Add background thread coverage collection ability to kcov. With KCOV_ENABLE coverage is collected only for syscalls that are issued from the current process. With KCOV_REMOTE_ENABLE it's possible to collect coverage for arbitrary parts of the kernel code, provided that those parts are annotated with kcov_remote_start()/kcov_remote_stop(). This allows to collect coverage from two types of kernel background threads: the global ones, that are spawned during kernel boot in a limited number of instances (e.g. one USB hub_event() worker thread is spawned per USB HCD); and the local ones, that are spawned when a user interacts with some kernel interface (e.g. vhost workers). To enable collecting coverage from a global background thread, a unique global handle must be assigned and passed to the corresponding kcov_remote_start() call. Then a userspace process can pass a list of such handles to the KCOV_REMOTE_ENABLE ioctl in the handles array field of the kcov_remote_arg struct. This will attach the used kcov device to the code sections, that are referenced by those handles. Since there might be many local background threads spawned from different userspace processes, we can't use a single global handle per annotation. Instead, the userspace process passes a non-zero handle through the common_handle field of the kcov_remote_arg struct. This common handle gets saved to the kcov_handle field in the current task_struct and needs to be passed to the newly spawned threads via custom annotations. Those threads should in turn be annotated with kcov_remote_start()/kcov_remote_stop(). Internally kcov stores handles as u64 integers. The top byte of a handle is used to denote the id of a subsystem that this handle belongs to, and the lower 4 bytes are used to denote the id of a thread instance within that subsystem. A reserved value 0 is used as a subsystem id for common handles as they don't belong to a particular subsystem. The bytes 4-7 are currently reserved and must be zero. In the future the number of bytes used for the subsystem or handle ids might be increased. When a particular userspace process collects coverage by via a common handle, kcov will collect coverage for each code section that is annotated to use the common handle obtained as kcov_handle from the current task_struct. However non common handles allow to collect coverage selectively from different subsystems. Link: http://lkml.kernel.org/r/e90e315426a384207edbec1d6aa89e43008e4caf.1572366574.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Alan Stern <stern@rowland.harvard.edu> Cc: "Michael S. Tsirkin" <mst@redhat.com> Cc: Jason Wang <jasowang@redhat.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Steven Rostedt <rostedt@goodmis.org> Cc: David Windsor <dwindsor@gmail.com> Cc: Elena Reshetova <elena.reshetova@intel.com> Cc: Anders Roxell <anders.roxell@linaro.org> Cc: Alexander Potapenko <glider@google.com> Cc: Marco Elver <elver@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
64 lines
1.9 KiB
C
64 lines
1.9 KiB
C
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
|
|
#ifndef _LINUX_KCOV_IOCTLS_H
|
|
#define _LINUX_KCOV_IOCTLS_H
|
|
|
|
#include <linux/types.h>
|
|
|
|
/*
|
|
* Argument for KCOV_REMOTE_ENABLE ioctl, see Documentation/dev-tools/kcov.rst
|
|
* and the comment before kcov_remote_start() for usage details.
|
|
*/
|
|
struct kcov_remote_arg {
|
|
unsigned int trace_mode; /* KCOV_TRACE_PC or KCOV_TRACE_CMP */
|
|
unsigned int area_size; /* Length of coverage buffer in words */
|
|
unsigned int num_handles; /* Size of handles array */
|
|
__u64 common_handle;
|
|
__u64 handles[0];
|
|
};
|
|
|
|
#define KCOV_REMOTE_MAX_HANDLES 0x100
|
|
|
|
#define KCOV_INIT_TRACE _IOR('c', 1, unsigned long)
|
|
#define KCOV_ENABLE _IO('c', 100)
|
|
#define KCOV_DISABLE _IO('c', 101)
|
|
#define KCOV_REMOTE_ENABLE _IOW('c', 102, struct kcov_remote_arg)
|
|
|
|
enum {
|
|
/*
|
|
* Tracing coverage collection mode.
|
|
* Covered PCs are collected in a per-task buffer.
|
|
* In new KCOV version the mode is chosen by calling
|
|
* ioctl(fd, KCOV_ENABLE, mode). In older versions the mode argument
|
|
* was supposed to be 0 in such a call. So, for reasons of backward
|
|
* compatibility, we have chosen the value KCOV_TRACE_PC to be 0.
|
|
*/
|
|
KCOV_TRACE_PC = 0,
|
|
/* Collecting comparison operands mode. */
|
|
KCOV_TRACE_CMP = 1,
|
|
};
|
|
|
|
/*
|
|
* The format for the types of collected comparisons.
|
|
*
|
|
* Bit 0 shows whether one of the arguments is a compile-time constant.
|
|
* Bits 1 & 2 contain log2 of the argument size, up to 8 bytes.
|
|
*/
|
|
#define KCOV_CMP_CONST (1 << 0)
|
|
#define KCOV_CMP_SIZE(n) ((n) << 1)
|
|
#define KCOV_CMP_MASK KCOV_CMP_SIZE(3)
|
|
|
|
#define KCOV_SUBSYSTEM_COMMON (0x00ull << 56)
|
|
#define KCOV_SUBSYSTEM_USB (0x01ull << 56)
|
|
|
|
#define KCOV_SUBSYSTEM_MASK (0xffull << 56)
|
|
#define KCOV_INSTANCE_MASK (0xffffffffull)
|
|
|
|
static inline __u64 kcov_remote_handle(__u64 subsys, __u64 inst)
|
|
{
|
|
if (subsys & ~KCOV_SUBSYSTEM_MASK || inst & ~KCOV_INSTANCE_MASK)
|
|
return 0;
|
|
return subsys | inst;
|
|
}
|
|
|
|
#endif /* _LINUX_KCOV_IOCTLS_H */
|