mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-28 11:18:45 +07:00
5c9a8750a6
kcov provides code coverage collection for coverage-guided fuzzing (randomized testing). Coverage-guided fuzzing is a testing technique that uses coverage feedback to determine new interesting inputs to a system. A notable user-space example is AFL (http://lcamtuf.coredump.cx/afl/). However, this technique is not widely used for kernel testing due to missing compiler and kernel support. kcov does not aim to collect as much coverage as possible. It aims to collect more or less stable coverage that is function of syscall inputs. To achieve this goal it does not collect coverage in soft/hard interrupts and instrumentation of some inherently non-deterministic or non-interesting parts of kernel is disbled (e.g. scheduler, locking). Currently there is a single coverage collection mode (tracing), but the API anticipates additional collection modes. Initially I also implemented a second mode which exposes coverage in a fixed-size hash table of counters (what Quentin used in his original patch). I've dropped the second mode for simplicity. This patch adds the necessary support on kernel side. The complimentary compiler support was added in gcc revision 231296. We've used this support to build syzkaller system call fuzzer, which has found 90 kernel bugs in just 2 months: https://github.com/google/syzkaller/wiki/Found-Bugs We've also found 30+ bugs in our internal systems with syzkaller. Another (yet unexplored) direction where kcov coverage would greatly help is more traditional "blob mutation". For example, mounting a random blob as a filesystem, or receiving a random blob over wire. Why not gcov. Typical fuzzing loop looks as follows: (1) reset coverage, (2) execute a bit of code, (3) collect coverage, repeat. A typical coverage can be just a dozen of basic blocks (e.g. an invalid input). In such context gcov becomes prohibitively expensive as reset/collect coverage steps depend on total number of basic blocks/edges in program (in case of kernel it is about 2M). Cost of kcov depends only on number of executed basic blocks/edges. On top of that, kernel requires per-thread coverage because there are always background threads and unrelated processes that also produce coverage. With inlined gcov instrumentation per-thread coverage is not possible. kcov exposes kernel PCs and control flow to user-space which is insecure. But debugfs should not be mapped as user accessible. Based on a patch by Quentin Casasnovas. [akpm@linux-foundation.org: make task_struct.kcov_mode have type `enum kcov_mode'] [akpm@linux-foundation.org: unbreak allmodconfig] [akpm@linux-foundation.org: follow x86 Makefile layout standards] Signed-off-by: Dmitry Vyukov <dvyukov@google.com> Reviewed-by: Kees Cook <keescook@chromium.org> Cc: syzkaller <syzkaller@googlegroups.com> Cc: Vegard Nossum <vegard.nossum@oracle.com> Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Tavis Ormandy <taviso@google.com> Cc: Will Deacon <will.deacon@arm.com> Cc: Quentin Casasnovas <quentin.casasnovas@oracle.com> Cc: Kostya Serebryany <kcc@google.com> Cc: Eric Dumazet <edumazet@google.com> Cc: Alexander Potapenko <glider@google.com> Cc: Kees Cook <keescook@google.com> Cc: Bjorn Helgaas <bhelgaas@google.com> Cc: Sasha Levin <sasha.levin@oracle.com> Cc: David Drysdale <drysdale@google.com> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: Kirill A. Shutemov <kirill@shutemov.name> Cc: Jiri Slaby <jslaby@suse.cz> Cc: Ingo Molnar <mingo@elte.hu> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: "H. Peter Anvin" <hpa@zytor.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
84 lines
3.3 KiB
Makefile
84 lines
3.3 KiB
Makefile
#
|
|
# The stub may be linked into the kernel proper or into a separate boot binary,
|
|
# but in either case, it executes before the kernel does (with MMU disabled) so
|
|
# things like ftrace and stack-protector are likely to cause trouble if left
|
|
# enabled, even if doing so doesn't break the build.
|
|
#
|
|
cflags-$(CONFIG_X86_32) := -march=i386
|
|
cflags-$(CONFIG_X86_64) := -mcmodel=small
|
|
cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ $(LINUX_INCLUDE) -O2 \
|
|
-fPIC -fno-strict-aliasing -mno-red-zone \
|
|
-mno-mmx -mno-sse
|
|
|
|
cflags-$(CONFIG_ARM64) := $(subst -pg,,$(KBUILD_CFLAGS))
|
|
cflags-$(CONFIG_ARM) := $(subst -pg,,$(KBUILD_CFLAGS)) \
|
|
-fno-builtin -fpic -mno-single-pic-base
|
|
|
|
cflags-$(CONFIG_EFI_ARMSTUB) += -I$(srctree)/scripts/dtc/libfdt
|
|
|
|
KBUILD_CFLAGS := $(cflags-y) -DDISABLE_BRANCH_PROFILING \
|
|
$(call cc-option,-ffreestanding) \
|
|
$(call cc-option,-fno-stack-protector)
|
|
|
|
GCOV_PROFILE := n
|
|
KASAN_SANITIZE := n
|
|
UBSAN_SANITIZE := n
|
|
OBJECT_FILES_NON_STANDARD := y
|
|
|
|
# Prevents link failures: __sanitizer_cov_trace_pc() is not linked in.
|
|
KCOV_INSTRUMENT := n
|
|
|
|
lib-y := efi-stub-helper.o
|
|
|
|
# include the stub's generic dependencies from lib/ when building for ARM/arm64
|
|
arm-deps := fdt_rw.c fdt_ro.c fdt_wip.c fdt.c fdt_empty_tree.c fdt_sw.c sort.c
|
|
|
|
$(obj)/lib-%.o: $(srctree)/lib/%.c FORCE
|
|
$(call if_changed_rule,cc_o_c)
|
|
|
|
lib-$(CONFIG_EFI_ARMSTUB) += arm-stub.o fdt.o string.o \
|
|
$(patsubst %.c,lib-%.o,$(arm-deps))
|
|
|
|
lib-$(CONFIG_ARM) += arm32-stub.o
|
|
lib-$(CONFIG_ARM64) += arm64-stub.o random.o
|
|
CFLAGS_arm64-stub.o := -DTEXT_OFFSET=$(TEXT_OFFSET)
|
|
|
|
#
|
|
# arm64 puts the stub in the kernel proper, which will unnecessarily retain all
|
|
# code indefinitely unless it is annotated as __init/__initdata/__initconst etc.
|
|
# So let's apply the __init annotations at the section level, by prefixing
|
|
# the section names directly. This will ensure that even all the inline string
|
|
# literals are covered.
|
|
# The fact that the stub and the kernel proper are essentially the same binary
|
|
# also means that we need to be extra careful to make sure that the stub does
|
|
# not rely on any absolute symbol references, considering that the virtual
|
|
# kernel mapping that the linker uses is not active yet when the stub is
|
|
# executing. So build all C dependencies of the EFI stub into libstub, and do
|
|
# a verification pass to see if any absolute relocations exist in any of the
|
|
# object files.
|
|
#
|
|
extra-$(CONFIG_EFI_ARMSTUB) := $(lib-y)
|
|
lib-$(CONFIG_EFI_ARMSTUB) := $(patsubst %.o,%.stub.o,$(lib-y))
|
|
|
|
STUBCOPY_FLAGS-y := -R .debug* -R *ksymtab* -R *kcrctab*
|
|
STUBCOPY_FLAGS-$(CONFIG_ARM64) += --prefix-alloc-sections=.init \
|
|
--prefix-symbols=__efistub_
|
|
STUBCOPY_RELOC-$(CONFIG_ARM64) := R_AARCH64_ABS
|
|
|
|
$(obj)/%.stub.o: $(obj)/%.o FORCE
|
|
$(call if_changed,stubcopy)
|
|
|
|
quiet_cmd_stubcopy = STUBCPY $@
|
|
cmd_stubcopy = if $(OBJCOPY) $(STUBCOPY_FLAGS-y) $< $@; then \
|
|
$(OBJDUMP) -r $@ | grep $(STUBCOPY_RELOC-y) \
|
|
&& (echo >&2 "$@: absolute symbol references not allowed in the EFI stub"; \
|
|
rm -f $@; /bin/false); else /bin/false; fi
|
|
|
|
#
|
|
# ARM discards the .data section because it disallows r/w data in the
|
|
# decompressor. So move our .data to .data.efistub, which is preserved
|
|
# explicitly by the decompressor linker script.
|
|
#
|
|
STUBCOPY_FLAGS-$(CONFIG_ARM) += --rename-section .data=.data.efistub
|
|
STUBCOPY_RELOC-$(CONFIG_ARM) := R_ARM_ABS
|