• Andrey Konovalov's avatar
    kcov: remote coverage support · eec028c9
    Andrey Konovalov authored
    Patch series " kcov: collect coverage from usb and vhost", v3.
    
    This patchset extends kcov to allow collecting coverage from backgound
    kernel threads.  This extension requires custom annotations for each of
    the places where coverage collection is desired.  This patchset
    implements this for hub events in the USB subsystem and for vhost
    workers.  See the first patch description for details about the kcov
    extension.  The other two patches apply this kcov extension to USB and
    vhost.
    
    Examples of other subsystems that might potentially benefit from this
    when custom annotations are added (the list is based on
    process_one_work() callers for bugs recently reported by syzbot):
    
    1. fs: writeback wb_workfn() worker,
    2. net: addrconf_dad_work()/addrconf_verify_work() workers,
    3. net: neigh_periodic_work() worker,
    4. net/p9: p9_write_work()/p9_read_work() workers,
    5. block: blk_mq_run_work_fn() worker.
    
    These patches have been used to enable coverage-guided USB fuzzing with
    syzkaller for the last few years, see the details here:
    
      https://github.com/google/syzkaller/blob/master/docs/linux/external_fuzzing_usb.md
    
    This patchset has been pushed to the public Linux kernel Gerrit
    instance:
    
      https://linux-review.googlesource.com/c/linux/kernel/git/torvalds/linux/+/1524
    
    This patch (of 3):
    
    Add background thread coverage collection ability to kcov.
    
    With KCOV_ENABLE coverage is collected only for syscalls that are issued
    from the current process.  With KCOV_REMOTE_ENABLE it's possible to
    collect coverage for arbitrary parts of the kernel code, provided that
    those parts are annotated with kcov_remote_start()/kcov_remote_stop().
    
    This allows to collect coverage from two types of kernel background
    threads: the global ones, that are spawned during kernel boot in a
    limited number of instances (e.g.  one USB hub_event() worker thread is
    spawned per USB HCD); and the local ones, that are spawned when a user
    interacts with some kernel interface (e.g.  vhost workers).
    
    To enable collecting coverage from a global background thread, a unique
    global handle must be assigned and passed to the corresponding
    kcov_remote_start() call.  Then a userspace process can pass a list of
    such handles to the KCOV_REMOTE_ENABLE ioctl in the handles array field
    of the kcov_remote_arg struct.  This will attach the used kcov device to
    the code sections, that are referenced by those handles.
    
    Since there might be many local background threads spawned from
    different userspace processes, we can't use a single global handle per
    annotation.  Instead, the userspace process passes a non-zero handle
    through the common_handle field of the kcov_remote_arg struct.  This
    common handle gets saved to the kcov_handle field in the current
    task_struct and needs to be passed to the newly spawned threads via
    custom annotations.  Those threads should in turn be annotated with
    kcov_remote_start()/kcov_remote_stop().
    
    Internally kcov stores handles as u64 integers.  The top byte of a
    handle is used to denote the id of a subsystem that this handle belongs
    to, and the lower 4 bytes are used to denote the id of a thread instance
    within that subsystem.  A reserved value 0 is used as a subsystem id for
    common handles as they don't belong to a particular subsystem.  The
    bytes 4-7 are currently reserved and must be zero.  In the future the
    number of bytes used for the subsystem or handle ids might be increased.
    
    When a particular userspace process collects coverage by via a common
    handle, kcov will collect coverage for each code section that is
    annotated to use the common handle obtained as kcov_handle from the
    current task_struct.  However non common handles allow to collect
    coverage selectively from different subsystems.
    
    Link: http://lkml.kernel.org/r/e90e315426a384207edbec1d6aa89e43008e4caf.1572366574.git.andreyknvl@google.comSigned-off-by: default avatarAndrey Konovalov <andreyknvl@google.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: Alan Stern <stern@rowland.harvard.edu>
    Cc: "Michael S. Tsirkin" <mst@redhat.com>
    Cc: Jason Wang <jasowang@redhat.com>
    Cc: Arnd Bergmann <arnd@arndb.de>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Cc: David Windsor <dwindsor@gmail.com>
    Cc: Elena Reshetova <elena.reshetova@intel.com>
    Cc: Anders Roxell <anders.roxell@linaro.org>
    Cc: Alexander Potapenko <glider@google.com>
    Cc: Marco Elver <elver@google.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    eec028c9
kcov.rst 11 KB