temporarily disable KCOV on the current lwp. Should be used in the rare
but problematic cases where extreme noise is introduced by an
uninteresting subsystem.
Use this capability to silence KCOV during the LOCKDEBUG lookups. This
divides the size of the KCOV output by more than two in my KCOV+vHCI
tests.
threads other than curlwp, which is useful when fuzzing components that
defer processing, such as the network stack (partially runs in softints)
and the USB stack (partially runs in uhub kthreads).
A subsystem that whishes to provide coverage for its threads creates a
"mailbox" via kcov_remote_register() and gives it a (subsystem, id)
identifier. There is one mailbox per "target lwp". The target lwp(s)
must then call kcov_remote_enter() and kcov_remote_leave() with the
identifier, to respectively enable and disable coverage within the
thread.
On the userland side, the fuzzer has access to the mailboxes on the
system with the KCOV_IOC_REMOTE_ATTACH and KCOV_IOC_REMOTE_DETACH ioctls.
When attached to a mailbox with a given identifier, the KCOV_IOC_ENABLE,
KCOV_IOC_DISABLE and mmap() operations will affect the mailbox.
As a demonstrator, the vHCI subsystem is changed to use KCOV mailboxes.
When the vHCI bus attaches it creates as many mailboxes as it has USB
ports, each mailbox being associated with a distinct port. Uhub is changed
to enable KCOV coverage in usbd_new_device(). With that in place, all of
the USB enumeration procedure can be traced with KCOV.
fsanitize flag on subr_kcov.c, which means that kMSan will instrument KCOV.
We add a bunch of __nomsan attributes to reduce this instrumentation, but
it does not remove it completely. That's fine.
Add new tests verifying dup2(2) scenarios:
- kcov_dup2
- kcov_basic_dup2_pc
- kcov_basic_dup2_cmp
The dup2(2) trick is used by syzkaller and assert that it works.
All new tests pass.
While there add minor non-functional cleanup changes.
Allow to specify mode in KCOV_IOC_ENABLE synchronizing the functionality
with Linux, FreeBSD and OpenBSD. As a NetBSD (and OpenBSD) specific of
the ioctl(2) interface, the mode argument has to be specified as &value
rather than value.
There are 3 modes available:
1. KCOV_MODE_NONE -- no trace specified, useful for testing purposes
2. KCOV_MODE_TRACE_PC -- trace the kernel program counter
3. KCOV_MODE_TRACE_CMP -- trace comparison instructions and switch statements
Adapt the ATF tests and documentation for new API.
The KCOV_MODE_TRACE_CMP mode is implemented but still awaits for the
GCC 8.x upgrade or selection of Clang/LLVM as the kernel compiler.
Obtained from OpenBSD and adapted for NetBSD by myself.
Reuse the fd_clone() API to associate kcov descriptors (KD) with a file
descriptor. Each fd (/dev/kcov) can be reused for a single LWP.
Add new ATF regression tests and cleanup existing code there. All tests
pass.
Refresh the kcov(4) man page documentation.
Developed with help from <maxv>.
The KCOV driver implements collection of code coverage inside the kernel.
It can be enabled on a per process basis from userland, allowing the kernel
program counter to be collected during syscalls triggered by the same
process.
The device is oriented towards kernel fuzzers, in particular syzkaller.
Currently the only supported coverage type is -fsanitize-coverage=trace-pc.
The KCOV driver was initially developed in Linux. A driver based on the
same concept was then implemented in FreeBSD and OpenBSD.
Documentation is borrowed from OpenBSD and ATF tests from FreeBSD.
This patch has been prepared by Siddharth Muralee, improved by <maxv>
and polished by myself before importing into the mainline tree.
All ATF tests pass.
maxv