ded97d2c2b
Enables kcov to collect comparison operands from instrumented code. This is done by using Clang's -fsanitize=trace-cmp instrumentation (currently not available for GCC). The comparison operands help a lot in fuzz testing. E.g. they are used in Syzkaller to cover the interiors of conditional statements with way less attempts and thus make previously unreachable code reachable. To allow separate collection of coverage and comparison operands two different work modes are implemented. Mode selection is now done via a KCOV_ENABLE ioctl call with corresponding argument value. Link: http://lkml.kernel.org/r/20171011095459.70721-1-glider@google.com Signed-off-by: Victor Chibotaru <tchibo@google.com> Signed-off-by: Alexander Potapenko <glider@google.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Andrey Konovalov <andreyknvl@google.com> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Alexander Popov <alex.popov@linux.com> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com> Cc: Kees Cook <keescook@chromium.org> Cc: Vegard Nossum <vegard.nossum@oracle.com> Cc: Quentin Casasnovas <quentin.casasnovas@oracle.com> Cc: <syzkaller@googlegroups.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
35 lines
802 B
C
35 lines
802 B
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _LINUX_KCOV_H
|
|
#define _LINUX_KCOV_H
|
|
|
|
#include <uapi/linux/kcov.h>
|
|
|
|
struct task_struct;
|
|
|
|
#ifdef CONFIG_KCOV
|
|
|
|
enum kcov_mode {
|
|
/* Coverage collection is not enabled yet. */
|
|
KCOV_MODE_DISABLED = 0,
|
|
/* KCOV was initialized, but tracing mode hasn't been chosen yet. */
|
|
KCOV_MODE_INIT = 1,
|
|
/*
|
|
* Tracing coverage collection mode.
|
|
* Covered PCs are collected in a per-task buffer.
|
|
*/
|
|
KCOV_MODE_TRACE_PC = 2,
|
|
/* Collecting comparison operands mode. */
|
|
KCOV_MODE_TRACE_CMP = 3,
|
|
};
|
|
|
|
void kcov_task_init(struct task_struct *t);
|
|
void kcov_task_exit(struct task_struct *t);
|
|
|
|
#else
|
|
|
|
static inline void kcov_task_init(struct task_struct *t) {}
|
|
static inline void kcov_task_exit(struct task_struct *t) {}
|
|
|
|
#endif /* CONFIG_KCOV */
|
|
#endif /* _LINUX_KCOV_H */
|