540baa17a8
Enables kcov to collect comparison operands from instrumented code. This is done by using Clang's -fsanitize=trace-cmp instrumentation (currently not available for GCC). The comparison operands help a lot in fuzz testing. E.g. they are used in Syzkaller to cover the interiors of conditional statements with way less attempts and thus make previously unreachable code reachable. To allow separate collection of coverage and comparison operands two different work modes are implemented. Mode selection is now done via a KCOV_ENABLE ioctl call with corresponding argument value. Link: http://lkml.kernel.org/r/20171011095459.70721-1-glider@google.com Signed-off-by: Victor Chibotaru <tchibo@google.com> Signed-off-by: Alexander Potapenko <glider@google.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Andrey Konovalov <andreyknvl@google.com> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Alexander Popov <alex.popov@linux.com> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com> Cc: Kees Cook <keescook@chromium.org> Cc: Vegard Nossum <vegard.nossum@oracle.com> Cc: Quentin Casasnovas <quentin.casasnovas@oracle.com> Cc: <syzkaller@googlegroups.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Bug: 64145065 (cherry-picked from ded97d2c2b2c5f1dcced0bc57133f7753b037dfc) Change-Id: Iaba700a3f4786048be14a5e764ccabceae114eb7 Signed-off-by: Paul Lawrence <paullawrence@google.com>
33 lines
763 B
C
33 lines
763 B
C
#ifndef _LINUX_KCOV_H
|
|
#define _LINUX_KCOV_H
|
|
|
|
#include <uapi/linux/kcov.h>
|
|
|
|
struct task_struct;
|
|
|
|
#ifdef CONFIG_KCOV
|
|
|
|
enum kcov_mode {
|
|
/* Coverage collection is not enabled yet. */
|
|
KCOV_MODE_DISABLED = 0,
|
|
/* KCOV was initialized, but tracing mode hasn't been chosen yet. */
|
|
KCOV_MODE_INIT = 1,
|
|
/*
|
|
* Tracing coverage collection mode.
|
|
* Covered PCs are collected in a per-task buffer.
|
|
*/
|
|
KCOV_MODE_TRACE_PC = 2,
|
|
/* Collecting comparison operands mode. */
|
|
KCOV_MODE_TRACE_CMP = 3,
|
|
};
|
|
|
|
void kcov_task_init(struct task_struct *t);
|
|
void kcov_task_exit(struct task_struct *t);
|
|
|
|
#else
|
|
|
|
static inline void kcov_task_init(struct task_struct *t) {}
|
|
static inline void kcov_task_exit(struct task_struct *t) {}
|
|
|
|
#endif /* CONFIG_KCOV */
|
|
#endif /* _LINUX_KCOV_H */
|