[PATCH 0/5] kcov: suppress timer and scheduler coverage leaks

Karl Mehltretter posted 5 patches 1 month, 3 weeks ago
include/linux/hrtimer_rearm.h | 18 ++++++++++++++++--
include/linux/kcov.h          | 25 ++++++++++++++++++++++++-
kernel/kcov.c                 |  2 +-
kernel/sched/core.c           | 15 ++++++++++++++-
4 files changed, 55 insertions(+), 5 deletions(-)
[PATCH 0/5] kcov: suppress timer and scheduler coverage leaks
Posted by Karl Mehltretter 1 month, 3 weeks ago
KCOV excludes interrupt and scheduler coverage so syscall coverage stays
input-dependent. Instrumented callees can still record when uninstrumented
timer and scheduler paths run with in_task() true.

CONFIG_KCOV_SELFTEST [1] exposes three cases on x86-64: deferred
hrtimer rearm, __schedule() callees and PREEMPT_RT wakeups. Task-context
wakeups and new-task enqueue also add scheduler coverage to ordinary
syscalls.

Add a nestable KCOV_PAUSED bit. Use it around deferred hrtimer rearm,
__schedule(), try_to_wake_up() and wake_up_new_task(). This keeps coverage
from their instrumented callees without excluding those callees from real
task-context coverage.

Testing:

  - GCC builds across x86-64, arm32, arm64, MIPS32, PowerPC 32/64,
    s390, RISC-V 32/64, LoongArch, Xtensa and UML
  - x86-64 Clang and KCOV-disabled builds
  - KCOV selftest, 10/10 x86-64 boots with and without PREEMPT_RT
  - KCOV selftest, 3/3 RISC-V 32/64, LoongArch and s390 boots after
    isolating unrelated architecture entry leaks
  - 40 dummy_hcd/g_zero remote-KCOV cycles on x86-64 and arm64
  - 400 repeated fork calls on x86-64 PREEMPT_RT
  - syzkaller: five one-hour A/B pairs on four 2-vCPU PREEMPT_RT VMs.
    At ~110k executions, the five-run median was 4,142 vs. 3,216
    corpus entries (+28.8%) and 54,872 vs. 50,940 coverage (+7.7%).
    No unsuppressed reports

The USB runs no longer contained the baseline PCs from deferred rearm,
hrtick and scheduler wakeup callees. The fork run no longer contained the
baseline __smp_call_single_queue(), generic_exec_single() or
smp_call_function_single_async() PCs.

With KCOV disabled, the pause calls compile away. With KCOV enabled on
x86-64, __schedule() grows by 117 bytes across patches 2 and 3,
try_to_wake_up() by 106 bytes and wake_up_new_task() by 88 bytes.

[1] https://lore.kernel.org/r/20260724192122.73080-1-kmehltretter@gmail.com/

Karl Mehltretter (5):
  kcov: add kcov_pause()/kcov_resume() helpers
  hrtimer: pause KCOV during deferred rearm
  sched: pause KCOV in __schedule()
  sched: pause KCOV in try_to_wake_up()
  sched: pause KCOV in wake_up_new_task()

 include/linux/hrtimer_rearm.h | 18 ++++++++++++++++--
 include/linux/kcov.h          | 25 ++++++++++++++++++++++++-
 kernel/kcov.c                 |  2 +-
 kernel/sched/core.c           | 15 ++++++++++++++-
 4 files changed, 55 insertions(+), 5 deletions(-)

base-commit: 8ba098e6b6ff0db8edf28528d1552be261af30d4
Re: [PATCH 0/5] kcov: suppress timer and scheduler coverage leaks
Posted by Peter Zijlstra 1 month, 3 weeks ago
On Fri, Aug 07, 2026 at 10:50:22PM +0200, Karl Mehltretter wrote:

> Karl Mehltretter (5):
>   kcov: add kcov_pause()/kcov_resume() helpers
>   hrtimer: pause KCOV during deferred rearm
>   sched: pause KCOV in __schedule()
>   sched: pause KCOV in try_to_wake_up()
>   sched: pause KCOV in wake_up_new_task()
> 
>  include/linux/hrtimer_rearm.h | 18 ++++++++++++++++--
>  include/linux/kcov.h          | 25 ++++++++++++++++++++++++-
>  kernel/kcov.c                 |  2 +-
>  kernel/sched/core.c           | 15 ++++++++++++++-
>  4 files changed, 55 insertions(+), 5 deletions(-)

You've send me a partial series; which is the same as not sending me
anything at all. If you want me to look at it, send the complete thing,
so I can evaluate the whole thing.