aboutsummaryrefslogtreecommitdiff
path: root/sys/kern/kern_kcov.c
Commit message (Collapse)AuthorAgeFilesLines
* kcov: Fix the buildMark Johnston2025-04-191-0/+1
| | | | | Fixes: 4568f5a286a2 ("kern_kcov: replace vm_page_next() with iterator") Reported by: syzbot+b41aad31e5897b2f3401@syzkaller.appspotmail.com
* kern_kcov: replace vm_page_next() with iteratorDoug Moore2025-04-181-5/+4
| | | | | | | Use VM_RADIX_FORALL, and drop a use of vm_page_next(), in kcov_free(). Reviewed by: kib Differential Revision: kern_kcov: replace vm_page_next() with iterator
* sys: Automated cleanup of cdefs and other formattingWarner Losh2023-11-271-1/+0
| | | | | | | | | | | | | | | | Apply the following automated changes to try to eliminate no-longer-needed sys/cdefs.h includes as well as now-empty blank lines in a row. Remove /^#if.*\n#endif.*\n#include\s+<sys/cdefs.h>.*\n/ Remove /\n+#include\s+<sys/cdefs.h>.*\n+#if.*\n#endif.*\n+/ Remove /\n+#if.*\n#endif.*\n+/ Remove /^#if.*\n#endif.*\n/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/types.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/param.h>/ Remove /\n+#include\s+<sys/cdefs.h>\n#include\s+<sys/capsicum.h>/ Sponsored by: Netflix
* sys: Remove $FreeBSD$: one-line .c patternWarner Losh2023-08-161-2/+0
| | | | Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
* sys: Remove $FreeBSD$: two-line .h patternWarner Losh2023-08-161-2/+0
| | | | Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
* spdx: The BSD-2-Clause-FreeBSD identifier is obsolete, drop -FreeBSDWarner Losh2023-05-121-1/+1
| | | | | | | | | The SPDX folks have obsoleted the BSD-2-Clause-FreeBSD identifier. Catch up to that fact and revert to their recommended match of BSD-2-Clause. Discussed with: pfg MFC After: 3 days Sponsored by: Netflix
* kcov: use __func__ in KASSERT instead of old function nameEd Maste2022-03-071-4/+2
| | | | | MFC after: 1 week Sponsored by: The FreeBSD Foundation
* kcov: Disable address and memory sanitizers in get_kinfo()Mark Johnston2021-09-171-1/+1
| | | | | | | get_kinfo() is only called from the coverage sanitizer callbacks, which are similarly uninstrumented. Sponsored by: The FreeBSD Foundation
* kcov: Integrate with KMSANMark Johnston2021-09-141-3/+4
| | | | | | | | | | | | | - kern_kcov.c needs to be compiled with -fsanitize=kernel-memory when KMSAN is configured since it calls into various other subsystems. - Disable address and memory sanitizers in kcov(4)'s coverage sanitizer callbacks, as they do not provide useful checking. Moreover, with KMSAN we may otherwise get false positives since the caller (coverage sanitizer runtime) is not instrumented. - Disable KASAN and KMSAN interceptors in subr_coverage.c, as they do not provide any benefit but do introduce overhead when fuzzing. Sponsored by: The FreeBSD Foundation
* Generalize bus_space(9) and atomic(9) sanitizer interceptorsMark Johnston2021-03-231-1/+3
| | | | | | | | | | | | | | | | | Make it easy to define interceptors for new sanitizer runtimes, rather than assuming KCSAN. Lay a bit of groundwork for KASAN and KMSAN. When a sanitizer is compiled in, atomic(9) and bus_space(9) definitions in atomic_san.h are used by default instead of the inline implementations in the platform's atomic.h. These definitions are implemented in the sanitizer runtime, which includes machine/{atomic,bus}.h with SAN_RUNTIME defined to pull in the actual implementations. No functional change intended. MFC after: 1 month Sponsored by: The FreeBSD Foundation
* Mark COVERAGE and KCOV as part of KCSANAndrew Turner2020-08-191-0/+2
| | | | | | | | | | While not strictly true this stops them from trying to use the KCSAN atomic hooks and allows these to be compiled into the same kernel. Sponsored by: Innovate UK Notes: svn path=/head/; revision=364393
* Mark more nodes as CTLFLAG_MPSAFE or CTLFLAG_NEEDGIANT (17 of many)Pawel Biernacki2020-02-261-1/+2
| | | | | | | | | | | | | | | | | | | r357614 added CTLFLAG_NEEDGIANT to make it easier to find nodes that are still not MPSAFE (or already are but aren’t properly marked). Use it in preparation for a general review of all nodes. This is non-functional change that adds annotations to SYSCTL_NODE and SYSCTL_PROC nodes using one of the soon-to-be-required flags. Mark all obvious cases as MPSAFE. All entries that haven't been marked as MPSAFE before are by default marked as NEEDGIANT Approved by: kib (mentor, blanket) Commented by: kib, gallatin, melifaro Differential Revision: https://reviews.freebsd.org/D23718 Notes: svn path=/head/; revision=358333
* Remove duplicated empty lines from kern/*.cMateusz Guzik2020-01-301-1/+0
| | | | | | | No functional changes. Notes: svn path=/head/; revision=357312
* Consistently use busy and vm_page_valid() rather than touching page bitsJeff Roberson2020-01-231-2/+3
| | | | | | | | | | directly. This improves API compliance, asserts, etc. Reviewed by: kib, markj Differential Revision: https://reviews.freebsd.org/D23283 Notes: svn path=/head/; revision=357017
* Change synchonization rules for vm_page reference counting.Mark Johnston2019-09-091-3/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are several mechanisms by which a vm_page reference is held, preventing the page from being freed back to the page allocator. In particular, holding the page's object lock is sufficient to prevent the page from being freed; holding the busy lock or a wiring is sufficent as well. These references are protected by the page lock, which must therefore be acquired for many per-page operations. This results in false sharing since the page locks are external to the vm_page structures themselves and each lock protects multiple structures. Transition to using an atomically updated per-page reference counter. The object's reference is counted using a flag bit in the counter. A second flag bit is used to atomically block new references via pmap_extract_and_hold() while removing managed mappings of a page. Thus, the reference count of a page is guaranteed not to increase if the page is unbusied, unmapped, and the object's write lock is held. As a consequence of this, the page lock no longer protects a page's identity; operations which move pages between objects are now synchronized solely by the objects' locks. The vm_page_wire() and vm_page_unwire() KPIs are changed. The former requires that either the object lock or the busy lock is held. The latter no longer has a return value and may free the page if it releases the last reference to that page. vm_page_unwire_noq() behaves the same as before; the caller is responsible for checking its return value and freeing or enqueuing the page as appropriate. vm_page_wire_mapped() is introduced for use in pmap_extract_and_hold(). It fails if the page is concurrently being unmapped, typically triggering a fallback to the fault handler. vm_page_wire() no longer requires the page lock and vm_page_unwire() now internally acquires the page lock when releasing the last wiring of a page (since the page lock still protects a page's queue state). In particular, synchronization details are no longer leaked into the caller. The change excises the page lock from several frequently executed code paths. In particular, vm_object_terminate() no longer bounces between page locks as it releases an object's pages, and direct I/O and sendfile(SF_NOCACHE) completions no longer require the page lock. In these latter cases we now get linear scalability in the common scenario where different threads are operating on different files. __FreeBSD_version is bumped. The DRM ports have been updated to accomodate the KPI changes. Reviewed by: jeff (earlier version) Tested by: gallatin (earlier version), pho Sponsored by: Netflix Differential Revision: https://reviews.freebsd.org/D20486 Notes: svn path=/head/; revision=352110
* kcov depends on eventhandler.h.Mark Johnston2019-05-201-0/+1
| | | | | | | MFC after: 3 days Notes: svn path=/head/; revision=348004
* Check the index hasn't changed after writing the cmp entry.Andrew Turner2019-02-251-5/+10
| | | | | | | | | | | | | | | | | If an interrupt fires while writing the cmp entry we may have a partial entry. Work around this by using atomic_cmpset to set the new index. If it fails we need to set the previous index value and try again as the entry may be in an inconsistent state. This fixes messages similar to the following from syzkaller: bad comp 224 type 2163727253 Reviewed by: tuexen Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D19287 Notes: svn path=/head/; revision=344517
* Allow the kcov buffer to be mmaped multiple times.Andrew Turner2019-02-211-5/+1
| | | | | | | | | After r344391 this restriction is no longer needed. Sponsored by: DARPA, AFRL Notes: svn path=/head/; revision=344432
* Unwire the kcov buffer when freeing the info struct.Andrew Turner2019-02-201-1/+16
| | | | | | | | | | | | | | | | | Without this the physical memory will not be returned to the kernel. While here call vm_object_reference on the object when mmapping the buffer. This removed the need for buggy tracking of if it has been mapped or not. This fixes issues where kcov could use all the system memory. Reported by: tuexen Reviewed by: kib Sponsored by: DARPA, AFTL Differential Revision: https://reviews.freebsd.org/D19252 Notes: svn path=/head/; revision=344391
* Call pmap_qenter for each page when creating the kcov buffer.Andrew Turner2019-02-201-6/+4
| | | | | | | | | | | | This removes the need to allocate a buffer to hold the vm_page_t objects at the cost of extra IPIs on some architectures. Reviewed by: kib Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D19252 Notes: svn path=/head/; revision=344390
* Create a common function to handle freeing the kcov info struct.Andrew Turner2019-02-191-16/+16
| | | | | | | | | | Both places that may free the kcov info struct are identical. Create a new common function to hold the code. Sponsored by: DARPA, AFRL Notes: svn path=/head/; revision=344279
* Fix the spelling of cov_unregister_pc.Andrew Turner2019-02-081-4/+4
| | | | | | | | | | When unregistering kcov from the coverage interface we should use the unregister function, not the register function. Sponsored by: DARPA, AFRL Notes: svn path=/head/; revision=343913
* Extract the coverage sanitizer KPI to a new file.Andrew Turner2019-01-291-142/+32
| | | | | | | | | | | | | | | | | | | | This will allow multiple consumers of the coverage data to be compiled into the kernel together. The only requirement is only one can be registered at a given point in time, however it is expected they will only register when the coverage data is needed. A new kernel conflig option COVERAGE is added. This will allow kcov to become a module that can be loaded as needed, or compiled into the kernel. While here clean up the #include style a little. Reviewed by: kib Sponsored by: DARPA, AFRL Differential Revision: https://reviews.freebsd.org/D18955 Notes: svn path=/head/; revision=343550
* Add support for the Clang Coverage Sanitizer in the kernel (KCOV).Andrew Turner2019-01-121-0/+676
When building with KCOV enabled the compiler will insert function calls to probes allowing us to trace the execution of the kernel from userspace. These probes are on function entry (trace-pc) and on comparison operations (trace-cmp). Userspace can enable the use of these probes on a single kernel thread with an ioctl interface. It can allocate space for the probe with KIOSETBUFSIZE, then mmap the allocated buffer and enable tracing with KIOENABLE, with the trace mode being passed in as the int argument. When complete KIODISABLE is used to disable tracing. The first item in the buffer is the number of trace event that have happened. Userspace can write 0 to this to reset the tracing, and is expected to do so on first use. The format of the buffer depends on the trace mode. When in PC tracing just the return address of the probe is stored. Under comparison tracing the comparison type, the two arguments, and the return address are traced. The former method uses on entry per trace event, while the later uses 4. As such they are incompatible so only a single mode may be enabled. KCOV is expected to help fuzzing the kernel, and while in development has already found a number of issues. It is required for the syzkaller system call fuzzer [1]. Other kernel fuzzers could also make use of it, either with the current interface, or by extending it with new modes. A man page is currently being worked on and is expected to be committed soon, however having the code in the kernel now is useful for other developers to use. [1] https://github.com/google/syzkaller Submitted by: Mitchell Horne <mhorne063@gmail.com> (Earlier version) Reviewed by: kib Testing by: tuexen Sponsored by: DARPA, AFRL Sponsored by: The FreeBSD Foundation (Mitchell Horne) Differential Revision: https://reviews.freebsd.org/D14599 Notes: svn path=/head/; revision=342962
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-03 01:16:43 +0000