Enables kcov to collect comparison operands from instrumented code. This is done by using Clang's -fsanitize=trace-cmp instrumentation (currently not available for GCC). The comparison operands help a lot in fuzz testing. E.g. they are used in Syzkaller to cover the interiors of conditional statements with way less attempts and thus make previously unreachable code reachable. To allow separate collection of coverage and comparison operands two different work modes are implemented. Mode selection is now done via a KCOV_ENABLE ioctl call with corresponding argument value.
Showing the changes to include/uapi/linux (1 of 3 files). Show all
Unified · Split
| @@ -8,4 +8,28 @@ · 7 unmodified lines | ||
| 8 | 8 | #define KCOV_ENABLE _IO('c', 100) |
| 9 | 9 | #define KCOV_DISABLE _IO('c', 101) |
| 10 | 10 | |
| 11 | +enum { | |
| 12 | + /* | |
| 13 | + * Tracing coverage collection mode. | |
| 14 | + * Covered PCs are collected in a per-task buffer. | |
| 15 | + * In new KCOV version the mode is chosen by calling | |
| 16 | + * ioctl(fd, KCOV_ENABLE, mode). In older versions the mode argument | |
| 17 | + * was supposed to be 0 in such a call. So, for reasons of backward | |
| 18 | + * compatibility, we have chosen the value KCOV_TRACE_PC to be 0. | |
| 19 | + */ | |
| 20 | + KCOV_TRACE_PC = 0, | |
| 21 | + /* Collecting comparison operands mode. */ | |
| 22 | + KCOV_TRACE_CMP = 1, | |
| 23 | +}; | |
| 24 | + | |
| 25 | +/* | |
| 26 | + * The format for the types of collected comparisons. | |
| 27 | + * | |
| 28 | + * Bit 0 shows whether one of the arguments is a compile-time constant. | |
| 29 | + * Bits 1 & 2 contain log2 of the argument size, up to 8 bytes. | |
| 30 | + */ | |
| 31 | +#define KCOV_CMP_CONST (1 << 0) | |
| 32 | +#define KCOV_CMP_SIZE(n) ((n) << 1) | |
| 33 | +#define KCOV_CMP_MASK KCOV_CMP_SIZE(3) | |
| 34 | + | |
| 11 | 35 | #endif /* _LINUX_KCOV_IOCTLS_H */ |