Re: [PATCH v2 0/6] kcov: Suppress timer and scheduler coverage leaks

[Peter Zijlstra <peterz@infradead.org>]

On Tue, Aug 11, 2026 at 08:59:41PM +0100, Bradley Morgan wrote:
> On 11 August 2026 16:41:05 BST, Karl Mehltretter <kmehltretter@gmail.com>
> wrote:
> >KCOV aims to exclude interrupt and scheduler coverage so syscall coverage
> >stays input-dependent. Instrumented callees can still record when
> >uninstrumented timer and scheduler paths run with in_task() true.
> >
> >With the diagnostic patch in [1] applied, CONFIG_KCOV_SELFTEST exposes
> >three cases on x86-64: deferred hrtimer rearm, __schedule() callees and
> >PREEMPT_RT wakeups. Task-context wakeups and new-task enqueue also add
> >scheduler coverage to ordinary syscalls.
> >
> >Add a nestable KCOV_PAUSED bit and a kcov_pause guard. Use the guard for
> >deferred hrtimer rearm, __schedule(), the try_to_wake_up() wakeup body
> >and wake_up_new_task(). This suppresses their instrumented callees
> >without excluding those callees from task-context coverage.
> >
> >Changes in v2:
> > - Add patch 1 to make kcov_start()'s mode parameter unsigned int. No
> >   functional change.
> > - Rework patch 2 around a guard-only API with private current-only
> >   helpers (Bradley Morgan).
> > - Use the guard in patches 3-6 and reword the pause comments.
> >
> >v2 testing:
> > - GCC builds on x86-64, arm32, arm64, MIPS32/64, PowerPC 32/64,
> >   s390, RISC-V 32/64, LoongArch, Xtensa and UML.
> > - PREEMPT_RT builds on x86-64, arm32, arm64, RISC-V 32/64 and
> >   LoongArch.
> > - x86-64 builds with GCC 8.1 and Clang 22.1. Both kernels passed a
> >   KCOV selftest boot.
> > - x86-64 CONFIG_KCOV=n build, with no KCOV or pause references.
> > - KCOV selftest, 10/10 x86-64 boots with and without PREEMPT_RT. A
> >   fresh non-RT boot passed after the helper-only rework.
> > - 40 dummy_hcd/g_zero remote-KCOV cycles on x86-64 and arm64.
> > - 400 repeated fork() calls on x86-64 PREEMPT_RT.
> >
> >Three one-hour syzkaller A/B pairs were run. Each baseline and patched
> >run used four 2-vCPU PREEMPT_RT VMs. The patched kernel completed 22-51%
> >more executions than base. At matched execution counts, corpus size grew
> >42-54% and coverage 14-19%. No run produced a report.
> >
> >With KCOV disabled, the pause sections compile away. With KCOV enabled
> >on x86-64, GCC 15.2 grows __schedule() by 117 bytes,
> >try_to_wake_up() by 94 bytes and wake_up_new_task() by 88 bytes relative
> >to the base commit.
> >
> >[1]
> >https://lore.kernel.org/r/20260724192122.73080-1-kmehltretter@gmail.com
> >
> 
> 
> Reviewed-by: Bradley Morgan <include@grrlz.net>

Plonk