[PATCH 0/4] gcov: Add MC/DC condition coverage support

[PATCH 0/4] gcov: Add MC/DC condition coverage support

[Sasha Levin]

This series adds support for GCC's MC/DC (Modified Condition/Decision
Coverage) instrumentation to the kernel's gcov subsystem.

MC/DC verifies that each condition in a boolean decision independently
affects the decision's outcome. It is required by safety standards such
as DO-178C (avionics) and ISO 26262 (automotive). GCC 14 added MC/DC
instrumentation via -fcondition-coverage.

Patch 1 fixes a pre-existing bug in gcov_info_add() where IOR-based
counters (bitsets) were incorrectly merged with += instead of |=.
Patches 2-3 add the CONFIG_GCOV_CONDITION_COVERAGE Kconfig option and
wire up the compiler flag. Patch 4 documents the feature.

With CONFIG_GCOV_CONDITION_COVERAGE=y, gcov --conditions shows per-line
condition coverage:

  4577658:  257:	if (node->num_loaded > 0)
  condition outcomes covered 2/2
  4577658:  355:	if (info && (strcmp(gcov_info_filename(info), name) == 0))
  condition outcomes covered 2/4
  condition  0 not covered (true)
  condition  1 not covered (true)
     2896:  420:	if (!copy)
  condition outcomes covered 1/2
  condition  0 not covered (true)

Tested with GCC 15.2, verified boot + gcov data extraction + gcov
--conditions output. Also verified clean build with LLVM=1 (condition
coverage correctly disabled for Clang).

Sasha Levin (4):
  gcov: fix gcov_info_add() merge semantics for IOR counters
  kconfig: add CC_HAS_CONDITION_COVERAGE for MC/DC support detection
  gcov: add MC/DC condition coverage support
  Documentation: gcov: document MC/DC condition coverage support

 Documentation/dev-tools/gcov.rst | 25 +++++++++++++++++++++++++
 Makefile                         |  3 +++
 arch/x86/um/vdso/Makefile        |  4 ++--
 init/Kconfig                     |  3 +++
 kernel/gcov/Kconfig              | 15 +++++++++++++++
 kernel/gcov/gcc_4_7.c            | 25 ++++++++++++++++++++++---
 6 files changed, 70 insertions(+), 5 deletions(-)

-- 
2.51.0

[PATCH 1/4] gcov: fix gcov_info_add() merge semantics for IOR counters

[Sasha Levin]

gcov_info_add() unconditionally uses += to merge all counter types.
This is wrong for counters that use IOR merge semantics (bitwise OR),
such as GCOV_COUNTER_IOR and GCC 14's GCOV_COUNTER_CONDS (MC/DC
condition coverage). These counters store bitsets that must be merged
with |=, not accumulated with +=.

Detect IOR merge semantics by comparing the merge function pointer
against __gcov_merge_ior, matching how GCC's own libgcov identifies
merge semantics. This fixes the pre-existing bug for GCOV_COUNTER_IOR
and also enables correct merging for MC/DC condition coverage data.

Fixes: 5f41ea0386a5 ("gcov: add support for gcc 4.7 gcov format")
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/gcov/gcc_4_7.c | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/kernel/gcov/gcc_4_7.c b/kernel/gcov/gcc_4_7.c
index 8fa22ababd943..923cfb34966b2 100644
--- a/kernel/gcov/gcc_4_7.c
+++ b/kernel/gcov/gcc_4_7.c
@@ -18,6 +18,8 @@
 #include <linux/mm.h>
 #include "gcov.h"
 
+extern void __gcov_merge_ior(gcov_type *, unsigned int);
+
 #if (__GNUC__ >= 15)
 #define GCOV_COUNTERS			10
 #elif (__GNUC__ >= 14)
@@ -187,6 +189,15 @@ static int counter_active(struct gcov_info *info, unsigned int type)
 	return info->merge[type] ? 1 : 0;
 }
 
+/*
+ * Determine whether a counter uses IOR merge semantics (bitwise OR of
+ * bitsets). Used for condition coverage (MC/DC) and other IOR-based counters.
+ */
+static bool counter_is_ior(struct gcov_info *info, unsigned int type)
+{
+	return info->merge[type] == __gcov_merge_ior;
+}
+
 /* Determine number of active counters. Based on gcc magic. */
 static unsigned int num_counter_active(struct gcov_info *info)
 {
@@ -259,9 +270,17 @@ void gcov_info_add(struct gcov_info *dst, struct gcov_info *src)
 			if (!counter_active(src, ct_idx))
 				continue;
 
-			for (val_idx = 0; val_idx < sci_ptr->num; val_idx++)
-				dci_ptr->values[val_idx] +=
-					sci_ptr->values[val_idx];
+			if (counter_is_ior(src, ct_idx)) {
+				for (val_idx = 0; val_idx < sci_ptr->num;
+				     val_idx++)
+					dci_ptr->values[val_idx] |=
+						sci_ptr->values[val_idx];
+			} else {
+				for (val_idx = 0; val_idx < sci_ptr->num;
+				     val_idx++)
+					dci_ptr->values[val_idx] +=
+						sci_ptr->values[val_idx];
+			}
 
 			dci_ptr++;
 			sci_ptr++;
-- 
2.51.0

[PATCH 2/4] kconfig: add CC_HAS_CONDITION_COVERAGE for MC/DC support detection

[Sasha Levin]

Add a Kconfig symbol to detect compiler support for -fcondition-coverage,
which enables MC/DC (Modified Condition/Decision Coverage) instrumentation.
This flag is available since GCC 14.

Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 init/Kconfig | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/init/Kconfig b/init/Kconfig
index 444ce811ea674..38c8e06ad6d08 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -132,6 +132,9 @@ config CC_HAS_ASSUME
 config CC_HAS_NO_PROFILE_FN_ATTR
 	def_bool $(success,echo '__attribute__((no_profile_instrument_function)) int x();' | $(CC) -x c - -c -o /dev/null -Werror)
 
+config CC_HAS_CONDITION_COVERAGE
+	def_bool $(cc-option,-fcondition-coverage)
+
 config CC_HAS_COUNTED_BY
 	bool
 	# clang needs to be at least 20.1.0 to avoid potential crashes
-- 
2.51.0

[PATCH 3/4] gcov: add MC/DC condition coverage support

[Sasha Levin]

Add CONFIG_GCOV_CONDITION_COVERAGE option to enable GCC's MC/DC
condition coverage instrumentation (-fcondition-coverage). MC/DC is
required by safety standards such as DO-178C and ISO 26262.

Add -fcondition-coverage and -Wno-error=coverage-too-many-conditions
to CFLAGS_GCOV when enabled. Both flags are gated on the config option
to avoid Clang warnings about unknown options.

Also add -fcondition-coverage to CFLAGS_REMOVE in the x86 UML vDSO
Makefile to prevent instrumentation of userspace vDSO code.

Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Makefile                  |  3 +++
 arch/x86/um/vdso/Makefile |  4 ++--
 kernel/gcov/Kconfig       | 15 +++++++++++++++
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index 2b15f0b4a0cb5..5b0657cd3e534 100644
--- a/Makefile
+++ b/Makefile
@@ -807,6 +807,9 @@ CFLAGS_GCOV	:= -fprofile-arcs -ftest-coverage
 ifdef CONFIG_CC_IS_GCC
 CFLAGS_GCOV	+= -fno-tree-loop-im
 endif
+ifdef CONFIG_GCOV_CONDITION_COVERAGE
+CFLAGS_GCOV	+= -fcondition-coverage -Wno-error=coverage-too-many-conditions
+endif
 export CFLAGS_GCOV
 
 # The arch Makefiles can override CC_FLAGS_FTRACE. We may also append it later.
diff --git a/arch/x86/um/vdso/Makefile b/arch/x86/um/vdso/Makefile
index 8a7c8b37cb6eb..3c8909f96a4c0 100644
--- a/arch/x86/um/vdso/Makefile
+++ b/arch/x86/um/vdso/Makefile
@@ -44,8 +44,8 @@ $(vobjs): KBUILD_CFLAGS += $(CFL)
 #
 # vDSO code runs in userspace and -pg doesn't help with profiling anyway.
 #
-CFLAGS_REMOVE_vdso-note.o = -pg -fprofile-arcs -ftest-coverage
-CFLAGS_REMOVE_um_vdso.o = -pg -fprofile-arcs -ftest-coverage
+CFLAGS_REMOVE_vdso-note.o = -pg -fprofile-arcs -ftest-coverage -fcondition-coverage
+CFLAGS_REMOVE_um_vdso.o = -pg -fprofile-arcs -ftest-coverage -fcondition-coverage
 
 #
 # The DSO images are built using a special linker script.
diff --git a/kernel/gcov/Kconfig b/kernel/gcov/Kconfig
index 04f4ebdc3cf59..7939c8f5ced3c 100644
--- a/kernel/gcov/Kconfig
+++ b/kernel/gcov/Kconfig
@@ -52,4 +52,19 @@ config GCOV_PROFILE_ALL
 	larger and run slower. Also be sure to exclude files from profiling
 	which are not linked to the kernel image to prevent linker errors.
 
+config GCOV_CONDITION_COVERAGE
+	bool "Enable MC/DC condition coverage instrumentation"
+	depends on GCOV_KERNEL
+	depends on CC_HAS_CONDITION_COVERAGE
+	default n
+	help
+	This option adds Modified Condition/Decision Coverage (MC/DC)
+	instrumentation using GCC's -fcondition-coverage flag. MC/DC
+	coverage data can be viewed using gcov --conditions.
+
+	MC/DC is required by safety standards such as DO-178C (avionics)
+	and ISO 26262 (automotive).
+
+	This increases instrumentation overhead. If unsure, say N.
+
 endmenu
-- 
2.51.0

[PATCH 4/4] Documentation: gcov: document MC/DC condition coverage support

[Sasha Levin]

Add a section documenting MC/DC support, including the GCC 14
requirement, how to view condition coverage data with gcov --conditions,
and the 64-condition-per-expression limitation.

Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 Documentation/dev-tools/gcov.rst | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/Documentation/dev-tools/gcov.rst b/Documentation/dev-tools/gcov.rst
index 075df6a4598d8..57b9345060c5e 100644
--- a/Documentation/dev-tools/gcov.rst
+++ b/Documentation/dev-tools/gcov.rst
@@ -180,6 +180,31 @@ b) gcov is run on the BUILD machine
       [user@build] gcov -o /tmp/coverage/tmp/out/init main.c
 
 
+MC/DC Coverage
+--------------
+
+When using GCC 14 or later with ``CONFIG_GCOV_CONDITION_COVERAGE=y``,
+Modified Condition/Decision Coverage (MC/DC) data is collected alongside
+standard branch coverage. MC/DC verifies that each condition in a
+decision independently affects the decision's outcome.
+
+To view MC/DC data, use::
+
+    gcov --conditions -o /sys/kernel/debug/gcov/path/to/dir file.c
+
+MC/DC coverage is required by safety standards such as DO-178C
+(avionics) and ISO 26262 (automotive).
+
+GCC's condition coverage implementation has a limit of 64 conditions per
+boolean expression, due to the use of 64-bit bitmasks internally.
+Expressions exceeding this limit cannot be instrumented and will produce
+a compiler warning. This does not affect the correctness of the kernel;
+those expressions simply will not have MC/DC coverage data.
+
+Note that MC/DC instrumentation increases binary size and execution
+overhead compared to standard gcov profiling.
+
+
 Note on compilers
 -----------------
 
-- 
2.51.0