Re: [PATCH v2 14/20] coverage: add Clang's source-based code coverage

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] coverage: LLVM_COV_DATA places non-alloc __llvm_cov* in kernel image
--

commit c6db5401d9d9ff31cd5421cd456c7917bf582166
Author: Sasha Levin <sashal@kernel.org>

coverage: add Clang's source-based code coverage

This commit adds support for Clang's Source-based Code Coverage under
CONFIG_LLVM_COV_KERNEL, exporting raw profile data of the kernel image via
/sys/kernel/debug/coverage/llvm/profraw and defining the LLVM_COV_DATA
linker script macro for the associated compiler-emitted sections.

Link: https://clang.llvm.org/docs/SourceBasedCodeCoverage.html [1]
Link: https://lore.kernel.org/lkml/20210407211704.367039-1-morbo@google.com/ [2]

> diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
> index 3eb732942d699..840899b604336 100644
> --- a/include/asm-generic/vmlinux.lds.h
> +++ b/include/asm-generic/vmlinux.lds.h
> @@ -359,6 +359,42 @@
>  #define THERMAL_TABLE(name)
>  #endif
>  
> +#ifdef CONFIG_LLVM_COV_KERNEL
> +#define LLVM_COV_DATA							\
> +	__llvm_prf_data : AT(ADDR(__llvm_prf_data) - LOAD_OFFSET) {	\
> +		BOUNDED_SECTION_POST_LABEL(__llvm_prf_data,		\
> +					   __llvm_prf_data,		\
> +					   _start, _end)		\
> +	}								\
> +	__llvm_prf_cnts : AT(ADDR(__llvm_prf_cnts) - LOAD_OFFSET) {	\
> +		BOUNDED_SECTION_POST_LABEL(__llvm_prf_cnts,		\
> +					   __llvm_prf_cnts,		\
> +					   _start, _end)		\
> +	}								\
> +	__llvm_prf_names : AT(ADDR(__llvm_prf_names) - LOAD_OFFSET) {	\
> +		BOUNDED_SECTION_POST_LABEL(__llvm_prf_names,		\
> +					   __llvm_prf_names,		\
> +					   _start, _end)		\
> +	}								\
> +	__llvm_prf_bits : AT(ADDR(__llvm_prf_bits) - LOAD_OFFSET) {	\
> +		BOUNDED_SECTION_POST_LABEL(__llvm_prf_bits,		\
> +					   __llvm_prf_bits,		\
> +					   _start, _end)		\
> +	}								\
> +	__llvm_covfun : AT(ADDR(__llvm_covfun) - LOAD_OFFSET) {		\
> +		BOUNDED_SECTION_POST_LABEL(__llvm_covfun,		\
> +					   __llvm_covfun,		\
> +					   _start, _end)		\
> +	}								\
> +	__llvm_covmap : AT(ADDR(__llvm_covmap) - LOAD_OFFSET) {		\
> +		BOUNDED_SECTION_POST_LABEL(__llvm_covmap,		\
> +					   __llvm_covmap,		\
> +					   _start, _end)		\
> +	}

[Severity: Medium]
Should __llvm_covfun and __llvm_covmap in LLVM_COV_DATA be placed outside
the loaded kernel image after _end with a 0 VMA (similar to DWARF_DEBUG,
ELF_DETAILS, or MODINFO) instead of alongside the runtime __llvm_prf_*
sections?

Unlike __llvm_prf_data, __llvm_prf_cnts, __llvm_prf_names, and
__llvm_prf_bits (which are emitted with SHF_ALLOC and accessed at runtime
by llvm_cov_serialize_raw_profile() and llvm_cov_reset()), Clang emits
__llvm_covfun and __llvm_covmap as SHT_PROGBITS sections without SHF_ALLOC
for offline consumption by the host llvm-cov tool, as noted in
scripts/mod/modpost.c:

    static const char *const section_white_list[] =
    {
        ...
        "__llvm_covfun",
        "__llvm_covmap",
        ...
    };

When CONFIG_LLVM_COV_KERNEL=y is linked with GNU ld.bfd (since
CONFIG_LLVM_COV_KERNEL only depends on CC_IS_CLANG, not LD_IS_LLD), placing
__llvm_covfun and __llvm_covmap inside the kernel image without a 0 VMA
causes the linker to advance the location counter "." across the offline
coverage mapping data. This shifts all subsequent kernel sections, inflates
the reserved kernel virtual address range up to _end by tens of megabytes
on CONFIG_COVERAGE_PROFILE_ALL=y builds (risking exceeding the
KERNEL_IMAGE_SIZE link-time assertion on x86_64 when !CONFIG_COMPILE_TEST),
and creates a zero-filled gap in vmlinux.bin.

When linking with ld.lld, ADDR() of these non-SHF_ALLOC sections evaluates
to 0, so AT(ADDR(...) - LOAD_OFFSET) assigns a bogus LMA of -LOAD_OFFSET,
and BOUNDED_SECTION_POST_LABEL() also emits unused __llvm_covfun_start/end
and __llvm_covmap_start/end symbols.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103015238.3780910-1-sashal@kernel.org?part=14