[PATCH 0/5] kcov: suppress timer and scheduler coverage leaks

[PATCH 0/5] kcov: suppress timer and scheduler coverage leaks

[Karl Mehltretter]

KCOV excludes interrupt and scheduler coverage so syscall coverage stays
input-dependent. Instrumented callees can still record when uninstrumented
timer and scheduler paths run with in_task() true.

CONFIG_KCOV_SELFTEST [1] exposes three cases on x86-64: deferred
hrtimer rearm, __schedule() callees and PREEMPT_RT wakeups. Task-context
wakeups and new-task enqueue also add scheduler coverage to ordinary
syscalls.

Add a nestable KCOV_PAUSED bit. Use it around deferred hrtimer rearm,
__schedule(), try_to_wake_up() and wake_up_new_task(). This keeps coverage
from their instrumented callees without excluding those callees from real
task-context coverage.

Testing:

  - GCC builds across x86-64, arm32, arm64, MIPS32, PowerPC 32/64,
    s390, RISC-V 32/64, LoongArch, Xtensa and UML
  - x86-64 Clang and KCOV-disabled builds
  - KCOV selftest, 10/10 x86-64 boots with and without PREEMPT_RT
  - KCOV selftest, 3/3 RISC-V 32/64, LoongArch and s390 boots after
    isolating unrelated architecture entry leaks
  - 40 dummy_hcd/g_zero remote-KCOV cycles on x86-64 and arm64
  - 400 repeated fork calls on x86-64 PREEMPT_RT
  - syzkaller: five one-hour A/B pairs on four 2-vCPU PREEMPT_RT VMs.
    At ~110k executions, the five-run median was 4,142 vs. 3,216
    corpus entries (+28.8%) and 54,872 vs. 50,940 coverage (+7.7%).
    No unsuppressed reports

The USB runs no longer contained the baseline PCs from deferred rearm,
hrtick and scheduler wakeup callees. The fork run no longer contained the
baseline __smp_call_single_queue(), generic_exec_single() or
smp_call_function_single_async() PCs.

With KCOV disabled, the pause calls compile away. With KCOV enabled on
x86-64, __schedule() grows by 117 bytes across patches 2 and 3,
try_to_wake_up() by 106 bytes and wake_up_new_task() by 88 bytes.

[1] https://lore.kernel.org/r/20260724192122.73080-1-kmehltretter@gmail.com/

Karl Mehltretter (5):
  kcov: add kcov_pause()/kcov_resume() helpers
  hrtimer: pause KCOV during deferred rearm
  sched: pause KCOV in __schedule()
  sched: pause KCOV in try_to_wake_up()
  sched: pause KCOV in wake_up_new_task()

 include/linux/hrtimer_rearm.h | 18 ++++++++++++++++--
 include/linux/kcov.h          | 25 ++++++++++++++++++++++++-
 kernel/kcov.c                 |  2 +-
 kernel/sched/core.c           | 15 ++++++++++++++-
 4 files changed, 55 insertions(+), 5 deletions(-)

base-commit: 8ba098e6b6ff0db8edf28528d1552be261af30d4

[PATCH 1/5] kcov: add kcov_pause()/kcov_resume() helpers

[Karl Mehltretter]

Interrupt-return work can run after HARDIRQ_OFFSET is dropped, when
in_task() is true. KCOV then attributes instrumented callees to the
interrupted task.

Add a KCOV_PAUSED bit next to KCOV_IN_CTXSW and mask both in
kcov_mode_enabled(). The context switch suppression keeps its own bit:
kcov_prepare_switch() runs on the previous task and kcov_finish_switch()
on the one switched in, so its lifetime is not a pause section.

Sections nest by passing the state returned by kcov_pause() to
kcov_resume(). Both operate on current. When task KCOV is active, remote
softirq sections save and restore the complete mode, preserving the
pause state.

The helpers are __always_inline, and the caller must be uninstrumented:
inlining does not remove the caller's own coverage callbacks.

Assisted-by: Claude:claude-opus-4-8
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 include/linux/kcov.h | 25 ++++++++++++++++++++++++-
 kernel/kcov.c        |  2 +-
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/include/linux/kcov.h b/include/linux/kcov.h
index 895b761b2db1..5a0a1a9bb7ef 100644
--- a/include/linux/kcov.h
+++ b/include/linux/kcov.h
@@ -2,6 +2,7 @@
 #ifndef _LINUX_KCOV_H
 #define _LINUX_KCOV_H
 
+#include <linux/bits.h>
 #include <linux/sched.h>
 #include <uapi/linux/kcov.h>
 
@@ -23,7 +24,8 @@ enum kcov_mode {
 	KCOV_MODE_TRACE_CMP = 3,
 };
 
-#define KCOV_IN_CTXSW	(1 << 30)
+#define KCOV_IN_CTXSW	BIT(30)
+#define KCOV_PAUSED	BIT(29)
 
 void kcov_task_init(struct task_struct *t);
 void kcov_task_exit(struct task_struct *t);
@@ -38,6 +40,25 @@ do {						\
 	(t)->kcov_mode &= ~KCOV_IN_CTXSW;	\
 } while (0)
 
+/*
+ * Pause coverage for current. Pass the returned state to kcov_resume().
+ * Callers must be uninstrumented.
+ */
+static __always_inline unsigned int kcov_pause(struct task_struct *t)
+{
+	unsigned int paused;
+
+	paused = t->kcov_mode & KCOV_PAUSED;
+	t->kcov_mode |= KCOV_PAUSED;
+	return paused;
+}
+
+static __always_inline void kcov_resume(struct task_struct *t, unsigned int paused)
+{
+	if (!paused)
+		t->kcov_mode &= ~KCOV_PAUSED;
+}
+
 /* See Documentation/dev-tools/kcov.rst for usage details. */
 void kcov_remote_start(u64 handle);
 void kcov_remote_stop(void);
@@ -93,6 +114,8 @@ void __sanitizer_cov_trace_switch(kcov_u64 val, void *cases);
 
 static inline void kcov_task_init(struct task_struct *t) {}
 static inline void kcov_task_exit(struct task_struct *t) {}
+static inline unsigned int kcov_pause(struct task_struct *t) { return 0; }
+static inline void kcov_resume(struct task_struct *t, unsigned int paused) {}
 static inline void kcov_prepare_switch(struct task_struct *t) {}
 static inline void kcov_finish_switch(struct task_struct *t) {}
 static inline void kcov_remote_start(u64 handle) {}
diff --git a/kernel/kcov.c b/kernel/kcov.c
index 1df373fb562b..83d53e383822 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -830,7 +830,7 @@ static const struct file_operations kcov_fops = {
 
 static inline bool kcov_mode_enabled(unsigned int mode)
 {
-	return (mode & ~KCOV_IN_CTXSW) != KCOV_MODE_DISABLED;
+	return (mode & ~(KCOV_IN_CTXSW | KCOV_PAUSED)) != KCOV_MODE_DISABLED;
 }
 
 static void kcov_remote_softirq_start(struct task_struct *t)
-- 
2.53.0

[PATCH 2/5] hrtimer: pause KCOV during deferred rearm

[Karl Mehltretter]

Deferred hrtimer rearm can run after HARDIRQ_OFFSET is dropped. in_task()
is then true, so KCOV attributes the instrumented timer-reprogramming
subtree to current.

With CONFIG_KCOV_SELFTEST, the interrupt selftest fails on x86_64
defconfig under QEMU, detecting spurious coverage in
__hrtimer_rearm_deferred(). The same happens on s390, RISC-V and
LoongArch, which also enable HRTIMER_REARM_DEFERRED.

Excluding the involved files instead would cost their coverage on real
task-context paths, e.g. the hrtimer and timekeeping syscalls.

Pause in the __always_inline wrappers, including hrtick_schedule_exit().
Call sites where task KCOV can be active are KCOV-disabled or noinstr.
HAVE_NOINSTR_HACK covers pre-GCC-12 x86. The other affected
architectures restrict KCOV to GCC 12 or Clang through
ARCH_WANTS_NO_INSTR. This avoids relying on __no_sanitize_coverage,
which is empty before GCC 12. Tested with GCC 8.1 and 15 on x86_64.

Fixes: 15dd3a948855 ("hrtimer: Push reprogramming timers into the interrupt return path")
Assisted-by: Claude:claude-opus-4-8
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 include/linux/hrtimer_rearm.h | 18 ++++++++++++++++--
 kernel/sched/core.c           |  2 +-
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/include/linux/hrtimer_rearm.h b/include/linux/hrtimer_rearm.h
index a6f2e5d5e1c7..b95687529c2e 100644
--- a/include/linux/hrtimer_rearm.h
+++ b/include/linux/hrtimer_rearm.h
@@ -3,10 +3,23 @@
 #define _LINUX_HRTIMER_REARM_H
 
 #ifdef CONFIG_HRTIMER_REARM_DEFERRED
+#include <linux/kcov.h>
 #include <linux/thread_info.h>
 
 void __hrtimer_rearm_deferred(void);
 
+/*
+ * Pause outside __hrtimer_rearm_deferred() to suppress its entry coverage.
+ * Call sites where task KCOV can be active are uninstrumented.
+ */
+static __always_inline void hrtimer_rearm_deferred_paused(void)
+{
+	unsigned int kcov_paused = kcov_pause(current);
+
+	__hrtimer_rearm_deferred();
+	kcov_resume(current, kcov_paused);
+}
+
 /*
  * This is purely CPU local, so check the TIF bit first to avoid the overhead of
  * the atomic test_and_clear_bit() operation for the common case where the bit
@@ -38,7 +51,7 @@ hrtimer_rearm_deferred_user_irq(unsigned long *tif_work, const unsigned long tif
 	 */
 	if (unlikely((*tif_work & TIF_REARM_MASK) == _TIF_HRTIMER_REARM)) {
 		clear_thread_flag(TIF_HRTIMER_REARM);
-		__hrtimer_rearm_deferred();
+		hrtimer_rearm_deferred_paused();
 		/* Don't go into the loop if HRTIMER_REARM was the only flag */
 		*tif_work &= ~TIF_HRTIMER_REARM;
 		return !*tif_work;
@@ -50,7 +63,7 @@ hrtimer_rearm_deferred_user_irq(unsigned long *tif_work, const unsigned long tif
 static __always_inline void hrtimer_rearm_deferred_tif(unsigned long tif_work)
 {
 	if (hrtimer_test_and_clear_rearm_deferred_tif(tif_work))
-		__hrtimer_rearm_deferred();
+		hrtimer_rearm_deferred_paused();
 }
 
 /*
@@ -73,6 +86,7 @@ static __always_inline bool hrtimer_test_and_clear_rearm_deferred(void)
 
 #else  /* CONFIG_HRTIMER_REARM_DEFERRED */
 static __always_inline void __hrtimer_rearm_deferred(void) { }
+static __always_inline void hrtimer_rearm_deferred_paused(void) { }
 static __always_inline void hrtimer_rearm_deferred(void) { }
 static __always_inline void hrtimer_rearm_deferred_tif(unsigned long tif_work) { }
 static __always_inline bool
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 96226707c2f6..b6a8fbbdd538 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1010,7 +1010,7 @@ static inline void hrtick_schedule_exit(struct rq *rq)
 	}
 
 	if (rq->hrtick_sched & HRTICK_SCHED_REARM_HRTIMER)
-		__hrtimer_rearm_deferred();
+		hrtimer_rearm_deferred_paused();
 
 	rq->hrtick_sched = HRTICK_SCHED_NONE;
 }
-- 
2.53.0

[PATCH 3/5] sched: pause KCOV in __schedule()

[Karl Mehltretter]

kernel/sched/ is not instrumented, but callees such as sched_clock(),
architecture CPU-capacity helpers and profile_hits() are.

During preemption and schedule() calls, instrumented callees can add
nondeterministic scheduler coverage to current.

With CONFIG_KCOV_SELFTEST, the interrupt selftest fails on x86_64
defconfig under QEMU, detecting spurious coverage in
arch_scale_cpu_capacity(). On arm64 the same class of leak appears in
sched_clock(), once the separate arm64 interrupt-accounting leak is
suppressed.

Annotating each callee would spread exclusions across architectures.
Pause across __schedule() instead, extending the scheduler exclusion to
its callees.

KCOV_PAUSED remains set while a task is switched out. Its resumed
__schedule() frame restores the prior state.

Fixes: 5c9a8750a640 ("kernel: add kcov code coverage")
Assisted-by: Claude:claude-opus-4-8
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 kernel/sched/core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index b6a8fbbdd538..d5663df6c702 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -7069,10 +7069,14 @@ static void __sched notrace __schedule(int sched_mode)
 	bool is_switch = false;
 	unsigned long *switch_count;
 	unsigned long prev_state;
+	unsigned int kcov_paused;
 	struct rq_flags rf;
 	struct rq *rq;
 	int cpu;
 
+	/* KCOV: sched/ is uninstrumented but the __schedule() callees are not. */
+	kcov_paused = kcov_pause(current);
+
 	/* Trace preemptions consistently with task switches */
 	trace_sched_entry_tp(sched_mode == SM_PREEMPT);
 
@@ -7239,6 +7243,7 @@ static void __sched notrace __schedule(int sched_mode)
 		raw_spin_rq_unlock_irq(rq);
 	}
 	trace_sched_exit_tp(is_switch);
+	kcov_resume(current, kcov_paused);
 }
 
 void __noreturn do_task_dead(void)
-- 
2.53.0

[PATCH 4/5] sched: pause KCOV in try_to_wake_up()

[Karl Mehltretter]

try_to_wake_up() is uninstrumented, but it calls instrumented helpers
such as kthread_is_per_cpu(), CPU capacity helpers and SCHED_HRTICK
arming. They can record into current while in_task() is true.

CONFIG_KCOV_SELFTEST exposes this under PREEMPT_RT. The interrupt
selftest fails on x86_64 in kthread_is_per_cpu(): RT runs the timer
softirq in a thread, so the wakeup runs in task context during the
selftest's spin. The same helpers leak into non-RT syscall wakeups such
as a pipe write waking a reader.

Pause all of try_to_wake_up(). Wrapping only select_task_rq() would miss
SCHED_HRTICK arming during enqueue.

Fixes: 5c9a8750a640 ("kernel: add kcov code coverage")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 kernel/sched/core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index d5663df6c702..1e562a7ff0af 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4252,6 +4252,8 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
 {
 	guard(preempt)();
 	int cpu, success = 0;
+	/* KCOV: sched/ is uninstrumented but the wakeup callees are not. */
+	unsigned int kcov_paused = kcov_pause(current);
 
 	wake_flags |= WF_TTWU;
 
@@ -4418,6 +4420,7 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
 	if (success)
 		ttwu_stat(p, task_cpu(p), wake_flags);
 
+	kcov_resume(current, kcov_paused);
 	return success;
 }
 
-- 
2.53.0

[PATCH 5/5] sched: pause KCOV in wake_up_new_task()

[Karl Mehltretter]

wake_up_new_task() is uninstrumented, but CPU selection and enqueue call
instrumented helpers. During a KCOV-enabled fork, they can record
scheduler, hrtimer and clockevent coverage into the parent.

The paths depend on runqueue and CPU state, so coverage varies between
identical forks. Pause KCOV for the whole function, extending the
scheduler exclusion to new-task wakeups.

Fixes: 5c9a8750a640 ("kernel: add kcov code coverage")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
 kernel/sched/core.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 1e562a7ff0afb..cad1b01063450 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4945,8 +4945,12 @@ void wake_up_new_task(struct task_struct *p)
 {
 	struct rq_flags rf;
 	struct rq *rq;
+	unsigned int kcov_paused;
 	int wake_flags = WF_FORK;
 
+	/* KCOV: sched/ is uninstrumented but the wakeup callees are not. */
+	kcov_paused = kcov_pause(current);
+
 	raw_spin_lock_irqsave(&p->pi_lock, rf.flags);
 	WRITE_ONCE(p->__state, TASK_RUNNING);
 	/*
@@ -4976,6 +4980,7 @@ void wake_up_new_task(struct task_struct *p)
 		rq_repin_lock(rq, &rf);
 	}
 	task_rq_unlock(rq, p, &rf);
+	kcov_resume(current, kcov_paused);
 }
 
 #ifdef CONFIG_PREEMPT_NOTIFIERS
-- 
2.53.0

Re: [PATCH 4/5] sched: pause KCOV in try_to_wake_up()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] The patch mixes a goto-based manual cleanup with a `guard()` declaration in the same function, violating cleanup subsystem guidelines.
--

--- Patch [4]: [PATCH 4/5] sched: pause KCOV in try_to_wake_up() ---
commit 96c5de7cc097dcbb15a79c4c86f4148070fd31cf
Author: Karl Mehltretter <kmehltretter@gmail.com>

sched: pause KCOV in try_to_wake_up()

This patch pauses KCOV instrumentation around try_to_wake_up() to prevent
instrumented helpers from recording into current while in task context. It
saves the pause state and manually resumes it at the function's exit label.

> diff --git a/kernel/sched/core.c b/kernel/sched/core.c
> --- a/kernel/sched/core.c
> +++ b/kernel/sched/core.c
> @@ -4252,6 +4252,8 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
>  {
>  	guard(preempt)();
>  	int cpu, success = 0;
> +	/* KCOV: sched/ is uninstrumented but the wakeup callees are not. */
> +	unsigned int kcov_paused = kcov_pause(current);

[ ... ]

> @@ -4418,6 +4420,7 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
>  	if (success)
>  		ttwu_stat(p, task_cpu(p), wake_flags);
>  
> +	kcov_resume(current, kcov_paused);
>  	return success;
>  }

[Severity: Low]
Does this mix manual goto-based cleanup with scope-based guard() declarations?

The cleanup subsystem guidelines recommend that goto-based error handling and
cleanup helpers should not be mixed in the same function, as it can confuse
ownership semantics and increase the risk of resource leaks if early returns
are added later.

In try_to_wake_up(), guard(preempt)() is used at the top of the function,
but this patch introduces a manual kcov_resume() cleanup step at the out:
label.

Could this KCOV pause and resume be handled using a scope-based cleanup helper
to match the existing guard() usage, preventing the mixed paradigms?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260807205027.31972-1-kmehltretter@gmail.com?part=4

Re: [PATCH 1/5] kcov: add kcov_pause()/kcov_resume() helpers

[Bradley Morgan]

On 7 August 2026 21:50:23 BST, Karl Mehltretter <kmehltretter@gmail.com>
wrote:
>Interrupt-return work can run after HARDIRQ_OFFSET is dropped, when
>in_task() is true. KCOV then attributes instrumented callees to the
>interrupted task.
>
>Add a KCOV_PAUSED bit next to KCOV_IN_CTXSW and mask both in
>kcov_mode_enabled(). The context switch suppression keeps its own bit:
>kcov_prepare_switch() runs on the previous task and kcov_finish_switch()
>on the one switched in, so its lifetime is not a pause section.
>
>Sections nest by passing the state returned by kcov_pause() to
>kcov_resume(). Both operate on current. When task KCOV is active, remote
>softirq sections save and restore the complete mode, preserving the
>pause state.
>
>The helpers are __always_inline, and the caller must be uninstrumented:
>inlining does not remove the caller's own coverage callbacks.
>

Hmm. Okay!

Reviewed-by: Bradley Morgan <include@grrlz.net>
 

I don't see anything wrong with it, LGTM, thanks for the patch 

>Assisted-by: Claude:claude-opus-4-8
>Assisted-by: Claude:claude-fable-5
>Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
>---
> include/linux/kcov.h | 25 ++++++++++++++++++++++++-
> kernel/kcov.c        |  2 +-
> 2 files changed, 25 insertions(+), 2 deletions(-)
>
>diff --git a/include/linux/kcov.h b/include/linux/kcov.h
>index 895b761b2db1..5a0a1a9bb7ef 100644
>--- a/include/linux/kcov.h
>+++ b/include/linux/kcov.h
>@@ -2,6 +2,7 @@
> #ifndef _LINUX_KCOV_H
> #define _LINUX_KCOV_H
> 
>+#include <linux/bits.h>
> #include <linux/sched.h>
> #include <uapi/linux/kcov.h>
> 
>@@ -23,7 +24,8 @@ enum kcov_mode {
> 	KCOV_MODE_TRACE_CMP = 3,
> };
> 
>-#define KCOV_IN_CTXSW	(1 << 30)
>+#define KCOV_IN_CTXSW	BIT(30)
>+#define KCOV_PAUSED	BIT(29)
> 
> void kcov_task_init(struct task_struct *t);
> void kcov_task_exit(struct task_struct *t);
>@@ -38,6 +40,25 @@ do {						\
> 	(t)->kcov_mode &= ~KCOV_IN_CTXSW;	\
> } while (0)
> 
>+/*
>+ * Pause coverage for current. Pass the returned state to kcov_resume().
>+ * Callers must be uninstrumented.
>+ */
>+static __always_inline unsigned int kcov_pause(struct task_struct *t)
>+{
>+	unsigned int paused;
>+
>+	paused = t->kcov_mode & KCOV_PAUSED;
>+	t->kcov_mode |= KCOV_PAUSED;
>+	return paused;
>+}
>+
>+static __always_inline void kcov_resume(struct task_struct *t, unsigned int paused)
>+{
>+	if (!paused)
>+		t->kcov_mode &= ~KCOV_PAUSED;
>+}
>+
> /* See Documentation/dev-tools/kcov.rst for usage details. */
> void kcov_remote_start(u64 handle);
> void kcov_remote_stop(void);
>@@ -93,6 +114,8 @@ void __sanitizer_cov_trace_switch(kcov_u64 val, void *cases);
> 
> static inline void kcov_task_init(struct task_struct *t) {}
> static inline void kcov_task_exit(struct task_struct *t) {}
>+static inline unsigned int kcov_pause(struct task_struct *t) { return 0; }
>+static inline void kcov_resume(struct task_struct *t, unsigned int paused) {}
> static inline void kcov_prepare_switch(struct task_struct *t) {}
> static inline void kcov_finish_switch(struct task_struct *t) {}
> static inline void kcov_remote_start(u64 handle) {}
>diff --git a/kernel/kcov.c b/kernel/kcov.c
>index 1df373fb562b..83d53e383822 100644
>--- a/kernel/kcov.c
>+++ b/kernel/kcov.c
>@@ -830,7 +830,7 @@ static const struct file_operations kcov_fops = {
> 
> static inline bool kcov_mode_enabled(unsigned int mode)
> {
>-	return (mode & ~KCOV_IN_CTXSW) != KCOV_MODE_DISABLED;
>+	return (mode & ~(KCOV_IN_CTXSW | KCOV_PAUSED)) != KCOV_MODE_DISABLED;
> }
> 
> static void kcov_remote_softirq_start(struct task_struct *t)
>

Thanks!

Re: [PATCH 2/5] hrtimer: pause KCOV during deferred rearm

[Bradley Morgan]

On 7 August 2026 21:50:24 BST, Karl Mehltretter <kmehltretter@gmail.com>
wrote:
>Deferred hrtimer rearm can run after HARDIRQ_OFFSET is dropped. in_task()
>is then true, so KCOV attributes the instrumented timer-reprogramming
>subtree to current.
>
>With CONFIG_KCOV_SELFTEST, the interrupt selftest fails on x86_64
>defconfig under QEMU, detecting spurious coverage in
>__hrtimer_rearm_deferred(). The same happens on s390, RISC-V and
>LoongArch, which also enable HRTIMER_REARM_DEFERRED.
>
>Excluding the involved files instead would cost their coverage on real
>task-context paths, e.g. the hrtimer and timekeeping syscalls.
>
>Pause in the __always_inline wrappers, including hrtick_schedule_exit().
>Call sites where task KCOV can be active are KCOV-disabled or noinstr.
>HAVE_NOINSTR_HACK covers pre-GCC-12 x86. The other affected
>architectures restrict KCOV to GCC 12 or Clang through
>ARCH_WANTS_NO_INSTR. This avoids relying on __no_sanitize_coverage,
>which is empty before GCC 12. Tested with GCC 8.1 and 15 on x86_64.
>
>Fixes: 15dd3a948855 ("hrtimer: Push reprogramming timers into the interrupt return path")
>Assisted-by: Claude:claude-opus-4-8
>Assisted-by: Claude:claude-fable-5
>Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
>---
> include/linux/hrtimer_rearm.h | 18 ++++++++++++++++--
> kernel/sched/core.c           |  2 +-
> 2 files changed, 17 insertions(+), 3 deletions(-)
>
>diff --git a/include/linux/hrtimer_rearm.h b/include/linux/hrtimer_rearm.h
>index a6f2e5d5e1c7..b95687529c2e 100644
>--- a/include/linux/hrtimer_rearm.h
>+++ b/include/linux/hrtimer_rearm.h
>@@ -3,10 +3,23 @@
> #define _LINUX_HRTIMER_REARM_H
> 
> #ifdef CONFIG_HRTIMER_REARM_DEFERRED
>+#include <linux/kcov.h>
> #include <linux/thread_info.h>
> 
> void __hrtimer_rearm_deferred(void);
> 
>+/*
>+ * Pause outside __hrtimer_rearm_deferred() to suppress its entry coverage.
>+ * Call sites where task KCOV can be active are uninstrumented.
>+ */

I see. Okay.

Reviewed-by: Bradley Morgan <include@grrlz.net>

LGTM

>+static __always_inline void hrtimer_rearm_deferred_paused(void)
>+{
>+	unsigned int kcov_paused = kcov_pause(current);
>+
>+	__hrtimer_rearm_deferred();
>+	kcov_resume(current, kcov_paused);
>+}
>+
> /*
>  * This is purely CPU local, so check the TIF bit first to avoid the overhead of
>  * the atomic test_and_clear_bit() operation for the common case where the bit
>@@ -38,7 +51,7 @@ hrtimer_rearm_deferred_user_irq(unsigned long *tif_work, const unsigned long tif
> 	 */
> 	if (unlikely((*tif_work & TIF_REARM_MASK) == _TIF_HRTIMER_REARM)) {
> 		clear_thread_flag(TIF_HRTIMER_REARM);
>-		__hrtimer_rearm_deferred();
>+		hrtimer_rearm_deferred_paused();
> 		/* Don't go into the loop if HRTIMER_REARM was the only flag */
> 		*tif_work &= ~TIF_HRTIMER_REARM;
> 		return !*tif_work;
>@@ -50,7 +63,7 @@ hrtimer_rearm_deferred_user_irq(unsigned long *tif_work, const unsigned long tif
> static __always_inline void hrtimer_rearm_deferred_tif(unsigned long
> tif_work)
> {
> 	if (hrtimer_test_and_clear_rearm_deferred_tif(tif_work))
>-		__hrtimer_rearm_deferred();
>+		hrtimer_rearm_deferred_paused();
> }
> 
> /*
>@@ -73,6 +86,7 @@ static __always_inline bool hrtimer_test_and_clear_rearm_deferred(void)
> 
> #else  /* CONFIG_HRTIMER_REARM_DEFERRED */
> static __always_inline void __hrtimer_rearm_deferred(void) { }
>+static __always_inline void hrtimer_rearm_deferred_paused(void) { }
> static __always_inline void hrtimer_rearm_deferred(void) { }
> static __always_inline void hrtimer_rearm_deferred_tif(unsigned long
> tif_work) { }
> static __always_inline bool
>diff --git a/kernel/sched/core.c b/kernel/sched/core.c
>index 96226707c2f6..b6a8fbbdd538 100644
>--- a/kernel/sched/core.c
>+++ b/kernel/sched/core.c
>@@ -1010,7 +1010,7 @@ static inline void hrtick_schedule_exit(struct rq *rq)
> 	}
> 
> 	if (rq->hrtick_sched & HRTICK_SCHED_REARM_HRTIMER)
>-		__hrtimer_rearm_deferred();
>+		hrtimer_rearm_deferred_paused();
> 
> 	rq->hrtick_sched = HRTICK_SCHED_NONE;
> }
>

Thanks!

Re: [PATCH 3/5] sched: pause KCOV in __schedule()

[Bradley Morgan]

On 7 August 2026 21:50:25 BST, Karl Mehltretter <kmehltretter@gmail.com>
wrote:
>kernel/sched/ is not instrumented, but callees such as sched_clock(),
>architecture CPU-capacity helpers and profile_hits() are.
>
>During preemption and schedule() calls, instrumented callees can add
>nondeterministic scheduler coverage to current.
>
>With CONFIG_KCOV_SELFTEST, the interrupt selftest fails on x86_64
>defconfig under QEMU, detecting spurious coverage in
>arch_scale_cpu_capacity(). On arm64 the same class of leak appears in
>sched_clock(), once the separate arm64 interrupt-accounting leak is
>suppressed.
>
>Annotating each callee would spread exclusions across architectures.
>Pause across __schedule() instead, extending the scheduler exclusion to
>its callees.
>
>KCOV_PAUSED remains set while a task is switched out. Its resumed
>__schedule() frame restores the prior state.
>
>Fixes: 5c9a8750a640 ("kernel: add kcov code coverage")
>Assisted-by: Claude:claude-opus-4-8
>Assisted-by: Claude:claude-fable-5

Awesomesauce! 

Reviewed-by: Bradley Morgan <include@grrlz.net>

well, no idea how one patch could be assisted by two AI models, but I
could see some sort of Frankenstein scenario, maybe fable planning opus
implementation?, tbh idc because this patch is good anyway, thanks Karl.

>Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
>---
> kernel/sched/core.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
>diff --git a/kernel/sched/core.c b/kernel/sched/core.c
>index b6a8fbbdd538..d5663df6c702 100644
>--- a/kernel/sched/core.c
>+++ b/kernel/sched/core.c
>@@ -7069,10 +7069,14 @@ static void __sched notrace __schedule(int sched_mode)
> 	bool is_switch = false;
> 	unsigned long *switch_count;
> 	unsigned long prev_state;
>+	unsigned int kcov_paused;
> 	struct rq_flags rf;
> 	struct rq *rq;
> 	int cpu;
> 
>+	/* KCOV: sched/ is uninstrumented but the __schedule() callees are not. */
>+	kcov_paused = kcov_pause(current);
>+
> 	/* Trace preemptions consistently with task switches */
> 	trace_sched_entry_tp(sched_mode == SM_PREEMPT);
> 
>@@ -7239,6 +7243,7 @@ static void __sched notrace __schedule(int sched_mode)
> 		raw_spin_rq_unlock_irq(rq);
> 	}
> 	trace_sched_exit_tp(is_switch);
>+	kcov_resume(current, kcov_paused);
> }
> 
> void __noreturn do_task_dead(void)
>

Thanks!

Re: [PATCH 4/5] sched: pause KCOV in try_to_wake_up()

[Bradley Morgan]

On 7 August 2026 21:50:26 BST, Karl Mehltretter <kmehltretter@gmail.com>
wrote:
>try_to_wake_up() is uninstrumented, but it calls instrumented helpers
>such as kthread_is_per_cpu(), CPU capacity helpers and SCHED_HRTICK
>arming. They can record into current while in_task() is true.
>
>CONFIG_KCOV_SELFTEST exposes this under PREEMPT_RT. The interrupt
>selftest fails on x86_64 in kthread_is_per_cpu(): RT runs the timer
>softirq in a thread, so the wakeup runs in task context during the
>selftest's spin. The same helpers leak into non-RT syscall wakeups such
>as a pipe write waking a reader.
>
>Pause all of try_to_wake_up(). Wrapping only select_task_rq() would miss
>SCHED_HRTICK arming during enqueue.
>
>Fixes: 5c9a8750a640 ("kernel: add kcov code coverage")
>Assisted-by: Claude:claude-opus-4-8
>Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>

I don't mind.

Reviewed-by: Bradley Morgan <include@grrlz.net>

I saw sashikos "kind" reply, this isn't a bug, but a scoped guard,
could be built.

considering it would future proof against somebody adding a early return
later.


but tbh that's more a patch 1 decision to make.


>---
> kernel/sched/core.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/kernel/sched/core.c b/kernel/sched/core.c
>index d5663df6c702..1e562a7ff0af 100644
>--- a/kernel/sched/core.c
>+++ b/kernel/sched/core.c
>@@ -4252,6 +4252,8 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
> {
> 	guard(preempt)();
> 	int cpu, success = 0;
>+	/* KCOV: sched/ is uninstrumented but the wakeup callees are not. */
>+	unsigned int kcov_paused = kcov_pause(current);
> 
> 	wake_flags |= WF_TTWU;
> 
>@@ -4418,6 +4420,7 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
> 	if (success)
> 		ttwu_stat(p, task_cpu(p), wake_flags);
> 
>+	kcov_resume(current, kcov_paused);
> 	return success;
> }
> 
>

Thanks!

Re: [PATCH 5/5] sched: pause KCOV in wake_up_new_task()

[Bradley Morgan]

On 7 August 2026 21:50:27 BST, Karl Mehltretter <kmehltretter@gmail.com>
wrote:
>wake_up_new_task() is uninstrumented, but CPU selection and enqueue call
>instrumented helpers. During a KCOV-enabled fork, they can record
>scheduler, hrtimer and clockevent coverage into the parent.
>
>The paths depend on runqueue and CPU state, so coverage varies between
>identical forks. Pause KCOV for the whole function, extending the
>scheduler exclusion to new-task wakeups.
>
>Fixes: 5c9a8750a640 ("kernel: add kcov code coverage")
>Assisted-by: Claude:claude-opus-4-8
>Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>

Reviewed-by: Bradley Morgan <include@grrlz.net>


>---
> kernel/sched/core.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
>diff --git a/kernel/sched/core.c b/kernel/sched/core.c
>index 1e562a7ff0afb..cad1b01063450 100644
>--- a/kernel/sched/core.c
>+++ b/kernel/sched/core.c
>@@ -4945,8 +4945,12 @@ void wake_up_new_task(struct task_struct *p)
> {
> 	struct rq_flags rf;
> 	struct rq *rq;
>+	unsigned int kcov_paused;
> 	int wake_flags = WF_FORK;
> 
>+	/* KCOV: sched/ is uninstrumented but the wakeup callees are not. */

I feel this comment is not the best.  I mean, it's more a opinion thing.

/* Instrumented callees would leak into current here... */

could be a good one. What do you think? :)


>+	kcov_paused = kcov_pause(current);
>+
> 	raw_spin_lock_irqsave(&p->pi_lock, rf.flags);
> 	WRITE_ONCE(p->__state, TASK_RUNNING);
> 	/*
>@@ -4976,6 +4980,7 @@ void wake_up_new_task(struct task_struct *p)
> 		rq_repin_lock(rq, &rf);
> 	}
> 	task_rq_unlock(rq, p, &rf);
>+	kcov_resume(current, kcov_paused);
> }
> 
> #ifdef CONFIG_PREEMPT_NOTIFIERS
>

Thanks!

Re: [PATCH 0/5] kcov: suppress timer and scheduler coverage leaks

[Peter Zijlstra]

On Fri, Aug 07, 2026 at 10:50:22PM +0200, Karl Mehltretter wrote:

> Karl Mehltretter (5):
>   kcov: add kcov_pause()/kcov_resume() helpers
>   hrtimer: pause KCOV during deferred rearm
>   sched: pause KCOV in __schedule()
>   sched: pause KCOV in try_to_wake_up()
>   sched: pause KCOV in wake_up_new_task()
> 
>  include/linux/hrtimer_rearm.h | 18 ++++++++++++++++--
>  include/linux/kcov.h          | 25 ++++++++++++++++++++++++-
>  kernel/kcov.c                 |  2 +-
>  kernel/sched/core.c           | 15 ++++++++++++++-
>  4 files changed, 55 insertions(+), 5 deletions(-)

You've send me a partial series; which is the same as not sending me
anything at all. If you want me to look at it, send the complete thing,
so I can evaluate the whole thing.