Eric Lee / smarc-fsl-linux-kernel

01 Apr, 2016

1 commit

23 Mar, 2016

1 commit

  • 5c9a8750a   kernel: add kcov code coverage ... Browse Code »

    kcov provides code coverage collection for coverage-guided fuzzing
    (randomized testing). Coverage-guided fuzzing is a testing technique
    that uses coverage feedback to determine new interesting inputs to a
    system. A notable user-space example is AFL
    (http://lcamtuf.coredump.cx/afl/). However, this technique is not
    widely used for kernel testing due to missing compiler and kernel
    support.

    kcov does not aim to collect as much coverage as possible. It aims to
    collect more or less stable coverage that is function of syscall inputs.
    To achieve this goal it does not collect coverage in soft/hard
    interrupts and instrumentation of some inherently non-deterministic or
    non-interesting parts of kernel is disbled (e.g. scheduler, locking).

    Currently there is a single coverage collection mode (tracing), but the
    API anticipates additional collection modes. Initially I also
    implemented a second mode which exposes coverage in a fixed-size hash
    table of counters (what Quentin used in his original patch). I've
    dropped the second mode for simplicity.

    This patch adds the necessary support on kernel side. The complimentary
    compiler support was added in gcc revision 231296.

    We've used this support to build syzkaller system call fuzzer, which has
    found 90 kernel bugs in just 2 months:

    https://github.com/google/syzkaller/wiki/Found-Bugs

    We've also found 30+ bugs in our internal systems with syzkaller.
    Another (yet unexplored) direction where kcov coverage would greatly
    help is more traditional "blob mutation". For example, mounting a
    random blob as a filesystem, or receiving a random blob over wire.

    Why not gcov. Typical fuzzing loop looks as follows: (1) reset
    coverage, (2) execute a bit of code, (3) collect coverage, repeat. A
    typical coverage can be just a dozen of basic blocks (e.g. an invalid
    input). In such context gcov becomes prohibitively expensive as
    reset/collect coverage steps depend on total number of basic
    blocks/edges in program (in case of kernel it is about 2M). Cost of
    kcov depends only on number of executed basic blocks/edges. On top of
    that, kernel requires per-thread coverage because there are always
    background threads and unrelated processes that also produce coverage.
    With inlined gcov instrumentation per-thread coverage is not possible.

    kcov exposes kernel PCs and control flow to user-space which is
    insecure. But debugfs should not be mapped as user accessible.

    Based on a patch by Quentin Casasnovas.

    [akpm@linux-foundation.org: make task_struct.kcov_mode have type `enum kcov_mode']
    [akpm@linux-foundation.org: unbreak allmodconfig]
    [akpm@linux-foundation.org: follow x86 Makefile layout standards]
    Signed-off-by: Dmitry Vyukov
    Reviewed-by: Kees Cook
    Cc: syzkaller
    Cc: Vegard Nossum
    Cc: Catalin Marinas
    Cc: Tavis Ormandy
    Cc: Will Deacon
    Cc: Quentin Casasnovas
    Cc: Kostya Serebryany
    Cc: Eric Dumazet
    Cc: Alexander Potapenko
    Cc: Kees Cook
    Cc: Bjorn Helgaas
    Cc: Sasha Levin
    Cc: David Drysdale
    Cc: Ard Biesheuvel
    Cc: Andrey Ryabinin
    Cc: Kirill A. Shutemov
    Cc: Jiri Slaby
    Cc: Ingo Molnar
    Cc: Thomas Gleixner
    Cc: "H. Peter Anvin"
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Dmitry Vyukov
     

07 Oct, 2015

1 commit

  • cc44ca848   rcu: Create rcu_sync infrastructure ... Browse Code »

    The rcu_sync infrastructure can be thought of as infrastructure to be
    used to implement reader-writer primitives having extremely lightweight
    readers during times when there are no writers. The first use is in
    the percpu_rwsem used by the VFS subsystem.

    This infrastructure is functionally equivalent to

    struct rcu_sync_struct {
    atomic_t counter;
    };

    /* Check possibility of fast-path read-side operations. */
    static inline bool rcu_sync_is_idle(struct rcu_sync_struct *rss)
    {
    return atomic_read(&rss->counter) == 0;
    }

    /* Tell readers to use slowpaths. */
    static inline void rcu_sync_enter(struct rcu_sync_struct *rss)
    {
    atomic_inc(&rss->counter);
    synchronize_sched();
    }

    /* Allow readers to once again use fastpaths. */
    static inline void rcu_sync_exit(struct rcu_sync_struct *rss)
    {
    synchronize_sched();
    atomic_dec(&rss->counter);
    }

    The main difference is that it records the state and only calls
    synchronize_sched() if required. At least some of the calls to
    synchronize_sched() will be optimized away when rcu_sync_enter() and
    rcu_sync_exit() are invoked repeatedly in quick succession.

    Signed-off-by: Oleg Nesterov
    Signed-off-by: Peter Zijlstra (Intel)
    Signed-off-by: Paul E. McKenney
    Reviewed-by: Josh Triplett

    Oleg Nesterov
     

07 Jan, 2015

1 commit

  • 83fe27ea5   rcu: Make SRCU optional by using CONFIG_SRCU ... Browse Code »

    SRCU is not necessary to be compiled by default in all cases. For tinification
    efforts not compiling SRCU unless necessary is desirable.

    The current patch tries to make compiling SRCU optional by introducing a new
    Kconfig option CONFIG_SRCU which is selected when any of the components making
    use of SRCU are selected.

    If we do not select CONFIG_SRCU, srcu.o will not be compiled at all.

    text data bss dec hex filename
    2007 0 0 2007 7d7 kernel/rcu/srcu.o

    Size of arch/powerpc/boot/zImage changes from

    text data bss dec hex filename
    831552 64180 23944 919676 e087c arch/powerpc/boot/zImage : before
    829504 64180 23952 917636 e0084 arch/powerpc/boot/zImage : after

    so the savings are about ~2000 bytes.

    Signed-off-by: Pranith Kumar
    CC: Paul E. McKenney
    CC: Josh Triplett
    CC: Lai Jiangshan
    Signed-off-by: Paul E. McKenney
    [ paulmck: resolve conflict due to removal of arch/ia64/kvm/Kconfig. ]

    Pranith Kumar
     

30 Oct, 2014

1 commit

24 Feb, 2014

1 commit

  • 51b1130eb   rcutorture: Abstract rcu_torture_random() ... Browse Code »

    Because rcu_torture_random() will be used by the locking equivalent to
    rcutorture, pull it out into its own module. This new module cannot
    be separately configured, instead, use the Kconfig "select" statement
    from the Kconfig options of tests depending on it.

    Suggested-by: Rusty Russell
    Signed-off-by: Paul E. McKenney

    Paul E. McKenney
     

16 Oct, 2013

1 commit