[PATCH 0/5] kcov: suppress timer and scheduler coverage leaks

[Karl Mehltretter]

KCOV excludes interrupt and scheduler coverage so syscall coverage stays
input-dependent. Instrumented callees can still record when uninstrumented
timer and scheduler paths run with in_task() true.

CONFIG_KCOV_SELFTEST [1] exposes three cases on x86-64: deferred
hrtimer rearm, __schedule() callees and PREEMPT_RT wakeups. Task-context
wakeups and new-task enqueue also add scheduler coverage to ordinary
syscalls.

Add a nestable KCOV_PAUSED bit. Use it around deferred hrtimer rearm,
__schedule(), try_to_wake_up() and wake_up_new_task(). This keeps coverage
from their instrumented callees without excluding those callees from real
task-context coverage.

Testing:

  - GCC builds across x86-64, arm32, arm64, MIPS32, PowerPC 32/64,
    s390, RISC-V 32/64, LoongArch, Xtensa and UML
  - x86-64 Clang and KCOV-disabled builds
  - KCOV selftest, 10/10 x86-64 boots with and without PREEMPT_RT
  - KCOV selftest, 3/3 RISC-V 32/64, LoongArch and s390 boots after
    isolating unrelated architecture entry leaks
  - 40 dummy_hcd/g_zero remote-KCOV cycles on x86-64 and arm64
  - 400 repeated fork calls on x86-64 PREEMPT_RT
  - syzkaller: five one-hour A/B pairs on four 2-vCPU PREEMPT_RT VMs.
    At ~110k executions, the five-run median was 4,142 vs. 3,216
    corpus entries (+28.8%) and 54,872 vs. 50,940 coverage (+7.7%).
    No unsuppressed reports

The USB runs no longer contained the baseline PCs from deferred rearm,
hrtick and scheduler wakeup callees. The fork run no longer contained the
baseline __smp_call_single_queue(), generic_exec_single() or
smp_call_function_single_async() PCs.

With KCOV disabled, the pause calls compile away. With KCOV enabled on
x86-64, __schedule() grows by 117 bytes across patches 2 and 3,
try_to_wake_up() by 106 bytes and wake_up_new_task() by 88 bytes.

[1] https://lore.kernel.org/r/20260724192122.73080-1-kmehltretter@xxxxxxxxx/

Karl Mehltretter (5):
  kcov: add kcov_pause()/kcov_resume() helpers
  hrtimer: pause KCOV during deferred rearm
  sched: pause KCOV in __schedule()
  sched: pause KCOV in try_to_wake_up()
  sched: pause KCOV in wake_up_new_task()

 include/linux/hrtimer_rearm.h | 18 ++++++++++++++++--
 include/linux/kcov.h          | 25 ++++++++++++++++++++++++-
 kernel/kcov.c                 |  2 +-
 kernel/sched/core.c           | 15 ++++++++++++++-
 4 files changed, 55 insertions(+), 5 deletions(-)

base-commit: 8ba098e6b6ff0db8edf28528d1552be261af30d4