[PATCH RFC v3 10/12] kcov: log old value

From: Jann Horn

Date: Tue Sep 08 2026 - 13:34:38 EST


For manual analysis of traces, log the old value at the memory location as
part of the memory_access_record.

This is best-effort; in particular:

- the value may not be recorded if it has an unusual size
- the recorded value may not match the value observed by the instrumented
memory operation in cases where the value is modified concurrently

Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
---
include/uapi/linux/kcov.h | 2 ++
kernel/kcov.c | 20 ++++++++++++++++++++
2 files changed, 22 insertions(+)

diff --git a/include/uapi/linux/kcov.h b/include/uapi/linux/kcov.h
index 76822d1c119a..235f73e11d59 100644
--- a/include/uapi/linux/kcov.h
+++ b/include/uapi/linux/kcov.h
@@ -91,12 +91,14 @@ static inline __u64 kcov_remote_handle(__u64 subsys, __u64 inst)
#define MEMORY_ACCESS_RECORD_RMW 0x20
#define MEMORY_ACCESS_RECORD_ATOMIC 0x40
#define MEMORY_ACCESS_RECORD_FREE 0x80
+#define MEMORY_ACCESS_RECORD_VALUE 0x100 /* value field is valid */
struct memory_access_record {
__aligned_u64 ip_address_and_kcov_flags;
__aligned_u64 data_address;
__u32 size;
__u32 flags; /* MEMORY_ACCESS_RECORD_* */
__aligned_u64 time;
+ __aligned_u64 value;
} __attribute__((aligned(8)));

#endif /* _LINUX_KCOV_IOCTLS_H */
diff --git a/kernel/kcov.c b/kernel/kcov.c
index 88aedaf41a9e..ef405940a2cb 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -1267,6 +1267,26 @@ void notrace __kcov_handle_memaccess(const volatile void *p, size_t size, unsign
.flags = type,
.time = kcov_get_time()
};
+
+ switch (size) {
+ case 1:
+ __get_kernel_nofault((u8 *)&record->value, p, u8, handle_fault);
+ record->flags |= MEMORY_ACCESS_RECORD_VALUE;
+ break;
+ case 2:
+ __get_kernel_nofault((u16 *)&record->value, p, u16, handle_fault);
+ record->flags |= MEMORY_ACCESS_RECORD_VALUE;
+ break;
+ case 4:
+ __get_kernel_nofault((u32 *)&record->value, p, u32, handle_fault);
+ record->flags |= MEMORY_ACCESS_RECORD_VALUE;
+ break;
+ case 8:
+ __get_kernel_nofault((u64 *)&record->value, p, u64, handle_fault);
+ record->flags |= MEMORY_ACCESS_RECORD_VALUE;
+ break;
+ }
+handle_fault:;
}

void notrace _kcov_handle_memaccess(const volatile void *p, size_t size, unsigned int type)

--
2.55.0.979.g7e5102b832-goog