Re: [PATCH v2 06/11] kcov: x86: introduce CONFIG_KCOV_UNIQUE

[Alexander Potapenko]

On Fri, Jun 27, 2025 at 4:24 PM Alexander Potapenko <glider@xxxxxxxxxx> wrote:
>
> On Fri, Jun 27, 2025 at 10:11 AM Peter Zijlstra <peterz@xxxxxxxxxxxxx> wrote:
> >
> > On Thu, Jun 26, 2025 at 03:41:53PM +0200, Alexander Potapenko wrote:
> > > The new config switches coverage instrumentation to using
> > >   __sanitizer_cov_trace_pc_guard(u32 *guard)
> > > instead of
> > >   __sanitizer_cov_trace_pc(void)
> > >
> > > This relies on Clang's -fsanitize-coverage=trace-pc-guard flag [1].
> > >
> > > Each callback receives a unique 32-bit guard variable residing in the
> > > __sancov_guards section. Those guards can be used by kcov to deduplicate
> > > the coverage on the fly.
> >
> > This sounds like a *LOT* of data; how big is this for a typical kernel
> > build?
>
> I have a 1.6Gb sized vmlinux, which has a .text section of 176Mb.
> There are 1809419 calls to __sanitizer_cov_trace_pc_guard, and the
> __sancov_guards section has a size of 6Mb, which are only allocated at
> runtime.

Also note that most of this array will be containing zeroes.
The high coverage watermark across all syzbot instances is below 900K
coverage points: https://syzkaller.appspot.com/upstream
But that is coverage aggregated from multiple runs of the same kernel binary.
CONFIG_KCOV_UNIQUE will be only initializing the guards for the code
that was executed during a single run (<= 1 hour), and only when
coverage collection was enabled for the current process, so background
tasks won't be polluting them.

>
> If we take a vmlinux image from syzbot (e.g.
> https://storage.googleapis.com/syzbot-assets/dadedf20b2e3/vmlinux-67a99386.xz),
> its .text section is 166Mb, and there are 1893023 calls to
> __sanitizer_cov_trace_pc, which will translate to exactly the same
> number of __sanitizer_cov_trace_pc_guard, if we apply the unique
> coverage instrumentation.