[PATCH 0/5] kcov: suppress timer and scheduler coverage leaks

0 views
Skip to first unread message

Karl Mehltretter

unread,
Aug 7, 2026, 4:50:45 PM (2 days ago) Aug 7
to Andrew Morton, Andrey Konovalov, Dmitry Vyukov, Alexander Potapenko, Marco Elver, Bradley Morgan, Thomas Gleixner, Anna-Maria Behnsen, Frederic Weisbecker, Peter Zijlstra, Ingo Molnar, Juri Lelli, Vincent Guittot, Steven Rostedt, Sebastian Andrzej Siewior, Clark Williams, linux-r...@lists.linux.dev, kasa...@googlegroups.com, linux-...@vger.kernel.org
KCOV excludes interrupt and scheduler coverage so syscall coverage stays
input-dependent. Instrumented callees can still record when uninstrumented
timer and scheduler paths run with in_task() true.

CONFIG_KCOV_SELFTEST [1] exposes three cases on x86-64: deferred
hrtimer rearm, __schedule() callees and PREEMPT_RT wakeups. Task-context
wakeups and new-task enqueue also add scheduler coverage to ordinary
syscalls.

Add a nestable KCOV_PAUSED bit. Use it around deferred hrtimer rearm,
__schedule(), try_to_wake_up() and wake_up_new_task(). This keeps coverage
from their instrumented callees without excluding those callees from real
task-context coverage.

Testing:

- GCC builds across x86-64, arm32, arm64, MIPS32, PowerPC 32/64,
s390, RISC-V 32/64, LoongArch, Xtensa and UML
- x86-64 Clang and KCOV-disabled builds
- KCOV selftest, 10/10 x86-64 boots with and without PREEMPT_RT
- KCOV selftest, 3/3 RISC-V 32/64, LoongArch and s390 boots after
isolating unrelated architecture entry leaks
- 40 dummy_hcd/g_zero remote-KCOV cycles on x86-64 and arm64
- 400 repeated fork calls on x86-64 PREEMPT_RT
- syzkaller: five one-hour A/B pairs on four 2-vCPU PREEMPT_RT VMs.
At ~110k executions, the five-run median was 4,142 vs. 3,216
corpus entries (+28.8%) and 54,872 vs. 50,940 coverage (+7.7%).
No unsuppressed reports

The USB runs no longer contained the baseline PCs from deferred rearm,
hrtick and scheduler wakeup callees. The fork run no longer contained the
baseline __smp_call_single_queue(), generic_exec_single() or
smp_call_function_single_async() PCs.

With KCOV disabled, the pause calls compile away. With KCOV enabled on
x86-64, __schedule() grows by 117 bytes across patches 2 and 3,
try_to_wake_up() by 106 bytes and wake_up_new_task() by 88 bytes.

[1] https://lore.kernel.org/r/20260724192122.73...@gmail.com/

Karl Mehltretter (5):
kcov: add kcov_pause()/kcov_resume() helpers
hrtimer: pause KCOV during deferred rearm
sched: pause KCOV in __schedule()
sched: pause KCOV in try_to_wake_up()
sched: pause KCOV in wake_up_new_task()

include/linux/hrtimer_rearm.h | 18 ++++++++++++++++--
include/linux/kcov.h | 25 ++++++++++++++++++++++++-
kernel/kcov.c | 2 +-
kernel/sched/core.c | 15 ++++++++++++++-
4 files changed, 55 insertions(+), 5 deletions(-)

base-commit: 8ba098e6b6ff0db8edf28528d1552be261af30d4

Karl Mehltretter

unread,
Aug 7, 2026, 4:50:47 PM (2 days ago) Aug 7
to Andrew Morton, Karl Mehltretter, Andrey Konovalov, Dmitry Vyukov, Alexander Potapenko, Marco Elver, Bradley Morgan, kasa...@googlegroups.com, linux-...@vger.kernel.org
Interrupt-return work can run after HARDIRQ_OFFSET is dropped, when
in_task() is true. KCOV then attributes instrumented callees to the
interrupted task.

Add a KCOV_PAUSED bit next to KCOV_IN_CTXSW and mask both in
kcov_mode_enabled(). The context switch suppression keeps its own bit:
kcov_prepare_switch() runs on the previous task and kcov_finish_switch()
on the one switched in, so its lifetime is not a pause section.

Sections nest by passing the state returned by kcov_pause() to
kcov_resume(). Both operate on current. When task KCOV is active, remote
softirq sections save and restore the complete mode, preserving the
pause state.

The helpers are __always_inline, and the caller must be uninstrumented:
inlining does not remove the caller's own coverage callbacks.

Assisted-by: Claude:claude-opus-4-8
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehlt...@gmail.com>
---
include/linux/kcov.h | 25 ++++++++++++++++++++++++-
kernel/kcov.c | 2 +-
2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/include/linux/kcov.h b/include/linux/kcov.h
index 895b761b2db1..5a0a1a9bb7ef 100644
--- a/include/linux/kcov.h
+++ b/include/linux/kcov.h
@@ -2,6 +2,7 @@
#ifndef _LINUX_KCOV_H
#define _LINUX_KCOV_H

+#include <linux/bits.h>
#include <linux/sched.h>
#include <uapi/linux/kcov.h>

@@ -23,7 +24,8 @@ enum kcov_mode {
KCOV_MODE_TRACE_CMP = 3,
};

-#define KCOV_IN_CTXSW (1 << 30)
+#define KCOV_IN_CTXSW BIT(30)
+#define KCOV_PAUSED BIT(29)

void kcov_task_init(struct task_struct *t);
void kcov_task_exit(struct task_struct *t);
@@ -38,6 +40,25 @@ do { \
(t)->kcov_mode &= ~KCOV_IN_CTXSW; \
} while (0)

+/*
+ * Pause coverage for current. Pass the returned state to kcov_resume().
+ * Callers must be uninstrumented.
+ */
+static __always_inline unsigned int kcov_pause(struct task_struct *t)
+{
+ unsigned int paused;
+
+ paused = t->kcov_mode & KCOV_PAUSED;
+ t->kcov_mode |= KCOV_PAUSED;
+ return paused;
+}
+
+static __always_inline void kcov_resume(struct task_struct *t, unsigned int paused)
+{
+ if (!paused)
+ t->kcov_mode &= ~KCOV_PAUSED;
+}
+
/* See Documentation/dev-tools/kcov.rst for usage details. */
void kcov_remote_start(u64 handle);
void kcov_remote_stop(void);
@@ -93,6 +114,8 @@ void __sanitizer_cov_trace_switch(kcov_u64 val, void *cases);

static inline void kcov_task_init(struct task_struct *t) {}
static inline void kcov_task_exit(struct task_struct *t) {}
+static inline unsigned int kcov_pause(struct task_struct *t) { return 0; }
+static inline void kcov_resume(struct task_struct *t, unsigned int paused) {}
static inline void kcov_prepare_switch(struct task_struct *t) {}
static inline void kcov_finish_switch(struct task_struct *t) {}
static inline void kcov_remote_start(u64 handle) {}
diff --git a/kernel/kcov.c b/kernel/kcov.c
index 1df373fb562b..83d53e383822 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -830,7 +830,7 @@ static const struct file_operations kcov_fops = {

static inline bool kcov_mode_enabled(unsigned int mode)
{
- return (mode & ~KCOV_IN_CTXSW) != KCOV_MODE_DISABLED;
+ return (mode & ~(KCOV_IN_CTXSW | KCOV_PAUSED)) != KCOV_MODE_DISABLED;
}

static void kcov_remote_softirq_start(struct task_struct *t)
--
2.53.0

Karl Mehltretter

unread,
Aug 7, 2026, 4:50:50 PM (2 days ago) Aug 7
to Andrew Morton, Karl Mehltretter, Andrey Konovalov, Dmitry Vyukov, Alexander Potapenko, Marco Elver, Bradley Morgan, kasa...@googlegroups.com, linux-...@vger.kernel.org, Thomas Gleixner, Anna-Maria Behnsen, Frederic Weisbecker, Peter Zijlstra, Ingo Molnar, Juri Lelli, Vincent Guittot
Deferred hrtimer rearm can run after HARDIRQ_OFFSET is dropped. in_task()
is then true, so KCOV attributes the instrumented timer-reprogramming
subtree to current.

With CONFIG_KCOV_SELFTEST, the interrupt selftest fails on x86_64
defconfig under QEMU, detecting spurious coverage in
__hrtimer_rearm_deferred(). The same happens on s390, RISC-V and
LoongArch, which also enable HRTIMER_REARM_DEFERRED.

Excluding the involved files instead would cost their coverage on real
task-context paths, e.g. the hrtimer and timekeeping syscalls.

Pause in the __always_inline wrappers, including hrtick_schedule_exit().
Call sites where task KCOV can be active are KCOV-disabled or noinstr.
HAVE_NOINSTR_HACK covers pre-GCC-12 x86. The other affected
architectures restrict KCOV to GCC 12 or Clang through
ARCH_WANTS_NO_INSTR. This avoids relying on __no_sanitize_coverage,
which is empty before GCC 12. Tested with GCC 8.1 and 15 on x86_64.

Fixes: 15dd3a948855 ("hrtimer: Push reprogramming timers into the interrupt return path")
Assisted-by: Claude:claude-opus-4-8
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehlt...@gmail.com>
---
include/linux/hrtimer_rearm.h | 18 ++++++++++++++++--
kernel/sched/core.c | 2 +-
2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/include/linux/hrtimer_rearm.h b/include/linux/hrtimer_rearm.h
index a6f2e5d5e1c7..b95687529c2e 100644
--- a/include/linux/hrtimer_rearm.h
+++ b/include/linux/hrtimer_rearm.h
@@ -3,10 +3,23 @@
#define _LINUX_HRTIMER_REARM_H

#ifdef CONFIG_HRTIMER_REARM_DEFERRED
+#include <linux/kcov.h>
#include <linux/thread_info.h>

void __hrtimer_rearm_deferred(void);

+/*
+ * Pause outside __hrtimer_rearm_deferred() to suppress its entry coverage.
+ * Call sites where task KCOV can be active are uninstrumented.
+ */
+static __always_inline void hrtimer_rearm_deferred_paused(void)
+{
+ unsigned int kcov_paused = kcov_pause(current);
+
+ __hrtimer_rearm_deferred();
+ kcov_resume(current, kcov_paused);
+}
+
/*
* This is purely CPU local, so check the TIF bit first to avoid the overhead of
* the atomic test_and_clear_bit() operation for the common case where the bit
@@ -38,7 +51,7 @@ hrtimer_rearm_deferred_user_irq(unsigned long *tif_work, const unsigned long tif
*/
if (unlikely((*tif_work & TIF_REARM_MASK) == _TIF_HRTIMER_REARM)) {
clear_thread_flag(TIF_HRTIMER_REARM);
- __hrtimer_rearm_deferred();
+ hrtimer_rearm_deferred_paused();
/* Don't go into the loop if HRTIMER_REARM was the only flag */
*tif_work &= ~TIF_HRTIMER_REARM;
return !*tif_work;
@@ -50,7 +63,7 @@ hrtimer_rearm_deferred_user_irq(unsigned long *tif_work, const unsigned long tif
static __always_inline void hrtimer_rearm_deferred_tif(unsigned long tif_work)
{
if (hrtimer_test_and_clear_rearm_deferred_tif(tif_work))
- __hrtimer_rearm_deferred();
+ hrtimer_rearm_deferred_paused();
}

/*
@@ -73,6 +86,7 @@ static __always_inline bool hrtimer_test_and_clear_rearm_deferred(void)

#else /* CONFIG_HRTIMER_REARM_DEFERRED */
static __always_inline void __hrtimer_rearm_deferred(void) { }
+static __always_inline void hrtimer_rearm_deferred_paused(void) { }
static __always_inline void hrtimer_rearm_deferred(void) { }
static __always_inline void hrtimer_rearm_deferred_tif(unsigned long tif_work) { }
static __always_inline bool
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 96226707c2f6..b6a8fbbdd538 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -1010,7 +1010,7 @@ static inline void hrtick_schedule_exit(struct rq *rq)
}

if (rq->hrtick_sched & HRTICK_SCHED_REARM_HRTIMER)
- __hrtimer_rearm_deferred();
+ hrtimer_rearm_deferred_paused();

rq->hrtick_sched = HRTICK_SCHED_NONE;
}
--
2.53.0

Karl Mehltretter

unread,
Aug 7, 2026, 4:50:52 PM (2 days ago) Aug 7
to Andrew Morton, Karl Mehltretter, Andrey Konovalov, Dmitry Vyukov, Alexander Potapenko, Marco Elver, Bradley Morgan, kasa...@googlegroups.com, linux-...@vger.kernel.org, Peter Zijlstra, Ingo Molnar, Juri Lelli, Vincent Guittot
kernel/sched/ is not instrumented, but callees such as sched_clock(),
architecture CPU-capacity helpers and profile_hits() are.

During preemption and schedule() calls, instrumented callees can add
nondeterministic scheduler coverage to current.

With CONFIG_KCOV_SELFTEST, the interrupt selftest fails on x86_64
defconfig under QEMU, detecting spurious coverage in
arch_scale_cpu_capacity(). On arm64 the same class of leak appears in
sched_clock(), once the separate arm64 interrupt-accounting leak is
suppressed.

Annotating each callee would spread exclusions across architectures.
Pause across __schedule() instead, extending the scheduler exclusion to
its callees.

KCOV_PAUSED remains set while a task is switched out. Its resumed
__schedule() frame restores the prior state.

Fixes: 5c9a8750a640 ("kernel: add kcov code coverage")
Assisted-by: Claude:claude-opus-4-8
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehlt...@gmail.com>
---
kernel/sched/core.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index b6a8fbbdd538..d5663df6c702 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -7069,10 +7069,14 @@ static void __sched notrace __schedule(int sched_mode)
bool is_switch = false;
unsigned long *switch_count;
unsigned long prev_state;
+ unsigned int kcov_paused;
struct rq_flags rf;
struct rq *rq;
int cpu;

+ /* KCOV: sched/ is uninstrumented but the __schedule() callees are not. */
+ kcov_paused = kcov_pause(current);
+
/* Trace preemptions consistently with task switches */
trace_sched_entry_tp(sched_mode == SM_PREEMPT);

@@ -7239,6 +7243,7 @@ static void __sched notrace __schedule(int sched_mode)
raw_spin_rq_unlock_irq(rq);
}
trace_sched_exit_tp(is_switch);
+ kcov_resume(current, kcov_paused);
}

void __noreturn do_task_dead(void)
--
2.53.0

Karl Mehltretter

unread,
Aug 7, 2026, 4:50:54 PM (2 days ago) Aug 7
to Andrew Morton, Karl Mehltretter, Andrey Konovalov, Dmitry Vyukov, Alexander Potapenko, Marco Elver, Bradley Morgan, kasa...@googlegroups.com, linux-...@vger.kernel.org, Peter Zijlstra, Ingo Molnar, Juri Lelli, Vincent Guittot, Steven Rostedt, Sebastian Andrzej Siewior, Clark Williams, linux-r...@lists.linux.dev
try_to_wake_up() is uninstrumented, but it calls instrumented helpers
such as kthread_is_per_cpu(), CPU capacity helpers and SCHED_HRTICK
arming. They can record into current while in_task() is true.

CONFIG_KCOV_SELFTEST exposes this under PREEMPT_RT. The interrupt
selftest fails on x86_64 in kthread_is_per_cpu(): RT runs the timer
softirq in a thread, so the wakeup runs in task context during the
selftest's spin. The same helpers leak into non-RT syscall wakeups such
as a pipe write waking a reader.

Pause all of try_to_wake_up(). Wrapping only select_task_rq() would miss
SCHED_HRTICK arming during enqueue.

Fixes: 5c9a8750a640 ("kernel: add kcov code coverage")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Karl Mehltretter <kmehlt...@gmail.com>
---
kernel/sched/core.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index d5663df6c702..1e562a7ff0af 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4252,6 +4252,8 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
{
guard(preempt)();
int cpu, success = 0;
+ /* KCOV: sched/ is uninstrumented but the wakeup callees are not. */
+ unsigned int kcov_paused = kcov_pause(current);

wake_flags |= WF_TTWU;

@@ -4418,6 +4420,7 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
if (success)
ttwu_stat(p, task_cpu(p), wake_flags);

+ kcov_resume(current, kcov_paused);
return success;
}

--
2.53.0

Karl Mehltretter

unread,
Aug 7, 2026, 4:50:58 PM (2 days ago) Aug 7
to Andrew Morton, Karl Mehltretter, Andrey Konovalov, Dmitry Vyukov, Alexander Potapenko, Marco Elver, Bradley Morgan, kasa...@googlegroups.com, linux-...@vger.kernel.org, Peter Zijlstra, Ingo Molnar, Juri Lelli, Vincent Guittot
wake_up_new_task() is uninstrumented, but CPU selection and enqueue call
instrumented helpers. During a KCOV-enabled fork, they can record
scheduler, hrtimer and clockevent coverage into the parent.

The paths depend on runqueue and CPU state, so coverage varies between
identical forks. Pause KCOV for the whole function, extending the
scheduler exclusion to new-task wakeups.

Fixes: 5c9a8750a640 ("kernel: add kcov code coverage")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Karl Mehltretter <kmehlt...@gmail.com>
---
kernel/sched/core.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 1e562a7ff0afb..cad1b01063450 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4945,8 +4945,12 @@ void wake_up_new_task(struct task_struct *p)
{
struct rq_flags rf;
struct rq *rq;
+ unsigned int kcov_paused;
int wake_flags = WF_FORK;

+ /* KCOV: sched/ is uninstrumented but the wakeup callees are not. */
+ kcov_paused = kcov_pause(current);
+
raw_spin_lock_irqsave(&p->pi_lock, rf.flags);
WRITE_ONCE(p->__state, TASK_RUNNING);
/*
@@ -4976,6 +4980,7 @@ void wake_up_new_task(struct task_struct *p)
rq_repin_lock(rq, &rf);
}
task_rq_unlock(rq, p, &rf);
+ kcov_resume(current, kcov_paused);
}

#ifdef CONFIG_PREEMPT_NOTIFIERS
--
2.53.0

Bradley Morgan

unread,
Aug 7, 2026, 9:16:43 PM (2 days ago) Aug 7
to Karl Mehltretter, Andrew Morton, Andrey Konovalov, Dmitry Vyukov, Alexander Potapenko, Marco Elver, kasa...@googlegroups.com, linux-...@vger.kernel.org
On 7 August 2026 21:50:23 BST, Karl Mehltretter <kmehlt...@gmail.com>
wrote:
>Interrupt-return work can run after HARDIRQ_OFFSET is dropped, when
>in_task() is true. KCOV then attributes instrumented callees to the
>interrupted task.
>
>Add a KCOV_PAUSED bit next to KCOV_IN_CTXSW and mask both in
>kcov_mode_enabled(). The context switch suppression keeps its own bit:
>kcov_prepare_switch() runs on the previous task and kcov_finish_switch()
>on the one switched in, so its lifetime is not a pause section.
>
>Sections nest by passing the state returned by kcov_pause() to
>kcov_resume(). Both operate on current. When task KCOV is active, remote
>softirq sections save and restore the complete mode, preserving the
>pause state.
>
>The helpers are __always_inline, and the caller must be uninstrumented:
>inlining does not remove the caller's own coverage callbacks.
>

Hmm. Okay!

Reviewed-by: Bradley Morgan <inc...@grrlz.net>


I don't see anything wrong with it, LGTM, thanks for the patch
Thanks!

Bradley Morgan

unread,
Aug 7, 2026, 9:19:24 PM (2 days ago) Aug 7
to Karl Mehltretter, Andrew Morton, Andrey Konovalov, Dmitry Vyukov, Alexander Potapenko, Marco Elver, kasa...@googlegroups.com, linux-...@vger.kernel.org, Thomas Gleixner, Anna-Maria Behnsen, Frederic Weisbecker, Peter Zijlstra, Ingo Molnar, Juri Lelli, Vincent Guittot
On 7 August 2026 21:50:24 BST, Karl Mehltretter <kmehlt...@gmail.com>
wrote:
I see. Okay.

Reviewed-by: Bradley Morgan <inc...@grrlz.net>

LGTM
Thanks!

Bradley Morgan

unread,
Aug 7, 2026, 9:21:23 PM (2 days ago) Aug 7
to Karl Mehltretter, Andrew Morton, Andrey Konovalov, Dmitry Vyukov, Alexander Potapenko, Marco Elver, kasa...@googlegroups.com, linux-...@vger.kernel.org, Peter Zijlstra, Ingo Molnar, Juri Lelli, Vincent Guittot
On 7 August 2026 21:50:25 BST, Karl Mehltretter <kmehlt...@gmail.com>
wrote:
>kernel/sched/ is not instrumented, but callees such as sched_clock(),
>architecture CPU-capacity helpers and profile_hits() are.
>
>During preemption and schedule() calls, instrumented callees can add
>nondeterministic scheduler coverage to current.
>
>With CONFIG_KCOV_SELFTEST, the interrupt selftest fails on x86_64
>defconfig under QEMU, detecting spurious coverage in
>arch_scale_cpu_capacity(). On arm64 the same class of leak appears in
>sched_clock(), once the separate arm64 interrupt-accounting leak is
>suppressed.
>
>Annotating each callee would spread exclusions across architectures.
>Pause across __schedule() instead, extending the scheduler exclusion to
>its callees.
>
>KCOV_PAUSED remains set while a task is switched out. Its resumed
>__schedule() frame restores the prior state.
>
>Fixes: 5c9a8750a640 ("kernel: add kcov code coverage")
>Assisted-by: Claude:claude-opus-4-8
>Assisted-by: Claude:claude-fable-5

Awesomesauce!

Reviewed-by: Bradley Morgan <inc...@grrlz.net>

well, no idea how one patch could be assisted by two AI models, but I
could see some sort of Frankenstein scenario, maybe fable planning opus
implementation?, tbh idc because this patch is good anyway, thanks Karl.
Thanks!

Bradley Morgan

unread,
Aug 7, 2026, 9:28:42 PM (2 days ago) Aug 7
to Karl Mehltretter, Andrew Morton, Andrey Konovalov, Dmitry Vyukov, Alexander Potapenko, Marco Elver, kasa...@googlegroups.com, linux-...@vger.kernel.org, Peter Zijlstra, Ingo Molnar, Juri Lelli, Vincent Guittot, Steven Rostedt, Sebastian Andrzej Siewior, Clark Williams, linux-r...@lists.linux.dev
On 7 August 2026 21:50:26 BST, Karl Mehltretter <kmehlt...@gmail.com>
wrote:
>try_to_wake_up() is uninstrumented, but it calls instrumented helpers
>such as kthread_is_per_cpu(), CPU capacity helpers and SCHED_HRTICK
>arming. They can record into current while in_task() is true.
>
>CONFIG_KCOV_SELFTEST exposes this under PREEMPT_RT. The interrupt
>selftest fails on x86_64 in kthread_is_per_cpu(): RT runs the timer
>softirq in a thread, so the wakeup runs in task context during the
>selftest's spin. The same helpers leak into non-RT syscall wakeups such
>as a pipe write waking a reader.
>
>Pause all of try_to_wake_up(). Wrapping only select_task_rq() would miss
>SCHED_HRTICK arming during enqueue.
>
>Fixes: 5c9a8750a640 ("kernel: add kcov code coverage")
>Assisted-by: Claude:claude-opus-4-8
>Signed-off-by: Karl Mehltretter <kmehlt...@gmail.com>

I don't mind.

Reviewed-by: Bradley Morgan <inc...@grrlz.net>

I saw sashikos "kind" reply, this isn't a bug, but a scoped guard,
could be built.

considering it would future proof against somebody adding a early return
later.


but tbh that's more a patch 1 decision to make.


>---
> kernel/sched/core.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/kernel/sched/core.c b/kernel/sched/core.c
>index d5663df6c702..1e562a7ff0af 100644
>--- a/kernel/sched/core.c
>+++ b/kernel/sched/core.c
>@@ -4252,6 +4252,8 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
> {
> guard(preempt)();
> int cpu, success = 0;
>+ /* KCOV: sched/ is uninstrumented but the wakeup callees are not. */
>+ unsigned int kcov_paused = kcov_pause(current);
>
> wake_flags |= WF_TTWU;
>
>@@ -4418,6 +4420,7 @@ int try_to_wake_up(struct task_struct *p, unsigned int state, int wake_flags)
> if (success)
> ttwu_stat(p, task_cpu(p), wake_flags);
>
>+ kcov_resume(current, kcov_paused);
> return success;
> }
>
>

Thanks!

Bradley Morgan

unread,
Aug 7, 2026, 9:36:15 PM (2 days ago) Aug 7
to Karl Mehltretter, Andrew Morton, Andrey Konovalov, Dmitry Vyukov, Alexander Potapenko, Marco Elver, kasa...@googlegroups.com, linux-...@vger.kernel.org, Peter Zijlstra, Ingo Molnar, Juri Lelli, Vincent Guittot
On 7 August 2026 21:50:27 BST, Karl Mehltretter <kmehlt...@gmail.com>
wrote:
>wake_up_new_task() is uninstrumented, but CPU selection and enqueue call
>instrumented helpers. During a KCOV-enabled fork, they can record
>scheduler, hrtimer and clockevent coverage into the parent.
>
>The paths depend on runqueue and CPU state, so coverage varies between
>identical forks. Pause KCOV for the whole function, extending the
>scheduler exclusion to new-task wakeups.
>
>Fixes: 5c9a8750a640 ("kernel: add kcov code coverage")
>Assisted-by: Claude:claude-opus-4-8
>Signed-off-by: Karl Mehltretter <kmehlt...@gmail.com>

Reviewed-by: Bradley Morgan <inc...@grrlz.net>


>---
> kernel/sched/core.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
>diff --git a/kernel/sched/core.c b/kernel/sched/core.c
>index 1e562a7ff0afb..cad1b01063450 100644
>--- a/kernel/sched/core.c
>+++ b/kernel/sched/core.c
>@@ -4945,8 +4945,12 @@ void wake_up_new_task(struct task_struct *p)
> {
> struct rq_flags rf;
> struct rq *rq;
>+ unsigned int kcov_paused;
> int wake_flags = WF_FORK;
>
>+ /* KCOV: sched/ is uninstrumented but the wakeup callees are not. */

I feel this comment is not the best. I mean, it's more a opinion thing.

/* Instrumented callees would leak into current here... */

could be a good one. What do you think? :)


>+ kcov_paused = kcov_pause(current);
>+
> raw_spin_lock_irqsave(&p->pi_lock, rf.flags);
> WRITE_ONCE(p->__state, TASK_RUNNING);
> /*
>@@ -4976,6 +4980,7 @@ void wake_up_new_task(struct task_struct *p)
> rq_repin_lock(rq, &rf);
> }
> task_rq_unlock(rq, p, &rf);
>+ kcov_resume(current, kcov_paused);
> }
>
> #ifdef CONFIG_PREEMPT_NOTIFIERS
>

Thanks!

Peter Zijlstra

unread,
Aug 8, 2026, 4:44:40 AM (yesterday) Aug 8
to Karl Mehltretter, Andrew Morton, Andrey Konovalov, Dmitry Vyukov, Alexander Potapenko, Marco Elver, Bradley Morgan, Thomas Gleixner, Anna-Maria Behnsen, Frederic Weisbecker, Ingo Molnar, Juri Lelli, Vincent Guittot, Steven Rostedt, Sebastian Andrzej Siewior, Clark Williams, linux-r...@lists.linux.dev, kasa...@googlegroups.com, linux-...@vger.kernel.org
On Fri, Aug 07, 2026 at 10:50:22PM +0200, Karl Mehltretter wrote:

> Karl Mehltretter (5):
> kcov: add kcov_pause()/kcov_resume() helpers
> hrtimer: pause KCOV during deferred rearm
> sched: pause KCOV in __schedule()
> sched: pause KCOV in try_to_wake_up()
> sched: pause KCOV in wake_up_new_task()
>
> include/linux/hrtimer_rearm.h | 18 ++++++++++++++++--
> include/linux/kcov.h | 25 ++++++++++++++++++++++++-
> kernel/kcov.c | 2 +-
> kernel/sched/core.c | 15 ++++++++++++++-
> 4 files changed, 55 insertions(+), 5 deletions(-)

You've send me a partial series; which is the same as not sending me
anything at all. If you want me to look at it, send the complete thing,
so I can evaluate the whole thing.
Reply all
Reply to author
Forward
0 new messages