[casaroli]

Summary

CONFIG_COVERAGE_ALL adds -fprofile-arcs -ftest-coverage (clang: -fprofile-instr-generate -fcoverage-mapping) to the compile options. A loadable module of a flat or protected build takes them too: in CMake through the targets of nuttx_add_application(), and in both build systems through crt0. The module then refers to __gcov_init(), __gcov_merge_add() and __gcov_exit(). The image has them, but the system symbol table does not export them, so no module loads:

libelf_symvalue: ERROR: SHN_UNDEF: Exported symbol "__gcov_init" not found
nsh: hello: command not found

Exporting the functions is not enough. __gcov_init() adds the gcov_info of the module to the list of the runtime, and the list keeps it after the module is unloaded, so the next dump or reset reads freed memory. What a module can get depends on the runtime:

• CONFIG_COVERAGE_MINI with GCC (libs/libbuiltin/libgcc/gcov.c): modules keep their coverage. __gcov_unload() removes from the list each gcov_info in the memory of a module, and libelf_uninit() calls it before it frees the module (dlclose(), rmmod(), the exit of an exec() program). A mutex protects the list. libc.csv exports __gcov_init, __gcov_merge_add, __gcov_exit, __gcov_fork, __gcov_dump and __gcov_reset.
• CONFIG_COVERAGE_TOOLCHAIN (libgcov), CONFIG_COVERAGE_COMPILER_RT and clang with CONFIG_COVERAGE_MINI: not changed here, as agreed in the review. libgcov keeps its functions hidden, has no call to remove one gcov_info, and the __gcov_exit() of a module would dump and unlink the data of the whole image; the clang runtimes find their data through the linker sections of the image. A module built with the coverage options still does not load with these runtimes; a later PR can handle them.

The unload does not dump the data of the module: the dump writes the data of all object files and can run in the context of an exiting task. To keep the data of a module, dump it while the module is loaded (gcov -d <path>, or __gcov_dump() in the module). The documentation commit describes both behaviours in Documentation/os/libs/libbuiltin.rst.

Impact

• CONFIG_COVERAGE_MINI with GCC and loadable modules: the modules load and have coverage data. struct module_s always keeps textsize and datasize (two size_t, before only with the module procfs).
• The other coverage runtimes: no change.
• No coverage, or a kernel build: no change. Without CONFIG_COVERAGE_MINI, __gcov_unload() is an empty macro.

Testing

qemu-armv8a:nsh (flat, Arm GNU 14.2, QEMU HVF) with CONFIG_COVERAGE_ALL, CONFIG_COVERAGE_MINI, CONFIG_ELF, CONFIG_LIBC_DLFCN, CONFIG_EXECFUNCS_SYSTEM_SYMTAB, CONFIG_MM_FILL_ALLOCATIONS (freed memory is overwritten) and CONFIG_NAME_MAX=255 (for the long .gcda names). hello and two test programs as instrumented modules from a 9p share; get_environ_ptr exported for the test as in #20807:

Step	Result
hello, gcovt (crt0.o has 9 gcov symbols, the modules refer to __gcov_init)	load and run
gcovt 9 0 dump (the module calls __gcov_dump())	863 .gcda files, with the one of gcovt
gcovt 11 3 &, then gcov -d while it sleeps	.gcda of gcovt; gcov on the host: the loop line ran 12 times, odd++ 5 times
25 x gcovt <n> + 25 x hello, then gcov -r -d	861 files, none of a module (their data is gone with them)
gcovdl 40: 40 x dlopen() / dlclose() of an instrumented libgcovso.so, __gcov_reset() after each dlclose(), __gcov_dump()	gcovdl: PASS
ostest	Exiting with status 0
The same test without the call in libelf_uninit()	the first dump after an unload never returns (it walks the freed gcov_info of hello)

The CMake build of the same configuration: crt0 has the 9 gcov symbols, gcovt loads 21 times and dumps its data.

qemu-armv8a:knsh (kernel build, HVF): ostest exits with status 0, as does ostest on the default qemu-armv8a:nsh. The programs of the export (init, sh, hello, ostest, getprime, dd) are byte-identical to master, except the commit and build-date string in sh and init.

This version (rebased on master d748a36), qemu-armv8a:nsh with CONFIG_COVERAGE_ALL, apps master, hello as a loadable module from a 9p share: CONFIG_COVERAGE_MINI with Make: hello and crt0 keep coverage, Hello, World!!; with CMake: the same symbols. CONFIG_COVERAGE_TOOLCHAIN: hello does not load, as on master.

tools/checkpatch.sh -c -u -m -g passes.

[github-actions]

MemBrowse Memory Report · Explore what changed →

s698pm-dkit

• Code: .text +16 B (+0.0%, 379,216 B)

No memory changes detected for:

• arduino-mega2560
• esp32-devkitc
• hifive1-revb
• mirtoo
• qemu-armv8a
• qemu-intel64
• rx65n-rsk2mb
• stm32-nucleo-f103rb

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}