October 8, 2026 | Prague, Czechia View More Details & Registration | Note: The schedule is subject to change. You must be registered for Linux Security Summit Europe 2026 to participate in the sessions. Please visit the event registration page to purchase a ticket.
Sign up or log in to add sessions to your schedule and sync them to your phone or calendar.
There is no practical tool that maps userspace programs to the kernel code they exercise. strace shows syscall names but not kernel internals. KCOV requires kernel recompilation. perf is general-purpose and not designed for per-program kernel coverage.
vock fills this gap. It takes any userspace program and outputs the exact kernel functions and branches that program reaches.
Two modes:
(1) HW mode uses Intel PT or AMD LBR via perf_event_open() — works on any generic kernel without kcov. The PT decoder walks TNT bits against vmlinux to reconstruct full branch-level coverage.
(2) KCOV mode uses kernel instrumentation with per-process tracking across fork() and pthread_create().
Use cases: measure kernel vulnerability exposure per application, identify which kernel subsystems need hardening for a given workload, and narrow down the syscall space for targeted fuzzing — instead of fuzzing all 300+ syscalls, fuzz only the paths the target program actually reaches.
