linux-kernel - new arch-independent tracepoints on hardware entry/exit from interrupt ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <a2e9ee60-e206-3775-62db-c05dc046b15e@gliwa.com>
Date:   Mon, 29 Oct 2018 08:58:50 +0100
From:   Claudio <claudio.fontana@...wa.com>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     linux-kernel@...r.kernel.org, Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>
Subject: new arch-independent tracepoints on hardware entry/exit from
 interrupt ?

Hello,

I am currently facing the requirements to trace OS events close to hardware entry and exit from
interrupt.

There are currently arch-independent events defined for entry/exit from irq handlers as
registered in Linux (irq_handler_entry, irq_handler_exit),

However that is of course a different view compared with the entry and exit to/from the kernel from a hardware perspective.

While playing around with the idea, I experimented with the idea of having two new events:

name: hw_irq_entry
ID: 93
format:
	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
	field:unsigned char common_preempt_count;	offset:3;	size:1;signed:0;
	field:int common_pid;	offset:4;	size:4;	signed:1;

	field:irq_hw_number_t hw_irq;	offset:8;	size:8;	signed:0;

print fmt: "hw_irq=%lu", REC->hw_irq

name: hw_irq_exit
ID: 92
format:
	field:unsigned short common_type;	offset:0;	size:2;	signed:0;
	field:unsigned char common_flags;	offset:2;	size:1;	signed:0;
	field:unsigned char common_preempt_count;	offset:3;	size:1;signed:0;
	field:int common_pid;	offset:4;	size:4;	signed:1;

	field:irq_hw_number_t hw_irq;	offset:8;	size:8;	signed:0;

print fmt: "hw_irq=%lu", REC->hw_irq

With the intention to report on any architecture the specific number meaningful for that architecture.

I noticed that on x86 we have a specific separate events for irq_vectors,
apparently introduced by commit cf910e83ae23 ("x86, trace: Add irq vector tracepoints")

but I wonder if a more general solution could be implemented to cover meaningfully all architectures,
without having the tools having to special case all possible architectures and also special case all possible events generated as a consequence of irq entry.

The use case here is about timing analysis for the automotive domain, the current architectures we are looking at are x86 and arm64.

Thank you for your thoughts on this,

Claudio