linux-kernel - [PATCH RESEND] sched: Add core cookie update tracepoint

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251128093222.119435-1-sieberf@amazon.com>
Date: Fri, 28 Nov 2025 11:32:22 +0200
From: Fernand Sieber <sieberf@...zon.com>
To: <linux-kernel@...r.kernel.org>, <peterz@...radead.org>,
	<mingo@...hat.com>, <vincent.guittot@...aro.org>
CC: <linux-trace-kernel@...r.kernel.org>, <jschoenh@...zon.de>,
	<dwmw@...zon.co.uk>, <kprateek.nayak@....com>, <vineethr@...ux.ibm.com>
Subject: [PATCH RESEND] sched: Add core cookie update tracepoint

ftrace based analysis can be used to qualify correct behavior of cookie
based applications. Security posture can be verified by tracing the
amount of time that tasks with different cookies collocate on hyperthread
siblings and asserting that it is kept to a minimum. Performance posture
can be measured by minimizing force idle (when an hyperthread is kept
idle because it doesn't have a runnable task matching the cookie of its
sibling). It is necessary for the application doing such an analysis to
know the cookie associated with each task at any point in time.

While the task to cookie mapping is driven by userspace and thus can
alternatively be supplied through a custom side channel to an application
analysing a trace, it is more convenient and accurate if the mapping is
already part of the trace. Given that these events are infrequent the
induced overhead is negligible.

Signed-off-by: Fernand Sieber <sieberf@...zon.com>
Link: https://lore.kernel.org/r/20250128113410.263994-1-sieberf@amazon.com
---
 include/trace/events/sched.h | 30 ++++++++++++++++++++++++++++++
 kernel/sched/core_sched.c    |  1 +
 2 files changed, 31 insertions(+)

diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
index 7b2645b50e78..e3298eb0702c 100644
--- a/include/trace/events/sched.h
+++ b/include/trace/events/sched.h
@@ -826,6 +826,36 @@ TRACE_EVENT(sched_wake_idle_without_ipi,
 	TP_printk("cpu=%d", __entry->cpu)
 );
 
+#ifdef CONFIG_SCHED_CORE
+/*
+ * Tracepoint for assigning cookies.
+ */
+TRACE_EVENT(sched_setcookie,
+
+	TP_PROTO(struct task_struct *tsk, unsigned long cookie),
+
+	TP_ARGS(tsk, cookie),
+
+	TP_STRUCT__entry(
+		__array(char, comm, TASK_COMM_LEN)
+		__field(pid_t, pid)
+		__field(unsigned long, oldcookie)
+		__field(unsigned long, newcookie)
+	),
+
+	TP_fast_assign(
+		memcpy(__entry->comm, tsk->comm, TASK_COMM_LEN);
+		__entry->pid		= tsk->pid;
+		__entry->oldcookie      = tsk->core_cookie;
+		__entry->newcookie      = cookie;
+	),
+
+	TP_printk("comm=%s pid=%d oldcookie=%lx newcookie=%lx",
+			__entry->comm, __entry->pid,
+			__entry->oldcookie, __entry->newcookie)
+);
+#endif
+
 /*
  * Following tracepoints are not exported in tracefs and provide hooking
  * mechanisms only for testing and debugging purposes.
diff --git a/kernel/sched/core_sched.c b/kernel/sched/core_sched.c
index 9ede71ecba7f..26eb23331fea 100644
--- a/kernel/sched/core_sched.c
+++ b/kernel/sched/core_sched.c
@@ -73,6 +73,7 @@ static unsigned long sched_core_update_cookie(struct task_struct *p,
 		sched_core_dequeue(rq, p, DEQUEUE_SAVE);
 
 	old_cookie = p->core_cookie;
+	trace_sched_setcookie(p, cookie);
 	p->core_cookie = cookie;
 
 	/*
-- 
2.43.0



Amazon Development Centre (South Africa) (Proprietary) Limited
29 Gogosoa Street, Observatory, Cape Town, Western Cape, 7925, South Africa
Registration Number: 2004 / 034463 / 07