linux-kernel - Re: [PATCH v3] drivers/perf: arm_spe: Fix consistency of SYS_PMSCR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <915cde39-7e3c-1a41-ca17-5953426fa0f3@arm.com>
Date:   Mon, 18 Jul 2022 09:55:32 +0530
From:   Anshuman Khandual <anshuman.khandual@....com>
To:     Suzuki K Poulose <suzuki.poulose@....com>,
        linux-arm-kernel@...ts.infradead.org
Cc:     german.gomez@....com, james.clark@....com,
        Will Deacon <will@...nel.org>,
        Mark Rutland <mark.rutland@....com>,
        Alexey Budankov <alexey.budankov@...ux.intel.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3] drivers/perf: arm_spe: Fix consistency of
 SYS_PMSCR_EL1.CX



On 7/14/22 16:40, Suzuki K Poulose wrote:
> On 14/07/2022 07:13, Anshuman Khandual wrote:
>> The arm_spe_pmu driver will enable SYS_PMSCR_EL1.CX in order to add CONTEXT
>> packets into the traces, if the owner of the perf event runs with required
>> capabilities i.e CAP_PERFMON or CAP_SYS_ADMIN via perfmon_capable() helper.
>>
>> The value of this bit is computed in the arm_spe_event_to_pmscr() function
>> but the check for capabilities happens in the pmu event init callback i.e
>> arm_spe_pmu_event_init(). This suggests that the value of the CX bit should
>> remain consistent for the duration of the perf session.
>>
>> However, the function arm_spe_event_to_pmscr() may be called later during
>> the event start callback i.e arm_spe_pmu_start() when the "current" process
>> is not the owner of the perf session, hence the CX bit setting is currently
>> not consistent.
>>
>> One way to fix this, is by caching the required value of the CX bit during
>> the initialization of the PMU event, so that it remains consistent for the
>> duration of the session. It uses currently unused 'event->hw.flags' element
>> to cache perfmon_capable() value, which can be referred during event start
>> callback to compute SYS_PMSCR_EL1.CX. This ensures consistent availability
>> of context packets in the trace as per event owner capabilities.
>>
>> Drop BIT(SYS_PMSCR_EL1_CX_SHIFT) check in arm_spe_pmu_event_init(), because
>> now CX bit cannot be set in arm_spe_event_to_pmscr() with perfmon_capable()
>> disabled.
>>
>> Cc: Will Deacon <will@...nel.org>
>> Cc: Mark Rutland <mark.rutland@....com>
>> Cc: Alexey Budankov <alexey.budankov@...ux.intel.com>
>> Cc: linux-arm-kernel@...ts.infradead.org
>> Cc: linux-kernel@...r.kernel.org
>> Fixes: cea7d0d4a59b ("drivers/perf: Open access for CAP_PERFMON privileged process")
> 
> TBH, this is not sufficient. The above commit simply replaced the capable() check with perfmon_capable() wrapper. The "incorrect check
> in the wrong task context" existed since :
> 
> d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension").
> 
> So I would recommend using that for the Fixes tag. And any stable
> backports without perfmon_capable() could fallback to using capable()
> check, like we do in this patch, from the event_init.

Makes sense. I will respin the patch with above "Fixes: " tag unless there
is some other feedback here.

> 
> Otherwise,
> 
> Reviewed-by: Suzuki K Poulose <suzuki.poulose@....com>
>