linux-kernel - [RFC/PATCH 0/5] perf: Relax privilege restriction on AMD IBS (v3)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240905031027.2567913-1-namhyung@kernel.org>
Date: Wed,  4 Sep 2024 20:10:22 -0700
From: Namhyung Kim <namhyung@...nel.org>
To: Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...nel.org>
Cc: Kan Liang <kan.liang@...ux.intel.com>,
	Mark Rutland <mark.rutland@....com>,
	Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
	Arnaldo Carvalho de Melo <acme@...nel.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Stephane Eranian <eranian@...gle.com>,
	Ravi Bangoria <ravi.bangoria@....com>
Subject: [RFC/PATCH 0/5] perf: Relax privilege restriction on AMD IBS (v3)

Hello,

This is RFC v3 to allow AMD IBS to regular users on the default settings
where kernel-level profiling is disabled (perf_event_paranoid=2).
Currently AMD IBS doesn't allow any kind of exclusion in the event
attribute.  But users needs to set attr.exclude_kernel to open an event
on such an environment.

v3 changes)

* fix build on s390
* add swfilt format for attr.config2
* count powerpc core-book3s dropped samples

v2) https://lore.kernel.org/lkml/20240830232910.1839548-1-namhyung@kernel.org/

* add PERF_FORMAT_DROPPED
* account dropped sw events and from BPF handler
* use precise RIP from IBS record

v1) https://lore.kernel.org/lkml/20240822230816.564262-1-namhyung@kernel.org/

While IBS doesn't support hardware level privilege filters, the kernel
can allow the event and drop samples belongs to the kernel like in the
software events.  This is limited but it still contains precise samples
which is important for various analysis like data type profiling.

This version added format/swfilt file in sysfs to expose the software
filtering by setting the attribute config2 value.  I think it's easier
to add a new config rather than adding a new PMU in order to handle
event multiplexing across IBS PMU.  Users can use the perf tool to
enable this feature manually like below.  Probably the perf tool can
handle this automatically in the future.

  $ perf record -e ibs_op/swfilt=1/uh $PROG

(Not sure if it's better to accept or ignore exclude_hv so that it can
use ":u" modifier only.)

In order to count those dropped samples correctly, I'd propose a new
read format PERF_FORMAT_DROPPED same as we did for the lost samples.
With this, it can count dropped samples in the software events and
from the BPF overflow handler as well.

Let me know what you think.

Thanks,
Namhyung

Namhyung Kim (5):
  perf/core: Add PERF_FORMAT_DROPPED
  perf/core: Export perf_exclude_event()
  perf/core: Account dropped samples from BPF
  perf/powerpc: Count dropped samples in core-book3s PMU
  perf/x86: Relax privilege filter restriction on AMD IBS

 arch/powerpc/perf/core-book3s.c |  4 ++-
 arch/s390/kernel/perf_cpum_sf.c |  8 ++++--
 arch/x86/events/amd/ibs.c       | 50 ++++++++++++++++++++++++---------
 include/linux/perf_event.h      |  7 +++++
 include/uapi/linux/perf_event.h |  5 +++-
 kernel/events/core.c            | 27 ++++++++++++++----
 6 files changed, 77 insertions(+), 24 deletions(-)

-- 
2.46.0.469.g59c65b2a67-goog