linux-kernel - Re: [PATCH 5/5] perf/x86: Relax privilege filter restriction on AMD IBS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <49fd4eb5-ee7b-45f5-a40f-dbfd793cdff4@amd.com>
Date: Tue, 15 Oct 2024 19:06:24 +0530
From: Ravi Bangoria <ravi.bangoria@....com>
To: Namhyung Kim <namhyung@...nel.org>, Peter Zijlstra
 <peterz@...radead.org>, Ingo Molnar <mingo@...nel.org>
Cc: Kan Liang <kan.liang@...ux.intel.com>, Mark Rutland
 <mark.rutland@....com>,
 Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
 Arnaldo Carvalho de Melo <acme@...nel.org>,
 LKML <linux-kernel@...r.kernel.org>, Stephane Eranian <eranian@...gle.com>,
 Ananth Narayan <ananth.narayan@....com>, Sandipan Das
 <sandipan.das@....com>, Ravi Bangoria <ravi.bangoria@....com>
Subject: Re: [PATCH 5/5] perf/x86: Relax privilege filter restriction on AMD
 IBS

Hi Namhyung,

On 05-Sep-24 8:40 AM, Namhyung Kim wrote:
> While IBS is available for per-thread profiling, still regular users
> cannot open an event due to the default paranoid setting (2) which
> doesn't allow unprivileged users to get kernel samples.  That means
> it needs to set exclude_kernel bit in the attribute but IBS driver
> would reject it since it has PERF_PMU_CAP_NO_EXCLUDE.  This is not what
> we want and I've been getting requests to fix this issue.
> 
> This should be done in the hardware, but until we get the HW fix we may
> allow exclude_{kernel,user} in the attribute and silently drop the
> samples in the PMU IRQ handler.  It won't guarantee the sampling
> frequency or even it'd miss some with fixed period too.  Not ideal,
> but that'd still be helpful to regular users.
> 
> To minimize the confusion, let's add 'swfilt' bit to attr.config2 which
> is exposed in the sysfs format directory so that users can figure out
> if the kernel support the privilege filters by software.
> 
>   $ perf record -e ibs_op/swfilt=1/uh true

Shall we add an example in tools/perf/Documentation/perf-amd-ibs.txt?


> +static struct attribute *swfilt_attrs[] = {
> +	&format_attr_swfilt.attr,
> +	NULL,
> +};
> +
>  static struct attribute *fetch_l3missonly_attrs[] = {
>  	&fetch_l3missonly.attr.attr,
>  	NULL,
> @@ -598,6 +604,11 @@ static struct attribute_group group_rand_en = {
>  	.attrs = rand_en_attrs,
>  };
>  
> +static struct attribute_group group_swfilt = {
> +	.name = "format",
> +	.attrs = swfilt_attrs,
> +};
> +
>  static struct attribute_group group_fetch_l3missonly = {
>  	.name = "format",
>  	.attrs = fetch_l3missonly_attrs,
> @@ -612,6 +623,7 @@ static struct attribute_group group_zen4_ibs_extensions = {
>  
>  static const struct attribute_group *fetch_attr_groups[] = {
>  	&group_rand_en,
> +	&group_swfilt,
>  	&empty_caps_group,
>  	NULL,
>  };

Causes:

  # dmesg
  sysfs: cannot create duplicate filename '/devices/ibs_fetch/format'
  Failed to register pmu: ibs_fetch, reason -17

Rename rand_en_attrs[] to fetch_attrs[], add &format_attr_swfilt.attr
to it and remove &group_swfilt from fetch_attr_groups[]. And I guess
it should work.

Thanks,
Ravi