lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <aD6bkAXjRllFvRTV@google.com>
Date: Mon, 2 Jun 2025 23:52:00 -0700
From: Namhyung Kim <namhyung@...nel.org>
To: Ingo Molnar <mingo@...nel.org>
Cc: Ravi Bangoria <ravi.bangoria@....com>,
	Peter Zijlstra <peterz@...radead.org>,
	Arnaldo Carvalho de Melo <acme@...nel.org>,
	Ingo Molnar <mingo@...hat.com>,
	Stephane Eranian <eranian@...gle.com>,
	Ian Rogers <irogers@...gle.com>,
	Kan Liang <kan.liang@...ux.intel.com>,
	James Clark <james.clark@...aro.org>, Leo Yan <leo.yan@....com>,
	Joe Mario <jmario@...hat.com>, linux-kernel@...r.kernel.org,
	linux-perf-users@...r.kernel.org,
	Santosh Shukla <santosh.shukla@....com>,
	Ananth Narayan <ananth.narayan@....com>,
	Sandipan Das <sandipan.das@....com>, bpf@...r.kernel.org
Subject: Re: [PATCH 1/4] perf/amd/ibs: Add load/store SW filters to IBS OP PMU

Hello,

+ bpf list

On Sat, May 31, 2025 at 09:53:44AM +0200, Ingo Molnar wrote:
> 
> * Ravi Bangoria <ravi.bangoria@....com> wrote:
> 
> > Since current IBS OP PMU does not have the capability to tag only load/
> > stores instructions, tools like perf mem/c2c ends up recording lots of
> > unwanted samples. So, introduce a load/store software filter in the IBS
> > OP PMU:
> > 
> >   ibs_op/swfilt=1,ldop=1/         --> Only load samples
> >   ibs_op/swfilt=1,stop=1/         --> Only store samples
> >   ibs_op/swfilt=1,ldop=1,stop=1/  --> Load OR store samples
> > 
> > Other HW or SW filters in combination with this ldst filter are logical
> > AND. For ex:
> > 
> >   ibs_op/swfilt=1,ldop=1,stop=1/u is
> >   "privilege == userspace && (ldop == 1 || stop == 1)"
> > 
> >   ibs_op/swfilt=1,ldop=1,stop=1,l3missonly=1/ is
> >   "l3missonly == 1 && (ldop == 1 || stop == 1)"
> 
> No objections, but:
> 
> > An alternate approach is mem_op BPF filter:
> > 
> >   perf record --filter "mem_op == load || mem_op == store" ...
> > 
> > However, there are few issues with it:
> > o BPF filter is called after preparing entire perf sample. If the sample
> >   does not satisfy the filtering criteria, all the efforts of preparing
> >   perf sample gets wasted.
> 
> Could we add an 'early' BPF callback point as well, to fast-discard 
> samples?

I guess that would require a new BPF program type than PERF_EVENT and
handle driver-specific details.

> 
> > o BPF filter requires root privilege.
> 
> Could we add 'built-in', 'safe' BPF scripts that are specifically 
> prepared for perf events filtering purposes, that can be toggled by 
> non-root users as well? These could be toggled by tooling via sysfs or 
> so, or even via the perf syscall if that turns out to be the better 
> approach.

We have BPF filter framework in the perf tools and it can be run as
normal user.  But root user should load and pin the BPF program prior
to use like below.

  $ sudo perf record --setup-filter pin

  $ perf record -d -e ibs_op/swfilt/u --filter 'mem_op == load' ...

Thanks,
Namhyung

> 
> It would give us the flexibility and extensibility of BPF, combining it 
> with the safety & compatibility of the filtering functionality being 
> provided by the kernel.
> 
> It could be provided in the form of a BPF program crypto signature 
> registry of upstream-approved BPF scripts for perf BPF callback(s),
> or so. (While root could load any BPF script.)
> 
> Thanks,
> 
> 	Ingo

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ