netdev - Re: bpf_get_branch_snapshot on qemu-kvm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 8 Oct 2021 14:36:12 +0800
From:   Like Xu <like.xu.linux@...il.com>
To:     Song Liu <songliubraving@...com>
Cc:     Peter Zijlstra <peterz@...radead.org>, bpf <bpf@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>,
        Kernel Team <Kernel-team@...com>,
        Andrii Nakryiko <andrii@...nel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        "like.xu@...ux.intel.com" <like.xu@...ux.intel.com>,
        Andi Kleen <andi@...stfloor.org>,
        "Liang, Kan" <kan.liang@...el.com>
Subject: Re: bpf_get_branch_snapshot on qemu-kvm

On 8/10/2021 1:46 pm, Song Liu wrote:
> 
> 
>> On Oct 7, 2021, at 8:34 PM, Like Xu <like.xu.linux@...il.com> wrote:
>>
>> On 30/9/2021 4:05 am, Song Liu wrote:
>>> Hi Kan,
>>>> On Sep 29, 2021, at 9:35 AM, Liang, Kan <kan.liang@...el.com> wrote:
>>>>
>>>>>>> - get confirmation that clearing GLOBAL_CTRL is suffient to supress
>>>>>>>   PEBS, in which case we can simply remove the PEBS_ENABLE clear.
>>>>>>
>>>>>> How should we confirm this? Can we run some tests for this? Or do we
>>>>>> need hardware experts' input for this?
>>>>>
>>>>> I'll put it on the list to ask the hardware people when I talk to them next. But
>>>>> maybe Kan or Andi know without asking.
>>>>
>>>> If the GLOBAL_CTRL is explicitly disabled, the counters do not count anymore.
>>>> It doesn't matter if PEBS is enabled or not.
>>>>
>>>> See 6c1c07b33eb0 ("perf/x86/intel: Avoid unnecessary PEBS_ENABLE MSR
>>>> access in PMI "). We optimized the PMU handler base on it.
>>> Thanks for these information!
>>> IIUC, all we need is the following on top of bpf-next/master:
>>> diff --git i/arch/x86/events/intel/core.c w/arch/x86/events/intel/core.c
>>> index 1248fc1937f82..d0d357e7d6f21 100644
>>> --- i/arch/x86/events/intel/core.c
>>> +++ w/arch/x86/events/intel/core.c
>>> @@ -2209,7 +2209,6 @@ intel_pmu_snapshot_branch_stack(struct perf_branch_entry *entries, unsigned int
>>>          /* must not have branches... */
>>>          local_irq_save(flags);
>>>          __intel_pmu_disable_all(false); /* we don't care about BTS */
>>
>> If the value passed in is true, does it affect your use case?
>>
>>> -       __intel_pmu_pebs_disable_all();
>>
>> In that case, we can reuse "static __always_inline void intel_pmu_disable_all(void)"
>> regardless of whether PEBS is supported or enabled inside the guest and the host ?
>>
>>>          __intel_pmu_lbr_disable();
>>
>> How about using intel_pmu_lbr_disable_all() to cover Arch LBR?
> 
> We are using LBR without PMI, so there isn't any hardware mechanism to
> stop the LBR, we have to stop it in software. There is always a delay
> between the event triggers and the LBR is stopped. In this window,

Do you use counters for snapshot branch stack?

Can the assumption of "without PMI" be broken sine Intel does have
the hardware mechanism like "freeze LBR on counter overflow
(aka, DEBUGCTLMSR_FREEZE_LBRS_ON_PMI)" ?

> the LBR is still running and old entries are being replaced by new entries.
> We actually need the old entries before the triggering event, so the key
> design goal here is to minimize the number of branch instructions between
> the event triggers and the LBR is stopped.

Yes, it makes sense.

> 
> Here, both __intel_pmu_disable_all(false) and __intel_pmu_lbr_disable()
> are used to optimize for this goal: the fewer branch instructions the
> better.

Is it possible that we have another LBR in-kernel user in addition to the current
BPF-LBR snapshot user, such as another BPF-LBR snapshot user or a LBR perf user ?

In the intel_pmu_snapshot_[arch]_branch_stack(), what if there is a PMI or NMI 
handler
to be called before __intel_pmu_lbr_disable(), which means more branch instructions
(assuming we don't use the FREEZE_LBRS_ON_xxx capability)?

How about try to disable LBR at the earliest possible time, before 
__intel_pmu_disable_all(false) ?

> 
> After removing __intel_pmu_pebs_disable_all() from
> intel_pmu_snapshot_branch_stack(), we found quite a few LBR entries in
> extable related code. With these entries, snapshot branch stack is not

Are you saying that you still need to call
__intel_pmu_pebs_disable_all() to maintain precision ?

> really useful in the VM, because all the interesting entries are flushed
> by these. I am not sure how to further optimize these. Do you have some
> suggestions on this?


> 
> Thanks,
> Song
>