** Description changed:
[Impact]
perf_allow_cpu() and perf_allow_tracepoint() are static inline in
<linux/perf_event.h> and reference sysctl_perf_event_paranoid and
security_perf_event_open(), neither of which is exported. Modules cannot
reuse the system-wide perf permission model and open-code partial copies
instead.
drm/xe does this in its OA and EU-stall observation paths, open-coding a
CPU-event check that ignores kernel.perf_event_paranoid and the
security_perf_event_open() LSM hook. On systems with Intel Xe graphics,
xe observation honors neither.
[Fix]
Patch 1 moves perf_allow_cpu/tracepoint() out of line into
kernel/events/core.c and exports them EXPORT_SYMBOL_GPL, with
!CONFIG_PERF_EVENTS stubs. No behavior change for existing callers.
Patch 2 switches xe's OA and EU-stall paths to perf_allow_cpu() so they
honor kernel.perf_event_paranoid and the LSM perf hook;
dev.xe.observation_paranoid stays as an escape hatch.
Upstream commits in linux-next/drm-next, targeting v7.3:
d32bf877c0c3 ("perf/core: out-of-line and export perf_allow_cpu/tracepoint()")
- 6680bf0cb726 ("drm/xe: gate observation streams with perf_allow_cpu()")
+ 6680bf0cb726 ("drm/xe: gate observation streams with perf_allow_cpu()")
Link:
https://lore.kernel.org/all/[email protected]/
drm/xe is backported: this kernel lacks commit 41255b2f1e03, so a
duplicate int ret declaration was dropped. perf/core is a clean cherry-
pick.
[Test Plan]
-
- - Builds clean with PERF_EVENTS=y, with PERF_EVENTS=n + DRM_XE=m
(COMPILE_TEST), and with DRM_XE=m.
+ - Builds clean with CONFIG_PERF_EVENTS=y; CONFIG_PERF_EVENTS=n plus
+ CONFIG_DRM_XE=m under COMPILE_TEST; and CONFIG_DRM_XE=m.
- Boots with no dmesg regressions.
- - perf_allow_cpu/tracepoint show as EXPORT_SYMBOL_GPL in Module.symvers and
/proc/kallsyms (absent when unpatched).
- - A non-root perf_event_paranoid sweep confirms perf_event_open() allow/deny
is unchanged.
+ - perf_allow_cpu() and perf_allow_tracepoint() appear as GPL-only exports in
+ Module.symvers and /proc/kallsyms; both are absent without the patches.
+ - A perf_event_paranoid sweep confirms unchanged perf_event_open()
+ allow/deny behavior.
[Where problems could occur]
- Patch 1 has identical behavior for existing callers. Patch 2 changes xe
observation permissions only on Intel Xe systems; others are unaffected.
+ Patch 1 has identical behavior for existing callers. Patch 2 changes xe
observation permissions only on Intel Xe systems; others are unaffected.
Low risk.
** Summary changed:
- Backport: export perf_allow_cpu/tracepoint() and gate drm/xe observation
+ Backport: complete perf_allow_* trio and use in drm/xe
** Description changed:
[Impact]
- perf_allow_cpu() and perf_allow_tracepoint() are static inline in
- <linux/perf_event.h> and reference sysctl_perf_event_paranoid and
- security_perf_event_open(), neither of which is exported. Modules cannot
- reuse the system-wide perf permission model and open-code partial copies
- instead.
+ Copied from the upstream cover letter:
- drm/xe does this in its OA and EU-stall observation paths, open-coding a
- CPU-event check that ignores kernel.perf_event_paranoid and the
- security_perf_event_open() LSM hook. On systems with Intel Xe graphics,
- xe observation honors neither.
+ perf_allow_cpu() and perf_allow_tracepoint() are static inline and
+ reach into a non-exported sysctl, so modular drivers that want the
+ same permission model as system-wide perf end up writing partial
+ copies of this code. Let's instead export these properly so that modules
+ can call them.
+
+ Commit 5e9629d0ae97 ("drivers/perf: arm_spe: Use perf_allow_kernel()
+ for permissions") already moved perf_allow_kernel() out of line and
+ exported it. Patch 1 does the same for the other two, and provides
+ !CONFIG_PERF_EVENTS stubs so the helpers stay callable when perf is
+ compiled out.
+
+ Patch 2 converts drm/xe's OA and EU stall paths to call
+ perf_allow_cpu(), so xe observation now respects the system
+ perf_event_paranoid policy and consults the LSM hook. Sites that have
+ already configured an LSM perf policy or tuned the paranoid sysctl will
+ now see those settings honored on xe as well.
[Fix]
-
- Patch 1 moves perf_allow_cpu/tracepoint() out of line into
- kernel/events/core.c and exports them EXPORT_SYMBOL_GPL, with
- !CONFIG_PERF_EVENTS stubs. No behavior change for existing callers.
- Patch 2 switches xe's OA and EU-stall paths to perf_allow_cpu() so they
- honor kernel.perf_event_paranoid and the LSM perf hook;
- dev.xe.observation_paranoid stays as an escape hatch.
Upstream commits in linux-next/drm-next, targeting v7.3:
d32bf877c0c3 ("perf/core: out-of-line and export perf_allow_cpu/tracepoint()")
6680bf0cb726 ("drm/xe: gate observation streams with perf_allow_cpu()")
Link:
https://lore.kernel.org/all/[email protected]/
- drm/xe is backported: this kernel lacks commit 41255b2f1e03, so a
- duplicate int ret declaration was dropped. perf/core is a clean cherry-
- pick.
+ drm/xe is backported: this kernel lacks commit 41255b2f1e03 ("drm/xe/oa:
+ Use drm_gem_mmap_obj for OA buffer mmap"), so a duplicate int ret
+ declaration was dropped. perf/core is a clean cherry-pick.
[Test Plan]
- - Builds clean with CONFIG_PERF_EVENTS=y; CONFIG_PERF_EVENTS=n plus
- CONFIG_DRM_XE=m under COMPILE_TEST; and CONFIG_DRM_XE=m.
+ - Builds clean with PERF_EVENTS=y, with PERF_EVENTS=n + DRM_XE=m
(COMPILE_TEST), and with DRM_XE=m.
- Boots with no dmesg regressions.
- - perf_allow_cpu() and perf_allow_tracepoint() appear as GPL-only exports in
- Module.symvers and /proc/kallsyms; both are absent without the patches.
- - A perf_event_paranoid sweep confirms unchanged perf_event_open()
- allow/deny behavior.
+ - perf_allow_cpu/tracepoint show as EXPORT_SYMBOL_GPL in Module.symvers and
/proc/kallsyms (absent when unpatched).
+ - A non-root perf_event_paranoid sweep confirms perf_event_open() allow/deny
is unchanged.
[Where problems could occur]
Patch 1 has identical behavior for existing callers. Patch 2 changes xe
observation permissions only on Intel Xe systems; others are unaffected.
Low risk.
** Description changed:
[Impact]
- Copied from the upstream cover letter:
+ perf_allow_cpu() and perf_allow_tracepoint() are static inline in
+ <linux/perf_event.h> and reference sysctl_perf_event_paranoid and
+ security_perf_event_open(), neither of which is exported. Modules cannot reuse
+ the system-wide perf permission model and open-code partial copies instead.
- perf_allow_cpu() and perf_allow_tracepoint() are static inline and
- reach into a non-exported sysctl, so modular drivers that want the
- same permission model as system-wide perf end up writing partial
- copies of this code. Let's instead export these properly so that modules
- can call them.
-
- Commit 5e9629d0ae97 ("drivers/perf: arm_spe: Use perf_allow_kernel()
- for permissions") already moved perf_allow_kernel() out of line and
- exported it. Patch 1 does the same for the other two, and provides
- !CONFIG_PERF_EVENTS stubs so the helpers stay callable when perf is
- compiled out.
-
- Patch 2 converts drm/xe's OA and EU stall paths to call
- perf_allow_cpu(), so xe observation now respects the system
- perf_event_paranoid policy and consults the LSM hook. Sites that have
- already configured an LSM perf policy or tuned the paranoid sysctl will
- now see those settings honored on xe as well.
+ drm/xe does this in its OA and EU-stall observation paths, open-coding a
+ CPU-event check that ignores kernel.perf_event_paranoid and the
+ security_perf_event_open() LSM hook. On systems with Intel Xe graphics, xe
+ observation honors neither.
[Fix]
+
+ Patch 1 moves perf_allow_cpu/tracepoint() out of line into
kernel/events/core.c
+ and exports them EXPORT_SYMBOL_GPL, with !CONFIG_PERF_EVENTS stubs. No
behavior
+ change for existing callers. Patch 2 switches xe's OA and EU-stall paths to
+ perf_allow_cpu() so they honor kernel.perf_event_paranoid and the LSM perf
hook;
+ dev.xe.observation_paranoid stays as an escape hatch.
Upstream commits in linux-next/drm-next, targeting v7.3:
d32bf877c0c3 ("perf/core: out-of-line and export perf_allow_cpu/tracepoint()")
6680bf0cb726 ("drm/xe: gate observation streams with perf_allow_cpu()")
+ drm/xe is backported: this kernel lacks commit 41255b2f1e03, so a duplicate
int
+ ret declaration was dropped. perf/core is a clean cherry-pick.
+
Link:
https://lore.kernel.org/all/[email protected]/
- drm/xe is backported: this kernel lacks commit 41255b2f1e03 ("drm/xe/oa:
- Use drm_gem_mmap_obj for OA buffer mmap"), so a duplicate int ret
- declaration was dropped. perf/core is a clean cherry-pick.
-
[Test Plan]
- - Builds clean with PERF_EVENTS=y, with PERF_EVENTS=n + DRM_XE=m
(COMPILE_TEST), and with DRM_XE=m.
+ - Builds clean with CONFIG_PERF_EVENTS=y; CONFIG_PERF_EVENTS=n plus
+ CONFIG_DRM_XE=m under COMPILE_TEST; and CONFIG_DRM_XE=m.
- Boots with no dmesg regressions.
- - perf_allow_cpu/tracepoint show as EXPORT_SYMBOL_GPL in Module.symvers and
/proc/kallsyms (absent when unpatched).
- - A non-root perf_event_paranoid sweep confirms perf_event_open() allow/deny
is unchanged.
+ - perf_allow_cpu() and perf_allow_tracepoint() appear as GPL-only exports in
+ Module.symvers and /proc/kallsyms; both are absent without the patches.
+ - A perf_event_paranoid sweep confirms unchanged perf_event_open()
+ allow/deny behavior.
[Where problems could occur]
- Patch 1 has identical behavior for existing callers. Patch 2 changes xe
observation permissions only on Intel Xe systems; others are unaffected.
- Low risk.
+ Patch 1 has identical behavior for existing callers. Patch 2 changes xe
+ observation permissions only on Intel Xe systems; others are unaffected. Low
+ risk.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2160654
Title:
Backport: complete perf_allow_* trio and use in drm/xe
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2160654/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
