Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [RFC] perf: Allow fine-grained PMU access control
To:     Andi Kleen <ak@linux.intel.com>,
        Alexey Budankov <alexey.budankov@linux.intel.com>
Cc:     Peter Zijlstra <peterz@infradead.org>,
        Tvrtko Ursulin <tursulin@ursulin.net>,
        linux-kernel@vger.kernel.org,
        Tvrtko Ursulin <tvrtko.ursulin@intel.com>,
        Ingo Molnar <mingo@redhat.com>,
        Arnaldo Carvalho de Melo <acme@kernel.org>,
        Alexander Shishkin <alexander.shishkin@linux.intel.com>,
        Jiri Olsa <jolsa@redhat.com>,
        Namhyung Kim <namhyung@kernel.org>,
        Mark Rutland <mark.rutland@arm.com>,
        "Rogozhkin, Dmitry V" <dmitry.v.rogozhkin@intel.com>
References: <20180521092549.5349-1-tvrtko.ursulin@linux.intel.com>
 <20180522090527.GP12198@hirez.programming.kicks-ass.net>
 <017c4a20-b597-9c0e-4cf3-c0fd1d7bf3d7@ursulin.net>
 <20180522123213.GR12198@hirez.programming.kicks-ass.net>
 <88a005e3-e090-33c1-0107-5c04a4d8f97f@linux.intel.com>
 <20180522171925.GL4486@tassilo.jf.intel.com>
From:   Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
Message-ID: <a2cb4e93-95c0-4a9f-db4d-69d6748c292e@linux.intel.com>
Date:   Mon, 11 Jun 2018 09:08:28 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.8.0
MIME-Version: 1.0
In-Reply-To: <20180522171925.GL4486@tassilo.jf.intel.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-GB
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


Hi,

On 22/05/2018 18:19, Andi Kleen wrote:
>> IMHO, it is unsafe for CBOX pmu but could IMC, UPI pmus be an exception here?
>> Because currently perf stat -I from IMC, UPI counters is only allowed when
>> system wide monitoring is permitted and this prevents joint perf record and
>> perf stat -I in cluster environments where users usually lack ability to
>> modify paranoid. Adding Andi who may have more ideas regarding all that.
> 
> PMU isolation is about not making side channels worse. There are normally
> already side channels from timing, but it has a degree of noise.
> 
> PMU isolation is just to prevent opening side channels with less noise.
> But reducing noise is always a trade off, it can never be perfect
> and at some point there are dimishing returns.
> 
> In general the farther you are from the origin of the noise there
> is already more noise. The PMU can reduce the noise, but if it's far
> enough away it may not make much difference.
> 
> So there are always trade offs with shades of grey, not a black
> and white situation. Depending on your security requirements
> it may be totally reasonable e.g. to allow the PMU
> on the memory controller (which is already very noisy in any case),
> but not on the caches.
> 
> Or allow it only on the graphics which is already fairly isolated.
> 
> So per pmu paranoid settings are a useful concept.

So it seems there is some positive feedback and fine-grained controls 
would be useful for other PMU's in cluster environments.

If we have agreement on that, question is how to drive this forward? 
Would someone be able to review the patch I've sent, or suggest more 
people to look at it before it could be queued up for merge?

Regards,

Tvrtko