On Tue, 2017-08-29 at 21:21 +0200, Peter Zijlstra wrote: > On Tue, Aug 29, 2017 at 07:16:31PM +0000, Rogozhkin, Dmitry V wrote: > > > Pretty strict, people tend to get fairly upset every time we leak stuff. > > > In fact Debian and Android carry a perf_event_paranoid patch that > > > default disables _everything_ :-( > > > > Can you say more on that for Debian and Android? What exactly they do? > > What is the value of perf_event_paranoid there? They disable everything > > even for root and CAP_SYS_ADMIN? But still they don't remove this from > > kernel on compilation stage, right? So users can explicitly change > > perf_event_paranoid to the desired value? > > They introduce (and default to) perf_event_paranoid = 3. Which > disallows everything for unpriv user, root can still do things IIRC, I'd > have to dig out the patch. > > This way apps have no access to the syscall, but you can enable it using > ADB by lowering the setting. So developers still have access, but > regular apps do not. > Hi, Peter. How you would feel about the following idea (or close to it): 1. We introduce one more level for perf_event_paranoid=4 (or =3, I am not sure whether Debian/Android =3 is considered uAPI) which would mean: "disallow kernel profiling for unpriv, but let individual kernel modules to have their own settings". 2. We will have i915 PMU custom setting "/sys/module/i915/parameters/perf_event_paranoid" which will be in effect only if global perf_event_paranoid=4 (or =3) and prevail over a global setting Would anything like that be acceptable upstream? This would permit customers to configure i915 PMU support for unpriv users separately from the rest of PMU subsystem. Regards, Dmitry. _______________________________________________ Intel-gfx mailing list Intel-gfx@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/intel-gfx
