lkml.org 
[lkml]   [2021]   [Jan]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] coresight: etm4x: Add config to exclude kernel mode tracing
    On Fri, Jan 15, 2021 at 11:16:24AM +0530, Sai Prakash Ranjan wrote:
    > Hello Mathieu, Suzuki
    >
    > On 2020-10-15 21:32, Mathieu Poirier wrote:
    > > On Thu, Oct 15, 2020 at 06:15:22PM +0530, Sai Prakash Ranjan wrote:
    > > > On production systems with ETMs enabled, it is preferred to
    > > > exclude kernel mode(NS EL1) tracing for security concerns and
    > > > support only userspace(NS EL0) tracing. So provide an option
    > > > via kconfig to exclude kernel mode tracing if it is required.
    > > > This config is disabled by default and would not affect the
    > > > current configuration which has both kernel and userspace
    > > > tracing enabled by default.
    > > >
    > >
    > > One requires root access (or be part of a special trace group) to be
    > > able to use
    > > the cs_etm PMU. With this kind of elevated access restricting tracing
    > > at EL1
    > > provides little in terms of security.
    > >
    >
    > Apart from the VM usecase discussed, I am told there are other
    > security concerns here regarding need to exclude kernel mode tracing
    > even for the privileged users/root. One such case being the ability
    > to analyze cryptographic code execution since ETMs can record all
    > branch instructions including timestamps in the kernel and there may
    > be other cases as well which I may not be aware of and hence have
    > added Denis and Mattias. Please let us know if you have any questions
    > further regarding this not being a security concern.

    Even if we were to apply this patch there are many ways to compromise a system
    or get the kernel to reveal important information using the perf subsystem. I
    would perfer to tackle the problem at that level rather than concentrating on
    coresight.

    >
    > After this discussion, I would like to post a v2 based on Suzuki's
    > feedback earlier. @Suzuki, I have a common config for ETM3 and ETM4
    > but couldn't get much idea on how to implement it for Intel PTs, if
    > you have any suggestions there, please do share or we can have this
    > only for Coresight ETMs.
    >
    > Thanks,
    > Sai
    >
    > --
    > QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a member
    > of Code Aurora Forum, hosted by The Linux Foundation

    \
     
     \ /
      Last update: 2021-01-18 21:27    [W:4.935 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site