Re: [PATCH v4 4/9] drm/i915/perf: open access for CAP_SYS_PERFMON privileged process
Lionel Landwerlin <[email protected]> Thu, 19 Dec 2019 11:10:29 +0200
| Newsgroups | gmane.linux.kernel,gmane.linux.kernel.lsm,gmane.comp.freedesktop.xorg.drivers.intel,gmane.linux.ports.parisc,gmane.linux.ports.ppc64.devel,gmane.linux.kernel.perf.user,gmane.linux.ports.arm.kernel,gmane.linux.oprofile |
|---|---|
| Organization | Intel Corporation (UK) Ltd. - Co. Reg. #1134945 - Pipers Way, Swindon SN3 1RJ |
| Message-ID | <[email protected]> |
On 18/12/2019 11:27, Alexey Budankov wrote: > Open access to i915_perf monitoring for CAP_SYS_PERFMON privileged > processes. For backward compatibility reasons access to i915_perf > subsystem remains open for CAP_SYS_ADMIN privileged processes but > CAP_SYS_ADMIN usage for secure i915_perf monitoring is discouraged > with respect to CAP_SYS_PERFMON capability. > > Signed-off-by: Alexey Budankov <[email protected]> Acked-by: Lionel Landwerlin <[email protected]> > --- > drivers/gpu/drm/i915/i915_perf.c | 13 ++++++------- > 1 file changed, 6 insertions(+), 7 deletions(-) > > diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c > index e42b86827d6b..e2697f8d04de 100644 > --- a/drivers/gpu/drm/i915/i915_perf.c > +++ b/drivers/gpu/drm/i915/i915_perf.c > @@ -2748,10 +2748,10 @@ i915_perf_open_ioctl_locked(struct drm_i915_private *dev_priv, > /* Similar to perf's kernel.perf_paranoid_cpu sysctl option > * we check a dev.i915.perf_stream_paranoid sysctl option > * to determine if it's ok to access system wide OA counters > - * without CAP_SYS_ADMIN privileges. > + * without CAP_SYS_PERFMON or CAP_SYS_ADMIN privileges. > */ > if (privileged_op && > - i915_perf_stream_paranoid && !capable(CAP_SYS_ADMIN)) { > + i915_perf_stream_paranoid && !perfmon_capable()) { > DRM_DEBUG("Insufficient privileges to open system-wide i915 perf stream\n"); > ret = -EACCES; > goto err_ctx; > @@ -2939,9 +2939,8 @@ static int read_properties_unlocked(struct drm_i915_private *dev_priv, > } else > oa_freq_hz = 0; > > - if (oa_freq_hz > i915_oa_max_sample_rate && > - !capable(CAP_SYS_ADMIN)) { > - DRM_DEBUG("OA exponent would exceed the max sampling frequency (sysctl dev.i915.oa_max_sample_rate) %uHz without root privileges\n", > + if (oa_freq_hz > i915_oa_max_sample_rate && !perfmon_capable()) { > + DRM_DEBUG("OA exponent would exceed the max sampling frequency (sysctl dev.i915.oa_max_sample_rate) %uHz without CAP_SYS_PERFMON or CAP_SYS_ADMIN privileges\n", > i915_oa_max_sample_rate); > return -EACCES; > } > @@ -3328,7 +3327,7 @@ int i915_perf_add_config_ioctl(struct drm_device *dev, void *data, > return -EINVAL; > } > > - if (i915_perf_stream_paranoid && !capable(CAP_SYS_ADMIN)) { > + if (i915_perf_stream_paranoid && !perfmon_capable()) { > DRM_DEBUG("Insufficient privileges to add i915 OA config\n"); > return -EACCES; > } > @@ -3474,7 +3473,7 @@ int i915_perf_remove_config_ioctl(struct drm_device *dev, void *data, > return -ENOTSUPP; > } > > - if (i915_perf_stream_paranoid && !capable(CAP_SYS_ADMIN)) { > + if (i915_perf_stream_paranoid && !perfmon_capable()) { > DRM_DEBUG("Insufficient privileges to remove i915 OA config\n"); > return -EACCES; > }