[0/2] KVM: arm64: Filtering PMU events

Message

Marc Zyngier Feb. 14, 2020, 6:36 p.m. UTC

It is at times necessary to prevent a guest from being able to sample
certain events if multiple CPUs share resources such as a cache level.
In this case, it would be interesting if the VMM could simply prevent
certain events from being counted instead of simply not exposing a PMU.

Given that most events are not architected, there is no easy way
to designate which events shouldn't be counted other than specifying
the raw event number.

Since I have no idea whether it is better to use an event whitelist
or blacklist, the proposed API takes a cue from the x86 version and
allows either allowing or denying counting of ranges of events.
The event space being pretty large (16bits on ARMv8.1), the default
policy is set by the first filter that gets installed (default deny if
we first allow, default allow if we first deny).

The filter state is global to the guest, despite the PMU being per
CPU. I'm not sure whether it would be worth it making it CPU-private.

Anyway, I'd be interesting in comments on how people would use this.
I'll try to push a patch against kvmtool that implement this shortly
(what I have currently is a harcoded set of hacks).

Marc Zyngier (2):
  KVM: arm64: Add PMU event filtering infrastructure
  KVM: arm64: Document PMU filtering API

 Documentation/virt/kvm/devices/vcpu.txt | 28 +++++++++
 arch/arm64/include/asm/kvm_host.h       |  6 ++
 arch/arm64/include/uapi/asm/kvm.h       | 16 ++++++
 virt/kvm/arm/arm.c                      |  2 +
 virt/kvm/arm/pmu.c                      | 76 +++++++++++++++++++++----
 5 files changed, 116 insertions(+), 12 deletions(-)

Comments

Marc Zyngier Feb. 15, 2020, 1 p.m. UTC | #1

On Fri, 14 Feb 2020 18:36:13 +0000
Marc Zyngier <[e-mail]> wrote:

> It is at times necessary to prevent a guest from being able to sample
> certain events if multiple CPUs share resources such as a cache level.
> In this case, it would be interesting if the VMM could simply prevent
> certain events from being counted instead of simply not exposing a PMU.
> 
> Given that most events are not architected, there is no easy way
> to designate which events shouldn't be counted other than specifying
> the raw event number.
> 
> Since I have no idea whether it is better to use an event whitelist
> or blacklist, the proposed API takes a cue from the x86 version and
> allows either allowing or denying counting of ranges of events.
> The event space being pretty large (16bits on ARMv8.1), the default
> policy is set by the first filter that gets installed (default deny if
> we first allow, default allow if we first deny).
> 
> The filter state is global to the guest, despite the PMU being per
> CPU. I'm not sure whether it would be worth it making it CPU-private.
> 
> Anyway, I'd be interesting in comments on how people would use this.
> I'll try to push a patch against kvmtool that implement this shortly
> (what I have currently is a harcoded set of hacks).

I now have a small extension to kvmtool allowing a --pmu-filter option
to be passed on the command line (see [1]).

I've also pushed out an update[2] to the kernel side of things, making
the filtering of the cycle counter consistent and documenting that
neither SW_INCR nor CHAIN could be filtered with this mechanism (but
this is of course up for discussion).

Thanks,

	M.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/maz/kvmtool.git/commit/?h=pmu-filter
[2] https://git.kernel.org/pub/scm/linux/kernel/git/maz/arm-platforms.git/log/?h=kvm-arm64/pmu-event-filter