Re: [PATCH v1 1/2] perf/core: Use sysctl to turn on/off dropping leaked kernel samples

Peter Zijlstra
2018-06-18T10:42:01Z

On Fri, Jun 15, 2018 at 01:31:34PM +0000, Liang, Kan wrote:
> > On Thu, Jun 14, 2018 at 11:02:53PM -0700, Stephane Eranian wrote:
> > > On Thu, Jun 14, 2018 at 7:10 PM Jin Yao <yao.jin@linux.intel.com> wrote:
> > > > + /*
> > > > + * Due to interrupt latency (AKA "skid"), we may enter the
> > > > + * kernel before taking an overflow, even if the PMU is only
> > > > + * counting user events.
> > > > + * To avoid leaking information to userspace, we must always
> > > > + * reject kernel samples when exclude_kernel is set.
> > > > + */
> > > > + if (event->attr.exclude_kernel && !user_mode(regs))
> > > > + return false;
> > > > +
> > > And how does that filter PEBS or LBR records?
> >
> > I suspect the user_mode() thing actually covers PEBS, but yes LBR might need
> > additional filtering.
>
> I think the large PEBS still need to be specially handled.

large pebs should be fine too, all pebs stuff eventually calls
perf_event_output() with a synthesized register set.