Re: [PATCH v1 1/2] perf/core: Use sysctl to turn on/off dropping leaked kernel samples

[Peter Zijlstra]

On Fri, Jun 15, 2018 at 01:31:34PM +0000, Liang, Kan wrote:
> > On Thu, Jun 14, 2018 at 11:02:53PM -0700, Stephane Eranian wrote:
> > > On Thu, Jun 14, 2018 at 7:10 PM Jin Yao <yao.jin@xxxxxxxxxxxxxxx> wrote:
> > > > +       /*
> > > > +        * Due to interrupt latency (AKA "skid"), we may enter the
> > > > +        * kernel before taking an overflow, even if the PMU is only
> > > > +        * counting user events.
> > > > +        * To avoid leaking information to userspace, we must always
> > > > +        * reject kernel samples when exclude_kernel is set.
> > > > +        */
> > > > +       if (event->attr.exclude_kernel && !user_mode(regs))
> > > > +               return false;
> > > > +
> > > And how does that filter PEBS or LBR records?
> > 
> > I suspect the user_mode() thing actually covers PEBS, but yes LBR might need
> > additional filtering.
> 
> I think the large PEBS still need to be specially handled.

large pebs should be fine too, all pebs stuff eventually calls
perf_event_output() with a synthesized register set.