Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Mon, 18 Jun 2018 12:41:49 +0200
From:   Peter Zijlstra <peterz@infradead.org>
To:     "Liang, Kan" <kan.liang@intel.com>
Cc:     Stephane Eranian <eranian@google.com>,
        "yao.jin@linux.intel.com" <yao.jin@linux.intel.com>,
        Arnaldo Carvalho de Melo <acme@kernel.org>,
        Jiri Olsa <jolsa@kernel.org>, Ingo Molnar <mingo@redhat.com>,
        Alexander Shishkin <alexander.shishkin@linux.intel.com>,
        "me@kylehuey.com" <me@kylehuey.com>,
        LKML <Linux-kernel@vger.kernel.org>,
        Vince Weaver <vincent.weaver@maine.edu>,
        Will Deacon <will.deacon@arm.com>,
        Namhyung Kim <namhyung@kernel.org>,
        Andi Kleen <ak@linux.intel.com>, "Jin, Yao" <yao.jin@intel.com>
Subject: Re: [PATCH v1 1/2] perf/core: Use sysctl to turn on/off dropping
 leaked kernel samples
Message-ID: <20180618104149.GH2458@hirez.programming.kicks-ass.net>
References: <1529057003-2212-1-git-send-email-yao.jin@linux.intel.com>
 <1529057003-2212-2-git-send-email-yao.jin@linux.intel.com>
 <CABPqkBTyEZX7DebLR-nbzXs0ZYGT1xWNmOmvKgRsvr4mxWJg=w@mail.gmail.com>
 <20180615081656.GC2458@hirez.programming.kicks-ass.net>
 <37D7C6CF3E00A74B8858931C1DB2F07753939C70@SHSMSX103.ccr.corp.intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <37D7C6CF3E00A74B8858931C1DB2F07753939C70@SHSMSX103.ccr.corp.intel.com>
User-Agent: Mutt/1.10.0 (2018-05-17)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Fri, Jun 15, 2018 at 01:31:34PM +0000, Liang, Kan wrote:
> > On Thu, Jun 14, 2018 at 11:02:53PM -0700, Stephane Eranian wrote:
> > > On Thu, Jun 14, 2018 at 7:10 PM Jin Yao <yao.jin@linux.intel.com> wrote:
> > > > +       /*
> > > > +        * Due to interrupt latency (AKA "skid"), we may enter the
> > > > +        * kernel before taking an overflow, even if the PMU is only
> > > > +        * counting user events.
> > > > +        * To avoid leaking information to userspace, we must always
> > > > +        * reject kernel samples when exclude_kernel is set.
> > > > +        */
> > > > +       if (event->attr.exclude_kernel && !user_mode(regs))
> > > > +               return false;
> > > > +
> > > And how does that filter PEBS or LBR records?
> > 
> > I suspect the user_mode() thing actually covers PEBS, but yes LBR might need
> > additional filtering.
> 
> I think the large PEBS still need to be specially handled.

large pebs should be fine too, all pebs stuff eventually calls
perf_event_output() with a synthesized register set.