linux-kernel - Re: [PATCH v1 1/2] perf/core: Use sysctl to turn on/off dropping leaked kernel samples

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180618104522.GI2458@hirez.programming.kicks-ass.net>
Date:   Mon, 18 Jun 2018 12:45:22 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     "Jin, Yao" <yao.jin@...ux.intel.com>
Cc:     Mark Rutland <mark.rutland@....com>, acme@...nel.org,
        jolsa@...nel.org, mingo@...hat.com,
        alexander.shishkin@...ux.intel.com, me@...ehuey.com,
        Linux-kernel@...r.kernel.org, vincent.weaver@...ne.edu,
        will.deacon@....com, eranian@...gle.com, namhyung@...nel.org,
        ak@...ux.intel.com, kan.liang@...el.com, yao.jin@...el.com
Subject: Re: [PATCH v1 1/2] perf/core: Use sysctl to turn on/off dropping
 leaked kernel samples

On Mon, Jun 18, 2018 at 02:55:32PM +0800, Jin, Yao wrote:
> Thanks for providing the patch. I understand this approach.
> 
> In my opinion, the skid window is from counter overflow to interrupt
> delivered. While if the skid window is too *big* (e.g. user -> kernel), it
> should be not very useful. So personally, I'd prefer to drop the samples.

I really don't get your insitence on dropping the sample. Dropping
samples is bad. Furthermore, doing what Mark suggests actually improves
the result by reducing the skid, if the event happened before we entered
(as it damn well should) then the user regs, which point at the entry
site, are a better approximation than our in-kernel set.

So not only do you not loose the sample, you actually get a better
sample.