Re: [PATCH v1 1/2] perf/core: Use sysctl to turn on/off dropping leaked kernel samples

[Peter Zijlstra]

On Thu, Jun 14, 2018 at 11:02:53PM -0700, Stephane Eranian wrote:
> On Thu, Jun 14, 2018 at 7:10 PM Jin Yao <yao.jin@xxxxxxxxxxxxxxx> wrote:
> > +       /*
> > +        * Due to interrupt latency (AKA "skid"), we may enter the
> > +        * kernel before taking an overflow, even if the PMU is only
> > +        * counting user events.
> > +        * To avoid leaking information to userspace, we must always
> > +        * reject kernel samples when exclude_kernel is set.
> > +        */
> > +       if (event->attr.exclude_kernel && !user_mode(regs))
> > +               return false;
> > +
> And how does that filter PEBS or LBR records?

I suspect the user_mode() thing actually covers PEBS, but yes LBR might
need additional filtering.