RE: [PATCH v1 1/2] perf/core: Use sysctl to turn on/off dropping leaked kernel samples

[Liang, Kan]

> On Thu, Jun 14, 2018 at 11:02:53PM -0700, Stephane Eranian wrote:
> > On Thu, Jun 14, 2018 at 7:10 PM Jin Yao <yao.jin@xxxxxxxxxxxxxxx> wrote:
> > > +       /*
> > > +        * Due to interrupt latency (AKA "skid"), we may enter the
> > > +        * kernel before taking an overflow, even if the PMU is only
> > > +        * counting user events.
> > > +        * To avoid leaking information to userspace, we must always
> > > +        * reject kernel samples when exclude_kernel is set.
> > > +        */
> > > +       if (event->attr.exclude_kernel && !user_mode(regs))
> > > +               return false;
> > > +
> > And how does that filter PEBS or LBR records?
> 
> I suspect the user_mode() thing actually covers PEBS, but yes LBR might need
> additional filtering.

I think the large PEBS still need to be specially handled.

Thanks,
Kan