On workloads that do a lot of kernel entry/exits we see kernel samples, even though :u is specified. This is due to skid existing.
This might be a security issue because it can leak kernel addresses even though kernel sampling support is disabled. One patch "perf/core: Drop kernel samples even though :u is specified" was posted in last year but it was reverted because it introduced a regression issue that broke the rr-project. Now this patch set uses sysctl to control the dropping of leaked kernel samples. /sys/devices/cpu/perf_allow_sample_leakage: 0 - default, drop the leaked kernel samples. 1 - don't drop the leaked kernel samples. For rr it can write 1 to /sys/devices/cpu/perf_allow_sample_leakage to keep original system behavior. Jin Yao (2): perf/core: Use sysctl to turn on/off dropping leaked kernel samples perf Documentation: Introduce the sysctl perf_allow_sample_leakage kernel/events/core.c | 58 ++++++++++++++++++++++++++++++++ tools/perf/Documentation/perf-record.txt | 14 ++++++++ 2 files changed, 72 insertions(+) -- 2.7.4
