> It is not because you force LBR to ring3 only that you do not capture > kernel addresses in the FROM field. > Keep in mind that LBR priv level filtering applies to the target of > the branch and not the source. You might > still get a kernel address if returning from kernel. Now, in callstack > mode, I think the return branch is never > actually recorded in the LBR, it just causes a pop, so theoretically > this should not happen. I'd like to be > 100% sure of that, though.
Far branches shouldn't be included in call stack LBR. Don't think there is any other situation where the ring 0 address could leak either. -Andi -- a...@linux.intel.com -- Speaking for myself only
