Re: [Patch v9 07/24] x86/fpu/xstate: Add xsaves_nmi() helper

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The use of the XSAVES instruction in xsaves_nmi() breaks FPU snapshotting to independent buffers due to the hardware's 'modified optimization', leading to a cross-process information leak.
--

commit e8d6f39a5d4512be90e9976febc30b8f46c0ea64
Author: Kan Liang <kan.liang@linux.intel.com>

x86/fpu/xstate: Add xsaves_nmi() helper

This commit adds a new xsaves_nmi() helper to safely save supported xsave
states from within an NMI handler. The helper is intended for the perf
subsystem to snapshot SIMD and APX eGPRs registers.

> diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
> index a7b6524a9dea2..d39c01546dee7 100644
> --- a/arch/x86/kernel/fpu/xstate.c
> +++ b/arch/x86/kernel/fpu/xstate.c

[ ... ]

> +void xsaves_nmi(struct xregs_state *xstate, u64 mask)
> +{
> +	int err;
> +
> +	if (!in_nmi())
> +		return;
> +
> +	XSTATE_OP(XSAVES, xstate, (u32)mask, (u32)(mask >> 32), err);

[Severity: High]
Does this code leak stale data into the perf samples? 

The XSAVES instruction uses a hardware modified optimization that tracks
whether a state component was modified since the last XRSTORS. If a
component is unmodified, XSAVES skips writing it to memory while still
setting its presence bit in the XSTATE_BV header.

When the perf subsystem calls xsaves_nmi() in x86_pmu_sample_xregs()
with an independent per-CPU buffer like ext_regs_buf, skipping the memory
write leaves whatever stale data was previously in that buffer.

Because the bit in XSTATE_BV is still set, won't the perf subsystem
read this stale data (potentially from other tasks) and leak it to
user-space?

> +	WARN_ON_ONCE(err);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706015439.3040804-1-dapeng1.mi@linux.intel.com?part=7