Re: [RESEND Patch v10 15/23] perf/x86: Support ZMM sampling using sample_simd_vec_reg_* fields

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Relaxed vector mask validation allows users to request sampling of XMM16-31 and YMM16-31 registers, but the kernel silently outputs zeroes for them.
--

--- Patch [15]: [RESEND Patch v10 15/23] perf/x86: Support ZMM sampling using sample_simd_vec_reg_* fields ---
commit 88766819a94c672c41219599404eada3a0d0fa19
Author: Dapeng Mi <dapeng1.mi@linux.intel.com>

perf/x86: Support ZMM sampling using sample_simd_vec_reg_* fields

This patch adds support for sampling up to 32 ZMM registers via the
sample_simd_vec_reg_* fields. ZMM0-15 are assembled from XMM, YMMH,
and ZMMH components, while ZMM16-31 are extracted as a whole.

> diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
> index 01de7799f907b..f59551200f18c 100644
> --- a/arch/x86/events/perf_event.h
> +++ b/arch/x86/events/perf_event.h
[ ... ]
> @@ -209,6 +209,60 @@ static inline bool event_needs_ymm(struct perf_event *event)
[ ... ]
> +static inline bool __event_needs_high16_zmm(struct perf_event *event,
> +					    u64 sample_type)
> +{
> +	if (!event->attr.sample_simd_regs_enabled)
> +		return false;
> +	if (event->attr.sample_simd_vec_reg_qwords < PERF_X86_ZMM_QWORDS)
> +		return false;

[Severity: Medium]
Will this abort collection of high-register state for XMM16-31 or YMM16-31
requests?

When sample_simd_vec_reg_qwords is less than PERF_X86_ZMM_QWORDS (e.g., 2 for
XMM or 4 for YMM), this returns false. Consequently, the hardware state for
the high 16 registers is not extracted.

> +
> +	if ((sample_type & PERF_SAMPLE_REGS_USER) &&
[ ... ]
> diff --git a/arch/x86/kernel/perf_regs.c b/arch/x86/kernel/perf_regs.c
> index 0076974498eee..93370d4657860 100644
> --- a/arch/x86/kernel/perf_regs.c
> +++ b/arch/x86/kernel/perf_regs.c
[ ... ]
> @@ -123,7 +136,8 @@ int perf_simd_reg_validate(u16 vec_qwords, u64 vec_mask,
>  
>  	if (vec_qwords) {
>  		if (vec_qwords != PERF_X86_XMM_QWORDS &&
> -		    vec_qwords != PERF_X86_YMM_QWORDS)
> +		    vec_qwords != PERF_X86_YMM_QWORDS &&
> +		    vec_qwords != PERF_X86_ZMM_QWORDS)
>  			return -EINVAL;
>  		if (vec_mask & ~PERF_X86_SIMD_VEC_MASK)
>  			return -EINVAL;

[Severity: Medium]
Does this validation allow users to request sampling of XMM16-31 and YMM16-31
registers?

With PERF_X86_SIMD_VEC_MASK expanded to 32 bits, this check now allows bits
16-31 to be set in the user mask for XMM and YMM requests.

Because bitmap_full(&mask, PERF_X86_SIMD_XMM_REGS) only validates that the
first 16 bits are set and ignores the rest, it won't reject masks that include
the upper 16 registers.

Combined with __event_needs_high16_zmm() returning false for non-ZMM requests,
does this mean the kernel will silently accept invalid UAPI configurations for
XMM16-31/YMM16-31 and return zeroes to userspace instead of actual data or an
error?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260824082731.1013973-1-dapeng1.mi@linux.intel.com?part=15