Re: [RESEND Patch v10 06/23] x86/fpu/xstate: Add xsaves_nmi() helper

["Mi, Dapeng" <dapeng1.mi@linux.intel.com>]

On 8/24/2026 4:54 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Critical] xsaves_nmi() uses the XSAVES instruction which employs hardware 'modified optimization', causing catastrophic data corruption for the interrupted task.
> --
>
> --- Patch [6]: [RESEND Patch v10 06/23] x86/fpu/xstate: Add xsaves_nmi() helper ---
> commit 2691ef22b25df7392d6766bb1de8a6d97a6ee37c
> Author: Kan Liang <kan.liang@linux.intel.com>
>
>     x86/fpu/xstate: Add xsaves_nmi() helper
>
> This commit introduces the xsaves_nmi() helper function to allow the perf
> subsystem to save supported xsave states within an NMI handler. It is intended
> to snapshot SIMD and APX eGPR registers at the exact moment an NMI occurs.
>
>> diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
>> index a7b6524a9dea2..d39c01546dee7 100644
>> --- a/arch/x86/kernel/fpu/xstate.c
>> +++ b/arch/x86/kernel/fpu/xstate.c
> [ ... ]
>> @@ -1474,6 +1474,29 @@ void xrstors(struct xregs_state *xstate, u64 mask)
> [ ... ]
>> +void xsaves_nmi(struct xregs_state *xstate, u64 mask)
>> +{
>> +	int err;
>> +
>> +	if (!in_nmi())
>> +		return;
>> +
>> +	XSTATE_OP(XSAVES, xstate, (u32)mask, (u32)(mask >> 32), err);
> [Severity: Critical]
> Does executing the xsaves instruction in this context corrupt the FPU state of
> the interrupted task?
>
> According to the Intel SDM, the xsaves instruction employs a modified
> optimization that unconditionally resets the CPU internal state-component
> tracking, marking all components as unmodified.
>
> If a task is interrupted by an NMI (such as a perf PMI) and this instruction
> executes, won't the subsequent context switch out of the task also see the
> state as unmodified? It seems the normal context-switch xsaves would silently
> skip saving the state to the task FPU buffer, losing any SIMD modifications
> made prior to the NMI.
>
> Additionally, since xsaves skips writing components it considers unmodified,
> could this leak stale SIMD state from previously interrupted tasks into the
> current perf sample buffer?

No, modified optimization is bound with the xstate buffer. Currently perf
use xsaves_nmi() with an dedicated xstate buffer and each sampling xstate
would be cleared before calling the xsaves_nmi(). So it won't impact other
xsaves usages and leak the stale xstate information.

Thanks.


>
>> +	WARN_ON_ONCE(err);
>> +}