Re: [Patch v8 07/23] x86/fpu/xstate: Add xsaves_nmi() helper

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Executing XSAVES blindly from an NMI context captures in-flight kernel FPU state, leading to a severe information leak via perf REGS_INTR.
--

commit d34a5f4e0fb88fb36d75fc06f907af1f26922ffe
Author: Kan Liang <kan.liang@linux.intel.com>

x86/fpu/xstate: Add xsaves_nmi() helper

This commit introduces the xsaves_nmi() function to allow saving supported
xsave states directly from an NMI handler. It is currently intended for use
by the perf subsystem to snapshot SIMD and APX eGPRs registers.

> diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
> index a7b6524a9dea2..4394091c47910 100644
> --- a/arch/x86/kernel/fpu/xstate.c
> +++ b/arch/x86/kernel/fpu/xstate.c

[ ... ]

> @@ -1474,6 +1474,29 @@ void xrstors(struct xregs_state *xstate, u64 mask)
>  	WARN_ON_ONCE(err);
>  }
>  
> +/**
> + * xsaves_nmi - Save selected components to a kernel xstate buffer in NMI
> + * @xstate:	Pointer to the buffer
> + * @mask:	Feature mask to select the components to save
> + *
> + * This function is similar to xsaves(), but should only be called within
> + * a NMI handler. This function returns the actual register contents at
> + * the moment the NMI occurs.
> + *
> + * Currently, the perf subsystem is the sole user of this helper. It uses
> + * the function to snapshot SIMD (XMM/YMM/ZMM) and APX eGPRs registers.
> + */
> +void xsaves_nmi(struct xregs_state *xstate, u64 mask)
> +{
> +	int err;
> +
> +	if (!in_nmi())
> +		return;
> +
> +	XSTATE_OP(XSAVES, xstate, (u32)mask, (u32)(mask >> 32), err);

[Severity: High]
Could executing XSAVES directly from an NMI context capture in-flight kernel
FPU state and lead to an information leak via perf REGS_INTR?

If an unprivileged user creates a hardware perf event with exclude_kernel=1
and requests PERF_SAMPLE_REGS_INTR, they bypass the perf_allow_kernel()
privilege check. Due to hardware skid, a PMI might be delivered after the CPU
has already transitioned into kernel space.

If the interrupted kernel context is actively using the FPU (for example,
inside kernel_fpu_begin() for cryptographic operations), the hardware FPU
registers would contain kernel data.

Since this helper captures the hardware FPU state unconditionally, and the
perf subsystem does not discard or filter REGS_INTR samples based on
privilege when a skid into kernel mode occurs, will this export sensitive
kernel SIMD registers to the unprivileged user's ring buffer?

> +	WARN_ON_ONCE(err);
> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260529075645.580362-1-dapeng1.mi@linux.intel.com?part=7