Re: [RESEND Patch v10 06/23] x86/fpu/xstate: Add xsaves_nmi() helper

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] xsaves_nmi() uses the XSAVES instruction which employs hardware 'modified optimization', causing catastrophic data corruption for the interrupted task.
--

--- Patch [6]: [RESEND Patch v10 06/23] x86/fpu/xstate: Add xsaves_nmi() helper ---
commit 2691ef22b25df7392d6766bb1de8a6d97a6ee37c
Author: Kan Liang <kan.liang@linux.intel.com>

    x86/fpu/xstate: Add xsaves_nmi() helper

This commit introduces the xsaves_nmi() helper function to allow the perf
subsystem to save supported xsave states within an NMI handler. It is intended
to snapshot SIMD and APX eGPR registers at the exact moment an NMI occurs.

> diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
> index a7b6524a9dea2..d39c01546dee7 100644
> --- a/arch/x86/kernel/fpu/xstate.c
> +++ b/arch/x86/kernel/fpu/xstate.c
[ ... ]
> @@ -1474,6 +1474,29 @@ void xrstors(struct xregs_state *xstate, u64 mask)
[ ... ]
> +void xsaves_nmi(struct xregs_state *xstate, u64 mask)
> +{
> +	int err;
> +
> +	if (!in_nmi())
> +		return;
> +
> +	XSTATE_OP(XSAVES, xstate, (u32)mask, (u32)(mask >> 32), err);

[Severity: Critical]
Does executing the xsaves instruction in this context corrupt the FPU state of
the interrupted task?

According to the Intel SDM, the xsaves instruction employs a modified
optimization that unconditionally resets the CPU internal state-component
tracking, marking all components as unmodified.

If a task is interrupted by an NMI (such as a perf PMI) and this instruction
executes, won't the subsequent context switch out of the task also see the
state as unmodified? It seems the normal context-switch xsaves would silently
skip saving the state to the task FPU buffer, losing any SIMD modifications
made prior to the NMI.

Additionally, since xsaves skips writing components it considers unmodified,
could this leak stale SIMD state from previously interrupted tasks into the
current perf sample buffer?

> +	WARN_ON_ONCE(err);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260824082731.1013973-1-dapeng1.mi@linux.intel.com?part=6