[PATCH] perf/x86/intel: Don't allow extended register sampling for BTS events

[PATCH] perf/x86/intel: Don't allow extended register sampling for BTS events

[Jiwoo Kim]

x86_pmu_hw_config() accepts extended (XMM) register sampling in
REGS_USER for events without precise_ip, and the same goes for the SIMD
register fields. The BTS event is such an event, and
intel_pmu_bts_config() does not reject it.

For a sample taken in the PMI handler, x86_pmu_update_perf_regs() copies
the user registers into the per-CPU x86_user_regs, which is a struct
x86_perf_regs. That is what perf_reg_value() and perf_simd_reg_value()
expect: they use container_of() on the sampled struct pt_regs to reach
the fields that follow it.

intel_pmu_drain_bts_buffer() does not call x86_pmu_update_perf_regs().
It passes zeroed on-stack registers to perf_prepare_sample(), so the
generic perf_sample_regs_user() takes the user registers from
perf_get_regs_user(). That returns task_pt_regs(current), or on x86_64,
when the buffer is drained from the PMI handler, a copy in the per-CPU
nmi_user_regs, and neither is embedded in a struct x86_perf_regs. For a
BTS event that requests these registers in REGS_USER, perf_reg_value()
and perf_simd_reg_value() therefore read past the end of the struct
pt_regs they are given, and use the words found there as pointers.
REGS_INTR is not affected: BTS events must set exclude_kernel, and
perf_sample_regs_intr() then reports no registers, as the zeroed ones
are not user mode.

BTS samples are built from the BTS buffer when it is drained, not from
the registers of an interrupted context, so there is nothing meaningful
to report in these registers for them. Reject extended and SIMD
register sampling for BTS events in intel_pmu_bts_config(), as was the
case before these registers could be sampled for events without
precise_ip.

This was found with an AI coding assistant, which also drafted this
patch and its changelog. It has not been reproduced, and the change
has only been compile-tested.

Fixes: edd9aec51213 ("perf/x86: Enable XMM register sampling for REGS_USER case")
Signed-off-by: Jiwoo Kim <arpe1618@gmail.com>
---
No Cc: stable, as the Fixes target first appeared in v7.4-rc1.

The container_of() on a struct pt_regs that is not embedded in a struct
x86_perf_regs came up in the review of v10 of the SIMD sampling series,
for software events and bpf_perf_event_output():
https://lore.kernel.org/r/20260824091225.514D71F000E9@smtp.kernel.org
The reply there pointed out that the PMU capability checks reject those
events. The BTS event is created on the core PMU, which has
PERF_PMU_CAP_EXTENDED_REGS (and PERF_PMU_CAP_SIMD_REGS where supported),
so those checks do not stop it.

 arch/x86/events/intel/core.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index 0a34d674df59..88a60d3e4eeb 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -4778,6 +4778,16 @@ static int intel_pmu_bts_config(struct perf_event *event)
 		if (attr->precise_ip)
 			return -EOPNOTSUPP;
 
+		/*
+		 * BTS samples are built from the BTS buffer when it is drained,
+		 * not from the registers of an interrupted context, and
+		 * intel_pmu_drain_bts_buffer() does not provide the registers in
+		 * the struct x86_perf_regs layout that extended register sampling
+		 * relies on.
+		 */
+		if (event_has_extended_regs(event) || event_has_simd_regs(event))
+			return -EOPNOTSUPP;
+
 		/* disallow bts if conflicting events are present */
 		if (x86_add_exclusive(x86_lbr_exclusive_lbr))
 			return -EBUSY;

base-commit: 59f1398140869432c7171b9a2a279ca315467c4e
-- 
2.43.0