Re: [RESEND Patch v10 15/23] perf/x86: Support ZMM sampling using sample_simd_vec_reg_* fields

["Mi, Dapeng" <dapeng1.mi@linux.intel.com>]

On 8/24/2026 4:58 PM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] Relaxed vector mask validation allows users to request sampling of XMM16-31 and YMM16-31 registers, but the kernel silently outputs zeroes for them.
> --
>
> --- Patch [15]: [RESEND Patch v10 15/23] perf/x86: Support ZMM sampling using sample_simd_vec_reg_* fields ---
> commit 88766819a94c672c41219599404eada3a0d0fa19
> Author: Dapeng Mi <dapeng1.mi@linux.intel.com>
>
> perf/x86: Support ZMM sampling using sample_simd_vec_reg_* fields
>
> This patch adds support for sampling up to 32 ZMM registers via the
> sample_simd_vec_reg_* fields. ZMM0-15 are assembled from XMM, YMMH,
> and ZMMH components, while ZMM16-31 are extracted as a whole.
>
>> diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
>> index 01de7799f907b..f59551200f18c 100644
>> --- a/arch/x86/events/perf_event.h
>> +++ b/arch/x86/events/perf_event.h
> [ ... ]
>> @@ -209,6 +209,60 @@ static inline bool event_needs_ymm(struct perf_event *event)
> [ ... ]
>> +static inline bool __event_needs_high16_zmm(struct perf_event *event,
>> +					    u64 sample_type)
>> +{
>> +	if (!event->attr.sample_simd_regs_enabled)
>> +		return false;
>> +	if (event->attr.sample_simd_vec_reg_qwords < PERF_X86_ZMM_QWORDS)
>> +		return false;
> [Severity: Medium]
> Will this abort collection of high-register state for XMM16-31 or YMM16-31
> requests?
>
> When sample_simd_vec_reg_qwords is less than PERF_X86_ZMM_QWORDS (e.g., 2 for
> XMM or 4 for YMM), this returns false. Consequently, the hardware state for
> the high 16 registers is not extracted.
>
>> +
>> +	if ((sample_type & PERF_SAMPLE_REGS_USER) &&
> [ ... ]
>> diff --git a/arch/x86/kernel/perf_regs.c b/arch/x86/kernel/perf_regs.c
>> index 0076974498eee..93370d4657860 100644
>> --- a/arch/x86/kernel/perf_regs.c
>> +++ b/arch/x86/kernel/perf_regs.c
> [ ... ]
>> @@ -123,7 +136,8 @@ int perf_simd_reg_validate(u16 vec_qwords, u64 vec_mask,
>>  
>>  	if (vec_qwords) {
>>  		if (vec_qwords != PERF_X86_XMM_QWORDS &&
>> -		    vec_qwords != PERF_X86_YMM_QWORDS)
>> +		    vec_qwords != PERF_X86_YMM_QWORDS &&
>> +		    vec_qwords != PERF_X86_ZMM_QWORDS)
>>  			return -EINVAL;
>>  		if (vec_mask & ~PERF_X86_SIMD_VEC_MASK)
>>  			return -EINVAL;
> [Severity: Medium]
> Does this validation allow users to request sampling of XMM16-31 and YMM16-31
> registers?
>
> With PERF_X86_SIMD_VEC_MASK expanded to 32 bits, this check now allows bits
> 16-31 to be set in the user mask for XMM and YMM requests.
>
> Because bitmap_full(&mask, PERF_X86_SIMD_XMM_REGS) only validates that the
> first 16 bits are set and ignores the rest, it won't reject masks that include
> the upper 16 registers.
>
> Combined with __event_needs_high16_zmm() returning false for non-ZMM requests,
> does this mean the kernel will silently accept invalid UAPI configurations for
> XMM16-31/YMM16-31 and return zeroes to userspace instead of actual data or an
> error?

Yeah, it's indeed a defect. Would submit a independent patch to enhance the
check. Thanks.


>