Re: [Patch v9 07/24] x86/fpu/xstate: Add xsaves_nmi() helper

["Mi, Dapeng" <dapeng1.mi@linux.intel.com>]

On 7/6/2026 10:18 AM, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] The use of the XSAVES instruction in xsaves_nmi() breaks FPU snapshotting to independent buffers due to the hardware's 'modified optimization', leading to a cross-process information leak.
> --
>
> commit e8d6f39a5d4512be90e9976febc30b8f46c0ea64
> Author: Kan Liang <kan.liang@linux.intel.com>
>
> x86/fpu/xstate: Add xsaves_nmi() helper
>
> This commit adds a new xsaves_nmi() helper to safely save supported xsave
> states from within an NMI handler. The helper is intended for the perf
> subsystem to snapshot SIMD and APX eGPRs registers.
>
>> diff --git a/arch/x86/kernel/fpu/xstate.c b/arch/x86/kernel/fpu/xstate.c
>> index a7b6524a9dea2..d39c01546dee7 100644
>> --- a/arch/x86/kernel/fpu/xstate.c
>> +++ b/arch/x86/kernel/fpu/xstate.c
> [ ... ]
>
>> +void xsaves_nmi(struct xregs_state *xstate, u64 mask)
>> +{
>> +	int err;
>> +
>> +	if (!in_nmi())
>> +		return;
>> +
>> +	XSTATE_OP(XSAVES, xstate, (u32)mask, (u32)(mask >> 32), err);
> [Severity: High]
> Does this code leak stale data into the perf samples? 
>
> The XSAVES instruction uses a hardware modified optimization that tracks
> whether a state component was modified since the last XRSTORS. If a
> component is unmodified, XSAVES skips writing it to memory while still
> setting its presence bit in the XSTATE_BV header.
>
> When the perf subsystem calls xsaves_nmi() in x86_pmu_sample_xregs()
> with an independent per-CPU buffer like ext_regs_buf, skipping the memory
> write leaves whatever stale data was previously in that buffer.
>
> Because the bit in XSTATE_BV is still set, won't the perf subsystem
> read this stale data (potentially from other tasks) and leak it to
> user-space?

No, not exactly. The modified optimization only works when xrstors is
called for the same xstate area.

Copy the description about modified optimization from section 13.6 in SDM
vol. 1.

"

A processor that implements the modified optimization saves information
about the most recent execution of
XRSTOR or XRSTORS in a quantity called XRSTOR_INFO, a 4-tuple containing
the following: (1) the CPL;
(2) whether the logical processor was in VMX non-root operation; (3) *the
linear address of the XSAVE area; *and
(4) the XCOMP_BV field in the XSAVE area. An execution of XSAVEOPT or
XSAVES uses the modified optimization
only if that execution corresponds to XRSTOR_INFO on these four parameters.

"

Since xsaves_nmi() uses a dedicated xstate area and never call xrstors
instruction for this dedicated xstate area, the modified optimization won't
really happen.

Thanks.


>
>> +	WARN_ON_ONCE(err);
>> +}