Re: [Patch v5 02/18] perf/x86/intel: Validate LBR XSAVE state before updating LBR stack

[Mi, Dapeng]

On 10/29/2026 5:40 PM, Peter Zijlstra wrote:
> On Thu, Oct 29, 2026 at 12:38:58PM +0800, Dapeng Mi wrote:
>> intel_pmu_arch_lbr_read_xsave() doesn't check if the LBR data is present
>> in the xsave area. If LBR data is in the INIT state, the LBR data may not
>> be really written into the xsave area.
>>
>> Add an explicit LBR XSAVE state presence check before updating the cached
>> LBR stack. Also clear the cached LBR stack when intel_pmu_lbr_reset() is
>> called, in addition to resetting the hardware LBR register file, to prevent
>> stale LBR data from being reused after a context switch or similar
>> transition.
>>
>> Fixes: c085fb877467 ("perf/x86/intel/lbr: Support XSAVES for arch LBR read")
>> Signed-off-by: Dapeng Mi <dapeng1.mi@xxxxxxxxxxxxxxx>
>> ---
>>  arch/x86/events/intel/lbr.c | 10 +++++++++-
>>  1 file changed, 9 insertions(+), 1 deletion(-)
>>
>> diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
>> index 0b446d8912e4..a2e4ba7e1a4f 100644
>> --- a/arch/x86/events/intel/lbr.c
>> +++ b/arch/x86/events/intel/lbr.c
>> @@ -193,6 +193,8 @@ void intel_pmu_lbr_reset(void)
>>  {
>>  	struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
>>  
>> +	cpuc->lbr_stack.nr = 0;
>> +
>>  	if (!x86_pmu.lbr_nr)
>>  		return;
>>  
> This also clears the stack if there is no LBR; was that on purpose? The
> Changelog is silent on this point.

Yes, it's on purpose. The intent is to clear the cached software LBR stack
as well when resetting the hardware LBR stack. This is to avoid leak the
LBR stack information in some unexpected cases. In theory, it can be placed
after the !x86_pmu.lbr_nr, I hope the software LBR stack can always be
cleared regardless of there is LBR user or not.

My fault, I missed to describe this change in the change log. I would add
it in next version.

Thanks.


>
>> @@ -1010,9 +1012,15 @@ static void intel_pmu_arch_lbr_read_xsave(struct cpu_hw_events *cpuc)
>>  		intel_pmu_store_lbr(cpuc, NULL);
>>  		return;
>>  	}
>> +	xsave->header.xfeatures = 0;
>>  	xsaves(&xsave->xsave, XFEATURE_MASK_LBR);
>>  
>> -	intel_pmu_store_lbr(cpuc, xsave->lbr.entries);
>> +	if (xsave->header.xfeatures & XFEATURE_MASK_LBR) {
>> +		intel_pmu_store_lbr(cpuc, xsave->lbr.entries);
>> +	} else {
>> +		/* Clear the LBR stack to avoid leaking stale entries. */
>> +		cpuc->lbr_stack.nr = 0;
>> +	}
>>  }
>>  
>>  void intel_pmu_lbr_read(void)
>> -- 
>> 2.34.1
>>