Re: [PATCH 10/10] arm64: Check DAIF (and PMR) at task-switch time

[Jinjie Ruan]

On 2026/4/7 21:16, Mark Rutland wrote:
> When __switch_to() switches from a 'prev' task to a 'next' task, various
> pieces of CPU state are expected to have specific values, such that
> these do not need to be saved/restored. If any of these hold an
> unexpected value when switching away from the prev task, they could lead
> to surprising behaviour in the context of the next task, and it would be
> difficult to determine where they were configured to their unexpected
> value.
> 
> Add some checks for DAIF and PMR at task-switch time so that we can
> detect such issues.
> 
> Signed-off-by: Mark Rutland <mark.rutland@xxxxxxx>
> Cc: Andy Lutomirski <luto@xxxxxxxxxx>
> Cc: Catalin Marinas <catalin.marinas@xxxxxxx>
> Cc: Jinjie Ruan <ruanjinjie@xxxxxxxxxx>
> Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
> Cc: Thomas Gleixner <tglx@xxxxxxxxxx>
> Cc: Vladimir Murzin <vladimir.murzin@xxxxxxx>
> Cc: Will Deacon <will@xxxxxxxxxx>
> ---
>  arch/arm64/kernel/process.c | 25 +++++++++++++++++++++++++
>  1 file changed, 25 insertions(+)
> 
> diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
> index 489554931231e..ba9038434d2fb 100644
> --- a/arch/arm64/kernel/process.c
> +++ b/arch/arm64/kernel/process.c
> @@ -699,6 +699,29 @@ void update_sctlr_el1(u64 sctlr)
>  	isb();
>  }
>  
> +static inline void debug_switch_state(void)
> +{
> +	if (system_uses_irq_prio_masking()) {
> +		unsigned long daif_expected = 0;
> +		unsigned long daif_actual = read_sysreg(daif);
> +		unsigned long pmr_expected = GIC_PRIO_IRQOFF;
> +		unsigned long pmr_actual = read_sysreg_s(SYS_ICC_PMR_EL1);
> +
> +		WARN_ONCE(daif_actual != daif_expected ||
> +			  pmr_actual != pmr_expected,
> +			  "Unexpected DAIF + PMR: 0x%lx + 0x%lx (expected 0x%lx + 0x%lx)\n",
> +			  daif_actual, pmr_actual,
> +			  daif_expected, pmr_expected);
> +	} else {
> +		unsigned long daif_expected = DAIF_PROCCTX_NOIRQ;
> +		unsigned long daif_actual = read_sysreg(daif);
> +
> +		WARN_ONCE(daif_actual != daif_expected,
> +			  "Unexpected DAIF value: 0x%lx (expected 0x%lx)\n",
> +			  daif_actual, daif_expected);
> +	}

This logic seems consistent with arm64's local_irq_disable()
implementation. Do we need to wrap these debug checks in a config option
(e.g., CONFIG_ARM64_DEBUG_PRIORITY_MASKING) to avoid unnecessary overhead?


__schedule()
  -> local_irq_disable()
    -> arch_local_irq_disable()

52 static __always_inline void __daif_local_irq_disable(void)
 53 {
 54         barrier();
 55         asm volatile("msr daifset, #3");
 56         barrier();
 57 }
 58
 59 static __always_inline void __pmr_local_irq_disable(void)
 60 {
 61         if (IS_ENABLED(CONFIG_ARM64_DEBUG_PRIORITY_MASKING)) {
 62                 u32 pmr = read_sysreg_s(SYS_ICC_PMR_EL1);
 63                 WARN_ON_ONCE(pmr != GIC_PRIO_IRQON && pmr !=
GIC_PRIO_IRQOFF);
 64         }
 65
 66         barrier();
 67         write_sysreg_s(GIC_PRIO_IRQOFF, SYS_ICC_PMR_EL1);
 68         barrier();
 69 }
 70
 71 static inline void arch_local_irq_disable(void)
 72 {
 73         if (system_uses_irq_prio_masking()) {
 74                 __pmr_local_irq_disable();
 75         } else {
 76                 __daif_local_irq_disable();
 77         }
 78 }


> +}
> +
>  /*
>   * Thread switching.
>   */
> @@ -708,6 +731,8 @@ struct task_struct *__switch_to(struct task_struct *prev,
>  {
>  	struct task_struct *last;
>  
> +	debug_switch_state();
> +
>  	fpsimd_thread_switch(next);
>  	tls_thread_switch(next);
>  	hw_breakpoint_thread_switch(next);