From: Breno Leitao <leitao@debian.org>
To: Mark Rutland <mark.rutland@arm.com>
Cc: Vladimir Murzin <vladimir.murzin@arm.com>,
rmikey@meta.com,
"Peter Zijlstra \(Intel\)" <peterz@infradead.org>,
Catalin Marinas <catalin.marinas@arm.com>,
Jinjie Ruan <ruanjinjie@huawei.com>,
kernel-team@meta.com, linux-kernel@vger.kernel.org,
bpf@vger.kernel.org, Will Deacon <will@kernel.org>,
linux-arm-kernel@lists.infradead.org
Subject: Re: [PATCH RFC] arm64: entry: PSTATE_I_SET is leaking on pseudo NMI mode
Date: Fri, 7 Aug 2026 09:29:12 -0700 [thread overview]
Message-ID: <anYHjvJ1_4dDjuzw@gmail.com> (raw)
In-Reply-To: <anXqMsJ14r3BAbMG@gmail.com>
On Fri, Aug 07, 2026 at 07:58:21AM -0700, Breno Leitao wrote:
> Meanwhile, I will try to ftrace the writes to PMR and regs->pmr to get
> a better grasp of the states machine we are in (probably on Monday).
It seems LLM found a very easy to reproduce this:
bash-5.1# dmesg
bash-5.1# cd /sys/kernel/tracing
echo 'r:pmr vfs_read bad=+0($retval):u64' >> kprobe_events
echo 1 > events/kprobes/pmr/enable
bash-5.1# dmesg
[ 54.997498] ------------[ cut here ]------------
[ 54.997506] WARNING: ./arch/arm64/include/asm/irqflags.h:63 at arm64_exit_to_kernel_mode+0xc0/0xc8, CPU#1: bash/185
[ 54.997530] Modules linked in:
[ 54.997535] CPU: 1 UID: 0 PID: 185 Comm: bash Not tainted 7.2.0-rc6-next-20260806upstream #15 PREEMPT(full)
[ 54.997538] Hardware name: linux,dummy-virt (DT)
[ 54.997540] pstate: 234003c5 (nzCv DAIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
[ 54.997542] pc : arm64_exit_to_kernel_mode+0xc0/0xc8
[ 54.997544] lr : el1_abort+0x5c/0x80
[ 54.997547] sp : ffff800088ba35f0
[ 54.997548] pmr: 000000f0
[ 54.997550] x29: ffff800088ba35f0 x28: ffff0000c3cd0000 x27: 0000000000000000
[ 54.997554] x26: ffff0000c3f277d0 x25: 0000000000000030 x24: 0000000000000001
[ 54.997557] x23: 00000000834003c5 x22: 0000000000000000 x21: 0000000000000001
[ 54.997566] x20: ffff800088ba3650 x19: 0000000000000000 x18: 0000000000000000
[ 54.997569] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
[ 54.997572] x14: 0000000040000000 x13: ffff800086b171f8 x12: fff080007fe00000
[ 54.997576] x11: 0000000000000001 x10: aaaaaaaaaaaaaaab x9 : 000000000000001f
[ 54.997579] x8 : 00000000000000d0 x7 : 0000000000000000 x6 : ffff0000c0adf02c
[ 54.997582] x5 : ffff0000c0adf034 x4 : ffff800081408b08 x3 : 000000000000000c
[ 54.997585] x2 : 00000000000002fe x1 : 0000000000000000 x0 : ffff800088ba3650
[ 54.997589] Call trace:
[ 54.997590] arm64_exit_to_kernel_mode+0xc0/0xc8 (P)
[ 54.997593] el1_abort+0x5c/0x80
[ 54.997595] el1h_64_sync_handler+0x50/0x100
[ 54.997597] el1h_64_sync+0x80/0x88
[ 54.997601] __arch_copy_from_user+0x220/0x240 (P)
[ 54.997604] process_fetch_insn+0x450/0x8b0
[ 54.997608] kretprobe_trace_func+0x1b0/0x298
[ 54.997611] kretprobe_dispatcher+0x5c/0x88
[ 54.997613] __kretprobe_trampoline_handler+0xc4/0x168
[ 54.997617] kretprobe_brk_handler+0x40/0x68
[ 54.997620] call_el1_break_hook+0x74/0xa0
[ 54.997623] do_el1_brk64+0x30/0x60
[ 54.997624] el1_brk64+0x2c/0x48
[ 54.997626] el1h_64_sync_handler+0x80/0x100
[ 54.997628] el1h_64_sync+0x80/0x88
[ 54.997630] ksys_read+0x80/0x100 (P)
[ 54.997634] __arm64_sys_read+0x28/0x40
[ 54.997636] invoke_syscall+0x54/0xf0
[ 54.997640] do_el0_svc+0x7c/0xb8
[ 54.997642] el0_svc+0x60/0x188
[ 54.997644] el0t_64_sync_handler+0x84/0x130
[ 54.997645] el0t_64_sync+0x1ac/0x1b0
[ 54.997647] ---[ end trace 0000000000000000 ]---
WARNING: multiple messages have this Message-ID (diff)
From: Breno Leitao <leitao@debian.org>
To: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will@kernel.org>,
"Peter Zijlstra (Intel)" <peterz@infradead.org>,
Jinjie Ruan <ruanjinjie@huawei.com>,
linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org, bpf@vger.kernel.org,
rmikey@meta.com, kernel-team@meta.com,
Vladimir Murzin <vladimir.murzin@arm.com>,
Ada Couprie Diaz <ada.coupriediaz@arm.com>
Subject: Re: [PATCH RFC] arm64: entry: PSTATE_I_SET is leaking on pseudo NMI mode
Date: Fri, 7 Aug 2026 09:29:12 -0700 [thread overview]
Message-ID: <anYHjvJ1_4dDjuzw@gmail.com> (raw)
In-Reply-To: <anXqMsJ14r3BAbMG@gmail.com>
On Fri, Aug 07, 2026 at 07:58:21AM -0700, Breno Leitao wrote:
> Meanwhile, I will try to ftrace the writes to PMR and regs->pmr to get
> a better grasp of the states machine we are in (probably on Monday).
It seems LLM found a very easy to reproduce this:
bash-5.1# dmesg
bash-5.1# cd /sys/kernel/tracing
echo 'r:pmr vfs_read bad=+0($retval):u64' >> kprobe_events
echo 1 > events/kprobes/pmr/enable
bash-5.1# dmesg
[ 54.997498] ------------[ cut here ]------------
[ 54.997506] WARNING: ./arch/arm64/include/asm/irqflags.h:63 at arm64_exit_to_kernel_mode+0xc0/0xc8, CPU#1: bash/185
[ 54.997530] Modules linked in:
[ 54.997535] CPU: 1 UID: 0 PID: 185 Comm: bash Not tainted 7.2.0-rc6-next-20260806upstream #15 PREEMPT(full)
[ 54.997538] Hardware name: linux,dummy-virt (DT)
[ 54.997540] pstate: 234003c5 (nzCv DAIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
[ 54.997542] pc : arm64_exit_to_kernel_mode+0xc0/0xc8
[ 54.997544] lr : el1_abort+0x5c/0x80
[ 54.997547] sp : ffff800088ba35f0
[ 54.997548] pmr: 000000f0
[ 54.997550] x29: ffff800088ba35f0 x28: ffff0000c3cd0000 x27: 0000000000000000
[ 54.997554] x26: ffff0000c3f277d0 x25: 0000000000000030 x24: 0000000000000001
[ 54.997557] x23: 00000000834003c5 x22: 0000000000000000 x21: 0000000000000001
[ 54.997566] x20: ffff800088ba3650 x19: 0000000000000000 x18: 0000000000000000
[ 54.997569] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000001
[ 54.997572] x14: 0000000040000000 x13: ffff800086b171f8 x12: fff080007fe00000
[ 54.997576] x11: 0000000000000001 x10: aaaaaaaaaaaaaaab x9 : 000000000000001f
[ 54.997579] x8 : 00000000000000d0 x7 : 0000000000000000 x6 : ffff0000c0adf02c
[ 54.997582] x5 : ffff0000c0adf034 x4 : ffff800081408b08 x3 : 000000000000000c
[ 54.997585] x2 : 00000000000002fe x1 : 0000000000000000 x0 : ffff800088ba3650
[ 54.997589] Call trace:
[ 54.997590] arm64_exit_to_kernel_mode+0xc0/0xc8 (P)
[ 54.997593] el1_abort+0x5c/0x80
[ 54.997595] el1h_64_sync_handler+0x50/0x100
[ 54.997597] el1h_64_sync+0x80/0x88
[ 54.997601] __arch_copy_from_user+0x220/0x240 (P)
[ 54.997604] process_fetch_insn+0x450/0x8b0
[ 54.997608] kretprobe_trace_func+0x1b0/0x298
[ 54.997611] kretprobe_dispatcher+0x5c/0x88
[ 54.997613] __kretprobe_trampoline_handler+0xc4/0x168
[ 54.997617] kretprobe_brk_handler+0x40/0x68
[ 54.997620] call_el1_break_hook+0x74/0xa0
[ 54.997623] do_el1_brk64+0x30/0x60
[ 54.997624] el1_brk64+0x2c/0x48
[ 54.997626] el1h_64_sync_handler+0x80/0x100
[ 54.997628] el1h_64_sync+0x80/0x88
[ 54.997630] ksys_read+0x80/0x100 (P)
[ 54.997634] __arm64_sys_read+0x28/0x40
[ 54.997636] invoke_syscall+0x54/0xf0
[ 54.997640] do_el0_svc+0x7c/0xb8
[ 54.997642] el0_svc+0x60/0x188
[ 54.997644] el0t_64_sync_handler+0x84/0x130
[ 54.997645] el0t_64_sync+0x1ac/0x1b0
[ 54.997647] ---[ end trace 0000000000000000 ]---
next prev parent reply other threads:[~2026-08-07 16:29 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-07 11:45 [PATCH RFC] arm64: entry: PSTATE_I_SET is leaking on pseudo NMI mode Breno Leitao
2026-08-07 13:40 ` Will Deacon
2026-08-07 13:40 ` Will Deacon
2026-08-07 13:57 ` Mark Rutland
2026-08-07 13:57 ` Mark Rutland
2026-08-07 14:49 ` Vladimir Murzin
2026-08-07 14:49 ` Vladimir Murzin
2026-08-10 12:44 ` Jinjie Ruan
2026-08-10 12:44 ` Jinjie Ruan
2026-08-10 13:04 ` Vladimir Murzin
2026-08-10 13:04 ` Vladimir Murzin
2026-08-11 2:47 ` Jinjie Ruan
2026-08-11 2:47 ` Jinjie Ruan
2026-08-11 8:18 ` Vladimir Murzin
2026-08-11 8:18 ` Vladimir Murzin
2026-08-07 14:58 ` Breno Leitao
2026-08-07 14:58 ` Breno Leitao
2026-08-07 16:29 ` Breno Leitao [this message]
2026-08-07 16:29 ` Breno Leitao
2026-08-10 11:43 ` Will Deacon
2026-08-10 11:43 ` Will Deacon
2026-08-10 12:42 ` Vladimir Murzin
2026-08-10 12:42 ` Vladimir Murzin
2026-08-10 15:05 ` Will Deacon
2026-08-10 15:05 ` Will Deacon
2026-08-10 16:39 ` Vladimir Murzin
2026-08-10 16:39 ` Vladimir Murzin
2026-08-10 12:51 ` Jinjie Ruan
2026-08-10 12:51 ` Jinjie Ruan
2026-08-10 12:59 ` Breno Leitao
2026-08-10 12:59 ` Breno Leitao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=anYHjvJ1_4dDjuzw@gmail.com \
--to=leitao@debian.org \
--cc=bpf@vger.kernel.org \
--cc=catalin.marinas@arm.com \
--cc=kernel-team@meta.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=peterz@infradead.org \
--cc=rmikey@meta.com \
--cc=ruanjinjie@huawei.com \
--cc=vladimir.murzin@arm.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.