Re: [PATCH 10/10] arm64: Check DAIF (and PMR) at task-switch time

Jinjie Ruan
2026-04-08T02:18:20Z

On 2026/4/7 21:16, Mark Rutland wrote:
> When __switch_to() switches from a 'prev' task to a 'next' task, various
> pieces of CPU state are expected to have specific values, such that
> these do not need to be saved/restored. If any of these hold an
> unexpected value when switching away from the prev task, they could lead
> to surprising behaviour in the context of the next task, and it would be
> difficult to determine where they were configured to their unexpected
> value.
>
> Add some checks for DAIF and PMR at task-switch time so that we can
> detect such issues.
>
> Signed-off-by: Mark Rutland <mark.rutland@arm.com>
> Cc: Andy Lutomirski <luto@kernel.org>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Jinjie Ruan <ruanjinjie@huawei.com>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Thomas Gleixner <tglx@kernel.org>
> Cc: Vladimir Murzin <vladimir.murzin@arm.com>
> Cc: Will Deacon <will@kernel.org>
> ---
> arch/arm64/kernel/process.c | 25 +++++++++++++++++++++++++
> 1 file changed, 25 insertions(+)
>
> diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
> index 489554931231e..ba9038434d2fb 100644
> --- a/arch/arm64/kernel/process.c
> +++ b/arch/arm64/kernel/process.c
> @@ -699,6 +699,29 @@ void update_sctlr_el1(u64 sctlr)
> isb();
> }
>
> +static inline void debug_switch_state(void)
> +{
> + if (system_uses_irq_prio_masking()) {
> + unsigned long daif_expected = 0;
> + unsigned long daif_actual = read_sysreg(daif);
> + unsigned long pmr_expected = GIC_PRIO_IRQOFF;
> + unsigned long pmr_actual = read_sysreg_s(SYS_ICC_PMR_EL1);
> +
> + WARN_ONCE(daif_actual != daif_expected ||
> + pmr_actual != pmr_expected,
> + "Unexpected DAIF + PMR: 0x%lx + 0x%lx (expected 0x%lx + 0x%lx)\n",
> + daif_actual, pmr_actual,
> + daif_expected, pmr_expected);
> + } else {
> + unsigned long daif_expected = DAIF_PROCCTX_NOIRQ;
> + unsigned long daif_actual = read_sysreg(daif);
> +
> + WARN_ONCE(daif_actual != daif_expected,
> + "Unexpected DAIF value: 0x%lx (expected 0x%lx)\n",
> + daif_actual, daif_expected);
> + }

This logic seems consistent with arm64's local_irq_disable()
implementation. Do we need to wrap these debug checks in a config option
(e.g., CONFIG_ARM64_DEBUG_PRIORITY_MASKING) to avoid unnecessary overhead?

__schedule()
-> local_irq_disable()
-> arch_local_irq_disable()

52 static __always_inline void __daif_local_irq_disable(void)
53 {
54 barrier();
55 asm volatile("msr daifset, #3");
56 barrier();
57 }
58
59 static __always_inline void __pmr_local_irq_disable(void)
60 {
61 if (IS_ENABLED(CONFIG_ARM64_DEBUG_PRIORITY_MASKING)) {
62 u32 pmr = read_sysreg_s(SYS_ICC_PMR_EL1);
63 WARN_ON_ONCE(pmr != GIC_PRIO_IRQON && pmr !=
GIC_PRIO_IRQOFF);
64 }
65
66 barrier();
67 write_sysreg_s(GIC_PRIO_IRQOFF, SYS_ICC_PMR_EL1);
68 barrier();
69 }
70
71 static inline void arch_local_irq_disable(void)
72 {
73 if (system_uses_irq_prio_masking()) {
74 __pmr_local_irq_disable();
75 } else {
76 __daif_local_irq_disable();
77 }
78 }

> +}
> +
> /*
> * Thread switching.
> */
> @@ -708,6 +731,8 @@ struct task_struct *__switch_to(struct task_struct *prev,
> {
> struct task_struct *last;
>
> + debug_switch_state();
> +
> fpsimd_thread_switch(next);
> tls_thread_switch(next);
> hw_breakpoint_thread_switch(next);