From d5bbc9b3d20c3f90b31a64c62bb4a800b9a5941c Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Tue, 5 May 2026 09:22:29 +0100 Subject: [PATCH 1/8] ARM: 9473/1: kprobes: test: add MODULE_DESCRIPTION All loadable modules must have a description, and since commit 6c6c1fc09de3 ("modpost: require a MODULE_DESCRIPTION()"), the kernel build warns about it missing: WARNING: modpost: missing MODULE_DESCRIPTION() in arch/arm/probes/kprobes/test-kprobes.o Add the missing description tags. Noticing that the existing license tag is unnecessarily hidden in an #ifdef section, remove the #ifdef and use conventional placing of the initcall and module_exit tags as well as the license and description. Tested-by: Randy Dunlap # build-tested Reviewed-by: Randy Dunlap Signed-off-by: Arnd Bergmann Signed-off-by: Russell King --- arch/arm/probes/kprobes/test-core.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/arch/arm/probes/kprobes/test-core.c b/arch/arm/probes/kprobes/test-core.c index 7a2baa135f0f..2de28088dac8 100644 --- a/arch/arm/probes/kprobes/test-core.c +++ b/arch/arm/probes/kprobes/test-core.c @@ -1649,24 +1649,16 @@ static int __init run_all_tests(void) return ret; } - +late_initcall(run_all_tests); /* * Module setup */ -#ifdef MODULE - static void __exit kprobe_test_exit(void) { } - -module_init(run_all_tests) module_exit(kprobe_test_exit) + +MODULE_DESCRIPTION("Test code for ARM kprobes"); MODULE_LICENSE("GPL"); - -#else /* !MODULE */ - -late_initcall(run_all_tests); - -#endif From 7e8ee82e69fde9d589272ec5e6f702358903be1f Mon Sep 17 00:00:00 2001 From: Ethan Nelson-Moore Date: Sun, 14 Jun 2026 02:45:38 +0100 Subject: [PATCH 2/8] ARM: 9477/1: Disable broken eBPF JIT on the Risc PC The eBPF JIT unconditionally generates ldrh/strh instructions, which do not function correctly on the Risc PC because its bus is unable to signal half-word accesses. Work around this issue by disabling the eBPF JIT when building for ARMv3 (the Risc PC is the only currently supported machine whose kernel is built for ARMv3). Comments from Ethan Nelson-Moore: From LKML: https://lore.kernel.org/all/CAD++jL=0qYGoygUwGEXQL7C_ROnC7kfpRv8RA+H5tNWwYu+pQA@mail.gmail.com/ The commit message has been updated slightly relative to the version on LKML to clarify that the Risc PC is not actually ARMv3. Fixes: 39c13c204bb1 ("arm: eBPF JIT compiler") Cc: stable@vger.kernel.org Signed-off-by: Ethan Nelson-Moore Reviewed-by: Linus Walleij Signed-off-by: Russell King --- arch/arm/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig index 9187240a02db..b8aa3fcce107 100644 --- a/arch/arm/Kconfig +++ b/arch/arm/Kconfig @@ -98,7 +98,7 @@ config ARM select HAVE_ARCH_TRACEHOOK select HAVE_ARCH_TRANSPARENT_HUGEPAGE if ARM_LPAE select HAVE_ARM_SMCCC if CPU_V7 - select HAVE_EBPF_JIT if !CPU_ENDIAN_BE32 + select HAVE_EBPF_JIT if !CPU_ENDIAN_BE32 && !CPU_32v3 select HAVE_CONTEXT_TRACKING_USER select HAVE_C_RECORDMCOUNT select HAVE_BUILDTIME_MCOUNT_SORT From 8ed9bff906cf8036531d1559f10e82733a52b41f Mon Sep 17 00:00:00 2001 From: Linus Walleij Date: Sat, 4 Jul 2026 21:15:55 +0100 Subject: [PATCH 3/8] ARM: 9481/2: breakpoint: CFI breakpoints only on demand This removes the stub hw_breakpoint_cfi_handler() from ARM, making it not steal breakpoint type 0x03 (ARM_ENTRY_CFI_BREAKPOINT) unless CFI is actively used in the kernel. When not instrumenting with CFI, or when a breakpoint is issued in userspace, we fall through to return 1 from hw_breakpoint_pending() "unhandled fault" so userspace can make use of this breakpoint. Tested with LKDTM and this command line: echo CFI_FORWARD_PROTO > /sys/kernel/debug/provoke-crash/DIRECT still works as expected. Closes: https://lore.kernel.org/lkml/kJqktbpLphg_Pk5I5SPptgTLjl3E3eq5mN5UzCslyFj7Q1Irp-wDid4mj5eQVd2iZtRGXgeZd8goq195EkXdjyt864YMc8mVb2B9NGH91NQ=@protonmail.com/ Fixes: c3f89986fde7 ("ARM: 9391/2: hw_breakpoint: Handle CFI breakpoints") Reported-by: slipher Suggested-by: Mark Rutland Signed-off-by: Linus Walleij Signed-off-by: Russell King --- arch/arm/kernel/hw_breakpoint.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c index cd4b34c96e35..38feb30dfb5f 100644 --- a/arch/arm/kernel/hw_breakpoint.c +++ b/arch/arm/kernel/hw_breakpoint.c @@ -929,10 +929,6 @@ static void hw_breakpoint_cfi_handler(struct pt_regs *regs) break; } } -#else -static void hw_breakpoint_cfi_handler(struct pt_regs *regs) -{ -} #endif /* @@ -964,9 +960,14 @@ static int hw_breakpoint_pending(unsigned long addr, unsigned int fsr, case ARM_ENTRY_SYNC_WATCHPOINT: watchpoint_handler(addr, fsr, regs); break; +#ifdef CONFIG_CFI case ARM_ENTRY_CFI_BREAKPOINT: - hw_breakpoint_cfi_handler(regs); + if (user_mode(regs)) + ret = 1; /* Don't handle userspace BKPT */ + else + hw_breakpoint_cfi_handler(regs); break; +#endif default: ret = 1; /* Unhandled fault. */ } From 8a58a41100ea377e978d99600ec24a9bd0273662 Mon Sep 17 00:00:00 2001 From: Karl Mehltretter Date: Fri, 24 Jul 2026 08:05:31 +0100 Subject: [PATCH 4/8] ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK Commit c6e61c06d606 ("ARM: 9463/1: Allow to enable RT") enabled PREEMPT_RT on ARM but did not select HAVE_POSIX_CPU_TIMERS_TASK_WORK. This leaves CONFIG_POSIX_CPU_TIMERS_TASK_WORK disabled, so CPU timers expire in hard IRQ context. On PREEMPT_RT this makes run_posix_cpu_timers() take the sleeping sighand->siglock: BUG: sleeping function called from invalid context at spinlock_rt.c:48 rt_spin_lock from lock_task_sighand lock_task_sighand from run_posix_cpu_timers run_posix_cpu_timers from update_process_times ARM handles TIF_NOTIFY_RESUME on all return-to-user paths, including v7-M. ARM32 KVM host support was removed by commit 541ad0150ca4 ("arm: Remove 32bit KVM host support"), so the select need not be conditional on KVM. Select it to defer POSIX CPU timer expiry to task context. Reproduced with setrlimit(RLIMIT_CPU, ...) and a busy loop. The same path is used by setitimer(ITIMER_PROF or ITIMER_VIRTUAL) and POSIX CPU timers created with timer_create(). Assisted-by: Claude:claude-fable-5 Fixes: c6e61c06d606 ("ARM: 9463/1: Allow to enable RT") Signed-off-by: Karl Mehltretter Reviewed-by: Arnd Bergmann Reviewed-by: Sebastian Andrzej Siewior Signed-off-by: Russell King --- arch/arm/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig index b8aa3fcce107..bcb53bc9b931 100644 --- a/arch/arm/Kconfig +++ b/arch/arm/Kconfig @@ -133,6 +133,7 @@ config ARM select HAVE_PERF_EVENTS select HAVE_PERF_REGS select HAVE_PERF_USER_STACK_DUMP + select HAVE_POSIX_CPU_TIMERS_TASK_WORK select MMU_GATHER_RCU_TABLE_FREE if SMP && ARM_LPAE select HAVE_REGS_AND_STACK_ACCESS_API select HAVE_RSEQ From e79ca91165d4fd18549c536abdb86101e889052f Mon Sep 17 00:00:00 2001 From: Xie Yuanbin Date: Tue, 28 Jul 2026 03:03:22 +0100 Subject: [PATCH 5/8] ARM: 9484/1: enable interrupts when unhandled user faults are triggered PREEMPT_RT requires interrupts to be enabled when sending signals. When do_DataAbort()/do_PrefetchAbort() triggers unhandled user faults, that is `inf->fn()` return a non-zero value, and the interrupts are not enabled within the hook function, force_sig_fault() will be called with interrupts disabled. This can be triggered by user programs executing the bkpt instruction, with kernel config CONFIG_PERF_EVENTS=n. Enable interrupts in do_DataAbort()/do_PrefetchAbort() when unhandled user faults are triggered to fix the issue. Fixes: c6e61c06d606 ("ARM: 9463/1: Allow to enable RT") Link: https://lore.kernel.org/20260629123349.134224-1-xieyuanbin1@huawei.com Suggested-by: Russell King Reviewed-by: Sebastian Andrzej Siewior Reviewed-by: Linus Walleij Signed-off-by: Xie Yuanbin Signed-off-by: Russell King --- arch/arm/mm/fault.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c index e62cc4be5adf..c68677503532 100644 --- a/arch/arm/mm/fault.c +++ b/arch/arm/mm/fault.c @@ -633,6 +633,9 @@ do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs) if (!inf->fn(addr, fsr & ~FSR_LNX_PF, regs)) return; + if (likely(user_mode(regs))) + local_irq_enable(); + pr_alert("8<--- cut here ---\n"); pr_alert("Unhandled fault: %s (0x%03x) at 0x%08lx\n", inf->name, fsr, addr); @@ -663,6 +666,9 @@ do_PrefetchAbort(unsigned long addr, unsigned int ifsr, struct pt_regs *regs) if (!inf->fn(addr, ifsr | FSR_LNX_PF, regs)) return; + if (likely(user_mode(regs))) + local_irq_enable(); + pr_alert("8<--- cut here ---\n"); pr_alert("Unhandled prefetch abort: %s (0x%03x) at 0x%08lx\n", inf->name, ifsr, addr); From 1039bffd6ae9c75b42b7d148d6c1106134107b66 Mon Sep 17 00:00:00 2001 From: Xie Yuanbin Date: Tue, 28 Jul 2026 03:16:42 +0100 Subject: [PATCH 6/8] ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults When CONFIG_DEBUG_USER=y, and cmdline "user_debug=31" is set, a user fault may trigger show_pte() without any lock. If another thread in the same process concurrently calls munmap(), the page table pages may be freed while show_pte() is still traversing them, causing a use-after-free in show_pte(). If CONFIG_ARM_LPAE=y, this may cause a kernel panic if the pages table of PMD are freed when show_pte() is running. Acquire mmap_write_lock() around show_pte() for user faults to fix the contention. For user faults, additionally restrict that show_pte() is called only when the addr is a user-space address (addr < TASK_SIZE). This is because the lock of tsk->mm only protects the virtual memory of user address space, furthermore, dumping the page tables of a kernel-space address for user faults is unnecessary and may have security implications. Keep everything unchanged for kernel faults, because the kernel is already in the "oops" state, acquiring a lock may risk a deadlock. Co-developed-by: Qi Xi Fixes: 6d021b724481 ("ARM: dump pgd, pmd and pte states on unhandled data abort faults") Link: https://lore.kernel.org/20260716014022.2823-1-xieyuanbin1@huawei.com Acked-by: Lorenzo Stoakes (ARM) Reviewed-by: Linus Walleij Signed-off-by: Qi Xi Signed-off-by: Xie Yuanbin Signed-off-by: Russell King --- arch/arm/mm/fault.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c index c68677503532..0a09d4ff7718 100644 --- a/arch/arm/mm/fault.c +++ b/arch/arm/mm/fault.c @@ -181,7 +181,11 @@ __do_user_fault(unsigned long addr, unsigned int fsr, unsigned int sig, pr_err("8<--- cut here ---\n"); pr_err("%s: unhandled page fault (%d) at 0x%08lx, code 0x%03x\n", tsk->comm, sig, addr, fsr); - show_pte(KERN_ERR, tsk->mm, addr); + if (likely(addr < TASK_SIZE)) { + mmap_write_lock(tsk->mm); + show_pte(KERN_ERR, tsk->mm, addr); + mmap_write_unlock(tsk->mm); + } show_regs(regs); } #endif @@ -639,7 +643,15 @@ do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs) pr_alert("8<--- cut here ---\n"); pr_alert("Unhandled fault: %s (0x%03x) at 0x%08lx\n", inf->name, fsr, addr); - show_pte(KERN_ALERT, current->mm, addr); + if (likely(user_mode(regs))) { + if (addr < TASK_SIZE) { + mmap_write_lock(current->mm); + show_pte(KERN_ALERT, current->mm, addr); + mmap_write_unlock(current->mm); + } + } else { + show_pte(KERN_ALERT, current->mm, addr); + } arm_notify_die("", regs, inf->sig, inf->code, (void __user *)addr, fsr, 0); From 055a410f7c9f7efa2b5524ad837d6cca78dd0b81 Mon Sep 17 00:00:00 2001 From: Ethan Nelson-Moore Date: Sun, 14 Jun 2026 02:56:01 +0100 Subject: [PATCH 7/8] ARM: 9478/1: Remove references to removed CONFIG_CPU_ARM92x_CPU_IDLE options Several assembly files in arch/arm/mm contain comments referring to CONFIG_CPU_ARM92x_CPU_IDLE options, which have not existed in the kernel since 2.4.21. Remove them. Discovered while searching for CONFIG_* symbols referenced in code but not defined in any Kconfig file. Reviewed-by: Linus Walleij Signed-off-by: Ethan Nelson-Moore Signed-off-by: Russell King --- arch/arm/mm/proc-arm920.S | 2 -- arch/arm/mm/proc-arm922.S | 2 -- arch/arm/mm/proc-arm925.S | 2 -- arch/arm/mm/proc-arm926.S | 2 -- 4 files changed, 8 deletions(-) diff --git a/arch/arm/mm/proc-arm920.S b/arch/arm/mm/proc-arm920.S index 4727f4b5b6e8..0326067c6c75 100644 --- a/arch/arm/mm/proc-arm920.S +++ b/arch/arm/mm/proc-arm920.S @@ -8,8 +8,6 @@ * * These are the low level assembler for performing cache and TLB * functions on the arm920. - * - * CONFIG_CPU_ARM920_CPU_IDLE -> nohlt */ #include #include diff --git a/arch/arm/mm/proc-arm922.S b/arch/arm/mm/proc-arm922.S index 5a4a3f4f2683..3fe6fdf0d325 100644 --- a/arch/arm/mm/proc-arm922.S +++ b/arch/arm/mm/proc-arm922.S @@ -9,8 +9,6 @@ * * These are the low level assembler for performing cache and TLB * functions on the arm922. - * - * CONFIG_CPU_ARM922_CPU_IDLE -> nohlt */ #include #include diff --git a/arch/arm/mm/proc-arm925.S b/arch/arm/mm/proc-arm925.S index 1c4830afe1d3..2d15467e4a08 100644 --- a/arch/arm/mm/proc-arm925.S +++ b/arch/arm/mm/proc-arm925.S @@ -15,8 +15,6 @@ * These are the low level assembler for performing cache and TLB * functions on the arm925. * - * CONFIG_CPU_ARM925_CPU_IDLE -> nohlt - * * Some additional notes based on deciphering the TI TRM on OMAP-5910: * * NOTE1: The TI925T Configuration Register bit "D-cache clean and flush diff --git a/arch/arm/mm/proc-arm926.S b/arch/arm/mm/proc-arm926.S index a09cc3e02efd..d94aa8199452 100644 --- a/arch/arm/mm/proc-arm926.S +++ b/arch/arm/mm/proc-arm926.S @@ -8,8 +8,6 @@ * * These are the low level assembler for performing cache and TLB * functions on the arm926. - * - * CONFIG_CPU_ARM926_CPU_IDLE -> nohlt */ #include #include From bb3b2cfeb206f5b10b859e134651b54120e3f530 Mon Sep 17 00:00:00 2001 From: Linus Walleij Date: Tue, 30 Jun 2026 18:05:56 +0100 Subject: [PATCH 8/8] ARM: 9480/1: entry: expand comment in __switch_to As per discussion between the developers in the mail thread linked, expand the comment in __switch_to so that readers of the code understand what is going on. Suggested-by: Mark Rutland Acked-by: Mark Rutland Signed-off-by: Linus Walleij > Signed-off-by: Russell King --- arch/arm/kernel/entry-armv.S | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S index ef6a657c8d13..b7faefe5bce7 100644 --- a/arch/arm/kernel/entry-armv.S +++ b/arch/arm/kernel/entry-armv.S @@ -557,9 +557,16 @@ ENTRY(__switch_to) ldmia r4, {r4 - sl, fp, ip, lr} @ Load all regs saved previously #ifdef CONFIG_VMAP_STACK @ - @ Do a dummy read from the new stack while running from the old one so - @ that we can rely on do_translation_fault() to fix up any stale PMD - @ entries covering the vmalloc region. + @ For a non-lazy mm switch, check_vmalloc_seq() has ensured that + @ that the active mm's page tables have mappings for the prev + @ task's stack and the next task's stack. + @ + @ For a lazy mm switch the active mm's page tables have mappings + @ for the prev task's stack but might not have mappings for the + @ new task's stack. Do a dummy read from the new stack while + @ running from the old stack so that we can rely on + @ do_translation_fault() to populate missing PMD entries covering the + @ new task's stack in the old task's page tables. @ ldr r2, [ip] #ifdef CONFIG_KASAN_VMALLOC