[PATCH v2] arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults

[PATCH v2] arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults

[Ard Biesheuvel]

From: Ard Biesheuvel <ardb@kernel.org>

When EFI runtime services are invoked from a preemptible kthread, the
kthread runs with efi_mm installed via kthread_use_mm() and preemption
enabled, so neither faulthandler_disabled() nor !mm applies in
do_page_fault(). A permission fault taken by the firmware on one of its
own (TTBR0) mappings then hits the 'access to user memory outside
uaccess routines' check and oopses, without efi_runtime_fixup_exception()
ever being consulted.

efi_mm has no VMAs, so there is nothing for the mm to resolve. Send such
faults to no_context directly, so that __do_kernel_fault() can recover
from them as it does when the call is made with preemption disabled.

Fixes: a5baf582f4c0 ("arm64/efi: Call EFI runtime services without disabling preemption")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
 arch/arm64/mm/fault.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 0b52557652be..87b5fd77d9ca 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -616,9 +616,10 @@ static int __kprobes do_page_fault(unsigned long far, unsigned long esr,
 
 	/*
 	 * If we're in an interrupt or have no user context, we must not take
-	 * the fault.
+	 * the fault. EFI runtime services may execute with preemption enabled
+	 * and mm == &efi_mm, but faults need to be treated as kernel faults.
 	 */
-	if (faulthandler_disabled() || !mm)
+	if (faulthandler_disabled() || !mm || mm_is_efi(mm))
 		goto no_context;
 
 	if (user_mode(regs))
-- 
2.56.0.385.gd3acb90ef8-goog

Re: [PATCH v2] arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults

[Catalin Marinas]

On Tue, 13 Oct 2026 09:30:08 +0200, Ard Biesheuvel wrote:
> When EFI runtime services are invoked from a preemptible kthread, the
> kthread runs with efi_mm installed via kthread_use_mm() and preemption
> enabled, so neither faulthandler_disabled() nor !mm applies in
> do_page_fault(). A permission fault taken by the firmware on one of its
> own (TTBR0) mappings then hits the 'access to user memory outside
> uaccess routines' check and oopses, without efi_runtime_fixup_exception()
> ever being consulted.
> 
> [...]

Applied to arm64 (for-next/efi), thanks!

[1/1] arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults
      https://git.kernel.org/arm64/c/171be684bfa3