[PATCH] arm64/mm: Route faults taken by EFI runtime firmware to no_context

[PATCH] arm64/mm: Route faults taken by EFI runtime firmware to no_context

[Ard Biesheuvel]

From: Ard Biesheuvel <ardb@kernel.org>

When EFI runtime services are invoked from a preemptible kthread, the
kthread runs with efi_mm installed via kthread_use_mm() and preemption
enabled, so neither faulthandler_disabled() nor !mm applies in
do_page_fault(). A permission fault taken by the firmware on one of its
own (TTBR0) mappings then hits the 'access to user memory outside
uaccess routines' check and oopses, without efi_runtime_fixup_exception()
ever being consulted.

efi_mm has no VMAs, so there is nothing for the mm to resolve. Send such
faults to no_context directly, so that __do_kernel_fault() can recover
from them as it does when the call is made with preemption disabled.

Fixes: a5baf582f4c0 ("arm64/efi: Call EFI runtime services without disabling preemption")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
 arch/arm64/mm/fault.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 0b52557652be..db308fe01c4f 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -40,6 +40,7 @@
 #include <asm/kprobes.h>
 #include <asm/mte.h>
 #include <asm/processor.h>
+#include <asm/stacktrace.h>
 #include <asm/sysreg.h>
 #include <asm/system_misc.h>
 #include <asm/tlbflush.h>
@@ -621,6 +622,17 @@ static int __kprobes do_page_fault(unsigned long far, unsigned long esr,
 	if (faulthandler_disabled() || !mm)
 		goto no_context;
 
+	/*
+	 * Faults taken by EFI runtime services firmware are never resolved by
+	 * the mm (efi_mm has no VMAs), and must reach __do_kernel_fault() so
+	 * that efi_runtime_fixup_exception() can recover from them. When EFI
+	 * runtime services are invoked from a preemptible kthread, neither of
+	 * the conditions above applies, so check for this explicitly.
+	 */
+	if (IS_ENABLED(CONFIG_EFI) && !user_mode(regs) &&
+	    is_ttbr0_addr(regs->pc) && current_in_efi())
+		goto no_context;
+
 	if (user_mode(regs))
 		mm_flags |= FAULT_FLAG_USER;
 
-- 
2.56.0.385.gd3acb90ef8-goog

Re: [PATCH] arm64/mm: Route faults taken by EFI runtime firmware to no_context

[Ard Biesheuvel]

On Fri, 9 Oct 2026, at 16:34, Ard Biesheuvel wrote:
> From: Ard Biesheuvel <ardb@kernel.org>
>
> When EFI runtime services are invoked from a preemptible kthread, the
> kthread runs with efi_mm installed via kthread_use_mm() and preemption
> enabled, so neither faulthandler_disabled() nor !mm applies in
> do_page_fault(). A permission fault taken by the firmware on one of its
> own (TTBR0) mappings then hits the 'access to user memory outside
> uaccess routines' check and oopses, without efi_runtime_fixup_exception()
> ever being consulted.
>
> efi_mm has no VMAs, so there is nothing for the mm to resolve. Send such
> faults to no_context directly, so that __do_kernel_fault() can recover
> from them as it does when the call is made with preemption disabled.
>
> Fixes: a5baf582f4c0 ("arm64/efi: Call EFI runtime services without 
> disabling preemption")
> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> ---
>  arch/arm64/mm/fault.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
>
> diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
> index 0b52557652be..db308fe01c4f 100644
> --- a/arch/arm64/mm/fault.c
> +++ b/arch/arm64/mm/fault.c
> @@ -40,6 +40,7 @@
>  #include <asm/kprobes.h>
>  #include <asm/mte.h>
>  #include <asm/processor.h>
> +#include <asm/stacktrace.h>
>  #include <asm/sysreg.h>
>  #include <asm/system_misc.h>
>  #include <asm/tlbflush.h>
> @@ -621,6 +622,17 @@ static int __kprobes do_page_fault(unsigned long 
> far, unsigned long esr,
>  	if (faulthandler_disabled() || !mm)
>  		goto no_context;
> 
> +	/*
> +	 * Faults taken by EFI runtime services firmware are never resolved by
> +	 * the mm (efi_mm has no VMAs), and must reach __do_kernel_fault() so
> +	 * that efi_runtime_fixup_exception() can recover from them. When EFI
> +	 * runtime services are invoked from a preemptible kthread, neither of
> +	 * the conditions above applies, so check for this explicitly.
> +	 */
> +	if (IS_ENABLED(CONFIG_EFI) && !user_mode(regs) &&
> +	    is_ttbr0_addr(regs->pc) && current_in_efi())
> +		goto no_context;
> +

Looking at this again, I wonder if we should just add a comparison with
&efi_mm to the preceding if() condition.

Re: [PATCH] arm64/mm: Route faults taken by EFI runtime firmware to no_context

[Catalin Marinas]

On Mon, Oct 12, 2026 at 10:36:41AM +0200, Ard Biesheuvel wrote:
> > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
> > index 0b52557652be..db308fe01c4f 100644
> > --- a/arch/arm64/mm/fault.c
> > +++ b/arch/arm64/mm/fault.c
> > @@ -40,6 +40,7 @@
> >  #include <asm/kprobes.h>
> >  #include <asm/mte.h>
> >  #include <asm/processor.h>
> > +#include <asm/stacktrace.h>
> >  #include <asm/sysreg.h>
> >  #include <asm/system_misc.h>
> >  #include <asm/tlbflush.h>
> > @@ -621,6 +622,17 @@ static int __kprobes do_page_fault(unsigned long 
> > far, unsigned long esr,
> >  	if (faulthandler_disabled() || !mm)
> >  		goto no_context;
> > 
> > +	/*
> > +	 * Faults taken by EFI runtime services firmware are never resolved by
> > +	 * the mm (efi_mm has no VMAs), and must reach __do_kernel_fault() so
> > +	 * that efi_runtime_fixup_exception() can recover from them. When EFI
> > +	 * runtime services are invoked from a preemptible kthread, neither of
> > +	 * the conditions above applies, so check for this explicitly.
> > +	 */
> > +	if (IS_ENABLED(CONFIG_EFI) && !user_mode(regs) &&
> > +	    is_ttbr0_addr(regs->pc) && current_in_efi())
> > +		goto no_context;
> > +
> 
> Looking at this again, I wonder if we should just add a comparison with
> &efi_mm to the preceding if() condition.

I think mm_is_efi() check in the previous block is simpler. I couldn't
find any case where this wouldn't cover the more extensive check above
(or the other way around).

-- 
Catalin

Re: [PATCH] arm64/mm: Route faults taken by EFI runtime firmware to no_context

[Ard Biesheuvel]

On Mon, 12 Oct 2026, at 14:51, Catalin Marinas wrote:
> On Mon, Oct 12, 2026 at 10:36:41AM +0200, Ard Biesheuvel wrote:
>> > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
>> > index 0b52557652be..db308fe01c4f 100644
>> > --- a/arch/arm64/mm/fault.c
>> > +++ b/arch/arm64/mm/fault.c
>> > @@ -40,6 +40,7 @@
>> >  #include <asm/kprobes.h>
>> >  #include <asm/mte.h>
>> >  #include <asm/processor.h>
>> > +#include <asm/stacktrace.h>
>> >  #include <asm/sysreg.h>
>> >  #include <asm/system_misc.h>
>> >  #include <asm/tlbflush.h>
>> > @@ -621,6 +622,17 @@ static int __kprobes do_page_fault(unsigned long 
>> > far, unsigned long esr,
>> >  	if (faulthandler_disabled() || !mm)
>> >  		goto no_context;
>> > 
>> > +	/*
>> > +	 * Faults taken by EFI runtime services firmware are never resolved by
>> > +	 * the mm (efi_mm has no VMAs), and must reach __do_kernel_fault() so
>> > +	 * that efi_runtime_fixup_exception() can recover from them. When EFI
>> > +	 * runtime services are invoked from a preemptible kthread, neither of
>> > +	 * the conditions above applies, so check for this explicitly.
>> > +	 */
>> > +	if (IS_ENABLED(CONFIG_EFI) && !user_mode(regs) &&
>> > +	    is_ttbr0_addr(regs->pc) && current_in_efi())
>> > +		goto no_context;
>> > +
>> 
>> Looking at this again, I wonder if we should just add a comparison with
>> &efi_mm to the preceding if() condition.
>
> I think mm_is_efi() check in the previous block is simpler. I couldn't
> find any case where this wouldn't cover the more extensive check above
> (or the other way around).
>

Exactly. I'll send a v2.