[patch 5/8] futex: Add robust futex unlock IP range

From: Thomas Gleixner

Date: Mon Mar 16 2026 - 13:20:05 EST


There will be a VDSO function to unlock robust futexes in user space. The
unlock sequence is racy vs. clearing the list_pending_op pointer in the
tasks robust list head. To plug this race the kernel needs to know the
instruction window. As the VDSO is per MM the addresses are stored in
mm_struct::futex.

Architectures which implement support for this have to update these
addresses when the VDSO is (re)mapped.

Arguably this could be resolved by chasing mm->context->vdso->image, but
that that's architecture specific and requires to touch quite some cache
lines. Having it in mm::futex reduces the cache line impact and avoids
having yet another set of architecture specific functionality.

Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxx>
---
include/linux/futex_types.h | 32 +++++++++++++++++++++++++-------
include/linux/mm_types.h | 1 +
init/Kconfig | 6 ++++++
3 files changed, 32 insertions(+), 7 deletions(-)

--- a/include/linux/futex_types.h
+++ b/include/linux/futex_types.h
@@ -33,13 +33,26 @@ struct futex_ctrl { };

/**
* struct futex_mm_data - Futex related per MM data
- * @phash_lock: Mutex to protect the private hash operations
- * @phash: RCU managed pointer to the private hash
- * @phash_new: Pointer to a newly allocated private hash
- * @phash_batches: Batch state for RCU synchronization
- * @phash_rcu: RCU head for call_rcu()
- * @phash_atomic: Aggregate value for @phash_ref
- * @phash_ref: Per CPU reference counter for a private hash
+ * @phash_lock: Mutex to protect the private hash operations
+ * @phash: RCU managed pointer to the private hash
+ * @phash_new: Pointer to a newly allocated private hash
+ * @phash_batches: Batch state for RCU synchronization
+ * @phash_rcu: RCU head for call_rcu()
+ * @phash_atomic: Aggregate value for @phash_ref
+ * @phash_ref: Per CPU reference counter for a private hash
+ *
+ * @unlock_cs_start_ip: The start IP of the robust futex unlock critical section
+ *
+ * @unlock_cs_success_ip: The IP of the robust futex unlock critical section which
+ * indicates that the unlock (cmpxchg) was successful
+ * Required to handle the compat size insanity for mixed mode
+ * game emulators.
+ *
+ * Not evaluated by the core code as that only
+ * evaluates the start/end range. Can therefore be 0 if the
+ * architecture does not care.
+ *
+ * @unlock_cs_end_ip: The end IP of the robust futex unlock critical section
*/
struct futex_mm_data {
#ifdef CONFIG_FUTEX_PRIVATE_HASH
@@ -51,6 +64,11 @@ struct futex_mm_data {
atomic_long_t phash_atomic;
unsigned int __percpu *phash_ref;
#endif
+#ifdef CONFIG_FUTEX_ROBUST_UNLOCK
+ unsigned long unlock_cs_start_ip;
+ unsigned long unlock_cs_success_ip;
+ unsigned long unlock_cs_end_ip;
+#endif
};

#endif /* _LINUX_FUTEX_TYPES_H */
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -22,6 +22,7 @@
#include <linux/types.h>
#include <linux/rseq_types.h>
#include <linux/bitmap.h>
+#include <linux/futex_types.h>

#include <asm/mmu.h>

--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1822,6 +1822,12 @@ config FUTEX_MPOL
depends on FUTEX && NUMA
default y

+config HAVE_FUTEX_ROBUST_UNLOCK
+ bool
+
+config FUTEX_ROBUST_UNLOCK
+ def_bool FUTEX && HAVE_GENERIC_VDSO && GENERIC_IRQ_ENTRY && RSEQ && HAVE_FUTEX_ROBUST_UNLOCK
+
config EPOLL
bool "Enable eventpoll support" if EXPERT
default y