x86/kprobes: Fix crash when probing CS CALL instructionsgrafted

When using eBPF to probe CS CALL instructions within a function,
a crash can be triggered.

The eBPF tool probes offset 257 of the __hrtimer_run_queues()
function:

<__hrtimer_run_queues+249>:  nopl   0x0(%rax,%rax,1)
<__hrtimer_run_queues+254>:  mov    %r14,%rdi
<__hrtimer_run_queues+257>:  cs call <__x86_indirect_thunk_r12>
<__hrtimer_run_queues+263>:  mov    %eax,%r12d
<__hrtimer_run_queues+266>:  xchg   %ax,%ax
<__hrtimer_run_queues+268>:  mov    %r13,%rdi

Which triggers this crash:

  BUG: unable to handle page fault for address: 00000000000f41c9
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  PGD 0 P4D 0
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 0 Comm: swapper/1 Kdump: loaded Tainted: P
  RIP: 0010:__hrtimer_run_queues+0x106/0x230

Note that __hrtimer_run_queues+0x106 is __hrtimer_run_queues+262, which is
at the 6th byte of the above CS CALL instruction. Since the CS CALL
instruction occupies 6 bytes, the exception occurred in the middle of that
call instruction.

The root cause is that when using eBPF tools to probe in the middle of a
function, a kprobe with INT3 is used as the underlying implementation.

During single-step emulation of the original CALL instruction,
int3_emulate_call() assumes that the probed CALL instruction is 5 bytes
long. However, the actual CS-prefixed CALL instruction occupies 6 bytes,
so it constructs an incorrect exception return address. When the CPU
returns from the kprobe handler, the next instruction to be executed is at
the address of the last byte of that CS CALL instruction. Coincidentally,
starting from that address, the CPU fetches and decodes a completely
different instruction, which ultimately triggers a kernel crash.

Fix the issue by using the actual instruction length obtained from
the instruction decoder when constructing the exception return
address, rather than relying on the hardcoded CALL_INSN_SIZE macro.

[ mingo: Refined the changelog ]

Fixes: 6256e668b7af ("x86/kprobes: Use int3 instead of debug trap for single-step")
Suggested-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Jinke Han <jinkehan@didiglobal.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Borislav Petkov <bp@alien8.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/20260908073742.GA10517@didi-ThinkCentre-M920t-N000

17 files changed, 543 insertions, 0 deletions

diff --git a/arch/sh/include/uapi/asm/Kbuild b/arch/sh/include/uapi/asm/Kbuild
new file mode 100644
index 000000000..b8812c74c
--- /dev/null
+++ b/arch/sh/include/uapi/asm/Kbuild
@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: GPL-2.0
+
+generated-y += unistd_32.h
+generic-y += ucontext.h
diff --git a/arch/sh/include/uapi/asm/auxvec.h b/arch/sh/include/uapi/asm/auxvec.h
new file mode 100644
index 000000000..63fcc39e2
--- /dev/null
+++ b/arch/sh/include/uapi/asm/auxvec.h
@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_SH_AUXVEC_H
+#define __ASM_SH_AUXVEC_H
+
+/*
+ * Architecture-neutral AT_ values in 0-17, leave some room
+ * for more of them.
+ */
+
+/*
+ * This entry gives some information about the FPU initialization
+ * performed by the kernel.
+ */
+#define AT_FPUCW		18	/* Used FPU control word.  */
+
+/*
+ * The entry point to the vsyscall page gets placed here.
+ */
+#define AT_SYSINFO_EHDR		33
+
+/*
+ * More complete cache descriptions than AT_[DIU]CACHEBSIZE.  If the
+ * value is -1, then the cache doesn't exist.  Otherwise:
+ *
+ *    bit 0-3:	  Cache set-associativity; 0 means fully associative.
+ *    bit 4-7:	  Log2 of cacheline size.
+ *    bit 8-31:	  Size of the entire cache >> 8.
+ */
+#define AT_L1I_CACHESHAPE	34
+#define AT_L1D_CACHESHAPE	35
+#define AT_L2_CACHESHAPE	36
+
+#define AT_VECTOR_SIZE_ARCH 5 /* entries in ARCH_DLINFO */
+
+#endif /* __ASM_SH_AUXVEC_H */
diff --git a/arch/sh/include/uapi/asm/byteorder.h b/arch/sh/include/uapi/asm/byteorder.h
new file mode 100644
index 000000000..e27d6da32
--- /dev/null
+++ b/arch/sh/include/uapi/asm/byteorder.h
@@ -0,0 +1,11 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_SH_BYTEORDER_H
+#define __ASM_SH_BYTEORDER_H
+
+#ifdef __LITTLE_ENDIAN__
+#include <linux/byteorder/little_endian.h>
+#else
+#include <linux/byteorder/big_endian.h>
+#endif
+
+#endif /* __ASM_SH_BYTEORDER_H */
diff --git a/arch/sh/include/uapi/asm/cachectl.h b/arch/sh/include/uapi/asm/cachectl.h
new file mode 100644
index 000000000..79c566325
--- /dev/null
+++ b/arch/sh/include/uapi/asm/cachectl.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _SH_CACHECTL_H
+#define _SH_CACHECTL_H
+
+/* Definitions for the cacheflush system call.  */
+
+#define CACHEFLUSH_D_INVAL	0x1	/* invalidate (without write back) */
+#define CACHEFLUSH_D_WB		0x2	/* write back (without invalidate) */
+#define CACHEFLUSH_D_PURGE	0x3	/* writeback and invalidate */
+
+#define CACHEFLUSH_I		0x4
+
+/*
+ * Options for cacheflush system call
+ */
+#define ICACHE	CACHEFLUSH_I		/* flush instruction cache */
+#define DCACHE	CACHEFLUSH_D_PURGE	/* writeback and flush data cache */
+#define BCACHE	(ICACHE|DCACHE)		/* flush both caches */
+
+#endif /* _SH_CACHECTL_H */
diff --git a/arch/sh/include/uapi/asm/cpu-features.h b/arch/sh/include/uapi/asm/cpu-features.h
new file mode 100644
index 000000000..6de5f6519
--- /dev/null
+++ b/arch/sh/include/uapi/asm/cpu-features.h
@@ -0,0 +1,28 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_SH_CPU_FEATURES_H
+#define __ASM_SH_CPU_FEATURES_H
+
+/*
+ * Processor flags
+ *
+ * Note: When adding a new flag, keep cpu_flags[] in
+ * arch/sh/kernel/setup.c in sync so symbolic name
+ * mapping of the processor flags has a chance of being
+ * reasonably accurate.
+ *
+ * These flags are also available through the ELF
+ * auxiliary vector as AT_HWCAP.
+ */
+#define CPU_HAS_FPU		0x0001	/* Hardware FPU support */
+#define CPU_HAS_P2_FLUSH_BUG	0x0002	/* Need to flush the cache in P2 area */
+#define CPU_HAS_MMU_PAGE_ASSOC	0x0004	/* SH3: TLB way selection bit support */
+#define CPU_HAS_DSP		0x0008	/* SH-DSP: DSP support */
+#define CPU_HAS_PERF_COUNTER	0x0010	/* Hardware performance counters */
+#define CPU_HAS_PTEA		0x0020	/* PTEA register */
+#define CPU_HAS_LLSC		0x0040	/* movli.l/movco.l */
+#define CPU_HAS_L2_CACHE	0x0080	/* Secondary cache / URAM */
+#define CPU_HAS_OP32		0x0100	/* 32-bit instruction support */
+#define CPU_HAS_PTEAEX		0x0200	/* PTE ASID Extension support */
+#define CPU_HAS_CAS_L		0x0400	/* cas.l atomic compare-and-swap */
+
+#endif /* __ASM_SH_CPU_FEATURES_H */
diff --git a/arch/sh/include/uapi/asm/hw_breakpoint.h b/arch/sh/include/uapi/asm/hw_breakpoint.h
new file mode 100644
index 000000000..043dd4b92
--- /dev/null
+++ b/arch/sh/include/uapi/asm/hw_breakpoint.h
@@ -0,0 +1,5 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * There isn't anything here anymore, but the file must not be empty or patch
+ * will delete it.
+ */
diff --git a/arch/sh/include/uapi/asm/ioctls.h b/arch/sh/include/uapi/asm/ioctls.h
new file mode 100644
index 000000000..11866d4f6
--- /dev/null
+++ b/arch/sh/include/uapi/asm/ioctls.h
@@ -0,0 +1,116 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_SH_IOCTLS_H
+#define __ASM_SH_IOCTLS_H
+
+#include <asm/ioctl.h>
+
+#define FIOCLEX		_IO('f', 1)
+#define FIONCLEX	_IO('f', 2)
+#define FIOASYNC	_IOW('f', 125, int)
+#define FIONBIO		_IOW('f', 126, int)
+#define FIONREAD	_IOR('f', 127, int)
+#define TIOCINQ		FIONREAD
+#define FIOQSIZE	_IOR('f', 128, loff_t)
+
+#define TCGETS		0x5401
+#define TCSETS		0x5402
+#define TCSETSW		0x5403
+#define TCSETSF		0x5404
+
+#define TCGETA		0x80127417	/* _IOR('t', 23, struct termio) */
+#define TCSETA		0x40127418	/* _IOW('t', 24, struct termio) */
+#define TCSETAW		0x40127419	/* _IOW('t', 25, struct termio) */
+#define TCSETAF		0x4012741C	/* _IOW('t', 28, struct termio) */
+
+#define TCSBRK		_IO('t', 29)
+#define TCXONC		_IO('t', 30)
+#define TCFLSH		_IO('t', 31)
+
+#define TIOCSWINSZ	0x40087467	/* _IOW('t', 103, struct winsize) */
+#define TIOCGWINSZ	0x80087468	/* _IOR('t', 104, struct winsize) */
+#define	TIOCSTART	_IO('t', 110)		/* start output, like ^Q */
+#define	TIOCSTOP	_IO('t', 111)		/* stop output, like ^S */
+#define TIOCOUTQ        _IOR('t', 115, int)     /* output queue size */
+
+#define TIOCSPGRP	_IOW('t', 118, int)
+#define TIOCGPGRP	_IOR('t', 119, int)
+
+#define TIOCEXCL	_IO('T', 12) /* 0x540C */
+#define TIOCNXCL	_IO('T', 13) /* 0x540D */
+#define TIOCSCTTY	_IO('T', 14) /* 0x540E */
+
+#define TIOCSTI		_IOW('T', 18, char) /* 0x5412 */
+#define TIOCMGET	_IOR('T', 21, unsigned int) /* 0x5415 */
+#define TIOCMBIS	_IOW('T', 22, unsigned int) /* 0x5416 */
+#define TIOCMBIC	_IOW('T', 23, unsigned int) /* 0x5417 */
+#define TIOCMSET	_IOW('T', 24, unsigned int) /* 0x5418 */
+# define TIOCM_LE	0x001
+# define TIOCM_DTR	0x002
+# define TIOCM_RTS	0x004
+# define TIOCM_ST	0x008
+# define TIOCM_SR	0x010
+# define TIOCM_CTS	0x020
+# define TIOCM_CAR	0x040
+# define TIOCM_RNG	0x080
+# define TIOCM_DSR	0x100
+# define TIOCM_CD	TIOCM_CAR
+# define TIOCM_RI	TIOCM_RNG
+
+#define TIOCGSOFTCAR	_IOR('T', 25, unsigned int) /* 0x5419 */
+#define TIOCSSOFTCAR	_IOW('T', 26, unsigned int) /* 0x541A */
+#define TIOCLINUX	_IOW('T', 28, char) /* 0x541C */
+#define TIOCCONS	_IO('T', 29) /* 0x541D */
+#define TIOCGSERIAL	0x803C541E	/* _IOR('T', 30, struct serial_struct) 0x541E */
+#define TIOCSSERIAL	0x403C541F	/* _IOW('T', 31, struct serial_struct) 0x541F */
+#define TIOCPKT		_IOW('T', 32, int) /* 0x5420 */
+# define TIOCPKT_DATA		 0
+# define TIOCPKT_FLUSHREAD	 1
+# define TIOCPKT_FLUSHWRITE	 2
+# define TIOCPKT_STOP		 4
+# define TIOCPKT_START		 8
+# define TIOCPKT_NOSTOP		16
+# define TIOCPKT_DOSTOP		32
+# define TIOCPKT_IOCTL		64
+
+
+#define TIOCNOTTY	_IO('T', 34) /* 0x5422 */
+#define TIOCSETD	_IOW('T', 35, int) /* 0x5423 */
+#define TIOCGETD	_IOR('T', 36, int) /* 0x5424 */
+#define TCSBRKP		_IOW('T', 37, int) /* 0x5425 */	/* Needed for POSIX tcsendbreak() */
+#define TIOCSBRK	_IO('T', 39) /* 0x5427 */ /* BSD compatibility */
+#define TIOCCBRK	_IO('T', 40) /* 0x5428 */ /* BSD compatibility */
+#define TIOCGSID	_IOR('T', 41, pid_t) /* 0x5429 */ /* Return the session ID of FD */
+#define TCGETS2		_IOR('T', 42, struct termios2)
+#define TCSETS2		_IOW('T', 43, struct termios2)
+#define TCSETSW2	_IOW('T', 44, struct termios2)
+#define TCSETSF2	_IOW('T', 45, struct termios2)
+#define TIOCGRS485	_IOR('T', 46, struct serial_rs485)
+#define TIOCSRS485	_IOWR('T', 47, struct serial_rs485)
+#define TIOCGPTN	_IOR('T',0x30, unsigned int) /* Get Pty Number (of pty-mux device) */
+#define TIOCSPTLCK	_IOW('T',0x31, int)  /* Lock/unlock Pty */
+#define TIOCGDEV	_IOR('T',0x32, unsigned int) /* Get primary device node of /dev/console */
+#define TIOCSIG		_IOW('T',0x36, int)  /* Generate signal on Pty slave */
+#define TIOCVHANGUP	_IO('T', 0x37)
+#define TIOCGPKT	_IOR('T', 0x38, int) /* Get packet mode state */
+#define TIOCGPTLCK	_IOR('T', 0x39, int) /* Get Pty lock state */
+#define TIOCGEXCL	_IOR('T', 0x40, int) /* Get exclusive mode state */
+#define TIOCGPTPEER	_IO('T', 0x41) /* Safely open the slave */
+#define TIOCGISO7816	_IOR('T', 0x42, struct serial_iso7816)
+#define TIOCSISO7816	_IOWR('T', 0x43, struct serial_iso7816)
+
+#define TIOCSERCONFIG	_IO('T', 83) /* 0x5453 */
+#define TIOCSERGWILD	_IOR('T', 84,  int) /* 0x5454 */
+#define TIOCSERSWILD	_IOW('T', 85,  int) /* 0x5455 */
+#define TIOCGLCKTRMIOS	0x5456
+#define TIOCSLCKTRMIOS	0x5457
+#define TIOCSERGSTRUCT	0x80d85458	/* _IOR('T', 88, struct async_struct) 0x5458 */ /* For debugging only */
+#define TIOCSERGETLSR   _IOR('T', 89, unsigned int) /* 0x5459 */ /* Get line status register */
+  /* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */
+# define TIOCSER_TEMT    0x01	/* Transmitter physically empty */
+#define TIOCSERGETMULTI 0x80A8545A	/* _IOR('T', 90, struct serial_multiport_struct) 0x545A */ /* Get multiport config */
+#define TIOCSERSETMULTI 0x40A8545B	/* _IOW('T', 91, struct serial_multiport_struct) 0x545B */ /* Set multiport config */
+
+#define TIOCMIWAIT	_IO('T', 92) /* 0x545C */	/* wait for a change on serial input line(s) */
+#define TIOCGICOUNT	0x545D	/* read serial port inline interrupt counts */
+
+#endif /* __ASM_SH_IOCTLS_H */
diff --git a/arch/sh/include/uapi/asm/posix_types.h b/arch/sh/include/uapi/asm/posix_types.h
new file mode 100644
index 000000000..adc998a64
--- /dev/null
+++ b/arch/sh/include/uapi/asm/posix_types.h
@@ -0,0 +1,2 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#include <asm/posix_types_32.h>
diff --git a/arch/sh/include/uapi/asm/posix_types_32.h b/arch/sh/include/uapi/asm/posix_types_32.h
new file mode 100644
index 000000000..ea0f51d1a
--- /dev/null
+++ b/arch/sh/include/uapi/asm/posix_types_32.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_SH_POSIX_TYPES_32_H
+#define __ASM_SH_POSIX_TYPES_32_H
+
+typedef unsigned short	__kernel_mode_t;
+#define __kernel_mode_t __kernel_mode_t
+typedef unsigned short	__kernel_ipc_pid_t;
+#define __kernel_ipc_pid_t __kernel_ipc_pid_t
+typedef unsigned short	__kernel_uid_t;
+#define __kernel_uid_t __kernel_uid_t
+typedef unsigned short	__kernel_gid_t;
+#define __kernel_gid_t __kernel_gid_t
+
+typedef unsigned short	__kernel_old_uid_t;
+#define __kernel_old_uid_t __kernel_old_uid_t
+typedef unsigned short	__kernel_old_gid_t;
+#define __kernel_old_gid_t __kernel_old_gid_t
+typedef unsigned short	__kernel_old_dev_t;
+#define __kernel_old_dev_t __kernel_old_dev_t
+
+#include <asm-generic/posix_types.h>
+
+#endif /* __ASM_SH_POSIX_TYPES_32_H */
diff --git a/arch/sh/include/uapi/asm/ptrace.h b/arch/sh/include/uapi/asm/ptrace.h
new file mode 100644
index 000000000..5c88e46b7
--- /dev/null
+++ b/arch/sh/include/uapi/asm/ptrace.h
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (C) 1999, 2000  Niibe Yutaka
+ */
+#ifndef _UAPI__ASM_SH_PTRACE_H
+#define _UAPI__ASM_SH_PTRACE_H
+
+
+#define PTRACE_GETREGS		12	/* General registers */
+#define PTRACE_SETREGS		13
+
+#define PTRACE_GETFPREGS	14	/* FPU registers */
+#define PTRACE_SETFPREGS	15
+
+#define PTRACE_GETFDPIC		31	/* get the ELF fdpic loadmap address */
+
+#define PTRACE_GETFDPIC_EXEC	0	/* [addr] request the executable loadmap */
+#define PTRACE_GETFDPIC_INTERP	1	/* [addr] request the interpreter loadmap */
+
+#define	PTRACE_GETDSPREGS	55	/* DSP registers */
+#define	PTRACE_SETDSPREGS	56
+
+#define PT_TEXT_END_ADDR	240
+#define PT_TEXT_ADDR		244	/* &(struct user)->start_code */
+#define PT_DATA_ADDR		248	/* &(struct user)->start_data */
+#define PT_TEXT_LEN		252
+
+#include <asm/ptrace_32.h>
+
+#endif /* _UAPI__ASM_SH_PTRACE_H */
diff --git a/arch/sh/include/uapi/asm/ptrace_32.h b/arch/sh/include/uapi/asm/ptrace_32.h
new file mode 100644
index 000000000..dc8a26015
--- /dev/null
+++ b/arch/sh/include/uapi/asm/ptrace_32.h
@@ -0,0 +1,78 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _UAPI__ASM_SH_PTRACE_32_H
+#define _UAPI__ASM_SH_PTRACE_32_H
+
+/*
+ * GCC defines register number like this:
+ * -----------------------------
+ *	 0 - 15 are integer registers
+ *	17 - 22 are control/special registers
+ *	24 - 39 fp registers
+ *	40 - 47 xd registers
+ *	48 -    fpscr register
+ * -----------------------------
+ *
+ * We follows above, except:
+ *	16 --- program counter (PC)
+ *	22 --- syscall #
+ *	23 --- floating point communication register
+ */
+#define REG_REG0	 0
+#define REG_REG15	15
+
+#define REG_PC		16
+
+#define REG_PR		17
+#define REG_SR		18
+#define REG_GBR		19
+#define REG_MACH	20
+#define REG_MACL	21
+
+#define REG_SYSCALL	22
+
+#define REG_FPREG0	23
+#define REG_FPREG15	38
+#define REG_XFREG0	39
+#define REG_XFREG15	54
+
+#define REG_FPSCR	55
+#define REG_FPUL	56
+
+/*
+ * This struct defines the way the registers are stored on the
+ * kernel stack during a system call or other kernel entry.
+ */
+struct pt_regs {
+	unsigned long regs[16];
+	unsigned long pc;
+	unsigned long pr;
+	unsigned long sr;
+	unsigned long gbr;
+	unsigned long mach;
+	unsigned long macl;
+	long tra;
+};
+
+/*
+ * This struct defines the way the DSP registers are stored on the
+ * kernel stack during a system call or other kernel entry.
+ */
+struct pt_dspregs {
+	unsigned long	a1;
+	unsigned long	a0g;
+	unsigned long	a1g;
+	unsigned long	m0;
+	unsigned long	m1;
+	unsigned long	a0;
+	unsigned long	x0;
+	unsigned long	x1;
+	unsigned long	y0;
+	unsigned long	y1;
+	unsigned long	dsr;
+	unsigned long	rs;
+	unsigned long	re;
+	unsigned long	mod;
+};
+
+
+#endif /* _UAPI__ASM_SH_PTRACE_32_H */
diff --git a/arch/sh/include/uapi/asm/sigcontext.h b/arch/sh/include/uapi/asm/sigcontext.h
new file mode 100644
index 000000000..a9cc8bad0
--- /dev/null
+++ b/arch/sh/include/uapi/asm/sigcontext.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_SH_SIGCONTEXT_H
+#define __ASM_SH_SIGCONTEXT_H
+
+struct sigcontext {
+	unsigned long	oldmask;
+
+	/* CPU registers */
+	unsigned long sc_regs[16];
+	unsigned long sc_pc;
+	unsigned long sc_pr;
+	unsigned long sc_sr;
+	unsigned long sc_gbr;
+	unsigned long sc_mach;
+	unsigned long sc_macl;
+
+	/* FPU registers */
+	unsigned long sc_fpregs[16];
+	unsigned long sc_xfpregs[16];
+	unsigned int sc_fpscr;
+	unsigned int sc_fpul;
+	unsigned int sc_ownedfp;
+};
+
+#endif /* __ASM_SH_SIGCONTEXT_H */
diff --git a/arch/sh/include/uapi/asm/signal.h b/arch/sh/include/uapi/asm/signal.h
new file mode 100644
index 000000000..97299dadd
--- /dev/null
+++ b/arch/sh/include/uapi/asm/signal.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_SH_SIGNAL_H
+#define __ASM_SH_SIGNAL_H
+
+#define SA_RESTORER	0x04000000
+
+#include <asm-generic/signal.h>
+
+#ifndef __KERNEL__
+struct old_sigaction {
+	__sighandler_t sa_handler;
+	old_sigset_t sa_mask;
+	unsigned long sa_flags;
+	void (*sa_restorer)(void);
+};
+#endif
+
+#endif /* __ASM_SH_SIGNAL_H */
diff --git a/arch/sh/include/uapi/asm/sockios.h b/arch/sh/include/uapi/asm/sockios.h
new file mode 100644
index 000000000..ef01ced9e
--- /dev/null
+++ b/arch/sh/include/uapi/asm/sockios.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_SH_SOCKIOS_H
+#define __ASM_SH_SOCKIOS_H
+
+#include <linux/time_types.h>
+
+/* Socket-level I/O control calls. */
+#define FIOGETOWN	_IOR('f', 123, int)
+#define FIOSETOWN 	_IOW('f', 124, int)
+
+#define SIOCATMARK	_IOR('s', 7, int)
+#define SIOCSPGRP	_IOW('s', 8, pid_t)
+#define SIOCGPGRP	_IOR('s', 9, pid_t)
+
+#define SIOCGSTAMP_OLD	_IOR('s', 100, struct __kernel_old_timeval) /* Get stamp (timeval) */
+#define SIOCGSTAMPNS_OLD _IOR('s', 101, struct __kernel_old_timespec) /* Get stamp (timespec) */
+
+#endif /* __ASM_SH_SOCKIOS_H */
diff --git a/arch/sh/include/uapi/asm/stat.h b/arch/sh/include/uapi/asm/stat.h
new file mode 100644
index 000000000..b0ca755ea
--- /dev/null
+++ b/arch/sh/include/uapi/asm/stat.h
@@ -0,0 +1,78 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_SH_STAT_H
+#define __ASM_SH_STAT_H
+
+struct __old_kernel_stat {
+	unsigned short st_dev;
+	unsigned short st_ino;
+	unsigned short st_mode;
+	unsigned short st_nlink;
+	unsigned short st_uid;
+	unsigned short st_gid;
+	unsigned short st_rdev;
+	unsigned long  st_size;
+	unsigned long  st_atime;
+	unsigned long  st_mtime;
+	unsigned long  st_ctime;
+};
+
+struct stat {
+	unsigned long  st_dev;
+	unsigned long  st_ino;
+	unsigned short st_mode;
+	unsigned short st_nlink;
+	unsigned short st_uid;
+	unsigned short st_gid;
+	unsigned long  st_rdev;
+	unsigned long  st_size;
+	unsigned long  st_blksize;
+	unsigned long  st_blocks;
+	unsigned long  st_atime;
+	unsigned long  st_atime_nsec;
+	unsigned long  st_mtime;
+	unsigned long  st_mtime_nsec;
+	unsigned long  st_ctime;
+	unsigned long  st_ctime_nsec;
+	unsigned long  __unused4;
+	unsigned long  __unused5;
+};
+
+/* This matches struct stat64 in glibc2.1, hence the absolutely
+ * insane amounts of padding around dev_t's.
+ */
+struct stat64 {
+	unsigned long long	st_dev;
+	unsigned char	__pad0[4];
+
+#define STAT64_HAS_BROKEN_ST_INO	1
+	unsigned long	__st_ino;
+
+	unsigned int	st_mode;
+	unsigned int	st_nlink;
+
+	unsigned long	st_uid;
+	unsigned long	st_gid;
+
+	unsigned long long	st_rdev;
+	unsigned char	__pad3[4];
+
+	long long	st_size;
+	unsigned long	st_blksize;
+
+	unsigned long long	st_blocks;	/* Number 512-byte blocks allocated. */
+
+	unsigned long	st_atime;
+	unsigned long	st_atime_nsec;
+
+	unsigned long	st_mtime;
+	unsigned long	st_mtime_nsec;
+
+	unsigned long	st_ctime;
+	unsigned long	st_ctime_nsec;
+
+	unsigned long long	st_ino;
+};
+
+#define STAT_HAVE_NSEC 1
+
+#endif /* __ASM_SH_STAT_H */
diff --git a/arch/sh/include/uapi/asm/swab.h b/arch/sh/include/uapi/asm/swab.h
new file mode 100644
index 000000000..c727d381a
--- /dev/null
+++ b/arch/sh/include/uapi/asm/swab.h
@@ -0,0 +1,50 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef __ASM_SH_SWAB_H
+#define __ASM_SH_SWAB_H
+
+/*
+ * Copyright (C) 1999  Niibe Yutaka
+ * Copyright (C) 2000, 2001  Paolo Alberelli
+ */
+#include <linux/compiler.h>
+#include <linux/types.h>
+#include <asm-generic/swab.h>
+
+static inline __attribute_const__ __u32 __arch_swab32(__u32 x)
+{
+	__asm__(
+		"swap.b		%1, %0\n\t"
+		"swap.w		%0, %0\n\t"
+		"swap.b		%0, %0"
+		: "=r" (x)
+		: "r" (x));
+
+	return x;
+}
+#define __arch_swab32 __arch_swab32
+
+static inline __attribute_const__ __u16 __arch_swab16(__u16 x)
+{
+	__asm__(
+		"swap.b		%1, %0"
+		: "=r" (x)
+		:  "r" (x));
+
+	return x;
+}
+#define __arch_swab16 __arch_swab16
+
+static inline __u64 __arch_swab64(__u64 val)
+{
+	union {
+		struct { __u32 a,b; } s;
+		__u64 u;
+	} v, w;
+	v.u = val;
+	w.s.b = __arch_swab32(v.s.a);
+	w.s.a = __arch_swab32(v.s.b);
+	return w.u;
+}
+#define __arch_swab64 __arch_swab64
+
+#endif /* __ASM_SH_SWAB_H */
diff --git a/arch/sh/include/uapi/asm/unistd.h b/arch/sh/include/uapi/asm/unistd.h
new file mode 100644
index 000000000..0f7c7772a
--- /dev/null
+++ b/arch/sh/include/uapi/asm/unistd.h
@@ -0,0 +1,2 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#include <asm/unistd_32.h>