From 5e8b52dab7bb3b41535d6bbd76074e77f058ce98 Mon Sep 17 00:00:00 2001 From: Leah Neukirchen Date: Wed, 22 Jul 2026 17:14:22 +0200 Subject: [PATCH] rpi-kernel: disable CONFIG_BPF_JIT_ALWAYS_ON on 32-bit ARM The BPF JIT for 32-bit ARM platforms has various issues with bigger filters, which are usually circumvented by falling back to the interpreter; however, our configuration prehibited that. Notably, the updated SECCOMP filter in OpenSSH 10.4 was too big and triggered the errno ENOTSUPP, which broke any login attempt. See https://patchew.org/linux/20250813152958.3107403-1-kafai.wan@linux.dev/20250813152958.3107403-3-kafai.wan@linux.dev/ for a discussion about the 32-bit ARM BPF JIT and its faults. --- srcpkgs/rpi-kernel/files/armv6-dotconfig | 2 +- srcpkgs/rpi-kernel/files/armv7-dotconfig | 2 +- srcpkgs/rpi-kernel/template | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/srcpkgs/rpi-kernel/files/armv6-dotconfig b/srcpkgs/rpi-kernel/files/armv6-dotconfig index ca2fc3e193aa5e..10401cc125785c 100644 --- a/srcpkgs/rpi-kernel/files/armv6-dotconfig +++ b/srcpkgs/rpi-kernel/files/armv6-dotconfig @@ -96,7 +96,7 @@ CONFIG_HAVE_EBPF_JIT=y # CONFIG_BPF_SYSCALL=y CONFIG_BPF_JIT=y -CONFIG_BPF_JIT_ALWAYS_ON=y +# CONFIG_BPF_JIT_ALWAYS_ON is not set CONFIG_BPF_JIT_DEFAULT_ON=y CONFIG_BPF_UNPRIV_DEFAULT_OFF=y # CONFIG_BPF_PRELOAD is not set diff --git a/srcpkgs/rpi-kernel/files/armv7-dotconfig b/srcpkgs/rpi-kernel/files/armv7-dotconfig index e770452b108415..a758be95373103 100644 --- a/srcpkgs/rpi-kernel/files/armv7-dotconfig +++ b/srcpkgs/rpi-kernel/files/armv7-dotconfig @@ -104,7 +104,7 @@ CONFIG_HAVE_EBPF_JIT=y # CONFIG_BPF_SYSCALL=y CONFIG_BPF_JIT=y -CONFIG_BPF_JIT_ALWAYS_ON=y +# CONFIG_BPF_JIT_ALWAYS_ON is not set CONFIG_BPF_JIT_DEFAULT_ON=y CONFIG_BPF_UNPRIV_DEFAULT_OFF=y # CONFIG_BPF_PRELOAD is not set diff --git a/srcpkgs/rpi-kernel/template b/srcpkgs/rpi-kernel/template index e0cb1a92585563..b6bd96b1a1f5b7 100644 --- a/srcpkgs/rpi-kernel/template +++ b/srcpkgs/rpi-kernel/template @@ -15,7 +15,7 @@ # XXX: KEEP IN SYNC WITH rpi5-kernel pkgname=rpi-kernel version=6.12.87 -revision=1 +revision=2 _githash=ae4d75fb36deba0fe1a986d9bfae65755e082dd0 archs="aarch64* armv6l* armv7l*" hostmakedepends="perl kmod uboot-mkimage openssl-devel bc bison flex xz pahole