[PATCH] arm64: scs: Remove redundant save/restore of SCS SP on entry to/from EL0

[PATCH] arm64: scs: Remove redundant save/restore of SCS SP on entry to/from EL0

[Will Deacon]

When returning to userspace, the SCS is empty and so the SCS SP just
points to the base address of the SCS page.

Rather than saving and restoring this address in the current task, we
can simply restore the SCS SP to point at the base of the stack on entry
to EL1 from EL0.

Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Will Deacon <will@kernel.org>
---
 arch/arm64/include/asm/scs.h | 8 ++++++++
 arch/arm64/kernel/entry.S    | 4 +---
 2 files changed, 9 insertions(+), 3 deletions(-)

I just spotted this by inspection when I was hacking on our exception
entry code.

diff --git a/arch/arm64/include/asm/scs.h b/arch/arm64/include/asm/scs.h
index 0fbc2e7867d3..a15a2968e7b6 100644
--- a/arch/arm64/include/asm/scs.h
+++ b/arch/arm64/include/asm/scs.h
@@ -10,6 +10,11 @@
 #ifdef CONFIG_SHADOW_CALL_STACK
 	scs_sp	.req	x18
 
+	.macro scs_load_current_base
+	get_current_task scs_sp
+	ldr	scs_sp, [scs_sp, #TSK_TI_SCS_BASE]
+	.endm
+
 	.macro scs_load_current
 	get_current_task scs_sp
 	ldr	scs_sp, [scs_sp, #TSK_TI_SCS_SP]
@@ -19,6 +24,9 @@
 	str	scs_sp, [\tsk, #TSK_TI_SCS_SP]
 	.endm
 #else
+	.macro scs_load_current_base
+	.endm
+
 	.macro scs_load_current
 	.endm
 
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index f8018b5c1f9a..ab476ba060d1 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -273,7 +273,7 @@ alternative_if ARM64_HAS_ADDRESS_AUTH
 alternative_else_nop_endif
 1:
 
-	scs_load_current
+	scs_load_current_base
 	.else
 	add	x21, sp, #PT_REGS_SIZE
 	get_current_task tsk
@@ -378,8 +378,6 @@ alternative_if ARM64_WORKAROUND_845719
 alternative_else_nop_endif
 #endif
 3:
-	scs_save tsk
-
 	/* Ignore asynchronous tag check faults in the uaccess routines */
 	ldr	x0, [tsk, THREAD_SCTLR_USER]
 	clear_mte_async_tcf x0
-- 
2.53.0.851.ga537e3e6e9-goog

Re: [PATCH] arm64: scs: Remove redundant save/restore of SCS SP on entry to/from EL0

[Ard Biesheuvel]

On Fri, 13 Mar 2026, at 13:32, Will Deacon wrote:
> When returning to userspace, the SCS is empty and so the SCS SP just
> points to the base address of the SCS page.
>
> Rather than saving and restoring this address in the current task, we
> can simply restore the SCS SP to point at the base of the stack on entry
> to EL1 from EL0.
>
> Cc: Ard Biesheuvel <ardb@kernel.org>
> Cc: Mark Rutland <mark.rutland@arm.com>
> Cc: Sami Tolvanen <samitolvanen@google.com>
> Signed-off-by: Will Deacon <will@kernel.org>
> ---
>  arch/arm64/include/asm/scs.h | 8 ++++++++
>  arch/arm64/kernel/entry.S    | 4 +---
>  2 files changed, 9 insertions(+), 3 deletions(-)
>

Acked-by: Ard Biesheuvel <ardb@kernel.org>

Re: [PATCH] arm64: scs: Remove redundant save/restore of SCS SP on entry to/from EL0

[Mark Rutland]

On Fri, Mar 13, 2026 at 12:32:19PM +0000, Will Deacon wrote:
> When returning to userspace, the SCS is empty and so the SCS SP just
> points to the base address of the SCS page.
> 
> Rather than saving and restoring this address in the current task, we
> can simply restore the SCS SP to point at the base of the stack on entry
> to EL1 from EL0.
> 
> Cc: Ard Biesheuvel <ardb@kernel.org>
> Cc: Mark Rutland <mark.rutland@arm.com>
> Cc: Sami Tolvanen <samitolvanen@google.com>
> Signed-off-by: Will Deacon <will@kernel.org>

I think this works either way, so:

Acked-by: Mark Rutland <mark.rutland@arm.com>

Mark.

> ---
>  arch/arm64/include/asm/scs.h | 8 ++++++++
>  arch/arm64/kernel/entry.S    | 4 +---
>  2 files changed, 9 insertions(+), 3 deletions(-)
> 
> I just spotted this by inspection when I was hacking on our exception
> entry code.
> 
> diff --git a/arch/arm64/include/asm/scs.h b/arch/arm64/include/asm/scs.h
> index 0fbc2e7867d3..a15a2968e7b6 100644
> --- a/arch/arm64/include/asm/scs.h
> +++ b/arch/arm64/include/asm/scs.h
> @@ -10,6 +10,11 @@
>  #ifdef CONFIG_SHADOW_CALL_STACK
>  	scs_sp	.req	x18
>  
> +	.macro scs_load_current_base
> +	get_current_task scs_sp
> +	ldr	scs_sp, [scs_sp, #TSK_TI_SCS_BASE]
> +	.endm
> +
>  	.macro scs_load_current
>  	get_current_task scs_sp
>  	ldr	scs_sp, [scs_sp, #TSK_TI_SCS_SP]
> @@ -19,6 +24,9 @@
>  	str	scs_sp, [\tsk, #TSK_TI_SCS_SP]
>  	.endm
>  #else
> +	.macro scs_load_current_base
> +	.endm
> +
>  	.macro scs_load_current
>  	.endm
>  
> diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
> index f8018b5c1f9a..ab476ba060d1 100644
> --- a/arch/arm64/kernel/entry.S
> +++ b/arch/arm64/kernel/entry.S
> @@ -273,7 +273,7 @@ alternative_if ARM64_HAS_ADDRESS_AUTH
>  alternative_else_nop_endif
>  1:
>  
> -	scs_load_current
> +	scs_load_current_base
>  	.else
>  	add	x21, sp, #PT_REGS_SIZE
>  	get_current_task tsk
> @@ -378,8 +378,6 @@ alternative_if ARM64_WORKAROUND_845719
>  alternative_else_nop_endif
>  #endif
>  3:
> -	scs_save tsk
> -
>  	/* Ignore asynchronous tag check faults in the uaccess routines */
>  	ldr	x0, [tsk, THREAD_SCTLR_USER]
>  	clear_mte_async_tcf x0
> -- 
> 2.53.0.851.ga537e3e6e9-goog
> 

Re: [PATCH] arm64: scs: Remove redundant save/restore of SCS SP on entry to/from EL0

[Sami Tolvanen]

On Fri, Mar 13, 2026 at 12:32:19PM +0000, Will Deacon wrote:
> When returning to userspace, the SCS is empty and so the SCS SP just
> points to the base address of the SCS page.
> 
> Rather than saving and restoring this address in the current task, we
> can simply restore the SCS SP to point at the base of the stack on entry
> to EL1 from EL0.
> 
> Cc: Ard Biesheuvel <ardb@kernel.org>
> Cc: Mark Rutland <mark.rutland@arm.com>
> Cc: Sami Tolvanen <samitolvanen@google.com>
> Signed-off-by: Will Deacon <will@kernel.org>
> ---
>  arch/arm64/include/asm/scs.h | 8 ++++++++
>  arch/arm64/kernel/entry.S    | 4 +---
>  2 files changed, 9 insertions(+), 3 deletions(-)
> 
> I just spotted this by inspection when I was hacking on our exception
> entry code.

Reviewed-by: Sami Tolvanen <samitolvanen@google.com>

Sami

Re: [PATCH] arm64: scs: Remove redundant save/restore of SCS SP on entry to/from EL0

[Catalin Marinas]

On Fri, 13 Mar 2026 12:32:19 +0000, Will Deacon wrote:
> When returning to userspace, the SCS is empty and so the SCS SP just
> points to the base address of the SCS page.
> 
> Rather than saving and restoring this address in the current task, we
> can simply restore the SCS SP to point at the base of the stack on entry
> to EL1 from EL0.
> 
> [...]

Applied to arm64 (for-next/misc), thanks!

[1/1] arm64: scs: Remove redundant save/restore of SCS SP on entry to/from EL0
      https://git.kernel.org/arm64/c/3ce8f5860ff4

-- 
Catalin