From: fangyu.yu@linux.alibaba.com
To: pjw@kernel.org, palmer@dabbelt.com, aou@eecs.berkeley.edu,
alex@ghiti.fr, songshuaishuai@tinylab.org, bjorn@rivosinc.com,
ardb@kernel.org, arnd@arndb.de, bhelgaas@google.com,
richard.lyu@suse.com, tzimmermann@suse.de, nathan@kernel.org
Cc: guoren@kernel.org, kvm-riscv@lists.infradead.org,
linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org,
Fangyu Yu <fangyu.yu@linux.alibaba.com>
Subject: [PATCH 4/4] riscv: kexec: Switch to trampoline page table before norelocate
Date: Tue, 24 Mar 2026 19:45:27 +0800 [thread overview]
Message-ID: <20260324114527.91494-5-fangyu.yu@linux.alibaba.com> (raw)
In-Reply-To: <20260324114527.91494-1-fangyu.yu@linux.alibaba.com>
From: Fangyu Yu <fangyu.yu@linux.alibaba.com>
Make riscv_kexec_norelocate a two-pass trampoline so it can
drop the kernel page tables while still executing from a
mapped address.
On the first entry, t3 is initialized to 0 by machine_kexec().
Loads the physical address of riscv_kexec_norelocate and the
trampoline SATP value, switches to the trampoline page table,
and jumps to the trampoline VA(=PA).
On the second entry, t3 contains the physical address of
riscv_kexec_norelocate, so the PC comparison matches and
execution continues under trampoline VA(=PA).
Since the trampoline page table is already active, replace the
previous stvec-based handoff with a direct jump to the target
entry (jr a2).
Signed-off-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
---
arch/riscv/kernel/kexec_relocate.S | 32 +++++++++++++++++++++++++-----
arch/riscv/kernel/machine_kexec.c | 13 ++++++++++++
2 files changed, 40 insertions(+), 5 deletions(-)
diff --git a/arch/riscv/kernel/kexec_relocate.S b/arch/riscv/kernel/kexec_relocate.S
index af6b99f5b0fd..2b9892bf04f2 100644
--- a/arch/riscv/kernel/kexec_relocate.S
+++ b/arch/riscv/kernel/kexec_relocate.S
@@ -147,13 +147,35 @@ riscv_kexec_relocate_end:
/* Used for jumping to crashkernel */
+.extern kexec_tramp_satp
+.extern riscv_kexec_norelocate_pa
.section ".kexec.tramp.text", "ax"
SYM_CODE_START(riscv_kexec_norelocate)
+ /*
+ * Two-pass entry:
+ * - 1st entry: t3 == 0 (initialized by machine_kexec()).
+ *
+ * - 2nd entry: t3 holds the physical address of
+ * riscv_kexec_norelocate, so auipc matches t3 and we fall through
+ * to label 1 to continue execution under trampoline VA(=PA).
+ */
+ auipc t0, 0
+ beq t0, t3, 1f
+
+ la t0, riscv_kexec_norelocate_pa
+ REG_L t3, 0(t0)
+ la t0, kexec_tramp_satp
+ REG_L t1, 0(t0)
+ csrw CSR_SATP, t1
+ sfence.vma x0, x0
+
+ jr t3
/*
* s0: (const) Phys address to jump to
* s1: (const) Phys address of the FDT image
* s2: (const) The hartid of the current hart
*/
+1:
mv s0, a1
mv s1, a2
mv s2, a3
@@ -199,13 +221,13 @@ SYM_CODE_START(riscv_kexec_norelocate)
csrw CSR_SSCRATCH, zero
/*
- * Switch to physical addressing
- * This will also trigger a jump to CSR_STVEC
- * which in this case is the address of the new
- * kernel.
+ * We are already executing from the trampoline VA with the trampoline
+ * page table installed, so there is no need to rely on the old flow
+ * of programming stvec and taking the implicit trap on SATP switch.
+ * Jump directly to the target entry instead.
*/
- csrw CSR_STVEC, a2
csrw CSR_SATP, zero
+ jr a2
SYM_CODE_END(riscv_kexec_norelocate)
diff --git a/arch/riscv/kernel/machine_kexec.c b/arch/riscv/kernel/machine_kexec.c
index 4e522a64a614..d78e7928c6cf 100644
--- a/arch/riscv/kernel/machine_kexec.c
+++ b/arch/riscv/kernel/machine_kexec.c
@@ -18,6 +18,8 @@
#include <linux/interrupt.h>
#include <linux/irq.h>
+unsigned long kexec_tramp_satp;
+unsigned long riscv_kexec_norelocate_pa;
static pgd_t kexec_tramp_pgd[PTRS_PER_PGD] __aligned(PAGE_SIZE);
static p4d_t kexec_tramp_p4d[PTRS_PER_P4D] __aligned(PAGE_SIZE);
static pud_t kexec_tramp_pud[PTRS_PER_PUD] __aligned(PAGE_SIZE);
@@ -266,6 +268,8 @@ machine_kexec(struct kimage *image)
*/
riscv_kexec_build_tramp((unsigned long)__kexec_tramp_text_start,
__pa_symbol(__kexec_tramp_text_start));
+ riscv_kexec_norelocate_pa = __pa_symbol(&riscv_kexec_norelocate);
+ kexec_tramp_satp = PFN_DOWN(__pa_symbol(kexec_tramp_pgd)) | satp_mode;
}
pr_notice("Will call new kernel at %08lx from hart id %lx\n",
@@ -277,6 +281,15 @@ machine_kexec(struct kimage *image)
/* Jump to the relocation code */
pr_notice("Bye...\n");
+ /*
+ * Initialize t3 to 0 for riscv_kexec_norelocate().
+ *
+ * The norelocate trampoline uses t3 as a scratch register to record/
+ * compare against the current PC when switching to the trampoline
+ * page table. Keep t3 untouched from here until we branch into
+ * riscv_kexec_norelocate.
+ */
+ asm volatile ("li t3, 0x0" ::: "t3");
kexec_method(first_ind_entry, jump_addr, fdt_addr,
this_hart_id, kernel_map.va_pa_offset);
unreachable();
--
2.50.1
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
prev parent reply other threads:[~2026-03-24 11:46 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-24 11:45 [PATCH 0/4] Add crashdump support in guest kernel fangyu.yu
2026-03-24 11:45 ` [PATCH 1/4] riscv: Add kexec trampoline text section to vmlinux.lds.S fangyu.yu
2026-03-24 11:45 ` [PATCH 2/4] riscv: kexec: Place norelocate trampoline into .kexec.tramp.text fangyu.yu
2026-03-24 11:45 ` [PATCH 3/4] riscv: kexec: Build trampoline page tables for crash kernel entry fangyu.yu
2026-03-24 11:45 ` fangyu.yu [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260324114527.91494-5-fangyu.yu@linux.alibaba.com \
--to=fangyu.yu@linux.alibaba.com \
--cc=alex@ghiti.fr \
--cc=aou@eecs.berkeley.edu \
--cc=ardb@kernel.org \
--cc=arnd@arndb.de \
--cc=bhelgaas@google.com \
--cc=bjorn@rivosinc.com \
--cc=guoren@kernel.org \
--cc=kvm-riscv@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=nathan@kernel.org \
--cc=palmer@dabbelt.com \
--cc=pjw@kernel.org \
--cc=richard.lyu@suse.com \
--cc=songshuaishuai@tinylab.org \
--cc=tzimmermann@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox