From nobody Fri Dec 19 18:58:12 2025 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B13C12E3AEA; Thu, 4 Dec 2025 07:23:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.17 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764833027; cv=none; b=X1AbBTKv8w+Cj5YthPcvuCTmrQUvc0DRgQNICkF5FtrWB6W3IPHo13OsG+fb+412xDb070tTIWmvEyS+IcQgEsJCbULAJ+PNKLae8e7pGCS9YFscNOje8fNdUVDD7/bvKzSMsNguZsbYTjkuBD18+g/AVw65adHNFK82Kb9ty8w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764833027; c=relaxed/simple; bh=BCg5BJPI4vrnJwZy/cBOahzk0FqyRAmssJmqoFadaVg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=mEbn07r6Ev3Iqeq0s8YwYjpnPGGuBiN7gXD6y0QUGRESOjbbWPys953DjRKxDhQ60QuYzPGWVJv8gEALkJCLmp1mzKl72ArUXdv905lHY67MEo8X6asnFbxpbckdze0zJNO/y8kcmjx9lWxgQSAN3ACqPOvWWhelE6r/wfC5Bp0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=JGOGcGuG; arc=none smtp.client-ip=198.175.65.17 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="JGOGcGuG" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1764833026; x=1796369026; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=BCg5BJPI4vrnJwZy/cBOahzk0FqyRAmssJmqoFadaVg=; b=JGOGcGuGzkfTGfdoxvdsxeWNeVrDBWeC/BDEhFbq6b9peCE7RfFR/5kd xLa2o5drPnyO7H25VdcO0ZNOZ3Awfttr9pifL6JF65SHjgULnSYuttgVq F5wXaXKDZqNcIFYWerMu4YXbHZVNGhxMUxAe8urqqoudGSElJq5vLYzSR /u1yGvEWSQ6szxiTTU+HnhRCj+0G6kEx6gbyTHM5R+WAjav3eMAf4C8eK xOVqM0GHUmwo0RTE+jCKRNYO0e2VUBlZLsqr2HTtFb50D/eUmWcIK3lIE Hv5UrC1NpNPbqG4sCxnRCJAI5srD8S9YrmzMGBkfMcRPw6Mgjai4x/0DY Q==; X-CSE-ConnectionGUID: Vc4yXEdCTJKd5wUd7dmDYA== X-CSE-MsgGUID: 6I4bY018R5+mybC6x5H2VA== X-IronPort-AV: E=McAfee;i="6800,10657,11631"; a="66804580" X-IronPort-AV: E=Sophos;i="6.20,248,1758610800"; d="scan'208";a="66804580" Received: from fmviesa004.fm.intel.com ([10.60.135.144]) by orvoesa109.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Dec 2025 23:23:44 -0800 X-CSE-ConnectionGUID: vQiroWzBTkOAGXDI37uy8Q== X-CSE-MsgGUID: xeCy5wQeRFSFTkpUbC3Tug== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.20,248,1758610800"; d="scan'208";a="199861628" Received: from sohilmeh.sc.intel.com ([172.25.103.65]) by fmviesa004.fm.intel.com with ESMTP; 03 Dec 2025 23:23:43 -0800 From: Sohil Mehta To: x86@kernel.org, Dave Hansen , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Ard Biesheuvel Cc: "H . Peter Anvin" , Andy Lutomirski , Peter Zijlstra , Kiryl Shutsemau , Sohil Mehta , Rick Edgecombe , Andrew Cooper , Tony Luck , Alexander Shishkin , linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org Subject: [PATCH 1/3] x86/cpu: Defer LASS enabling until userspace comes up Date: Wed, 3 Dec 2025 23:21:41 -0800 Message-ID: <20251204072143.3636863-2-sohil.mehta@intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20251204072143.3636863-1-sohil.mehta@intel.com> References: <20251204072143.3636863-1-sohil.mehta@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" LASS blocks any kernel access to the lower half of the virtual address space. Unfortunately, some EFI accesses happen during boot with bit 63 cleared, which causes a #GP fault when LASS is enabled. Notably, the SetVirtualAddressMap() call can only happen in EFI physical mode. Also, EFI_BOOT_SERVICES_CODE/_DATA could be accessed even after ExitBootServices(). For example, efi_check_for_embedded_firmwares() accesses this memory even after SetVirtualAddressMap(). At a minimum, LASS enabling must be deferred until EFI has completely finished entering virtual mode (including freeing boot services memory). Moving setup_lass() to arch_cpu_finalize_init() would do the trick, but it would make the implementation fragile. Something else might come in the future that needs the LASS enabling to be moved again. In general, security features such as LASS provide limited value before userspace is up. They aren't necessary during early boot while only trusted ring0 code is executing. Introduce a generic late initcall to defer activating some CPU features until userspace is enabled. For now, only move the LASS CR4 programming to this initcall. As APs are already up by the time late initcalls run, some extra steps are needed to enable LASS on all CPUs. Use a CPU hotplug callback instead of on_each_cpu() or smp_call_function(). This ensures that LASS is enabled on every CPU that is currently online as well as any future CPUs that come online later. Note, even though hotplug callbacks run with preemption enabled, cr4_set_bits() would disable interrupts while updating CR4. Keep the existing logic in place to clear the LASS feature bits early. setup_clear_cpu_cap() must be called before boot_cpu_data is finalized and alternatives are patched. Eventually, the entire setup_lass() logic can go away once the restrictions based on vsyscall emulation and EFI are removed. Signed-off-by: Sohil Mehta --- arch/x86/kernel/cpu/common.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index e7ab22fce3b5..c6835a04d734 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -422,12 +422,27 @@ static __always_inline void setup_lass(struct cpuinfo= _x86 *c) if (IS_ENABLED(CONFIG_X86_VSYSCALL_EMULATION) || IS_ENABLED(CONFIG_EFI)) { setup_clear_cpu_cap(X86_FEATURE_LASS); - return; } +} =20 +static int enable_lass(unsigned int cpu) +{ cr4_set_bits(X86_CR4_LASS); + + return 0; } =20 +static int cpu_finalize_pre_userspace(void) +{ + if (!cpu_feature_enabled(X86_FEATURE_LASS)) + return 0; + + cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "x86/lass:enable", enable_lass, NU= LL); + + return 0; +} +late_initcall(cpu_finalize_pre_userspace); + /* These bits should not change their value after CPU init is finished. */ static const unsigned long cr4_pinned_mask =3D X86_CR4_SMEP | X86_CR4_SMAP= | X86_CR4_UMIP | X86_CR4_FSGSBASE | X86_CR4_CET | X86_CR4_FRED; --=20 2.43.0 From nobody Fri Dec 19 18:58:12 2025 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2C7942F9998; Thu, 4 Dec 2025 07:23:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.17 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764833027; cv=none; b=LV4N9pce+eJGa2RvDrWiLre+b4t/lFXeWuGBz8y+PbJE1YFvBB1gcYrTVlmXhgu/GpLBgQjJpLfkF4tChTZUGdv4145YnCfycopwactiCrwqZ8qiu5qYBllRfvnPWs1crDexsIj6yq8U6hfpgRy1W9Nkwmqd2U7CmNZODYSXE4A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764833027; c=relaxed/simple; bh=yIyxQXuaRahR7U9KfaUjZE2DFbPFjXN0cVWD6cHkLok=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ArjLcdlDvAJ3+hKZo2R14M23x1/bZHbKbmDwbUNFWGs088bULsHGgBx70hdqv1pzGZmfLBZCSPXW/pf9F0s4DpJoRQW+ALsh6ivTZyYz3PzlPIiqMnYVQHzVXXMQ3ycStXHFF7w8qsj0gnnuXFZatt1/GyNOgcYHPp3iSKBPNBQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=elhOdQhx; arc=none smtp.client-ip=198.175.65.17 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="elhOdQhx" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1764833027; x=1796369027; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=yIyxQXuaRahR7U9KfaUjZE2DFbPFjXN0cVWD6cHkLok=; b=elhOdQhxTwIFK7F6bWdTzAdnDj3BnWyQYM+LrSKgFHAwPrQO3n3z76+l AkcZ05p53SHbJtrUS40vMUijxc0OK7ZkaJONqyHMdnjv4h5Pn36goagt6 FtpduEkCK8xu63mN+1W2cO6aZCzz0R+4gbQwKqezgpSADt1p9WYm6onHi Kxnyqn20uHJSl9Qfjgo6g+IzemPqN1hf1EsF6TaJfFrMb8EsfzQNXwWUw eCCDSBQ6QU1kND6QlM7BUYkwWkTGBzrrk+TlQ5JYix5KrOKKf8DjIVg7O xZwDJW4RCko9WvbrUqRieXisVwNQj3rWYuiXdE6c74wntpiixCfk9BTl3 A==; X-CSE-ConnectionGUID: RMMayjAhTRusLTu2CyjiKQ== X-CSE-MsgGUID: YyDomUCGQIeKQWmjgQ7QtA== X-IronPort-AV: E=McAfee;i="6800,10657,11631"; a="66804589" X-IronPort-AV: E=Sophos;i="6.20,248,1758610800"; d="scan'208";a="66804589" Received: from fmviesa004.fm.intel.com ([10.60.135.144]) by orvoesa109.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Dec 2025 23:23:44 -0800 X-CSE-ConnectionGUID: i50frKhHTv+EESPOUQfkhQ== X-CSE-MsgGUID: m+p96y9TT3GVDPgmmhA7VA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.20,248,1758610800"; d="scan'208";a="199861633" Received: from sohilmeh.sc.intel.com ([172.25.103.65]) by fmviesa004.fm.intel.com with ESMTP; 03 Dec 2025 23:23:43 -0800 From: Sohil Mehta To: x86@kernel.org, Dave Hansen , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Ard Biesheuvel Cc: "H . Peter Anvin" , Andy Lutomirski , Peter Zijlstra , Kiryl Shutsemau , Sohil Mehta , Rick Edgecombe , Andrew Cooper , Tony Luck , Alexander Shishkin , linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org Subject: [PATCH 2/3] x86/efi: Make runtime services compatible with LASS Date: Wed, 3 Dec 2025 23:21:42 -0800 Message-ID: <20251204072143.3636863-3-sohil.mehta@intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20251204072143.3636863-1-sohil.mehta@intel.com> References: <20251204072143.3636863-1-sohil.mehta@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Ideally, EFI runtime services should switch to kernel virtual addresses after SetVirtualAddressMap(). However, firmware implementations are known to be buggy in this regard and continue to access physical addresses. The kernel maintains a 1:1 mapping of all runtime services code and data regions to avoid breaking such firmware. LASS enforcement relies on bit 63 of the virtual address, which would block such accesses to the lower half. Unfortunately, not doing anything could lead to #GP faults when users update to a kernel with LASS enabled. One option is to use a STAC/CLAC pair to temporarily disable LASS data enforcement. However, there is no guarantee that the stray accesses would only touch data and not perform instruction fetches. Also, relying on the AC bit would depend on the runtime calls preserving RFLAGS, which is highly unlikely in practice. Instead, use the big hammer and switch off the entire LASS mechanism temporarily by clearing CR4.LASS. Do this right after switching to efi_mm (as userspace is not mapped) to minimize the security impact. Some runtime services can be invoked during boot when LASS isn't active. Use a global variable (similar to efi_mm) to save and restore the correct CR4.LASS state. The runtime calls are serialized with the efi_runtime_lock, so no concurrency issues are expected. Signed-off-by: Sohil Mehta --- arch/x86/platform/efi/efi_64.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c index b4409df2105a..3d0593d6d54c 100644 --- a/arch/x86/platform/efi/efi_64.c +++ b/arch/x86/platform/efi/efi_64.c @@ -55,6 +55,7 @@ */ static u64 efi_va =3D EFI_VA_START; static struct mm_struct *efi_prev_mm; +static unsigned long efi_cr4_lass; =20 /* * We need our own copy of the higher levels of the page tables @@ -443,16 +444,46 @@ static void efi_leave_mm(void) unuse_temporary_mm(efi_prev_mm); } =20 +/* + * Toggle LASS to allow EFI to access any 1:1 mapped region in the lower + * half. + * + * Disable LASS after switching to EFI-mm, as userspace is not mapped in + * it. Similar to EFI-mm, they rely on preemption being disabled and the + * calls being serialized. + */ + +static void efi_disable_lass(void) +{ + if (!cpu_feature_enabled(X86_FEATURE_LASS)) + return; + + /* Save current CR4.LASS state */ + efi_cr4_lass =3D cr4_read_shadow() & X86_CR4_LASS; + cr4_clear_bits(efi_cr4_lass); +} + +static void efi_enable_lass(void) +{ + if (!cpu_feature_enabled(X86_FEATURE_LASS)) + return; + + /* Reprogram CR4.LASS only if it was set earlier */ + cr4_set_bits(efi_cr4_lass); +} + void arch_efi_call_virt_setup(void) { efi_sync_low_kernel_mappings(); efi_fpu_begin(); firmware_restrict_branch_speculation_start(); efi_enter_mm(); + efi_disable_lass(); } =20 void arch_efi_call_virt_teardown(void) { + efi_enable_lass(); efi_leave_mm(); firmware_restrict_branch_speculation_end(); efi_fpu_end(); --=20 2.43.0 From nobody Fri Dec 19 18:58:12 2025 Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8DA342E2F0E; Thu, 4 Dec 2025 07:23:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=198.175.65.17 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764833029; cv=none; b=mN3FEdBLX9jxHJTah2QnMJRIg+BMJ2Umt7rq3nefEdruohzJ8xNQedeu2bjvtWmLFVvtNIl9fjaSnqfvOVsOoqiLu5TDgb/uJsMC+rGhLCMuod1LcTl0C37Uvj2t0knsKvAUby8KW/Ne4sor5bDVLOTj07H4RdyIjCqpxyJN5Ak= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764833029; c=relaxed/simple; bh=1YwCGwQ1loJ5d92qxwSBPiK3ZN6jGchTytl2iRuN2G0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LxE9Tozu3Gk8F6qu/YUZ544OwzQWmbuyy21c/tEBSCdGp8LX/e77JhSLKJy5TyKjzWBtx39giZvJKhJykVG6+tJBRfrc+Zf9MQ8CqABv7vI3oi8llZLjUWiEApv78GxATq9IAKYb+mx8jEyL0SKLhd/n89bDPvvQMy45jLyM6aI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=aG3asMkB; arc=none smtp.client-ip=198.175.65.17 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="aG3asMkB" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1764833028; x=1796369028; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=1YwCGwQ1loJ5d92qxwSBPiK3ZN6jGchTytl2iRuN2G0=; b=aG3asMkBBaV+DaTp4QX4rL5MuMw+F/lsZDSoWGJZkGfTL9CRS7LejJU8 Et0r15RQQiGjTmzPpOqcDl3buc97WjQ6vC74Th1g5cORW+f/QGUglH9jB 3ReDToEWusqqZa9ihmO8Yl3F+viOBxt82M8AJ7AgjqxHRyi6NaB9IXCT6 4XULEQP4/3zIkFZNx/GId3GG9p/hsDCd1QxieC63831SttmEpulytRIFY wTi1XLZgTgA0nY9l2iENdvrTGiYrKCFPnAcjT1bta3GusM4DyUT8D0L9L R9WyvWJnH+jpJT4xNLRkX/P/UTrhAi8uSpY5WEyr2WejZ7sq05xcHoHP6 A==; X-CSE-ConnectionGUID: kwBpiaPcQzeHfHL7TBI6iw== X-CSE-MsgGUID: kBVBHTZQTLKwarxJtAiOvA== X-IronPort-AV: E=McAfee;i="6800,10657,11631"; a="66804591" X-IronPort-AV: E=Sophos;i="6.20,248,1758610800"; d="scan'208";a="66804591" Received: from fmviesa004.fm.intel.com ([10.60.135.144]) by orvoesa109.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Dec 2025 23:23:45 -0800 X-CSE-ConnectionGUID: SJMrJGd6TJGC2+Mewjrzww== X-CSE-MsgGUID: wxbjS4EXRqCL4syPFZ/H3w== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.20,248,1758610800"; d="scan'208";a="199861636" Received: from sohilmeh.sc.intel.com ([172.25.103.65]) by fmviesa004.fm.intel.com with ESMTP; 03 Dec 2025 23:23:43 -0800 From: Sohil Mehta To: x86@kernel.org, Dave Hansen , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Ard Biesheuvel Cc: "H . Peter Anvin" , Andy Lutomirski , Peter Zijlstra , Kiryl Shutsemau , Sohil Mehta , Rick Edgecombe , Andrew Cooper , Tony Luck , Alexander Shishkin , linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org Subject: [PATCH 3/3] x86/cpu: Remove LASS restriction on EFI Date: Wed, 3 Dec 2025 23:21:43 -0800 Message-ID: <20251204072143.3636863-4-sohil.mehta@intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20251204072143.3636863-1-sohil.mehta@intel.com> References: <20251204072143.3636863-1-sohil.mehta@intel.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The initial LASS enabling has been deferred to much later during boot, and EFI runtime services now run with LASS temporarily disabled. This removes LASS from the path of all EFI services. To make LASS more usable, remove the restriction on EFI, as the two can now coexist. Signed-off-by: Sohil Mehta --- arch/x86/kernel/cpu/common.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index c6835a04d734..9c60084203b5 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -415,14 +415,9 @@ static __always_inline void setup_lass(struct cpuinfo_= x86 *c) * Legacy vsyscall page access causes a #GP when LASS is active. * Disable LASS because the #GP handler doesn't support vsyscall * emulation. - * - * Also disable LASS when running under EFI, as some runtime and - * boot services rely on 1:1 mappings in the lower half. */ - if (IS_ENABLED(CONFIG_X86_VSYSCALL_EMULATION) || - IS_ENABLED(CONFIG_EFI)) { + if (IS_ENABLED(CONFIG_X86_VSYSCALL_EMULATION)) setup_clear_cpu_cap(X86_FEATURE_LASS); - } } =20 static int enable_lass(unsigned int cpu) --=20 2.43.0