[PATCH] x86/process: Use thread.gsindex for 32-bit gs, drop dead thread.fs

From: Uros Bizjak

Date: Sun Sep 06 2026 - 16:22:30 EST


thread_struct duplicates what 64-bit already does for segment
tracking: on X86_64 the active FS/GS selectors live in the 16-bit
fsindex/gsindex fields, while X86_32 instead carries its own
"unsigned long fs, gs" pair, flagged since day one with:

/*
* XXX: this could presumably be unsigned short. Alternatively,
* 32-bit kernels could be taught to use fsindex instead.
*/

Do the second half of that TODO for gs, and just delete fs.

gs is the only one of the two that actually needs storage in
thread_struct on 32-bit. pt_regs does have a gs slot, but on
32-bit it is repurposed to hold the interrupt vector number
("On interrupt, gs and __gsh store the vector number. They never
store gs any more.", see struct pt_regs in ptrace.h) rather than
the real %gs selector, so __switch_to() and ptrace() need
thread.gs as the only place the actual value lives. fs has no
such repurposing - its pt_regs slot genuinely holds %fs (see
PT_FS / regs->fs) and sigcontext does too - and thread.fs has had
no reader or writer anywhere in the tree for years: it's dead
weight in every 32-bit task_struct.

Move gsindex out of the CONFIG_X86_32 #else branch so it's shared
between 32-bit and 64-bit instead of 32-bit growing its own copy,
and update the corresponding .gs sites in process.c, process_32.c and
ptrace.c to match. Segment selectors are 16 bits wide, so narrowing
from unsigned long to unsigned short loses nothing - ptrace's
set_segment_reg() already truncates to u16 before the assignment.

No functional change; thread_struct also gets a little smaller on
32-bit as a side effect.

Signed-off-by: Uros Bizjak <ubizjak@xxxxxxxxx>
Cc: Thomas Gleixner <tglx@xxxxxxxxxx>
Cc: Ingo Molnar <mingo@xxxxxxxxxx>
Cc: Borislav Petkov <bp@xxxxxxxxx>
Cc: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx>
Cc: "H. Peter Anvin" <hpa@xxxxxxxxx>
---
arch/x86/include/asm/processor.h | 10 +---------
arch/x86/kernel/process.c | 2 +-
arch/x86/kernel/process_32.c | 6 +++---
arch/x86/kernel/ptrace.c | 4 ++--
4 files changed, 7 insertions(+), 15 deletions(-)

diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index ec9db0dfa0df..d80a28fb51ec 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -476,19 +476,11 @@ struct thread_struct {
unsigned short es;
unsigned short ds;
unsigned short fsindex;
- unsigned short gsindex;
#endif
-
+ unsigned short gsindex;
#ifdef CONFIG_X86_64
unsigned long fsbase;
unsigned long gsbase;
-#else
- /*
- * XXX: this could presumably be unsigned short. Alternatively,
- * 32-bit kernels could be taught to use fsindex instead.
- */
- unsigned long fs;
- unsigned long gs;
#endif

/* Save middle states of ptrace breakpoints */
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 346c438ac880..5b1a132ff84e 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -204,7 +204,7 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
set_bit(MM_CONTEXT_LOCK_LAM, &p->mm->context.flags);
#else
p->thread.sp0 = (unsigned long) (childregs + 1);
- savesegment(gs, p->thread.gs);
+ savesegment(gs, p->thread.gsindex);
/*
* Clear all status flags including IF and set fixed bit. 64bit
* does not have this initialization as the frame does not contain
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 168dabf9853f..f520039d7d15 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -172,7 +172,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
* used %fs or %gs (it does not today), or if the kernel is
* running inside of a hypervisor layer.
*/
- savesegment(gs, prev->gs);
+ savesegment(gs, prev->gsindex);

/*
* Load the per-thread Thread-Local Storage descriptor.
@@ -202,8 +202,8 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
/*
* Restore %gs if needed (which is common)
*/
- if (prev->gs | next->gs)
- loadsegment(gs, next->gs);
+ if (prev->gsindex | next->gsindex)
+ loadsegment(gs, next->gsindex);

raw_cpu_write(current_task, next_p);

diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 3dcadc13f09a..09fcbfba8a45 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -192,7 +192,7 @@ static u16 get_segment_reg(struct task_struct *task, unsigned long offset)
if (task == current)
savesegment(gs, retval);
else
- retval = task->thread.gs;
+ retval = task->thread.gsindex;
}
return retval;
}
@@ -230,7 +230,7 @@ static int set_segment_reg(struct task_struct *task,
break;

case offsetof(struct user_regs_struct, gs):
- task->thread.gs = value;
+ task->thread.gsindex = value;
}

return 0;
--
2.55.0