[xen stable-4.21] x86/kexec: Disable FRED earlier in kexec_reloc()

[patchbot@xxxxxxx]

commit c16597ec81365f065ca8d02ec49d237725f2d64e
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Tue Jun 30 14:54:57 2026 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Jun 30 14:54:57 2026 +0200

    x86/kexec: Disable FRED earlier in kexec_reloc()
    
    With FRED just as with IDT, it's unsafe to run the exception handlers after
    switching stack.
    
    To remove this unsafe window, %cr4 needs clearing earlier.  In turn, we may
    need to switch to PCID 0 earlier too in order to be able to clear CR4.PCIDE.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Jan Beulich <jbeulich@xxxxxxxx>
    master commit: 4665d1796736cd999a3a8d291d4fbb4da637f440
    master date: 2026-06-23 19:15:51 +0100
---
 xen/arch/x86/x86_64/kexec_reloc.S | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/xen/arch/x86/x86_64/kexec_reloc.S 
b/xen/arch/x86/x86_64/kexec_reloc.S
index 406f60bc64..20a6b3a8ab 100644
--- a/xen/arch/x86/x86_64/kexec_reloc.S
+++ b/xen/arch/x86/x86_64/kexec_reloc.S
@@ -46,6 +46,21 @@ FUNC(kexec_reloc, PAGE_SIZE)
         lidt    (%rsp)
         add     $10, %rsp
 
+        /* Move to PCID 0 if necessary, as a prerequisite to clearing 
CR4.PCIDE */
+        mov     %cr3, %rax
+        test    $0xfff, %eax
+        jz      1f
+        and     $~0xfff, %rax
+        mov     %rax, %cr3
+1:
+
+        /*
+         * Set CR4 to PAE only.  This may disable FRED, which must happen
+         * before switching off Xen's stack.
+         */
+        mov     $X86_CR4_PAE, %eax
+        mov     %rax, %cr4
+
         /* Setup stack. */
         leaq    (.Lreloc_stack_base - kexec_reloc)(%rdi), %rsp
 
@@ -71,13 +86,6 @@ FUNC(kexec_reloc, PAGE_SIZE)
         orl     $(X86_CR0_PG | X86_CR0_PE), %eax
         movq    %rax, %cr0
 
-        /*
-         * Set cr4 to a known state:
-         *  - physical address extension enabled
-         */
-        movl    $X86_CR4_PAE, %eax
-        movq    %rax, %cr4
-
         movq    %rdx, %rdi
         call    relocate_pages
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.21