From c3974cbf207716d87c66ee01b5f69b11fa461edb Mon Sep 17 00:00:00 2001 From: Andrew Cooper Date: Mon, 16 Mar 2026 14:26:09 +0000 Subject: [PATCH] x86/kexec: Invalidate the IDT earlier in kexec_reloc() After switching stack, it is not safe to run any exception handlers, because attempts to access the cpu_info block are out-of-bounds and will generate wild accesses. Invalidating the IDT in the common path means there's no need to do so again in the 32bit path, so drop compat_mode_idt entirely. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich Release-Acked-by: Oleksii Kurochko --- xen/arch/x86/x86_64/kexec_reloc.S | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/xen/arch/x86/x86_64/kexec_reloc.S b/xen/arch/x86/x86_64/kexec_reloc.S index d0951ea1e1..7a6dd2cbe7 100644 --- a/xen/arch/x86/x86_64/kexec_reloc.S +++ b/xen/arch/x86/x86_64/kexec_reloc.S @@ -44,6 +44,16 @@ FUNC(kexec_reloc, PAGE_SIZE) movq %rcx, %rbp + /* + * Invalidate the IDT. After switching off Xen's stacks, the + * exception handlers are unsafe to use, because there's no way to + * perform arithmetic on the stack pointer to find the cpu_info block. + */ + push $0 + pushw $0 + lidt (%rsp) + add $10, %rsp + /* * Move to the identity mapped stack. * @@ -94,8 +104,6 @@ FUNC(kexec_reloc, PAGE_SIZE) jmp *%rbp .L_call_32_bit: - /* Setup IDT. */ - lidt compat_mode_idt(%rip) /* Load compat GDT. */ leaq compat_mode_gdt(%rip), %rax @@ -202,11 +210,6 @@ DATA_LOCAL(compat_mode_gdt, 8) .Lcompat_mode_gdt_end: END(compat_mode_gdt) -DATA_LOCAL(compat_mode_idt) - .word 0 /* limit */ - .long 0 /* base */ -END(compat_mode_idt) - /* * 16 words of stack are more than enough. */