Re: [tip: x86/urgent] x86/cpu: Disable CR pinning during CPU bringup

[Dave Hansen]

On 3/18/26 14:09, Peter Zijlstra wrote:
> So currently we setup an IDT and everything, then setup the FRED MSRs,
> flip CR4_FRED and call it a day. But we could just explicitly poison all
> the IDT stuff to cause tripple faults.

We already have:

        /* Enable FRED */
        cr4_set_bits(X86_CR4_FRED);
        /* Any further IDT use is a bug */
        idt_invalidate();

which I think means that if you clear X86_CR4_FRED, you triple-fault on
the next reference to the IDT. That's a fate far worse than having the
CR-pinning code silently fix up X86_CR4_FRED.

It's arguable that having X86_CR4_FRED pinned in the first place makes
things less secure if an attacker is thwacking CR4 bits.