x86/cpu: Fix IST handling during PCPU bringup

Clear IST references in newly allocated IDTs.  Nothing good will come of
having them set before the TSS is suitably constructed (although the chances
of the CPU surviving such an IST interrupt/exception is extremely slim).

Uniformly set the IST references after the TSS is in place.  This fixes an
issue on AMD hardware, where onlining a PCPU while PCPU0 is in HVM context
will cause IST_NONE to be copied into the new IDT, making that PCPU vulnerable
to privilege escalation from PV guests until it subsequently schedules an HVM
guest.

This is XSA-244.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
master commit: cc08c73c8c1f5ba5ed0f8274548db6725e1c3157
master date: 2017-10-12 14:50:31 +0200

diff --git a/xen/arch/x86/cpu/common.c b/xen/arch/x86/cpu/common.c
index 7dc82200b0b31ea718856535555a51f60f2110d1..4874b04e79a65cf3f754539f42bb0d73f215a4cb 100644 (file)
--- a/xen/arch/x86/cpu/common.c
+++ b/xen/arch/x86/cpu/common.c
@@ -556,6 +556,7 @@ void __init early_cpu_init(void)
  * - Sets up TSS with stack pointers, including ISTs
  * - Inserts TSS selector into regular and compat GDTs
  * - Loads GDT, IDT, TR then null LDT
+ * - Sets up IST references in the IDT
  */
 void __cpuinit load_system_tables(void)
 {
@@ -602,6 +603,10 @@ void __cpuinit load_system_tables(void)
        asm volatile ("lidt %0"  : : "m"  (idtr) );
        asm volatile ("ltr  %w0" : : "rm" (TSS_ENTRY << 3) );
        asm volatile ("lldt %w0" : : "rm" (0) );
+
+       set_ist(&idt_tables[cpu][TRAP_double_fault],  IST_DF);
+       set_ist(&idt_tables[cpu][TRAP_nmi],           IST_NMI);
+       set_ist(&idt_tables[cpu][TRAP_machine_check], IST_MCE);
 }
 
 /*

diff --git a/xen/arch/x86/smpboot.c b/xen/arch/x86/smpboot.c
index a84f0388b941e4c9716e55eed267dd780cde4eb1..a95f06efc121dc1ba91d65ea56bbf0ad858eae87 100644 (file)
--- a/xen/arch/x86/smpboot.c
+++ b/xen/arch/x86/smpboot.c
@@ -664,6 +664,9 @@ static int cpu_smpboot_alloc(unsigned int cpu)
     if ( idt_tables[cpu] == NULL )
         goto oom;
     memcpy(idt_tables[cpu], idt_table, IDT_ENTRIES * sizeof(idt_entry_t));
+    set_ist(&idt_tables[cpu][TRAP_double_fault],  IST_NONE);
+    set_ist(&idt_tables[cpu][TRAP_nmi],           IST_NONE);
+    set_ist(&idt_tables[cpu][TRAP_machine_check], IST_NONE);
 
     if ( zalloc_cpumask_var(&per_cpu(cpu_sibling_mask, cpu)) &&
          zalloc_cpumask_var(&per_cpu(cpu_core_mask, cpu)) )