From: Andrew Cooper <andrew.cooper3@citrix.com>
Subject: x86/traps: Use an Interrupt Stack Table for #DB

PV guests can use architectural corner cases to cause #DB to be raised after
transitioning into supervisor mode.

Use an interrupt stack table for #DB to prevent the exception being taken with
a guest controlled stack pointer.

This is part of XSA-260 / CVE-2018-8897.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>

Index: xen-4.0.3-testing/xen/arch/x86/cpu/common.c
===================================================================
--- xen-4.0.3-testing.orig/xen/arch/x86/cpu/common.c
+++ xen-4.0.3-testing/xen/arch/x86/cpu/common.c
@@ -660,6 +660,7 @@ void __cpuinit cpu_init(void)
 	set_ist(&idt_tables[cpu][TRAP_double_fault],  IST_DF);
 	set_ist(&idt_tables[cpu][TRAP_nmi],	      IST_NMI);
 	set_ist(&idt_tables[cpu][TRAP_machine_check], IST_MCE);
+	set_ist(&idt_tables[cpu][TRAP_debug],         IST_DB);
 #endif
 
 	/* Clear all 6 debug registers: */
Index: xen-4.0.3-testing/xen/arch/x86/hvm/svm/svm.c
===================================================================
--- xen-4.0.3-testing.orig/xen/arch/x86/hvm/svm/svm.c
+++ xen-4.0.3-testing/xen/arch/x86/hvm/svm/svm.c
@@ -647,6 +647,7 @@ static void svm_ctxt_switch_from(struct
     set_ist(&idt_tables[cpu][TRAP_double_fault],  IST_DF);
     set_ist(&idt_tables[cpu][TRAP_nmi],           IST_NMI);
     set_ist(&idt_tables[cpu][TRAP_machine_check], IST_MCE);
+    set_ist(&idt_tables[cpu][TRAP_debug],         IST_DB);
 #endif
 }
 
@@ -672,6 +673,7 @@ static void svm_ctxt_switch_to(struct vc
     set_ist(&idt_tables[cpu][TRAP_double_fault],  IST_NONE);
     set_ist(&idt_tables[cpu][TRAP_nmi],           IST_NONE);
     set_ist(&idt_tables[cpu][TRAP_machine_check], IST_NONE);
+    set_ist(&idt_tables[cpu][TRAP_debug],         IST_NONE);
 #endif
 
     svm_restore_dr(v);
Index: xen-4.0.3-testing/xen/arch/x86/smpboot.c
===================================================================
--- xen-4.0.3-testing.orig/xen/arch/x86/smpboot.c
+++ xen-4.0.3-testing/xen/arch/x86/smpboot.c
@@ -927,6 +927,7 @@ static int __devinit do_boot_cpu(int api
 	set_ist(&idt_tables[cpu][TRAP_double_fault],  IST_NONE);
 	set_ist(&idt_tables[cpu][TRAP_nmi],           IST_NONE);
 	set_ist(&idt_tables[cpu][TRAP_machine_check], IST_NONE);
+	set_ist(&idt_tables[cpu][TRAP_debug],         IST_NONE);
 #endif
 
 	/*
Index: xen-4.0.3-testing/xen/arch/x86/x86_64/traps.c
===================================================================
--- xen-4.0.3-testing.orig/xen/arch/x86/x86_64/traps.c
+++ xen-4.0.3-testing/xen/arch/x86/x86_64/traps.c
@@ -367,6 +367,7 @@ void __devinit subarch_percpu_traps_init
         set_ist(&idt_table[TRAP_double_fault],  IST_DF);
         set_ist(&idt_table[TRAP_nmi],           IST_NMI);
         set_ist(&idt_table[TRAP_machine_check], IST_MCE);
+        set_ist(&idt_table[TRAP_debug],         IST_DB);
 
         /*
          * The 32-on-64 hypercall entry vector is only accessible from ring 1.
@@ -393,6 +394,9 @@ void __devinit subarch_percpu_traps_init
     /* NMI handler has its own per-CPU 4kB stack. */
     this_cpu(init_tss).ist[IST_NMI-1] = (unsigned long)&stack[IST_NMI * PAGE_SIZE];
 
+    /* DB handler has its own per-CPU 4kB stack. */
+    this_cpu(init_tss).ist[IST_DB-1] = (unsigned long)&stack[IST_DB * PAGE_SIZE];
+
     /* Trampoline for SYSCALL entry from long mode. */
     stack = &stack[IST_MAX * PAGE_SIZE]; /* Skip the IST stacks. */
     wrmsrl(MSR_LSTAR, (unsigned long)stack);
Index: xen-4.0.3-testing/xen/arch/x86/x86_64/entry.S
===================================================================
--- xen-4.0.3-testing.orig/xen/arch/x86/x86_64/entry.S
+++ xen-4.0.3-testing/xen/arch/x86/x86_64/entry.S
@@ -572,7 +572,7 @@ ENTRY(device_not_available)
 ENTRY(debug)
         pushq $0
         movl  $TRAP_debug,4(%rsp)
-        jmp   handle_exception
+        jmp   handle_ist_exception
 
 ENTRY(int3)
         pushq $0
Index: xen-4.0.3-testing/xen/include/asm-x86/processor.h
===================================================================
--- xen-4.0.3-testing.orig/xen/include/asm-x86/processor.h
+++ xen-4.0.3-testing/xen/include/asm-x86/processor.h
@@ -461,7 +461,8 @@ struct tss_struct {
 #define IST_DF   1UL
 #define IST_NMI  2UL
 #define IST_MCE  3UL
-#define IST_MAX  3UL
+#define IST_DB   4UL
+#define IST_MAX  4UL
 
 /* Set the interrupt stack table used by a particular interrupt
  * descriptor table entry. */
