Re: [PATCH] x86/IDT: Fix IDT generation for INT $0x80

[Andrew Cooper <andrew.cooper3@citrix.com>]

On 11/03/2025 9:27 pm, Andrew Cooper wrote:
> On 11/03/2025 9:22 pm, Andrew Cooper wrote:
>> When PV is enabled, entry_int80 needs to be DPL3, not DPL0.
>>
>> This causes the XSA-259 PoC to fail with:
>>
>>   --- Xen Test Framework ---
>>   Environment: PV 64bit (Long mode 4 levels)
>>   XSA-259 PoC
>>   Error: Unexpected fault 0x800d0802, #GP[IDT[256]]
>>   Test result: ERROR
>>
>> (Clearly I have a bug in XTF's rendering of the error code too.)

Nope, it's a QEMU bug.  Under QEMU, we get:

--- Xen Test Framework ---
Environment: PV 64bit (Long mode 4 levels)
XSA-259 PoC
(XEN) [    3.982447] *** #GP/IDT ec 00000802
(XEN) [    3.982668] *** #GP/IDT ec 00000802, not permitted
(XEN) [    3.982849] *** #GP inject ec 00000802
Error: Unexpected fault 0x800d0802, #GP[IDT[256]]
Test result: ERROR


On real hardware:

(d1) --- Xen Test Framework ---
(d1) Environment: PV 64bit (Long mode 4 levels)
(d1) XSA-259 PoC
(XEN) *** #GP/IDT ec 00000402
(XEN) *** #GP/IDT ec 00000402, not permitted
(XEN) *** #GP inject ec 00000402
(d1) Success: Not vulnerable to XSA-259
(d1) Test result: SUCCESS

So it's by chance that Luca's testing even picked up this failure.  The
XSA-259 PoC can't distinguish between the #GP INT emulation path and the
INT80 fastpath's error path which injects #GP.

~Andrew