x86: Incorrect handling of IST settings during CPU hotplug

ISSUE DESCRIPTION

The x86-64 architecture allows interrupts to be run on distinct stacks. The choice of stack is encoded in a field of the corresponding interrupt descriptor in the Interrupt Descriptor Table (IDT). That field selects an entry from the active Task State Segment (TSS).
Since, on AMD hardware, Xen switches to an HVM guest’s TSS before actually entering the guest, with the Global Interrupt Flag still set, the selectors in the IDT entry are switched when guest context is loaded/unloaded.
When a new CPU is brought online, its IDT is copied from CPU0’s IDT, including those selector fields. If CPU0 happens at that moment to be in HVM context, wrong values for those IDT fields would be installed for the new CPU. If the first guest vCPU to be run on that CPU belongs to a PV guest, it will then have the ability to escalate its privilege or crash the hypervisor.

IMPACT

A malicious or buggy x86 PV guest could escalate its privileges or crash the hypervisor.

VULNERABLE SYSTEMS

All Xen versions from at least 3.2 onwards are vulnerable. Earlier versions have not been checked.
Only PV guests can exploit the vulnerability. HVM guests cannot exploit the vulnerability, but their presence is necessary for the exposure of the vulnerability to PV guests.
Only x86 systems using SVM (AMD virtualisation extensions) rather than VMX (Intel virtualisation extensions) are vulnerable. Therefore AMD x86 hardware is vulnerable; Intel hardware is not vulnerable.
ARM systems are not vulnerable.