multiple MSI mapping issues on x86

ISSUE DESCRIPTION

Multiple issues exist with the setup of PCI MSI interrupts:

• unprivileged guests were permitted access to devices not owned by them, in particular allowing them to disable MSI or MSI-X on any device
• HVM guests can trigger a codepath intended only for PV guests
• some failure paths partially tear down previously configured interrupts, leaving inconsistent state
• with XSM enabled, caller and callee of a hook disagreed about the data structure pointed to by a type-less argument

IMPACT

A malicious or buggy guest may cause the hypervisor to crash, resulting in Denial of Service (DoS) affecting the entire host. Privilege escalation and information leaks cannot be excluded.

VULNERABLE SYSTEMS

All Xen versions from at 3.3 onwards are vulnerable. Xen versions 3.2 and earlier are not vulnerable.
Only x86 systems are affected. ARM systems are not affected.
Only guests which have a physical device assigned to them can exploit the vulnerability.