Intel VT-d Interrupt Remapping engines can be evaded by native NMI interrupts

ISSUE DESCRIPTION

Message Signaled Interrupts (MSI) interrupts on Intel platforms are defined as DWORD writes to a special address location (0xFEE???). MSIs on Intel Platforms supporting VT-d have two defined formats - Remappable format interrupts, and Compatibility (not remappable) format interrupts, based on the format of their data payload. Remappable interrupts are subject to interrupt-remapping protection checks, while compatibility format interrupts are not. For protection reasons, host software disables compatibility format interrupts (causing them to be blocked by interrupt translation hardware) and manages the remappable interrupts through programming of interrupt-remapping table entries.
Malformed MSIs are transactions to the special (0xFEE???) address range that do not have proper attributes of MSI requests (e.g., size of request is invalid). Such malformed transactions are detected and aborted by the platform, before they are subject to further interrupt remapping/processing. For RAS purposes, some platforms may be configured to support System Error Reporting (SERR) capability. These platforms raise a PCI system error (SERR#) due to Unsupported Request, which are typically delivered as Non-Maskable Interrupts (NMI), to report such errors to software. Depending on hypervisor and Dom0 kernel configuration, such an NMI may be handled by the hypervisor/Dom0 or can result in a host software halt (“panic”). On platforms with SERR enabled, such malformed MSI requests can be generated by guest OS with an assigned device, causing hypervisor/Dom0 receive NMI despite using VT-d and interrupt remapping for device assignment.

IMPACT

A malicious domain, given access to a device which bus mastering capable, can mount a denial of service attack affecting the whole system.

VULNERABLE SYSTEMS

Xen version 3.3 onwards is vulnerable.
Only systems using Intel VT-d for PCI passthrough are vulnerable where system firmware (BIOS) may enable SERR in Host Bridge device. In order to verify whether SERR is enabled, one can read the SERR Enable (SERRE) bit (bit 8) in PCICMD register (offset 0x4) in PCI configuration space of the Host Bridge device (BDF 00:00.0). Value 1 of PCICMD[SERRE] indicates SERR logic is enabled.
It is currently not known whether all or just some chipsets supporting VT-d are affected.
Any domain which is given access to a PCI device that is bus mastering capable can take advantage of this vulnerability.