[Xen-changelog] [xen-unstable] vmx: During task-switch, read instr-len VMCS field only when valid.

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Keir Fraser <keir.fraser@xxxxxxxxxx>
# Date 1259761147 0
# Node ID 28d967d08cd9398b924932b1c603537ab7f94c6f
# Parent  7ffec3fab548e84d2b94e1ab08716c66c571c8f3
vmx: During task-switch, read instr-len VMCS field only when valid.

Otherwise we can crash on the BUG_ON() in __get_instruction_length().

Signed-off-by: Keir Fraser <keir.fraser@xxxxxxxxxx>
---
 xen/arch/x86/hvm/vmx/vmx.c |   22 ++++++++++++----------
 1 files changed, 12 insertions(+), 10 deletions(-)

diff -r 7ffec3fab548 -r 28d967d08cd9 xen/arch/x86/hvm/vmx/vmx.c
--- a/xen/arch/x86/hvm/vmx/vmx.c        Wed Dec 02 08:52:50 2009 +0000
+++ b/xen/arch/x86/hvm/vmx/vmx.c        Wed Dec 02 13:39:07 2009 +0000
@@ -2521,16 +2521,18 @@ asmlinkage void vmx_vmexit_handler(struc
         int32_t ecode = -1, source;
         exit_qualification = __vmread(EXIT_QUALIFICATION);
         source = (exit_qualification >> 30) & 3;
-        inst_len = __get_instruction_length(); /* Safe: See SDM 3B 23.2.4 */
-        if ( (source == 3) && (idtv_info & INTR_INFO_VALID_MASK) )
-        {
-            /* ExtInt, NMI, HWException: no instruction to skip over. */
-            if ( !(idtv_info & (1u<<10)) ) /* 0 <= IntrType <= 3? */
-                inst_len = 0;
-            /* If there's an error code then we pass it along. */
-            if ( idtv_info & INTR_INFO_DELIVER_CODE_MASK )
-                ecode = __vmread(IDT_VECTORING_ERROR_CODE);
-        }
+        /* Vectored event should fill in interrupt information. */
+        WARN_ON((source == 3) && !(idtv_info & INTR_INFO_VALID_MASK));
+        /*
+         * In the following cases there is an instruction to skip over:
+         *  - TSW is due to a CALL, IRET or JMP instruction.
+         *  - TSW is a vectored event due to a SW exception or SW interrupt.
+         */
+        inst_len = ((source != 3) ||        /* CALL, IRET, or JMP? */
+                    (idtv_info & (1u<<10))) /* IntrType > 3? */
+            ? __get_instruction_length() /* Safe: SDM 3B 23.2.4 */ : 0;
+        if ( (source == 3) && (idtv_info & INTR_INFO_DELIVER_CODE_MASK) )
+            ecode = __vmread(IDT_VECTORING_ERROR_CODE);
         regs->eip += inst_len;
         hvm_task_switch((uint16_t)exit_qualification, reasons[source], ecode);
         break;

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog