[patch 2/3] KVM: task switch: check task busy state

[Marcelo Tosatti <mtosatti@redhat.com>]

[-- Attachment #1: task-switch-checks --]
[-- Type: text/plain, Size: 1433 bytes --]

Checks that the new task is available (call, jump, exception, or interrupt) or 
busy (IRET return). Generate GP# or TS# otherwise.

Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

Index: kvm-vmx-checks/arch/x86/kvm/x86.c
===================================================================
--- kvm-vmx-checks.orig/arch/x86/kvm/x86.c
+++ kvm-vmx-checks/arch/x86/kvm/x86.c
@@ -3519,6 +3519,11 @@ int kvm_task_switch(struct kvm_vcpu *vcp
 	if (load_guest_segment_descriptor(vcpu, old_tss_sel, &cseg_desc))
 		goto out;
 
+	if (!nseg_desc.p || (nseg_desc.limit0 | nseg_desc.limit << 16) < 0x67) {
+		kvm_queue_exception_e(vcpu, TS_VECTOR, tss_selector & 0xfffc);
+		return 1;
+	}
+
 	if (reason != TASK_SWITCH_IRET) {
 		int cpl;
 
@@ -3527,12 +3532,19 @@ int kvm_task_switch(struct kvm_vcpu *vcp
 			kvm_queue_exception_e(vcpu, GP_VECTOR, 0);
 			return 1;
 		}
+		if (nseg_desc.type & (1 << 1)) {
+			kvm_queue_exception_e(vcpu, GP_VECTOR,
+					      old_tss_sel & 0xfffc);
+			return 1;
+		}
+	} else {
+		if (!(cseg_desc.type & (1 << 1))) {
+			kvm_queue_exception_e(vcpu, TS_VECTOR,
+					      tss_selector & 0xfffc);
+			return 1;
+		}
 	}
 
-	if (!nseg_desc.p || (nseg_desc.limit0 | nseg_desc.limit << 16) < 0x67) {
-		kvm_queue_exception_e(vcpu, TS_VECTOR, tss_selector & 0xfffc);
-		return 1;
-	}
 
 	if (reason == TASK_SWITCH_IRET || reason == TASK_SWITCH_JMP) {
 		cseg_desc.type &= ~(1 << 1); //clear the B flag

--