From mboxrd@z Thu Jan  1 00:00:00 1970
From: Marcelo Tosatti <mtosatti@redhat.com>
Subject: [patch 2/3] KVM: task switch: check task busy state
Date: Sat, 19 Jul 2008 19:08:08 -0300
Message-ID: <20080719220932.945706026@localhost.localdomain>
References: <20080719220806.152409866@localhost.localdomain>
Cc: kvm@vger.kernel.org, Marcelo Tosatti <mtosatti@redhat.com>
To: Avi Kivity <avi@qumranet.com>
Return-path: <kvm-owner@vger.kernel.org>
Received: from mx1.redhat.com ([66.187.233.31]:56838 "EHLO mx1.redhat.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1751485AbYGSWKH (ORCPT <rfc822;kvm@vger.kernel.org>);
	Sat, 19 Jul 2008 18:10:07 -0400
Content-Disposition: inline; filename=task-switch-checks
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

Checks that the new task is available (call, jump, exception, or interrupt) or 
busy (IRET return). Generate GP# or TS# otherwise.

Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

Index: kvm-vmx-checks/arch/x86/kvm/x86.c
===================================================================
--- kvm-vmx-checks.orig/arch/x86/kvm/x86.c
+++ kvm-vmx-checks/arch/x86/kvm/x86.c
@@ -3519,6 +3519,11 @@ int kvm_task_switch(struct kvm_vcpu *vcp
 	if (load_guest_segment_descriptor(vcpu, old_tss_sel, &cseg_desc))
 		goto out;
 
+	if (!nseg_desc.p || (nseg_desc.limit0 | nseg_desc.limit << 16) < 0x67) {
+		kvm_queue_exception_e(vcpu, TS_VECTOR, tss_selector & 0xfffc);
+		return 1;
+	}
+
 	if (reason != TASK_SWITCH_IRET) {
 		int cpl;
 
@@ -3527,12 +3532,19 @@ int kvm_task_switch(struct kvm_vcpu *vcp
 			kvm_queue_exception_e(vcpu, GP_VECTOR, 0);
 			return 1;
 		}
+		if (nseg_desc.type & (1 << 1)) {
+			kvm_queue_exception_e(vcpu, GP_VECTOR,
+					      old_tss_sel & 0xfffc);
+			return 1;
+		}
+	} else {
+		if (!(cseg_desc.type & (1 << 1))) {
+			kvm_queue_exception_e(vcpu, TS_VECTOR,
+					      tss_selector & 0xfffc);
+			return 1;
+		}
 	}
 
-	if (!nseg_desc.p || (nseg_desc.limit0 | nseg_desc.limit << 16) < 0x67) {
-		kvm_queue_exception_e(vcpu, TS_VECTOR, tss_selector & 0xfffc);
-		return 1;
-	}
 
 	if (reason == TASK_SWITCH_IRET || reason == TASK_SWITCH_JMP) {
 		cseg_desc.type &= ~(1 << 1); //clear the B flag

--