diff options
| author | Jan Kiszka <jan.kiszka@siemens.com> | 2010-04-14 16:57:11 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-04-26 07:48:05 -0700 |
| commit | 151b026f22691dfb64247f9505a259405b6a1d04 (patch) | |
| tree | ef50625ce32c4df086d8273b3f6aae00caaeacc1 | |
| parent | 00e7035cabdd49657b80b4e0b6995310dc198847 (diff) | |
KVM: x86: Fix TSS size check for 16-bit tasks
(Cherry-picked from commit e8861cfe2c75bdce36655b64d7ce02c2b31b604d)
A 16-bit TSS is only 44 bytes long. So make sure to test for the correct
size on task switch.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | arch/x86/kvm/x86.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index e0f010e53f63..dd7892740314 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -4576,6 +4576,7 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int reason) int ret = 0; u32 old_tss_base = get_segment_base(vcpu, VCPU_SREG_TR); u16 old_tss_sel = get_segment_selector(vcpu, VCPU_SREG_TR); + u32 desc_limit; old_tss_base = vcpu->arch.mmu.gva_to_gpa(vcpu, old_tss_base); @@ -4598,7 +4599,10 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int reason) } } - if (!nseg_desc.p || get_desc_limit(&nseg_desc) < 0x67) { + desc_limit = get_desc_limit(&nseg_desc); + if (!nseg_desc.p || + ((desc_limit < 0x67 && (nseg_desc.type & 8)) || + desc_limit < 0x2b)) { kvm_queue_exception_e(vcpu, TS_VECTOR, tss_selector & 0xfffc); return 1; } |