2 files changed, 27 insertions, 10 deletions

diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index 264814f26ce0..159b5988292f 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -350,6 +350,7 @@ struct kvm_mmu_page {
 };
 
 struct kvm_pio_request {
+        unsigned long linear_rip;
         unsigned long count;
         int in;
         int port;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 9f279bb145e5..099b851dabaf 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6535,14 +6535,27 @@ int kvm_emulate_instruction_from_buffer(struct kvm_vcpu *vcpu,
 }
 EXPORT_SYMBOL_GPL(kvm_emulate_instruction_from_buffer);
 
+static int complete_fast_pio_out(struct kvm_vcpu *vcpu)
+{
+        vcpu->arch.pio.count = 0;
+
+        if (unlikely(!kvm_is_linear_rip(vcpu, vcpu->arch.pio.linear_rip)))
+                return 1;
+
+        return kvm_skip_emulated_instruction(vcpu);
+}
+
 static int kvm_fast_pio_out(struct kvm_vcpu *vcpu, int size,
                             unsigned short port)
 {
         unsigned long val = kvm_register_read(vcpu, VCPU_REGS_RAX);
         int ret = emulator_pio_out_emulated(&vcpu->arch.emulate_ctxt,
                                             size, port, &val, 1);
-        /* do not return to emulator after return from userspace */
-        vcpu->arch.pio.count = 0;
+
+        if (!ret) {
+                vcpu->arch.pio.linear_rip = kvm_get_linear_rip(vcpu);
+                vcpu->arch.complete_userspace_io = complete_fast_pio_out;
+        }
         return ret;
 }
 
@@ -6553,6 +6566,11 @@ static int complete_fast_pio_in(struct kvm_vcpu *vcpu)
         /* We should only ever be called with arch.pio.count equal to 1 */
         BUG_ON(vcpu->arch.pio.count != 1);
 
+        if (unlikely(!kvm_is_linear_rip(vcpu, vcpu->arch.pio.linear_rip))) {
+                vcpu->arch.pio.count = 0;
+                return 1;
+        }
+
         /* For size less than 4 we merge, else we zero extend */
         val = (vcpu->arch.pio.size < 4) ? kvm_register_read(vcpu, VCPU_REGS_RAX)
                                         : 0;
@@ -6565,7 +6583,7 @@ static int complete_fast_pio_in(struct kvm_vcpu *vcpu)
                                  vcpu->arch.pio.port, &val, 1);
         kvm_register_write(vcpu, VCPU_REGS_RAX, val);
 
-        return 1;
+        return kvm_skip_emulated_instruction(vcpu);
 }
 
 static int kvm_fast_pio_in(struct kvm_vcpu *vcpu, int size,
@@ -6584,6 +6602,7 @@ static int kvm_fast_pio_in(struct kvm_vcpu *vcpu, int size,
                 return ret;
         }
 
+        vcpu->arch.pio.linear_rip = kvm_get_linear_rip(vcpu);
         vcpu->arch.complete_userspace_io = complete_fast_pio_in;
 
         return 0;
@@ -6591,16 +6610,13 @@ static int kvm_fast_pio_in(struct kvm_vcpu *vcpu, int size,
 
 int kvm_fast_pio(struct kvm_vcpu *vcpu, int size, unsigned short port, int in)
 {
-        int ret = kvm_skip_emulated_instruction(vcpu);
+        int ret;
 
-        /*
-         * TODO: we might be squashing a KVM_GUESTDBG_SINGLESTEP-triggered
-         * KVM_EXIT_DEBUG here.
-         */
         if (in)
-                return kvm_fast_pio_in(vcpu, size, port) && ret;
+                ret = kvm_fast_pio_in(vcpu, size, port);
         else
-                return kvm_fast_pio_out(vcpu, size, port) && ret;
+                ret = kvm_fast_pio_out(vcpu, size, port);
+        return ret && kvm_skip_emulated_instruction(vcpu);
 }
 EXPORT_SYMBOL_GPL(kvm_fast_pio);