1 files changed, 39 insertions, 10 deletions

diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index 0cefba28c864..fbb0e6df121b 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -548,7 +548,7 @@ int kvm_apic_set_irq(struct kvm_vcpu *vcpu, struct kvm_lapic_irq *irq,
 }
 
 int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
-                    unsigned long ipi_bitmap_high, int min,
+                    unsigned long ipi_bitmap_high, u32 min,
                     unsigned long icr, int op_64_bit)
 {
         int i;
@@ -571,18 +571,31 @@ int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,
         rcu_read_lock();
         map = rcu_dereference(kvm->arch.apic_map);
 
+        if (min > map->max_apic_id)
+                goto out;
         /* Bits above cluster_size are masked in the caller.  */
-        for_each_set_bit(i, &ipi_bitmap_low, BITS_PER_LONG) {
-                vcpu = map->phys_map[min + i]->vcpu;
-                count += kvm_apic_set_irq(vcpu, &irq, NULL);
+        for_each_set_bit(i, &ipi_bitmap_low,
+                min((u32)BITS_PER_LONG, (map->max_apic_id - min + 1))) {
+                if (map->phys_map[min + i]) {
+                        vcpu = map->phys_map[min + i]->vcpu;
+                        count += kvm_apic_set_irq(vcpu, &irq, NULL);
+                }
         }
 
         min += cluster_size;
-        for_each_set_bit(i, &ipi_bitmap_high, BITS_PER_LONG) {
-                vcpu = map->phys_map[min + i]->vcpu;
-                count += kvm_apic_set_irq(vcpu, &irq, NULL);
+
+        if (min > map->max_apic_id)
+                goto out;
+
+        for_each_set_bit(i, &ipi_bitmap_high,
+                min((u32)BITS_PER_LONG, (map->max_apic_id - min + 1))) {
+                if (map->phys_map[min + i]) {
+                        vcpu = map->phys_map[min + i]->vcpu;
+                        count += kvm_apic_set_irq(vcpu, &irq, NULL);
+                }
         }
 
+out:
         rcu_read_unlock();
         return count;
 }
@@ -1331,9 +1344,8 @@ EXPORT_SYMBOL_GPL(kvm_lapic_reg_read);
 
 static int apic_mmio_in_range(struct kvm_lapic *apic, gpa_t addr)
 {
-        return kvm_apic_hw_enabled(apic) &&
-            addr >= apic->base_address &&
-            addr < apic->base_address + LAPIC_MMIO_LENGTH;
+        return addr >= apic->base_address &&
+                addr < apic->base_address + LAPIC_MMIO_LENGTH;
 }
 
 static int apic_mmio_read(struct kvm_vcpu *vcpu, struct kvm_io_device *this,
@@ -1345,6 +1357,15 @@ static int apic_mmio_read(struct kvm_vcpu *vcpu, struct kvm_io_device *this,
         if (!apic_mmio_in_range(apic, address))
                 return -EOPNOTSUPP;
 
+        if (!kvm_apic_hw_enabled(apic) || apic_x2apic_mode(apic)) {
+                if (!kvm_check_has_quirk(vcpu->kvm,
+                                         KVM_X86_QUIRK_LAPIC_MMIO_HOLE))
+                        return -EOPNOTSUPP;
+
+                memset(data, 0xff, len);
+                return 0;
+        }
+
         kvm_lapic_reg_read(apic, offset, len, data);
 
         return 0;
@@ -1904,6 +1925,14 @@ static int apic_mmio_write(struct kvm_vcpu *vcpu, struct kvm_io_device *this,
         if (!apic_mmio_in_range(apic, address))
                 return -EOPNOTSUPP;
 
+        if (!kvm_apic_hw_enabled(apic) || apic_x2apic_mode(apic)) {
+                if (!kvm_check_has_quirk(vcpu->kvm,
+                                         KVM_X86_QUIRK_LAPIC_MMIO_HOLE))
+                        return -EOPNOTSUPP;
+
+                return 0;
+        }
+
         /*
          * APIC register must be aligned on 128-bits boundary.
          * 32/64/128 bits registers must be accessed thru 32 bits.