4 files changed, 11 insertions, 8 deletions

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index 6df88c7885c0..adc98675cda0 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -3372,7 +3372,7 @@ x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len)
         int def_op_bytes, def_ad_bytes, goffset, simd_prefix;
         bool op_prefix = false;
         struct opcode opcode;
-        struct operand memop = { .type = OP_NONE };
+        struct operand memop = { .type = OP_NONE }, *memopp = NULL;
 
         c->eip = ctxt->eip;
         c->fetch.start = c->eip;
@@ -3547,9 +3547,6 @@ done_prefixes:
         if (memop.type == OP_MEM && c->ad_bytes != 8)
                 memop.addr.mem.ea = (u32)memop.addr.mem.ea;
 
-        if (memop.type == OP_MEM && c->rip_relative)
-                memop.addr.mem.ea += c->eip;
-
         /*
          * Decode and fetch the source operand: register, memory
          * or immediate.
@@ -3571,6 +3568,7 @@ done_prefixes:
                                                            c->op_bytes;
         srcmem_common:
                 c->src = memop;
+                memopp = &c->src;
                 break;
         case SrcImmU16:
                 rc = decode_imm(ctxt, &c->src, 2, false);
@@ -3667,6 +3665,7 @@ done_prefixes:
         case DstMem:
         case DstMem64:
                 c->dst = memop;
+                memopp = &c->dst;
                 if ((c->d & DstMask) == DstMem64)
                         c->dst.bytes = 8;
                 else
@@ -3700,10 +3699,13 @@ done_prefixes:
                 /* Special instructions do their own operand decoding. */
         default:
                 c->dst.type = OP_NONE; /* Disable writeback. */
-                return 0;
+                break;
         }
 
 done:
+        if (memopp && memopp->type == OP_MEM && c->rip_relative)
+                memopp->addr.mem.ea += c->eip;
+
         return (rc == X86EMUL_UNHANDLEABLE) ? EMULATION_FAILED : EMULATION_OK;
 }
 
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index bd14bb4c8594..aee38623b768 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -565,7 +565,7 @@ gfn_to_memslot_dirty_bitmap(struct kvm_vcpu *vcpu, gfn_t gfn,
 
 static bool mapping_level_dirty_bitmap(struct kvm_vcpu *vcpu, gfn_t large_gfn)
 {
-        return gfn_to_memslot_dirty_bitmap(vcpu, large_gfn, true);
+        return !gfn_to_memslot_dirty_bitmap(vcpu, large_gfn, true);
 }
 
 static int mapping_level(struct kvm_vcpu *vcpu, gfn_t large_gfn)
diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 6c4dc010c4cb..9d03ad4dd5ec 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -121,7 +121,7 @@ static int FNAME(walk_addr_generic)(struct guest_walker *walker,
                                     gva_t addr, u32 access)
 {
         pt_element_t pte;
-        pt_element_t __user *ptep_user;
+        pt_element_t __user *uninitialized_var(ptep_user);
         gfn_t table_gfn;
         unsigned index, pt_access, uninitialized_var(pte_access);
         gpa_t pte_gpa;
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 4c3fa0f67469..d48ec60ea421 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2047,7 +2047,8 @@ static void ept_update_paging_mode_cr0(unsigned long *hw_cr0,
                                         unsigned long cr0,
                                         struct kvm_vcpu *vcpu)
 {
-        vmx_decache_cr3(vcpu);
+        if (!test_bit(VCPU_EXREG_CR3, (ulong *)&vcpu->arch.regs_avail))
+                vmx_decache_cr3(vcpu);
         if (!(cr0 & X86_CR0_PG)) {
                 /* From paging/starting to nonpaging */
                 vmcs_write32(CPU_BASED_VM_EXEC_CONTROL,