4 files changed, 6 insertions, 5 deletions

diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index e50425d0f5f7..9b531351a587 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -2672,6 +2672,7 @@ static int __direct_map(struct kvm_vcpu *vcpu, gpa_t v, int write,
                         break;
                 }
 
+                drop_large_spte(vcpu, iterator.sptep);
                 if (!is_shadow_present_pte(*iterator.sptep)) {
                         u64 base_addr = iterator.addr;
 
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index e81df8fce027..2de1bc09a8d4 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -3002,10 +3002,8 @@ static int cr8_write_interception(struct vcpu_svm *svm)
         u8 cr8_prev = kvm_get_cr8(&svm->vcpu);
         /* instruction emulation calls kvm_set_cr8() */
         r = cr_interception(svm);
-        if (irqchip_in_kernel(svm->vcpu.kvm)) {
-                clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
+        if (irqchip_in_kernel(svm->vcpu.kvm))
                 return r;
-        }
         if (cr8_prev <= kvm_get_cr8(&svm->vcpu))
                 return r;
         kvm_run->exit_reason = KVM_EXIT_SET_TPR;
@@ -3567,6 +3565,8 @@ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
         if (is_guest_mode(vcpu) && (vcpu->arch.hflags & HF_VINTR_MASK))
                 return;
 
+        clr_cr_intercept(svm, INTERCEPT_CR8_WRITE);
+
         if (irr == -1)
                 return;
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index a06f101ef64b..392752834751 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -6688,7 +6688,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
                 else if (is_page_fault(intr_info))
                         return enable_ept;
                 else if (is_no_device(intr_info) &&
-                         !(nested_read_cr0(vmcs12) & X86_CR0_TS))
+                         !(vmcs12->guest_cr0 & X86_CR0_TS))
                         return 0;
                 return vmcs12->exception_bitmap &
                                 (1u << (intr_info & INTR_INFO_VECTOR_MASK));
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 39c28f09dfd5..2b8578432d5b 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6186,7 +6186,7 @@ static int complete_emulated_mmio(struct kvm_vcpu *vcpu)
                 frag->len -= len;
         }
 
-        if (vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments) {
+        if (vcpu->mmio_cur_fragment >= vcpu->mmio_nr_fragments) {
                 vcpu->mmio_needed = 0;
 
                 /* FIXME: return into emulator if single-stepping.  */