3 files changed, 14 insertions, 12 deletions

diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 47b29834a6b6..56ff9bebb577 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -548,11 +548,10 @@ static bool handle_mmio_cfg_reg(struct kvm_vcpu *vcpu,
         u32 val;
         u32 *reg;
 
-        offset >>= 1;
         reg = vgic_bitmap_get_reg(&vcpu->kvm->arch.vgic.irq_cfg,
-                                  vcpu->vcpu_id, offset);
+                                  vcpu->vcpu_id, offset >> 1);
 
-        if (offset & 2)
+        if (offset & 4)
                 val = *reg >> 16;
         else
                 val = *reg & 0xffff;
@@ -561,13 +560,13 @@ static bool handle_mmio_cfg_reg(struct kvm_vcpu *vcpu,
         vgic_reg_access(mmio, &val, offset,
                         ACCESS_READ_VALUE | ACCESS_WRITE_VALUE);
         if (mmio->is_write) {
-                if (offset < 4) {
+                if (offset < 8) {
                         *reg = ~0U; /* Force PPIs/SGIs to 1 */
                         return false;
                 }
 
                 val = vgic_cfg_compress(val);
-                if (offset & 2) {
+                if (offset & 4) {
                         *reg &= 0xffff;
                         *reg |= val << 16;
                 } else {
@@ -916,6 +915,7 @@ static void vgic_dispatch_sgi(struct kvm_vcpu *vcpu, u32 reg)
         case 0:
                 if (!target_cpus)
                         return;
+                break;
 
         case 1:
                 target_cpus = ((1 << nrcpus) - 1) & ~(1 << vcpu_id) & 0xff;
@@ -1667,10 +1667,11 @@ static int vgic_ioaddr_assign(struct kvm *kvm, phys_addr_t *ioaddr,
         if (addr + size < addr)
                 return -EINVAL;
 
+        *ioaddr = addr;
         ret = vgic_ioaddr_overlap(kvm);
         if (ret)
-                return ret;
-        *ioaddr = addr;
+                *ioaddr = VGIC_ADDR_UNDEF;
+
         return ret;
 }
 
diff --git a/virt/kvm/assigned-dev.c b/virt/kvm/assigned-dev.c
index 8db43701016f..bf06577fea51 100644
--- a/virt/kvm/assigned-dev.c
+++ b/virt/kvm/assigned-dev.c
@@ -395,7 +395,8 @@ static int assigned_device_enable_host_msix(struct kvm *kvm,
         if (dev->entries_nr == 0)
                 return r;
 
-        r = pci_enable_msix(dev->dev, dev->host_msix_entries, dev->entries_nr);
+        r = pci_enable_msix_exact(dev->dev,
+                                  dev->host_msix_entries, dev->entries_nr);
         if (r)
                 return r;
 
diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c
index 10df100c4514..06e6401d6ef4 100644
--- a/virt/kvm/async_pf.c
+++ b/virt/kvm/async_pf.c
@@ -101,7 +101,7 @@ static void async_pf_execute(struct work_struct *work)
         if (waitqueue_active(&vcpu->wq))
                 wake_up_interruptible(&vcpu->wq);
 
-        mmdrop(mm);
+        mmput(mm);
         kvm_put_kvm(vcpu->kvm);
 }
 
@@ -118,7 +118,7 @@ void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu)
                 flush_work(&work->work);
 #else
                 if (cancel_work_sync(&work->work)) {
-                        mmdrop(work->mm);
+                        mmput(work->mm);
                         kvm_put_kvm(vcpu->kvm); /* == work->vcpu->kvm */
                         kmem_cache_free(async_pf_cache, work);
                 }
@@ -183,7 +183,7 @@ int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, unsigned long hva,
         work->addr = hva;
         work->arch = *arch;
         work->mm = current->mm;
-        atomic_inc(&work->mm->mm_count);
+        atomic_inc(&work->mm->mm_users);
         kvm_get_kvm(work->vcpu->kvm);
 
         /* this can't really happen otherwise gfn_to_pfn_async
@@ -201,7 +201,7 @@ int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, unsigned long hva,
         return 1;
 retry_sync:
         kvm_put_kvm(work->vcpu->kvm);
-        mmdrop(work->mm);
+        mmput(work->mm);
         kmem_cache_free(async_pf_cache, work);
         return 0;
 }