4 files changed, 33 insertions, 18 deletions

diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
index 47b29834a6b6..56ff9bebb577 100644
--- a/virt/kvm/arm/vgic.c
+++ b/virt/kvm/arm/vgic.c
@@ -548,11 +548,10 @@ static bool handle_mmio_cfg_reg(struct kvm_vcpu *vcpu,
         u32 val;
         u32 *reg;
 
-        offset >>= 1;
         reg = vgic_bitmap_get_reg(&vcpu->kvm->arch.vgic.irq_cfg,
-                                  vcpu->vcpu_id, offset);
+                                  vcpu->vcpu_id, offset >> 1);
 
-        if (offset & 2)
+        if (offset & 4)
                 val = *reg >> 16;
         else
                 val = *reg & 0xffff;
@@ -561,13 +560,13 @@ static bool handle_mmio_cfg_reg(struct kvm_vcpu *vcpu,
         vgic_reg_access(mmio, &val, offset,
                         ACCESS_READ_VALUE | ACCESS_WRITE_VALUE);
         if (mmio->is_write) {
-                if (offset < 4) {
+                if (offset < 8) {
                         *reg = ~0U; /* Force PPIs/SGIs to 1 */
                         return false;
                 }
 
                 val = vgic_cfg_compress(val);
-                if (offset & 2) {
+                if (offset & 4) {
                         *reg &= 0xffff;
                         *reg |= val << 16;
                 } else {
@@ -916,6 +915,7 @@ static void vgic_dispatch_sgi(struct kvm_vcpu *vcpu, u32 reg)
         case 0:
                 if (!target_cpus)
                         return;
+                break;
 
         case 1:
                 target_cpus = ((1 << nrcpus) - 1) & ~(1 << vcpu_id) & 0xff;
@@ -1667,10 +1667,11 @@ static int vgic_ioaddr_assign(struct kvm *kvm, phys_addr_t *ioaddr,
         if (addr + size < addr)
                 return -EINVAL;
 
+        *ioaddr = addr;
         ret = vgic_ioaddr_overlap(kvm);
         if (ret)
-                return ret;
-        *ioaddr = addr;
+                *ioaddr = VGIC_ADDR_UNDEF;
+
         return ret;
 }
 
diff --git a/virt/kvm/assigned-dev.c b/virt/kvm/assigned-dev.c
index 8db43701016f..bf06577fea51 100644
--- a/virt/kvm/assigned-dev.c
+++ b/virt/kvm/assigned-dev.c
@@ -395,7 +395,8 @@ static int assigned_device_enable_host_msix(struct kvm *kvm,
         if (dev->entries_nr == 0)
                 return r;
 
-        r = pci_enable_msix(dev->dev, dev->host_msix_entries, dev->entries_nr);
+        r = pci_enable_msix_exact(dev->dev,
+                                  dev->host_msix_entries, dev->entries_nr);
         if (r)
                 return r;
 
diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c
index 10df100c4514..06e6401d6ef4 100644
--- a/virt/kvm/async_pf.c
+++ b/virt/kvm/async_pf.c
@@ -101,7 +101,7 @@ static void async_pf_execute(struct work_struct *work)
         if (waitqueue_active(&vcpu->wq))
                 wake_up_interruptible(&vcpu->wq);
 
-        mmdrop(mm);
+        mmput(mm);
         kvm_put_kvm(vcpu->kvm);
 }
 
@@ -118,7 +118,7 @@ void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu)
                 flush_work(&work->work);
 #else
                 if (cancel_work_sync(&work->work)) {
-                        mmdrop(work->mm);
+                        mmput(work->mm);
                         kvm_put_kvm(vcpu->kvm); /* == work->vcpu->kvm */
                         kmem_cache_free(async_pf_cache, work);
                 }
@@ -183,7 +183,7 @@ int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, unsigned long hva,
         work->addr = hva;
         work->arch = *arch;
         work->mm = current->mm;
-        atomic_inc(&work->mm->mm_count);
+        atomic_inc(&work->mm->mm_users);
         kvm_get_kvm(work->vcpu->kvm);
 
         /* this can't really happen otherwise gfn_to_pfn_async
@@ -201,7 +201,7 @@ int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, unsigned long hva,
         return 1;
 retry_sync:
         kvm_put_kvm(work->vcpu->kvm);
-        mmdrop(work->mm);
+        mmput(work->mm);
         kmem_cache_free(async_pf_cache, work);
         return 0;
 }
diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
index d4b601547f1f..2458a1dc2ba9 100644
--- a/virt/kvm/ioapic.c
+++ b/virt/kvm/ioapic.c
@@ -97,6 +97,14 @@ static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic)
         bitmap_zero(ioapic->rtc_status.dest_map, KVM_MAX_VCPUS);
 }
 
+static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic);
+
+static void rtc_status_pending_eoi_check_valid(struct kvm_ioapic *ioapic)
+{
+        if (WARN_ON(ioapic->rtc_status.pending_eoi < 0))
+                kvm_rtc_eoi_tracking_restore_all(ioapic);
+}
+
 static void __rtc_irq_eoi_tracking_restore_one(struct kvm_vcpu *vcpu)
 {
         bool new_val, old_val;
@@ -120,9 +128,8 @@ static void __rtc_irq_eoi_tracking_restore_one(struct kvm_vcpu *vcpu)
         } else {
                 __clear_bit(vcpu->vcpu_id, ioapic->rtc_status.dest_map);
                 ioapic->rtc_status.pending_eoi--;
+                rtc_status_pending_eoi_check_valid(ioapic);
         }
-
-        WARN_ON(ioapic->rtc_status.pending_eoi < 0);
 }
 
 void kvm_rtc_eoi_tracking_restore_one(struct kvm_vcpu *vcpu)
@@ -149,10 +156,10 @@ static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic)
 
 static void rtc_irq_eoi(struct kvm_ioapic *ioapic, struct kvm_vcpu *vcpu)
 {
-        if (test_and_clear_bit(vcpu->vcpu_id, ioapic->rtc_status.dest_map))
+        if (test_and_clear_bit(vcpu->vcpu_id, ioapic->rtc_status.dest_map)) {
                 --ioapic->rtc_status.pending_eoi;
-
-        WARN_ON(ioapic->rtc_status.pending_eoi < 0);
+                rtc_status_pending_eoi_check_valid(ioapic);
+        }
 }
 
 static bool rtc_irq_check_coalesced(struct kvm_ioapic *ioapic)
@@ -353,10 +360,16 @@ static int ioapic_service(struct kvm_ioapic *ioapic, int irq, bool line_status)
                 ioapic->irr &= ~(1 << irq);
 
         if (irq == RTC_GSI && line_status) {
+                /*
+                 * pending_eoi cannot ever become negative (see
+                 * rtc_status_pending_eoi_check_valid) and the caller
+                 * ensures that it is only called if it is >= zero, namely
+                 * if rtc_irq_check_coalesced returns false).
+                 */
                 BUG_ON(ioapic->rtc_status.pending_eoi != 0);
                 ret = kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe,
                                 ioapic->rtc_status.dest_map);
-                ioapic->rtc_status.pending_eoi = ret;
+                ioapic->rtc_status.pending_eoi = (ret < 0 ? 0 : ret);
         } else
                 ret = kvm_irq_delivery_to_apic(ioapic->kvm, NULL, &irqe, NULL);