3.19-stable patches

added patches:
	kvm-nvmx-mask-unrestricted_guest-if-disabled-on-l0.patch
	staging-comedi-adv_pci1710-fix-ai-insn_read-for-non-zero-channel.patch

diff --git a/queue-3.19/kvm-nvmx-mask-unrestricted_guest-if-disabled-on-l0.patch b/queue-3.19/kvm-nvmx-mask-unrestricted_guest-if-disabled-on-l0.patch
new file mode 100644 (file)
index 0000000..c72398f
--- /dev/null
+++ b/queue-3.19/kvm-nvmx-mask-unrestricted_guest-if-disabled-on-l0.patch
@@ -0,0 +1,57 @@
+From 0790ec172de1bd2e23f1dbd4925426b6cc3c1b72 Mon Sep 17 00:00:00 2001
+From: Radim Krčmář <rkrcmar@redhat.com>
+Date: Tue, 17 Mar 2015 14:02:32 +0100
+Subject: KVM: nVMX: mask unrestricted_guest if disabled on L0
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Radim Krčmář <rkrcmar@redhat.com>
+
+commit 0790ec172de1bd2e23f1dbd4925426b6cc3c1b72 upstream.
+
+If EPT was enabled, unrestricted_guest was allowed in L1 regardless of
+L0.  L1 triple faulted when running L2 guest that required emulation.
+
+Another side effect was 'WARN_ON_ONCE(vmx->nested.nested_run_pending)'
+in L0's dmesg:
+  WARNING: CPU: 0 PID: 0 at arch/x86/kvm/vmx.c:9190 nested_vmx_vmexit+0x96e/0xb00 [kvm_intel] ()
+
+Prevent this scenario by masking SECONDARY_EXEC_UNRESTRICTED_GUEST when
+the host doesn't have it enabled.
+
+Fixes: 78051e3b7e35 ("KVM: nVMX: Disable unrestricted mode if ept=0")
+Cc: stable@vger.kernel.org
+Tested-By: Kashyap Chamarthy <kchamart@redhat.com>
+Signed-off-by: Radim Krčmář <rkrcmar@redhat.com>
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ arch/x86/kvm/vmx.c |    7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -2404,8 +2404,7 @@ static __init void nested_vmx_setup_ctls
+ 
+       if (enable_ept) {
+               /* nested EPT: emulate EPT also to L1 */
+-              nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT |
+-                      SECONDARY_EXEC_UNRESTRICTED_GUEST;
++              nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT;
+               nested_vmx_ept_caps = VMX_EPT_PAGE_WALK_4_BIT |
+                        VMX_EPTP_WB_BIT | VMX_EPT_2MB_PAGE_BIT |
+                        VMX_EPT_INVEPT_BIT;
+@@ -2419,6 +2418,10 @@ static __init void nested_vmx_setup_ctls
+       } else
+               nested_vmx_ept_caps = 0;
+ 
++      if (enable_unrestricted_guest)
++              nested_vmx_secondary_ctls_high |=
++                      SECONDARY_EXEC_UNRESTRICTED_GUEST;
++
+       /* miscellaneous data */
+       rdmsr(MSR_IA32_VMX_MISC, nested_vmx_misc_low, nested_vmx_misc_high);
+       nested_vmx_misc_low &= VMX_MISC_SAVE_EFER_LMA;

diff --git a/queue-3.19/series b/queue-3.19/series
index 90b3f229425ec0a2a46f1fb2afe611c23b1c1c3e..3506fcc1b320c6b7d301fc7f4d2464237f5c1390 100644 (file)
--- a/queue-3.19/series
+++ b/queue-3.19/series
@@ -19,3 +19,5 @@ udptunnels-call-handle_offloads-after-inserting-vlan-tag.patch
 usbnet-fix-tx_packets-stat-for-flag_multi_frame-drivers.patch
 usbnet-fix-tx_bytes-statistic-running-backward-in-cdc_ncm.patch
 tg3-hold-tp-lock-before-calling-tg3_halt-from-tg3_init_one.patch
+kvm-nvmx-mask-unrestricted_guest-if-disabled-on-l0.patch
+staging-comedi-adv_pci1710-fix-ai-insn_read-for-non-zero-channel.patch

diff --git a/queue-3.19/staging-comedi-adv_pci1710-fix-ai-insn_read-for-non-zero-channel.patch b/queue-3.19/staging-comedi-adv_pci1710-fix-ai-insn_read-for-non-zero-channel.patch
new file mode 100644 (file)
index 0000000..a2d89ff
--- /dev/null
+++ b/queue-3.19/staging-comedi-adv_pci1710-fix-ai-insn_read-for-non-zero-channel.patch
@@ -0,0 +1,55 @@
+From abe46b8932dd9a6dfc3698e3eb121809b7b9ed28 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Fri, 27 Feb 2015 16:04:42 +0000
+Subject: staging: comedi: adv_pci1710: fix AI INSN_READ for non-zero channel
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit abe46b8932dd9a6dfc3698e3eb121809b7b9ed28 upstream.
+
+Reading of analog input channels by the `INSN_READ` comedi instruction
+is broken for all except channel 0.  `pci171x_ai_insn_read()` calls
+`pci171x_ai_read_sample()` with the wrong value for the third parameter.
+It is supposed to be the current index in a channel list (which is
+always of length 1 in this case, so the index should be 0), but instead
+it is passing the actual channel number.  `pci171x_ai_read_sample()`
+checks the channel number encoded in the raw sample value read from the
+hardware matches the channel number stored in the specified index of the
+previously set up channel list and returns `-ENODATA` if it doesn't
+match.  Since the index should always be 0 in this case, the match will
+fail unless the channel number is also 0.  Fix it by passing 0 as the
+channel index.
+
+Note that when the bug first appeared, it was `pci171x_ai_dropout()`
+that was called with the wrong parameter value.  `pci171x_ai_dropout()`
+got replaced with `pci171x_ai_read_sample()` in commit 7fd2dae2500d
+("staging: comedi: adv_pci1710: introduce pci171x_ai_read_sample()").
+
+Fixes: 16c7eb6047bb ("staging: comedi: adv_pci1710: always enable PCI171x_PARANOIDCHECK code")
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/staging/comedi/drivers/adv_pci1710.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/staging/comedi/drivers/adv_pci1710.c
++++ b/drivers/staging/comedi/drivers/adv_pci1710.c
+@@ -455,7 +455,6 @@ static int pci171x_insn_read_ai(struct c
+                               struct comedi_insn *insn, unsigned int *data)
+ {
+       struct pci1710_private *devpriv = dev->private;
+-      unsigned int chan = CR_CHAN(insn->chanspec);
+       int ret = 0;
+       int i;
+ 
+@@ -477,7 +476,7 @@ static int pci171x_insn_read_ai(struct c
+                       break;
+ 
+               val = inw(dev->iobase + PCI171x_AD_DATA);
+-              ret = pci171x_ai_dropout(dev, s, chan, val);
++              ret = pci171x_ai_dropout(dev, s, 0, val);
+               if (ret)
+                       break;
+