From: Greg Kroah-Hartman Date: Sun, 26 Apr 2015 09:39:48 +0000 (+0200) Subject: 3.19-stable patches X-Git-Tag: v4.0.1~23 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1a2f5cb187a6ca94568ff1c160a92f2ecec0b7ae;p=thirdparty%2Fkernel%2Fstable-queue.git 3.19-stable patches added patches: kvm-nvmx-mask-unrestricted_guest-if-disabled-on-l0.patch staging-comedi-adv_pci1710-fix-ai-insn_read-for-non-zero-channel.patch --- diff --git a/queue-3.19/kvm-nvmx-mask-unrestricted_guest-if-disabled-on-l0.patch b/queue-3.19/kvm-nvmx-mask-unrestricted_guest-if-disabled-on-l0.patch new file mode 100644 index 00000000000..c72398f1f25 --- /dev/null +++ b/queue-3.19/kvm-nvmx-mask-unrestricted_guest-if-disabled-on-l0.patch @@ -0,0 +1,57 @@ +From 0790ec172de1bd2e23f1dbd4925426b6cc3c1b72 Mon Sep 17 00:00:00 2001 +From: Radim Krčmář +Date: Tue, 17 Mar 2015 14:02:32 +0100 +Subject: KVM: nVMX: mask unrestricted_guest if disabled on L0 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Radim Krčmář + +commit 0790ec172de1bd2e23f1dbd4925426b6cc3c1b72 upstream. + +If EPT was enabled, unrestricted_guest was allowed in L1 regardless of +L0. L1 triple faulted when running L2 guest that required emulation. + +Another side effect was 'WARN_ON_ONCE(vmx->nested.nested_run_pending)' +in L0's dmesg: + WARNING: CPU: 0 PID: 0 at arch/x86/kvm/vmx.c:9190 nested_vmx_vmexit+0x96e/0xb00 [kvm_intel] () + +Prevent this scenario by masking SECONDARY_EXEC_UNRESTRICTED_GUEST when +the host doesn't have it enabled. + +Fixes: 78051e3b7e35 ("KVM: nVMX: Disable unrestricted mode if ept=0") +Cc: stable@vger.kernel.org +Tested-By: Kashyap Chamarthy +Signed-off-by: Radim Krčmář +Signed-off-by: Marcelo Tosatti +Signed-off-by: Greg Kroah-Hartman + + +--- + arch/x86/kvm/vmx.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -2404,8 +2404,7 @@ static __init void nested_vmx_setup_ctls + + if (enable_ept) { + /* nested EPT: emulate EPT also to L1 */ +- nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT | +- SECONDARY_EXEC_UNRESTRICTED_GUEST; ++ nested_vmx_secondary_ctls_high |= SECONDARY_EXEC_ENABLE_EPT; + nested_vmx_ept_caps = VMX_EPT_PAGE_WALK_4_BIT | + VMX_EPTP_WB_BIT | VMX_EPT_2MB_PAGE_BIT | + VMX_EPT_INVEPT_BIT; +@@ -2419,6 +2418,10 @@ static __init void nested_vmx_setup_ctls + } else + nested_vmx_ept_caps = 0; + ++ if (enable_unrestricted_guest) ++ nested_vmx_secondary_ctls_high |= ++ SECONDARY_EXEC_UNRESTRICTED_GUEST; ++ + /* miscellaneous data */ + rdmsr(MSR_IA32_VMX_MISC, nested_vmx_misc_low, nested_vmx_misc_high); + nested_vmx_misc_low &= VMX_MISC_SAVE_EFER_LMA; diff --git a/queue-3.19/series b/queue-3.19/series index 90b3f229425..3506fcc1b32 100644 --- a/queue-3.19/series +++ b/queue-3.19/series @@ -19,3 +19,5 @@ udptunnels-call-handle_offloads-after-inserting-vlan-tag.patch usbnet-fix-tx_packets-stat-for-flag_multi_frame-drivers.patch usbnet-fix-tx_bytes-statistic-running-backward-in-cdc_ncm.patch tg3-hold-tp-lock-before-calling-tg3_halt-from-tg3_init_one.patch +kvm-nvmx-mask-unrestricted_guest-if-disabled-on-l0.patch +staging-comedi-adv_pci1710-fix-ai-insn_read-for-non-zero-channel.patch diff --git a/queue-3.19/staging-comedi-adv_pci1710-fix-ai-insn_read-for-non-zero-channel.patch b/queue-3.19/staging-comedi-adv_pci1710-fix-ai-insn_read-for-non-zero-channel.patch new file mode 100644 index 00000000000..a2d89ffca34 --- /dev/null +++ b/queue-3.19/staging-comedi-adv_pci1710-fix-ai-insn_read-for-non-zero-channel.patch @@ -0,0 +1,55 @@ +From abe46b8932dd9a6dfc3698e3eb121809b7b9ed28 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Fri, 27 Feb 2015 16:04:42 +0000 +Subject: staging: comedi: adv_pci1710: fix AI INSN_READ for non-zero channel + +From: Ian Abbott + +commit abe46b8932dd9a6dfc3698e3eb121809b7b9ed28 upstream. + +Reading of analog input channels by the `INSN_READ` comedi instruction +is broken for all except channel 0. `pci171x_ai_insn_read()` calls +`pci171x_ai_read_sample()` with the wrong value for the third parameter. +It is supposed to be the current index in a channel list (which is +always of length 1 in this case, so the index should be 0), but instead +it is passing the actual channel number. `pci171x_ai_read_sample()` +checks the channel number encoded in the raw sample value read from the +hardware matches the channel number stored in the specified index of the +previously set up channel list and returns `-ENODATA` if it doesn't +match. Since the index should always be 0 in this case, the match will +fail unless the channel number is also 0. Fix it by passing 0 as the +channel index. + +Note that when the bug first appeared, it was `pci171x_ai_dropout()` +that was called with the wrong parameter value. `pci171x_ai_dropout()` +got replaced with `pci171x_ai_read_sample()` in commit 7fd2dae2500d +("staging: comedi: adv_pci1710: introduce pci171x_ai_read_sample()"). + +Fixes: 16c7eb6047bb ("staging: comedi: adv_pci1710: always enable PCI171x_PARANOIDCHECK code") +Signed-off-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/staging/comedi/drivers/adv_pci1710.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/staging/comedi/drivers/adv_pci1710.c ++++ b/drivers/staging/comedi/drivers/adv_pci1710.c +@@ -455,7 +455,6 @@ static int pci171x_insn_read_ai(struct c + struct comedi_insn *insn, unsigned int *data) + { + struct pci1710_private *devpriv = dev->private; +- unsigned int chan = CR_CHAN(insn->chanspec); + int ret = 0; + int i; + +@@ -477,7 +476,7 @@ static int pci171x_insn_read_ai(struct c + break; + + val = inw(dev->iobase + PCI171x_AD_DATA); +- ret = pci171x_ai_dropout(dev, s, chan, val); ++ ret = pci171x_ai_dropout(dev, s, 0, val); + if (ret) + break; +