14 Oct, 2013

2 commits


13 Oct, 2013

9 commits

  • Olga reported that file descriptors opened with O_PATH do not work with
    fstatfs(), found during further development of ksh93's thread support.

    There is no reason to not allow O_PATH file descriptors here (fstatfs is
    very much a path operation), so use "fdget_raw()". See commit
    55815f70147d ("vfs: make O_PATH file descriptors usable for 'fstat()'")
    for a very similar issue reported for fstat() by the same team.

    Reported-and-tested-by: ольга крыжановская
    Acked-by: Al Viro
    Cc: stable@kernel.org # O_PATH introduced in 3.0+
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     
  • Pull ext4 bugfixes from Ted Ts'o:
    "A bug fix and performance regression fix for ext4"

    * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
    ext4: fix memory leak in xattr
    ext4: fix performance regression in writeback of random writes

    Linus Torvalds
     
  • Pull btrfs fixes from Chris Mason:
    "We've got more bug fixes in my for-linus branch:

    One of these fixes another corner of the compression oops from last
    time. Miao nailed down some problems with concurrent snapshot
    deletion and drive balancing.

    I kept out one of his patches for more testing, but these are all
    stable"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
    Btrfs: fix oops caused by the space balance and dead roots
    Btrfs: insert orphan roots into fs radix tree
    Btrfs: limit delalloc pages outside of find_delalloc_range
    Btrfs: use right root when checking for hash collision

    Linus Torvalds
     
  • Pull sound fixes from Takashi Iwai:
    "All stable fixes except for a trivial headset mic fixup: the removal
    of bogus frame checks in snd-usb-usx2y driver that have regressed in
    the recent kernel versions, the HD-audio HDMI channel map fix, and a
    few HD-audio device-specific fixes"

    * tag 'sound-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
    ALSA: hda - Sony VAIO Pro 13 (haswell) now has a working headset jack
    ALSA: hda - Add a headset mic model for ALC269 and friends
    ALSA: hda - Fix microphone for Sony VAIO Pro 13 (Haswell model)
    ALSA: hda - Add fixup for ASUS N56VZ
    ALSA: hda - hdmi: Fix channel map switch not taking effect
    ALSA: hda - Fix mono speakers and headset mic on Dell Vostro 5470
    ALSA: snd-usb-usx2y: remove bogus frame checks

    Linus Torvalds
     
  • Pull i2c fixes from Wolfram Sang:
    "We had various reports of problems with deferred probing in the I2C
    subsystem, so this pull requst is a little bigger than usual.

    Most issues should be addressed now so devices will be found
    correctly. A few ususal driver bugfixes are in here, too"

    * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
    i2c: i2c-mux-pinctrl: use deferred probe when adapter not found
    i2c: i2c-arb-gpio-challenge: use deferred probe when adapter not found
    i2c: i2c-mux-gpio: use deferred probing
    i2c: i2c-mux-gpio: don't ignore of_get_named_gpio errors
    i2c: omap: Clear ARDY bit twice
    i2c: Not all adapters have a parent
    i2c: i2c-stu300: replace platform_driver_probe to support deferred probing
    i2c: i2c-mxs: replace platform_driver_probe to support deferred probing
    i2c: i2c-imx: replace platform_driver_probe to support deferred probing
    i2c: i2c-designware-platdrv: replace platform_driver_probe to support deferred probing

    Linus Torvalds
     
  • If we take the 2nd retry path in ext4_expand_extra_isize_ea, we
    potentionally return from the function without having freed these
    allocations. If we don't do the return, we over-write the previous
    allocation pointers, so we leak either way.

    Spotted with Coverity.

    [ Fixed by tytso to set is and bs to NULL after freeing these
    pointers, in case in the retry loop we later end up triggering an
    error causing a jump to cleanup, at which point we could have a double
    free bug. -- Ted ]

    Signed-off-by: Dave Jones
    Signed-off-by: "Theodore Ts'o"
    Reviewed-by: Eric Sandeen
    Cc: stable@vger.kernel.org

    Dave Jones
     
  • Pull gcc "asm goto" miscompilation workaround from Ingo Molnar:
    "This is the fix for the GCC miscompilation discussed in the following
    lkml thread:

    [x86] BUG: unable to handle kernel paging request at 00740060

    The bug in GCC has been fixed by Jakub and the fix will be part of the
    GCC 4.8.2 release expected to be released next week - so the quirk's
    version test checks for miscompilation bug

    Linus Torvalds
     
  • Pull x86 fixes from Ingo Molnar:
    "A build fix and a reboot quirk"

    * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
    x86/reboot: Add reboot quirk for Dell Latitude E5410
    x86, build, pci: Fix PCI_MSI build on !SMP

    Linus Torvalds
     
  • Pull ARC fix from Vineet Gupta:
    "Fix for broken gdb 'jump'"

    * tag 'arc-fixes-for-3.12-part3' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
    ARC: Ignore ptrace SETREGSET request for synthetic register "stop_pc"

    Linus Torvalds
     

12 Oct, 2013

3 commits

  • ARCompact TRAP_S insn used for breakpoints, commits before exception is
    taken (updating architectural PC). So ptregs->ret contains next-PC and
    not the breakpoint PC itself. This is different from other restartable
    exceptions such as TLB Miss where ptregs->ret has exact faulting PC.
    gdb needs to know exact-PC hence ARC ptrace GETREGSET provides for
    @stop_pc which returns ptregs->ret vs. EFA depending on the
    situation.

    However, writing stop_pc (SETREGSET request), which updates ptregs->ret
    doesn't makes sense stop_pc doesn't always correspond to that reg as
    described above.

    This was not an issue so far since user_regs->ret / user_regs->stop_pc
    had same value and both writing to ptregs->ret was OK, needless, but NOT
    broken, hence not observed.

    With gdb "jump", they diverge, and user_regs->ret updating ptregs is
    overwritten immediately with stop_pc, which this patch fixes.

    Reported-by: Anton Kolesov
    Signed-off-by: Vineet Gupta

    Vineet Gupta
     
  • Pull MIPS fix from Ralf Baechle:
    "Just one fix. The stack protector was loading the value of the canary
    instead of its address"

    * 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
    MIPS: stack protector: Fix per-task canary switch

    Linus Torvalds
     
  • Pull drm fixes from Dave Airlie:
    "All over the map..

    - nouveau:
    disable MSI, needs more work, will try again next merge window
    - radeon:
    audio + uvd regression fixes, dpm fixes, reset fixes
    - i915:
    the dpms fix might fix your haswell

    And one pain in the ass revert, so we have VGA arbitration that when
    implemented 4-5 years ago really hoped that GPUs could remove
    themselves from arbitration completely once they had a kernel driver.

    It seems Intel hw designers decided that was too nice a facility to
    allow us to have so they removed it when they went on-die (so since
    Ironlake at least). Now Alex Williamson added support for VGA
    arbitration for newer GPUs however this now exposes itself to
    userspace as requireing arbitration of GPU VGA regions and the X
    server gets involved and disables things that it can't handle when VGA
    access is possibly required around every operation.

    So in order to not break userspace we just reverted things back to the
    old known broken status so maybe we can try and design out way out.

    Ville also had a patch to use stop machine for the two times Intel
    needs to access VGA space, that might be acceptable with some rework,
    but for now myself and Daniel agreed to just go back"

    * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (23 commits)
    Revert "i915: Update VGA arbiter support for newer devices"
    Revert "drm/i915: Delay disabling of VGA memory until vgacon->fbcon handoff is done"
    drm/radeon: re-enable sw ACR support on pre-DCE4
    drm/radeon/dpm: disable bapm on TN asics
    drm/radeon: improve soft reset on CIK
    drm/radeon: improve soft reset on SI
    drm/radeon/dpm: off by one in si_set_mc_special_registers()
    drm/radeon/dpm/btc: off by one in btc_set_mc_special_registers()
    drm/radeon: forever loop on error in radeon_do_test_moves()
    drm/radeon: fix hw contexts for SUMO2 asics
    drm/radeon: fix typo in CP DMA register headers
    drm/radeon/dpm: disable multiple UVD states
    drm/radeon: use hw generated CTS/N values for audio
    drm/radeon: fix N/CTS clock matching for audio
    drm/radeon: use 64-bit math to calculate CTS values for audio (v2)
    drm/edid: catch kmalloc failure in drm_edid_to_speaker_allocation
    Revert "drm/fb-helper: don't sleep for screen unblank when an oops is in progress"
    drm/gma500: fix things after get/put page helpers
    drm/nouveau/mc: disable msi support by default, it's busted in tons of places
    drm/i915: Only apply DPMS to the encoder if enabled
    ...

    Linus Torvalds
     

11 Oct, 2013

22 commits

  • Just got the positive confirmation from a tester:
    https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1227093/comments/28

    Signed-off-by: David Henningsson
    Signed-off-by: Takashi Iwai

    David Henningsson
     
  • Using the headset mic model will cause the headset mic to be labeled
    "headset mic" instead of just "mic".

    Signed-off-by: David Henningsson
    Signed-off-by: Takashi Iwai

    David Henningsson
     
  • The external mic showed up with a precense detect of "always present",
    essentially disabling the internal mic. Therefore turn off presence
    detection for this pin.

    Note: The external mic seems not yet working, but an internal mic is
    certainly better than no mic at all.

    Cc: stable@vger.kernel.org
    BugLink: https://bugs.launchpad.net/bugs/1227093
    Signed-off-by: David Henningsson
    Signed-off-by: Takashi Iwai

    David Henningsson
     
  • Fengguang Wu, Oleg Nesterov and Peter Zijlstra tracked down
    a kernel crash to a GCC bug: GCC miscompiles certain 'asm goto'
    constructs, as outlined here:

    http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670

    Implement a workaround suggested by Jakub Jelinek.

    Reported-and-tested-by: Fengguang Wu
    Reported-by: Oleg Nesterov
    Reported-by: Peter Zijlstra
    Suggested-by: Jakub Jelinek
    Reviewed-by: Richard Henderson
    Cc: Linus Torvalds
    Cc: Andrew Morton
    Cc:
    Signed-off-by: Ingo Molnar

    Ingo Molnar
     
  • This reverts commit 81b5c7bc8de3e6f63419139c2fc91bf81dea8a7d.

    Adding drm/i915 into the vga arbiter chain means that X (in a piece of
    well-meant paranoia) will do a get/put on the vga decoding around
    _every_ accel call down into the ddx. Which results in some nice
    performance disasters [1]. This really breaks userspace, by disabling
    DRI for everyone, and stops OpenGL from working, this isn't limited
    to just the i915 but both the integrated and discrete GPUs on
    multi-gpu systems, in other words this causes untold worlds of pain,

    Ville tried to come up with a Great Hack to fiddle the required VGA
    I/O ops behind everyone's back using stop_machine, but that didn't
    really work out [2]. Given that we're fairly late in the -rc stage for
    such games let's just revert this all.

    One thing we might want to keep is to delay the disabling of the vga
    decoding until the fbdev emulation and the fbcon screen is set up. If
    we kill vga mem decoding beforehand fbcon can end up with a white
    square in the top-left corner it tried to save from the vga memory for
    a seamless transition. And we have bug reports on older platforms
    which seem to match these symptoms.

    But again that's something to play around with in -next.

    References: [1] http://lists.x.org/archives/xorg-devel/2013-September/037763.html
    References: [2] http://www.spinics.net/lists/intel-gfx/msg34062.html
    Cc: Alex Williamson
    Cc: Ville Syrjälä
    Cc: Chris Wilson
    Signed-off-by: Daniel Vetter
    Signed-off-by: Dave Airlie

    Dave Airlie
     
  • This reverts commit 6e1b4fdad5157bb9e88777d525704aba24389bee.

    This is part of a revert due to a userspace breakage, better explained in the revert of 1a1a4cbf4906a13c0c377f708df5d94168e7b582.

    Signed-off-by: Daniel Vetter
    Signed-off-by: Dave Airlie

    Dave Airlie
     
  • Regression fixes for audio and UVD, several hang fixes,
    some DPM fixes.

    * 'drm-fixes-3.12' of git://people.freedesktop.org/~agd5f/linux:
    drm/radeon: re-enable sw ACR support on pre-DCE4
    drm/radeon/dpm: disable bapm on TN asics
    drm/radeon: improve soft reset on CIK
    drm/radeon: improve soft reset on SI
    drm/radeon/dpm: off by one in si_set_mc_special_registers()
    drm/radeon/dpm/btc: off by one in btc_set_mc_special_registers()
    drm/radeon: forever loop on error in radeon_do_test_moves()
    drm/radeon: fix hw contexts for SUMO2 asics
    drm/radeon: fix typo in CP DMA register headers
    drm/radeon/dpm: disable multiple UVD states
    drm/radeon: use hw generated CTS/N values for audio
    drm/radeon: fix N/CTS clock matching for audio
    drm/radeon: use 64-bit math to calculate CTS values for audio (v2)
    drm/edid: catch kmalloc failure in drm_edid_to_speaker_allocation

    Dave Airlie
     
  • When doing space balance and subvolume destroy at the same time, we met
    the following oops:

    kernel BUG at fs/btrfs/relocation.c:2247!
    RIP: 0010: [] prepare_to_merge+0x154/0x1f0 [btrfs]
    Call Trace:
    [] relocate_block_group+0x466/0x4e6 [btrfs]
    [] btrfs_relocate_block_group+0x143/0x275 [btrfs]
    [] btrfs_relocate_chunk.isra.27+0x5c/0x5a2 [btrfs]
    [] ? btrfs_item_key_to_cpu+0x15/0x31 [btrfs]
    [] ? btrfs_get_token_64+0x7e/0xcd [btrfs]
    [] ? btrfs_tree_read_unlock_blocking+0xb2/0xb7 [btrfs]
    [] btrfs_balance+0x9c7/0xb6f [btrfs]
    [] btrfs_ioctl_balance+0x234/0x2ac [btrfs]
    [] btrfs_ioctl+0xd87/0x1ef9 [btrfs]
    [] ? path_openat+0x234/0x4db
    [] ? __do_page_fault+0x31d/0x391
    [] ? vma_link+0x74/0x94
    [] vfs_ioctl+0x1d/0x39
    [] do_vfs_ioctl+0x32d/0x3e2
    [] SyS_ioctl+0x57/0x83
    [] ? do_page_fault+0xe/0x10
    [] system_call_fastpath+0x16/0x1b

    It is because we returned the error number if the reference of the root was 0
    when doing space relocation. It was not right here, because though the root
    was dead(refs == 0), but the space it held still need be relocated, or we
    could not remove the block group. So in this case, we should return the root
    no matter it is dead or not.

    Signed-off-by: Miao Xie
    Signed-off-by: Josef Bacik
    Signed-off-by: Chris Mason

    Miao Xie
     
  • Now we don't drop all the deleted snapshots/subvolumes before the space
    balance. It means we have to relocate the space which is held by the dead
    snapshots/subvolumes. So we must into them into fs radix tree, or we would
    forget to commit the change of them when doing transaction commit, and it
    would corrupt the metadata.

    Signed-off-by: Miao Xie
    Signed-off-by: Josef Bacik
    Signed-off-by: Chris Mason

    Miao Xie
     
  • Liu fixed part of this problem and unfortunately I steered him in slightly the
    wrong direction and so didn't completely fix the problem. The problem is we
    limit the size of the delalloc range we are looking for to max bytes and then we
    try to lock that range. If we fail to lock the pages in that range we will
    shrink the max bytes to a single page and re loop. However if our first page is
    inside of the delalloc range then we will end up limiting the end of the range
    to a period before our first page. This is illustrated below

    [0 -------- delalloc range --------- 256mb]
    [page]

    So find_delalloc_range will return with delalloc_start as 0 and end as 128mb,
    and then we will notice that delalloc_start < *start and adjust it up, but not
    adjust delalloc_end up, so things go sideways. To fix this we need to not limit
    the max bytes in find_delalloc_range, but in find_lock_delalloc_range and that
    way we don't end up with this confusion. Thanks,

    Signed-off-by: Josef Bacik
    Signed-off-by: Chris Mason

    Josef Bacik
     
  • btrfs_rename was using the root of the old dir instead of the root of the new
    dir when checking for a hash collision, so if you tried to move a file into a
    subvol it would freak out because it would see the file you are trying to move
    in its current root. This fixes the bug where this would fail

    btrfs subvol create test1
    btrfs subvol create test2
    mv test1 test2.

    Thanks to Chris Murphy for catching this,

    Cc: stable@vger.kernel.org
    Reported-by: Chris Murphy
    Signed-off-by: Josef Bacik
    Signed-off-by: Chris Mason

    Josef Bacik
     
  • Commit c0f04d88e46d ("bcache: Fix flushes in writeback mode") was fixing
    a reported data corruption bug, but it seems some last minute
    refactoring or rebasing introduced a null pointer deref.

    Signed-off-by: Kent Overstreet
    Cc: linux-stable # >= v3.10
    Reported-by: Gabriel de Perthuis
    Signed-off-by: Linus Torvalds

    Kent Overstreet
     
  • Pull hwmon fix from Guenter Roeck:
    "Fix root cause of crash/error seen in applesmc driver"

    * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
    hwmon: (applesmc) Always read until end of data

    Linus Torvalds
     
  • Pull kbuild fix from Michal Marek:
    "Here is an ARM Makefile fix that you even acked. After nobody wanted
    to take it, it ended up in the kbuild tree"

    * 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
    arm, kbuild: make "make install" not depend on vmlinux

    Linus Torvalds
     
  • Pull watchdog fix from Wim Van Sebroeck:
    "Make sure that the hpwdt driver will not load auxilary iLO devices"

    * git://www.linux-watchdog.org/linux-watchdog:
    watchdog: hpwdt: Patch to ignore auxilary iLO devices

    Linus Torvalds
     
  • Useful for locating buggy drivers on kernel oops.

    It may add dozens of new lines to boot dmesg. DEBUG_KOBJECT_RELEASE is
    hopefully only enabled in debug kernels (like maybe the Fedora rawhide
    one, or at developers), so being a bit more verbose is likely ok.

    Acked-by: Russell King
    Cc: Greg Kroah-Hartman
    Signed-off-by: Fengguang Wu
    Signed-off-by: Linus Torvalds

    Fengguang Wu
     
  • This patch is to prevent hpwdt from loading on any auxilary iLO devices defined
    after the initial (or main) iLO device. All auxilary iLO devices will have a
    subsystem device ID set to 0x1979 in order for hpwdt to differentiate between
    the two types.

    Signed-off-by: Thomas Mingarelli
    Tested-by: Lisa Mitchell
    Signed-off-by: Wim Van Sebroeck

    Mingarelli, Thomas
     
  • Pull /dev/random changes from Ted Ts'o:
    "These patches are designed to enable improvements to /dev/random for
    non-x86 platforms, in particular MIPS and ARM"

    * tag 'random_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/random:
    random: allow architectures to optionally define random_get_entropy()
    random: run random_int_secret_init() run after all late_initcalls

    Linus Torvalds
     
  • Pull kvm fixes from Paolo Bonzini:
    "Fixes for 3.12-rc5: two old PPC bugs and one new (3.12-rc2) x86 bug"

    * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
    kvm: ppc: booke: check range page invalidation progress on page setup
    KVM: PPC: Book3S HV: Fix typo in saving DSCR
    KVM: nVMX: fix shadow on EPT

    Linus Torvalds
     
  • Pull spi fixes from Mark Brown:
    "This is all driver updates, mostly fixes for error handling paths
    except for the s3c64xx and hspi fixes for trying to use runtime PM
    before it is enabled and the pxa2xx fix for interactions between power
    management and interrupt handling"

    * tag 'spi-v3.12-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
    spi: atmel: Fix incorrect error path
    spi/hspi: fixup Runtime PM enable timing
    spi/s3c64xx: Ensure runtime PM is enabled prior to registration
    spi/clps711x: drop clk_put for devm_clk_get in spi_clps711x_probe()
    spi: fix return value check in dspi_probe()
    spi: mpc512x: fix error return code in mpc512x_psc_spi_do_probe()
    spi: clps711x: Don't call kfree() after spi_master_put/spi_unregister_master
    spi/pxa2xx: check status register as well to determine if the device is off

    Linus Torvalds
     
  • Allow architectures which have a disabled get_cycles() function to
    provide a random_get_entropy() function which provides a fine-grained,
    rapidly changing counter that can be used by the /dev/random driver.

    For example, an architecture might have a rapidly changing register
    used to control random TLB cache eviction, or DRAM refresh that
    doesn't meet the requirements of get_cycles(), but which is good
    enough for the needs of the random driver.

    Signed-off-by: "Theodore Ts'o"
    Cc: stable@vger.kernel.org

    Theodore Ts'o
     
  • Pull MTD fixes from Brian Norris:
    - fix a small memory leak in some new ONFI code
    - account for additional odd variations of Micron SPI flash

    Acked by David Woodhouse.

    * tag 'for-linus-20131008' of git://git.infradead.org/linux-mtd:
    mtd: m25p80: Fix 4 byte addressing mode for Micron devices.
    mtd: nand: fix memory leak in ONFI extended parameter page

    Linus Torvalds
     

10 Oct, 2013

4 commits

  • HW ACR support may have issues on some older chips, so
    use SW ACR for now until we've tested further.

    Signed-off-by: Alex Deucher
    CC: Rafał Miłecki

    Alex Deucher
     
  • When the MM code is invalidating a range of pages, it calls the KVM
    kvm_mmu_notifier_invalidate_range_start() notifier function, which calls
    kvm_unmap_hva_range(), which arranges to flush all the TLBs for guest pages.
    However, the Linux PTEs for the range being flushed are still valid at
    that point. We are not supposed to establish any new references to pages
    in the range until the ...range_end() notifier gets called.
    The PPC-specific KVM code doesn't get any explicit notification of that;
    instead, we are supposed to use mmu_notifier_retry() to test whether we
    are or have been inside a range flush notifier pair while we have been
    referencing a page.

    This patch calls the mmu_notifier_retry() while mapping the guest
    page to ensure we are not referencing a page when in range invalidation.

    This call is inside a region locked with kvm->mmu_lock, which is the
    same lock that is called by the KVM MMU notifier functions, thus
    ensuring that no new notification can proceed while we are in the
    locked region.

    Signed-off-by: Bharat Bhushan
    Acked-by: Alexander Graf
    [Backported to 3.12 - Paolo]
    Reviewed-by: Bharat Bhushan
    Signed-off-by: Paolo Bonzini

    Bharat Bhushan
     
  • This fixes a typo in the code that saves the guest DSCR (Data Stream
    Control Register) into the kvm_vcpu_arch struct on guest exit. The
    effect of the typo was that the DSCR value was saved in the wrong place,
    so changes to the DSCR by the guest didn't persist across guest exit
    and entry, and some host kernel memory got corrupted.

    Cc: stable@vger.kernel.org [v3.1+]
    Signed-off-by: Paul Mackerras
    Acked-by: Alexander Graf
    Signed-off-by: Paolo Bonzini

    Paul Mackerras
     
  • 72f857950f6f19 broke shadow on EPT. This patch reverts it and fixes PAE
    on nEPT (which reverted commit fixed) in other way.

    Shadow on EPT is now broken because while L1 builds shadow page table
    for L2 (which is PAE while L2 is in real mode) it never loads L2's
    GUEST_PDPTR[0-3]. They do not need to be loaded because without nested
    virtualization HW does this during guest entry if EPT is disabled,
    but in our case L0 emulates L2's vmentry while EPT is enables, so we
    cannot rely on vmcs12->guest_pdptr[0-3] to contain up-to-date values
    and need to re-read PDPTEs from L2 memory. This is what kvm_set_cr3()
    is doing, but by clearing cache bits during L2 vmentry we drop values
    that kvm_set_cr3() read from memory.

    So why the same code does not work for PAE on nEPT? kvm_set_cr3()
    reads pdptes into vcpu->arch.walk_mmu->pdptrs[]. walk_mmu points to
    vcpu->arch.nested_mmu while nested guest is running, but ept_load_pdptrs()
    uses vcpu->arch.mmu which contain incorrect values. Fix that by using
    walk_mmu in ept_(load|save)_pdptrs.

    Signed-off-by: Gleb Natapov
    Reviewed-by: Paolo Bonzini
    Tested-by: Paolo Bonzini
    Signed-off-by: Paolo Bonzini

    Gleb Natapov