--- /dev/null
+From 07464e88365e9236febaca9ed1a2e2006d8bc952 Mon Sep 17 00:00:00 2001
+From: Oliver O'Halloran <oohall@gmail.com>
+Date: Wed, 6 Feb 2019 13:04:53 +1100
+Subject: libnvdimm: Fix altmap reservation size calculation
+
+From: Oliver O'Halloran <oohall@gmail.com>
+
+commit 07464e88365e9236febaca9ed1a2e2006d8bc952 upstream.
+
+Libnvdimm reserves the first 8K of pfn and devicedax namespaces to
+store a superblock describing the namespace. This 8K reservation
+is contained within the altmap area which the kernel uses for the
+vmemmap backing for the pages within the namespace. The altmap
+allows for some pages at the start of the altmap area to be reserved
+and that mechanism is used to protect the superblock from being
+re-used as vmemmap backing.
+
+The number of PFNs to reserve is calculated using:
+
+ PHYS_PFN(SZ_8K)
+
+Which is implemented as:
+
+ #define PHYS_PFN(x) ((unsigned long)((x) >> PAGE_SHIFT))
+
+So on systems where PAGE_SIZE is greater than 8K the reservation
+size is truncated to zero and the superblock area is re-used as
+vmemmap backing. As a result all the namespace information stored
+in the superblock (i.e. if it's a PFN or DAX namespace) is lost
+and the namespace needs to be re-created to get access to the
+contents.
+
+This patch fixes this by using PFN_UP() rather than PHYS_PFN() to ensure
+that at least one page is reserved. On systems with a 4K pages size this
+patch should have no effect.
+
+Cc: stable@vger.kernel.org
+Cc: Dan Williams <dan.j.williams@intel.com>
+Fixes: ac515c084be9 ("libnvdimm, pmem, pfn: move pfn setup to the core")
+Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
+Reviewed-by: Vishal Verma <vishal.l.verma@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvdimm/pfn_devs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvdimm/pfn_devs.c
++++ b/drivers/nvdimm/pfn_devs.c
+@@ -515,7 +515,7 @@ static unsigned long init_altmap_base(re
+
+ static unsigned long init_altmap_reserve(resource_size_t base)
+ {
+- unsigned long reserve = PHYS_PFN(SZ_8K);
++ unsigned long reserve = PFN_UP(SZ_8K);
+ unsigned long base_pfn = PHYS_PFN(base);
+
+ reserve += base_pfn - PFN_SECTION_ALIGN_DOWN(base_pfn);
--- /dev/null
+From 966d23a006ca7b44ac8cf4d0c96b19785e0c3da0 Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Tue, 15 Jan 2019 10:47:00 -0800
+Subject: libnvdimm/label: Clear 'updating' flag after label-set update
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit 966d23a006ca7b44ac8cf4d0c96b19785e0c3da0 upstream.
+
+The UEFI 2.7 specification sets expectations that the 'updating' flag is
+eventually cleared. To date, the libnvdimm core has never adhered to
+that protocol. The policy of the core matches the policy of other
+multi-device info-block formats like MD-Software-RAID that expect
+administrator intervention on inconsistent info-blocks, not automatic
+invalidation.
+
+However, some pre-boot environments may unfortunately attempt to "clean
+up" the labels and invalidate a set when it fails to find at least one
+"non-updating" label in the set. Clear the updating flag after set
+updates to minimize the window of vulnerability to aggressive pre-boot
+environments.
+
+Ideally implementations would not write to the label area outside of
+creating namespaces.
+
+Note that this only minimizes the window, it does not close it as the
+system can still crash while clearing the flag and the set can be
+subsequently deleted / invalidated by the pre-boot environment.
+
+Fixes: f524bf271a5c ("libnvdimm: write pmem label set")
+Cc: <stable@vger.kernel.org>
+Cc: Kelly Couch <kelly.j.couch@intel.com>
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvdimm/label.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- a/drivers/nvdimm/label.c
++++ b/drivers/nvdimm/label.c
+@@ -492,7 +492,7 @@ static unsigned long nd_label_offset(str
+
+ static int __pmem_label_update(struct nd_region *nd_region,
+ struct nd_mapping *nd_mapping, struct nd_namespace_pmem *nspm,
+- int pos)
++ int pos, unsigned long flags)
+ {
+ u64 cookie = nd_region_interleave_set_cookie(nd_region);
+ struct nvdimm_drvdata *ndd = to_ndd(nd_mapping);
+@@ -530,7 +530,7 @@ static int __pmem_label_update(struct nd
+ memcpy(nd_label->uuid, nspm->uuid, NSLABEL_UUID_LEN);
+ if (nspm->alt_name)
+ memcpy(nd_label->name, nspm->alt_name, NSLABEL_NAME_LEN);
+- nd_label->flags = __cpu_to_le32(NSLABEL_FLAG_UPDATING);
++ nd_label->flags = __cpu_to_le32(flags);
+ nd_label->nlabel = __cpu_to_le16(nd_region->ndr_mappings);
+ nd_label->position = __cpu_to_le16(pos);
+ nd_label->isetcookie = __cpu_to_le64(cookie);
+@@ -922,13 +922,13 @@ static int del_labels(struct nd_mapping
+ int nd_pmem_namespace_label_update(struct nd_region *nd_region,
+ struct nd_namespace_pmem *nspm, resource_size_t size)
+ {
+- int i;
++ int i, rc;
+
+ for (i = 0; i < nd_region->ndr_mappings; i++) {
+ struct nd_mapping *nd_mapping = &nd_region->mapping[i];
+ struct nvdimm_drvdata *ndd = to_ndd(nd_mapping);
+ struct resource *res;
+- int rc, count = 0;
++ int count = 0;
+
+ if (size == 0) {
+ rc = del_labels(nd_mapping, nspm->uuid);
+@@ -946,7 +946,20 @@ int nd_pmem_namespace_label_update(struc
+ if (rc < 0)
+ return rc;
+
+- rc = __pmem_label_update(nd_region, nd_mapping, nspm, i);
++ rc = __pmem_label_update(nd_region, nd_mapping, nspm, i,
++ NSLABEL_FLAG_UPDATING);
++ if (rc)
++ return rc;
++ }
++
++ if (size == 0)
++ return 0;
++
++ /* Clear the UPDATING flag per UEFI 2.7 expectations */
++ for (i = 0; i < nd_region->ndr_mappings; i++) {
++ struct nd_mapping *nd_mapping = &nd_region->mapping[i];
++
++ rc = __pmem_label_update(nd_region, nd_mapping, nspm, i, 0);
+ if (rc)
+ return rc;
+ }
--- /dev/null
+From fa7d2e639cd90442d868dfc6ca1d4cc9d8bf206e Mon Sep 17 00:00:00 2001
+From: Dan Williams <dan.j.williams@intel.com>
+Date: Thu, 24 Jan 2019 17:33:06 -0800
+Subject: libnvdimm/pmem: Honor force_raw for legacy pmem regions
+
+From: Dan Williams <dan.j.williams@intel.com>
+
+commit fa7d2e639cd90442d868dfc6ca1d4cc9d8bf206e upstream.
+
+For recovery, where non-dax access is needed to a given physical address
+range, and testing, allow the 'force_raw' attribute to override the
+default establishment of a dev_pagemap.
+
+Otherwise without this capability it is possible to end up with a
+namespace that can not be activated due to corrupted info-block, and one
+that can not be repaired due to a section collision.
+
+Cc: <stable@vger.kernel.org>
+Fixes: 004f1afbe199 ("libnvdimm, pmem: direct map legacy pmem by default")
+Signed-off-by: Dan Williams <dan.j.williams@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/nvdimm/namespace_devs.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/nvdimm/namespace_devs.c
++++ b/drivers/nvdimm/namespace_devs.c
+@@ -138,6 +138,7 @@ bool nd_is_uuid_unique(struct device *de
+ bool pmem_should_map_pages(struct device *dev)
+ {
+ struct nd_region *nd_region = to_nd_region(dev->parent);
++ struct nd_namespace_common *ndns = to_ndns(dev);
+ struct nd_namespace_io *nsio;
+
+ if (!IS_ENABLED(CONFIG_ZONE_DEVICE))
+@@ -149,6 +150,9 @@ bool pmem_should_map_pages(struct device
+ if (is_nd_pfn(dev) || is_nd_btt(dev))
+ return false;
+
++ if (ndns->force_raw)
++ return false;
++
+ nsio = to_nd_namespace_io(dev);
+ if (region_intersects(nsio->res.start, resource_size(&nsio->res),
+ IORESOURCE_SYSTEM_RAM,
nfp-bpf-fix-alu32-high-bits-clearance-bug.patch
net-set-static-variable-an-initial-value-in-atl2_pro.patch
tmpfs-fix-uninitialized-return-value-in-shmem_link.patch
+stm-class-prevent-division-by-zero.patch
+libnvdimm-label-clear-updating-flag-after-label-set-update.patch
+libnvdimm-pmem-honor-force_raw-for-legacy-pmem-regions.patch
+libnvdimm-fix-altmap-reservation-size-calculation.patch
--- /dev/null
+From bf7cbaae0831252b416f375ca9b1027ecd4642dd Mon Sep 17 00:00:00 2001
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Date: Thu, 21 Feb 2019 14:19:17 +0200
+Subject: stm class: Prevent division by zero
+
+From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+
+commit bf7cbaae0831252b416f375ca9b1027ecd4642dd upstream.
+
+Using STP_POLICY_ID_SET ioctl command with dummy_stm device, or any STM
+device that supplies zero mmio channel size, will trigger a division by
+zero bug in the kernel.
+
+Prevent this by disallowing channel widths other than 1 for such devices.
+
+Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices")
+CC: stable@vger.kernel.org # v4.4+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hwtracing/stm/core.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/hwtracing/stm/core.c
++++ b/drivers/hwtracing/stm/core.c
+@@ -561,7 +561,7 @@ static int stm_char_policy_set_ioctl(str
+ {
+ struct stm_device *stm = stmf->stm;
+ struct stp_policy_id *id;
+- int ret = -EINVAL;
++ int ret = -EINVAL, wlimit = 1;
+ u32 size;
+
+ if (stmf->output.nr_chans)
+@@ -589,8 +589,10 @@ static int stm_char_policy_set_ioctl(str
+ if (id->__reserved_0 || id->__reserved_1)
+ goto err_free;
+
+- if (id->width < 1 ||
+- id->width > PAGE_SIZE / stm->data->sw_mmiosz)
++ if (stm->data->sw_mmiosz)
++ wlimit = PAGE_SIZE / stm->data->sw_mmiosz;
++
++ if (id->width < 1 || id->width > wlimit)
+ goto err_free;
+
+ ret = stm_file_assign(stmf, id->id, id->width);
projects / thirdparty / kernel / stable-queue.git / commitdiff
