From 73f767ec2940ccd0ffdaf27cca2653af007c7d8b Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 26 Nov 2013 14:25:32 -0800 Subject: [PATCH] 3.4-stable patches added patches: powerpc-powernv-add-pe-to-its-own-peltv.patch powerpc-signals-mark-vsx-not-saved-with-small-contexts.patch powerpc-vio-use-strcpy-in-modalias_show.patch sunrpc-fix-a-data-corruption-issue-when-retransmitting-rpc-calls.patch --- ...erpc-powernv-add-pe-to-its-own-peltv.patch | 50 ++++++ ...rk-vsx-not-saved-with-small-contexts.patch | 58 +++++++ ...erpc-vio-use-strcpy-in-modalias_show.patch | 39 +++++ queue-3.4/series | 4 + ...-issue-when-retransmitting-rpc-calls.patch | 152 ++++++++++++++++++ 5 files changed, 303 insertions(+) create mode 100644 queue-3.4/powerpc-powernv-add-pe-to-its-own-peltv.patch create mode 100644 queue-3.4/powerpc-signals-mark-vsx-not-saved-with-small-contexts.patch create mode 100644 queue-3.4/powerpc-vio-use-strcpy-in-modalias_show.patch create mode 100644 queue-3.4/sunrpc-fix-a-data-corruption-issue-when-retransmitting-rpc-calls.patch diff --git a/queue-3.4/powerpc-powernv-add-pe-to-its-own-peltv.patch b/queue-3.4/powerpc-powernv-add-pe-to-its-own-peltv.patch new file mode 100644 index 00000000000..56ab2cccff5 --- /dev/null +++ b/queue-3.4/powerpc-powernv-add-pe-to-its-own-peltv.patch @@ -0,0 +1,50 @@ +From 631ad691b5818291d89af9be607d2fe40be0886e Mon Sep 17 00:00:00 2001 +From: Gavin Shan +Date: Mon, 4 Nov 2013 16:32:46 +0800 +Subject: powerpc/powernv: Add PE to its own PELTV + +From: Gavin Shan + +commit 631ad691b5818291d89af9be607d2fe40be0886e upstream. + +We need add PE to its own PELTV. Otherwise, the errors originated +from the PE might contribute to other PEs. In the result, we can't +clear up the error successfully even we're checking and clearing +errors during access to PCI config space. + +Reported-by: kalshett@in.ibm.com +Signed-off-by: Gavin Shan +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/platforms/powernv/pci-ioda.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/arch/powerpc/platforms/powernv/pci-ioda.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda.c +@@ -613,13 +613,23 @@ static int __devinit pnv_ioda_configure_ + rid_end = pe->rid + 1; + } + +- /* Associate PE in PELT */ ++ /* ++ * Associate PE in PELT. We need add the PE into the ++ * corresponding PELT-V as well. Otherwise, the error ++ * originated from the PE might contribute to other ++ * PEs. ++ */ + rc = opal_pci_set_pe(phb->opal_id, pe->pe_number, pe->rid, + bcomp, dcomp, fcomp, OPAL_MAP_PE); + if (rc) { + pe_err(pe, "OPAL error %ld trying to setup PELT table\n", rc); + return -ENXIO; + } ++ ++ rc = opal_pci_set_peltv(phb->opal_id, pe->pe_number, ++ pe->pe_number, OPAL_ADD_PE_TO_DOMAIN); ++ if (rc) ++ pe_warn(pe, "OPAL error %d adding self to PELTV\n", rc); + opal_pci_eeh_freeze_clear(phb->opal_id, pe->pe_number, + OPAL_EEH_ACTION_CLEAR_FREEZE_ALL); + diff --git a/queue-3.4/powerpc-signals-mark-vsx-not-saved-with-small-contexts.patch b/queue-3.4/powerpc-signals-mark-vsx-not-saved-with-small-contexts.patch new file mode 100644 index 00000000000..585f02afaed --- /dev/null +++ b/queue-3.4/powerpc-signals-mark-vsx-not-saved-with-small-contexts.patch @@ -0,0 +1,58 @@ +From c13f20ac48328b05cd3b8c19e31ed6c132b44b42 Mon Sep 17 00:00:00 2001 +From: Michael Neuling +Date: Wed, 20 Nov 2013 16:18:54 +1100 +Subject: powerpc/signals: Mark VSX not saved with small contexts + +From: Michael Neuling + +commit c13f20ac48328b05cd3b8c19e31ed6c132b44b42 upstream. + +The VSX MSR bit in the user context indicates if the context contains VSX +state. Currently we set this when the process has touched VSX at any stage. + +Unfortunately, if the user has not provided enough space to save the VSX state, +we can't save it but we currently still set the MSR VSX bit. + +This patch changes this to clear the MSR VSX bit when the user doesn't provide +enough space. This indicates that there is no valid VSX state in the user +context. + +This is needed to support get/set/make/swapcontext for applications that use +VSX but only provide a small context. For example, getcontext in glibc +provides a smaller context since the VSX registers don't need to be saved over +the glibc function call. But since the program calling getcontext may have +used VSX, the kernel currently says the VSX state is valid when it's not. If +the returned context is then used in setcontext (ie. a small context without +VSX but with MSR VSX set), the kernel will refuse the context. This situation +has been reported by the glibc community. + +Based on patch from Carlos O'Donell. + +Tested-by: Haren Myneni +Signed-off-by: Michael Neuling +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/signal_32.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/arch/powerpc/kernel/signal_32.c ++++ b/arch/powerpc/kernel/signal_32.c +@@ -459,7 +459,15 @@ static int save_user_regs(struct pt_regs + if (copy_vsx_to_user(&frame->mc_vsregs, current)) + return 1; + msr |= MSR_VSX; +- } ++ } else if (!ctx_has_vsx_region) ++ /* ++ * With a small context structure we can't hold the VSX ++ * registers, hence clear the MSR value to indicate the state ++ * was not saved. ++ */ ++ msr &= ~MSR_VSX; ++ ++ + #endif /* CONFIG_VSX */ + #ifdef CONFIG_SPE + /* save spe registers */ diff --git a/queue-3.4/powerpc-vio-use-strcpy-in-modalias_show.patch b/queue-3.4/powerpc-vio-use-strcpy-in-modalias_show.patch new file mode 100644 index 00000000000..a705f334d49 --- /dev/null +++ b/queue-3.4/powerpc-vio-use-strcpy-in-modalias_show.patch @@ -0,0 +1,39 @@ +From 411cabf79e684171669ad29a0628c400b4431e95 Mon Sep 17 00:00:00 2001 +From: Prarit Bhargava +Date: Thu, 17 Oct 2013 08:00:11 -0400 +Subject: powerpc/vio: use strcpy in modalias_show + +From: Prarit Bhargava + +commit 411cabf79e684171669ad29a0628c400b4431e95 upstream. + +Commit e82b89a6f19bae73fb064d1b3dd91fcefbb478f4 used strcat instead of +strcpy which can result in an overflow of newlines on the buffer. + +Signed-off-by: Prarit Bhargava +Cc: benh@kernel.crashing.org +Cc: ben@decadent.org.uk +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/vio.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/kernel/vio.c ++++ b/arch/powerpc/kernel/vio.c +@@ -1342,12 +1342,12 @@ static ssize_t modalias_show(struct devi + + dn = dev->of_node; + if (!dn) { +- strcat(buf, "\n"); ++ strcpy(buf, "\n"); + return strlen(buf); + } + cp = of_get_property(dn, "compatible", NULL); + if (!cp) { +- strcat(buf, "\n"); ++ strcpy(buf, "\n"); + return strlen(buf); + } + diff --git a/queue-3.4/series b/queue-3.4/series index 1b1b65be284..4a1ea3fef68 100644 --- a/queue-3.4/series +++ b/queue-3.4/series @@ -30,3 +30,7 @@ hwmon-lm90-fix-max6696-alarm-handling.patch block-fix-race-between-request-completion-and-timeout-handling.patch block-fix-a-probe-argument-to-blk_register_region.patch block-properly-stack-underlying-max_segment_size-to-dm-device.patch +powerpc-vio-use-strcpy-in-modalias_show.patch +powerpc-powernv-add-pe-to-its-own-peltv.patch +powerpc-signals-mark-vsx-not-saved-with-small-contexts.patch +sunrpc-fix-a-data-corruption-issue-when-retransmitting-rpc-calls.patch diff --git a/queue-3.4/sunrpc-fix-a-data-corruption-issue-when-retransmitting-rpc-calls.patch b/queue-3.4/sunrpc-fix-a-data-corruption-issue-when-retransmitting-rpc-calls.patch new file mode 100644 index 00000000000..7f366d41358 --- /dev/null +++ b/queue-3.4/sunrpc-fix-a-data-corruption-issue-when-retransmitting-rpc-calls.patch @@ -0,0 +1,152 @@ +From a6b31d18b02ff9d7915c5898c9b5ca41a798cd73 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Fri, 8 Nov 2013 16:03:50 -0500 +Subject: SUNRPC: Fix a data corruption issue when retransmitting RPC calls + +From: Trond Myklebust + +commit a6b31d18b02ff9d7915c5898c9b5ca41a798cd73 upstream. + +The following scenario can cause silent data corruption when doing +NFS writes. It has mainly been observed when doing database writes +using O_DIRECT. + +1) The RPC client uses sendpage() to do zero-copy of the page data. +2) Due to networking issues, the reply from the server is delayed, + and so the RPC client times out. + +3) The client issues a second sendpage of the page data as part of + an RPC call retransmission. + +4) The reply to the first transmission arrives from the server + _before_ the client hardware has emptied the TCP socket send + buffer. +5) After processing the reply, the RPC state machine rules that + the call to be done, and triggers the completion callbacks. +6) The application notices the RPC call is done, and reuses the + pages to store something else (e.g. a new write). + +7) The client NIC drains the TCP socket send buffer. Since the + page data has now changed, it reads a corrupted version of the + initial RPC call, and puts it on the wire. + +This patch fixes the problem in the following manner: + +The ordering guarantees of TCP ensure that when the server sends a +reply, then we know that the _first_ transmission has completed. Using +zero-copy in that situation is therefore safe. +If a time out occurs, we then send the retransmission using sendmsg() +(i.e. no zero-copy), We then know that the socket contains a full copy of +the data, and so it will retransmit a faithful reproduction even if the +RPC call completes, and the application reuses the O_DIRECT buffer in +the meantime. + +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xprtsock.c | 28 +++++++++++++++++++++------- + 1 file changed, 21 insertions(+), 7 deletions(-) + +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -390,8 +390,10 @@ static int xs_send_kvec(struct socket *s + return kernel_sendmsg(sock, &msg, NULL, 0, 0); + } + +-static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned int base, int more) ++static int xs_send_pagedata(struct socket *sock, struct xdr_buf *xdr, unsigned int base, int more, bool zerocopy) + { ++ ssize_t (*do_sendpage)(struct socket *sock, struct page *page, ++ int offset, size_t size, int flags); + struct page **ppage; + unsigned int remainder; + int err, sent = 0; +@@ -400,6 +402,9 @@ static int xs_send_pagedata(struct socke + base += xdr->page_base; + ppage = xdr->pages + (base >> PAGE_SHIFT); + base &= ~PAGE_MASK; ++ do_sendpage = sock->ops->sendpage; ++ if (!zerocopy) ++ do_sendpage = sock_no_sendpage; + for(;;) { + unsigned int len = min_t(unsigned int, PAGE_SIZE - base, remainder); + int flags = XS_SENDMSG_FLAGS; +@@ -407,7 +412,7 @@ static int xs_send_pagedata(struct socke + remainder -= len; + if (remainder != 0 || more) + flags |= MSG_MORE; +- err = sock->ops->sendpage(sock, *ppage, base, len, flags); ++ err = do_sendpage(sock, *ppage, base, len, flags); + if (remainder == 0 || err != len) + break; + sent += err; +@@ -428,9 +433,10 @@ static int xs_send_pagedata(struct socke + * @addrlen: UDP only -- length of destination address + * @xdr: buffer containing this request + * @base: starting position in the buffer ++ * @zerocopy: true if it is safe to use sendpage() + * + */ +-static int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen, struct xdr_buf *xdr, unsigned int base) ++static int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen, struct xdr_buf *xdr, unsigned int base, bool zerocopy) + { + unsigned int remainder = xdr->len - base; + int err, sent = 0; +@@ -458,7 +464,7 @@ static int xs_sendpages(struct socket *s + if (base < xdr->page_len) { + unsigned int len = xdr->page_len - base; + remainder -= len; +- err = xs_send_pagedata(sock, xdr, base, remainder != 0); ++ err = xs_send_pagedata(sock, xdr, base, remainder != 0, zerocopy); + if (remainder == 0 || err != len) + goto out; + sent += err; +@@ -561,7 +567,7 @@ static int xs_local_send_request(struct + req->rq_svec->iov_base, req->rq_svec->iov_len); + + status = xs_sendpages(transport->sock, NULL, 0, +- xdr, req->rq_bytes_sent); ++ xdr, req->rq_bytes_sent, true); + dprintk("RPC: %s(%u) = %d\n", + __func__, xdr->len - req->rq_bytes_sent, status); + if (likely(status >= 0)) { +@@ -617,7 +623,7 @@ static int xs_udp_send_request(struct rp + status = xs_sendpages(transport->sock, + xs_addr(xprt), + xprt->addrlen, xdr, +- req->rq_bytes_sent); ++ req->rq_bytes_sent, true); + + dprintk("RPC: xs_udp_send_request(%u) = %d\n", + xdr->len - req->rq_bytes_sent, status); +@@ -688,6 +694,7 @@ static int xs_tcp_send_request(struct rp + struct rpc_xprt *xprt = req->rq_xprt; + struct sock_xprt *transport = container_of(xprt, struct sock_xprt, xprt); + struct xdr_buf *xdr = &req->rq_snd_buf; ++ bool zerocopy = true; + int status; + + xs_encode_stream_record_marker(&req->rq_snd_buf); +@@ -695,13 +702,20 @@ static int xs_tcp_send_request(struct rp + xs_pktdump("packet data:", + req->rq_svec->iov_base, + req->rq_svec->iov_len); ++ /* Don't use zero copy if this is a resend. If the RPC call ++ * completes while the socket holds a reference to the pages, ++ * then we may end up resending corrupted data. ++ */ ++ if (task->tk_flags & RPC_TASK_SENT) ++ zerocopy = false; + + /* Continue transmitting the packet/record. We must be careful + * to cope with writespace callbacks arriving _after_ we have + * called sendmsg(). */ + while (1) { + status = xs_sendpages(transport->sock, +- NULL, 0, xdr, req->rq_bytes_sent); ++ NULL, 0, xdr, req->rq_bytes_sent, ++ zerocopy); + + dprintk("RPC: xs_tcp_send_request(%u) = %d\n", + xdr->len - req->rq_bytes_sent, status); -- 2.47.3