[PATCH v2 0/7] [net] intel: Use smp_rmb rather than read_barrier_depends

[PATCH v2 0/7] [net] intel: Use smp_rmb rather than read_barrier_depends

[Brian King]

This patch converts several network drivers to use smp_rmb
rather than read_barrier_depends. The initial issue was
discovered with ixgbe on a Power machine which resulted
in skb list corruption due to fetching a stale skb pointer.
More details can be found in the ixgbe patch description.

Changes since v1:
- Remove NULLing of tx_buffer->skb in the ixgbe patch

Brian King (7):
  ixgbe: Fix skb list corruption on Power systems
  i40e: Use smp_rmb rather than read_barrier_depends
  ixgbevf: Use smp_rmb rather than read_barrier_depends
  igbvf: Use smp_rmb rather than read_barrier_depends
  igb: Use smp_rmb rather than read_barrier_depends
  fm10k: Use smp_rmb rather than read_barrier_depends
  i40evf: Use smp_rmb rather than read_barrier_depends

 drivers/net/ethernet/intel/fm10k/fm10k_main.c     | 2 +-
 drivers/net/ethernet/intel/i40e/i40e_main.c       | 2 +-
 drivers/net/ethernet/intel/i40e/i40e_txrx.c       | 2 +-
 drivers/net/ethernet/intel/i40evf/i40e_txrx.c     | 2 +-
 drivers/net/ethernet/intel/igb/igb_main.c         | 2 +-
 drivers/net/ethernet/intel/igbvf/netdev.c         | 2 +-
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c     | 2 +-
 drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 2 +-
 8 files changed, 8 insertions(+), 8 deletions(-)

-- 
1.8.3.1

[PATCH v2 1/7] ixgbe: Fix skb list corruption on Power systems

[Brian King]

This patch fixes an issue seen on Power systems with ixgbe which results
in skb list corruption and an eventual kernel oops. The following is what
was observed:

CPU 1                                   CPU2
============================            ============================
1: ixgbe_xmit_frame_ring                ixgbe_clean_tx_irq
2:  first->skb = skb                     eop_desc = tx_buffer->next_to_watch
3:  ixgbe_tx_map                         read_barrier_depends()
4:   wmb                                 check adapter written status bit
5:   first->next_to_watch = tx_desc      napi_consume_skb(tx_buffer->skb ..);
6:   writel(i, tx_ring->tail);

The read_barrier_depends is insufficient to ensure that tx_buffer->skb does not
get loaded prior to tx_buffer->next_to_watch, which then results in loading
a stale skb pointer. This patch replaces the read_barrier_depends with
smp_rmb to ensure loads are ordered with respect to the load of
tx_buffer->next_to_watch.

Cc: stable<stable@vger.kernel.org>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
---
 drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 6d5f31e..879a9c4 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1192,7 +1192,7 @@ static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector,
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		/* if DD is not set pending work has not been completed */
 		if (!(eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)))
-- 
1.8.3.1

Re: [PATCH v2 1/7] ixgbe: Fix skb list corruption on Power systems

[Jesse Brandeburg]

On Fri, 17 Nov 2017 11:05:43 -0600
Brian King <brking@linux.vnet.ibm.com> wrote:

> This patch fixes an issue seen on Power systems with ixgbe which results
> in skb list corruption and an eventual kernel oops. The following is what
> was observed:

Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>

[PATCH v2 2/7] i40e: Use smp_rmb rather than read_barrier_depends

[Brian King]

The original issue being fixed in this patch was seen with the ixgbe
driver, but the same issue exists with i40e as well, as the code is
very similar. read_barrier_depends is not sufficient to ensure
loads following it are not speculatively loaded out of order
by the CPU, which can result in stale data being loaded, causing
potential system crashes.

Cc: stable<stable@vger.kernel.org>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
---
 drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +-
 drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 6498da8..ea20aac 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -3760,7 +3760,7 @@ static bool i40e_clean_fdir_tx_irq(struct i40e_ring *tx_ring, int budget)
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		/* if the descriptor isn't done, no work yet to do */
 		if (!(eop_desc->cmd_type_offset_bsz &
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 120c68f..3c07ff1 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -759,7 +759,7 @@ static bool i40e_clean_tx_irq(struct i40e_vsi *vsi,
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		i40e_trace(clean_tx_irq, tx_ring, tx_desc, tx_buf);
 		/* we have caught up to head, no work left to do */
-- 
1.8.3.1

Re: [PATCH v2 2/7] i40e: Use smp_rmb rather than read_barrier_depends

[Jesse Brandeburg]

On Fri, 17 Nov 2017 11:05:44 -0600
Brian King <brking@linux.vnet.ibm.com> wrote:

> The original issue being fixed in this patch was seen with the ixgbe
> driver, but the same issue exists with i40e as well, as the code is
> very similar. read_barrier_depends is not sufficient to ensure
> loads following it are not speculatively loaded out of order
> by the CPU, which can result in stale data being loaded, causing
> potential system crashes.

Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>

[PATCH v2 3/7] ixgbevf: Use smp_rmb rather than read_barrier_depends

[Brian King]

The original issue being fixed in this patch was seen with the ixgbe
driver, but the same issue exists with ixgbevf as well, as the code is
very similar. read_barrier_depends is not sufficient to ensure
loads following it are not speculatively loaded out of order
by the CPU, which can result in stale data being loaded, causing
potential system crashes.

Cc: stable<stable@vger.kernel.org>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
---
 drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index 032f8ac..90ecc4b 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -326,7 +326,7 @@ static bool ixgbevf_clean_tx_irq(struct ixgbevf_q_vector *q_vector,
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		/* if DD is not set pending work has not been completed */
 		if (!(eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD)))
-- 
1.8.3.1

Re: [PATCH v2 3/7] ixgbevf: Use smp_rmb rather than read_barrier_depends

[Jesse Brandeburg]

On Fri, 17 Nov 2017 11:05:45 -0600
Brian King <brking@linux.vnet.ibm.com> wrote:

> The original issue being fixed in this patch was seen with the ixgbe
> driver, but the same issue exists with ixgbevf as well, as the code is
> very similar. read_barrier_depends is not sufficient to ensure
> loads following it are not speculatively loaded out of order
> by the CPU, which can result in stale data being loaded, causing
> potential system crashes.

Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>

[PATCH v2 4/7] igbvf: Use smp_rmb rather than read_barrier_depends

[Brian King]

The original issue being fixed in this patch was seen with the ixgbe
driver, but the same issue exists with igbvf as well, as the code is
very similar. read_barrier_depends is not sufficient to ensure
loads following it are not speculatively loaded out of order
by the CPU, which can result in stale data being loaded, causing
potential system crashes.

Cc: stable<stable@vger.kernel.org>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
---
 drivers/net/ethernet/intel/igbvf/netdev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c
index 1ed5569..6f5888b 100644
--- a/drivers/net/ethernet/intel/igbvf/netdev.c
+++ b/drivers/net/ethernet/intel/igbvf/netdev.c
@@ -810,7 +810,7 @@ static bool igbvf_clean_tx_irq(struct igbvf_ring *tx_ring)
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		/* if DD is not set pending work has not been completed */
 		if (!(eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)))
-- 
1.8.3.1

Re: [PATCH v2 4/7] igbvf: Use smp_rmb rather than read_barrier_depends

[Jesse Brandeburg]

On Fri, 17 Nov 2017 11:05:46 -0600
Brian King <brking@linux.vnet.ibm.com> wrote:

> The original issue being fixed in this patch was seen with the ixgbe
> driver, but the same issue exists with igbvf as well, as the code is
> very similar. read_barrier_depends is not sufficient to ensure
> loads following it are not speculatively loaded out of order
> by the CPU, which can result in stale data being loaded, causing
> potential system crashes.

Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>

RE: [Intel-wired-lan] [PATCH v2 4/7] igbvf: Use smp_rmb rather than read_barrier_depends

[Brown, Aaron F]

> From: Intel-wired-lan [mailto:intel-wired-lan-bounces@osuosl.org] On Behalf
> Of Brian King
> Sent: Friday, November 17, 2017 9:06 AM
> Cc: muvic@linux.vnet.ibm.com; stable@vger.kernel.org; intel-wired-
> lan@lists.osuosl.org; brking@pobox.com
> Subject: [Intel-wired-lan] [PATCH v2 4/7] igbvf: Use smp_rmb rather than
> read_barrier_depends
> 
> The original issue being fixed in this patch was seen with the ixgbe
> driver, but the same issue exists with igbvf as well, as the code is
> very similar. read_barrier_depends is not sufficient to ensure
> loads following it are not speculatively loaded out of order
> by the CPU, which can result in stale data being loaded, causing
> potential system crashes.
> 
> Cc: stable<stable@vger.kernel.org>
> Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
> ---
>  drivers/net/ethernet/intel/igbvf/netdev.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Tested-by: Aaron Brown <aaron.f.brown@intel.com>

[PATCH v2 5/7] igb: Use smp_rmb rather than read_barrier_depends

[Brian King]

The original issue being fixed in this patch was seen with the ixgbe
driver, but the same issue exists with igb as well, as the code is
very similar. read_barrier_depends is not sufficient to ensure
loads following it are not speculatively loaded out of order
by the CPU, which can result in stale data being loaded, causing
potential system crashes.

Cc: stable<stable@vger.kernel.org>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
---
 drivers/net/ethernet/intel/igb/igb_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index ea69af2..b0031c5 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -6970,7 +6970,7 @@ static bool igb_clean_tx_irq(struct igb_q_vector *q_vector, int napi_budget)
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		/* if DD is not set pending work has not been completed */
 		if (!(eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD)))
-- 
1.8.3.1

Re: [PATCH v2 5/7] igb: Use smp_rmb rather than read_barrier_depends

[Jesse Brandeburg]

On Fri, 17 Nov 2017 11:05:47 -0600
Brian King <brking@linux.vnet.ibm.com> wrote:

> The original issue being fixed in this patch was seen with the ixgbe
> driver, but the same issue exists with igb as well, as the code is
> very similar. read_barrier_depends is not sufficient to ensure
> loads following it are not speculatively loaded out of order
> by the CPU, which can result in stale data being loaded, causing
> potential system crashes.

Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>

RE: [Intel-wired-lan] [PATCH v2 5/7] igb: Use smp_rmb rather than read_barrier_depends

[Brown, Aaron F]

> From: Intel-wired-lan [mailto:intel-wired-lan-bounces@osuosl.org] On Behalf
> Of Brian King
> Sent: Friday, November 17, 2017 9:06 AM
> Cc: muvic@linux.vnet.ibm.com; stable@vger.kernel.org; intel-wired-
> lan@lists.osuosl.org; brking@pobox.com
> Subject: [Intel-wired-lan] [PATCH v2 5/7] igb: Use smp_rmb rather than
> read_barrier_depends
> 
> The original issue being fixed in this patch was seen with the ixgbe
> driver, but the same issue exists with igb as well, as the code is
> very similar. read_barrier_depends is not sufficient to ensure
> loads following it are not speculatively loaded out of order
> by the CPU, which can result in stale data being loaded, causing
> potential system crashes.
> 
> Cc: stable<stable@vger.kernel.org>
> Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
> ---
>  drivers/net/ethernet/intel/igb/igb_main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Tested-by: Aaron Brown <aaron.f.brown@intel.com>

[PATCH v2 6/7] fm10k: Use smp_rmb rather than read_barrier_depends

[Brian King]

The original issue being fixed in this patch was seen with the ixgbe
driver, but the same issue exists with fm10k as well, as the code is
very similar. read_barrier_depends is not sufficient to ensure
loads following it are not speculatively loaded out of order
by the CPU, which can result in stale data being loaded, causing
potential system crashes.

Cc: stable<stable@vger.kernel.org>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
---
 drivers/net/ethernet/intel/fm10k/fm10k_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_main.c b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
index 9dffaba..103c0a7 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_main.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_main.c
@@ -1229,7 +1229,7 @@ static bool fm10k_clean_tx_irq(struct fm10k_q_vector *q_vector,
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		/* if DD is not set pending work has not been completed */
 		if (!(eop_desc->flags & FM10K_TXD_FLAG_DONE))
-- 
1.8.3.1

Re: [PATCH v2 6/7] fm10k: Use smp_rmb rather than read_barrier_depends

[Jesse Brandeburg]

On Fri, 17 Nov 2017 11:05:48 -0600
Brian King <brking@linux.vnet.ibm.com> wrote:

> The original issue being fixed in this patch was seen with the ixgbe
> driver, but the same issue exists with fm10k as well, as the code is
> very similar. read_barrier_depends is not sufficient to ensure
> loads following it are not speculatively loaded out of order
> by the CPU, which can result in stale data being loaded, causing
> potential system crashes.

Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>

[PATCH v2 7/7] i40evf: Use smp_rmb rather than read_barrier_depends

[Brian King]

The original issue being fixed in this patch was seen with the ixgbe
driver, but the same issue exists with i40evf as well, as the code is
very similar. read_barrier_depends is not sufficient to ensure
loads following it are not speculatively loaded out of order
by the CPU, which can result in stale data being loaded, causing
potential system crashes.

Cc: stable<stable@vger.kernel.org>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
---
 drivers/net/ethernet/intel/i40evf/i40e_txrx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
index c32c624..07a4e6e 100644
--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c
@@ -179,7 +179,7 @@ static bool i40e_clean_tx_irq(struct i40e_vsi *vsi,
 			break;
 
 		/* prevent any other reads prior to eop_desc */
-		read_barrier_depends();
+		smp_rmb();
 
 		i40e_trace(clean_tx_irq, tx_ring, tx_desc, tx_buf);
 		/* if the descriptor isn't done, no work yet to do */
-- 
1.8.3.1

Re: [PATCH v2 7/7] i40evf: Use smp_rmb rather than read_barrier_depends

[Jesse Brandeburg]

On Fri, 17 Nov 2017 11:05:49 -0600
Brian King <brking@linux.vnet.ibm.com> wrote:

> The original issue being fixed in this patch was seen with the ixgbe
> driver, but the same issue exists with i40evf as well, as the code is
> very similar. read_barrier_depends is not sufficient to ensure
> loads following it are not speculatively loaded out of order
> by the CPU, which can result in stale data being loaded, causing
> potential system crashes.

Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>