aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net/e1000e/netdev.c
diff options
context:
space:
mode:
authorJeff Kirsher <jeffrey.t.kirsher@intel.com>2010-08-08 12:02:31 -0400
committerDavid S. Miller <davem@davemloft.net>2010-08-08 23:02:45 -0400
commit2d0bb1c1f4524befe9f0fcf0d0cd3081a451223f (patch)
tree16abb34e4f852ac6c4101ef9e46940c3bcd5937f /drivers/net/e1000e/netdev.c
parent4bc091d85f979a1a18ef2d710b819b3c5b397707 (diff)
e100/e1000*/igb*/ixgb*: Add missing read memory barrier
Based on patches from Sonny Rao and Milton Miller... Combined the patches to fix up clean_tx_irq and clean_rx_irq. The PowerPC architecture does not require loads to independent bytes to be ordered without adding an explicit barrier. In ixgbe_clean_rx_irq we load the status bit then load the packet data. With packet split disabled if these loads go out of order we get a stale packet, but we will notice the bad sequence numbers and drop it. The problem occurs with packet split enabled where the TCP/IP header and data are in different descriptors. If the reads go out of order we may have data that doesn't match the TCP/IP header. Since we use hardware checksumming this bad data is never verified and it makes it all the way to the application. This bug was found during stress testing and adding this barrier has been shown to fix it. The bug can manifest as a data integrity issue (bad payload data) or as a BUG in skb_pull(). This was a nasty bug to hunt down, if people agree with the fix I think it's a candidate for stable. Previously Submitted to e1000-devel only for ixgbe http://marc.info/?l=e1000-devel&m=126593062701537&w=3 We've now seen this problem hit with other device drivers (e1000e mostly) So I'm resubmitting with fixes for other Intel Device Drivers with similar issues. CC: Milton Miller <miltonm@bga.com> CC: Anton Blanchard <anton@samba.org> CC: Sonny Rao <sonnyrao@us.ibm.com> CC: stable <stable@kernel.org> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/e1000e/netdev.c')
-rw-r--r--drivers/net/e1000e/netdev.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 36d31a416320..c3dd590d87b2 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -781,6 +781,7 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
781 if (*work_done >= work_to_do) 781 if (*work_done >= work_to_do)
782 break; 782 break;
783 (*work_done)++; 783 (*work_done)++;
784 rmb(); /* read descriptor and rx_buffer_info after status DD */
784 785
785 status = rx_desc->status; 786 status = rx_desc->status;
786 skb = buffer_info->skb; 787 skb = buffer_info->skb;
@@ -991,6 +992,7 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter)
991 while ((eop_desc->upper.data & cpu_to_le32(E1000_TXD_STAT_DD)) && 992 while ((eop_desc->upper.data & cpu_to_le32(E1000_TXD_STAT_DD)) &&
992 (count < tx_ring->count)) { 993 (count < tx_ring->count)) {
993 bool cleaned = false; 994 bool cleaned = false;
995 rmb(); /* read buffer_info after eop_desc */
994 for (; !cleaned; count++) { 996 for (; !cleaned; count++) {
995 tx_desc = E1000_TX_DESC(*tx_ring, i); 997 tx_desc = E1000_TX_DESC(*tx_ring, i);
996 buffer_info = &tx_ring->buffer_info[i]; 998 buffer_info = &tx_ring->buffer_info[i];
@@ -1087,6 +1089,7 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
1087 break; 1089 break;
1088 (*work_done)++; 1090 (*work_done)++;
1089 skb = buffer_info->skb; 1091 skb = buffer_info->skb;
1092 rmb(); /* read descriptor and rx_buffer_info after status DD */
1090 1093
1091 /* in the packet split case this is header only */ 1094 /* in the packet split case this is header only */
1092 prefetch(skb->data - NET_IP_ALIGN); 1095 prefetch(skb->data - NET_IP_ALIGN);
@@ -1286,6 +1289,7 @@ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
1286 if (*work_done >= work_to_do) 1289 if (*work_done >= work_to_do)
1287 break; 1290 break;
1288 (*work_done)++; 1291 (*work_done)++;
1292 rmb(); /* read descriptor and rx_buffer_info after status DD */
1289 1293
1290 status = rx_desc->status; 1294 status = rx_desc->status;
1291 skb = buffer_info->skb; 1295 skb = buffer_info->skb;