Patch "platform/mellanox: mlxbf-tmfifo: Fix a memory barrier issue" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    platform/mellanox: mlxbf-tmfifo: Fix a memory barrier issue

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     platform-mellanox-mlxbf-tmfifo-fix-a-memory-barrier-.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 73b68f79acd38141cc5d31d2c786ed9b2f720427
Author: Liming Sun <limings@xxxxxxxxxx>
Date:   Fri May 7 20:30:12 2021 -0400

    platform/mellanox: mlxbf-tmfifo: Fix a memory barrier issue
    
    [ Upstream commit 1c0e5701c5e792c090aef0e5b9b8923c334d9324 ]
    
    The virtio framework uses wmb() when updating avail->idx. It
    guarantees the write order, but not necessarily loading order
    for the code accessing the memory. This commit adds a load barrier
    after reading the avail->idx to make sure all the data in the
    descriptor is visible. It also adds a barrier when returning the
    packet to virtio framework to make sure read/writes are visible to
    the virtio code.
    
    Fixes: 1357dfd7261f ("platform/mellanox: Add TmFifo driver for Mellanox BlueField Soc")
    Signed-off-by: Liming Sun <limings@xxxxxxxxxx>
    Reviewed-by: Vadim Pasternak <vadimp@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/1620433812-17911-1-git-send-email-limings@xxxxxxxxxx
    Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c
index 5739a9669b29..92bda873d44a 100644
--- a/drivers/platform/mellanox/mlxbf-tmfifo.c
+++ b/drivers/platform/mellanox/mlxbf-tmfifo.c
@@ -294,6 +294,9 @@ mlxbf_tmfifo_get_next_desc(struct mlxbf_tmfifo_vring *vring)
 	if (vring->next_avail == virtio16_to_cpu(vdev, vr->avail->idx))
 		return NULL;
 
+	/* Make sure 'avail->idx' is visible already. */
+	virtio_rmb(false);
+
 	idx = vring->next_avail % vr->num;
 	head = virtio16_to_cpu(vdev, vr->avail->ring[idx]);
 	if (WARN_ON(head >= vr->num))
@@ -322,7 +325,7 @@ static void mlxbf_tmfifo_release_desc(struct mlxbf_tmfifo_vring *vring,
 	 * done or not. Add a memory barrier here to make sure the update above
 	 * completes before updating the idx.
 	 */
-	mb();
+	virtio_mb(false);
 	vr->used->idx = cpu_to_virtio16(vdev, vr_idx + 1);
 }
 
@@ -730,6 +733,12 @@ static bool mlxbf_tmfifo_rxtx_one_desc(struct mlxbf_tmfifo_vring *vring,
 		desc = NULL;
 		fifo->vring[is_rx] = NULL;
 
+		/*
+		 * Make sure the load/store are in order before
+		 * returning back to virtio.
+		 */
+		virtio_mb(false);
+
 		/* Notify upper layer that packet is done. */
 		spin_lock_irqsave(&fifo->spin_lock[is_rx], flags);
 		vring_interrupt(0, vring->vq);