Merge tag 'char-misc-4.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull hyperv fix from Greg KH:
 "This is a single hyperv bugfix for 4.16-rc7.

  It resolves an issue with the ring-buffer signaling to resolve
  reported problems.

  It's been in linux-next for a while now with no reported issues"

* tag 'char-misc-4.16-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  Drivers: hv: vmbus: Fix ring buffer signaling

1 files changed, 35 insertions, 17 deletions

diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index 50e071444a5c..8699bb969e7e 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -417,13 +417,24 @@ __hv_pkt_iter_next(struct vmbus_channel *channel,
 }
 EXPORT_SYMBOL_GPL(__hv_pkt_iter_next);
 
+/* How many bytes were read in this iterator cycle */
+static u32 hv_pkt_iter_bytes_read(const struct hv_ring_buffer_info *rbi,
+                                        u32 start_read_index)
+{
+        if (rbi->priv_read_index >= start_read_index)
+                return rbi->priv_read_index - start_read_index;
+        else
+                return rbi->ring_datasize - start_read_index +
+                        rbi->priv_read_index;
+}
+
 /*
  * Update host ring buffer after iterating over packets.
  */
 void hv_pkt_iter_close(struct vmbus_channel *channel)
 {
         struct hv_ring_buffer_info *rbi = &channel->inbound;
-        u32 orig_write_sz = hv_get_bytes_to_write(rbi);
+        u32 curr_write_sz, pending_sz, bytes_read, start_read_index;
 
         /*
          * Make sure all reads are done before we update the read index since
@@ -431,8 +442,12 @@ void hv_pkt_iter_close(struct vmbus_channel *channel)
          * is updated.
          */
         virt_rmb();
+        start_read_index = rbi->ring_buffer->read_index;
         rbi->ring_buffer->read_index = rbi->priv_read_index;
 
+        if (!rbi->ring_buffer->feature_bits.feat_pending_send_sz)
+                return;
+
         /*
          * Issue a full memory barrier before making the signaling decision.
          * Here is the reason for having this barrier:
@@ -446,26 +461,29 @@ void hv_pkt_iter_close(struct vmbus_channel *channel)
          */
         virt_mb();
 
-        /* If host has disabled notifications then skip */
-        if (rbi->ring_buffer->interrupt_mask)
+        pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);
+        if (!pending_sz)
                 return;
 
-        if (rbi->ring_buffer->feature_bits.feat_pending_send_sz) {
-                u32 pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);
+        /*
+         * Ensure the read of write_index in hv_get_bytes_to_write()
+         * happens after the read of pending_send_sz.
+         */
+        virt_rmb();
+        curr_write_sz = hv_get_bytes_to_write(rbi);
+        bytes_read = hv_pkt_iter_bytes_read(rbi, start_read_index);
 
-                /*
-                 * If there was space before we began iteration,
-                 * then host was not blocked. Also handles case where
-                 * pending_sz is zero then host has nothing pending
-                 * and does not need to be signaled.
-                 */
-                if (orig_write_sz > pending_sz)
-                        return;
+        /*
+         * If there was space before we began iteration,
+         * then host was not blocked.
+         */
 
-                /* If pending write will not fit, don't give false hope. */
-                if (hv_get_bytes_to_write(rbi) < pending_sz)
-                        return;
-        }
+        if (curr_write_sz - bytes_read > pending_sz)
+                return;
+
+        /* If pending write will not fit, don't give false hope. */
+        if (curr_write_sz <= pending_sz)
+                return;
 
         vmbus_setevent(channel);
 }