From: Michael Kelley <mikelley@microsoft.com>

Fix bugs in signaling the Hyper-V host when freeing space in the
host->guest ring buffer:

1. The interrupt_mask must not be used to determine whether to signal
   on the host->guest ring buffer
2. The ring buffer write_index must be read (via hv_get_bytes_to_write)
   *after* pending_send_sz is read in order to avoid a race condition
3. Comparisons with pending_send_sz must treat the "equals" case as
   not-enough-space
4. Don't signal if the pending_send_sz feature is not present. Older
   versions of Hyper-V that don't implement this feature will poll.

Fixes: 03bad714a161 ("vmbus: more host signalling avoidance")
Signed-off-by: Michael Kelley <mikelley@microsoft.com>
---

This fix should also go to 4.14 stable and 4.15 stable.

---
 drivers/hv/ring_buffer.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index 50e0714..b64be18 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -423,7 +423,11 @@ struct vmpacket_descriptor *
 void hv_pkt_iter_close(struct vmbus_channel *channel)
 {
 =09struct hv_ring_buffer_info *rbi =3D &channel->inbound;
-=09u32 orig_write_sz =3D hv_get_bytes_to_write(rbi);
+=09u32 curr_write_sz;
+=09u32 delta =3D rbi->ring_buffer->read_index < rbi->priv_read_index ?
+=09=09=09(rbi->priv_read_index - rbi->ring_buffer->read_index) :
+=09=09=09(rbi->ring_datasize - rbi->ring_buffer->read_index +
+=09=09=09rbi->priv_read_index);
=20
 =09/*
 =09 * Make sure all reads are done before we update the read index since
@@ -446,27 +450,31 @@ void hv_pkt_iter_close(struct vmbus_channel *channel)
 =09 */
 =09virt_mb();
=20
-=09/* If host has disabled notifications then skip */
-=09if (rbi->ring_buffer->interrupt_mask)
-=09=09return;
-
 =09if (rbi->ring_buffer->feature_bits.feat_pending_send_sz) {
 =09=09u32 pending_sz =3D READ_ONCE(rbi->ring_buffer->pending_send_sz);
=20
 =09=09/*
+=09=09 * Ensure the read of write_index in hv_get_bytes_to_write()
+=09=09 * happens after the read of pending_send_sz.
+=09=09 */
+=09=09virt_rmb();
+=09=09curr_write_sz =3D hv_get_bytes_to_write(rbi);
+
+=09=09/*
 =09=09 * If there was space before we began iteration,
 =09=09 * then host was not blocked. Also handles case where
 =09=09 * pending_sz is zero then host has nothing pending
 =09=09 * and does not need to be signaled.
 =09=09 */
-=09=09if (orig_write_sz > pending_sz)
+=09=09if (curr_write_sz - delta > pending_sz)
 =09=09=09return;
=20
 =09=09/* If pending write will not fit, don't give false hope. */
-=09=09if (hv_get_bytes_to_write(rbi) < pending_sz)
+=09=09if (curr_write_sz <=3D pending_sz)
 =09=09=09return;
+
+=09=09vmbus_setevent(channel);
 =09}
=20
-=09vmbus_setevent(channel);
 }
 EXPORT_SYMBOL_GPL(hv_pkt_iter_close);
--=20
1.8.3.1