Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 655296c8 authored by Michael Kelley's avatar Michael Kelley Committed by Greg Kroah-Hartman
Browse files

Drivers: hv: vmbus: Fix ring buffer signaling 



Fix bugs in signaling the Hyper-V host when freeing space in the
host->guest ring buffer:

1. The interrupt_mask must not be used to determine whether to signal
   on the host->guest ring buffer
2. The ring buffer write_index must be read (via hv_get_bytes_to_write)
   *after* pending_send_sz is read in order to avoid a race condition
3. Comparisons with pending_send_sz must treat the "equals" case as
   not-enough-space
4. Don't signal if the pending_send_sz feature is not present. Older
   versions of Hyper-V that don't implement this feature will poll.

Fixes: 03bad714 ("vmbus: more host signalling avoidance")

Cc: Stable <stable@vger.kernel.org> # 4.14 and above
Signed-off-by: default avatarMichael Kelley <mhkelley@outlook.com>
Signed-off-by: default avatarK. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 661e50bc

drivers/hv/ring_buffer.c

+35 −17
Original line number Diff line number Diff line
@@ -417,13 +417,24 @@ __hv_pkt_iter_next(struct vmbus_channel *channel, 
}

EXPORT_SYMBOL_GPL(__hv_pkt_iter_next);



/* How many bytes were read in this iterator cycle */

static u32 hv_pkt_iter_bytes_read(const struct hv_ring_buffer_info *rbi,

					u32 start_read_index)

{

	if (rbi->priv_read_index >= start_read_index)

		return rbi->priv_read_index - start_read_index;

	else

		return rbi->ring_datasize - start_read_index +

			rbi->priv_read_index;

}



/*

 * Update host ring buffer after iterating over packets.

 */

void hv_pkt_iter_close(struct vmbus_channel *channel)

{

	struct hv_ring_buffer_info *rbi = &channel->inbound;

	u32 orig_write_sz = hv_get_bytes_to_write(rbi);

	u32 curr_write_sz, pending_sz, bytes_read, start_read_index;



	/*

	 * Make sure all reads are done before we update the read index since
@@ -431,8 +442,12 @@ void hv_pkt_iter_close(struct vmbus_channel *channel) 
	 * is updated.

	 */

	virt_rmb();

	start_read_index = rbi->ring_buffer->read_index;

	rbi->ring_buffer->read_index = rbi->priv_read_index;



	if (!rbi->ring_buffer->feature_bits.feat_pending_send_sz)

		return;



	/*

	 * Issue a full memory barrier before making the signaling decision.

	 * Here is the reason for having this barrier:
@@ -446,26 +461,29 @@ void hv_pkt_iter_close(struct vmbus_channel *channel) 
	 */

	virt_mb();



	/* If host has disabled notifications then skip */

	if (rbi->ring_buffer->interrupt_mask)

	pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);

	if (!pending_sz)

		return;



	if (rbi->ring_buffer->feature_bits.feat_pending_send_sz) {

		u32 pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz);

	/*

	 * Ensure the read of write_index in hv_get_bytes_to_write()

	 * happens after the read of pending_send_sz.

	 */

	virt_rmb();

	curr_write_sz = hv_get_bytes_to_write(rbi);

	bytes_read = hv_pkt_iter_bytes_read(rbi, start_read_index);



	/*

	 * If there was space before we began iteration,

		 * then host was not blocked. Also handles case where

		 * pending_sz is zero then host has nothing pending

		 * and does not need to be signaled.

	 * then host was not blocked.

	 */

		if (orig_write_sz > pending_sz)



	if (curr_write_sz - bytes_read > pending_sz)

		return;



	/* If pending write will not fit, don't give false hope. */

		if (hv_get_bytes_to_write(rbi) < pending_sz)

	if (curr_write_sz <= pending_sz)

		return;

	}



	vmbus_setevent(channel);

}