[PATCH 2/9] scsi: ufs: core: Defer link recovery on reserved PM command timeout

[Stanley Jhu <stanleyjhu@google.com>]

When a device management command sent by a PM callback times out,
ufshcd_eh_timed_out() runs ufshcd_link_recovery() inline:

1. The PM callback holds hba->dev_cmd.lock, a read lock on
   hba->clk_scaling_lock, and the only reserved tag while it waits
   for the command.
2. The command times out and ufshcd_eh_timed_out() resets the host.
3. The reset runs ufshcd_verify_dev_init(), which needs the same tag
   and lock, so host init fails with -ENOMEM in SDB mode and
   deadlocks on hba->dev_cmd.lock in MCQ mode.

Instead, stop the host controller, schedule the error handler and
complete the command with DID_TIME_OUT, so the PM callback releases
the tag and locks before recovery runs.

The remaining tail of ufshcd_eh_timed_out() then only handles SCSI
commands, so drop the reserved command branch there.

Fixes: 01d5e237b339 ("scsi: ufs: core: Handle PM commands timeout before SCSI EH")
Cc: stable@vger.kernel.org # 7.3.x: cd37a69c367b: scsi: ufs: core: Remove an always-false WARN_ONCE()
Cc: stable@vger.kernel.org # 7.3.x: 22d14117ec18: scsi: ufs: core: Add a helper for clearing hba->outstanding_reqs
Cc: stable@vger.kernel.org # 7.3.x: 3a7e551ae4bc: scsi: ufs: core: Fix double release in ufshcd_eh_timed_out()
Cc: stable@vger.kernel.org # 7.3.x
Signed-off-by: Stanley Jhu <stanleyjhu@google.com>
---
 drivers/ufs/core/ufshcd.c | 60 +++++++++++++++++++++++++++++++++------
 1 file changed, 52 insertions(+), 8 deletions(-)

diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index e9dcab35a4cd..6a5f5fa732d9 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -7147,7 +7147,7 @@ static void ufshcd_err_handler(struct work_struct *work)
 	spin_unlock_irqrestore(&hba->host->host_lock, flags);
 
 	/* Complete requests that have door-bell cleared by h/w */
-	if (!stop)
+	if (!stop && ufshcd_is_hba_active(hba))
 		ufshcd_complete_requests(hba, false);
 	spin_lock_irqsave(&hba->host->host_lock, flags);
 again:
@@ -9689,6 +9689,50 @@ static void ufshcd_async_scan(void *data, async_cookie_t cookie)
 		dev_err(hba->dev, "%s failed: %d\n", __func__, ret);
 }
 
+/*
+ * Claim @scmd before stopping the HBA in case normal completion raced with
+ * scsi_timeout(), then complete @scmd so the PM caller releases
+ * hba->dev_cmd.lock and the reserved tag before error recovery runs.
+ */
+static void ufshcd_eh_pm_cmd_timed_out(struct ufs_hba *hba,
+				       struct scsi_cmnd *scmd)
+{
+	struct request *rq = scsi_cmd_to_rq(scmd);
+	struct ufs_hw_queue *hwq;
+
+	if (!hba->mcq_enabled) {
+		if (!ufshcd_clear_outstanding_reqs(hba, BIT(rq->tag)))
+			return;
+		ufshcd_hba_stop(hba);
+		ufshcd_force_error_recovery(hba);
+		set_host_byte(scmd, DID_TIME_OUT);
+		scsi_done(scmd);
+		return;
+	}
+
+	hwq = ufshcd_mcq_req_to_hwq(hba, rq);
+	if (ufshcd_is_hba_active(hba))
+		ufshcd_mcq_poll_cqe_lock(hba, hwq);
+	scoped_guard(spinlock_irqsave, &hwq->cq_lock) {
+		if (test_bit(SCMD_STATE_COMPLETE, &scmd->state))
+			return;
+	}
+	spin_lock_irq(&hba->host->host_lock);
+	hba->force_reset = true;
+	if (hba->ufshcd_state != UFSHCD_STATE_ERROR)
+		hba->ufshcd_state = UFSHCD_STATE_EH_SCHEDULED_FATAL;
+	spin_unlock_irq(&hba->host->host_lock);
+	ufshcd_hba_stop(hba);
+	ufshcd_mcq_compl_all_cqes_lock(hba, hwq);
+	ufshcd_force_error_recovery(hba);
+	scoped_guard(spinlock_irqsave, &hwq->cq_lock) {
+		if (!test_bit(SCMD_STATE_COMPLETE, &scmd->state)) {
+			set_host_byte(scmd, DID_TIME_OUT);
+			scsi_done(scmd);
+		}
+	}
+}
+
 static enum scsi_timeout_action ufshcd_eh_timed_out(struct scsi_cmnd *scmd)
 {
 	struct ufs_hba *hba = shost_priv(scmd->device->host);
@@ -9698,6 +9742,11 @@ static enum scsi_timeout_action ufshcd_eh_timed_out(struct scsi_cmnd *scmd)
 		return SCSI_EH_NOT_HANDLED;
 	}
 
+	if (!ufshcd_is_scsi_cmd(scmd)) {
+		ufshcd_eh_pm_cmd_timed_out(hba, scmd);
+		return SCSI_EH_DONE;
+	}
+
 	/*
 	 * Handle the timeout directly to prevent a deadlock between
 	 * ufshcd_set_dev_pwr_mode() and ufshcd_err_handler().
@@ -9718,13 +9767,8 @@ static enum scsi_timeout_action ufshcd_eh_timed_out(struct scsi_cmnd *scmd)
 				return SCSI_EH_DONE;
 		}
 
-		if (ufshcd_is_scsi_cmd(scmd)) {
-			set_host_byte(scmd, DID_REQUEUE);
-			ufshcd_release_scsi_cmd(hba, scmd);
-		} else {
-			set_host_byte(scmd, DID_TIME_OUT);
-		}
-
+		set_host_byte(scmd, DID_REQUEUE);
+		ufshcd_release_scsi_cmd(hba, scmd);
 		scsi_done(scmd);
 	}
 
-- 
2.56.0.567.gdb80ae8cd5-goog