Commit ac1bc2ba authored by Bart Van Assche's avatar Bart Van Assche Committed by Martin K. Petersen
Browse files

scsi: ufs: Request sense data asynchronously 

Clearing a unit attention synchronously from inside the UFS error handler
may trigger the following deadlock:

 - ufshcd_err_handler() calls ufshcd_err_handling_unprepare() and the
   latter function calls ufshcd_clear_ua_wluns().

 - ufshcd_clear_ua_wluns() submits a REQUEST SENSE command and that command
   activates the SCSI error handler.

 - The SCSI error handler calls ufshcd_host_reset_and_restore().

 - ufshcd_host_reset_and_restore() executes the following code:
   ufshcd_schedule_eh_work(hba); flush_work(&hba->eh_work);

This sequence results in a deadlock (circular wait). Fix this by requesting
sense data asynchronously.

Link: https://lore.kernel.org/r/20210722033439.26550-16-bvanassche@acm.org


Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Stanley Chu <stanley.chu@mediatek.com>
Cc: Can Guo <cang@codeaurora.org>
Cc: Asutosh Das <asutoshd@codeaurora.org>
Cc: Avri Altman <avri.altman@wdc.com>
Reviewed-by: default avatarBean Huo <beanhuo@micron.com>
Signed-off-by: default avatarBart Van Assche <bvanassche@acm.org>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 64180742

drivers/scsi/ufs/ufshcd.c

+33 −31
Original line number Diff line number Diff line
@@ -7880,8 +7880,39 @@ static int ufshcd_add_lus(struct ufs_hba *hba) 
	return ret;

}



static void ufshcd_request_sense_done(struct request *rq, blk_status_t error)

{

	if (error != BLK_STS_OK)

		pr_err("%s: REQUEST SENSE failed (%d)", __func__, error);

	blk_put_request(rq);

}



static int

ufshcd_send_request_sense(struct ufs_hba *hba, struct scsi_device *sdp);

ufshcd_request_sense_async(struct ufs_hba *hba, struct scsi_device *sdev)

{

	/*

	 * From SPC-6: the REQUEST SENSE command with any allocation length

	 * clears the sense data.

	 */

	static const u8 cmd[6] = {REQUEST_SENSE, 0, 0, 0, 0, 0};

	struct scsi_request *rq;

	struct request *req;



	req = blk_get_request(sdev->request_queue, REQ_OP_DRV_IN, /*flags=*/0);

	if (IS_ERR(req))

		return PTR_ERR(req);



	rq = scsi_req(req);

	rq->cmd_len = ARRAY_SIZE(cmd);

	memcpy(rq->cmd, cmd, rq->cmd_len);

	rq->retries = 3;

	req->timeout = 1 * HZ;

	req->rq_flags |= RQF_PM | RQF_QUIET;



	blk_execute_rq_nowait(/*bd_disk=*/NULL, req, /*at_head=*/true,

			      ufshcd_request_sense_done);

	return 0;

}



static int ufshcd_clear_ua_wlun(struct ufs_hba *hba, u8 wlun)

{
@@ -7909,7 +7940,7 @@ static int ufshcd_clear_ua_wlun(struct ufs_hba *hba, u8 wlun) 
	if (ret)

		goto out_err;



	ret = ufshcd_send_request_sense(hba, sdp);

	ret = ufshcd_request_sense_async(hba, sdp);

	scsi_device_put(sdp);

out_err:

	if (ret)
@@ -8509,35 +8540,6 @@ static void ufshcd_hba_exit(struct ufs_hba *hba) 
	}

}



static int

ufshcd_send_request_sense(struct ufs_hba *hba, struct scsi_device *sdp)

{

	unsigned char cmd[6] = {REQUEST_SENSE,

				0,

				0,

				0,

				UFS_SENSE_SIZE,

				0};

	char *buffer;

	int ret;



	buffer = kzalloc(UFS_SENSE_SIZE, GFP_KERNEL);

	if (!buffer) {

		ret = -ENOMEM;

		goto out;

	}



	ret = scsi_execute(sdp, cmd, DMA_FROM_DEVICE, buffer,

			UFS_SENSE_SIZE, NULL, NULL,

			msecs_to_jiffies(1000), 3, 0, RQF_PM, NULL);

	if (ret)

		pr_err("%s: failed with err %d\n", __func__, ret);



	kfree(buffer);

out:

	return ret;

}



/**

 * ufshcd_set_dev_pwr_mode - sends START STOP UNIT command to set device

 *			     power mode