deadlock during HCI error handling

[222야옹이]

Hi all,
I found deadlock during HCI error handling.
Please see blow sequences.


static void ufshcd_err_handler(struct work_struct *work)
{
spin_lock_irqsave(hba->host->host_lock, flags);
if (hba->ufshcd_state == UFSHCD_STATE_RESET)
goto out;


hba->ufshcd_state = UFSHCD_STATE_RESET;
ufshcd_set_eh_in_progress(hba);
ufshcd_complete_requests(hba);

if (hba->dev_quirks & UFS_DEVICE_QUIRK_RECOVERY_FROM_DL_NAC_ERRORS) {
bool ret;

spin_unlock_irqrestore(hba->host->host_lock, flags);
ret = ufshcd_quirk_dl_nac_errors(hba); // If your board has this quirk, do this function.

spin_lock_irqsave(hba->host->host_lock, flags);
if (!ret)
goto skip_err_handling;
}
...
}

// After that, function flow like this
ufshcd_quirk_dl_nac_errors -> ufshcd_verify_dev_init -> ufshcd_exex_dev_cmd


static int ufshcd_exec_dev_cmd(struct ufs_hba *hba, enum dev_cmd_type cmd_type, int timeout)
{
struct ufshcd_lrb *lrbp;
int err;
int tag;
struct completion wait;
unsigned long flags;

down_read(&hba->clk_scaling_lock);

wait_event(hba->dev_cmd.tag_wq, ufshcd_get_dev_cmd_tag(hba, &tag)); // If you have no free slot, wait definitely
...
}

// After SCSI CMD timeout, timeout handler starts for other commands
// function flow like below
ufshcd_abort -> ufshcd_issue_tm_cmd timeout -> ufs reset routine

static int ufshcd_eh_host_reset_handler(struct scsi_cmnd *cmd)
{
hba = shost_priv(cmd->device->host);

ufshcd_hold(hba, false);

do {
spin_lock_irqsave(hba->host->host_lock, flags);
if (!(work_pending(&hba->eh_work) ||
hba->ufshcd_state == UFSHCD_STATE_RESET ||
hba->ufshcd_state == UFSHCD_STATE_EH_SCHEDULED))
break;

spin_unlock_irqrestore(hba->host->host_lock, flags);
dev_dbg(hba->dev, "%s: reset in progress\n", __func__);
flush_work(&hba->eh_work); //wait ufshcd_err_handler. deadlock!!
} while (1);
...
}

You can generate this scenario
1. enable UFS_DEVICE_QUIRK_RECOVERY_FROM_DL_NAC_ERRORS quirk
2. iozone + HCI error (echo 1 > /sys/kernel/debug/ufs/monitor)

Thanks.