[PATCH 1/2] xhci: make xhci_handshake() timeout wall-clock based again

[Henry Tseng <henrytseng@qnap.com>]

xhci_abort_cmd_ring() waits for the command ring to stop with
xhci_handshake() and a 5 s timeout. On an AMD Raven USB 3.1 xHCI
(1022:15e0), after a configure endpoint command failed to complete
during device disconnect, that handshake returned -ETIMEDOUT 15.8 s
later:

  [   86.086412] xhci_hcd 0000:0c:00.3: Command timeout, USBSTS: 0x00000010 PCD
  [   86.086450] xhci_hcd 0000:0c:00.3: Abort command ring
  [  101.924383] xhci_hcd 0000:0c:00.3: Abort failed to stop command ring: -110

xhci_abort_cmd_ring() is called from xhci_handle_command_timeout() with
xhci->lock held, so interrupts were disabled on that CPU for the whole
15.8 s.

The timeout budget is no longer tied to elapsed time. xhci_handshake()
originally polled with readl(), udelay(1) and a decrementing
microsecond counter. Commit f7fac17ca925 ("xhci: Convert
xhci_handshake() to use readl_poll_timeout_atomic()") replaced that loop
with readl_poll_timeout_atomic(), which at the time computed its
deadline with ktime_get(). Its commit message notes that this also
fixed a bug on AMD Stoneyridge, where udelay(1) sometimes took over
10 ms and a 5 s timeout ran for over 15 s, triggering the watchdog.
Commit 7349a69cf312 ("iopoll: Do not use timekeeping in
read_poll_timeout_atomic()") then replaced that deadline with a locally
estimated one, which does not account for the readl(), however long it
takes.

To fix this, restore the readl() and udelay() loop, with the
decrementing microsecond counter replaced by a ktime deadline.

Signed-off-by: Henry Tseng <henrytseng@qnap.com>
---
The overrun was measured on v7.3-rc5 by calling xhci_handshake() on
USBSTS bit 5, which is reserved and zeroed, so the poll always runs
to the timeout:

  ret = xhci_handshake(&xhci->op_regs->status, BIT(5), BIT(5),
                       XHCI_RESET_LONG_USEC);

XHCI_RESET_LONG_USEC is 10000000 us. Elapsed time was taken around the call
with ktime_get(). All runs returned -ETIMEDOUT.

  Intel Core 9 273PE, Alder Lake-S PCH USB 3.2 (8086:7ae0)
    unpatched 19121395 us (1.91x)   patched 10000001 us
  Intel Core Ultra 7 155H, Meteor Lake-P USB 3.2 (8086:7e7d)
    unpatched 17161328 us (1.71x)   patched 10000001 us

 drivers/usb/host/xhci.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index a9e47e178c28..8169d30dd40e 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -86,16 +86,20 @@ static bool td_on_ring(struct xhci_td *td, struct xhci_ring *ring)
 int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, u64 timeout_us)
 {
 	u32	result;
-	int	ret;
+	ktime_t deadline = ktime_add_us(ktime_get(), timeout_us);
 
-	ret = readl_poll_timeout_atomic(ptr, result,
-					(result & mask) == done ||
-					result == U32_MAX,
-					1, timeout_us);
-	if (result == U32_MAX)		/* card removed */
-		return -ENODEV;
+	for (;;) {
+		result = readl(ptr);
+		if (result == U32_MAX)			/* card removed */
+			return -ENODEV;
+		if ((result & mask) == done)
+			return 0;
 
-	return ret;
+		if (ktime_compare(ktime_get(), deadline) > 0)
+			return -ETIMEDOUT;
+
+		udelay(1);
+	}
 }
 
 /*
-- 
2.43.0