From 60501277b7856751b64938fca88d74195ca9b7f5 Mon Sep 17 00:00:00 2001
From: Taylor R Campbell <riastradh@NetBSD.org>
Date: Fri, 7 Apr 2023 08:03:14 +0000
Subject: [PATCH] xhci(4): Defer root intr xfers while polling.

Root intr xfers require taking adaptive locks, which is forbidden
while polling.

This is not great -- any USB transfer completion callbacks might try
to take adaptive locks, not just uhub_intr, and that will always
causes trouble.  We get lucky with ukbd_intr because it's not
MP-safe, so it relies only on the kernel lock (a spin lock) anyway.
But this change brings xhci in line with ehci.

PR kern/57326

XXX pullup-8
XXX pullup-9
XXX pullup-10
---
 sys/dev/usb/xhci.c    | 24 +++++++++++++++++++++---
 sys/dev/usb/xhcivar.h |  2 +-
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/sys/dev/usb/xhci.c b/sys/dev/usb/xhci.c
index 9ca0748172cc..46a139e64220 100644
--- a/sys/dev/usb/xhci.c
+++ b/sys/dev/usb/xhci.c
@@ -2351,11 +2351,15 @@ xhci_rhpsc(struct xhci_softc * const sc, u_int ctlrport)
 	KASSERT(xfer->ux_status == USBD_IN_PROGRESS);
 
 	uint8_t *p = xfer->ux_buf;
-	memset(p, 0, xfer->ux_length);
+	if (!xhci_polling_p(sc) || !sc->sc_intrxfer_deferred[bn])
+		memset(p, 0, xfer->ux_length);
 	p[rhp / NBBY] |= 1 << (rhp % NBBY);
 	xfer->ux_actlen = xfer->ux_length;
 	xfer->ux_status = USBD_NORMAL_COMPLETION;
-	usb_transfer_complete(xfer);
+	if (xhci_polling_p(sc))
+		sc->sc_intrxfer_deferred[bn] = true;
+	else
+		usb_transfer_complete(xfer);
 }
 
 /* Process Transfer Events */
@@ -2619,7 +2623,7 @@ xhci_softintr(void *v)
 	struct xhci_softc * const sc = XHCI_BUS2SC(bus);
 	struct xhci_ring * const er = sc->sc_er;
 	struct xhci_trb *trb;
-	int i, j, k;
+	int i, j, k, bn;
 
 	XHCIHIST_FUNC();
 
@@ -2630,6 +2634,20 @@ xhci_softintr(void *v)
 
 	XHCIHIST_CALLARGS("er: xr_ep %jd xr_cs %jd", i, j, 0, 0);
 
+	/*
+	 * Handle deferred root intr xfer, in case we just switched off
+	 * polling.  It's not safe to complete root intr xfers while
+	 * polling -- too much kernel machinery gets involved.
+	 */
+	if (!xhci_polling_p(sc)) {
+		for (bn = 0; bn < 2; bn++) {
+			if (__predict_false(sc->sc_intrxfer_deferred[bn])) {
+				sc->sc_intrxfer_deferred[bn] = false;
+				usb_transfer_complete(sc->sc_intrxfer[bn]);
+			}
+		}
+	}
+
 	while (1) {
 		usb_syncmem(&er->xr_dma, XHCI_TRB_SIZE * i, XHCI_TRB_SIZE,
 		    BUS_DMASYNC_POSTREAD);
diff --git a/sys/dev/usb/xhcivar.h b/sys/dev/usb/xhcivar.h
index 20ae54059332..6ade708bc178 100644
--- a/sys/dev/usb/xhcivar.h
+++ b/sys/dev/usb/xhcivar.h
@@ -121,7 +121,7 @@ struct xhci_softc {
 	int *sc_rhportmap[2];
 	int sc_rhportcount[2];
 	struct usbd_xfer *sc_intrxfer[2];
-
+	bool sc_intrxfer_deferred[2];
 
 	struct xhci_slot * sc_slots;