[PATCH v2] crypto: marvell/octeontx - clean up VF resources when DOWN fails

[Myeonghun Pak <mhun512@gmail.com>]

A failed DOWN mailbox notification makes otx_cptvf_remove() skip all
local cleanup. The driver core still completes unbind and releases the
devm-allocated cptvf, leaving the raw IRQ handlers registered with that
object as their argument. The sysfs group, crypto device-table entry,
software queues and PCI resources also remain uncleaned.

Keep the notification error diagnostic, but run local cleanup regardless
of the PF response. The PF only acknowledges DOWN; it does not disable the
VF queue. Disable the VQ locally and poll its INFLIGHT count for up to one
second before releasing the DMA command queues. Warn if the queue does
not become idle, but continue local teardown. Clear PCI bus mastering
before freeing resources. Remove both IRQ handlers before killing the
tasklet and releasing its resources.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code.

Fixes: 10b4f09491bf ("crypto: marvell - add the Virtual Function driver for CPT")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Changes in v2:
- Disable the local VQ and poll INFLIGHT for up to one second before
  freeing DMA command queues.
- Warn on an idle timeout and continue local cleanup.
- Clear PCI bus mastering before releasing resources.

v1: https://lore.kernel.org/r/20261004042634.1130247-1-mhun512@gmail.com
Review: https://sashiko.dev/#/patchset/20261004042634.1130247-1-mhun512%40gmail.com

 .../crypto/marvell/octeontx/otx_cptvf_main.c  | 44 ++++++++++++-------
 1 file changed, 29 insertions(+), 15 deletions(-)

diff --git a/drivers/crypto/marvell/octeontx/otx_cptvf_main.c b/drivers/crypto/marvell/octeontx/otx_cptvf_main.c
index 159c1d2..047bfc0 100644
--- a/drivers/crypto/marvell/octeontx/otx_cptvf_main.c
+++ b/drivers/crypto/marvell/octeontx/otx_cptvf_main.c
@@ -9,6 +9,7 @@
  */
 
 #include <linux/interrupt.h>
+#include <linux/iopoll.h>
 #include <linux/module.h>
 #include "otx_cptvf.h"
 #include "otx_cptvf_algs.h"
@@ -930,6 +931,8 @@ clear_drvdata:
 static void otx_cptvf_remove(struct pci_dev *pdev)
 {
 	struct otx_cptvf *cptvf = pci_get_drvdata(pdev);
+	union otx_cptx_vqx_inprog vqx_inprog;
+	int ret;
 
 	if (!cptvf) {
 		dev_err(&pdev->dev, "Invalid CPT-VF device\n");
@@ -937,22 +940,33 @@ static void otx_cptvf_remove(struct pci_dev *pdev)
 	}
 
 	/* Convey DOWN to PF */
-	if (otx_cptvf_send_vf_down(cptvf)) {
+	if (otx_cptvf_send_vf_down(cptvf))
 		dev_err(&pdev->dev, "PF not responding to DOWN msg\n");
-	} else {
-		sysfs_remove_group(&pdev->dev.kobj, &otx_cptvf_sysfs_group);
-		otx_cpt_crypto_exit(pdev, THIS_MODULE, cptvf->vftype);
-		cptvf_free_irq_affinity(cptvf, CPT_VF_INT_VEC_E_DONE);
-		cptvf_free_irq_affinity(cptvf, CPT_VF_INT_VEC_E_MISC);
-		free_irq(pci_irq_vector(pdev, CPT_VF_INT_VEC_E_DONE), cptvf);
-		free_irq(pci_irq_vector(pdev, CPT_VF_INT_VEC_E_MISC), cptvf);
-		cptvf_sw_cleanup(cptvf);
-		pci_free_irq_vectors(cptvf->pdev);
-		pci_iounmap(pdev, cptvf->reg_base);
-		pci_release_regions(pdev);
-		pci_disable_device(pdev);
-		pci_set_drvdata(pdev, NULL);
-	}
+
+	sysfs_remove_group(&pdev->dev.kobj, &otx_cptvf_sysfs_group);
+	otx_cpt_crypto_exit(pdev, THIS_MODULE, cptvf->vftype);
+
+	/* Disable the VQ and wait for in-flight instructions to complete. */
+	cptvf_write_vq_ctl(cptvf, 0);
+	ret = readq_poll_timeout(cptvf->reg_base + OTX_CPT_VQX_INPROG(0),
+				 vqx_inprog.u, !vqx_inprog.s.inflight,
+				 10, 1000000);
+	if (ret)
+		dev_warn(&pdev->dev, "Timed out waiting for VQ to become idle\n");
+
+	/* Disable PCI bus mastering before releasing resources. */
+	pci_clear_master(pdev);
+
+	cptvf_free_irq_affinity(cptvf, CPT_VF_INT_VEC_E_DONE);
+	cptvf_free_irq_affinity(cptvf, CPT_VF_INT_VEC_E_MISC);
+	free_irq(pci_irq_vector(pdev, CPT_VF_INT_VEC_E_DONE), cptvf);
+	free_irq(pci_irq_vector(pdev, CPT_VF_INT_VEC_E_MISC), cptvf);
+	cptvf_sw_cleanup(cptvf);
+	pci_free_irq_vectors(cptvf->pdev);
+	pci_iounmap(pdev, cptvf->reg_base);
+	pci_release_regions(pdev);
+	pci_disable_device(pdev);
+	pci_set_drvdata(pdev, NULL);
 }
 
 /* Supported devices */
-- 
2.53.0