[PATCH] usb: chipidea: stop asynchronous work before destroying roles

[PATCH] usb: chipidea: stop asynchronous work before destroying roles

[Xu Yang]

From: Xu Yang <xu.yang_2@nxp.com>

Role teardown currently removes the gadget and host roles while OTG
interrupts, FSM processing and work items may still be active. Such
asynchronous processing can queue or execute role-switch operations
against partially destroyed roles. In particular, a gadget instance
may remain registered after the controller has been removed.

Disable power_lost_work before starting role teardown. During OTG
destruction, disable the IRQ and ci->work, clear canceled ID and
B-session-valid events, and remove the OTG FSM before destroying the
workqueue.

Finally, destroy the gadget and host roles only after the OTG machinery
has been stopped. This establishes a teardown order in which event
sources are quiesced before their target resources are released.

Fixes: cbec6bd55a45 ("usb: chipidea: move otg related things to otg file")
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
---
 drivers/usb/chipidea/core.c |  5 +++--
 drivers/usb/chipidea/otg.c  | 17 +++++++++++++----
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 3461dd763a6e..eb7b9c0746d8 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -942,10 +942,11 @@ EXPORT_SYMBOL_GPL(ci_hdrc_query_available_role);
 
 static inline void ci_role_destroy(struct ci_hdrc *ci)
 {
-	ci_hdrc_gadget_destroy(ci);
-	ci_hdrc_host_destroy(ci);
+	disable_work_sync(&ci->power_lost_work);
 	if (ci->is_otg && ci->roles[CI_ROLE_GADGET])
 		ci_hdrc_otg_destroy(ci);
+	ci_hdrc_gadget_destroy(ci);
+	ci_hdrc_host_destroy(ci);
 }
 
 static void ci_get_otg_capable(struct ci_hdrc *ci)
diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c
index 89a6a37815f0..8ac8969a45f0 100644
--- a/drivers/usb/chipidea/otg.c
+++ b/drivers/usb/chipidea/otg.c
@@ -272,12 +272,21 @@ int ci_hdrc_otg_init(struct ci_hdrc *ci)
  */
 void ci_hdrc_otg_destroy(struct ci_hdrc *ci)
 {
-	if (ci->wq)
-		destroy_workqueue(ci->wq);
+	disable_irq(ci->irq);
+	if (disable_work_sync(&ci->work)) {
+		ci->id_event = false;
+		ci->b_sess_valid_event = false;
+		/* Balance disable_irq_nosync() performed in ci_otg_queue_work() */
+		enable_irq(ci->irq);
+	}
+
+	if (ci_otg_is_fsm_mode(ci))
+		ci_hdrc_otg_fsm_remove(ci);
 
 	/* Disable all OTG irq and clear status */
 	hw_write_otgsc(ci, OTGSC_INT_EN_BITS | OTGSC_INT_STATUS_BITS,
 						OTGSC_INT_STATUS_BITS);
-	if (ci_otg_is_fsm_mode(ci))
-		ci_hdrc_otg_fsm_remove(ci);
+	if (ci->wq)
+		destroy_workqueue(ci->wq);
+	enable_irq(ci->irq);
 }
-- 
2.34.1