[PATCH v3 10/18] PCI: dwc: Free the MSI domain after the host .deinit() callback

[Koichiro Den <den@valinux.co.jp>]

dw_pcie_host_deinit() frees the iMSI-RX domain before calling the host
.deinit() callback. For a core-owned parent interrupt,
dw_pcie_free_msi() removes the chained handler right before the domain.
A glue driver that owns the parent interrupt and demultiplexes the MSIs
itself through dw_handle_msi_irq() can only stop its handler in
.deinit(), after the domain is gone, so a late interrupt can still
dispatch into the freed domain.

Remove the domain after .deinit(), in dw_pcie_host_deinit() and in the
dw_pcie_host_init() unwind. Keep removing the chained handlers of
core-owned interrupts before .deinit(), which powers the controller
down. Clear pp->irq_domain when the domain is removed so the unwind can
tell whether it exists.

Signed-off-by: Koichiro Den <den@valinux.co.jp>
---
Changes in v3:
  - New patch. In v2 the R-Car driver freed its parent IRQ in .deinit(),
    after the core had already removed the iMSI-RX domain. This closes
    the known gap noted under v2 patch 10:
    https://lore.kernel.org/r/20260928165230.3397664-11-den@valinux.co.jp/

 .../pci/controller/dwc/pcie-designware-host.c | 31 ++++++++++++++-----
 1 file changed, 23 insertions(+), 8 deletions(-)

diff --git a/drivers/pci/controller/dwc/pcie-designware-host.c b/drivers/pci/controller/dwc/pcie-designware-host.c
index 63b38532d069..774e1936d999 100644
--- a/drivers/pci/controller/dwc/pcie-designware-host.c
+++ b/drivers/pci/controller/dwc/pcie-designware-host.c
@@ -228,7 +228,7 @@ int dw_pcie_allocate_domains(struct dw_pcie_rp *pp)
 }
 EXPORT_SYMBOL_GPL(dw_pcie_allocate_domains);
 
-void dw_pcie_free_msi(struct dw_pcie_rp *pp)
+static void dw_pcie_remove_msi_handlers(struct dw_pcie_rp *pp)
 {
 	u32 ctrl;
 
@@ -236,8 +236,18 @@ void dw_pcie_free_msi(struct dw_pcie_rp *pp)
 		if (pp->msi_irq[ctrl] > 0)
 			irq_set_chained_handler_and_data(pp->msi_irq[ctrl], NULL, NULL);
 	}
+}
 
+static void dw_pcie_free_msi_domain(struct dw_pcie_rp *pp)
+{
 	irq_domain_remove(pp->irq_domain);
+	pp->irq_domain = NULL;
+}
+
+void dw_pcie_free_msi(struct dw_pcie_rp *pp)
+{
+	dw_pcie_remove_msi_handlers(pp);
+	dw_pcie_free_msi_domain(pp);
 }
 EXPORT_SYMBOL_GPL(dw_pcie_free_msi);
 
@@ -633,7 +643,7 @@ int dw_pcie_host_init(struct dw_pcie_rp *pp)
 
 	ret = of_pci_get_equalization_presets(dev, &pp->presets, pci->num_lanes);
 	if (ret)
-		goto err_free_msi;
+		goto err_deinit_host;
 
 	/*
 	 * Allocate the resource for MSG TLP before programming the iATU
@@ -649,7 +659,7 @@ int dw_pcie_host_init(struct dw_pcie_rp *pp)
 
 	ret = dw_pcie_edma_detect(pci);
 	if (ret)
-		goto err_free_msi;
+		goto err_deinit_host;
 
 	ret = dw_pcie_setup_rc(pp);
 	if (ret)
@@ -686,14 +696,16 @@ int dw_pcie_host_init(struct dw_pcie_rp *pp)
 err_remove_edma:
 	dw_pcie_edma_remove(pci);
 
-err_free_msi:
-	if (pp->use_imsi_rx)
-		dw_pcie_free_msi(pp);
-
 err_deinit_host:
+	if (pp->use_imsi_rx && pp->irq_domain)
+		dw_pcie_remove_msi_handlers(pp);
+
 	if (pp->ops->deinit)
 		pp->ops->deinit(pp);
 
+	if (pp->use_imsi_rx && pp->irq_domain)
+		dw_pcie_free_msi_domain(pp);
+
 err_free_ecam:
 	if (pp->cfg)
 		pci_ecam_free(pp->cfg);
@@ -718,11 +730,14 @@ void dw_pcie_host_deinit(struct dw_pcie_rp *pp)
 	dw_pcie_edma_remove(pci);
 
 	if (pp->use_imsi_rx)
-		dw_pcie_free_msi(pp);
+		dw_pcie_remove_msi_handlers(pp);
 
 	if (pp->ops->deinit)
 		pp->ops->deinit(pp);
 
+	if (pp->use_imsi_rx)
+		dw_pcie_free_msi_domain(pp);
+
 	if (pp->cfg)
 		pci_ecam_free(pp->cfg);
 }
-- 
2.51.0