From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C0E92C98338 for ; Sun, 27 Sep 2026 22:19:39 +0000 (UTC) Received: from boromir.ozlabs.org (localhost [127.0.0.1]) by lists.ozlabs.org (Postfix) with ESMTP id 4htJl775CPz30TL; Mon, 28 Sep 2026 08:19:31 +1000 (AEST) Authentication-Results: lists.ozlabs.org; arc=none smtp.remote-ip="2a00:1450:4864:31::11" ARC-Seal: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1790533234; cv=none; b=kQYvpQHjGs6aPM7FOI39Y4c+WuMW6hndkVzfZjW5fPebkkCDZJ929AAkmv4zz8n8q5s8tyeSwIrpnXkTD0yMcxZhH1mhFKa5CvDfLeCNIGl5Zbsa8SC+A3Oxa15wb7Aj8jP/tfM+WjGC/iCsm/ajMoNU1+UaeNDyrF5ewXn8Q1p7wKypO6+5obuRLSJB9bzKi/5CIPZQeR3BAOkUKt4yLT/5P/2XGDs/zj1jy3MKJmj77VFLQDkMRZvDq/DbMk9AYSTPBDiCTAqiM4r524Eyl2+XqBxKCnnd+9DlW2WaHLzUaJjbShApdxiN7s+muYj6zyyMQOpmXWe+jS/Av6AGZQ== ARC-Message-Signature: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1790533234; c=relaxed/relaxed; bh=W5PmmKcwKXc/s/p4BcFIaJTS2AL83j8QjzrMDbzKTmQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Aamf5gdL5WFXGLAiW8NGjnCeOMCX8KKWbJw1zal1GPblDGsfQ2wXwHAZbMN3AecLpdRKhP2mUBJbyqNtI1B6CoZ2BUpTKYp0bZMKECQxLf2MSedDcAFjY8+66d+AfJ+IJ/KT5K2MDozKadh/WpbG74Vjgi3S0MpLDG1S0FqlcmAJZoJ5bjH6r6DN9Vb/DFsXvd0C5ErWDE1zZ0DfrbF3xSEtaGXo/RRHJarFipubkMZQHPZy8y3X0ejNmT1xPJeuaNOK/DsHKPX+/BLVhGjTwfiOKN0GfOTNwOP7juQ6S+UsomLCsWwxRyZX5oRXdvG+F44gMdykMboGPhj9F9i8iQ== ARC-Authentication-Results: i=1; lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=O7oWFKDn; dkim-atps=neutral; spf=pass (client-ip=2a00:1450:4864:31::11; helo=mail-wm2-x11.google.com; envelope-from=abhinjoses@gmail.com; receiver=lists.ozlabs.org) smtp.mailfrom=gmail.com Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: lists.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=O7oWFKDn; dkim-atps=neutral Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=gmail.com (client-ip=2a00:1450:4864:31::11; helo=mail-wm2-x11.google.com; envelope-from=abhinjoses@gmail.com; receiver=lists.ozlabs.org) Received: from mail-wm2-x11.google.com (mail-wm2-x11.google.com [IPv6:2a00:1450:4864:31::11]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4htCRP4vg8z2yLY for ; Mon, 28 Sep 2026 04:20:33 +1000 (AEST) Received: by mail-wm2-x11.google.com with SMTP id 5b1f17b1804b1-49ff9642c57so4121555e9.0 for ; Sun, 27 Sep 2026 11:20:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1790533230; x=1791138030; darn=lists.ozlabs.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=W5PmmKcwKXc/s/p4BcFIaJTS2AL83j8QjzrMDbzKTmQ=; b=O7oWFKDn5RkvvbtsEimt4FW5X4mRxX4aySpg2dmWyW077sp42cbO1D0zKGOMYCKKeq ou2DMu5fIJUJ+cm1SZQeeqiDExGz60uJEMW+78n3DA0zREwlIShCL3uG0k/mLc21rP9U cuE4mqaoLCteanI8SqC+v7p+iiFrn0frsUyHuOrQ7GeSeZPaqxg1GOt5tV1y8tLhhRB7 /Hk7jdw7sQjQctjw+rLEToIx00eCDy/FqaDGbCnnNbbrJrkomrHdG2UGmFKxIbkmZN/p 2r9uS2jXPY6iqgTWfyD790g4TSfRmW8BzihGA0HBMooxp8DIB0vtm70+XlppPs5lB73n 7Dxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790533230; x=1791138030; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=W5PmmKcwKXc/s/p4BcFIaJTS2AL83j8QjzrMDbzKTmQ=; b=yuqQC2L5unA3KbMw4BOeK7hHVL05kjaS1B1+5zLDP2If+fBmehqKsEcNRqi08p/DwG OLlhjrJuPqElBwYLDPiJvV6BxRPXO4DDhs65l0Bd2ApI4/QxINlX/VTCJzrShAQbQ9zE ra2VH166XwsyCmgmcAFU2xo0NkbbcEb8CzerXrQI3JlsmIIZdzbD9WPyTCm7DV2v9Nt4 ibHnVSEAoZCpBpKw0BQ+x2D5nMezW3p19XLRQ07laLY/DH2BpNynoy2u0SkWIL70089U aBzrOZI2pAxkzHgGtuyu6JsOj1jJ0BxpfikcFtb0/3xonq0Dj2qxgFvx8G+6ygPpxGOj zXkg== X-Forwarded-Encrypted: i=1; AKwUvBw5yANYpjc9OI+5UTQniRUAzB/1cS4RYdVGtSqJ/5GQwgGqBm2INK4TL5Pz8W4jOFqrX6zs3R0ppMDvbFw=@lists.ozlabs.org X-Gm-Message-State: AFuF++k6PTpdwLOHmJDtF6N67uZuf1+noVRtFcVxpNrjx+4z8fL4siE/ daRU6RlAsRxEfJZrKfFk4boJoVqejLks6zBD2ib2aXpTmwwlEKaLd+UK X-Gm-Gg: AYBFou1S0gyBLBom6oHDc0LkipRIW0ytLXGku3ILgX8aVCBJaathwDiiGBjgYTlMRwS i0ApbeSjN8Hsxi/uRh6uG8VtK23Y5fTwRBwumh+3diOPykCm+fkjKIrclrYDOfchpklPBqnpCbT FYAmBe+G8EmjirFQtpnobovWVGSLqocgL4zaEyrSrR75VP9k01bRE1LyWEE/StCDIC4H8yg5M9T 3eA5wETVigCrJMzDCpfu4fT05f408kCPJFzTq0CtrGo7jH2dcGZuaG0Cp084wxDIaUOhwn0ifRz YWz10JMYldvbfkTBtK2DuPsRSpmkBebw5nmlTByTIiNq3fso+WwoZuhIvrL3P98wY/jQT8D8zgY bvKM5CsZPLeQnK1XKskGnx/L9UjtvYUwLPrKO+QuY/Zz3CQnQScb3nS7RjI5bBeIYr3tPaSsQgw cpgYV223pyuHjXCkhImLlvPa2RDFWi+pMLO5XL1UBSNesQrjxBq3EeTvKwYc1epdNmsNndYM8sR 2enTOwq4M1Auy88+n/EWFrKOpB/fxW0Dv/yK1O6ezQs39LXgOxethqedmv3TXU3Q3Q= X-Received: by 2002:a05:600c:4f89:b0:49e:6581:7baf with SMTP id 5b1f17b1804b1-49fe66c80c8mr197381425e9.2.1790533230530; Sun, 27 Sep 2026 11:20:30 -0700 (PDT) Received: from f3a6eae2255e.fritz.box (dynamic-002-214-014-217.2.214.pool.telefonica.de. [2.214.14.217]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a002d1d8d5sm38371585e9.0.2026.09.27.11.20.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 27 Sep 2026 11:20:29 -0700 (PDT) From: Abhin Parekadan Jose To: Bjorn Helgaas , Lukas Wunner , "Michael S. Tsirkin" Cc: =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= , Shuai Xue , Kees Cook , Mahesh J Salgaonkar , Oliver O'Halloran , linux-pci@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, Abhin Parekadan Jose Subject: [PATCH RFC v4 5/5] misc: Add edu_srpoc surprise removal POC driver Date: Sun, 27 Sep 2026 18:20:16 +0000 Message-ID: <20260927182017.938565-6-abhinjoses@gmail.com> X-Mailer: git-send-email 2.51.1 In-Reply-To: <20260927182017.938565-1-abhinjoses@gmail.com> References: <20260927182017.938565-1-abhinjoses@gmail.com> X-Mailing-List: linuxppc-dev@lists.ozlabs.org List-Id: List-Help: List-Owner: List-Post: List-Archive: , List-Subscribe: , , List-Unsubscribe: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A test driver for the QEMU edu device that reproduces the surprise removal hang described in MST's RFC v5 thread. - hacked in a reg to the edu device on qemu to raise a delayed irq - This driver writes to that reg in remove and waits for the irq to be handled. This simulates del_gendisk() blocked in blk_mq_freeze_queue_wait() remove() blocks until the delayed interrupt arrives, 600 seconds after it is requested, or until the device is surprise removed and its disconnect work runs. That is the purpose of the driver, so a normal unbind takes 600 seconds, and on a QEMU without the delayed interrupt register it never returns. It is only built with CONFIG_EDU_SRPOC. Assisted-by: LLM Signed-off-by: Abhin Parekadan Jose --- Changes since RFC v3: - Reinitialize the completion in remove() before requesting the delayed interrupt, so that an earlier completion cannot let remove() return while the interrupt is still pending. (Sashiko) Changes since RFC v1: - Build only with CONFIG_EDU_SRPOC, which depends on PCI, instead of unconditionally. (Sashiko) - Don't claim the interrupt if the status register reads all ones, i.e. the device is gone. (Sashiko) - Clear bus mastering in the probe error path and in remove(). (Sashiko) - Document that remove() blocks by design. (Sashiko) - Fixed a checkpatch warning about braced if() blocks. RFC v1: https://lore.kernel.org/all/20260905183905.997833-4-abhinjoses@gmail.com/ Sashiko review: https://lore.kernel.org/all/20260905185027.291191F00A3A@smtp.kernel.org/ RFC v3: https://lore.kernel.org/all/20260927175203.928270-6-abhinjoses@gmail.com/ Sashiko review of v3: https://lore.kernel.org/all/20260927175937.E006F1F00893@smtp.kernel.org/ --- drivers/misc/Kconfig | 11 +++ drivers/misc/Makefile | 1 + drivers/misc/edu_srpoc.c | 172 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 184 insertions(+) create mode 100644 drivers/misc/edu_srpoc.c diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig index 7364931dad3a1..99457e53d21cf 100644 --- a/drivers/misc/Kconfig +++ b/drivers/misc/Kconfig @@ -57,6 +57,17 @@ config DUMMY_IRQ The sole purpose of this module is to help with debugging of systems on which spurious IRQs would happen on disabled IRQ vector. +config EDU_SRPOC + tristate "QEMU edu surprise removal POC driver" + depends on PCI + help + Test driver for the QEMU edu device. Its remove() callback blocks + until the device raises a delayed interrupt or is surprise removed, + to reproduce a hang in remove() during surprise removal. Needs an + edu device with the delayed interrupt register at BAR0 0x30. + + If unsure, say N. + config IBMVMC tristate "IBM Virtual Management Channel support" depends on PPC_PSERIES diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile index e8d8d5d88c0df..9ebcc6ce60f34 100644 --- a/drivers/misc/Makefile +++ b/drivers/misc/Makefile @@ -9,6 +9,7 @@ obj-$(CONFIG_AD525X_DPOT_I2C) += ad525x_dpot-i2c.o obj-$(CONFIG_AD525X_DPOT_SPI) += ad525x_dpot-spi.o obj-$(CONFIG_ATMEL_SSC) += atmel-ssc.o obj-$(CONFIG_DUMMY_IRQ) += dummy-irq.o +obj-$(CONFIG_EDU_SRPOC) += edu_srpoc.o obj-$(CONFIG_ICS932S401) += ics932s401.o obj-$(CONFIG_LKDTM) += lkdtm/ obj-$(CONFIG_TI_FPC202) += ti_fpc202.o diff --git a/drivers/misc/edu_srpoc.c b/drivers/misc/edu_srpoc.c new file mode 100644 index 0000000000000..1f395b2c31ee3 --- /dev/null +++ b/drivers/misc/edu_srpoc.c @@ -0,0 +1,172 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * edu_srpoc.c Surprise Removal POC driver for the QEMU edu device + * + * In remove(), schedules a delayed interrupt on the edu device and + * blocks waiting for it to complete. This simulates del_gendisk() + * blocked in blk_mq_freeze_queue_wait() on slow in-flight I/O. + * + * Surprise-remove the device during this window to reproduce the hang. + * + * edu BAR 0 registers used: + * 0x08 Factorial: write N to compute N! asynchronously + * 0x20 Status: write EDU_STATUS_IRQFACT to enable IRQ on completion + * 0x24 IRQ status: bit 0 = FACT_IRQ, bit 9 = DELAY_IRQ + * 0x30 Delayed IRQ: write N (ms). Hacked in this functionality(not upstream). + * 0x64 IRQ lower: write bitmask to ack + */ + +#include +#include +#include +#include +#include + +#define PCI_VENDOR_ID_EDU 0x1234 +#define PCI_DEVICE_ID_EDU 0x11e8 + +#define EDU_REG_FACT 0x08 +#define EDU_REG_STATUS 0x20 +#define EDU_REG_DELAYED_IRQ 0x30 +#define EDU_REG_IRQ_STATUS 0x24 +#define EDU_REG_IRQ_LOWER 0x64 + +#define EDU_STATUS_IRQFACT 0x80 +#define EDU_FACT_IRQ BIT(0) +#define EDU_DELAY_IRQ BIT(9) + +struct edu_dev { + struct pci_dev *pdev; + void __iomem *regs; + struct completion irq_done; +}; + +static irqreturn_t edu_irq_handler(int irq, void *data) +{ + struct edu_dev *edu = data; + u32 status; + + status = ioread32(edu->regs + EDU_REG_IRQ_STATUS); + /* All ones means the device is gone; the interrupt is not ours */ + if (!status || PCI_POSSIBLE_ERROR(status)) + return IRQ_NONE; + + iowrite32(status, edu->regs + EDU_REG_IRQ_LOWER); + + if (status & (EDU_FACT_IRQ | EDU_DELAY_IRQ)) + complete(&edu->irq_done); + + return IRQ_HANDLED; +} + +static void edu_disconnect(struct work_struct *work) +{ + struct pci_dev *pdev = container_of(work, struct pci_dev, + disconnect_work); + struct edu_dev *edu = pci_get_drvdata(pdev); + + if (!pci_test_and_clear_disconnect_enable(pdev)) + return; + + if (!edu) + return; + + dev_info(&pdev->dev, "disconnect_work fired — unblocking remove()\n"); + complete(&edu->irq_done); +} + +static int edu_probe(struct pci_dev *pdev, const struct pci_device_id *id) +{ + struct edu_dev *edu; + int err; + + edu = devm_kzalloc(&pdev->dev, sizeof(*edu), GFP_KERNEL); + if (!edu) + return -ENOMEM; + + edu->pdev = pdev; + init_completion(&edu->irq_done); + + err = pci_enable_device(pdev); + if (err) + return err; + + err = pci_request_regions(pdev, "edu_srpoc"); + if (err) + goto err_disable; + + edu->regs = pci_iomap(pdev, 0, 0); + if (!edu->regs) { + err = -ENOMEM; + goto err_release; + } + + pci_set_master(pdev); + + err = pci_alloc_irq_vectors(pdev, 1, 1, PCI_IRQ_MSI | PCI_IRQ_INTX); + if (err < 0) + goto err_iounmap; + + err = request_irq(pci_irq_vector(pdev, 0), edu_irq_handler, + IRQF_SHARED, "edu_srpoc", edu); + if (err) + goto err_free_vectors; + + pci_set_drvdata(pdev, edu); + + INIT_WORK(&pdev->disconnect_work, edu_disconnect); + pci_set_disconnect_work(pdev); + + dev_info(&pdev->dev, "edu_srpoc probed\n"); + return 0; + +err_free_vectors: + pci_free_irq_vectors(pdev); +err_iounmap: + pci_clear_master(pdev); + pci_iounmap(pdev, edu->regs); +err_release: + pci_release_regions(pdev); +err_disable: + pci_disable_device(pdev); + return err; +} + +static void edu_remove(struct pci_dev *pdev) +{ + struct edu_dev *edu = pci_get_drvdata(pdev); + + reinit_completion(&edu->irq_done); + iowrite32(EDU_STATUS_IRQFACT, edu->regs + EDU_REG_STATUS); + iowrite32(600000, edu->regs + EDU_REG_DELAYED_IRQ); + + dev_info(&pdev->dev, "Waiting for IRQ in remove()\n"); + wait_for_completion(&edu->irq_done); + dev_info(&pdev->dev, "Unblocked, cleaning up\n"); + + pci_clear_disconnect_work(pdev); + free_irq(pci_irq_vector(pdev, 0), edu); + pci_free_irq_vectors(pdev); + pci_clear_master(pdev); + pci_iounmap(pdev, edu->regs); + pci_release_regions(pdev); + pci_disable_device(pdev); +} + +static const struct pci_device_id edu_ids[] = { + { PCI_DEVICE(PCI_VENDOR_ID_EDU, PCI_DEVICE_ID_EDU) }, + { 0 } +}; +MODULE_DEVICE_TABLE(pci, edu_ids); + +static struct pci_driver edu_driver = { + .name = "edu_srpoc", + .id_table = edu_ids, + .probe = edu_probe, + .remove = edu_remove, +}; + +module_pci_driver(edu_driver); +MODULE_AUTHOR("Abhin Parekadan Jose"); +MODULE_DESCRIPTION("edu surprise removal POC driver"); +MODULE_LICENSE("GPL"); -- 2.51.1