[PATCH v5 0/6] platform/x86/amd/hsmp: Serialize the data plane against socket teardown

From: Muralidhara M K

Date: Fri Jul 10 2026 - 10:50:45 EST


This series makes the AMD HSMP driver safe against concurrent probe/remove
of its per-socket devices and against the lock-free data plane (open
/dev/hsmp fds and hwmon/sysfs reads) racing socket teardown.

The ACPI front-end binds one platform device per socket but shares a single
socket array and a single /dev/hsmp misc device across them, while the data
plane issues mailbox messages with no coordination with driver teardown.
misc_deregister() does not drain already-open fds, so an in-flight message
can touch a freed socket array or an unmapped mailbox on unbind.

A single rw_semaphore, hsmp_sock_rwsem, serializes everything: the data
plane takes it for read so messages run concurrently, and probe and remove
take it for write to bring sockets up and tear them down while excluding and
draining the data plane. The fix is built up in small, bisectable steps:

1. Introduce hsmp_sock_rwsem and hold it for write across ACPI probe/remove
so concurrent per-socket probes cannot race the bring-up handshake or
the one-time socket-array allocation.
2. Map the metric table with ioremap() and release it via a devres action,
so its lifetime is no longer pinned to a single per-socket devres scope.
3. Serialize the per-socket metric-table fill-and-copy with a mutex.
4. Clear mdev.this_device on deregister (independent hygiene fix that the
next patch relies on to track /dev/hsmp registration).
5. Track shared socket ownership with a refcount and a single coordinated
release helper, drop the is_probed flag and unparent /dev/hsmp on the
ACPI path.
6. Add the read side of hsmp_sock_rwsem to the data plane: split the send
into hsmp_send_message_locked() (asserts the rwsem is held) and
hsmp_send_message() (wraps it in guard(rwsem_read)). Route the probe-only
senders through the locked variant so probe, holding the write lock, does
not recurse on the rwsem.

Each patch builds on its own and the series is checkpatch --strict clean.

Changes since v4:
- Collapse the two-lock design onto a single rwsem, as suggested on v4.
The dedicated ACPI probe mutex is gone; probe and remove take
hsmp_sock_rwsem for write instead, so there is one lock rather than a
probe mutex nested outside the data-plane rwsem.
- Add hsmp_send_message_locked(), the send core that asserts the rwsem is
held, and reduce hsmp_send_message() to guard(rwsem_read) around it. The
probe-only senders (hsmp_test(), hsmp_cache_proto_ver(),
hsmp_get_tbl_dram_base()) call the locked variant, so the probe path can
hold the rwsem for write across the whole mailbox handshake without
recursing on it.
- plat.c takes the rwsem for write around init_platform_device() only, not
across devm_add_action_or_reset(), so the release action (which also
takes it for write) cannot deadlock if that registration fails.
- hsmp_misc_register() now takes the /dev/hsmp parent from its caller: the
ACPI driver passes NULL (shared singleton, per-socket devices unbind out
of order), while the platform driver keeps parenting to its single
device. v4 unparented it unconditionally, which also dropped the parent
for the platform path.
- Reword the patch 2 changelog and the devres release comment around the
"devm-managed" split; minor comment cleanups.

Muralidhara M K (6):
platform/x86/amd/hsmp: Serialize ACPI HSMP probe and remove with an
rwsem
platform/x86/amd/hsmp: Map the metric table with ioremap() and unmap
it explicitly
platform/x86/amd/hsmp: Serialize per-socket metric table reads with a
mutex
platform/x86/amd/hsmp: Clear mdev.this_device on deregister
platform/x86/amd/hsmp: ACPI HSMP refcounted sockets and coordinated
release
platform/x86/amd/hsmp: Serialize the data plane against socket
teardown

drivers/platform/x86/amd/hsmp/acpi.c | 137 ++++++++++++++++++++++++---
drivers/platform/x86/amd/hsmp/hsmp.c | 113 ++++++++++++++++++++--
drivers/platform/x86/amd/hsmp/hsmp.h | 14 ++-
drivers/platform/x86/amd/hsmp/plat.c | 38 +++++++-
4 files changed, 279 insertions(+), 23 deletions(-)


base-commit: ff7836fa850c2f815bc219f1e48f6ec8699f4ae7
--
2.34.1