linux.git/arch/powerpc/kexec, branch master

powerpc/kexec_file: Use inclusive range checks for excluded memory

2026-09-05T05:41:40+00:00

arch_check_excluded_range() checks if a kexec segment overlaps an
excluded memory range.

Both ranges use inclusive end addresses, but the overlap check uses
exclusive comparisons. This skips ranges with start == ->ranges[i].end
or end == ->ranges[i].start. Use inclusive comparisons instead.

Fixes: 6e5250eaa665 ("powerpc/crash: use generic APIs to locate memory hole for kdump")
Signed-off-by: Thorsten Blum 
Reviewed-by: Sourabh Jain 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260810145827.157972-3-thorsten.blum@linux.dev

powerpc/kexec: Simplify kdump_extra_elfcorehdr_size()

2026-09-05T05:41:40+00:00

Return the size directly and drop the extra_sz variable to simplify
kdump_extra_elfcorehdr_size(). The two warning paths now fall through
to the existing return 0 at the end of the function.

Signed-off-by: Thorsten Blum 
Reviewed-by: Christophe Leroy (CS GROUP) 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260730131940.597739-2-thorsten.blum@linux.dev

powerpc/kexec_file: Use inclusive range checks in add_usable_mem()

2026-09-05T05:41:39+00:00

add_usable_mem() adds usable memory ranges for the kdump kernel.

The ranges are inclusive, but the partial overlap check uses exclusive
comparisons. This skips ranges with base == loc_end or end == loc_base.
Use inclusive comparisons instead.

Fixes: 7c64e21a1c5a ("powerpc/kexec_file: Restrict memory usage of kdump kernel")
Signed-off-by: Thorsten Blum 
Reviewed-by: Sourabh Jain 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260809162403.18142-2-thorsten.blum@linux.dev

Merge tag 'powerpc-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

2026-08-18T19:08:13+00:00

Pull powerpc updates from Madhavan Srinivasan:

 - Enable Rust for ppc64le

 - ppc4xx gpio driver updates

 - Add power12 base enablement support

 - Validate arch_compat against host compatibility mode

 - Simplify bootx_scan_dt_build_struct() in powermac platform

 - Implement get_direction() in cpm2

 - Use cpu_relax() in ps3_create_spu()

 - Add NULL guard for cause_ipi in smp_muxed_ipi_message_pass

 - Fixes to handle pseries watchdogs in kdump path

 - Fix missing r2 clobber in PCREL inline assembly

 - Set GPIO chip parent on ppc44x

 - KVM: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl

 - KVM: Use generic xfer to guest work function

 - Enable to run posix cpu timers in task context

 - Misc fixes and cleanups

Thanks to Aditya Gupta, Alice Ryhl, Amit Machhiwal, Andrew Morton,
Anushree Mathur, Athira Rajeev, Bartosz Golaszewski, Cédric Le Goater,
Christian König, Christophe Leroy (CS GROUP), Gary Guo, Gaurav Batra,
Gautam Menghani, Gou Hao, Hari Bathini, Harsh Prateek Bora, jiazhenyuan,
Jinjie Ruan, Link Mauve, Linus Walleij, Mahesh Kumar G Mahesh
Salgaonkar, Michael Walle, Michal Suchánek, Mukesh Kumar Chaurasiya
(IBM), Nicholas Piggin, Nikhil Kumar Singh, Praveen K Pandey, Ritesh
Harjani (IBM), Rosen Penev, Saket Kumar Bhaskar, Shrikanth Hegde,
Sourabh Jain, Thorsten Blum, Vaibhav Jain, Venkat Rao Bagalkote, Vishal
Chourasia, Wentao Guan, and Yanfei Xu.

* tag 'powerpc-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (62 commits)
  powerpc/pseries/iommu: switch to Default DMA window during kdump
  powerpc/configs: enable CONFIG_RAS to fix EDAC support
  KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl
  KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV
  KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM
  KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl
  gpio: ppc44x: use dev_name() for chip label
  gpio: ppc44x: fix undefined behavior in GPIO_MASK2 macro
  gpio: ppc44x: drop PPC-specific IO helpers
  gpio: ppc44x: Convert GPIO to generic MMIO
  gpio: ppc44x: Use platform resource helper for GPIO MMIO
  gpio: ppc44x: Use module platform driver helper for GPIO
  gpio: ppc44x: update all 4xx to 44x
  gpio: move ppc4xx gpio driver from arch/powerpc to drivers/gpio
  KVM: PPC: Use min() in kvm_vm_ioctl_check_extension()
  KVM: PPC: booke: Use min() in watchdog_next_timeout()
  powerpc/perf: Add power12 Base Performance Monitoring support
  powerpc: Add Power12 architected mode
  powerpc: Add Power12 raw mode
  powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation
  ...

powerpc/kexec_file: Prevent kexec range truncation

2026-07-31T12:02:23+00:00

Sashiko AI review pointed out the following issue.

The __merge_memory_ranges() function incorrectly handles overlapping
memory ranges when merging them. Although sort_memory_ranges() sorts all
ranges by their start address in ascending order beforehand, the merge
logic remains defective in two ways:

1. It compares the current range's start against the previous element (i-1)
   instead of the running target index (idx)

2. It unconditionally overwrites 'ranges[idx].end' with 'ranges[i].end'.

This logic flaw leads to critical memory truncation when a larger memory
range completely subsumes subsequent smaller ranges.

For example, consider a sorted input array with three ranges:
  Range A (idx=0): [0x1000 - 0x9000]
  Range B (i=1):   [0x2000 - 0x5000] (completely inside Range A)
  Range C (i=2):   [0x6000 - 0x8000] (completely inside Range A)

1. When i=1 (Range B):
   ranges[1].start (0x2000) <= ranges[0].end + 1 (0x9001) is TRUE.
   The code executes: ranges[0].end = ranges[1].end, which erroneously
   shrinks Range A's end from 0x9000 down to 0x5000.

2. When i=2 (Range C):
   ranges[2].start (0x6000) <= ranges[1].end + 1 (0x5001) is FALSE.
   The code falls into the else block, creating a broken new range.

As a result, valid memory fragments [0x5001 - 0x5fff] and [0x8001 - 0x9000]
are completely lost from the kexec exclude lists, potentially allowing
the crash kernel to overwrite active memory, causing data corruption
or crashes.

Fix this by ensuring the start of the current range is compared against the
end of the active merged range (idx), and use max() to safely prevent the
outer boundary from being truncated.

Cc: stable@vger.kernel.org
Fixes: 180adfc532a8 ("powerpc/kexec_file: Add helper functions for getting memory ranges")
Signed-off-by: Jinjie Ruan 
Reviewed-by: Sourabh Jain 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260729012948.2797865-4-ruanjinjie@huawei.com

powerpc/kexec_file: Fix null-ptr-def in extra size calculation

2026-07-31T12:02:23+00:00

A static Sashiko AI review identified a potential NULL pointer
dereference in kexec_extra_fdt_size_ppc64().

On platforms without any reserved memory regions,
get_reserved_memory_ranges() can return 0 while leaving 'rmem'
unallocated as NULL. Passing it directly leads to a kernel panic when
evaluating 'rmem->nr_ranges'.

Add a NULL check for 'rmem' to prevent this crash.

Cc: stable@vger.kernel.org
Fixes: 0d3ff067331e ("powerpc/kexec_file: fix extra size calculation for kexec FDT")
Signed-off-by: Jinjie Ruan 
Reviewed-by: Sourabh Jain 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260729012948.2797865-3-ruanjinjie@huawei.com

powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr()

2026-07-31T12:02:23+00:00

In get_crash_memory_ranges(), if crash_exclude_mem_range() failed
after realloc_mem_ranges() has successfully allocated the cmem
memory, it just returns an error but leaves cmem pointing to
the allocated memory, nor is it freed in the caller
update_crash_elfcorehdr(), which cause a memory leak, goto out
to free the cmem.

Fixes: 849599b702ef ("powerpc/crash: add crash memory hotplug support")
Reviewed-by: Sourabh Jain 
Signed-off-by: Jinjie Ruan 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260729012948.2797865-2-ruanjinjie@huawei.com

powerpc/kexec_file: use snprintf to simplify setup_kdump_cmdline

2026-07-31T11:30:48+00:00

Replace the manual string length accounting, memcpy(), and NUL
termination with a single snprintf() call to prepend the elfcorehdr=
address and to detect string truncation at the same time.

Use kmalloc() to avoid unnecessarily zeroing the memory. While at it,
also use "prepending" instead of "appending" in the error message.

Signed-off-by: Thorsten Blum 
Signed-off-by: Madhavan Srinivasan 
Link: https://patch.msgid.link/20260527000105.1081651-3-thorsten.blum@linux.dev

powerpc/kexec_file: Use crash_exclude_core_ranges() helper

2026-06-30T15:49:06+00:00

The crash memory exclude of crashk_res and crashk_cma memory on powerpc
are almost identical to the generic crash_exclude_core_ranges().

By introducing the architecture-specific arch_crash_exclude_mem_range()
function with a default implementation of crash_exclude_mem_range(),
and using crash_exclude_mem_range_guarded as powerpc's separate
implementation, the generic crash_exclude_core_ranges() helper function
can be reused.

Cc: Andrew Morton 
Cc: Hari Bathini 
Cc: Madhavan Srinivasan 
Cc: Mahesh Salgaonkar 
Cc: Michael Ellerman 
Cc: Ritesh Harjani (IBM) 
Cc: Shivang Upadhyay 
Acked-by: Breno leitao 
Acked-by: Baoquan He 
Reviewed-by: Sourabh Jain 
Acked-by: Mike Rapoport (Microsoft) 
Signed-off-by: Jinjie Ruan 
Link: https://patch.msgid.link/20260629094746.191843-9-ruanjinjie@huawei.com
Signed-off-by: Mike Rapoport (Microsoft)

powerpc/crash: sort crash memory ranges before preparing elfcorehdr

2026-06-30T15:49:06+00:00

During a memory hot-remove event, the elfcorehdr is rebuilt to exclude
the removed memory. While updating the crash memory ranges for this
operation, the crash memory ranges array can become unsorted. This
happens because remove_mem_range() may split a memory range into two
parts and append the higher-address part as a separate range at the end
of the array.

So far, no issues have been observed due to the unsorted crash memory
ranges. However, this could lead to problems once crash memory range
removal is handled by generic code, as introduced in the upcoming
patches in this series.

Currently, powerpc uses a platform-specific function,
remove_mem_range(), to exclude hot-removed memory from the crash memory
ranges. This function performs the same task as the generic
crash_exclude_mem_range() in crash_core.c. The generic helper also
ensures that the crash memory ranges remain sorted. So remove the
redundant powerpc-specific implementation and instead call
crash_exclude_mem_range_guarded() (which internally calls
crash_exclude_mem_range()) to exclude the hot-removed memory ranges.

Cc: Andrew Morton 
Cc: Baoquan he 
Cc: Jinjie Ruan 
Cc: Hari Bathini 
Cc: Madhavan Srinivasan 
Cc: Mahesh Salgaonkar 
Cc: Michael Ellerman 
Cc: Ritesh Harjani (IBM) 
Cc: Shivang Upadhyay 
Cc: linux-kernel@vger.kernel.org
Acked-by: Baoquan He 
Reviewed-by: Ritesh Harjani (IBM) 
Acked-by: Mike Rapoport (Microsoft) 
Signed-off-by: Sourabh Jain 
Signed-off-by: Jinjie Ruan 
Link: https://patch.msgid.link/20260629094746.191843-3-ruanjinjie@huawei.com
Signed-off-by: Mike Rapoport (Microsoft)