From: Jaidev Shastri <jaidevshastri@vt.edu>

pl011_setup_port() fills the port structure and then stores its address
into amba_ports[] with a plain store. The console callbacks read the
slot through co->index with plain loads.

Store the slot with smp_store_release() and read it with
smp_load_acquire().

Found with MBCheck, a static herd7-based memory consistency checker.

Signed-off-by: Jaidev Shastri <jaidevshastri@vt.edu>
---
 drivers/tty/serial/amba-pl011.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
index c4824c201..696c12ca9 100644
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2536,7 +2536,8 @@ static int pl011_console_setup(struct console *co, char *options)
 	 */
 	if (co->index >= UART_NR)
 		co->index = 0;
-	uap = amba_ports[co->index];
+	/* Pairs with the smp_store_release() in pl011_setup_port(). */
+	uap = smp_load_acquire(&amba_ports[co->index]);
 	if (!uap)
 		return -ENODEV;
 
@@ -2574,7 +2575,8 @@ static int pl011_console_setup(struct console *co, char *options)
 
 static int pl011_console_exit(struct console *co)
 {
-	struct uart_amba_port *uap = amba_ports[co->index];
+	/* Pairs with the smp_store_release() in pl011_setup_port(). */
+	struct uart_amba_port *uap = smp_load_acquire(&amba_ports[co->index]);
 
 	clk_disable_unprepare(uap->clk);
 
@@ -2644,7 +2646,8 @@ static int pl011_console_match(struct console *co, char *name, int idx,
 static void
 pl011_console_write_atomic(struct console *co, struct nbcon_write_context *wctxt)
 {
-	struct uart_amba_port *uap = amba_ports[co->index];
+	/* Pairs with the smp_store_release() in pl011_setup_port(). */
+	struct uart_amba_port *uap = smp_load_acquire(&amba_ports[co->index]);
 	unsigned int old_cr = 0;
 
 	if (!nbcon_enter_unsafe(wctxt))
@@ -2672,7 +2675,8 @@ pl011_console_write_atomic(struct console *co, struct nbcon_write_context *wctxt
 static void
 pl011_console_write_thread(struct console *co, struct nbcon_write_context *wctxt)
 {
-	struct uart_amba_port *uap = amba_ports[co->index];
+	/* Pairs with the smp_store_release() in pl011_setup_port(). */
+	struct uart_amba_port *uap = smp_load_acquire(&amba_ports[co->index]);
 	unsigned int old_cr = 0;
 
 	if (!nbcon_enter_unsafe(wctxt))
@@ -2983,7 +2987,8 @@ static int pl011_setup_port(struct device *dev, struct uart_amba_port *uap,
 	if (ret)
 		return ret;
 
-	amba_ports[index] = uap;
+	/* Pairs with the smp_load_acquire() in the console callbacks. */
+	smp_store_release(&amba_ports[index], uap);
 
 	return 0;
 }

---
base-commit: 93f51579e7df248780214094418f205253383cc5
change-id: 20260921-mb-pl011-35ffcc30d55f

Best regards,
--  
Jaidev Shastri <jaidevshastri@vt.edu>

On Mon, Sep 21, 2026 at 09:20:12PM -0400, Jaidev Shastri via B4 Relay wrote:
> From: Jaidev Shastri <jaidevshastri@vt.edu>
> 
> pl011_setup_port() fills the port structure and then stores its address
> into amba_ports[] with a plain store. The console callbacks read the
> slot through co->index with plain loads.
> 
> Store the slot with smp_store_release() and read it with
> smp_load_acquire().
> 
> Found with MBCheck, a static herd7-based memory consistency checker.
> 
> Signed-off-by: Jaidev Shastri <jaidevshastri@vt.edu>
> ---
>  drivers/tty/serial/amba-pl011.c | 15 ++++++++++-----
>  1 file changed, 10 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
> index c4824c201..696c12ca9 100644
> --- a/drivers/tty/serial/amba-pl011.c
> +++ b/drivers/tty/serial/amba-pl011.c
> @@ -2536,7 +2536,8 @@ static int pl011_console_setup(struct console *co, char *options)
>  	 */
>  	if (co->index >= UART_NR)
>  		co->index = 0;
> -	uap = amba_ports[co->index];
> +	/* Pairs with the smp_store_release() in pl011_setup_port(). */
> +	uap = smp_load_acquire(&amba_ports[co->index]);

That is usually wrong and not how to do this :(

Pleaase fix this properly, if it actually is a real issue.

thanks,

greg k-h