• James Gowans's avatar
    kexec: do syscore_shutdown() in kernel_kexec · 7bb94380
    James Gowans authored
    syscore_shutdown() runs driver and module callbacks to get the system into
    a state where it can be correctly shut down.  In commit 6f389a8f ("PM
    / reboot: call syscore_shutdown() after disable_nonboot_cpus()")
    syscore_shutdown() was removed from kernel_restart_prepare() and hence got
    (incorrectly?) removed from the kexec flow.  This was innocuous until
    commit 6735150b ("KVM: Use syscore_ops instead of reboot_notifier to
    hook restart/shutdown") changed the way that KVM registered its shutdown
    callbacks, switching from reboot notifiers to syscore_ops.shutdown.  As
    syscore_shutdown() is missing from kexec, KVM's shutdown hook is not run
    and virtualisation is left enabled on the boot CPU which results in triple
    faults when switching to the new kernel on Intel x86 VT-x with VMXE
    enabled.
    
    Fix this by adding syscore_shutdown() to the kexec sequence.  In terms of
    where to add it, it is being added after migrating the kexec task to the
    boot CPU, but before APs are shut down.  It is not totally clear if this
    is the best place: in commit 6f389a8f ("PM / reboot: call
    syscore_shutdown() after disable_nonboot_cpus()") it is stated that
    "syscore_ops operations should be carried with one CPU on-line and
    interrupts disabled." APs are only offlined later in machine_shutdown(),
    so this syscore_shutdown() is being run while APs are still online.  This
    seems to be the correct place as it matches where syscore_shutdown() is
    run in the reboot and halt flows - they also run it before APs are shut
    down.  The assumption is that the commit message in commit 6f389a8f
    ("PM / reboot: call syscore_shutdown() after disable_nonboot_cpus()") is
    no longer valid.
    
    KVM has been discussed here as it is what broke loudly by not having
    syscore_shutdown() in kexec, but this change impacts more than just KVM;
    all drivers/modules which register a syscore_ops.shutdown callback will
    now be invoked in the kexec flow.  Looking at some of them like x86 MCE it
    is probably more correct to also shut these down during kexec. 
    Maintainers of all drivers which use syscore_ops.shutdown are added on CC
    for visibility.  They are:
    
    arch/powerpc/platforms/cell/spu_base.c  .shutdown = spu_shutdown,
    arch/x86/kernel/cpu/mce/core.c	        .shutdown = mce_syscore_shutdown,
    arch/x86/kernel/i8259.c                 .shutdown = i8259A_shutdown,
    drivers/irqchip/irq-i8259.c	        .shutdown = i8259A_shutdown,
    drivers/irqchip/irq-sun6i-r.c	        .shutdown = sun6i_r_intc_shutdown,
    drivers/leds/trigger/ledtrig-cpu.c	.shutdown = ledtrig_cpu_syscore_shutdown,
    drivers/power/reset/sc27xx-poweroff.c	.shutdown = sc27xx_poweroff_shutdown,
    kernel/irq/generic-chip.c	        .shutdown = irq_gc_shutdown,
    virt/kvm/kvm_main.c	                .shutdown = kvm_shutdown,
    
    This has been tested by doing a kexec on x86_64 and aarch64.
    
    Link: https://lkml.kernel.org/r/20231213064004.2419447-1-jgowans@amazon.com
    Fixes: 6735150b ("KVM: Use syscore_ops instead of reboot_notifier to hook restart/shutdown")
    Signed-off-by: default avatarJames Gowans <jgowans@amazon.com>
    Cc: Baoquan He <bhe@redhat.com>
    Cc: Eric Biederman <ebiederm@xmission.com>
    Cc: Paolo Bonzini <pbonzini@redhat.com>
    Cc: Sean Christopherson <seanjc@google.com>
    Cc: Marc Zyngier <maz@kernel.org>
    Cc: Arnd Bergmann <arnd@arndb.de>
    Cc: Tony Luck <tony.luck@intel.com>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: Chen-Yu Tsai <wens@csie.org>
    Cc: Jernej Skrabec <jernej.skrabec@gmail.com>
    Cc: Samuel Holland <samuel@sholland.org>
    Cc: Pavel Machek <pavel@ucw.cz>
    Cc: Sebastian Reichel <sre@kernel.org>
    Cc: Orson Zhai <orsonzhai@gmail.com>
    Cc: Alexander Graf <graf@amazon.de>
    Cc: Jan H. Schoenherr <jschoenh@amazon.de>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    7bb94380
kexec_core.c 32.6 KB