[PATCH 3/6] perf/x86/intel/pt: Stop tracing at syscore shutdown

[Adrian Hunter <adrian.hunter@intel.com>]

Intel PT tracing can survive a shutdown sequence and continue into a
kexec'ed kernel.

The perf reboot notifier removes only per-CPU events, so per-task
events can remain active, for example:

        perf record -e intel_pt// -- kexec -e

Tracing can also remain enabled on CPUs running traced tasks when
stop_other_cpus() halts them.  On systems where Intel PT is unavailable
in VMX operation (IA32_VMX_MISC[14] = 0), VMXOFF during KVM shutdown can
re-enable TraceEn via intel_pt_handle_vmx(0) if a tracing event is
still active.

As a result, the new kernel may inherit TraceEn set and Intel PT can
continue writing into buffers allocated by the old kernel.  Those pages
may subsequently be reused for unrelated purposes.  In addition,
pt_init() detects TraceEn already enabled and refuses to register the
PMU.

Stopping events from a shutdown callback is not sufficient because they
may be scheduled back in until interrupts are finally disabled.
Instead, add a syscore shutdown handler that:

  - prevents TraceEn from being enabled again, and
  - clears TraceEn on every CPU.

syscore_shutdown() is executed for kexec, reboot, halt and poweroff,
and still runs while CPUs can service IPIs.

To block tracing from restarting, introduce a shutdown flag checked by
both pt_config_start() and intel_pt_handle_vmx(), the only places that
can enable TraceEn.  After shutdown begins, events remain in a
self-consistent perf state but no longer generate trace data, matching
the existing VMX-on handling.

Clear TraceEn by reading IA32_RTIT_CTL on each CPU and updating the
hardware state directly rather than relying on aux_config, ensuring
tracing is disabled regardless of perf's software state.  Once the
shutdown flag is set, no racing path can re-enable TraceEn.

kexec jump (KEXEC_PRESERVE_CONTEXT) is not covered because it does not
execute syscore shutdown.  kdump continues to rely on
cpu_emergency_stop_pt().

Example:

    On first kernel:

	perf record -e intel_pt// -- kexec -e

    On second kernel:

	# Without the fix, PT is enabled at boot
	dmesg | grep -i 'PT is enabled at boot time'
	[    2.065889] pt: PT is enabled at boot time, doing nothing

Fixes: 52ca9ced3f70 ("perf/x86/intel/pt: Add Intel PT PMU driver")
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Cc: stable@vger.kernel.org
---
 arch/x86/events/intel/pt.c | 46 +++++++++++++++++++++++++++++++++++---
 1 file changed, 43 insertions(+), 3 deletions(-)

diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
index 36bf039668d7..7453e9880b25 100644
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@@ -18,6 +18,7 @@
 #include <linux/slab.h>
 #include <linux/device.h>
 #include <linux/kvm_types.h>
+#include <linux/syscore_ops.h>
 
 #include <asm/cpuid/api.h>
 #include <asm/perf_event.h>
@@ -34,6 +35,9 @@ static DEFINE_PER_CPU(struct pt, pt_ctx);
 
 static struct pt_pmu pt_pmu;
 
+/* Set at shutdown, after which TraceEn must not be set */
+static bool pt_shutdown;
+
 /*
  * Capabilities of Intel PT hardware, such as number of address bits or
  * supported output schemes, are cached and exported to userspace as "caps"
@@ -425,7 +429,7 @@ static void pt_config_start(struct perf_event *event)
 		return;
 
 	ctl |= RTIT_CTL_TRACEEN;
-	if (READ_ONCE(pt->vmx_on))
+	if (READ_ONCE(pt->vmx_on) || READ_ONCE(pt_shutdown))
 		perf_aux_output_flag(&pt->handle, PERF_AUX_FLAG_PARTIAL);
 	else
 		wrmsrq(MSR_IA32_RTIT_CTL, ctl);
@@ -1609,7 +1613,7 @@ void intel_pt_handle_vmx(int on)
 		                     PERF_AUX_FLAG_PARTIAL);
 
 	/* Turn PTs back on */
-	if (!on && event)
+	if (!on && event && !READ_ONCE(pt_shutdown))
 		wrmsrq(MSR_IA32_RTIT_CTL, event->hw.aux_config);
 
 	local_irq_restore(flags);
@@ -1860,6 +1864,38 @@ static int pt_event_init(struct perf_event *event)
 	return 0;
 }
 
+static void pt_shutdown_cpu(void *info)
+{
+	u64 ctl;
+
+	/*
+	 * After VMXON on CPUs without PT support in VMX operation,
+	 * TraceEn is already clear and RTIT_CTL must not be written.
+	 */
+	rdmsrq(MSR_IA32_RTIT_CTL, ctl);
+	if (ctl & RTIT_CTL_TRACEEN)
+		wrmsrq(MSR_IA32_RTIT_CTL, ctl & ~RTIT_CTL_TRACEEN);
+}
+
+/*
+ * Tracing must not continue into a kexec'ed kernel, which may reuse the
+ * trace buffer memory, so stop tracing on all CPUs and prevent it from
+ * being started again. Events are left in place, but record nothing more.
+ */
+static void pt_syscore_shutdown(void *data)
+{
+	WRITE_ONCE(pt_shutdown, true);
+	on_each_cpu(pt_shutdown_cpu, NULL, 1);
+}
+
+static const struct syscore_ops pt_syscore_ops = {
+	.shutdown	= pt_syscore_shutdown,
+};
+
+static struct syscore pt_syscore = {
+	.ops = &pt_syscore_ops,
+};
+
 void cpu_emergency_stop_pt(void)
 {
 	struct pt *pt = this_cpu_ptr(&pt_ctx);
@@ -1933,7 +1969,11 @@ static __init int pt_init(void)
 		intel_pt_validate_hw_cap(PT_CAP_num_address_ranges);
 
 	ret = perf_pmu_register(&pt_pmu.pmu, "intel_pt", -1);
+	if (ret)
+		return ret;
 
-	return ret;
+	register_syscore(&pt_syscore);
+
+	return 0;
 }
 arch_initcall(pt_init);
-- 
2.53.0