LinuxPPC-Dev Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Jinjie Ruan <ruanjinjie@huawei.com>
To: <catalin.marinas@arm.com>, <will@kernel.org>,
	<mark.rutland@arm.com>, <chenhuacai@kernel.org>,
	<kernel@xen0n.name>, <maddy@linux.ibm.com>, <mpe@ellerman.id.au>,
	<npiggin@gmail.com>, <chleroy@kernel.org>,
	<ritesh.list@gmail.com>, <sshegde@linux.ibm.com>,
	<tglx@kernel.org>, <mingo@redhat.com>, <bp@alien8.de>,
	<dave.hansen@linux.intel.com>, <hpa@zytor.com>,
	<gregkh@linuxfoundation.org>, <rafael@kernel.org>,
	<dakr@kernel.org>, <akpm@linux-foundation.org>,
	<baoquan.he@linux.dev>, <rppt@kernel.org>,
	<pasha.tatashin@soleen.com>, <pratyush@kernel.org>,
	<ruirui.yang@linux.dev>, <leitao@debian.org>,
	<yeoreum.yun@arm.com>, <sourabhjain@linux.ibm.com>,
	<robh@kernel.org>, <coxu@redhat.com>, <kees@kernel.org>,
	<tangyouling@kylinos.cn>, <liukexin@kylinos.cn>,
	<zhangtianyang@loongson.cn>, <guodongtai@kylinos.cn>,
	<maqianga@uniontech.com>, <chao.gao@intel.com>,
	<kai.huang@intel.com>, <vishal.l.verma@intel.com>,
	<seanjc@google.com>, <piliu@redhat.com>, <thuth@redhat.com>,
	<jbouron@amazon.com>, <me@linux.beauty>, <mclapinski@google.com>,
	<graf@amazon.com>, <bgwin@google.com>, <hbathini@linux.ibm.com>,
	<eric.devolder@oracle.com>, <takahiro.akashi@linaro.org>,
	<james.morse@arm.com>, <palmer@rivosinc.com>, <x86@kernel.org>,
	<linux-arm-kernel@lists.infradead.org>,
	<linux-kernel@vger.kernel.org>, <loongarch@lists.linux.dev>,
	<linuxppc-dev@lists.ozlabs.org>, <driver-core@lists.linux.dev>,
	<kexec@lists.infradead.org>
Cc: <ruanjinjie@huawei.com>
Subject: [PATCH v6 12/14] crash: Normalize the kexec_load elfcorehdr at load time
Date: Mon, 21 Sep 2026 17:04:48 +0800	[thread overview]
Message-ID: <20260921090450.807575-13-ruanjinjie@huawei.com> (raw)
In-Reply-To: <20260921090450.807575-1-ruanjinjie@huawei.com>

For kexec_load() the kernel does not build the elfcorehdr, so it is only
rewritten by the first crash hotplug event.  CPU hotplug events do not
change the elfcorehdr, but they may run without device_hotplug_lock
(e.g. CPU offlining during suspend), so they cannot perform that rewrite
without racing with memory hotplug.

Normalize the elfcorehdr once when the crash image is installed via
crash_hotplug_prepare_elfcorehdr(), while device_hotplug_lock can still
be taken safely, and let the hotplug paths skip CPU events entirely.
Architectures that do not need the rewrite  (e.g. powerpc) treat
KEXEC_CRASH_HP_NONE as a no-op.

The x86 crash hotplug handler now skips CPU hotplug events
unconditionally, so nothing reads image->elfcorehdr_updated anymore.
Drop the field and the code that maintains it.

Slightly tested on x86_64 with kexec_load (--kexec-syscall --hotplug),
it boots successfully into the second kernel.

Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: "Christophe Leroy (CS GROUP)" <chleroy@kernel.org>
Cc: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
Cc: Shrikanth Hegde <sshegde@linux.ibm.com>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
Cc: Pratyush Yadav <pratyush@kernel.org>
Cc: Dave Young <ruirui.yang@linux.dev>
Cc: Sourabh Jain <sourabhjain@linux.ibm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
---
 arch/powerpc/kexec/crash.c |  1 +
 arch/x86/kernel/crash.c    |  5 ++---
 include/linux/crash_core.h |  1 +
 include/linux/kexec.h      |  1 -
 kernel/crash_core.c        | 20 +++++++++++++++++++-
 kernel/kexec.c             |  4 ++++
 kernel/kexec_core.c        |  1 -
 7 files changed, 27 insertions(+), 6 deletions(-)

diff --git a/arch/powerpc/kexec/crash.c b/arch/powerpc/kexec/crash.c
index 775895f31037..8ede33740fc0 100644
--- a/arch/powerpc/kexec/crash.c
+++ b/arch/powerpc/kexec/crash.c
@@ -638,6 +638,7 @@ void arch_crash_handle_hotplug_event(struct kimage *image, void *arg)
 	struct memory_notify *mn;
 
 	switch (image->hp_action) {
+	case KEXEC_CRASH_HP_NONE:
 	case KEXEC_CRASH_HP_REMOVE_CPU:
 		return;
 
diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
index 3c9f4fbbe7ff..f34fa8dba028 100644
--- a/arch/x86/kernel/crash.c
+++ b/arch/x86/kernel/crash.c
@@ -457,9 +457,8 @@ void arch_crash_handle_hotplug_event(struct kimage *image, void *arg)
 	 * possible CPUs, there is no need to update the elfcorehdr
 	 * for additional CPU changes.
 	 */
-	if ((image->file_mode || image->elfcorehdr_updated) &&
-		((image->hp_action == KEXEC_CRASH_HP_ADD_CPU) ||
-		(image->hp_action == KEXEC_CRASH_HP_REMOVE_CPU)))
+	if (image->hp_action == KEXEC_CRASH_HP_ADD_CPU ||
+	    image->hp_action == KEXEC_CRASH_HP_REMOVE_CPU)
 		return;
 
 	/*
diff --git a/include/linux/crash_core.h b/include/linux/crash_core.h
index b1c816e98143..a740757dff35 100644
--- a/include/linux/crash_core.h
+++ b/include/linux/crash_core.h
@@ -39,6 +39,7 @@ static inline void arch_crash_handle_hotplug_event(struct kimage *image, void *a
 #endif
 
 int crash_check_hotplug_support(void);
+void crash_hotplug_prepare_elfcorehdr(struct kimage *image);
 
 #ifndef arch_crash_hotplug_support
 static inline int arch_crash_hotplug_support(struct kimage *image, unsigned long kexec_flags)
diff --git a/include/linux/kexec.h b/include/linux/kexec.h
index 72258d813301..f1f218e46db0 100644
--- a/include/linux/kexec.h
+++ b/include/linux/kexec.h
@@ -404,7 +404,6 @@ struct kimage {
 #ifdef CONFIG_CRASH_HOTPLUG
 	int hp_action;
 	int elfcorehdr_index;
-	bool elfcorehdr_updated;
 #endif
 
 #ifdef CONFIG_IMA_KEXEC
diff --git a/kernel/crash_core.c b/kernel/crash_core.c
index 4a990b17b66c..b638ad0e5ba2 100644
--- a/kernel/crash_core.c
+++ b/kernel/crash_core.c
@@ -742,7 +742,6 @@ static void crash_handle_hotplug_event(unsigned int hp_action, unsigned int cpu,
 
 	/* No longer handling a hotplug event */
 	image->hp_action = KEXEC_CRASH_HP_NONE;
-	image->elfcorehdr_updated = true;
 
 	/* Change back to read-only */
 	arch_kexec_protect_crashkres();
@@ -754,6 +753,25 @@ static void crash_handle_hotplug_event(unsigned int hp_action, unsigned int cpu,
 	crash_hotplug_unlock();
 }
 
+void crash_hotplug_prepare_elfcorehdr(struct kimage *image)
+{
+	if (!image || !image->hotplug_support || image->file_mode)
+		return;
+
+	crash_find_elfcorehdr(image);
+	if (image->elfcorehdr_index < 0)
+		return;
+
+	/*
+	 * kexec_load() images are not normalized at load, so do it here while
+	 * the lock is still free to take.  hp_action is KEXEC_CRASH_HP_NONE,
+	 * which the arch handler treats as "just rebuild the elfcorehdr".
+	 */
+	lock_device_hotplug();
+	arch_crash_handle_hotplug_event(image, NULL);
+	unlock_device_hotplug();
+}
+
 static int crash_memhp_notifier(struct notifier_block *nb, unsigned long val, void *arg)
 {
 	switch (val) {
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 90756dc6339b..ea9ba00bc786 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -166,6 +166,10 @@ static int do_kexec_load(unsigned long entry, unsigned long nr_segments,
 	/* Install the new kernel and uninstall the old */
 	image = xchg(dest_image, image);
 
+#ifdef CONFIG_CRASH_HOTPLUG
+	if ((flags & KEXEC_ON_CRASH) && kexec_crash_image)
+		crash_hotplug_prepare_elfcorehdr(kexec_crash_image);
+#endif
 out:
 #ifdef CONFIG_CRASH_DUMP
 	if ((flags & KEXEC_ON_CRASH) && kexec_crash_image)
diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
index 31c8228318a7..c36a5e8b400e 100644
--- a/kernel/kexec_core.c
+++ b/kernel/kexec_core.c
@@ -251,7 +251,6 @@ struct kimage *do_kimage_alloc_init(void)
 #ifdef CONFIG_CRASH_HOTPLUG
 	image->hp_action = KEXEC_CRASH_HP_NONE;
 	image->elfcorehdr_index = -1;
-	image->elfcorehdr_updated = false;
 #endif
 
 	return image;
-- 
2.34.1



  parent reply	other threads:[~2026-09-21  9:05 UTC|newest]

Thread overview: 43+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-21  9:04 [PATCH v6 00/14] crash: Fix several bugs Jinjie Ruan
2026-09-21  9:04 ` [PATCH v6 01/14] kexec: Fix CMA segment address translation with non-zero text_offset Jinjie Ruan
2026-09-21  9:17   ` sashiko-bot
2026-10-20  8:09   ` Mike Rapoport
2026-10-20  8:34     ` Jinjie Ruan
2026-10-20  8:42     ` Jinjie Ruan
2026-09-21  9:04 ` [PATCH v6 02/14] kexec: Record allocated CMA pages to fix release size mismatch Jinjie Ruan
2026-09-21  9:14   ` sashiko-bot
2026-10-20  8:09   ` Mike Rapoport
2026-09-21  9:04 ` [PATCH v6 03/14] kexec: Extract kexec_free_segment_cma() from kimage_free_cma() Jinjie Ruan
2026-09-21  9:13   ` sashiko-bot
2026-09-21  9:04 ` [PATCH v6 04/14] arm64: kexec_file: Fix CMA page leaks in segment placement retry loops Jinjie Ruan
2026-09-21  9:18   ` sashiko-bot
2026-10-20  8:09   ` Mike Rapoport
2026-09-21  9:04 ` [PATCH v6 05/14] arm64: kexec_file: Fix elf_headers memory leak in retry loop Jinjie Ruan
2026-09-21  9:15   ` sashiko-bot
2026-10-10 20:00   ` Catalin Marinas
2026-09-21  9:04 ` [PATCH v6 06/14] LoongArch: kexec_file: Fix CMA page leaks in segment placement retry loops Jinjie Ruan
2026-09-21  9:13   ` sashiko-bot
2026-09-21  9:04 ` [PATCH v6 07/14] LoongArch: kexec_file: Fix elf_headers memory leak in retry loop Jinjie Ruan
2026-09-21  9:14   ` sashiko-bot
2026-09-21  9:04 ` [PATCH v6 08/14] LoongArch: kexec_file: Fix a modified_cmdline leak Jinjie Ruan
2026-09-21  9:15   ` sashiko-bot
2026-09-21  9:04 ` [PATCH v6 09/14] x86/crash: Fix massive out-of-bounds write on 32-bit Highmem Jinjie Ruan
2026-09-21  9:12   ` sashiko-bot
2026-10-20  8:09   ` Mike Rapoport
2026-10-21  8:28     ` Jinjie Ruan
2026-10-21 17:02       ` Mike Rapoport
2026-09-21  9:04 ` [PATCH v6 10/14] crash: Extract crash_get_memory_ranges() helper Jinjie Ruan
2026-09-21  9:19   ` sashiko-bot
2026-09-21  9:04 ` [PATCH v6 11/14] crash: Factor out crash_find_elfcorehdr() helper Jinjie Ruan
2026-09-21  9:17   ` sashiko-bot
2026-09-21  9:04 ` Jinjie Ruan [this message]
2026-09-21  9:19   ` [PATCH v6 12/14] crash: Normalize the kexec_load elfcorehdr at load time sashiko-bot
2026-09-21  9:04 ` [PATCH v6 13/14] driver core: Add device_hotplug_lock_assert_held() helper Jinjie Ruan
2026-09-21  9:18   ` sashiko-bot
2026-09-21  9:04 ` [PATCH v6 14/14] crash: Fix TOCTOU race in crash memory range collection Jinjie Ruan
2026-09-21  9:25   ` sashiko-bot
2026-10-08  1:57 ` [PATCH v6 00/14] crash: Fix several bugs Jinjie Ruan
2026-10-08  3:26   ` Baoquan He
2026-10-08  6:42   ` Mike Rapoport
2026-10-20  8:09 ` Mike Rapoport
2026-10-20  8:53   ` Jinjie Ruan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260921090450.807575-13-ruanjinjie@huawei.com \
    --to=ruanjinjie@huawei.com \
    --cc=akpm@linux-foundation.org \
    --cc=baoquan.he@linux.dev \
    --cc=bgwin@google.com \
    --cc=bp@alien8.de \
    --cc=catalin.marinas@arm.com \
    --cc=chao.gao@intel.com \
    --cc=chenhuacai@kernel.org \
    --cc=chleroy@kernel.org \
    --cc=coxu@redhat.com \
    --cc=dakr@kernel.org \
    --cc=dave.hansen@linux.intel.com \
    --cc=driver-core@lists.linux.dev \
    --cc=eric.devolder@oracle.com \
    --cc=graf@amazon.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=guodongtai@kylinos.cn \
    --cc=hbathini@linux.ibm.com \
    --cc=hpa@zytor.com \
    --cc=james.morse@arm.com \
    --cc=jbouron@amazon.com \
    --cc=kai.huang@intel.com \
    --cc=kees@kernel.org \
    --cc=kernel@xen0n.name \
    --cc=kexec@lists.infradead.org \
    --cc=leitao@debian.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linuxppc-dev@lists.ozlabs.org \
    --cc=liukexin@kylinos.cn \
    --cc=loongarch@lists.linux.dev \
    --cc=maddy@linux.ibm.com \
    --cc=maqianga@uniontech.com \
    --cc=mark.rutland@arm.com \
    --cc=mclapinski@google.com \
    --cc=me@linux.beauty \
    --cc=mingo@redhat.com \
    --cc=mpe@ellerman.id.au \
    --cc=npiggin@gmail.com \
    --cc=palmer@rivosinc.com \
    --cc=pasha.tatashin@soleen.com \
    --cc=piliu@redhat.com \
    --cc=pratyush@kernel.org \
    --cc=rafael@kernel.org \
    --cc=ritesh.list@gmail.com \
    --cc=robh@kernel.org \
    --cc=rppt@kernel.org \
    --cc=ruirui.yang@linux.dev \
    --cc=seanjc@google.com \
    --cc=sourabhjain@linux.ibm.com \
    --cc=sshegde@linux.ibm.com \
    --cc=takahiro.akashi@linaro.org \
    --cc=tangyouling@kylinos.cn \
    --cc=tglx@kernel.org \
    --cc=thuth@redhat.com \
    --cc=vishal.l.verma@intel.com \
    --cc=will@kernel.org \
    --cc=x86@kernel.org \
    --cc=yeoreum.yun@arm.com \
    --cc=zhangtianyang@loongson.cn \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox