From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5C84B4A13AE for ; Wed, 29 Jul 2026 16:48:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785343701; cv=none; b=JL+vKS29/8SNdlLw2vP88USGmYtHcb2j/02WwM31PRMuUMrqDIVaII5vlkaenZ3zwvppsZySMbF21JjrsK85q+rK68EH1fC10MiECARkzcEQf5qGWcH/2nbOoz1H/6WE0aprlsy9komxI+o57JGRIZGTeCIJ9M6Hubunt1atsoI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785343701; c=relaxed/simple; bh=uBEEc90nmtuM3xQOYEqki7EeF1IGEopFW5g5kp+rX+4=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=c+APwGnSUWqTfU/cVqVKPuL69uDbzvHxRx+SJUTkmV5XKMRHzLbUngM6E0L8Ei3i1cO5aR+lo/RrCdOqEI3UCkobpi/1gojIl3bBTjmH0T2+pHHzBkfatyD0HHv5ZA2mLA0iLlSg/pbjtdPyCu4QJ6qSGiU2CJAcf8b49Kb9rko= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=RURRz7s4; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="RURRz7s4" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=5l/3IP2HFVsa8eAqLOCa4UVEPVokMRetreMKGr2fkq8=; b=RURRz7s4klLVjJ1u0nsrHmmDI2 6huTDWCqNbHC3TPf0/VNEPWfxkndui6XU+JXSJ5DpiG9Qi+EUKSg4YlxYA6+5HjOpyF2NxbmdCB3I IfR83VyRoPifX3SADc9MenUDDOtKZw0lYlmnfHMJPbb1HIJIqxoT5aXFs92TE9vl49F6zdifEni7a blLi764oJSrTG//yH0piQUMUN/oQIEgokEdkEQvvL2j8jVreJm3kJfX93CpYZFqCRfPDQUmSTN50+ cLtQzbV2968XW4fGsJqnxrmj9Ybh5aB+R6HC3JPwKPRFxS1e0CN75gFL78YRohH6HKxwQxxhtu/96 5xvXvn6Q==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wp7Rj-008amb-2s; Wed, 29 Jul 2026 16:47:56 +0000 Date: Wed, 29 Jul 2026 09:47:49 -0700 From: Breno Leitao To: Pratyush Yadav Cc: Andrew Morton , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Baoquan He , Pasha Tatashin , Miaohe Lin , Naoya Horiguchi , linux-mm@kvack.org, linux-kernel@vger.kernel.org, kexec@lists.infradead.org, rmikey@meta.com, riel@surriel.com, kernel-team@meta.com, Kiryl Shutsemau Subject: Re: [PATCH] kexec: keep the next kernel off hardware-poisoned pages Message-ID: References: <20260728-kexec_posioned-v1-1-160c81d180fe@debian.org> <2vxz7bme80vm.fsf@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <2vxz7bme80vm.fsf@kernel.org> X-Debian-User: leitao On Wed, Jul 29, 2026 at 01:57:01PM +0200, Pratyush Yadav wrote: > On Tue, Jul 28 2026, Breno Leitao wrote: > > > Memory failures (such as unrecoverable ECCs errors) are getting more and > > more common. The kernel knows how to handle it while running, marking it > > as poisoned (and SIGBUS user tasks). > > > > Poisoned memory is removed from the buddy allocator, but, not from > > other places. A current problem is that kexec will load new kernel > > on top of a bad/poisoned memory, which is undesirable. > > > > If the next kernel's image, initrd or purgatory lands on poisoned frame, > > the relocation copy writes to the bad memory and the machine checks > > during the kexec. > > > > Skip hardware-poisoned frames when placing segments: check them in the > > kexec_file hole finder so it lays the next kernel down on good memory, > > and reject a poisoned destination in sanity_check_segment_list() for > > the kexec_load path, which cannot relocate. > > kexec_locate_mem_hole() uses kexec_alloc_contig() to try to find a > contiguous range from CMA. If found, it uses that and skips relocation. > Do you know if CMA tracks poisoned pages and skips allocating them? > > sanity_check_segment_list() will catch these anyway and error out, but > would be nice if CMA can track poisoned pages in the first place. > Anyway, that is out of scope for this patch, but something you might > want to look into. Good point, I understand CMA already avoids them: alloc_contig_range() runs in PB_ISOLATE_MODE_CMA_ALLOC, where a HWPoison page counts as unmovable, so isolation returns -EBUSY and cma_alloc() routes around it, no? > > --- a/kernel/kexec_file.c > > +++ b/kernel/kexec_file.c > > @@ -504,6 +504,13 @@ static int locate_mem_hole_top_down(unsigned long start, unsigned long end, > > continue; > > } > > > > + /* Avoid placing the next kernel on hardware-poisoned memory */ > > + if (range_contains_hwpoison(temp_start, > > + temp_end - temp_start + 1)) { > > + temp_start = temp_start - PAGE_SIZE; > > Sashiko complains about this > https://sashiko.dev/#/patchset/20260728-kexec_posioned-v1-1-160c81d180fe@debian.org: > > If we find a hardware-poisoned page within a large segment, does this loop in > locate_mem_hole_top_down() cause a CPU soft lockup? > > Since temp_start is shifted by only PAGE_SIZE, the next iteration will call > range_contains_hwpoison() again. As seen in mm/memory-failure.c, that > function does a linear scan from the new start address: > > for (pfn = PHYS_PFN(start); pfn <= end_pfn; pfn++) { > if (pfn_valid(pfn) && PageHWPoison(pfn_to_page(pfn))) > return true; > } > > This means we could rescan almost the entire segment over and over until it > finally moves past the poisoned page. For a very large segment like a 512MB > initrd, this would iterate billions of times without yielding. > > Could range_contains_hwpoison() return the address of the poisoned page so > the hole finder can skip past it efficiently? > > Which does seem to make sense. Same problem below. Agreed, that could be a real problem. Returning the poisoned page address from range_contains_hwpoison() would work but feels awkward for a predicate function. Let me think through a cleaner approach. Thanks for the review, --breno