From nobody Tue Sep 29 13:20:37 2026 Received: from stravinsky.debian.org (stravinsky.debian.org [82.195.75.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 23CA9369224 for ; Fri, 7 Aug 2026 14:06:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=82.195.75.108 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786111566; cv=none; b=exIzpl7j8ovI2/6kBWYovq+BO3HD9lD6Eb4/1HwCpCR8hHdTNtif8v5WvQfUgDnLuV5nI0wMNsmfuneovGoUbhAf/bc9KFBmw9nAFKyAoH1pMtAYAx1ZDngjLNSBIgeR0Hg0ZnwNTYB0Fm9oaXu7SOf/momBJfw3oVGdaW2UyqE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786111566; c=relaxed/simple; bh=SWLUcI/DF2JhAszQhmn2J1XYAQICne5Kz7Jfs0Ci4Cs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=uQKFPRNIrhnSIssmTFDG/5WwgPu5pVX4UnO1VNLi0M2IRq8r9crbdkqZaePDVmdZBqas1LuQ6hOJC+zD1x+hhZElDHRyJGjca5drLiipvMGlCSjMv3DxLgBwlK8oqX5EBsfP2/01lmNkWBPrfSOzd0Ba9Uq3N1HKsOP0zki4KqQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=debian.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b=GxaLeyYH; arc=none smtp.client-ip=82.195.75.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=debian.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=debian.org header.i=@debian.org header.b="GxaLeyYH" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Cc:To:Message-Id: Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From: Reply-To:Content-ID:Content-Description:In-Reply-To:References; bh=K3SviOS6dfaElwqZsGFYvgNYmNLpXjvir7qqTUt7Jc4=; b=GxaLeyYHNZw0HZXIP+vjijRoCE zu2xXDts+Z7bKOgH+rIhfwCzToipY6I9hYWKnLvuyR8YdGYhUHHVPxuFgijvThFd05L3QrePApM6u yPqvEEHZ10uhsFPwwbz92HtT6SRl0C771gpsnnBasyqcLQcyI976wrnlfXCfLf1V0uUPKNNDS4a+B gyiuB9DOlsNRns8ixialnIqyM76s4SP0NXSrWG8IFBs27HHvvREzkSyVpav9wXDEPlpP3hr5MjZU3 a8Y19qY5ptNbAsJjdV2hUM0pRmrgZ0l750Spl8trqryBEipOtK1XWyTTiILdPKZlYev17NNUfLC3o vdz475Pg==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from ) id 1wsLCk-000TvW-00; Fri, 07 Aug 2026 14:05:47 +0000 From: Breno Leitao Date: Fri, 07 Aug 2026 07:05:09 -0700 Subject: [PATCH v4] kexec: keep the next kernel off hardware-poisoned pages Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260807-kexec_posioned-v4-1-70d57f14625d@debian.org> X-B4-Tracking: v=1; b=H4sIABTmdWoC/2XMywqDMBCF4VcJs3bKTOIlddX3KKVEM9pQUIlFW orvXhRKL24P5/ufMEoMMkKpnhBlCmPoOyhVmiioL65rBYOHUoEmnVOhC7zKXerz0C9H8VjoqiK XcmocQaJgiNKE+xo8nhIFlzDe+vhY+xMv6ztl/1MTIyPnVFv2bKmRg5cquG7XxxaW1qS/vKGN1 8jY7LVnm2Xc5OnGm4+3ZDbeIKM1zuXihUzGP36e5xdZtS9aLQEAAA== X-Change-ID: 20260727-kexec_posioned-72bb0a4143a0 To: Andrew Morton , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Baoquan He , Pasha Tatashin , Pratyush Yadav , Miaohe Lin , Naoya Horiguchi , pratyush@kernel.org Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, kexec@lists.infradead.org, rmikey@meta.com, riel@surriel.com, kernel-team@meta.com, Kiryl Shutsemau , Breno Leitao X-Mailer: b4 0.16-dev-f8e9d X-Developer-Signature: v=1; a=openpgp-sha256; l=9097; i=leitao@debian.org; h=from:subject:message-id; bh=SWLUcI/DF2JhAszQhmn2J1XYAQICne5Kz7Jfs0Ci4Cs=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBqdeY1kEEZkJGz1XhZQ+IcaILAez7sq3dqPdKGM QXOYA6OzZyJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCanXmNQAKCRA1o5Of/Hh3 bWyeD/4zPXn1gQcSq4LJXP5wG6c1SwzSBFOrrPUWDFCNsSYbIfwrDkgXtBHmz7YiAK5oAMfaKeR PLCZybD3wwgN2md5wVg6+bKGjvDYZYVgpHlcLeLs9UtICZlI3dQJtVAdLUt9OCLTcf7U36VIQcp GtbED8jGl6S+T7rpw1fVx9csCJunaGfM2LWLgqR6vNqt6Bxhzzm4rVeoxmXiurlTDZ2kGM9olJz q6EfFlIqEKdTCFW7Gq2JZ0zWhKWL/DLeJCM/RzxWXBZarDQHs3c5jbclYLR3ApCinTqeZV41/7S Gyk5Vh1Lg2HdP511r29Jp8o1w5zGUkTzsmqze8CwdKaUDzytRQAz0s2rlVMfI47cihK7x32IIWY 4FL3hDINkgryiY1K5fL6Rca2eFEckuSE2ywPyV30LCLqYYVonnSaw88wBXQzYyj48icJG/+llY3 84YlUxbJRUm9ebqzu2OuwZ0XPH3kkFMcVQwfiw3D4AIudmS6Ytl06f21cPFniFY4GPGUgY8xeAw 2ZUC/H7hMY1UCXCz45aa2bnXiECcGCOJt8uSFxBA6RnYGiPcpTv5oTbPtN4Fw/R9ro+HtRkO0yX hUx2ygcacZUmH7d03CaUNuT3SM3tcK1FjypWJFqubND/69b6UjhBHqmJzUFAUU7wDWJbUIxfP1O ljVFxeb1lznK6Pw== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D X-Debian-User: leitao Memory failures (such as unrecoverable ECCs errors) are getting more and more common. The kernel knows how to handle it while running, marking it as poisoned (and SIGBUS user tasks). Poisoned memory is removed from the buddy allocator, but, not from other places. A current problem is that kexec will load new kernel on top of a bad/poisoned memory, which is undesirable. If the next kernel's image, initrd or purgatory lands on poisoned frame, the relocation copy writes to the bad memory and the machine checks during the kexec. Skip hardware-poisoned frames when placing segments: check them in the kexec_file hole finder so it lays the next kernel down on good memory, and reject a poisoned destination in sanity_check_segment_list() for the kexec_load path, which cannot relocate. The two hole finders walk in opposite directions, so each asks for the end of the poison it has to clear: the top-down walk for the first poisoned page in the window, the bottom-up walk for the last. A poisoned hugetlb folio counts in full, as hugetlb keeps the flag on the folio and the poisoned subpages on its raw hwpoison list. Suggested-by: Kiryl Shutsemau Signed-off-by: Breno Leitao --- Changes in v4: - Anchor the top-down hole finder on the first poisoned page in the window and the bottom-up one on the last, so each jumps clear of the poison in one step. New range_first_hwpoison(). (Kiryl Shutsemau) - Count a poisoned hugetlb folio in full: the flag lives on the folio, not on the subpages, so the per-pfn scan missed poisoned tail pages. (Kiryl Shutsemau) - Link to v3: https://patch.msgid.link/20260803-kexec_posioned-v3-1-83aa6ed= e0351@debian.org Changes in v3: - Return the address of the last poisoned page in the range, or PHYS_ADDR_MAX when it is clean, instead of a bool plus an output parameter. Renamed to range_last_hwpoison(). (Pratyush Yadav) - Add cond_resched() to the scan loop, as a segment can span half of memory. (Sashiko) - Link to v2: https://patch.msgid.link/20260730-kexec_posioned-v2-1-f92d185= 51f64@debian.org Changes in v2: - Change from pfn_to_page() to pfn_to_online_page(). (Miaohe Lin) - Return the poisoned address once we find a hit, to avoid the O(n^2) rescan. (Sashiko) - Link to v1: https://patch.msgid.link/20260728-kexec_posioned-v1-1-160c81d= 180fe@debian.org To: Andrew Morton To: David Hildenbrand To: Lorenzo Stoakes To: "Liam R. Howlett" To: Vlastimil Babka To: Mike Rapoport To: Suren Baghdasaryan To: Michal Hocko To: Baoquan He To: Pasha Tatashin To: Pratyush Yadav To: Miaohe Lin To: Naoya Horiguchi Cc: linux-mm@kvack.org Cc: linux-kernel@vger.kernel.org Cc: kexec@lists.infradead.org --- include/linux/mm.h | 14 +++++++++++ kernel/kexec_core.c | 10 ++++++++ kernel/kexec_file.c | 18 ++++++++++++++ mm/memory-failure.c | 72 +++++++++++++++++++++++++++++++++++++++++++++++++= ++++ 4 files changed, 114 insertions(+) diff --git a/include/linux/mm.h b/include/linux/mm.h index 7fabe6c66b4b7..41b923901b193 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -5192,6 +5192,8 @@ extern const struct attribute_group memory_failure_at= tr_group; extern void memory_failure_queue(unsigned long pfn, int flags); void num_poisoned_pages_inc(unsigned long pfn); void num_poisoned_pages_sub(unsigned long pfn, long i); +phys_addr_t range_first_hwpoison(phys_addr_t start, unsigned long size); +phys_addr_t range_last_hwpoison(phys_addr_t start, unsigned long size); #else static inline void memory_failure_queue(unsigned long pfn, int flags) { @@ -5204,6 +5206,18 @@ static inline void num_poisoned_pages_inc(unsigned l= ong pfn) static inline void num_poisoned_pages_sub(unsigned long pfn, long i) { } + +static inline phys_addr_t range_first_hwpoison(phys_addr_t start, + unsigned long size) +{ + return PHYS_ADDR_MAX; +} + +static inline phys_addr_t range_last_hwpoison(phys_addr_t start, + unsigned long size) +{ + return PHYS_ADDR_MAX; +} #endif =20 #if defined(CONFIG_MEMORY_FAILURE) && defined(CONFIG_MEMORY_HOTPLUG) diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c index dc770b9a6d053..e097e980b1439 100644 --- a/kernel/kexec_core.c +++ b/kernel/kexec_core.c @@ -212,6 +212,16 @@ int sanity_check_segment_list(struct kimage *image) } #endif =20 + /* + * Reject destinations that land on hardware-poisoned memory: the + * relocation copy would machine-check on the bad frame. + */ + for (i =3D 0; i < nr_segments; i++) { + if (range_first_hwpoison(image->segment[i].mem, + image->segment[i].memsz) !=3D PHYS_ADDR_MAX) + return -EADDRNOTAVAIL; + } + /* * The destination addresses are searched from system RAM rather than * being allocated from the buddy allocator, so they are not guaranteed diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 59fb9d71e9d86..9ba6cc01af929 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -475,6 +475,7 @@ static int locate_mem_hole_top_down(unsigned long start= , unsigned long end, { struct kimage *image =3D kbuf->image; unsigned long temp_start, temp_end; + phys_addr_t poison; =20 temp_end =3D min(end, kbuf->buf_max); temp_start =3D temp_end - kbuf->memsz + 1; @@ -504,6 +505,15 @@ static int locate_mem_hole_top_down(unsigned long star= t, unsigned long end, continue; } =20 + poison =3D range_first_hwpoison(temp_start, kbuf->memsz); + if (poison !=3D PHYS_ADDR_MAX) { + /* we hit a poisoned page */ + if (poison < kbuf->memsz) + return 0; + temp_start =3D poison - kbuf->memsz; + continue; + } + /* We found a suitable memory range */ break; } while (1); @@ -520,6 +530,7 @@ static int locate_mem_hole_bottom_up(unsigned long star= t, unsigned long end, { struct kimage *image =3D kbuf->image; unsigned long temp_start, temp_end; + phys_addr_t poison; =20 temp_start =3D max(start, kbuf->buf_min); =20 @@ -546,6 +557,13 @@ static int locate_mem_hole_bottom_up(unsigned long sta= rt, unsigned long end, continue; } =20 + poison =3D range_last_hwpoison(temp_start, kbuf->memsz); + if (poison !=3D PHYS_ADDR_MAX) { + /* we hit a poisoned page */ + temp_start =3D poison + PAGE_SIZE; + continue; + } + /* We found a suitable memory range */ break; } while (1); diff --git a/mm/memory-failure.c b/mm/memory-failure.c index a8b03e2920ba8..c485e205fb633 100644 --- a/mm/memory-failure.c +++ b/mm/memory-failure.c @@ -96,6 +96,78 @@ void num_poisoned_pages_sub(unsigned long pfn, long i) memblk_nr_poison_sub(pfn, i); } =20 +/* + * Return the first or the last hardware-poisoned online page in [start, + * start + size), or PHYS_ADDR_MAX if the range is clean. + */ +static phys_addr_t range_hwpoison(phys_addr_t start, unsigned long size, + bool first) +{ + phys_addr_t poison =3D PHYS_ADDR_MAX; + unsigned long pfn, end_pfn; + + if (!size || !atomic_long_read(&num_poisoned_pages)) + return poison; + + end_pfn =3D PHYS_PFN(start + size - 1); + for (pfn =3D PHYS_PFN(start); pfn <=3D end_pfn; pfn++) { + struct page *page =3D pfn_to_online_page(pfn); + struct folio *folio; + + cond_resched(); + + if (!page) + continue; + + folio =3D page_folio(page); + if (folio_test_hugetlb(folio)) { + /* + * hugetlbfs is a bit special, given the poison + * information is at the folio, not at the page + */ + unsigned long folio_end; + + /* + * No hugetlb_lock: the scan is racy either way, a frame + * can be poisoned right after it. Just don't let a folio + * dissolved under us walk the scan backwards. + */ + folio_end =3D folio_pfn(folio) + folio_nr_pages(folio) - 1; + folio_end =3D max(folio_end, pfn); + + if (folio_test_hwpoison(folio)) { + if (first) + return PFN_PHYS(pfn); + poison =3D PFN_PHYS(min(folio_end, end_pfn)); + } + /* skip all the pfns that belong to hugetlb */ + pfn =3D folio_end; + continue; + } + + if (!PageHWPoison(page)) + /* page is good, let's go to the next one */ + continue; + + if (first) + return PFN_PHYS(pfn); + + poison =3D PFN_PHYS(pfn); + } + + return poison; +} + +phys_addr_t range_first_hwpoison(phys_addr_t start, unsigned long size) +{ + return range_hwpoison(start, size, true); +} + +phys_addr_t range_last_hwpoison(phys_addr_t start, unsigned long size) +{ + return range_hwpoison(start, size, false); +} + /** * MF_ATTR_RO - Create sysfs entry for each memory failure statistics. * @_name: name of the file in the per NUMA sysfs directory. --- base-commit: c5e32e86ca02b003f86e095d379b38148999293d change-id: 20260727-kexec_posioned-72bb0a4143a0 Best regards, -- =20 Breno Leitao