[PATCH v3] memblock: don't allocate new reserve_mem regions on a KHO boot

[PATCH v3] memblock: don't allocate new reserve_mem regions on a KHO boot

[Jose A. Perez de Azpillaga]

On a KHO boot, a reserve_mem region that can't be revived is allocated
from KHO_NOPRSRV memory, which includes the bootmem the next kernel
boots out of. With CONFIG_KEXEC_HANDOVER_DEBUG, preserving the region
then fails:

  WARNING: kernel/liveupdate/kexec_handover.c:1245 at kho_preserve_pages+0x168/0x180
  failed to prepare memblock FDT for KHO: -22

Without it, the next kernel puts its memmap on top of the region and
the ramoops records in it are lost.

There is no use case for adding regions across a live update, so fail
instead of allocating, and drop the TODO.

Add an is_kho_boot() stub so the memblock tests still build.

Fixes: f99230780211 ("memblock: add KHO support for reserve_mem")
Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
---
Changes in v3:
- add an is_kho_boot() stub to the memblock tests (Mike).
- add Pasha's Reviewed-by.

Changes in v2:
- fail on a KHO boot instead of allocating outside bootmem, as agreed
  with Pratyush [1]. this drops v1's patch 1.
- not an RFC anymore.
- based on v7.4-rc1.

v2: https://lore.kernel.org/all/20261104204235.9066-1-azpijr@gmail.com/
v1: https://lore.kernel.org/all/20261021211058.83483-3-azpijr@gmail.com/

[1] https://lore.kernel.org/all/2vxzfqxglrg6.fsf@kernel.org/

 mm/memblock.c                     | 11 ++++++++++-
 tools/testing/memblock/internal.h |  5 +++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/mm/memblock.c b/mm/memblock.c
index a450092a80fb..e325e0542c9a 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -2827,7 +2827,16 @@ static int __init reserve_mem(char *p)
 	if (reserve_mem_kho_revive(name, size, align))
 		return 1;
 
-	/* TODO: Allocation must be outside of KHO_NOPRSRV region */
+	/*
+	 * On a KHO boot memblock only allocates from KHO_NOPRSRV memory here,
+	 * which includes the bootmem the next kernel boots out of. Only regions
+	 * handed over by the previous kernel are supported.
+	 */
+	if (is_kho_boot()) {
+		pr_err("reserve_mem: can't allocate \"%s\" on a KHO boot\n", name);
+		return -EOPNOTSUPP;
+	}
+
 	start = memblock_phys_alloc(size, align);
 	if (!start) {
 		pr_err("reserve_mem: memblock allocation failed\n");
diff --git a/tools/testing/memblock/internal.h b/tools/testing/memblock/internal.h
index ba4d1c02fde5..84f22a964510 100644
--- a/tools/testing/memblock/internal.h
+++ b/tools/testing/memblock/internal.h
@@ -51,4 +51,9 @@ static inline bool kho_bootmem_overlap(phys_addr_t phys, size_t size)
 	return false;
 }
 
+static inline bool is_kho_boot(void)
+{
+	return false;
+}
+
 #endif

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.56.0

Re: [PATCH v3] memblock: don't allocate new reserve_mem regions on a KHO boot

[Mukesh Pilaniya]

Hi Jose, Thanks for the patch!

On 06/11/26 3:01 am, Jose A. Perez de Azpillaga wrote:
> On a KHO boot, a reserve_mem region that can't be revived is allocated
> from KHO_NOPRSRV memory, which includes the bootmem the next kernel
> boots out of. With CONFIG_KEXEC_HANDOVER_DEBUG, preserving the region
> then fails:
> 
>   WARNING: kernel/liveupdate/kexec_handover.c:1245 at kho_preserve_pages+0x168/0x180
>   failed to prepare memblock FDT for KHO: -22
> 
> Without it, the next kernel puts its memmap on top of the region and
> the ramoops records in it are lost.
> 
> There is no use case for adding regions across a live update, so fail
> instead of allocating, and drop the TODO.
> 
> Add an is_kho_boot() stub so the memblock tests still build.
> 
> Fixes: f99230780211 ("memblock: add KHO support for reserve_mem")
> Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
> Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
> ---
> Changes in v3:
> - add an is_kho_boot() stub to the memblock tests (Mike).
> - add Pasha's Reviewed-by.
> 
> Changes in v2:
> - fail on a KHO boot instead of allocating outside bootmem, as agreed
>   with Pratyush [1]. this drops v1's patch 1.
> - not an RFC anymore.
> - based on v7.4-rc1.
> 
> v2: https://lore.kernel.org/all/20261104204235.9066-1-azpijr@gmail.com/
> v1: https://lore.kernel.org/all/20261021211058.83483-3-azpijr@gmail.com/
> 
> [1] https://lore.kernel.org/all/2vxzfqxglrg6.fsf@kernel.org/
> 
>  mm/memblock.c                     | 11 ++++++++++-
>  tools/testing/memblock/internal.h |  5 +++++
>  2 files changed, 15 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/memblock.c b/mm/memblock.c
> index a450092a80fb..e325e0542c9a 100644
> --- a/mm/memblock.c
> +++ b/mm/memblock.c
> @@ -2827,7 +2827,16 @@ static int __init reserve_mem(char *p)
>  	if (reserve_mem_kho_revive(name, size, align))
>  		return 1;
>  
> -	/* TODO: Allocation must be outside of KHO_NOPRSRV region */
> +	/*
> +	 * On a KHO boot memblock only allocates from KHO_NOPRSRV memory here,
> +	 * which includes the bootmem the next kernel boots out of. Only regions
> +	 * handed over by the previous kernel are supported.
> +	 */
> +	if (is_kho_boot()) {
> +		pr_err("reserve_mem: can't allocate \"%s\" on a KHO boot\n", name);
> +		return -EOPNOTSUPP;
> +	}
I think this over-restricts when KHO is explicitly disabled. kho= is an
early_param parsed before reserve_mem=, but kho_populate records the
incoming FDT without checking kho_enable. So a KHO payload booted with
kho=off ends up with is_kho_boot() == true and kho_is_enabled() ==false.

In that config nothing can be handed over again; reserve_mem_init
returns early on !kho_is_enabled(), and kho_fill_kimage bails on
!kho_enable. Allocating the region from KHO_NOPRSRV is therefore
harmless, and the documented best-effort reserve_mem= behaviour is
preserved.
That said, a new reserve_mem= line is rejected and its ramoops/ftrace
boot-instance consumers lose their region.

So, Would

	if (kho_is_enabled() && is_kho_boot())

be better here? If so, the memblock tests will also need a
kho_is_enabled() stub, since
tools/testing/memblock/linux/kexec_handover.h is empty and reserve_mem()
sits outside the CONFIG_KEXEC_HANDOVER ifdef.

Otherwise, the patch looks good to me.
> +
>  	start = memblock_phys_alloc(size, align);
>  	if (!start) {
>  		pr_err("reserve_mem: memblock allocation failed\n");
> diff --git a/tools/testing/memblock/internal.h b/tools/testing/memblock/internal.h
> index ba4d1c02fde5..84f22a964510 100644
> --- a/tools/testing/memblock/internal.h
> +++ b/tools/testing/memblock/internal.h
> @@ -51,4 +51,9 @@ static inline bool kho_bootmem_overlap(phys_addr_t phys, size_t size)
>  	return false;
>  }
>  
> +static inline bool is_kho_boot(void)
> +{
> +	return false;
> +}
> +
>  #endif
> 
> base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4

-- 
Regards,
Mukesh Pilaniya

Re: [PATCH v3] memblock: don't allocate new reserve_mem regions on a KHO boot

[Jose A. Perez de Azpillaga]

On 11/6/26 4:57 AM, Mukesh Pilaniya wrote:
> Hi Jose, Thanks for the patch!
> 
> On 06/11/26 3:01 am, Jose A. Perez de Azpillaga wrote:
>> On a KHO boot, a reserve_mem region that can't be revived is allocated
>> from KHO_NOPRSRV memory, which includes the bootmem the next kernel
>> boots out of. With CONFIG_KEXEC_HANDOVER_DEBUG, preserving the region
>> then fails:
>>
>>   WARNING: kernel/liveupdate/kexec_handover.c:1245 at kho_preserve_pages+0x168/0x180
>>   failed to prepare memblock FDT for KHO: -22
>>
>> Without it, the next kernel puts its memmap on top of the region and
>> the ramoops records in it are lost.
>>
>> There is no use case for adding regions across a live update, so fail
>> instead of allocating, and drop the TODO.
>>
>> Add an is_kho_boot() stub so the memblock tests still build.
>>
>> Fixes: f99230780211 ("memblock: add KHO support for reserve_mem")
>> Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com>
>> Signed-off-by: Jose A. Perez de Azpillaga <azpijr@gmail.com>
>> ---
>> Changes in v3:
>> - add an is_kho_boot() stub to the memblock tests (Mike).
>> - add Pasha's Reviewed-by.
>>
>> Changes in v2:
>> - fail on a KHO boot instead of allocating outside bootmem, as agreed
>>   with Pratyush [1]. this drops v1's patch 1.
>> - not an RFC anymore.
>> - based on v7.4-rc1.
>>
>> v2: https://lore.kernel.org/all/20261104204235.9066-1-azpijr@gmail.com/
>> v1: https://lore.kernel.org/all/20261021211058.83483-3-azpijr@gmail.com/
>>
>> [1] https://lore.kernel.org/all/2vxzfqxglrg6.fsf@kernel.org/
>>
>>  mm/memblock.c                     | 11 ++++++++++-
>>  tools/testing/memblock/internal.h |  5 +++++
>>  2 files changed, 15 insertions(+), 1 deletion(-)
>>
>> diff --git a/mm/memblock.c b/mm/memblock.c
>> index a450092a80fb..e325e0542c9a 100644
>> --- a/mm/memblock.c
>> +++ b/mm/memblock.c
>> @@ -2827,7 +2827,16 @@ static int __init reserve_mem(char *p)
>>  	if (reserve_mem_kho_revive(name, size, align))
>>  		return 1;
>>  
>> -	/* TODO: Allocation must be outside of KHO_NOPRSRV region */
>> +	/*
>> +	 * On a KHO boot memblock only allocates from KHO_NOPRSRV memory here,
>> +	 * which includes the bootmem the next kernel boots out of. Only regions
>> +	 * handed over by the previous kernel are supported.
>> +	 */
>> +	if (is_kho_boot()) {
>> +		pr_err("reserve_mem: can't allocate \"%s\" on a KHO boot\n", name);
>> +		return -EOPNOTSUPP;
>> +	}
> I think this over-restricts when KHO is explicitly disabled. kho= is an
> early_param parsed before reserve_mem=, but kho_populate records the
> incoming FDT without checking kho_enable. So a KHO payload booted with
> kho=off ends up with is_kho_boot() == true and kho_is_enabled() ==false.
> 
> In that config nothing can be handed over again; reserve_mem_init
> returns early on !kho_is_enabled(), and kho_fill_kimage bails on
> !kho_enable. Allocating the region from KHO_NOPRSRV is therefore
> harmless, and the documented best-effort reserve_mem= behaviour is
> preserved.
> That said, a new reserve_mem= line is rejected and its ramoops/ftrace
> boot-instance consumers lose their region.
> 
> So, Would
> 
> 	if (kho_is_enabled() && is_kho_boot())
> 
> be better here? If so, the memblock tests will also need a
> kho_is_enabled() stub, since
> tools/testing/memblock/linux/kexec_handover.h is empty and reserve_mem()
> sits outside the CONFIG_KEXEC_HANDOVER ifdef.

good catch, will do it in v4 :)

-- 
cheers,
jose a. p-a