Re: [PATCH 0/4] kdump: crashkernel reservation from CMA

[Baoquan He]

Hi Michal,

On 11/30/23 at 08:04pm, Baoquan He wrote:
> On 11/30/23 at 11:16am, Michal Hocko wrote:
> > On Thu 30-11-23 11:00:48, Baoquan He wrote:
> > [...]
> > > Now, we are worried if there's risk if the CMA area is retaken into kdump
> > > kernel as system RAM. E.g is it possible that 1st kernel's ongoing RDMA
> > > or DMA will interfere with kdump kernel's normal memory accessing?
> > > Because kdump kernel usually only reset and initialize the needed
> > > device, e.g dump target. Those unneeded devices will be unshutdown and
> > > let go. 


Re-read your mail, we are saying the same thing, Please ignore the
words at bottom from my last mail.

> > 
> > I do not really want to discount your concerns but I am bit confused why
> > this matters so much. First of all, if there is a buggy RDMA driver

Not buggy DMA or RDMA driver. This is decided by kdump mechanism. When
we do kexec reboot, we shutdown cpu, interrupt, all devicees. When we do
kdump, we only shutdown cpu, interrupt.

> > which doesn't use the proper pinning API (which would migrate away from
> > the CMA) then what is the worst case? We will get crash kernel corrupted
> > potentially and fail to take a proper kernel crash, right? Is this
> > worrisome? Yes. Is it a real roadblock? I do not think so. The problem

We may fail to take a proper kernel crash, why isn't it a roadblock? We
have stable way with a little more memory, why would we take risk to
take another way, just for saving memory? Usually only high end server
needs the big memory for crashkernel and the big end server usually have
huge system ram. The big memory will be a very small percentage relative
to huge system RAM.

> > seems theoretical to me and it is not CMA usage at fault here IMHO. It
> > is the said theoretical driver that needs fixing anyway.

Now, what we want to make clear is if it's a theoretical possibility, or
very likely happen. We have met several on-flight DMA stomping into
kexec kernel's initrd in the past two years because device driver didn't
provide shutdown() methor properly. For kdump, once it happen, the pain
is we don't know how to debug. For kexec reboot, customer allows to
login their system to reproduce and figure out the stomping. For kdump,
the system corruption rarely happend, and the stomping could rarely
happen too.

The code change looks simple and the benefit is very attractive. I
surely like it if finally people confirm there's no risk. As I said, we
can't afford to take the risk if it possibly happen. But I don't object
if other people would rather take risk, we can let it land in kernel.

My personal opinion, thanks for sharing your thought.

> > 
> > Now, it is really fair to mention that CMA backed crash kernel memory
> > has some limitations
> > 	- CMA reservation can only be used by the userspace in the
> > 	  primary kernel. If the size is overshot this might have
> > 	  negative impact on kernel allocations
> > 	- userspace memory dumping in the crash kernel is fundamentally
> > 	  incomplete.
> 
> I am not sure if we are talking about the same thing. My concern is:
> ====================================================================
> 1) system corrutption happened, crash dumping is prepared, cpu and
> interrupt controllers are shutdown;
> 2) all pci devices are kept alive;
> 3) kdump kernel boot up, initialization is only done on those devices
> which drivers are added into kdump kernel's initrd;
> 4) those on-flight DMA engine could be still working if their kernel
> module is not loaded;
> 
> In this case, if the DMA's destination is located in crashkernel=,cma
> region, the DMA writting could continue even when kdump kernel has put
> important kernel data into the area. Is this possible or absolutely not
> possible with DMA, RDMA, or any other stuff which could keep accessing
> that area?
> 
> The existing crashkernel= syntax can gurantee the reserved crashkernel
> area for kdump kernel is safe.
> =======================================================================
> 
> The 1st kernel's data in the ,cma area is ignored once crashkernel=,cma
> is taken.
>