linux/kernel/panic.c
<<
>>
Prefs
   1/*
   2 *  linux/kernel/panic.c
   3 *
   4 *  Copyright (C) 1991, 1992  Linus Torvalds
   5 */
   6
   7/*
   8 * This function is used through-out the kernel (including mm and fs)
   9 * to indicate a major problem.
  10 */
  11#include <linux/debug_locks.h>
  12#include <linux/interrupt.h>
  13#include <linux/kmsg_dump.h>
  14#include <linux/kallsyms.h>
  15#include <linux/notifier.h>
  16#include <linux/module.h>
  17#include <linux/random.h>
  18#include <linux/ftrace.h>
  19#include <linux/reboot.h>
  20#include <linux/delay.h>
  21#include <linux/kexec.h>
  22#include <linux/sched.h>
  23#include <linux/sysrq.h>
  24#include <linux/init.h>
  25#include <linux/nmi.h>
  26#include <linux/console.h>
  27#include <linux/bug.h>
  28
  29#define PANIC_TIMER_STEP 100
  30#define PANIC_BLINK_SPD 18
  31
  32int panic_on_oops = CONFIG_PANIC_ON_OOPS_VALUE;
  33static unsigned long tainted_mask;
  34static int pause_on_oops;
  35static int pause_on_oops_flag;
  36static DEFINE_SPINLOCK(pause_on_oops_lock);
  37bool crash_kexec_post_notifiers;
  38int panic_on_warn __read_mostly;
  39
  40int panic_timeout = CONFIG_PANIC_TIMEOUT;
  41EXPORT_SYMBOL_GPL(panic_timeout);
  42
  43ATOMIC_NOTIFIER_HEAD(panic_notifier_list);
  44
  45EXPORT_SYMBOL(panic_notifier_list);
  46
  47static long no_blink(int state)
  48{
  49        return 0;
  50}
  51
  52/* Returns how long it waited in ms */
  53long (*panic_blink)(int state);
  54EXPORT_SYMBOL(panic_blink);
  55
  56/*
  57 * Stop ourself in panic -- architecture code may override this
  58 */
  59void __weak panic_smp_self_stop(void)
  60{
  61        while (1)
  62                cpu_relax();
  63}
  64
  65/*
  66 * Stop ourselves in NMI context if another CPU has already panicked. Arch code
  67 * may override this to prepare for crash dumping, e.g. save regs info.
  68 */
  69void __weak nmi_panic_self_stop(struct pt_regs *regs)
  70{
  71        panic_smp_self_stop();
  72}
  73
  74/*
  75 * Stop other CPUs in panic.  Architecture dependent code may override this
  76 * with more suitable version.  For example, if the architecture supports
  77 * crash dump, it should save registers of each stopped CPU and disable
  78 * per-CPU features such as virtualization extensions.
  79 */
  80void __weak crash_smp_send_stop(void)
  81{
  82        static int cpus_stopped;
  83
  84        /*
  85         * This function can be called twice in panic path, but obviously
  86         * we execute this only once.
  87         */
  88        if (cpus_stopped)
  89                return;
  90
  91        /*
  92         * Note smp_send_stop is the usual smp shutdown function, which
  93         * unfortunately means it may not be hardened to work in a panic
  94         * situation.
  95         */
  96        smp_send_stop();
  97        cpus_stopped = 1;
  98}
  99
 100atomic_t panic_cpu = ATOMIC_INIT(PANIC_CPU_INVALID);
 101
 102/*
 103 * A variant of panic() called from NMI context. We return if we've already
 104 * panicked on this CPU. If another CPU already panicked, loop in
 105 * nmi_panic_self_stop() which can provide architecture dependent code such
 106 * as saving register state for crash dump.
 107 */
 108void nmi_panic(struct pt_regs *regs, const char *msg)
 109{
 110        int old_cpu, cpu;
 111
 112        cpu = raw_smp_processor_id();
 113        old_cpu = atomic_cmpxchg(&panic_cpu, PANIC_CPU_INVALID, cpu);
 114
 115        if (old_cpu == PANIC_CPU_INVALID)
 116                panic("%s", msg);
 117        else if (old_cpu != cpu)
 118                nmi_panic_self_stop(regs);
 119}
 120EXPORT_SYMBOL(nmi_panic);
 121
 122/**
 123 *      panic - halt the system
 124 *      @fmt: The text string to print
 125 *
 126 *      Display a message, then perform cleanups.
 127 *
 128 *      This function never returns.
 129 */
 130void panic(const char *fmt, ...)
 131{
 132        static char buf[1024];
 133        va_list args;
 134        long i, i_next = 0;
 135        int state = 0;
 136        int old_cpu, this_cpu;
 137        bool _crash_kexec_post_notifiers = crash_kexec_post_notifiers;
 138
 139        /*
 140         * Disable local interrupts. This will prevent panic_smp_self_stop
 141         * from deadlocking the first cpu that invokes the panic, since
 142         * there is nothing to prevent an interrupt handler (that runs
 143         * after setting panic_cpu) from invoking panic() again.
 144         */
 145        local_irq_disable();
 146
 147        /*
 148         * It's possible to come here directly from a panic-assertion and
 149         * not have preempt disabled. Some functions called from here want
 150         * preempt to be disabled. No point enabling it later though...
 151         *
 152         * Only one CPU is allowed to execute the panic code from here. For
 153         * multiple parallel invocations of panic, all other CPUs either
 154         * stop themself or will wait until they are stopped by the 1st CPU
 155         * with smp_send_stop().
 156         *
 157         * `old_cpu == PANIC_CPU_INVALID' means this is the 1st CPU which
 158         * comes here, so go ahead.
 159         * `old_cpu == this_cpu' means we came from nmi_panic() which sets
 160         * panic_cpu to this CPU.  In this case, this is also the 1st CPU.
 161         */
 162        this_cpu = raw_smp_processor_id();
 163        old_cpu  = atomic_cmpxchg(&panic_cpu, PANIC_CPU_INVALID, this_cpu);
 164
 165        if (old_cpu != PANIC_CPU_INVALID && old_cpu != this_cpu)
 166                panic_smp_self_stop();
 167
 168        console_verbose();
 169        bust_spinlocks(1);
 170        va_start(args, fmt);
 171        vsnprintf(buf, sizeof(buf), fmt, args);
 172        va_end(args);
 173        pr_emerg("Kernel panic - not syncing: %s\n", buf);
 174#ifdef CONFIG_DEBUG_BUGVERBOSE
 175        /*
 176         * Avoid nested stack-dumping if a panic occurs during oops processing
 177         */
 178        if (!test_taint(TAINT_DIE) && oops_in_progress <= 1)
 179                dump_stack();
 180#endif
 181
 182        /*
 183         * If we have crashed and we have a crash kernel loaded let it handle
 184         * everything else.
 185         * If we want to run this after calling panic_notifiers, pass
 186         * the "crash_kexec_post_notifiers" option to the kernel.
 187         *
 188         * Bypass the panic_cpu check and call __crash_kexec directly.
 189         */
 190        if (!_crash_kexec_post_notifiers) {
 191                printk_nmi_flush_on_panic();
 192                __crash_kexec(NULL);
 193
 194                /*
 195                 * Note smp_send_stop is the usual smp shutdown function, which
 196                 * unfortunately means it may not be hardened to work in a
 197                 * panic situation.
 198                 */
 199                smp_send_stop();
 200        } else {
 201                /*
 202                 * If we want to do crash dump after notifier calls and
 203                 * kmsg_dump, we will need architecture dependent extra
 204                 * works in addition to stopping other CPUs.
 205                 */
 206                crash_smp_send_stop();
 207        }
 208
 209        /*
 210         * Run any panic handlers, including those that might need to
 211         * add information to the kmsg dump output.
 212         */
 213        atomic_notifier_call_chain(&panic_notifier_list, 0, buf);
 214
 215        /* Call flush even twice. It tries harder with a single online CPU */
 216        printk_nmi_flush_on_panic();
 217        kmsg_dump(KMSG_DUMP_PANIC);
 218
 219        /*
 220         * If you doubt kdump always works fine in any situation,
 221         * "crash_kexec_post_notifiers" offers you a chance to run
 222         * panic_notifiers and dumping kmsg before kdump.
 223         * Note: since some panic_notifiers can make crashed kernel
 224         * more unstable, it can increase risks of the kdump failure too.
 225         *
 226         * Bypass the panic_cpu check and call __crash_kexec directly.
 227         */
 228        if (_crash_kexec_post_notifiers)
 229                __crash_kexec(NULL);
 230
 231        bust_spinlocks(0);
 232
 233        /*
 234         * We may have ended up stopping the CPU holding the lock (in
 235         * smp_send_stop()) while still having some valuable data in the console
 236         * buffer.  Try to acquire the lock then release it regardless of the
 237         * result.  The release will also print the buffers out.  Locks debug
 238         * should be disabled to avoid reporting bad unlock balance when
 239         * panic() is not being callled from OOPS.
 240         */
 241        debug_locks_off();
 242        console_flush_on_panic();
 243
 244        if (!panic_blink)
 245                panic_blink = no_blink;
 246
 247        if (panic_timeout > 0) {
 248                /*
 249                 * Delay timeout seconds before rebooting the machine.
 250                 * We can't use the "normal" timers since we just panicked.
 251                 */
 252                pr_emerg("Rebooting in %d seconds..", panic_timeout);
 253
 254                for (i = 0; i < panic_timeout * 1000; i += PANIC_TIMER_STEP) {
 255                        touch_nmi_watchdog();
 256                        if (i >= i_next) {
 257                                i += panic_blink(state ^= 1);
 258                                i_next = i + 3600 / PANIC_BLINK_SPD;
 259                        }
 260                        mdelay(PANIC_TIMER_STEP);
 261                }
 262        }
 263        if (panic_timeout != 0) {
 264                /*
 265                 * This will not be a clean reboot, with everything
 266                 * shutting down.  But if there is a chance of
 267                 * rebooting the system it will be rebooted.
 268                 */
 269                emergency_restart();
 270        }
 271#ifdef __sparc__
 272        {
 273                extern int stop_a_enabled;
 274                /* Make sure the user can actually press Stop-A (L1-A) */
 275                stop_a_enabled = 1;
 276                pr_emerg("Press Stop-A (L1-A) to return to the boot prom\n");
 277        }
 278#endif
 279#if defined(CONFIG_S390)
 280        {
 281                unsigned long caller;
 282
 283                caller = (unsigned long)__builtin_return_address(0);
 284                disabled_wait(caller);
 285        }
 286#endif
 287        pr_emerg("---[ end Kernel panic - not syncing: %s\n", buf);
 288        local_irq_enable();
 289        for (i = 0; ; i += PANIC_TIMER_STEP) {
 290                touch_softlockup_watchdog();
 291                if (i >= i_next) {
 292                        i += panic_blink(state ^= 1);
 293                        i_next = i + 3600 / PANIC_BLINK_SPD;
 294                }
 295                mdelay(PANIC_TIMER_STEP);
 296        }
 297}
 298
 299EXPORT_SYMBOL(panic);
 300
 301
 302struct tnt {
 303        u8      bit;
 304        char    true;
 305        char    false;
 306};
 307
 308static const struct tnt tnts[] = {
 309        { TAINT_PROPRIETARY_MODULE,     'P', 'G' },
 310        { TAINT_FORCED_MODULE,          'F', ' ' },
 311        { TAINT_CPU_OUT_OF_SPEC,        'S', ' ' },
 312        { TAINT_FORCED_RMMOD,           'R', ' ' },
 313        { TAINT_MACHINE_CHECK,          'M', ' ' },
 314        { TAINT_BAD_PAGE,               'B', ' ' },
 315        { TAINT_USER,                   'U', ' ' },
 316        { TAINT_DIE,                    'D', ' ' },
 317        { TAINT_OVERRIDDEN_ACPI_TABLE,  'A', ' ' },
 318        { TAINT_WARN,                   'W', ' ' },
 319        { TAINT_CRAP,                   'C', ' ' },
 320        { TAINT_FIRMWARE_WORKAROUND,    'I', ' ' },
 321        { TAINT_OOT_MODULE,             'O', ' ' },
 322        { TAINT_UNSIGNED_MODULE,        'E', ' ' },
 323        { TAINT_SOFTLOCKUP,             'L', ' ' },
 324        { TAINT_LIVEPATCH,              'K', ' ' },
 325};
 326
 327/**
 328 *      print_tainted - return a string to represent the kernel taint state.
 329 *
 330 *  'P' - Proprietary module has been loaded.
 331 *  'F' - Module has been forcibly loaded.
 332 *  'S' - SMP with CPUs not designed for SMP.
 333 *  'R' - User forced a module unload.
 334 *  'M' - System experienced a machine check exception.
 335 *  'B' - System has hit bad_page.
 336 *  'U' - Userspace-defined naughtiness.
 337 *  'D' - Kernel has oopsed before
 338 *  'A' - ACPI table overridden.
 339 *  'W' - Taint on warning.
 340 *  'C' - modules from drivers/staging are loaded.
 341 *  'I' - Working around severe firmware bug.
 342 *  'O' - Out-of-tree module has been loaded.
 343 *  'E' - Unsigned module has been loaded.
 344 *  'L' - A soft lockup has previously occurred.
 345 *  'K' - Kernel has been live patched.
 346 *
 347 *      The string is overwritten by the next call to print_tainted().
 348 */
 349const char *print_tainted(void)
 350{
 351        static char buf[ARRAY_SIZE(tnts) + sizeof("Tainted: ")];
 352
 353        if (tainted_mask) {
 354                char *s;
 355                int i;
 356
 357                s = buf + sprintf(buf, "Tainted: ");
 358                for (i = 0; i < ARRAY_SIZE(tnts); i++) {
 359                        const struct tnt *t = &tnts[i];
 360                        *s++ = test_bit(t->bit, &tainted_mask) ?
 361                                        t->true : t->false;
 362                }
 363                *s = 0;
 364        } else
 365                snprintf(buf, sizeof(buf), "Not tainted");
 366
 367        return buf;
 368}
 369
 370int test_taint(unsigned flag)
 371{
 372        return test_bit(flag, &tainted_mask);
 373}
 374EXPORT_SYMBOL(test_taint);
 375
 376unsigned long get_taint(void)
 377{
 378        return tainted_mask;
 379}
 380
 381/**
 382 * add_taint: add a taint flag if not already set.
 383 * @flag: one of the TAINT_* constants.
 384 * @lockdep_ok: whether lock debugging is still OK.
 385 *
 386 * If something bad has gone wrong, you'll want @lockdebug_ok = false, but for
 387 * some notewortht-but-not-corrupting cases, it can be set to true.
 388 */
 389void add_taint(unsigned flag, enum lockdep_ok lockdep_ok)
 390{
 391        if (lockdep_ok == LOCKDEP_NOW_UNRELIABLE && __debug_locks_off())
 392                pr_warn("Disabling lock debugging due to kernel taint\n");
 393
 394        set_bit(flag, &tainted_mask);
 395}
 396EXPORT_SYMBOL(add_taint);
 397
 398static void spin_msec(int msecs)
 399{
 400        int i;
 401
 402        for (i = 0; i < msecs; i++) {
 403                touch_nmi_watchdog();
 404                mdelay(1);
 405        }
 406}
 407
 408/*
 409 * It just happens that oops_enter() and oops_exit() are identically
 410 * implemented...
 411 */
 412static void do_oops_enter_exit(void)
 413{
 414        unsigned long flags;
 415        static int spin_counter;
 416
 417        if (!pause_on_oops)
 418                return;
 419
 420        spin_lock_irqsave(&pause_on_oops_lock, flags);
 421        if (pause_on_oops_flag == 0) {
 422                /* This CPU may now print the oops message */
 423                pause_on_oops_flag = 1;
 424        } else {
 425                /* We need to stall this CPU */
 426                if (!spin_counter) {
 427                        /* This CPU gets to do the counting */
 428                        spin_counter = pause_on_oops;
 429                        do {
 430                                spin_unlock(&pause_on_oops_lock);
 431                                spin_msec(MSEC_PER_SEC);
 432                                spin_lock(&pause_on_oops_lock);
 433                        } while (--spin_counter);
 434                        pause_on_oops_flag = 0;
 435                } else {
 436                        /* This CPU waits for a different one */
 437                        while (spin_counter) {
 438                                spin_unlock(&pause_on_oops_lock);
 439                                spin_msec(1);
 440                                spin_lock(&pause_on_oops_lock);
 441                        }
 442                }
 443        }
 444        spin_unlock_irqrestore(&pause_on_oops_lock, flags);
 445}
 446
 447/*
 448 * Return true if the calling CPU is allowed to print oops-related info.
 449 * This is a bit racy..
 450 */
 451int oops_may_print(void)
 452{
 453        return pause_on_oops_flag == 0;
 454}
 455
 456/*
 457 * Called when the architecture enters its oops handler, before it prints
 458 * anything.  If this is the first CPU to oops, and it's oopsing the first
 459 * time then let it proceed.
 460 *
 461 * This is all enabled by the pause_on_oops kernel boot option.  We do all
 462 * this to ensure that oopses don't scroll off the screen.  It has the
 463 * side-effect of preventing later-oopsing CPUs from mucking up the display,
 464 * too.
 465 *
 466 * It turns out that the CPU which is allowed to print ends up pausing for
 467 * the right duration, whereas all the other CPUs pause for twice as long:
 468 * once in oops_enter(), once in oops_exit().
 469 */
 470void oops_enter(void)
 471{
 472        tracing_off();
 473        /* can't trust the integrity of the kernel anymore: */
 474        debug_locks_off();
 475        do_oops_enter_exit();
 476}
 477
 478/*
 479 * 64-bit random ID for oopses:
 480 */
 481static u64 oops_id;
 482
 483static int init_oops_id(void)
 484{
 485        if (!oops_id)
 486                get_random_bytes(&oops_id, sizeof(oops_id));
 487        else
 488                oops_id++;
 489
 490        return 0;
 491}
 492late_initcall(init_oops_id);
 493
 494void print_oops_end_marker(void)
 495{
 496        init_oops_id();
 497        pr_warn("---[ end trace %016llx ]---\n", (unsigned long long)oops_id);
 498}
 499
 500/*
 501 * Called when the architecture exits its oops handler, after printing
 502 * everything.
 503 */
 504void oops_exit(void)
 505{
 506        do_oops_enter_exit();
 507        print_oops_end_marker();
 508        kmsg_dump(KMSG_DUMP_OOPS);
 509}
 510
 511struct warn_args {
 512        const char *fmt;
 513        va_list args;
 514};
 515
 516void __warn(const char *file, int line, void *caller, unsigned taint,
 517            struct pt_regs *regs, struct warn_args *args)
 518{
 519        disable_trace_on_warning();
 520
 521        pr_warn("------------[ cut here ]------------\n");
 522
 523        if (file)
 524                pr_warn("WARNING: CPU: %d PID: %d at %s:%d %pS\n",
 525                        raw_smp_processor_id(), current->pid, file, line,
 526                        caller);
 527        else
 528                pr_warn("WARNING: CPU: %d PID: %d at %pS\n",
 529                        raw_smp_processor_id(), current->pid, caller);
 530
 531        if (args)
 532                vprintk(args->fmt, args->args);
 533
 534        if (panic_on_warn) {
 535                /*
 536                 * This thread may hit another WARN() in the panic path.
 537                 * Resetting this prevents additional WARN() from panicking the
 538                 * system on this thread.  Other threads are blocked by the
 539                 * panic_mutex in panic().
 540                 */
 541                panic_on_warn = 0;
 542                panic("panic_on_warn set ...\n");
 543        }
 544
 545        print_modules();
 546
 547        if (regs)
 548                show_regs(regs);
 549        else
 550                dump_stack();
 551
 552        print_oops_end_marker();
 553
 554        /* Just a warning, don't kill lockdep. */
 555        add_taint(taint, LOCKDEP_STILL_OK);
 556}
 557
 558#ifdef WANT_WARN_ON_SLOWPATH
 559void warn_slowpath_fmt(const char *file, int line, const char *fmt, ...)
 560{
 561        struct warn_args args;
 562
 563        args.fmt = fmt;
 564        va_start(args.args, fmt);
 565        __warn(file, line, __builtin_return_address(0), TAINT_WARN, NULL,
 566               &args);
 567        va_end(args.args);
 568}
 569EXPORT_SYMBOL(warn_slowpath_fmt);
 570
 571void warn_slowpath_fmt_taint(const char *file, int line,
 572                             unsigned taint, const char *fmt, ...)
 573{
 574        struct warn_args args;
 575
 576        args.fmt = fmt;
 577        va_start(args.args, fmt);
 578        __warn(file, line, __builtin_return_address(0), taint, NULL, &args);
 579        va_end(args.args);
 580}
 581EXPORT_SYMBOL(warn_slowpath_fmt_taint);
 582
 583void warn_slowpath_null(const char *file, int line)
 584{
 585        __warn(file, line, __builtin_return_address(0), TAINT_WARN, NULL, NULL);
 586}
 587EXPORT_SYMBOL(warn_slowpath_null);
 588#endif
 589
 590#ifdef CONFIG_CC_STACKPROTECTOR
 591
 592/*
 593 * Called when gcc's -fstack-protector feature is used, and
 594 * gcc detects corruption of the on-stack canary value
 595 */
 596__visible void __stack_chk_fail(void)
 597{
 598        panic("stack-protector: Kernel stack is corrupted in: %p\n",
 599                __builtin_return_address(0));
 600}
 601EXPORT_SYMBOL(__stack_chk_fail);
 602
 603#endif
 604
 605core_param(panic, panic_timeout, int, 0644);
 606core_param(pause_on_oops, pause_on_oops, int, 0644);
 607core_param(panic_on_warn, panic_on_warn, int, 0644);
 608core_param(crash_kexec_post_notifiers, crash_kexec_post_notifiers, bool, 0644);
 609
 610static int __init oops_setup(char *s)
 611{
 612        if (!s)
 613                return -EINVAL;
 614        if (!strcmp(s, "panic"))
 615                panic_on_oops = 1;
 616        return 0;
 617}
 618early_param("oops", oops_setup);
 619