projects/linux·blob v7.1-rc7 · refs

1263 lines · 31.6 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * linux/kernel/panic.c
4 *
5 * Copyright (C) 1991, 1992 Linus Torvalds
6 */
7
8/*
9 * This function is used through-out the kernel (including mm and fs)
10 * to indicate a major problem.
11 */
12#include <linux/debug_locks.h>
13#include <linux/sched/debug.h>
14#include <linux/interrupt.h>
15#include <linux/kgdb.h>
16#include <linux/kmsg_dump.h>
17#include <linux/kallsyms.h>
18#include <linux/notifier.h>
19#include <linux/vt_kern.h>
20#include <linux/module.h>
21#include <linux/random.h>
22#include <linux/ftrace.h>
23#include <linux/reboot.h>
24#include <linux/delay.h>
25#include <linux/kexec.h>
26#include <linux/panic_notifier.h>
27#include <linux/sched.h>
28#include <linux/string_helpers.h>
29#include <linux/sysrq.h>
30#include <linux/init.h>
31#include <linux/nmi.h>
32#include <linux/console.h>
33#include <linux/bug.h>
34#include <linux/ratelimit.h>
35#include <linux/debugfs.h>
36#include <linux/sysfs.h>
37#include <linux/context_tracking.h>
38#include <linux/seq_buf.h>
39#include <linux/sys_info.h>
40#include <trace/events/error_report.h>
41#include <asm/sections.h>
42
43#define PANIC_TIMER_STEP 100
44#define PANIC_BLINK_SPD 18
45#define PANIC_MSG_BUFSZ 1024
46
47#ifdef CONFIG_SMP
48/*
49 * Should we dump all CPUs backtraces in an oops event?
50 * Defaults to 0, can be changed via sysctl.
51 */
52static unsigned int __read_mostly sysctl_oops_all_cpu_backtrace;
53#else
54#define sysctl_oops_all_cpu_backtrace 0
55#endif /* CONFIG_SMP */
56
57int panic_on_oops = IS_ENABLED(CONFIG_PANIC_ON_OOPS);
58static unsigned long tainted_mask =
59 IS_ENABLED(CONFIG_RANDSTRUCT) ? (1 << TAINT_RANDSTRUCT) : 0;
60static int pause_on_oops;
61static int pause_on_oops_flag;
62static DEFINE_SPINLOCK(pause_on_oops_lock);
63bool crash_kexec_post_notifiers;
64int panic_on_warn __read_mostly;
65unsigned long panic_on_taint;
66bool panic_on_taint_nousertaint = false;
67static unsigned int warn_limit __read_mostly;
68static bool panic_console_replay;
69
70bool panic_triggering_all_cpu_backtrace;
71static bool panic_this_cpu_backtrace_printed;
72
73int panic_timeout = CONFIG_PANIC_TIMEOUT;
74EXPORT_SYMBOL_GPL(panic_timeout);
75
76unsigned long panic_print;
77
78static int panic_force_cpu = -1;
79
80ATOMIC_NOTIFIER_HEAD(panic_notifier_list);
81
82EXPORT_SYMBOL(panic_notifier_list);
83
84static void panic_print_deprecated(void)
85{
86 pr_info_once("Kernel: The 'panic_print' parameter is now deprecated. Please use 'panic_sys_info' and 'panic_console_replay' instead.\n");
87}
88
89#ifdef CONFIG_SYSCTL
90
91/*
92 * Taint values can only be increased
93 * This means we can safely use a temporary.
94 */
95static int proc_taint(const struct ctl_table *table, int write,
96 void *buffer, size_t *lenp, loff_t *ppos)
97{
98 struct ctl_table t;
99 unsigned long tmptaint = get_taint();
100 int err;
101
102 if (write && !capable(CAP_SYS_ADMIN))
103 return -EPERM;
104
105 t = *table;
106 t.data = &tmptaint;
107 err = proc_doulongvec_minmax(&t, write, buffer, lenp, ppos);
108 if (err < 0)
109 return err;
110
111 if (write) {
112 int i;
113
114 /*
115 * If we are relying on panic_on_taint not producing
116 * false positives due to userspace input, bail out
117 * before setting the requested taint flags.
118 */
119 if (panic_on_taint_nousertaint && (tmptaint & panic_on_taint))
120 return -EINVAL;
121
122 /*
123 * Poor man's atomic or. Not worth adding a primitive
124 * to everyone's atomic.h for this
125 */
126 for (i = 0; i < TAINT_FLAGS_COUNT; i++)
127 if ((1UL << i) & tmptaint)
128 add_taint(i, LOCKDEP_STILL_OK);
129 }
130
131 return err;
132}
133
134static int sysctl_panic_print_handler(const struct ctl_table *table, int write,
135 void *buffer, size_t *lenp, loff_t *ppos)
136{
137 if (write)
138 panic_print_deprecated();
139 return proc_doulongvec_minmax(table, write, buffer, lenp, ppos);
140}
141
142static const struct ctl_table kern_panic_table[] = {
143#ifdef CONFIG_SMP
144 {
145 .procname = "oops_all_cpu_backtrace",
146 .data = &sysctl_oops_all_cpu_backtrace,
147 .maxlen = sizeof(int),
148 .mode = 0644,
149 .proc_handler = proc_dointvec_minmax,
150 .extra1 = SYSCTL_ZERO,
151 .extra2 = SYSCTL_ONE,
152 },
153#endif
154 {
155 .procname = "tainted",
156 .maxlen = sizeof(long),
157 .mode = 0644,
158 .proc_handler = proc_taint,
159 },
160 {
161 .procname = "panic",
162 .data = &panic_timeout,
163 .maxlen = sizeof(int),
164 .mode = 0644,
165 .proc_handler = proc_dointvec,
166 },
167 {
168 .procname = "panic_on_oops",
169 .data = &panic_on_oops,
170 .maxlen = sizeof(int),
171 .mode = 0644,
172 .proc_handler = proc_dointvec,
173 },
174 {
175 .procname = "panic_print",
176 .data = &panic_print,
177 .maxlen = sizeof(unsigned long),
178 .mode = 0644,
179 .proc_handler = sysctl_panic_print_handler,
180 },
181 {
182 .procname = "panic_on_warn",
183 .data = &panic_on_warn,
184 .maxlen = sizeof(int),
185 .mode = 0644,
186 .proc_handler = proc_dointvec_minmax,
187 .extra1 = SYSCTL_ZERO,
188 .extra2 = SYSCTL_ONE,
189 },
190 {
191 .procname = "warn_limit",
192 .data = &warn_limit,
193 .maxlen = sizeof(warn_limit),
194 .mode = 0644,
195 .proc_handler = proc_douintvec,
196 },
197#if (defined(CONFIG_X86_32) || defined(CONFIG_PARISC)) && \
198 defined(CONFIG_DEBUG_STACKOVERFLOW)
199 {
200 .procname = "panic_on_stackoverflow",
201 .data = &sysctl_panic_on_stackoverflow,
202 .maxlen = sizeof(int),
203 .mode = 0644,
204 .proc_handler = proc_dointvec,
205 },
206#endif
207 {
208 .procname = "panic_sys_info",
209 .data = &panic_print,
210 .maxlen = sizeof(panic_print),
211 .mode = 0644,
212 .proc_handler = sysctl_sys_info_handler,
213 },
214};
215
216static __init int kernel_panic_sysctls_init(void)
217{
218 register_sysctl_init("kernel", kern_panic_table);
219 return 0;
220}
221late_initcall(kernel_panic_sysctls_init);
222#endif
223
224/* The format is "panic_sys_info=tasks,mem,locks,ftrace,..." */
225static int __init setup_panic_sys_info(char *buf)
226{
227 /* There is no risk of race in kernel boot phase */
228 panic_print = sys_info_parse_param(buf);
229 return 1;
230}
231__setup("panic_sys_info=", setup_panic_sys_info);
232
233static atomic_t warn_count = ATOMIC_INIT(0);
234
235#ifdef CONFIG_SYSFS
236static ssize_t warn_count_show(struct kobject *kobj, struct kobj_attribute *attr,
237 char *page)
238{
239 return sysfs_emit(page, "%d\n", atomic_read(&warn_count));
240}
241
242static struct kobj_attribute warn_count_attr = __ATTR_RO(warn_count);
243
244static __init int kernel_panic_sysfs_init(void)
245{
246 sysfs_add_file_to_group(kernel_kobj, &warn_count_attr.attr, NULL);
247 return 0;
248}
249late_initcall(kernel_panic_sysfs_init);
250#endif
251
252static long no_blink(int state)
253{
254 return 0;
255}
256
257/* Returns how long it waited in ms */
258long (*panic_blink)(int state);
259EXPORT_SYMBOL(panic_blink);
260
261/*
262 * Stop ourself in panic -- architecture code may override this
263 */
264void __weak __noreturn panic_smp_self_stop(void)
265{
266 while (1)
267 cpu_relax();
268}
269
270/*
271 * Stop ourselves in NMI context if another CPU has already panicked. Arch code
272 * may override this to prepare for crash dumping, e.g. save regs info.
273 */
274void __weak __noreturn nmi_panic_self_stop(struct pt_regs *regs)
275{
276 panic_smp_self_stop();
277}
278
279/*
280 * Stop other CPUs in panic. Architecture dependent code may override this
281 * with more suitable version. For example, if the architecture supports
282 * crash dump, it should save registers of each stopped CPU and disable
283 * per-CPU features such as virtualization extensions.
284 */
285void __weak crash_smp_send_stop(void)
286{
287 static int cpus_stopped;
288
289 /*
290 * This function can be called twice in panic path, but obviously
291 * we execute this only once.
292 */
293 if (cpus_stopped)
294 return;
295
296 /*
297 * Note smp_send_stop is the usual smp shutdown function, which
298 * unfortunately means it may not be hardened to work in a panic
299 * situation.
300 */
301 smp_send_stop();
302 cpus_stopped = 1;
303}
304
305atomic_t panic_cpu = ATOMIC_INIT(PANIC_CPU_INVALID);
306atomic_t panic_redirect_cpu = ATOMIC_INIT(PANIC_CPU_INVALID);
307
308#if defined(CONFIG_SMP) && defined(CONFIG_CRASH_DUMP)
309static char *panic_force_buf;
310
311static int __init panic_force_cpu_setup(char *str)
312{
313 int cpu;
314
315 if (!str)
316 return -EINVAL;
317
318 if (kstrtoint(str, 0, &cpu) || cpu < 0 || cpu >= nr_cpu_ids) {
319 pr_warn("panic_force_cpu: invalid value '%s'\n", str);
320 return -EINVAL;
321 }
322
323 panic_force_cpu = cpu;
324 return 0;
325}
326early_param("panic_force_cpu", panic_force_cpu_setup);
327
328static int __init panic_force_cpu_late_init(void)
329{
330 if (panic_force_cpu < 0)
331 return 0;
332
333 panic_force_buf = kmalloc(PANIC_MSG_BUFSZ, GFP_KERNEL);
334
335 return 0;
336}
337late_initcall(panic_force_cpu_late_init);
338
339static void do_panic_on_target_cpu(void *info)
340{
341 panic("%s", (char *)info);
342}
343
344/**
345 * panic_smp_redirect_cpu - Redirect panic to target CPU
346 * @target_cpu: CPU that should handle the panic
347 * @msg: formatted panic message
348 *
349 * Default implementation uses IPI. Architectures with NMI support
350 * can override this for more reliable delivery.
351 *
352 * Return: 0 on success, negative errno on failure
353 */
354int __weak panic_smp_redirect_cpu(int target_cpu, void *msg)
355{
356 static call_single_data_t panic_csd;
357
358 panic_csd.func = do_panic_on_target_cpu;
359 panic_csd.info = msg;
360
361 return smp_call_function_single_async(target_cpu, &panic_csd);
362}
363
364/**
365 * panic_try_force_cpu - Redirect panic to a specific CPU for crash kernel
366 * @fmt: panic message format string
367 * @args: arguments for format string
368 *
369 * Some platforms require panic handling to occur on a specific CPU
370 * for the crash kernel to function correctly. This function redirects
371 * panic handling to the CPU specified via the panic_force_cpu= boot parameter.
372 *
373 * Returns false if panic should proceed on current CPU.
374 * Returns true if panic was redirected.
375 */
376__printf(1, 0)
377static bool panic_try_force_cpu(const char *fmt, va_list args)
378{
379 int this_cpu = raw_smp_processor_id();
380 int old_cpu = PANIC_CPU_INVALID;
381 const char *msg;
382
383 /* Feature not enabled via boot parameter */
384 if (panic_force_cpu < 0)
385 return false;
386
387 /* Already on target CPU - proceed normally */
388 if (this_cpu == panic_force_cpu)
389 return false;
390
391 /* Target CPU is offline, can't redirect */
392 if (!cpu_online(panic_force_cpu)) {
393 pr_warn("panic: target CPU %d is offline, continuing on CPU %d\n",
394 panic_force_cpu, this_cpu);
395 return false;
396 }
397
398 /* Another panic already in progress */
399 if (panic_in_progress())
400 return false;
401
402 /*
403 * Only one CPU can do the redirect. Use atomic cmpxchg to ensure
404 * we don't race with another CPU also trying to redirect.
405 */
406 if (!atomic_try_cmpxchg(&panic_redirect_cpu, &old_cpu, this_cpu))
407 return false;
408
409 /*
410 * Use dynamically allocated buffer if available, otherwise
411 * fall back to static message for early boot panics or allocation failure.
412 */
413 if (panic_force_buf) {
414 vsnprintf(panic_force_buf, PANIC_MSG_BUFSZ, fmt, args);
415 msg = panic_force_buf;
416 } else {
417 msg = "Redirected panic (buffer unavailable)";
418 }
419
420 console_verbose();
421 bust_spinlocks(1);
422
423 pr_emerg("panic: Redirecting from CPU %d to CPU %d for crash kernel.\n",
424 this_cpu, panic_force_cpu);
425
426 /* Dump original CPU before redirecting */
427 if (!test_taint(TAINT_DIE) &&
428 oops_in_progress <= 1 &&
429 IS_ENABLED(CONFIG_DEBUG_BUGVERBOSE)) {
430 dump_stack();
431 }
432
433 if (panic_smp_redirect_cpu(panic_force_cpu, (void *)msg) != 0) {
434 atomic_set(&panic_redirect_cpu, PANIC_CPU_INVALID);
435 pr_warn("panic: failed to redirect to CPU %d, continuing on CPU %d\n",
436 panic_force_cpu, this_cpu);
437 return false;
438 }
439
440 /* IPI/NMI sent, this CPU should stop */
441 return true;
442}
443#else
444__printf(1, 0)
445static inline bool panic_try_force_cpu(const char *fmt, va_list args)
446{
447 return false;
448}
449#endif /* CONFIG_SMP && CONFIG_CRASH_DUMP */
450
451bool panic_try_start(void)
452{
453 int old_cpu, this_cpu;
454
455 /*
456 * Only one CPU is allowed to execute the crash_kexec() code as with
457 * panic(). Otherwise parallel calls of panic() and crash_kexec()
458 * may stop each other. To exclude them, we use panic_cpu here too.
459 */
460 old_cpu = PANIC_CPU_INVALID;
461 this_cpu = raw_smp_processor_id();
462
463 return atomic_try_cmpxchg(&panic_cpu, &old_cpu, this_cpu);
464}
465EXPORT_SYMBOL(panic_try_start);
466
467void panic_reset(void)
468{
469 atomic_set(&panic_cpu, PANIC_CPU_INVALID);
470}
471EXPORT_SYMBOL(panic_reset);
472
473bool panic_in_progress(void)
474{
475 return unlikely(atomic_read(&panic_cpu) != PANIC_CPU_INVALID);
476}
477EXPORT_SYMBOL(panic_in_progress);
478
479/* Return true if a panic is in progress on the current CPU. */
480bool panic_on_this_cpu(void)
481{
482 /*
483 * We can use raw_smp_processor_id() here because it is impossible for
484 * the task to be migrated to the panic_cpu, or away from it. If
485 * panic_cpu has already been set, and we're not currently executing on
486 * that CPU, then we never will be.
487 */
488 return unlikely(atomic_read(&panic_cpu) == raw_smp_processor_id());
489}
490EXPORT_SYMBOL(panic_on_this_cpu);
491
492/*
493 * Return true if a panic is in progress on a remote CPU.
494 *
495 * On true, the local CPU should immediately release any printing resources
496 * that may be needed by the panic CPU.
497 */
498bool panic_on_other_cpu(void)
499{
500 return (panic_in_progress() && !panic_on_this_cpu());
501}
502EXPORT_SYMBOL(panic_on_other_cpu);
503
504/*
505 * A variant of panic() called from NMI context. We return if we've already
506 * panicked on this CPU. If another CPU already panicked, loop in
507 * nmi_panic_self_stop() which can provide architecture dependent code such
508 * as saving register state for crash dump.
509 */
510void nmi_panic(struct pt_regs *regs, const char *msg)
511{
512 if (panic_try_start())
513 panic("%s", msg);
514 else if (panic_on_other_cpu())
515 nmi_panic_self_stop(regs);
516}
517EXPORT_SYMBOL(nmi_panic);
518
519void check_panic_on_warn(const char *origin)
520{
521 unsigned int limit;
522
523 if (panic_on_warn)
524 panic("%s: panic_on_warn set ...\n", origin);
525
526 limit = READ_ONCE(warn_limit);
527 if (atomic_inc_return(&warn_count) >= limit && limit)
528 panic("%s: system warned too often (kernel.warn_limit is %d)",
529 origin, limit);
530}
531
532static void panic_trigger_all_cpu_backtrace(void)
533{
534 /* Temporary allow non-panic CPUs to write their backtraces. */
535 panic_triggering_all_cpu_backtrace = true;
536
537 if (panic_this_cpu_backtrace_printed)
538 trigger_allbutcpu_cpu_backtrace(raw_smp_processor_id());
539 else
540 trigger_all_cpu_backtrace();
541
542 panic_triggering_all_cpu_backtrace = false;
543}
544
545/*
546 * Helper that triggers the NMI backtrace (if set in panic_print)
547 * and then performs the secondary CPUs shutdown - we cannot have
548 * the NMI backtrace after the CPUs are off!
549 */
550static void panic_other_cpus_shutdown(bool crash_kexec)
551{
552 if (panic_print & SYS_INFO_ALL_BT)
553 panic_trigger_all_cpu_backtrace();
554
555 /*
556 * Note that smp_send_stop() is the usual SMP shutdown function,
557 * which unfortunately may not be hardened to work in a panic
558 * situation. If we want to do crash dump after notifier calls
559 * and kmsg_dump, we will need architecture dependent extra
560 * bits in addition to stopping other CPUs, hence we rely on
561 * crash_smp_send_stop() for that.
562 */
563 if (!crash_kexec)
564 smp_send_stop();
565 else
566 crash_smp_send_stop();
567}
568
569/**
570 * vpanic - halt the system
571 * @fmt: The text string to print
572 * @args: Arguments for the format string
573 *
574 * Display a message, then perform cleanups. This function never returns.
575 */
576void vpanic(const char *fmt, va_list args)
577{
578 static char buf[PANIC_MSG_BUFSZ];
579 long i, i_next = 0, len;
580 int state = 0;
581 bool _crash_kexec_post_notifiers = crash_kexec_post_notifiers;
582
583 if (panic_on_warn) {
584 /*
585 * This thread may hit another WARN() in the panic path.
586 * Resetting this prevents additional WARN() from panicking the
587 * system on this thread. Other threads are blocked by the
588 * panic_mutex in panic().
589 */
590 panic_on_warn = 0;
591 }
592
593 /*
594 * Disable local interrupts. This will prevent panic_smp_self_stop
595 * from deadlocking the first cpu that invokes the panic, since
596 * there is nothing to prevent an interrupt handler (that runs
597 * after setting panic_cpu) from invoking panic() again.
598 */
599 local_irq_disable();
600 preempt_disable_notrace();
601
602 /* Redirect panic to target CPU if configured via panic_force_cpu=. */
603 if (panic_try_force_cpu(fmt, args)) {
604 /*
605 * Mark ourselves offline so panic_other_cpus_shutdown() won't wait
606 * for us on architectures that check num_online_cpus().
607 */
608 set_cpu_online(smp_processor_id(), false);
609 panic_smp_self_stop();
610 }
611 /*
612 * It's possible to come here directly from a panic-assertion and
613 * not have preempt disabled. Some functions called from here want
614 * preempt to be disabled. No point enabling it later though...
615 *
616 * Only one CPU is allowed to execute the panic code from here. For
617 * multiple parallel invocations of panic, all other CPUs either
618 * stop themself or will wait until they are stopped by the 1st CPU
619 * with smp_send_stop().
620 *
621 * cmpxchg success means this is the 1st CPU which comes here,
622 * so go ahead.
623 * `old_cpu == this_cpu' means we came from nmi_panic() which sets
624 * panic_cpu to this CPU. In this case, this is also the 1st CPU.
625 */
626 /* atomic_try_cmpxchg updates old_cpu on failure */
627 if (panic_try_start()) {
628 /* go ahead */
629 } else if (panic_on_other_cpu())
630 panic_smp_self_stop();
631
632 console_verbose();
633 bust_spinlocks(1);
634 len = vscnprintf(buf, sizeof(buf), fmt, args);
635
636 if (len && buf[len - 1] == '\n')
637 buf[len - 1] = '\0';
638
639 pr_emerg("Kernel panic - not syncing: %s\n", buf);
640 /*
641 * Avoid nested stack-dumping if a panic occurs during oops processing
642 */
643 if (atomic_read(&panic_redirect_cpu) != PANIC_CPU_INVALID &&
644 panic_force_cpu == raw_smp_processor_id()) {
645 pr_emerg("panic: Redirected from CPU %d, skipping stack dump.\n",
646 atomic_read(&panic_redirect_cpu));
647 } else if (test_taint(TAINT_DIE) || oops_in_progress > 1) {
648 panic_this_cpu_backtrace_printed = true;
649 } else if (IS_ENABLED(CONFIG_DEBUG_BUGVERBOSE)) {
650 dump_stack();
651 panic_this_cpu_backtrace_printed = true;
652 }
653
654 /*
655 * If kgdb is enabled, give it a chance to run before we stop all
656 * the other CPUs or else we won't be able to debug processes left
657 * running on them.
658 */
659 kgdb_panic(buf);
660
661 /*
662 * If we have crashed and we have a crash kernel loaded let it handle
663 * everything else.
664 * If we want to run this after calling panic_notifiers, pass
665 * the "crash_kexec_post_notifiers" option to the kernel.
666 *
667 * Bypass the panic_cpu check and call __crash_kexec directly.
668 */
669 if (!_crash_kexec_post_notifiers)
670 __crash_kexec(NULL);
671
672 panic_other_cpus_shutdown(_crash_kexec_post_notifiers);
673
674 printk_legacy_allow_panic_sync();
675
676 /*
677 * Run any panic handlers, including those that might need to
678 * add information to the kmsg dump output.
679 */
680 atomic_notifier_call_chain(&panic_notifier_list, 0, buf);
681
682 sys_info(panic_print);
683
684 kmsg_dump_desc(KMSG_DUMP_PANIC, buf);
685
686 /*
687 * If you doubt kdump always works fine in any situation,
688 * "crash_kexec_post_notifiers" offers you a chance to run
689 * panic_notifiers and dumping kmsg before kdump.
690 * Note: since some panic_notifiers can make crashed kernel
691 * more unstable, it can increase risks of the kdump failure too.
692 *
693 * Bypass the panic_cpu check and call __crash_kexec directly.
694 */
695 if (_crash_kexec_post_notifiers)
696 __crash_kexec(NULL);
697
698 console_unblank();
699
700 /*
701 * We may have ended up stopping the CPU holding the lock (in
702 * smp_send_stop()) while still having some valuable data in the console
703 * buffer. Try to acquire the lock then release it regardless of the
704 * result. The release will also print the buffers out. Locks debug
705 * should be disabled to avoid reporting bad unlock balance when
706 * panic() is not being callled from OOPS.
707 */
708 debug_locks_off();
709 console_flush_on_panic(CONSOLE_FLUSH_PENDING);
710
711 if ((panic_print & SYS_INFO_PANIC_CONSOLE_REPLAY) ||
712 panic_console_replay)
713 console_flush_on_panic(CONSOLE_REPLAY_ALL);
714
715 if (!panic_blink)
716 panic_blink = no_blink;
717
718 if (panic_timeout > 0) {
719 /*
720 * Delay timeout seconds before rebooting the machine.
721 * We can't use the "normal" timers since we just panicked.
722 */
723 pr_emerg("Rebooting in %d seconds..\n", panic_timeout);
724
725 for (i = 0; i < panic_timeout * 1000; i += PANIC_TIMER_STEP) {
726 touch_nmi_watchdog();
727 if (i >= i_next) {
728 i += panic_blink(state ^= 1);
729 i_next = i + 3600 / PANIC_BLINK_SPD;
730 }
731 mdelay(PANIC_TIMER_STEP);
732 }
733 }
734 if (panic_timeout != 0) {
735 /*
736 * This will not be a clean reboot, with everything
737 * shutting down. But if there is a chance of
738 * rebooting the system it will be rebooted.
739 */
740 if (panic_reboot_mode != REBOOT_UNDEFINED)
741 reboot_mode = panic_reboot_mode;
742 emergency_restart();
743 }
744#ifdef __sparc__
745 {
746 extern int stop_a_enabled;
747 /* Make sure the user can actually press Stop-A (L1-A) */
748 stop_a_enabled = 1;
749 pr_emerg("Press Stop-A (L1-A) from sun keyboard or send break\n"
750 "twice on console to return to the boot prom\n");
751 }
752#endif
753#if defined(CONFIG_S390)
754 disabled_wait();
755#endif
756 pr_emerg("---[ end Kernel panic - not syncing: %s ]---\n", buf);
757
758 /* Do not scroll important messages printed above */
759 suppress_printk = 1;
760
761 /*
762 * The final messages may not have been printed if in a context that
763 * defers printing (such as NMI) and irq_work is not available.
764 * Explicitly flush the kernel log buffer one last time.
765 */
766 console_flush_on_panic(CONSOLE_FLUSH_PENDING);
767 nbcon_atomic_flush_unsafe();
768
769 local_irq_enable();
770 for (i = 0; ; i += PANIC_TIMER_STEP) {
771 touch_softlockup_watchdog();
772 if (i >= i_next) {
773 i += panic_blink(state ^= 1);
774 i_next = i + 3600 / PANIC_BLINK_SPD;
775 }
776 mdelay(PANIC_TIMER_STEP);
777 }
778}
779EXPORT_SYMBOL(vpanic);
780
781/* Identical to vpanic(), except it takes variadic arguments instead of va_list */
782void panic(const char *fmt, ...)
783{
784 va_list args;
785
786 va_start(args, fmt);
787 vpanic(fmt, args);
788 va_end(args);
789}
790EXPORT_SYMBOL(panic);
791
792#define TAINT_FLAG(taint, _c_true, _c_false) \
793 [ TAINT_##taint ] = { \
794 .c_true = _c_true, .c_false = _c_false, \
795 .desc = #taint, \
796 }
797
798/*
799 * NOTE: if you modify the taint_flags or TAINT_FLAGS_COUNT,
800 * please also modify tools/debugging/kernel-chktaint and
801 * Documentation/admin-guide/tainted-kernels.rst, including its
802 * small shell script that prints the TAINT_FLAGS_COUNT bits of
803 * /proc/sys/kernel/tainted.
804 *
805 * Also, update INIT_TAINT_BUF_MAX below.
806 */
807const struct taint_flag taint_flags[TAINT_FLAGS_COUNT] = {
808 TAINT_FLAG(PROPRIETARY_MODULE, 'P', 'G'),
809 TAINT_FLAG(FORCED_MODULE, 'F', ' '),
810 TAINT_FLAG(CPU_OUT_OF_SPEC, 'S', ' '),
811 TAINT_FLAG(FORCED_RMMOD, 'R', ' '),
812 TAINT_FLAG(MACHINE_CHECK, 'M', ' '),
813 TAINT_FLAG(BAD_PAGE, 'B', ' '),
814 TAINT_FLAG(USER, 'U', ' '),
815 TAINT_FLAG(DIE, 'D', ' '),
816 TAINT_FLAG(OVERRIDDEN_ACPI_TABLE, 'A', ' '),
817 TAINT_FLAG(WARN, 'W', ' '),
818 TAINT_FLAG(CRAP, 'C', ' '),
819 TAINT_FLAG(FIRMWARE_WORKAROUND, 'I', ' '),
820 TAINT_FLAG(OOT_MODULE, 'O', ' '),
821 TAINT_FLAG(UNSIGNED_MODULE, 'E', ' '),
822 TAINT_FLAG(SOFTLOCKUP, 'L', ' '),
823 TAINT_FLAG(LIVEPATCH, 'K', ' '),
824 TAINT_FLAG(AUX, 'X', ' '),
825 TAINT_FLAG(RANDSTRUCT, 'T', ' '),
826 TAINT_FLAG(TEST, 'N', ' '),
827 TAINT_FLAG(FWCTL, 'J', ' '),
828};
829
830#undef TAINT_FLAG
831
832static void print_tainted_seq(struct seq_buf *s, bool verbose)
833{
834 const char *sep = "";
835 int i;
836
837 if (!tainted_mask) {
838 seq_buf_puts(s, "Not tainted");
839 return;
840 }
841
842 seq_buf_printf(s, "Tainted: ");
843 for (i = 0; i < TAINT_FLAGS_COUNT; i++) {
844 const struct taint_flag *t = &taint_flags[i];
845 bool is_set = test_bit(i, &tainted_mask);
846 char c = is_set ? t->c_true : t->c_false;
847
848 if (verbose) {
849 if (is_set) {
850 seq_buf_printf(s, "%s[%c]=%s", sep, c, t->desc);
851 sep = ", ";
852 }
853 } else {
854 seq_buf_putc(s, c);
855 }
856 }
857}
858
859/* The initial buffer can accommodate all taint flags in verbose
860 * mode, with some headroom. Once the allocator is available, the
861 * exact size is allocated dynamically; the initial buffer remains
862 * as a fallback if allocation fails.
863 *
864 * The verbose taint string currently requires up to 327 characters.
865 */
866#define INIT_TAINT_BUF_MAX 350
867
868static char init_taint_buf[INIT_TAINT_BUF_MAX] __initdata;
869static char *taint_buf __refdata = init_taint_buf;
870static size_t taint_buf_size = INIT_TAINT_BUF_MAX;
871
872static __init int alloc_taint_buf(void)
873{
874 int i;
875 char *buf;
876 size_t size = 0;
877
878 size += sizeof("Tainted: ") - 1;
879 for (i = 0; i < TAINT_FLAGS_COUNT; i++) {
880 size += 2; /* For ", " */
881 size += 4; /* For "[%c]=" */
882 size += strlen(taint_flags[i].desc);
883 }
884
885 size += 1; /* For NULL terminator */
886
887 buf = kmalloc(size, GFP_KERNEL);
888
889 if (!buf) {
890 panic("Failed to allocate taint string buffer");
891 }
892
893 taint_buf = buf;
894 taint_buf_size = size;
895
896 return 0;
897}
898postcore_initcall(alloc_taint_buf);
899
900static const char *_print_tainted(bool verbose)
901{
902 struct seq_buf s;
903
904 BUILD_BUG_ON(ARRAY_SIZE(taint_flags) != TAINT_FLAGS_COUNT);
905
906 seq_buf_init(&s, taint_buf, taint_buf_size);
907
908 print_tainted_seq(&s, verbose);
909
910 return seq_buf_str(&s);
911}
912
913/**
914 * print_tainted - return a string to represent the kernel taint state.
915 *
916 * For individual taint flag meanings, see Documentation/admin-guide/sysctl/kernel.rst
917 *
918 * The string is overwritten by the next call to print_tainted(),
919 * but is always NULL terminated.
920 */
921const char *print_tainted(void)
922{
923 return _print_tainted(false);
924}
925
926/**
927 * print_tainted_verbose - A more verbose version of print_tainted()
928 */
929const char *print_tainted_verbose(void)
930{
931 return _print_tainted(true);
932}
933
934int test_taint(unsigned flag)
935{
936 return test_bit(flag, &tainted_mask);
937}
938EXPORT_SYMBOL(test_taint);
939
940unsigned long get_taint(void)
941{
942 return tainted_mask;
943}
944
945/**
946 * add_taint: add a taint flag if not already set.
947 * @flag: one of the TAINT_* constants.
948 * @lockdep_ok: whether lock debugging is still OK.
949 *
950 * If something bad has gone wrong, you'll want @lockdebug_ok = false, but for
951 * some notewortht-but-not-corrupting cases, it can be set to true.
952 */
953void add_taint(unsigned flag, enum lockdep_ok lockdep_ok)
954{
955 if (lockdep_ok == LOCKDEP_NOW_UNRELIABLE && __debug_locks_off())
956 pr_warn("Disabling lock debugging due to kernel taint\n");
957
958 set_bit(flag, &tainted_mask);
959
960 if (tainted_mask & panic_on_taint) {
961 panic_on_taint = 0;
962 panic("panic_on_taint set ...");
963 }
964}
965EXPORT_SYMBOL(add_taint);
966
967static void spin_msec(int msecs)
968{
969 int i;
970
971 for (i = 0; i < msecs; i++) {
972 touch_nmi_watchdog();
973 mdelay(1);
974 }
975}
976
977/*
978 * It just happens that oops_enter() and oops_exit() are identically
979 * implemented...
980 */
981static void do_oops_enter_exit(void)
982{
983 unsigned long flags;
984 static int spin_counter;
985
986 if (!pause_on_oops)
987 return;
988
989 spin_lock_irqsave(&pause_on_oops_lock, flags);
990 if (pause_on_oops_flag == 0) {
991 /* This CPU may now print the oops message */
992 pause_on_oops_flag = 1;
993 } else {
994 /* We need to stall this CPU */
995 if (!spin_counter) {
996 /* This CPU gets to do the counting */
997 spin_counter = pause_on_oops;
998 do {
999 spin_unlock(&pause_on_oops_lock);
1000 spin_msec(MSEC_PER_SEC);
1001 spin_lock(&pause_on_oops_lock);
1002 } while (--spin_counter);
1003 pause_on_oops_flag = 0;
1004 } else {
1005 /* This CPU waits for a different one */
1006 while (spin_counter) {
1007 spin_unlock(&pause_on_oops_lock);
1008 spin_msec(1);
1009 spin_lock(&pause_on_oops_lock);
1010 }
1011 }
1012 }
1013 spin_unlock_irqrestore(&pause_on_oops_lock, flags);
1014}
1015
1016/*
1017 * Return true if the calling CPU is allowed to print oops-related info.
1018 * This is a bit racy..
1019 */
1020bool oops_may_print(void)
1021{
1022 return pause_on_oops_flag == 0;
1023}
1024
1025/*
1026 * Called when the architecture enters its oops handler, before it prints
1027 * anything. If this is the first CPU to oops, and it's oopsing the first
1028 * time then let it proceed.
1029 *
1030 * This is all enabled by the pause_on_oops kernel boot option. We do all
1031 * this to ensure that oopses don't scroll off the screen. It has the
1032 * side-effect of preventing later-oopsing CPUs from mucking up the display,
1033 * too.
1034 *
1035 * It turns out that the CPU which is allowed to print ends up pausing for
1036 * the right duration, whereas all the other CPUs pause for twice as long:
1037 * once in oops_enter(), once in oops_exit().
1038 */
1039void oops_enter(void)
1040{
1041 nbcon_cpu_emergency_enter();
1042 tracing_off();
1043 /* can't trust the integrity of the kernel anymore: */
1044 debug_locks_off();
1045 do_oops_enter_exit();
1046
1047 if (sysctl_oops_all_cpu_backtrace)
1048 trigger_all_cpu_backtrace();
1049}
1050
1051static void print_oops_end_marker(void)
1052{
1053 pr_warn("---[ end trace %016llx ]---\n", 0ULL);
1054}
1055
1056/*
1057 * Called when the architecture exits its oops handler, after printing
1058 * everything.
1059 */
1060void oops_exit(void)
1061{
1062 do_oops_enter_exit();
1063 print_oops_end_marker();
1064 nbcon_cpu_emergency_exit();
1065 kmsg_dump(KMSG_DUMP_OOPS);
1066}
1067
1068struct warn_args {
1069 const char *fmt;
1070 va_list args;
1071};
1072
1073void __warn(const char *file, int line, void *caller, unsigned taint,
1074 struct pt_regs *regs, struct warn_args *args)
1075{
1076 nbcon_cpu_emergency_enter();
1077
1078 disable_trace_on_warning();
1079
1080 if (file) {
1081 pr_warn("WARNING: %s:%d at %pS, CPU#%d: %s/%d\n",
1082 file, line, caller,
1083 raw_smp_processor_id(), current->comm, current->pid);
1084 } else {
1085 pr_warn("WARNING: at %pS, CPU#%d: %s/%d\n",
1086 caller,
1087 raw_smp_processor_id(), current->comm, current->pid);
1088 }
1089
1090#pragma GCC diagnostic push
1091#ifndef __clang__
1092#pragma GCC diagnostic ignored "-Wsuggest-attribute=format"
1093#endif
1094 if (args)
1095 vprintk(args->fmt, args->args);
1096#pragma GCC diagnostic pop
1097
1098 print_modules();
1099
1100 if (regs)
1101 show_regs(regs);
1102
1103 check_panic_on_warn("kernel");
1104
1105 if (!regs)
1106 dump_stack();
1107
1108 print_irqtrace_events(current);
1109
1110 print_oops_end_marker();
1111 trace_error_report_end(ERROR_DETECTOR_WARN, (unsigned long)caller);
1112
1113 /* Just a warning, don't kill lockdep. */
1114 add_taint(taint, LOCKDEP_STILL_OK);
1115
1116 nbcon_cpu_emergency_exit();
1117}
1118
1119#ifdef CONFIG_BUG
1120#ifndef __WARN_FLAGS
1121void warn_slowpath_fmt(const char *file, int line, unsigned taint,
1122 const char *fmt, ...)
1123{
1124 bool rcu = warn_rcu_enter();
1125 struct warn_args args;
1126
1127 pr_warn(CUT_HERE);
1128
1129 if (!fmt) {
1130 __warn(file, line, __builtin_return_address(0), taint,
1131 NULL, NULL);
1132 warn_rcu_exit(rcu);
1133 return;
1134 }
1135
1136 args.fmt = fmt;
1137 va_start(args.args, fmt);
1138 __warn(file, line, __builtin_return_address(0), taint, NULL, &args);
1139 va_end(args.args);
1140 warn_rcu_exit(rcu);
1141}
1142EXPORT_SYMBOL(warn_slowpath_fmt);
1143#else
1144void __warn_printk(const char *fmt, ...)
1145{
1146 bool rcu = warn_rcu_enter();
1147 va_list args;
1148
1149 pr_warn(CUT_HERE);
1150
1151 va_start(args, fmt);
1152 vprintk(fmt, args);
1153 va_end(args);
1154 warn_rcu_exit(rcu);
1155}
1156EXPORT_SYMBOL(__warn_printk);
1157#endif
1158
1159/* Support resetting WARN*_ONCE state */
1160
1161static int clear_warn_once_set(void *data, u64 val)
1162{
1163 generic_bug_clear_once();
1164 memset(__start_once, 0, __end_once - __start_once);
1165 return 0;
1166}
1167
1168DEFINE_DEBUGFS_ATTRIBUTE(clear_warn_once_fops, NULL, clear_warn_once_set,
1169 "%lld\n");
1170
1171static __init int register_warn_debugfs(void)
1172{
1173 /* Don't care about failure */
1174 debugfs_create_file_unsafe("clear_warn_once", 0200, NULL, NULL,
1175 &clear_warn_once_fops);
1176 return 0;
1177}
1178
1179device_initcall(register_warn_debugfs);
1180#endif
1181
1182#ifdef CONFIG_STACKPROTECTOR
1183
1184/*
1185 * Called when gcc's -fstack-protector feature is used, and
1186 * gcc detects corruption of the on-stack canary value
1187 */
1188__visible noinstr void __stack_chk_fail(void)
1189{
1190 unsigned long flags;
1191
1192 instrumentation_begin();
1193 flags = user_access_save();
1194
1195 panic("stack-protector: Kernel stack is corrupted in: %pB",
1196 __builtin_return_address(0));
1197
1198 user_access_restore(flags);
1199 instrumentation_end();
1200}
1201EXPORT_SYMBOL(__stack_chk_fail);
1202
1203#endif
1204
1205core_param(panic, panic_timeout, int, 0644);
1206core_param(pause_on_oops, pause_on_oops, int, 0644);
1207core_param(panic_on_warn, panic_on_warn, int, 0644);
1208core_param(crash_kexec_post_notifiers, crash_kexec_post_notifiers, bool, 0644);
1209core_param(panic_console_replay, panic_console_replay, bool, 0644);
1210
1211static int panic_print_set(const char *val, const struct kernel_param *kp)
1212{
1213 panic_print_deprecated();
1214 return param_set_ulong(val, kp);
1215}
1216
1217static int panic_print_get(char *val, const struct kernel_param *kp)
1218{
1219 return param_get_ulong(val, kp);
1220}
1221
1222static const struct kernel_param_ops panic_print_ops = {
1223 .set = panic_print_set,
1224 .get = panic_print_get,
1225};
1226__core_param_cb(panic_print, &panic_print_ops, &panic_print, 0644);
1227
1228static int __init oops_setup(char *s)
1229{
1230 if (!s)
1231 return -EINVAL;
1232 if (!strcmp(s, "panic"))
1233 panic_on_oops = 1;
1234 return 0;
1235}
1236early_param("oops", oops_setup);
1237
1238static int __init panic_on_taint_setup(char *s)
1239{
1240 char *taint_str;
1241
1242 if (!s)
1243 return -EINVAL;
1244
1245 taint_str = strsep(&s, ",");
1246 if (kstrtoul(taint_str, 16, &panic_on_taint))
1247 return -EINVAL;
1248
1249 /* make sure panic_on_taint doesn't hold out-of-range TAINT flags */
1250 panic_on_taint &= TAINT_FLAGS_MAX;
1251
1252 if (!panic_on_taint)
1253 return -EINVAL;
1254
1255 if (s && !strcmp(s, "nousertaint"))
1256 panic_on_taint_nousertaint = true;
1257
1258 pr_info("panic_on_taint: bitmask=0x%lx nousertaint_mode=%s\n",
1259 panic_on_taint, str_enabled_disabled(panic_on_taint_nousertaint));
1260
1261 return 0;
1262}
1263early_param("panic_on_taint", panic_on_taint_setup);