1 /* 2 * linux/kernel/panic.c 3 * 4 * Copyright (C) 1991, 1992 Linus Torvalds 5 */ 6 7 /* 8 * This function is used through-out the kernel (including mm and fs) 9 * to indicate a major problem. 10 */ 11 #include <linux/debug_locks.h> 12 #include <linux/interrupt.h> 13 #include <linux/kmsg_dump.h> 14 #include <linux/kallsyms.h> 15 #include <linux/notifier.h> 16 #include <linux/module.h> 17 #include <linux/random.h> 18 #include <linux/ftrace.h> 19 #include <linux/reboot.h> 20 #include <linux/delay.h> 21 #include <linux/kexec.h> 22 #include <linux/sched.h> 23 #include <linux/sysrq.h> 24 #include <linux/init.h> 25 #include <linux/nmi.h> 26 #include <linux/console.h> 27 #include <linux/bug.h> 28 29 #define PANIC_TIMER_STEP 100 30 #define PANIC_BLINK_SPD 18 31 32 int panic_on_oops = CONFIG_PANIC_ON_OOPS_VALUE; 33 static unsigned long tainted_mask; 34 static int pause_on_oops; 35 static int pause_on_oops_flag; 36 static DEFINE_SPINLOCK(pause_on_oops_lock); 37 bool crash_kexec_post_notifiers; 38 int panic_on_warn __read_mostly; 39 40 int panic_timeout = CONFIG_PANIC_TIMEOUT; 41 EXPORT_SYMBOL_GPL(panic_timeout); 42 43 ATOMIC_NOTIFIER_HEAD(panic_notifier_list); 44 45 EXPORT_SYMBOL(panic_notifier_list); 46 47 static long no_blink(int state) 48 { 49 return 0; 50 } 51 52 /* Returns how long it waited in ms */ 53 long (*panic_blink)(int state); 54 EXPORT_SYMBOL(panic_blink); 55 56 /* 57 * Stop ourself in panic -- architecture code may override this 58 */ 59 void __weak panic_smp_self_stop(void) 60 { 61 while (1) 62 cpu_relax(); 63 } 64 65 /* 66 * Stop ourselves in NMI context if another CPU has already panicked. Arch code 67 * may override this to prepare for crash dumping, e.g. save regs info. 68 */ 69 void __weak nmi_panic_self_stop(struct pt_regs *regs) 70 { 71 panic_smp_self_stop(); 72 } 73 74 atomic_t panic_cpu = ATOMIC_INIT(PANIC_CPU_INVALID); 75 76 /* 77 * A variant of panic() called from NMI context. We return if we've already 78 * panicked on this CPU. If another CPU already panicked, loop in 79 * nmi_panic_self_stop() which can provide architecture dependent code such 80 * as saving register state for crash dump. 81 */ 82 void nmi_panic(struct pt_regs *regs, const char *msg) 83 { 84 int old_cpu, cpu; 85 86 cpu = raw_smp_processor_id(); 87 old_cpu = atomic_cmpxchg(&panic_cpu, PANIC_CPU_INVALID, cpu); 88 89 if (old_cpu == PANIC_CPU_INVALID) 90 panic("%s", msg); 91 else if (old_cpu != cpu) 92 nmi_panic_self_stop(regs); 93 } 94 EXPORT_SYMBOL(nmi_panic); 95 96 /** 97 * panic - halt the system 98 * @fmt: The text string to print 99 * 100 * Display a message, then perform cleanups. 101 * 102 * This function never returns. 103 */ 104 void panic(const char *fmt, ...) 105 { 106 static char buf[1024]; 107 va_list args; 108 long i, i_next = 0; 109 int state = 0; 110 int old_cpu, this_cpu; 111 bool _crash_kexec_post_notifiers = crash_kexec_post_notifiers; 112 113 /* 114 * Disable local interrupts. This will prevent panic_smp_self_stop 115 * from deadlocking the first cpu that invokes the panic, since 116 * there is nothing to prevent an interrupt handler (that runs 117 * after setting panic_cpu) from invoking panic() again. 118 */ 119 local_irq_disable(); 120 121 /* 122 * It's possible to come here directly from a panic-assertion and 123 * not have preempt disabled. Some functions called from here want 124 * preempt to be disabled. No point enabling it later though... 125 * 126 * Only one CPU is allowed to execute the panic code from here. For 127 * multiple parallel invocations of panic, all other CPUs either 128 * stop themself or will wait until they are stopped by the 1st CPU 129 * with smp_send_stop(). 130 * 131 * `old_cpu == PANIC_CPU_INVALID' means this is the 1st CPU which 132 * comes here, so go ahead. 133 * `old_cpu == this_cpu' means we came from nmi_panic() which sets 134 * panic_cpu to this CPU. In this case, this is also the 1st CPU. 135 */ 136 this_cpu = raw_smp_processor_id(); 137 old_cpu = atomic_cmpxchg(&panic_cpu, PANIC_CPU_INVALID, this_cpu); 138 139 if (old_cpu != PANIC_CPU_INVALID && old_cpu != this_cpu) 140 panic_smp_self_stop(); 141 142 console_verbose(); 143 bust_spinlocks(1); 144 va_start(args, fmt); 145 vsnprintf(buf, sizeof(buf), fmt, args); 146 va_end(args); 147 pr_emerg("Kernel panic - not syncing: %s\n", buf); 148 #ifdef CONFIG_DEBUG_BUGVERBOSE 149 /* 150 * Avoid nested stack-dumping if a panic occurs during oops processing 151 */ 152 if (!test_taint(TAINT_DIE) && oops_in_progress <= 1) 153 dump_stack(); 154 #endif 155 156 /* 157 * If we have crashed and we have a crash kernel loaded let it handle 158 * everything else. 159 * If we want to run this after calling panic_notifiers, pass 160 * the "crash_kexec_post_notifiers" option to the kernel. 161 * 162 * Bypass the panic_cpu check and call __crash_kexec directly. 163 */ 164 if (!_crash_kexec_post_notifiers) { 165 printk_nmi_flush_on_panic(); 166 __crash_kexec(NULL); 167 } 168 169 /* 170 * Note smp_send_stop is the usual smp shutdown function, which 171 * unfortunately means it may not be hardened to work in a panic 172 * situation. 173 */ 174 smp_send_stop(); 175 176 /* 177 * Run any panic handlers, including those that might need to 178 * add information to the kmsg dump output. 179 */ 180 atomic_notifier_call_chain(&panic_notifier_list, 0, buf); 181 182 /* Call flush even twice. It tries harder with a single online CPU */ 183 printk_nmi_flush_on_panic(); 184 kmsg_dump(KMSG_DUMP_PANIC); 185 186 /* 187 * If you doubt kdump always works fine in any situation, 188 * "crash_kexec_post_notifiers" offers you a chance to run 189 * panic_notifiers and dumping kmsg before kdump. 190 * Note: since some panic_notifiers can make crashed kernel 191 * more unstable, it can increase risks of the kdump failure too. 192 * 193 * Bypass the panic_cpu check and call __crash_kexec directly. 194 */ 195 if (_crash_kexec_post_notifiers) 196 __crash_kexec(NULL); 197 198 bust_spinlocks(0); 199 200 /* 201 * We may have ended up stopping the CPU holding the lock (in 202 * smp_send_stop()) while still having some valuable data in the console 203 * buffer. Try to acquire the lock then release it regardless of the 204 * result. The release will also print the buffers out. Locks debug 205 * should be disabled to avoid reporting bad unlock balance when 206 * panic() is not being callled from OOPS. 207 */ 208 debug_locks_off(); 209 console_flush_on_panic(); 210 211 if (!panic_blink) 212 panic_blink = no_blink; 213 214 if (panic_timeout > 0) { 215 /* 216 * Delay timeout seconds before rebooting the machine. 217 * We can't use the "normal" timers since we just panicked. 218 */ 219 pr_emerg("Rebooting in %d seconds..", panic_timeout); 220 221 for (i = 0; i < panic_timeout * 1000; i += PANIC_TIMER_STEP) { 222 touch_nmi_watchdog(); 223 if (i >= i_next) { 224 i += panic_blink(state ^= 1); 225 i_next = i + 3600 / PANIC_BLINK_SPD; 226 } 227 mdelay(PANIC_TIMER_STEP); 228 } 229 } 230 if (panic_timeout != 0) { 231 /* 232 * This will not be a clean reboot, with everything 233 * shutting down. But if there is a chance of 234 * rebooting the system it will be rebooted. 235 */ 236 emergency_restart(); 237 } 238 #ifdef __sparc__ 239 { 240 extern int stop_a_enabled; 241 /* Make sure the user can actually press Stop-A (L1-A) */ 242 stop_a_enabled = 1; 243 pr_emerg("Press Stop-A (L1-A) to return to the boot prom\n"); 244 } 245 #endif 246 #if defined(CONFIG_S390) 247 { 248 unsigned long caller; 249 250 caller = (unsigned long)__builtin_return_address(0); 251 disabled_wait(caller); 252 } 253 #endif 254 pr_emerg("---[ end Kernel panic - not syncing: %s\n", buf); 255 local_irq_enable(); 256 for (i = 0; ; i += PANIC_TIMER_STEP) { 257 touch_softlockup_watchdog(); 258 if (i >= i_next) { 259 i += panic_blink(state ^= 1); 260 i_next = i + 3600 / PANIC_BLINK_SPD; 261 } 262 mdelay(PANIC_TIMER_STEP); 263 } 264 } 265 266 EXPORT_SYMBOL(panic); 267 268 269 struct tnt { 270 u8 bit; 271 char true; 272 char false; 273 }; 274 275 static const struct tnt tnts[] = { 276 { TAINT_PROPRIETARY_MODULE, 'P', 'G' }, 277 { TAINT_FORCED_MODULE, 'F', ' ' }, 278 { TAINT_CPU_OUT_OF_SPEC, 'S', ' ' }, 279 { TAINT_FORCED_RMMOD, 'R', ' ' }, 280 { TAINT_MACHINE_CHECK, 'M', ' ' }, 281 { TAINT_BAD_PAGE, 'B', ' ' }, 282 { TAINT_USER, 'U', ' ' }, 283 { TAINT_DIE, 'D', ' ' }, 284 { TAINT_OVERRIDDEN_ACPI_TABLE, 'A', ' ' }, 285 { TAINT_WARN, 'W', ' ' }, 286 { TAINT_CRAP, 'C', ' ' }, 287 { TAINT_FIRMWARE_WORKAROUND, 'I', ' ' }, 288 { TAINT_OOT_MODULE, 'O', ' ' }, 289 { TAINT_UNSIGNED_MODULE, 'E', ' ' }, 290 { TAINT_SOFTLOCKUP, 'L', ' ' }, 291 { TAINT_LIVEPATCH, 'K', ' ' }, 292 }; 293 294 /** 295 * print_tainted - return a string to represent the kernel taint state. 296 * 297 * 'P' - Proprietary module has been loaded. 298 * 'F' - Module has been forcibly loaded. 299 * 'S' - SMP with CPUs not designed for SMP. 300 * 'R' - User forced a module unload. 301 * 'M' - System experienced a machine check exception. 302 * 'B' - System has hit bad_page. 303 * 'U' - Userspace-defined naughtiness. 304 * 'D' - Kernel has oopsed before 305 * 'A' - ACPI table overridden. 306 * 'W' - Taint on warning. 307 * 'C' - modules from drivers/staging are loaded. 308 * 'I' - Working around severe firmware bug. 309 * 'O' - Out-of-tree module has been loaded. 310 * 'E' - Unsigned module has been loaded. 311 * 'L' - A soft lockup has previously occurred. 312 * 'K' - Kernel has been live patched. 313 * 314 * The string is overwritten by the next call to print_tainted(). 315 */ 316 const char *print_tainted(void) 317 { 318 static char buf[ARRAY_SIZE(tnts) + sizeof("Tainted: ")]; 319 320 if (tainted_mask) { 321 char *s; 322 int i; 323 324 s = buf + sprintf(buf, "Tainted: "); 325 for (i = 0; i < ARRAY_SIZE(tnts); i++) { 326 const struct tnt *t = &tnts[i]; 327 *s++ = test_bit(t->bit, &tainted_mask) ? 328 t->true : t->false; 329 } 330 *s = 0; 331 } else 332 snprintf(buf, sizeof(buf), "Not tainted"); 333 334 return buf; 335 } 336 337 int test_taint(unsigned flag) 338 { 339 return test_bit(flag, &tainted_mask); 340 } 341 EXPORT_SYMBOL(test_taint); 342 343 unsigned long get_taint(void) 344 { 345 return tainted_mask; 346 } 347 348 /** 349 * add_taint: add a taint flag if not already set. 350 * @flag: one of the TAINT_* constants. 351 * @lockdep_ok: whether lock debugging is still OK. 352 * 353 * If something bad has gone wrong, you'll want @lockdebug_ok = false, but for 354 * some notewortht-but-not-corrupting cases, it can be set to true. 355 */ 356 void add_taint(unsigned flag, enum lockdep_ok lockdep_ok) 357 { 358 if (lockdep_ok == LOCKDEP_NOW_UNRELIABLE && __debug_locks_off()) 359 pr_warn("Disabling lock debugging due to kernel taint\n"); 360 361 set_bit(flag, &tainted_mask); 362 } 363 EXPORT_SYMBOL(add_taint); 364 365 static void spin_msec(int msecs) 366 { 367 int i; 368 369 for (i = 0; i < msecs; i++) { 370 touch_nmi_watchdog(); 371 mdelay(1); 372 } 373 } 374 375 /* 376 * It just happens that oops_enter() and oops_exit() are identically 377 * implemented... 378 */ 379 static void do_oops_enter_exit(void) 380 { 381 unsigned long flags; 382 static int spin_counter; 383 384 if (!pause_on_oops) 385 return; 386 387 spin_lock_irqsave(&pause_on_oops_lock, flags); 388 if (pause_on_oops_flag == 0) { 389 /* This CPU may now print the oops message */ 390 pause_on_oops_flag = 1; 391 } else { 392 /* We need to stall this CPU */ 393 if (!spin_counter) { 394 /* This CPU gets to do the counting */ 395 spin_counter = pause_on_oops; 396 do { 397 spin_unlock(&pause_on_oops_lock); 398 spin_msec(MSEC_PER_SEC); 399 spin_lock(&pause_on_oops_lock); 400 } while (--spin_counter); 401 pause_on_oops_flag = 0; 402 } else { 403 /* This CPU waits for a different one */ 404 while (spin_counter) { 405 spin_unlock(&pause_on_oops_lock); 406 spin_msec(1); 407 spin_lock(&pause_on_oops_lock); 408 } 409 } 410 } 411 spin_unlock_irqrestore(&pause_on_oops_lock, flags); 412 } 413 414 /* 415 * Return true if the calling CPU is allowed to print oops-related info. 416 * This is a bit racy.. 417 */ 418 int oops_may_print(void) 419 { 420 return pause_on_oops_flag == 0; 421 } 422 423 /* 424 * Called when the architecture enters its oops handler, before it prints 425 * anything. If this is the first CPU to oops, and it's oopsing the first 426 * time then let it proceed. 427 * 428 * This is all enabled by the pause_on_oops kernel boot option. We do all 429 * this to ensure that oopses don't scroll off the screen. It has the 430 * side-effect of preventing later-oopsing CPUs from mucking up the display, 431 * too. 432 * 433 * It turns out that the CPU which is allowed to print ends up pausing for 434 * the right duration, whereas all the other CPUs pause for twice as long: 435 * once in oops_enter(), once in oops_exit(). 436 */ 437 void oops_enter(void) 438 { 439 tracing_off(); 440 /* can't trust the integrity of the kernel anymore: */ 441 debug_locks_off(); 442 do_oops_enter_exit(); 443 } 444 445 /* 446 * 64-bit random ID for oopses: 447 */ 448 static u64 oops_id; 449 450 static int init_oops_id(void) 451 { 452 if (!oops_id) 453 get_random_bytes(&oops_id, sizeof(oops_id)); 454 else 455 oops_id++; 456 457 return 0; 458 } 459 late_initcall(init_oops_id); 460 461 void print_oops_end_marker(void) 462 { 463 init_oops_id(); 464 pr_warn("---[ end trace %016llx ]---\n", (unsigned long long)oops_id); 465 } 466 467 /* 468 * Called when the architecture exits its oops handler, after printing 469 * everything. 470 */ 471 void oops_exit(void) 472 { 473 do_oops_enter_exit(); 474 print_oops_end_marker(); 475 kmsg_dump(KMSG_DUMP_OOPS); 476 } 477 478 struct warn_args { 479 const char *fmt; 480 va_list args; 481 }; 482 483 void __warn(const char *file, int line, void *caller, unsigned taint, 484 struct pt_regs *regs, struct warn_args *args) 485 { 486 disable_trace_on_warning(); 487 488 pr_warn("------------[ cut here ]------------\n"); 489 490 if (file) 491 pr_warn("WARNING: CPU: %d PID: %d at %s:%d %pS\n", 492 raw_smp_processor_id(), current->pid, file, line, 493 caller); 494 else 495 pr_warn("WARNING: CPU: %d PID: %d at %pS\n", 496 raw_smp_processor_id(), current->pid, caller); 497 498 if (args) 499 vprintk(args->fmt, args->args); 500 501 if (panic_on_warn) { 502 /* 503 * This thread may hit another WARN() in the panic path. 504 * Resetting this prevents additional WARN() from panicking the 505 * system on this thread. Other threads are blocked by the 506 * panic_mutex in panic(). 507 */ 508 panic_on_warn = 0; 509 panic("panic_on_warn set ...\n"); 510 } 511 512 print_modules(); 513 514 if (regs) 515 show_regs(regs); 516 else 517 dump_stack(); 518 519 print_oops_end_marker(); 520 521 /* Just a warning, don't kill lockdep. */ 522 add_taint(taint, LOCKDEP_STILL_OK); 523 } 524 525 #ifdef WANT_WARN_ON_SLOWPATH 526 void warn_slowpath_fmt(const char *file, int line, const char *fmt, ...) 527 { 528 struct warn_args args; 529 530 args.fmt = fmt; 531 va_start(args.args, fmt); 532 __warn(file, line, __builtin_return_address(0), TAINT_WARN, NULL, 533 &args); 534 va_end(args.args); 535 } 536 EXPORT_SYMBOL(warn_slowpath_fmt); 537 538 void warn_slowpath_fmt_taint(const char *file, int line, 539 unsigned taint, const char *fmt, ...) 540 { 541 struct warn_args args; 542 543 args.fmt = fmt; 544 va_start(args.args, fmt); 545 __warn(file, line, __builtin_return_address(0), taint, NULL, &args); 546 va_end(args.args); 547 } 548 EXPORT_SYMBOL(warn_slowpath_fmt_taint); 549 550 void warn_slowpath_null(const char *file, int line) 551 { 552 __warn(file, line, __builtin_return_address(0), TAINT_WARN, NULL, NULL); 553 } 554 EXPORT_SYMBOL(warn_slowpath_null); 555 #endif 556 557 #ifdef CONFIG_CC_STACKPROTECTOR 558 559 /* 560 * Called when gcc's -fstack-protector feature is used, and 561 * gcc detects corruption of the on-stack canary value 562 */ 563 __visible void __stack_chk_fail(void) 564 { 565 panic("stack-protector: Kernel stack is corrupted in: %p\n", 566 __builtin_return_address(0)); 567 } 568 EXPORT_SYMBOL(__stack_chk_fail); 569 570 #endif 571 572 core_param(panic, panic_timeout, int, 0644); 573 core_param(pause_on_oops, pause_on_oops, int, 0644); 574 core_param(panic_on_warn, panic_on_warn, int, 0644); 575 core_param(crash_kexec_post_notifiers, crash_kexec_post_notifiers, bool, 0644); 576 577 static int __init oops_setup(char *s) 578 { 579 if (!s) 580 return -EINVAL; 581 if (!strcmp(s, "panic")) 582 panic_on_oops = 1; 583 return 0; 584 } 585 early_param("oops", oops_setup); 586