arch/powerpc/kernel/watchdog.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Watchdog support on powerpc systems.
   4  *
   5  * Copyright 2017, IBM Corporation.
   6  *
   7  * This uses code from arch/sparc/kernel/nmi.c and kernel/watchdog.c
   8  */
   9
  10 #define pr_fmt(fmt) "watchdog: " fmt
  11
  12 #include <linux/kernel.h>
  13 #include <linux/param.h>
  14 #include <linux/init.h>
  15 #include <linux/percpu.h>
  16 #include <linux/cpu.h>
  17 #include <linux/nmi.h>
  18 #include <linux/module.h>
  19 #include <linux/export.h>
  20 #include <linux/kprobes.h>
  21 #include <linux/hardirq.h>
  22 #include <linux/reboot.h>
  23 #include <linux/slab.h>
  24 #include <linux/kdebug.h>
  25 #include <linux/sched/debug.h>
  26 #include <linux/delay.h>
  27 #include <linux/processor.h>
  28 #include <linux/smp.h>
  29
  30 #include <asm/interrupt.h>
  31 #include <asm/paca.h>
  32 #include <asm/nmi.h>
  33
  34 /*
  35  * The powerpc watchdog ensures that each CPU is able to service timers.
  36  * The watchdog sets up a simple timer on each CPU to run once per timer
  37  * period, and updates a per-cpu timestamp and a "pending" cpumask. This is
  38  * the heartbeat.
  39  *
  40  * Then there are two systems to check that the heartbeat is still running.
  41  * The local soft-NMI, and the SMP checker.
  42  *
  43  * The soft-NMI checker can detect lockups on the local CPU. When interrupts
  44  * are disabled with local_irq_disable(), platforms that use soft-masking
  45  * can leave hardware interrupts enabled and handle them with a masked
  46  * interrupt handler. The masked handler can send the timer interrupt to the
  47  * watchdog's soft_nmi_interrupt(), which appears to Linux as an NMI
  48  * interrupt, and can be used to detect CPUs stuck with IRQs disabled.
  49  *
  50  * The soft-NMI checker will compare the heartbeat timestamp for this CPU
  51  * with the current time, and take action if the difference exceeds the
  52  * watchdog threshold.
  53  *
  54  * The limitation of the soft-NMI watchdog is that it does not work when
  55  * interrupts are hard disabled or otherwise not being serviced. This is
  56  * solved by also having a SMP watchdog where all CPUs check all other
  57  * CPUs heartbeat.
  58  *
  59  * The SMP checker can detect lockups on other CPUs. A gobal "pending"
  60  * cpumask is kept, containing all CPUs which enable the watchdog. Each
  61  * CPU clears their pending bit in their heartbeat timer. When the bitmask
  62  * becomes empty, the last CPU to clear its pending bit updates a global
  63  * timestamp and refills the pending bitmask.
  64  *
  65  * In the heartbeat timer, if any CPU notices that the global timestamp has
  66  * not been updated for a period exceeding the watchdog threshold, then it
  67  * means the CPU(s) with their bit still set in the pending mask have had
  68  * their heartbeat stop, and action is taken.
  69  *
  70  * Some platforms implement true NMI IPIs, which can be used by the SMP
  71  * watchdog to detect an unresponsive CPU and pull it out of its stuck
  72  * state with the NMI IPI, to get crash/debug data from it. This way the
  73  * SMP watchdog can detect hardware interrupts off lockups.
  74  */
  75
  76 static cpumask_t wd_cpus_enabled __read_mostly;
  77
  78 static u64 wd_panic_timeout_tb __read_mostly; /* timebase ticks until panic */
  79 static u64 wd_smp_panic_timeout_tb __read_mostly; /* panic other CPUs */
  80
  81 static u64 wd_timer_period_ms __read_mostly;  /* interval between heartbeat */
  82
  83 static DEFINE_PER_CPU(struct hrtimer, wd_hrtimer);
  84 static DEFINE_PER_CPU(u64, wd_timer_tb);
  85
  86 /* SMP checker bits */
  87 static unsigned long __wd_smp_lock;
  88 static cpumask_t wd_smp_cpus_pending;
  89 static cpumask_t wd_smp_cpus_stuck;
  90 static u64 wd_smp_last_reset_tb;
  91
  92 static inline void wd_smp_lock(unsigned long *flags)
  93 {
  94         /*
  95          * Avoid locking layers if possible.
  96          * This may be called from low level interrupt handlers at some
  97          * point in future.
  98          */
  99         raw_local_irq_save(*flags);
 100         hard_irq_disable(); /* Make it soft-NMI safe */
 101         while (unlikely(test_and_set_bit_lock(0, &__wd_smp_lock))) {
 102                 raw_local_irq_restore(*flags);
 103                 spin_until_cond(!test_bit(0, &__wd_smp_lock));
 104                 raw_local_irq_save(*flags);
 105                 hard_irq_disable();
 106         }
 107 }
 108
 109 static inline void wd_smp_unlock(unsigned long *flags)
 110 {
 111         clear_bit_unlock(0, &__wd_smp_lock);
 112         raw_local_irq_restore(*flags);
 113 }
 114
 115 static void wd_lockup_ipi(struct pt_regs *regs)
 116 {
 117         int cpu = raw_smp_processor_id();
 118         u64 tb = get_tb();
 119
 120         pr_emerg("CPU %d Hard LOCKUP\n", cpu);
 121         pr_emerg("CPU %d TB:%lld, last heartbeat TB:%lld (%lldms ago)\n",
 122                  cpu, tb, per_cpu(wd_timer_tb, cpu),
 123                  tb_to_ns(tb - per_cpu(wd_timer_tb, cpu)) / 1000000);
 124         print_modules();
 125         print_irqtrace_events(current);
 126         if (regs)
 127                 show_regs(regs);
 128         else
 129                 dump_stack();
 130
 131         /* Do not panic from here because that can recurse into NMI IPI layer */
 132 }
 133
 134 static void set_cpumask_stuck(const struct cpumask *cpumask, u64 tb)
 135 {
 136         cpumask_or(&wd_smp_cpus_stuck, &wd_smp_cpus_stuck, cpumask);
 137         cpumask_andnot(&wd_smp_cpus_pending, &wd_smp_cpus_pending, cpumask);
 138         /*
 139          * See wd_smp_clear_cpu_pending()
 140          */
 141         smp_mb();
 142         if (cpumask_empty(&wd_smp_cpus_pending)) {
 143                 wd_smp_last_reset_tb = tb;
 144                 cpumask_andnot(&wd_smp_cpus_pending,
 145                                 &wd_cpus_enabled,
 146                                 &wd_smp_cpus_stuck);
 147         }
 148 }
 149 static void set_cpu_stuck(int cpu, u64 tb)
 150 {
 151         set_cpumask_stuck(cpumask_of(cpu), tb);
 152 }
 153
 154 static void watchdog_smp_panic(int cpu, u64 tb)
 155 {
 156         unsigned long flags;
 157         int c;
 158
 159         wd_smp_lock(&flags);
 160         /* Double check some things under lock */
 161         if ((s64)(tb - wd_smp_last_reset_tb) < (s64)wd_smp_panic_timeout_tb)
 162                 goto out;
 163         if (cpumask_test_cpu(cpu, &wd_smp_cpus_pending))
 164                 goto out;
 165         if (cpumask_weight(&wd_smp_cpus_pending) == 0)
 166                 goto out;
 167
 168         pr_emerg("CPU %d detected hard LOCKUP on other CPUs %*pbl\n",
 169                  cpu, cpumask_pr_args(&wd_smp_cpus_pending));
 170         pr_emerg("CPU %d TB:%lld, last SMP heartbeat TB:%lld (%lldms ago)\n",
 171                  cpu, tb, wd_smp_last_reset_tb,
 172                  tb_to_ns(tb - wd_smp_last_reset_tb) / 1000000);
 173
 174         if (!sysctl_hardlockup_all_cpu_backtrace) {
 175                 /*
 176                  * Try to trigger the stuck CPUs, unless we are going to
 177                  * get a backtrace on all of them anyway.
 178                  */
 179                 for_each_cpu(c, &wd_smp_cpus_pending) {
 180                         if (c == cpu)
 181                                 continue;
 182                         smp_send_nmi_ipi(c, wd_lockup_ipi, 1000000);
 183                 }
 184         }
 185
 186         /* Take the stuck CPUs out of the watch group */
 187         set_cpumask_stuck(&wd_smp_cpus_pending, tb);
 188
 189         wd_smp_unlock(&flags);
 190
 191         if (sysctl_hardlockup_all_cpu_backtrace)
 192                 trigger_allbutself_cpu_backtrace();
 193
 194         /*
 195          * Force flush any remote buffers that might be stuck in IRQ context
 196          * and therefore could not run their irq_work.
 197          */
 198         printk_trigger_flush();
 199
 200         if (hardlockup_panic)
 201                 nmi_panic(NULL, "Hard LOCKUP");
 202
 203         return;
 204
 205 out:
 206         wd_smp_unlock(&flags);
 207 }
 208
 209 static void wd_smp_clear_cpu_pending(int cpu, u64 tb)
 210 {
 211         if (!cpumask_test_cpu(cpu, &wd_smp_cpus_pending)) {
 212                 if (unlikely(cpumask_test_cpu(cpu, &wd_smp_cpus_stuck))) {
 213                         struct pt_regs *regs = get_irq_regs();
 214                         unsigned long flags;
 215
 216                         wd_smp_lock(&flags);
 217
 218                         pr_emerg("CPU %d became unstuck TB:%lld\n",
 219                                  cpu, tb);
 220                         print_irqtrace_events(current);
 221                         if (regs)
 222                                 show_regs(regs);
 223                         else
 224                                 dump_stack();
 225
 226                         cpumask_clear_cpu(cpu, &wd_smp_cpus_stuck);
 227                         wd_smp_unlock(&flags);
 228                 } else {
 229                         /*
 230                          * The last CPU to clear pending should have reset the
 231                          * watchdog so we generally should not find it empty
 232                          * here if our CPU was clear. However it could happen
 233                          * due to a rare race with another CPU taking the
 234                          * last CPU out of the mask concurrently.
 235                          *
 236                          * We can't add a warning for it. But just in case
 237                          * there is a problem with the watchdog that is causing
 238                          * the mask to not be reset, try to kick it along here.
 239                          */
 240                         if (unlikely(cpumask_empty(&wd_smp_cpus_pending)))
 241                                 goto none_pending;
 242                 }
 243                 return;
 244         }
 245
 246         cpumask_clear_cpu(cpu, &wd_smp_cpus_pending);
 247
 248         /*
 249          * Order the store to clear pending with the load(s) to check all
 250          * words in the pending mask to check they are all empty. This orders
 251          * with the same barrier on another CPU. This prevents two CPUs
 252          * clearing the last 2 pending bits, but neither seeing the other's
 253          * store when checking if the mask is empty, and missing an empty
 254          * mask, which ends with a false positive.
 255          */
 256         smp_mb();
 257         if (cpumask_empty(&wd_smp_cpus_pending)) {
 258                 unsigned long flags;
 259
 260 none_pending:
 261                 /*
 262                  * Double check under lock because more than one CPU could see
 263                  * a clear mask with the lockless check after clearing their
 264                  * pending bits.
 265                  */
 266                 wd_smp_lock(&flags);
 267                 if (cpumask_empty(&wd_smp_cpus_pending)) {
 268                         wd_smp_last_reset_tb = tb;
 269                         cpumask_andnot(&wd_smp_cpus_pending,
 270                                         &wd_cpus_enabled,
 271                                         &wd_smp_cpus_stuck);
 272                 }
 273                 wd_smp_unlock(&flags);
 274         }
 275 }
 276
 277 static void watchdog_timer_interrupt(int cpu)
 278 {
 279         u64 tb = get_tb();
 280
 281         per_cpu(wd_timer_tb, cpu) = tb;
 282
 283         wd_smp_clear_cpu_pending(cpu, tb);
 284
 285         if ((s64)(tb - wd_smp_last_reset_tb) >= (s64)wd_smp_panic_timeout_tb)
 286                 watchdog_smp_panic(cpu, tb);
 287 }
 288
 289 DEFINE_INTERRUPT_HANDLER_NMI(soft_nmi_interrupt)
 290 {
 291         unsigned long flags;
 292         int cpu = raw_smp_processor_id();
 293         u64 tb;
 294
 295         /* should only arrive from kernel, with irqs disabled */
 296         WARN_ON_ONCE(!arch_irq_disabled_regs(regs));
 297
 298         if (!cpumask_test_cpu(cpu, &wd_cpus_enabled))
 299                 return 0;
 300
 301         __this_cpu_inc(irq_stat.soft_nmi_irqs);
 302
 303         tb = get_tb();
 304         if (tb - per_cpu(wd_timer_tb, cpu) >= wd_panic_timeout_tb) {
 305                 wd_smp_lock(&flags);
 306                 if (cpumask_test_cpu(cpu, &wd_smp_cpus_stuck)) {
 307                         wd_smp_unlock(&flags);
 308                         return 0;
 309                 }
 310                 set_cpu_stuck(cpu, tb);
 311
 312                 pr_emerg("CPU %d self-detected hard LOCKUP @ %pS\n",
 313                          cpu, (void *)regs->nip);
 314                 pr_emerg("CPU %d TB:%lld, last heartbeat TB:%lld (%lldms ago)\n",
 315                          cpu, tb, per_cpu(wd_timer_tb, cpu),
 316                          tb_to_ns(tb - per_cpu(wd_timer_tb, cpu)) / 1000000);
 317                 print_modules();
 318                 print_irqtrace_events(current);
 319                 show_regs(regs);
 320
 321                 wd_smp_unlock(&flags);
 322
 323                 if (sysctl_hardlockup_all_cpu_backtrace)
 324                         trigger_allbutself_cpu_backtrace();
 325
 326                 if (hardlockup_panic)
 327                         nmi_panic(regs, "Hard LOCKUP");
 328         }
 329         if (wd_panic_timeout_tb < 0x7fffffff)
 330                 mtspr(SPRN_DEC, wd_panic_timeout_tb);
 331
 332         return 0;
 333 }
 334
 335 static enum hrtimer_restart watchdog_timer_fn(struct hrtimer *hrtimer)
 336 {
 337         int cpu = smp_processor_id();
 338
 339         if (!(watchdog_enabled & NMI_WATCHDOG_ENABLED))
 340                 return HRTIMER_NORESTART;
 341
 342         if (!cpumask_test_cpu(cpu, &watchdog_cpumask))
 343                 return HRTIMER_NORESTART;
 344
 345         watchdog_timer_interrupt(cpu);
 346
 347         hrtimer_forward_now(hrtimer, ms_to_ktime(wd_timer_period_ms));
 348
 349         return HRTIMER_RESTART;
 350 }
 351
 352 void arch_touch_nmi_watchdog(void)
 353 {
 354         unsigned long ticks = tb_ticks_per_usec * wd_timer_period_ms * 1000;
 355         int cpu = smp_processor_id();
 356         u64 tb;
 357
 358         if (!cpumask_test_cpu(cpu, &watchdog_cpumask))
 359                 return;
 360
 361         tb = get_tb();
 362         if (tb - per_cpu(wd_timer_tb, cpu) >= ticks) {
 363                 per_cpu(wd_timer_tb, cpu) = tb;
 364                 wd_smp_clear_cpu_pending(cpu, tb);
 365         }
 366 }
 367 EXPORT_SYMBOL(arch_touch_nmi_watchdog);
 368
 369 static void start_watchdog(void *arg)
 370 {
 371         struct hrtimer *hrtimer = this_cpu_ptr(&wd_hrtimer);
 372         int cpu = smp_processor_id();
 373         unsigned long flags;
 374
 375         if (cpumask_test_cpu(cpu, &wd_cpus_enabled)) {
 376                 WARN_ON(1);
 377                 return;
 378         }
 379
 380         if (!(watchdog_enabled & NMI_WATCHDOG_ENABLED))
 381                 return;
 382
 383         if (!cpumask_test_cpu(cpu, &watchdog_cpumask))
 384                 return;
 385
 386         wd_smp_lock(&flags);
 387         cpumask_set_cpu(cpu, &wd_cpus_enabled);
 388         if (cpumask_weight(&wd_cpus_enabled) == 1) {
 389                 cpumask_set_cpu(cpu, &wd_smp_cpus_pending);
 390                 wd_smp_last_reset_tb = get_tb();
 391         }
 392         wd_smp_unlock(&flags);
 393
 394         *this_cpu_ptr(&wd_timer_tb) = get_tb();
 395
 396         hrtimer_init(hrtimer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
 397         hrtimer->function = watchdog_timer_fn;
 398         hrtimer_start(hrtimer, ms_to_ktime(wd_timer_period_ms),
 399                       HRTIMER_MODE_REL_PINNED);
 400 }
 401
 402 static int start_watchdog_on_cpu(unsigned int cpu)
 403 {
 404         return smp_call_function_single(cpu, start_watchdog, NULL, true);
 405 }
 406
 407 static void stop_watchdog(void *arg)
 408 {
 409         struct hrtimer *hrtimer = this_cpu_ptr(&wd_hrtimer);
 410         int cpu = smp_processor_id();
 411         unsigned long flags;
 412
 413         if (!cpumask_test_cpu(cpu, &wd_cpus_enabled))
 414                 return; /* Can happen in CPU unplug case */
 415
 416         hrtimer_cancel(hrtimer);
 417
 418         wd_smp_lock(&flags);
 419         cpumask_clear_cpu(cpu, &wd_cpus_enabled);
 420         wd_smp_unlock(&flags);
 421
 422         wd_smp_clear_cpu_pending(cpu, get_tb());
 423 }
 424
 425 static int stop_watchdog_on_cpu(unsigned int cpu)
 426 {
 427         return smp_call_function_single(cpu, stop_watchdog, NULL, true);
 428 }
 429
 430 static void watchdog_calc_timeouts(void)
 431 {
 432         wd_panic_timeout_tb = watchdog_thresh * ppc_tb_freq;
 433
 434         /* Have the SMP detector trigger a bit later */
 435         wd_smp_panic_timeout_tb = wd_panic_timeout_tb * 3 / 2;
 436
 437         /* 2/5 is the factor that the perf based detector uses */
 438         wd_timer_period_ms = watchdog_thresh * 1000 * 2 / 5;
 439 }
 440
 441 void watchdog_nmi_stop(void)
 442 {
 443         int cpu;
 444
 445         for_each_cpu(cpu, &wd_cpus_enabled)
 446                 stop_watchdog_on_cpu(cpu);
 447 }
 448
 449 void watchdog_nmi_start(void)
 450 {
 451         int cpu;
 452
 453         watchdog_calc_timeouts();
 454         for_each_cpu_and(cpu, cpu_online_mask, &watchdog_cpumask)
 455                 start_watchdog_on_cpu(cpu);
 456 }
 457
 458 /*
 459  * Invoked from core watchdog init.
 460  */
 461 int __init watchdog_nmi_probe(void)
 462 {
 463         int err;
 464
 465         err = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN,
 466                                         "powerpc/watchdog:online",
 467                                         start_watchdog_on_cpu,
 468                                         stop_watchdog_on_cpu);
 469         if (err < 0) {
 470                 pr_warn("could not be initialized");
 471                 return err;
 472         }
 473         return 0;
 474 }