mce.c 48.9 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1
2
/*
 * Machine check handler.
Ingo Molnar's avatar
Ingo Molnar committed
3
 *
Linus Torvalds's avatar
Linus Torvalds committed
4
 * K8 parts Copyright 2002,2003 Andi Kleen, SuSE Labs.
5
6
 * Rest from unknown author(s).
 * 2004 Andi Kleen. Rewrote most of it.
7
8
 * Copyright 2008 Intel Corporation
 * Author: Andi Kleen
Linus Torvalds's avatar
Linus Torvalds committed
9
 */
Ingo Molnar's avatar
Ingo Molnar committed
10
11
12
#include <linux/thread_info.h>
#include <linux/capability.h>
#include <linux/miscdevice.h>
13
#include <linux/interrupt.h>
Ingo Molnar's avatar
Ingo Molnar committed
14
15
16
17
#include <linux/ratelimit.h>
#include <linux/kallsyms.h>
#include <linux/rcupdate.h>
#include <linux/kobject.h>
18
#include <linux/uaccess.h>
Ingo Molnar's avatar
Ingo Molnar committed
19
20
21
#include <linux/kdebug.h>
#include <linux/kernel.h>
#include <linux/percpu.h>
Linus Torvalds's avatar
Linus Torvalds committed
22
23
#include <linux/string.h>
#include <linux/sysdev.h>
24
#include <linux/delay.h>
25
#include <linux/ctype.h>
Ingo Molnar's avatar
Ingo Molnar committed
26
#include <linux/sched.h>
27
#include <linux/sysfs.h>
Ingo Molnar's avatar
Ingo Molnar committed
28
29
30
31
#include <linux/types.h>
#include <linux/init.h>
#include <linux/kmod.h>
#include <linux/poll.h>
32
#include <linux/nmi.h>
Ingo Molnar's avatar
Ingo Molnar committed
33
#include <linux/cpu.h>
34
#include <linux/smp.h>
Ingo Molnar's avatar
Ingo Molnar committed
35
#include <linux/fs.h>
36
#include <linux/mm.h>
37
#include <linux/debugfs.h>
Ingo Molnar's avatar
Ingo Molnar committed
38

39
#include <asm/processor.h>
40
41
#include <asm/hw_irq.h>
#include <asm/apic.h>
42
#include <asm/idle.h>
43
#include <asm/ipi.h>
Ingo Molnar's avatar
Ingo Molnar committed
44
45
#include <asm/mce.h>
#include <asm/msr.h>
Linus Torvalds's avatar
Linus Torvalds committed
46

47
#include "mce-internal.h"
48

49
50
51
52
53
#define rcu_dereference_check_mce(p) \
	rcu_dereference_check((p), \
			      rcu_read_lock_sched_held() || \
			      lockdep_is_held(&mce_read_mutex))

54
55
56
#define CREATE_TRACE_POINTS
#include <trace/events/mce.h>

Hidetoshi Seto's avatar
Hidetoshi Seto committed
57
int mce_disabled __read_mostly;
58

Ingo Molnar's avatar
Ingo Molnar committed
59
#define MISC_MCELOG_MINOR	227
60

61
62
#define SPINUNIT 100	/* 100ns */

63
64
atomic_t mce_entry;

65
66
DEFINE_PER_CPU(unsigned, mce_exception_count);

67
68
69
70
71
72
73
/*
 * Tolerant levels:
 *   0: always panic on uncorrected errors, log corrected errors
 *   1: panic or SIGBUS on uncorrected errors, log corrected errors
 *   2: SIGBUS or log uncorrected errors (if possible), log corrected errors
 *   3: never panic or SIGBUS, log all errors (for testing only)
 */
Hidetoshi Seto's avatar
Hidetoshi Seto committed
74
75
76
77
78
79
80
81
82
83
static int			tolerant		__read_mostly = 1;
static int			banks			__read_mostly;
static int			rip_msr			__read_mostly;
static int			mce_bootlog		__read_mostly = -1;
static int			monarch_timeout		__read_mostly = -1;
static int			mce_panic_timeout	__read_mostly;
static int			mce_dont_log_ce		__read_mostly;
int				mce_cmci_disabled	__read_mostly;
int				mce_ignore_ce		__read_mostly;
int				mce_ser			__read_mostly;
84

85
86
struct mce_bank                *mce_banks		__read_mostly;

87
88
89
90
/* User mode helper program triggered by machine check event */
static unsigned long		mce_need_notify;
static char			mce_helper[128];
static char			*mce_helper_argv[2] = { mce_helper, NULL };
Linus Torvalds's avatar
Linus Torvalds committed
91

92
static DECLARE_WAIT_QUEUE_HEAD(mce_wait);
93
94
95
static DEFINE_PER_CPU(struct mce, mces_seen);
static int			cpu_missing;

96
97
98
99
100
101
102
103
104
/*
 * CPU/chipset specific EDAC code can register a notifier call here to print
 * MCE errors in a human-readable form.
 */
ATOMIC_NOTIFIER_HEAD(x86_mce_decoder_chain);
EXPORT_SYMBOL_GPL(x86_mce_decoder_chain);

static int default_decode_mce(struct notifier_block *nb, unsigned long val,
			       void *data)
105
106
107
{
	pr_emerg("No human readable MCE decoding support on this CPU type.\n");
	pr_emerg("Run the message through 'mcelog --ascii' to decode.\n");
108
109

	return NOTIFY_STOP;
110
111
}

112
113
114
115
static struct notifier_block mce_dec_nb = {
	.notifier_call = default_decode_mce,
	.priority      = -1,
};
116

117
118
119
120
121
/* MCA banks polled by the period polling timer for corrected events */
DEFINE_PER_CPU(mce_banks_t, mce_poll_banks) = {
	[0 ... BITS_TO_LONGS(MAX_NR_BANKS)-1] = ~0UL
};

122
123
static DEFINE_PER_CPU(struct work_struct, mce_work);

124
125
126
127
/* Do initial initialization of a struct mce */
void mce_setup(struct mce *m)
{
	memset(m, 0, sizeof(struct mce));
128
	m->cpu = m->extcpu = smp_processor_id();
129
	rdtscll(m->tsc);
130
131
132
133
134
135
136
137
138
	/* We hope get_seconds stays lockless */
	m->time = get_seconds();
	m->cpuvendor = boot_cpu_data.x86_vendor;
	m->cpuid = cpuid_eax(1);
#ifdef CONFIG_SMP
	m->socketid = cpu_data(m->extcpu).phys_proc_id;
#endif
	m->apicid = cpu_data(m->extcpu).initial_apicid;
	rdmsrl(MSR_IA32_MCG_CAP, m->mcgcap);
139
140
}

141
142
143
DEFINE_PER_CPU(struct mce, injectm);
EXPORT_PER_CPU_SYMBOL_GPL(injectm);

Linus Torvalds's avatar
Linus Torvalds committed
144
145
146
147
148
149
/*
 * Lockless MCE logging infrastructure.
 * This avoids deadlocks on printk locks without having to break locks. Also
 * separate MCEs from kernel messages to avoid bogus bug reports.
 */

150
static struct mce_log mcelog = {
151
152
153
	.signature	= MCE_LOG_SIGNATURE,
	.len		= MCE_LOG_LEN,
	.recordlen	= sizeof(struct mce),
154
};
Linus Torvalds's avatar
Linus Torvalds committed
155
156
157
158

void mce_log(struct mce *mce)
{
	unsigned next, entry;
Ingo Molnar's avatar
Ingo Molnar committed
159

160
161
162
	/* Emit the trace record: */
	trace_mce_record(mce);

Linus Torvalds's avatar
Linus Torvalds committed
163
	mce->finished = 0;
Mike Waychison's avatar
Mike Waychison committed
164
	wmb();
Linus Torvalds's avatar
Linus Torvalds committed
165
	for (;;) {
166
		entry = rcu_dereference_check_mce(mcelog.next);
167
		for (;;) {
Ingo Molnar's avatar
Ingo Molnar committed
168
169
170
171
172
			/*
			 * When the buffer fills up discard new entries.
			 * Assume that the earlier errors are the more
			 * interesting ones:
			 */
173
			if (entry >= MCE_LOG_LEN) {
174
175
				set_bit(MCE_OVERFLOW,
					(unsigned long *)&mcelog.flags);
176
177
				return;
			}
Ingo Molnar's avatar
Ingo Molnar committed
178
			/* Old left over entry. Skip: */
179
180
181
182
			if (mcelog.entry[entry].finished) {
				entry++;
				continue;
			}
Mike Waychison's avatar
Mike Waychison committed
183
			break;
Linus Torvalds's avatar
Linus Torvalds committed
184
185
186
187
188
189
190
		}
		smp_rmb();
		next = entry + 1;
		if (cmpxchg(&mcelog.next, entry, next) == entry)
			break;
	}
	memcpy(mcelog.entry + entry, mce, sizeof(struct mce));
Mike Waychison's avatar
Mike Waychison committed
191
	wmb();
Linus Torvalds's avatar
Linus Torvalds committed
192
	mcelog.entry[entry].finished = 1;
Mike Waychison's avatar
Mike Waychison committed
193
	wmb();
Linus Torvalds's avatar
Linus Torvalds committed
194

195
	mce->finished = 1;
196
	set_bit(0, &mce_need_notify);
Linus Torvalds's avatar
Linus Torvalds committed
197
198
}

Hidetoshi Seto's avatar
Hidetoshi Seto committed
199
static void print_mce(struct mce *m)
Linus Torvalds's avatar
Linus Torvalds committed
200
{
201
	pr_emerg("CPU %d: Machine Check Exception: %16Lx Bank %d: %016Lx\n",
202
	       m->extcpu, m->mcgstatus, m->bank, m->status);
203

204
	if (m->ip) {
205
206
207
208
		pr_emerg("RIP%s %02x:<%016Lx> ",
			!(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
				m->cs, m->ip);

Linus Torvalds's avatar
Linus Torvalds committed
209
		if (m->cs == __KERNEL_CS)
210
			print_symbol("{%s}", m->ip);
211
		pr_cont("\n");
Linus Torvalds's avatar
Linus Torvalds committed
212
	}
213
214

	pr_emerg("TSC %llx ", m->tsc);
Linus Torvalds's avatar
Linus Torvalds committed
215
	if (m->addr)
216
		pr_cont("ADDR %llx ", m->addr);
Linus Torvalds's avatar
Linus Torvalds committed
217
	if (m->misc)
218
		pr_cont("MISC %llx ", m->misc);
219

220
221
222
223
224
225
	pr_cont("\n");
	pr_emerg("PROCESSOR %u:%x TIME %llu SOCKET %u APIC %x\n",
		m->cpuvendor, m->cpuid, m->time, m->socketid, m->apicid);

	/*
	 * Print out human-readable details about the MCE error,
226
	 * (if the CPU has an implementation for that)
227
	 */
228
	atomic_notifier_call_chain(&x86_mce_decoder_chain, 0, m);
229
230
}

Hidetoshi Seto's avatar
Hidetoshi Seto committed
231
232
static void print_mce_head(void)
{
233
	pr_emerg("\nHARDWARE ERROR\n");
Hidetoshi Seto's avatar
Hidetoshi Seto committed
234
235
}

236
237
static void print_mce_tail(void)
{
238
	pr_emerg("This is not a software problem!\n");
Linus Torvalds's avatar
Linus Torvalds committed
239
240
}

241
242
243
244
#define PANIC_TIMEOUT 5 /* 5 seconds */

static atomic_t mce_paniced;

245
246
247
static int fake_panic;
static atomic_t mce_fake_paniced;

248
249
250
251
/* Panic in progress. Enable interrupts and wait for final IPI */
static void wait_for_panic(void)
{
	long timeout = PANIC_TIMEOUT*USEC_PER_SEC;
252

253
254
255
256
	preempt_disable();
	local_irq_enable();
	while (timeout-- > 0)
		udelay(1);
257
258
	if (panic_timeout == 0)
		panic_timeout = mce_panic_timeout;
259
260
261
	panic("Panicing machine check CPU died");
}

262
static void mce_panic(char *msg, struct mce *final, char *exp)
263
{
Linus Torvalds's avatar
Linus Torvalds committed
264
	int i;
265

266
267
268
269
270
271
272
	if (!fake_panic) {
		/*
		 * Make sure only one CPU runs in machine check panic
		 */
		if (atomic_inc_return(&mce_paniced) > 1)
			wait_for_panic();
		barrier();
273

274
275
276
277
278
279
280
		bust_spinlocks(1);
		console_verbose();
	} else {
		/* Don't log too much for fake panic */
		if (atomic_inc_return(&mce_fake_paniced) > 1)
			return;
	}
Hidetoshi Seto's avatar
Hidetoshi Seto committed
281
	print_mce_head();
282
	/* First print corrected ones that are still unlogged */
Linus Torvalds's avatar
Linus Torvalds committed
283
	for (i = 0; i < MCE_LOG_LEN; i++) {
284
		struct mce *m = &mcelog.entry[i];
Hidetoshi Seto's avatar
Hidetoshi Seto committed
285
286
287
288
		if (!(m->status & MCI_STATUS_VAL))
			continue;
		if (!(m->status & MCI_STATUS_UC))
			print_mce(m);
289
290
291
292
293
	}
	/* Now print uncorrected but with the final one last */
	for (i = 0; i < MCE_LOG_LEN; i++) {
		struct mce *m = &mcelog.entry[i];
		if (!(m->status & MCI_STATUS_VAL))
Linus Torvalds's avatar
Linus Torvalds committed
294
			continue;
Hidetoshi Seto's avatar
Hidetoshi Seto committed
295
296
		if (!(m->status & MCI_STATUS_UC))
			continue;
297
		if (!final || memcmp(m, final, sizeof(struct mce)))
Hidetoshi Seto's avatar
Hidetoshi Seto committed
298
			print_mce(m);
Linus Torvalds's avatar
Linus Torvalds committed
299
	}
300
	if (final)
Hidetoshi Seto's avatar
Hidetoshi Seto committed
301
		print_mce(final);
302
303
	if (cpu_missing)
		printk(KERN_EMERG "Some CPUs didn't answer in synchronization\n");
304
	print_mce_tail();
305
306
	if (exp)
		printk(KERN_EMERG "Machine check: %s\n", exp);
307
308
309
310
311
312
	if (!fake_panic) {
		if (panic_timeout == 0)
			panic_timeout = mce_panic_timeout;
		panic(msg);
	} else
		printk(KERN_EMERG "Fake kernel panic: %s\n", msg);
313
}
Linus Torvalds's avatar
Linus Torvalds committed
314

315
316
317
318
319
/* Support code for software error injection */

static int msr_to_offset(u32 msr)
{
	unsigned bank = __get_cpu_var(injectm.bank);
320

321
322
	if (msr == rip_msr)
		return offsetof(struct mce, ip);
323
	if (msr == MSR_IA32_MCx_STATUS(bank))
324
		return offsetof(struct mce, status);
325
	if (msr == MSR_IA32_MCx_ADDR(bank))
326
		return offsetof(struct mce, addr);
327
	if (msr == MSR_IA32_MCx_MISC(bank))
328
329
330
331
332
333
		return offsetof(struct mce, misc);
	if (msr == MSR_IA32_MCG_STATUS)
		return offsetof(struct mce, mcgstatus);
	return -1;
}

334
335
336
337
/* MSR access wrappers used for error injection */
static u64 mce_rdmsrl(u32 msr)
{
	u64 v;
338

339
340
	if (__get_cpu_var(injectm).finished) {
		int offset = msr_to_offset(msr);
341

342
343
344
345
		if (offset < 0)
			return 0;
		return *(u64 *)((char *)&__get_cpu_var(injectm) + offset);
	}
346
347
348
349
350
351
352
353
354
355
356

	if (rdmsrl_safe(msr, &v)) {
		WARN_ONCE(1, "mce: Unable to read msr %d!\n", msr);
		/*
		 * Return zero in case the access faulted. This should
		 * not happen normally but can happen if the CPU does
		 * something weird, or if the code is buggy.
		 */
		v = 0;
	}

357
358
359
360
361
	return v;
}

static void mce_wrmsrl(u32 msr, u64 v)
{
362
363
	if (__get_cpu_var(injectm).finished) {
		int offset = msr_to_offset(msr);
364

365
366
367
368
		if (offset >= 0)
			*(u64 *)((char *)&__get_cpu_var(injectm) + offset) = v;
		return;
	}
369
370
371
	wrmsrl(msr, v);
}

372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
/*
 * Simple lockless ring to communicate PFNs from the exception handler with the
 * process context work function. This is vastly simplified because there's
 * only a single reader and a single writer.
 */
#define MCE_RING_SIZE 16	/* we use one entry less */

struct mce_ring {
	unsigned short start;
	unsigned short end;
	unsigned long ring[MCE_RING_SIZE];
};
static DEFINE_PER_CPU(struct mce_ring, mce_ring);

/* Runs with CPU affinity in workqueue */
static int mce_ring_empty(void)
{
	struct mce_ring *r = &__get_cpu_var(mce_ring);

	return r->start == r->end;
}

static int mce_ring_get(unsigned long *pfn)
{
	struct mce_ring *r;
	int ret = 0;

	*pfn = 0;
	get_cpu();
	r = &__get_cpu_var(mce_ring);
	if (r->start == r->end)
		goto out;
	*pfn = r->ring[r->start];
	r->start = (r->start + 1) % MCE_RING_SIZE;
	ret = 1;
out:
	put_cpu();
	return ret;
}

/* Always runs in MCE context with preempt off */
static int mce_ring_add(unsigned long pfn)
{
	struct mce_ring *r = &__get_cpu_var(mce_ring);
	unsigned next;

	next = (r->end + 1) % MCE_RING_SIZE;
	if (next == r->start)
		return -1;
	r->ring[r->end] = pfn;
	wmb();
	r->end = next;
	return 0;
}

Andi Kleen's avatar
Andi Kleen committed
427
int mce_available(struct cpuinfo_x86 *c)
Linus Torvalds's avatar
Linus Torvalds committed
428
{
429
	if (mce_disabled)
430
		return 0;
431
	return cpu_has(c, X86_FEATURE_MCE) && cpu_has(c, X86_FEATURE_MCA);
Linus Torvalds's avatar
Linus Torvalds committed
432
433
}

434
435
436
437
438
439
440
441
442
static void mce_schedule_work(void)
{
	if (!mce_ring_empty()) {
		struct work_struct *work = &__get_cpu_var(mce_work);
		if (!work_pending(work))
			schedule_work(work);
	}
}

Huang Ying's avatar
Huang Ying committed
443
444
445
446
/*
 * Get the address of the instruction at the time of the machine check
 * error.
 */
447
448
static inline void mce_get_rip(struct mce *m, struct pt_regs *regs)
{
Huang Ying's avatar
Huang Ying committed
449
450

	if (regs && (m->mcgstatus & (MCG_STATUS_RIPV|MCG_STATUS_EIPV))) {
451
		m->ip = regs->ip;
452
453
		m->cs = regs->cs;
	} else {
454
		m->ip = 0;
455
456
		m->cs = 0;
	}
Huang Ying's avatar
Huang Ying committed
457
	if (rip_msr)
458
		m->ip = mce_rdmsrl(rip_msr);
459
460
}

461
#ifdef CONFIG_X86_LOCAL_APIC
462
463
464
465
466
467
468
469
470
471
/*
 * Called after interrupts have been reenabled again
 * when a MCE happened during an interrupts off region
 * in the kernel.
 */
asmlinkage void smp_mce_self_interrupt(struct pt_regs *regs)
{
	ack_APIC_irq();
	exit_idle();
	irq_enter();
472
	mce_notify_irq();
473
	mce_schedule_work();
474
475
476
477
478
479
480
	irq_exit();
}
#endif

static void mce_report_event(struct pt_regs *regs)
{
	if (regs->flags & (X86_VM_MASK|X86_EFLAGS_IF)) {
481
		mce_notify_irq();
482
483
484
485
486
487
488
		/*
		 * Triggering the work queue here is just an insurance
		 * policy in case the syscall exit notify handler
		 * doesn't run soon enough or ends up running on the
		 * wrong CPU (can happen when audit sleeps)
		 */
		mce_schedule_work();
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
		return;
	}

#ifdef CONFIG_X86_LOCAL_APIC
	/*
	 * Without APIC do not notify. The event will be picked
	 * up eventually.
	 */
	if (!cpu_has_apic)
		return;

	/*
	 * When interrupts are disabled we cannot use
	 * kernel services safely. Trigger an self interrupt
	 * through the APIC to instead do the notification
	 * after interrupts are reenabled again.
	 */
	apic->send_IPI_self(MCE_SELF_VECTOR);

	/*
	 * Wait for idle afterwards again so that we don't leave the
	 * APIC in a non idle state because the normal APIC writes
	 * cannot exclude us.
	 */
	apic_wait_icr_idle();
#endif
}

517
518
DEFINE_PER_CPU(unsigned, mce_poll_count);

519
/*
520
521
522
523
 * Poll for corrected events or events that happened before reset.
 * Those are just logged through /dev/mcelog.
 *
 * This is executed in standard interrupt context.
524
525
526
527
528
529
530
531
532
 *
 * Note: spec recommends to panic for fatal unsignalled
 * errors here. However this would be quite problematic --
 * we would need to reimplement the Monarch handling and
 * it would mess up the exclusion between exception handler
 * and poll hander -- * so we skip this for now.
 * These cases should not happen anyways, or only when the CPU
 * is already totally * confused. In this case it's likely it will
 * not fully execute the machine check handler either.
533
 */
534
void machine_check_poll(enum mcp_flags flags, mce_banks_t *b)
535
536
537
538
{
	struct mce m;
	int i;

539
540
	__get_cpu_var(mce_poll_count)++;

541
542
	mce_setup(&m);

543
	m.mcgstatus = mce_rdmsrl(MSR_IA32_MCG_STATUS);
544
	for (i = 0; i < banks; i++) {
545
		if (!mce_banks[i].ctl || !test_bit(i, *b))
546
547
548
549
550
551
552
553
			continue;

		m.misc = 0;
		m.addr = 0;
		m.bank = i;
		m.tsc = 0;

		barrier();
554
		m.status = mce_rdmsrl(MSR_IA32_MCx_STATUS(i));
555
556
557
558
		if (!(m.status & MCI_STATUS_VAL))
			continue;

		/*
559
560
		 * Uncorrected or signalled events are handled by the exception
		 * handler when it is enabled, so don't process those here.
561
562
563
		 *
		 * TBD do the same check for MCI_STATUS_EN here?
		 */
564
565
		if (!(flags & MCP_UC) &&
		    (m.status & (mce_ser ? MCI_STATUS_S : MCI_STATUS_UC)))
566
567
568
			continue;

		if (m.status & MCI_STATUS_MISCV)
569
			m.misc = mce_rdmsrl(MSR_IA32_MCx_MISC(i));
570
		if (m.status & MCI_STATUS_ADDRV)
571
			m.addr = mce_rdmsrl(MSR_IA32_MCx_ADDR(i));
572
573
574
575
576
577
578

		if (!(flags & MCP_TIMESTAMP))
			m.tsc = 0;
		/*
		 * Don't get the IP here because it's unlikely to
		 * have anything to do with the actual error location.
		 */
579
		if (!(flags & MCP_DONTLOG) && !mce_dont_log_ce) {
Andi Kleen's avatar
Andi Kleen committed
580
581
582
			mce_log(&m);
			add_taint(TAINT_MACHINE_CHECK);
		}
583
584
585
586

		/*
		 * Clear state for this bank.
		 */
587
		mce_wrmsrl(MSR_IA32_MCx_STATUS(i), 0);
588
589
590
591
592
593
	}

	/*
	 * Don't clear MCG_STATUS here because it's only defined for
	 * exceptions.
	 */
594
595

	sync_core();
596
}
597
EXPORT_SYMBOL_GPL(machine_check_poll);
598

599
600
601
602
603
604
605
606
607
/*
 * Do a quick check if any of the events requires a panic.
 * This decides if we keep the events around or clear them.
 */
static int mce_no_way_out(struct mce *m, char **msg)
{
	int i;

	for (i = 0; i < banks; i++) {
608
		m->status = mce_rdmsrl(MSR_IA32_MCx_STATUS(i));
609
610
611
612
613
614
		if (mce_severity(m, tolerant, msg) >= MCE_PANIC_SEVERITY)
			return 1;
	}
	return 0;
}

615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
/*
 * Variable to establish order between CPUs while scanning.
 * Each CPU spins initially until executing is equal its number.
 */
static atomic_t mce_executing;

/*
 * Defines order of CPUs on entry. First CPU becomes Monarch.
 */
static atomic_t mce_callin;

/*
 * Check if a timeout waiting for other CPUs happened.
 */
static int mce_timed_out(u64 *t)
{
	/*
	 * The others already did panic for some reason.
	 * Bail out like in a timeout.
	 * rmb() to tell the compiler that system_state
	 * might have been modified by someone else.
	 */
	rmb();
	if (atomic_read(&mce_paniced))
		wait_for_panic();
	if (!monarch_timeout)
		goto out;
	if ((s64)*t < SPINUNIT) {
		/* CHECKME: Make panic default for 1 too? */
		if (tolerant < 1)
			mce_panic("Timeout synchronizing machine check over CPUs",
				  NULL, NULL);
		cpu_missing = 1;
		return 1;
	}
	*t -= SPINUNIT;
out:
	touch_nmi_watchdog();
	return 0;
}

/*
 * The Monarch's reign.  The Monarch is the CPU who entered
 * the machine check handler first. It waits for the others to
 * raise the exception too and then grades them. When any
 * error is fatal panic. Only then let the others continue.
 *
 * The other CPUs entering the MCE handler will be controlled by the
 * Monarch. They are called Subjects.
 *
 * This way we prevent any potential data corruption in a unrecoverable case
 * and also makes sure always all CPU's errors are examined.
 *
668
 * Also this detects the case of a machine check event coming from outer
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
 * space (not detected by any CPUs) In this case some external agent wants
 * us to shut down, so panic too.
 *
 * The other CPUs might still decide to panic if the handler happens
 * in a unrecoverable place, but in this case the system is in a semi-stable
 * state and won't corrupt anything by itself. It's ok to let the others
 * continue for a bit first.
 *
 * All the spin loops have timeouts; when a timeout happens a CPU
 * typically elects itself to be Monarch.
 */
static void mce_reign(void)
{
	int cpu;
	struct mce *m = NULL;
	int global_worst = 0;
	char *msg = NULL;
	char *nmsg = NULL;

	/*
	 * This CPU is the Monarch and the other CPUs have run
	 * through their handlers.
	 * Grade the severity of the errors of all the CPUs.
	 */
	for_each_possible_cpu(cpu) {
		int severity = mce_severity(&per_cpu(mces_seen, cpu), tolerant,
					    &nmsg);
		if (severity > global_worst) {
			msg = nmsg;
			global_worst = severity;
			m = &per_cpu(mces_seen, cpu);
		}
	}

	/*
	 * Cannot recover? Panic here then.
	 * This dumps all the mces in the log buffer and stops the
	 * other CPUs.
	 */
	if (m && global_worst >= MCE_PANIC_SEVERITY && tolerant < 3)
709
		mce_panic("Fatal Machine check", m, msg);
710
711
712
713
714
715
716
717
718
719
720

	/*
	 * For UC somewhere we let the CPU who detects it handle it.
	 * Also must let continue the others, otherwise the handling
	 * CPU could deadlock on a lock.
	 */

	/*
	 * No machine check event found. Must be some external
	 * source or one CPU is hung. Panic.
	 */
721
	if (global_worst <= MCE_KEEP_SEVERITY && tolerant < 3)
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
		mce_panic("Machine check from unknown source", NULL, NULL);

	/*
	 * Now clear all the mces_seen so that they don't reappear on
	 * the next mce.
	 */
	for_each_possible_cpu(cpu)
		memset(&per_cpu(mces_seen, cpu), 0, sizeof(struct mce));
}

static atomic_t global_nwo;

/*
 * Start of Monarch synchronization. This waits until all CPUs have
 * entered the exception handler and then determines if any of them
 * saw a fatal event that requires panic. Then it executes them
 * in the entry order.
 * TBD double check parallel CPU hotunplug
 */
Hidetoshi Seto's avatar
Hidetoshi Seto committed
741
static int mce_start(int *no_way_out)
742
{
Hidetoshi Seto's avatar
Hidetoshi Seto committed
743
	int order;
744
745
746
	int cpus = num_online_cpus();
	u64 timeout = (u64)monarch_timeout * NSEC_PER_USEC;

Hidetoshi Seto's avatar
Hidetoshi Seto committed
747
748
	if (!timeout)
		return -1;
749

Hidetoshi Seto's avatar
Hidetoshi Seto committed
750
	atomic_add(*no_way_out, &global_nwo);
751
752
753
754
	/*
	 * global_nwo should be updated before mce_callin
	 */
	smp_wmb();
755
	order = atomic_inc_return(&mce_callin);
756
757
758
759
760
761
762

	/*
	 * Wait for everyone.
	 */
	while (atomic_read(&mce_callin) != cpus) {
		if (mce_timed_out(&timeout)) {
			atomic_set(&global_nwo, 0);
Hidetoshi Seto's avatar
Hidetoshi Seto committed
763
			return -1;
764
765
766
767
		}
		ndelay(SPINUNIT);
	}

768
769
770
771
	/*
	 * mce_callin should be read before global_nwo
	 */
	smp_rmb();
772

Hidetoshi Seto's avatar
Hidetoshi Seto committed
773
774
775
776
	if (order == 1) {
		/*
		 * Monarch: Starts executing now, the others wait.
		 */
777
		atomic_set(&mce_executing, 1);
Hidetoshi Seto's avatar
Hidetoshi Seto committed
778
779
780
781
782
783
784
785
786
787
788
789
790
791
	} else {
		/*
		 * Subject: Now start the scanning loop one by one in
		 * the original callin order.
		 * This way when there are any shared banks it will be
		 * only seen by one CPU before cleared, avoiding duplicates.
		 */
		while (atomic_read(&mce_executing) < order) {
			if (mce_timed_out(&timeout)) {
				atomic_set(&global_nwo, 0);
				return -1;
			}
			ndelay(SPINUNIT);
		}
792
793
794
	}

	/*
Hidetoshi Seto's avatar
Hidetoshi Seto committed
795
	 * Cache the global no_way_out state.
796
	 */
Hidetoshi Seto's avatar
Hidetoshi Seto committed
797
798
799
	*no_way_out = atomic_read(&global_nwo);

	return order;
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
}

/*
 * Synchronize between CPUs after main scanning loop.
 * This invokes the bulk of the Monarch processing.
 */
static int mce_end(int order)
{
	int ret = -1;
	u64 timeout = (u64)monarch_timeout * NSEC_PER_USEC;

	if (!timeout)
		goto reset;
	if (order < 0)
		goto reset;

	/*
	 * Allow others to run.
	 */
	atomic_inc(&mce_executing);

	if (order == 1) {
		/* CHECKME: Can this race with a parallel hotplug? */
		int cpus = num_online_cpus();

		/*
		 * Monarch: Wait for everyone to go through their scanning
		 * loops.
		 */
		while (atomic_read(&mce_executing) <= cpus) {
			if (mce_timed_out(&timeout))
				goto reset;
			ndelay(SPINUNIT);
		}

		mce_reign();
		barrier();
		ret = 0;
	} else {
		/*
		 * Subject: Wait for Monarch to finish.
		 */
		while (atomic_read(&mce_executing) != 0) {
			if (mce_timed_out(&timeout))
				goto reset;
			ndelay(SPINUNIT);
		}

		/*
		 * Don't reset anything. That's done by the Monarch.
		 */
		return 0;
	}

	/*
	 * Reset all global state.
	 */
reset:
	atomic_set(&global_nwo, 0);
	atomic_set(&mce_callin, 0);
	barrier();

	/*
	 * Let others run again.
	 */
	atomic_set(&mce_executing, 0);
	return ret;
}

869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
/*
 * Check if the address reported by the CPU is in a format we can parse.
 * It would be possible to add code for most other cases, but all would
 * be somewhat complicated (e.g. segment offset would require an instruction
 * parser). So only support physical addresses upto page granuality for now.
 */
static int mce_usable_address(struct mce *m)
{
	if (!(m->status & MCI_STATUS_MISCV) || !(m->status & MCI_STATUS_ADDRV))
		return 0;
	if ((m->misc & 0x3f) > PAGE_SHIFT)
		return 0;
	if (((m->misc >> 6) & 7) != MCM_ADDR_PHYS)
		return 0;
	return 1;
}

886
887
888
889
890
891
static void mce_clear_state(unsigned long *toclear)
{
	int i;

	for (i = 0; i < banks; i++) {
		if (test_bit(i, toclear))
892
			mce_wrmsrl(MSR_IA32_MCx_STATUS(i), 0);
893
894
895
	}
}

896
897
898
899
900
901
902
/*
 * The actual machine check handler. This only handles real
 * exceptions when something got corrupted coming in through int 18.
 *
 * This is executed in NMI context not subject to normal locking rules. This
 * implies that most kernel services cannot be safely used. Don't even
 * think about putting a printk in there!
903
904
905
906
 *
 * On Intel systems this is entered on all CPUs in parallel through
 * MCE broadcast. However some CPUs might be broken beyond repair,
 * so be always careful when synchronizing with others.
Linus Torvalds's avatar
Linus Torvalds committed
907
 */
Ingo Molnar's avatar
Ingo Molnar committed
908
void do_machine_check(struct pt_regs *regs, long error_code)
Linus Torvalds's avatar
Linus Torvalds committed
909
{
910
	struct mce m, *final;
Linus Torvalds's avatar
Linus Torvalds committed
911
	int i;
912
913
914
915
916
917
	int worst = 0;
	int severity;
	/*
	 * Establish sequential order between the CPUs entering the machine
	 * check handler.
	 */
Hidetoshi Seto's avatar
Hidetoshi Seto committed
918
	int order;
919
920
921
922
923
924
925
926
927
928
	/*
	 * If no_way_out gets set, there is no safe way to recover from this
	 * MCE.  If tolerant is cranked up, we'll try anyway.
	 */
	int no_way_out = 0;
	/*
	 * If kill_it gets set, there might be a way to recover from this
	 * error.
	 */
	int kill_it = 0;
929
	DECLARE_BITMAP(toclear, MAX_NR_BANKS);
930
	char *msg = "Unknown";
Linus Torvalds's avatar
Linus Torvalds committed
931

932
933
	atomic_inc(&mce_entry);

934
935
	__get_cpu_var(mce_exception_count)++;

936
	if (notify_die(DIE_NMI, "machine check", regs, error_code,
937
			   18, SIGKILL) == NOTIFY_STOP)
938
		goto out;
939
	if (!banks)
940
		goto out;
Linus Torvalds's avatar
Linus Torvalds committed
941

942
943
	mce_setup(&m);

944
	m.mcgstatus = mce_rdmsrl(MSR_IA32_MCG_STATUS);
945
946
947
	final = &__get_cpu_var(mces_seen);
	*final = m;

948
949
	no_way_out = mce_no_way_out(&m, &msg);

Linus Torvalds's avatar
Linus Torvalds committed
950
951
	barrier();

952
953
954
955
956
957
	/*
	 * When no restart IP must always kill or panic.
	 */
	if (!(m.mcgstatus & MCG_STATUS_RIPV))
		kill_it = 1;

958
959
960
961
962
	/*
	 * Go through all the banks in exclusion of the other CPUs.
	 * This way we don't report duplicated events on shared banks
	 * because the first one to see it will clear it.
	 */
Hidetoshi Seto's avatar
Hidetoshi Seto committed
963
	order = mce_start(&no_way_out);
Linus Torvalds's avatar
Linus Torvalds committed
964
	for (i = 0; i < banks; i++) {
965
		__clear_bit(i, toclear);
966
		if (!mce_banks[i].ctl)
Linus Torvalds's avatar
Linus Torvalds committed
967
			continue;
968
969

		m.misc = 0;
Linus Torvalds's avatar
Linus Torvalds committed
970
971
972
		m.addr = 0;
		m.bank = i;

973
		m.status = mce_rdmsrl(MSR_IA32_MCx_STATUS(i));
Linus Torvalds's avatar
Linus Torvalds committed
974
975
976
		if ((m.status & MCI_STATUS_VAL) == 0)
			continue;

977
		/*
978
979
		 * Non uncorrected or non signaled errors are handled by
		 * machine_check_poll. Leave them alone, unless this panics.
980
		 */
981
982
		if (!(m.status & (mce_ser ? MCI_STATUS_S : MCI_STATUS_UC)) &&
			!no_way_out)
983
984
985
986
987
988
989
			continue;

		/*
		 * Set taint even when machine check was not enabled.
		 */
		add_taint(TAINT_MACHINE_CHECK);

990
		severity = mce_severity(&m, tolerant, NULL);
991

992
993
994
995
996
997
998
999
		/*
		 * When machine check was for corrected handler don't touch,
		 * unless we're panicing.
		 */
		if (severity == MCE_KEEP_SEVERITY && !no_way_out)
			continue;
		__set_bit(i, toclear);
		if (severity == MCE_NO_SEVERITY) {
1000
1001
1002
1003
1004
			/*
			 * Machine check event was not enabled. Clear, but
			 * ignore.
			 */
			continue;
Linus Torvalds's avatar
Linus Torvalds committed
1005
1006
		}

1007
1008
1009
1010
1011
1012
		/*
		 * Kill on action required.
		 */
		if (severity == MCE_AR_SEVERITY)
			kill_it = 1;

Linus Torvalds's avatar
Linus Torvalds committed
1013
		if (m.status & MCI_STATUS_MISCV)
1014
			m.misc = mce_rdmsrl(MSR_IA32_MCx_MISC(i));
Linus Torvalds's avatar
Linus Torvalds committed
1015
		if (m.status & MCI_STATUS_ADDRV)
1016
			m.addr = mce_rdmsrl(MSR_IA32_MCx_ADDR(i));
Linus Torvalds's avatar
Linus Torvalds committed
1017

1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
		/*
		 * Action optional error. Queue address for later processing.
		 * When the ring overflows we just ignore the AO error.
		 * RED-PEN add some logging mechanism when
		 * usable_address or mce_add_ring fails.
		 * RED-PEN don't ignore overflow for tolerant == 0
		 */
		if (severity == MCE_AO_SEVERITY && mce_usable_address(&m))
			mce_ring_add(m.addr >> PAGE_SHIFT);

1028
		mce_get_rip(&m, regs);
1029
		mce_log(&m);
Linus Torvalds's avatar
Linus Torvalds committed
1030

1031
1032
1033
		if (severity > worst) {
			*final = m;
			worst = severity;
Linus Torvalds's avatar
Linus Torvalds committed
1034
1035
1036
		}
	}

1037
1038
1039
	if (!no_way_out)
		mce_clear_state(toclear);

Ingo Molnar's avatar
Ingo Molnar committed
1040
	/*
1041
1042
	 * Do most of the synchronization with other CPUs.
	 * When there's any problem use only local no_way_out state.
Ingo Molnar's avatar
Ingo Molnar committed
1043
	 */
1044
1045
	if (mce_end(order) < 0)
		no_way_out = worst >= MCE_PANIC_SEVERITY;
1046
1047
1048

	/*
	 * If we have decided that we just CAN'T continue, and the user
Ingo Molnar's avatar
Ingo Molnar committed
1049
	 * has not set tolerant to an insane level, give up and die.
1050
1051
1052
	 *
	 * This is mainly used in the case when the system doesn't
	 * support MCE broadcasting or it has been disabled.
1053
1054
	 */
	if (no_way_out && tolerant < 3)
1055
		mce_panic("Fatal machine check on current CPU", final, msg);
1056
1057
1058
1059
1060
1061
1062
1063

	/*
	 * If the error seems to be unrecoverable, something should be
	 * done.  Try to kill as little as possible.  If we can kill just
	 * one task, do that.  If the user has set the tolerance very
	 * high, don't try to do anything at all.
	 */

1064
1065
	if (kill_it && tolerant < 3)
		force_sig(SIGBUS, current);
Linus Torvalds's avatar
Linus Torvalds committed
1066

1067
1068
1069
	/* notify userspace ASAP */
	set_thread_flag(TIF_MCE_NOTIFY);

1070
1071
	if (worst > 0)
		mce_report_event(regs);
1072
	mce_wrmsrl(MSR_IA32_MCG_STATUS, 0);
1073
out:
1074
	atomic_dec(&mce_entry);
1075
	sync_core();
Linus Torvalds's avatar
Linus Torvalds committed
1076
}
1077
EXPORT_SYMBOL_GPL(do_machine_check);
Linus Torvalds's avatar
Linus Torvalds committed
1078

1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
/* dummy to break dependency. actual code is in mm/memory-failure.c */
void __attribute__((weak)) memory_failure(unsigned long pfn, int vector)
{
	printk(KERN_ERR "Action optional memory failure at %lx ignored\n", pfn);
}

/*
 * Called after mce notification in process context. This code
 * is allowed to sleep. Call the high level VM handler to process
 * any corrupted pages.
 * Assume that the work queue code only calls this one at a time
 * per CPU.
 * Note we don't disable preemption, so this code might run on the wrong
 * CPU. In this case the event is picked up by the scheduled work queue.
 * This is merely a fast path to expedite processing in some common
 * cases.
 */
void mce_notify_process(void)
{
	unsigned long pfn;
	mce_notify_irq();
	while (mce_ring_get(&pfn))
		memory_failure(pfn, MCE_VECTOR);
}

static void mce_process_work(struct work_struct *dummy)
{
	mce_notify_process();
}

1109
1110
1111
#ifdef CONFIG_X86_MCE_INTEL
/***
 * mce_log_therm_throt_event - Logs the thermal throttling event to mcelog
Simon Arlott's avatar
Simon Arlott committed
1112
 * @cpu: The CPU on which the event occurred.
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
 * @status: Event status information
 *
 * This function should be called by the thermal interrupt after the
 * event has been processed and the decision was made to log the event
 * further.
 *
 * The status parameter will be saved to the 'status' field of 'struct mce'
 * and historically has been the register value of the
 * MSR_IA32_THERMAL_STATUS (Intel) msr.
 */
1123
void mce_log_therm_throt_event(__u64 status)
1124
1125
1126
{
	struct mce m;

1127
	mce_setup(&m);
1128
1129
1130
1131
1132
1133
	m.bank = MCE_THERMAL_BANK;
	m.status = status;
	mce_log(&m);
}
#endif /* CONFIG_X86_MCE_INTEL */

Linus Torvalds's avatar
Linus Torvalds committed
1134
/*
1135
1136
1137
 * Periodic polling timer for "silent" machine check errors.  If the
 * poller finds an MCE, poll 2x faster.  When the poller finds no more
 * errors, poll 2x slower (up to check_interval seconds).
Linus Torvalds's avatar
Linus Torvalds committed
1138
1139
 */
static int check_interval = 5 * 60; /* 5 minutes */
Ingo Molnar's avatar
Ingo Molnar committed
1140

1141
static DEFINE_PER_CPU(int, mce_next_interval); /* in jiffies */
1142
static DEFINE_PER_CPU(struct timer_list, mce_timer);
Linus Torvalds's avatar
Linus Torvalds committed
1143

1144
static void mce_start_timer(unsigned long data)
Linus Torvalds's avatar
Linus Torvalds committed
1145
{
1146
	struct timer_list *t = &per_cpu(mce_timer, data);
1147
	int *n;
1148
1149
1150

	WARN_ON(smp_processor_id() != data);

Ingo Molnar's avatar
Ingo Molnar committed
1151
	if (mce_available(&current_cpu_data)) {
1152
1153
		machine_check_poll(MCP_TIMESTAMP,
				&__get_cpu_var(mce_poll_banks));
Ingo Molnar's avatar
Ingo Molnar committed
1154
	}
Linus Torvalds's avatar
Linus Torvalds committed
1155
1156

	/*
1157
1158
	 * Alert userspace if needed.  If we logged an MCE, reduce the
	 * polling interval, otherwise increase the polling interval.
Linus Torvalds's avatar
Linus Torvalds committed
1159
	 */
1160
	n = &__get_cpu_var(mce_next_interval);
1161
	if (mce_notify_irq())
1162
		*n = max(*n/2, HZ/100);
1163
	else
1164
		*n = min(*n*2, (int)round_jiffies_relative(check_interval*HZ));
1165

1166
	t->expires = jiffies + *n;
1167
	add_timer_on(t, smp_processor_id());
1168
1169
}

1170
1171
static void mce_do_trigger(struct work_struct *work)
{
1172
	call_usermodehelper(mce_helper, mce_helper_argv, NULL, UMH_NO_WAIT);
1173
1174
1175
1176
}

static DECLARE_WORK(mce_trigger_work, mce_do_trigger);

1177
/*
1178
1179
1180
 * Notify the user(s) about new machine check events.
 * Can be called from interrupt context, but not from machine check/NMI
 * context.
1181
 */
1182
int mce_notify_irq(void)
1183
{
1184
1185
1186
	/* Not more than two messages every minute */
	static DEFINE_RATELIMIT_STATE(ratelimit, 60*HZ, 2);

1187
	clear_thread_flag(TIF_MCE_NOTIFY);
Ingo Molnar's avatar
Ingo Molnar committed
1188

1189
	if (test_and_clear_bit(0, &mce_need_notify)) {
1190
		wake_up_interruptible(&mce_wait);
1191
1192
1193
1194
1195
1196

		/*
		 * There is no risk of missing notifications because
		 * work_pending is always cleared before the function is
		 * executed.
		 */
1197
		if (mce_helper[0] && !work_pending(&mce_trigger_work))
1198
			schedule_work(&mce_trigger_work);
1199

1200
		if (__ratelimit(&ratelimit))
1201
			printk(KERN_INFO "Machine check events logged\n");
1202
1203

		return 1;
Linus Torvalds's avatar
Linus Torvalds committed
1204
	}
1205
1206
	return 0;
}
1207
EXPORT_SYMBOL_GPL(mce_notify_irq);
1208

1209
static int __cpuinit __mcheck_cpu_mce_banks_init(void)
1210
1211
1212
1213
1214
1215
1216
1217
{
	int i;

	mce_banks = kzalloc(banks * sizeof(struct mce_bank), GFP_KERNEL);
	if (!mce_banks)
		return -ENOMEM;
	for (i = 0; i < banks; i++) {
		struct mce_bank *b = &mce_banks[i];
1218

1219
1220
1221
1222
122