kern_heartbeat.c revision 1.8 1 1.8 riastrad /* $NetBSD: kern_heartbeat.c,v 1.8 2023/09/02 17:44:32 riastradh Exp $ */
2 1.1 riastrad
3 1.1 riastrad /*-
4 1.1 riastrad * Copyright (c) 2023 The NetBSD Foundation, Inc.
5 1.1 riastrad * All rights reserved.
6 1.1 riastrad *
7 1.1 riastrad * Redistribution and use in source and binary forms, with or without
8 1.1 riastrad * modification, are permitted provided that the following conditions
9 1.1 riastrad * are met:
10 1.1 riastrad * 1. Redistributions of source code must retain the above copyright
11 1.1 riastrad * notice, this list of conditions and the following disclaimer.
12 1.1 riastrad * 2. Redistributions in binary form must reproduce the above copyright
13 1.1 riastrad * notice, this list of conditions and the following disclaimer in the
14 1.1 riastrad * documentation and/or other materials provided with the distribution.
15 1.1 riastrad *
16 1.1 riastrad * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17 1.1 riastrad * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18 1.1 riastrad * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19 1.1 riastrad * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20 1.1 riastrad * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21 1.1 riastrad * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22 1.1 riastrad * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23 1.1 riastrad * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24 1.1 riastrad * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25 1.1 riastrad * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26 1.1 riastrad * POSSIBILITY OF SUCH DAMAGE.
27 1.1 riastrad */
28 1.1 riastrad
29 1.1 riastrad /*
30 1.1 riastrad * heartbeat(9) -- periodic checks to ensure CPUs are making progress
31 1.1 riastrad *
32 1.1 riastrad * Manual tests to run when changing this file. Magic numbers are for
33 1.1 riastrad * evbarm; adjust for other platforms. Tests involving cpuctl
34 1.1 riastrad * online/offline assume a 2-CPU system -- for full testing on a >2-CPU
35 1.1 riastrad * system, offline all but one CPU.
36 1.1 riastrad *
37 1.1 riastrad * 1. cpuctl offline 0
38 1.1 riastrad * sleep 20
39 1.1 riastrad * cpuctl online 0
40 1.1 riastrad *
41 1.1 riastrad * 2. cpuctl offline 1
42 1.1 riastrad * sleep 20
43 1.1 riastrad * cpuctl online 1
44 1.1 riastrad *
45 1.1 riastrad * 3. cpuctl offline 0
46 1.1 riastrad * sysctl -w kern.heartbeat.max_period=5
47 1.1 riastrad * sleep 10
48 1.1 riastrad * sysctl -w kern.heartbeat.max_period=0
49 1.1 riastrad * sleep 10
50 1.1 riastrad * sysctl -w kern.heartbeat.max_period=5
51 1.1 riastrad * sleep 10
52 1.1 riastrad * cpuctl online 0
53 1.1 riastrad *
54 1.1 riastrad * 4. sysctl -w debug.crashme_enable=1
55 1.1 riastrad * sysctl -w debug.crashme.spl_spinout=1 # IPL_SOFTCLOCK
56 1.8 riastrad * # verify system panics after 15sec, with a stack trace through
57 1.8 riastrad * # crashme_spl_spinout
58 1.1 riastrad *
59 1.1 riastrad * 5. sysctl -w debug.crashme_enable=1
60 1.1 riastrad * sysctl -w debug.crashme.spl_spinout=6 # IPL_SCHED
61 1.8 riastrad * # verify system panics after 15sec, with a stack trace through
62 1.8 riastrad * # crashme_spl_spinout
63 1.1 riastrad *
64 1.1 riastrad * 6. cpuctl offline 0
65 1.1 riastrad * sysctl -w debug.crashme_enable=1
66 1.1 riastrad * sysctl -w debug.crashme.spl_spinout=1 # IPL_SOFTCLOCK
67 1.8 riastrad * # verify system panics after 15sec, with a stack trace through
68 1.8 riastrad * # crashme_spl_spinout
69 1.1 riastrad *
70 1.1 riastrad * 7. cpuctl offline 0
71 1.1 riastrad * sysctl -w debug.crashme_enable=1
72 1.1 riastrad * sysctl -w debug.crashme.spl_spinout=5 # IPL_VM
73 1.8 riastrad * # verify system panics after 15sec, with a stack trace through
74 1.8 riastrad * # crashme_spl_spinout
75 1.1 riastrad *
76 1.1 riastrad * # Not this -- IPL_SCHED and IPL_HIGH spinout on a single CPU
77 1.1 riastrad * # require a hardware watchdog timer.
78 1.1 riastrad * #cpuctl offline 0
79 1.1 riastrad * #sysctl -w debug.crashme_enable
80 1.1 riastrad * #sysctl -w debug.crashme.spl_spinout=6 # IPL_SCHED
81 1.1 riastrad * # hope watchdog timer kicks in
82 1.1 riastrad */
83 1.1 riastrad
84 1.1 riastrad #include <sys/cdefs.h>
85 1.8 riastrad __KERNEL_RCSID(0, "$NetBSD: kern_heartbeat.c,v 1.8 2023/09/02 17:44:32 riastradh Exp $");
86 1.1 riastrad
87 1.1 riastrad #ifdef _KERNEL_OPT
88 1.1 riastrad #include "opt_ddb.h"
89 1.1 riastrad #include "opt_heartbeat.h"
90 1.1 riastrad #endif
91 1.1 riastrad
92 1.1 riastrad #include "heartbeat.h"
93 1.1 riastrad
94 1.1 riastrad #include <sys/param.h>
95 1.1 riastrad #include <sys/types.h>
96 1.1 riastrad
97 1.1 riastrad #include <sys/atomic.h>
98 1.1 riastrad #include <sys/cpu.h>
99 1.1 riastrad #include <sys/errno.h>
100 1.1 riastrad #include <sys/heartbeat.h>
101 1.1 riastrad #include <sys/ipi.h>
102 1.4 riastrad #include <sys/kernel.h>
103 1.1 riastrad #include <sys/mutex.h>
104 1.1 riastrad #include <sys/sysctl.h>
105 1.1 riastrad #include <sys/systm.h>
106 1.1 riastrad #include <sys/xcall.h>
107 1.1 riastrad
108 1.1 riastrad #ifdef DDB
109 1.1 riastrad #include <ddb/ddb.h>
110 1.1 riastrad #endif
111 1.1 riastrad
112 1.1 riastrad /*
113 1.1 riastrad * Global state.
114 1.1 riastrad *
115 1.1 riastrad * heartbeat_lock serializes access to heartbeat_max_period_secs
116 1.1 riastrad * and heartbeat_max_period_ticks. Two separate variables so we
117 1.1 riastrad * can avoid multiplication or division in the heartbeat routine.
118 1.1 riastrad *
119 1.1 riastrad * heartbeat_sih is stable after initialization in
120 1.1 riastrad * heartbeat_start.
121 1.1 riastrad */
122 1.1 riastrad kmutex_t heartbeat_lock __cacheline_aligned;
123 1.1 riastrad unsigned heartbeat_max_period_secs __read_mostly;
124 1.1 riastrad unsigned heartbeat_max_period_ticks __read_mostly;
125 1.1 riastrad
126 1.1 riastrad void *heartbeat_sih __read_mostly;
127 1.1 riastrad
128 1.1 riastrad /*
129 1.1 riastrad * heartbeat_suspend()
130 1.1 riastrad *
131 1.1 riastrad * Suspend heartbeat monitoring of the current CPU.
132 1.1 riastrad *
133 1.1 riastrad * Called after the current CPU has been marked offline but before
134 1.6 riastrad * it has stopped running, or after IPL has been raised for
135 1.6 riastrad * polling-mode console input. Caller must have preemption
136 1.6 riastrad * disabled. Non-nestable. Reversed by heartbeat_resume.
137 1.1 riastrad */
138 1.1 riastrad void
139 1.1 riastrad heartbeat_suspend(void)
140 1.1 riastrad {
141 1.6 riastrad struct cpu_info *ci = curcpu();
142 1.6 riastrad int s;
143 1.1 riastrad
144 1.2 riastrad KASSERT(curcpu_stable());
145 1.6 riastrad KASSERT((ci->ci_schedstate.spc_flags & SPCF_HEARTBEATSUSPENDED) == 0);
146 1.1 riastrad
147 1.6 riastrad s = splsched();
148 1.6 riastrad ci->ci_schedstate.spc_flags |= SPCF_HEARTBEATSUSPENDED;
149 1.6 riastrad splx(s);
150 1.1 riastrad }
151 1.1 riastrad
152 1.1 riastrad /*
153 1.4 riastrad * heartbeat_resume_cpu(ci)
154 1.4 riastrad *
155 1.4 riastrad * Resume heartbeat monitoring of ci.
156 1.4 riastrad *
157 1.4 riastrad * Called at startup while cold, and whenever heartbeat monitoring
158 1.4 riastrad * is re-enabled after being disabled or the period is changed.
159 1.4 riastrad * When not cold, ci must be the current CPU.
160 1.6 riastrad *
161 1.6 riastrad * Must be run at splsched.
162 1.4 riastrad */
163 1.4 riastrad static void
164 1.4 riastrad heartbeat_resume_cpu(struct cpu_info *ci)
165 1.4 riastrad {
166 1.4 riastrad
167 1.4 riastrad KASSERT(__predict_false(cold) || curcpu_stable());
168 1.4 riastrad KASSERT(__predict_false(cold) || ci == curcpu());
169 1.6 riastrad /* XXX KASSERT IPL_SCHED */
170 1.4 riastrad
171 1.4 riastrad ci->ci_heartbeat_count = 0;
172 1.5 riastrad ci->ci_heartbeat_uptime_cache = time_uptime;
173 1.4 riastrad ci->ci_heartbeat_uptime_stamp = 0;
174 1.4 riastrad }
175 1.4 riastrad
176 1.4 riastrad /*
177 1.1 riastrad * heartbeat_resume()
178 1.1 riastrad *
179 1.1 riastrad * Resume heartbeat monitoring of the current CPU.
180 1.1 riastrad *
181 1.1 riastrad * Called after the current CPU has started running but before it
182 1.6 riastrad * has been marked online, or when ending polling-mode input
183 1.6 riastrad * before IPL is restored. Caller must have preemption disabled.
184 1.1 riastrad */
185 1.1 riastrad void
186 1.1 riastrad heartbeat_resume(void)
187 1.1 riastrad {
188 1.1 riastrad struct cpu_info *ci = curcpu();
189 1.1 riastrad int s;
190 1.1 riastrad
191 1.2 riastrad KASSERT(curcpu_stable());
192 1.6 riastrad KASSERT(ci->ci_schedstate.spc_flags & SPCF_HEARTBEATSUSPENDED);
193 1.1 riastrad
194 1.1 riastrad /*
195 1.1 riastrad * Block heartbeats while we reset the state so we don't
196 1.1 riastrad * spuriously think we had a heart attack in the middle of
197 1.1 riastrad * resetting the count and the uptime stamp.
198 1.1 riastrad */
199 1.1 riastrad s = splsched();
200 1.6 riastrad ci->ci_schedstate.spc_flags &= ~SPCF_HEARTBEATSUSPENDED;
201 1.4 riastrad heartbeat_resume_cpu(ci);
202 1.1 riastrad splx(s);
203 1.1 riastrad }
204 1.1 riastrad
205 1.1 riastrad /*
206 1.7 riastrad * heartbeat_timecounter_suspended()
207 1.7 riastrad *
208 1.7 riastrad * True if timecounter heartbeat checks are suspended because the
209 1.7 riastrad * timecounter may not be advancing, false if heartbeat checks
210 1.7 riastrad * should check for timecounter progress.
211 1.7 riastrad */
212 1.7 riastrad static bool
213 1.7 riastrad heartbeat_timecounter_suspended(void)
214 1.7 riastrad {
215 1.7 riastrad CPU_INFO_ITERATOR cii;
216 1.7 riastrad struct cpu_info *ci;
217 1.7 riastrad
218 1.7 riastrad /*
219 1.7 riastrad * The timecounter ticks only on the primary CPU. Check
220 1.7 riastrad * whether it's suspended.
221 1.7 riastrad *
222 1.7 riastrad * XXX Would be nice if we could find the primary CPU without
223 1.7 riastrad * iterating over all CPUs.
224 1.7 riastrad */
225 1.7 riastrad for (CPU_INFO_FOREACH(cii, ci)) {
226 1.7 riastrad if (CPU_IS_PRIMARY(ci)) {
227 1.7 riastrad return ci->ci_schedstate.spc_flags &
228 1.7 riastrad SPCF_HEARTBEATSUSPENDED;
229 1.7 riastrad }
230 1.7 riastrad }
231 1.7 riastrad
232 1.7 riastrad /*
233 1.7 riastrad * This should be unreachable -- there had better be a primary
234 1.7 riastrad * CPU in the system! If not, the timecounter will be busted
235 1.7 riastrad * anyway.
236 1.7 riastrad */
237 1.7 riastrad panic("no primary CPU");
238 1.7 riastrad }
239 1.7 riastrad
240 1.7 riastrad /*
241 1.1 riastrad * heartbeat_reset_xc(a, b)
242 1.1 riastrad *
243 1.1 riastrad * Cross-call handler to reset heartbeat state just prior to
244 1.1 riastrad * enabling heartbeat checks.
245 1.1 riastrad */
246 1.1 riastrad static void
247 1.1 riastrad heartbeat_reset_xc(void *a, void *b)
248 1.1 riastrad {
249 1.6 riastrad int s;
250 1.1 riastrad
251 1.6 riastrad s = splsched();
252 1.6 riastrad heartbeat_resume_cpu(curcpu());
253 1.6 riastrad splx(s);
254 1.1 riastrad }
255 1.1 riastrad
256 1.1 riastrad /*
257 1.1 riastrad * set_max_period(max_period)
258 1.1 riastrad *
259 1.1 riastrad * Set the maximum period, in seconds, for heartbeat checks.
260 1.1 riastrad *
261 1.1 riastrad * - If max_period is zero, disable them.
262 1.1 riastrad *
263 1.1 riastrad * - If the max period was zero and max_period is nonzero, ensure
264 1.1 riastrad * all CPUs' heartbeat uptime caches are up-to-date before
265 1.1 riastrad * re-enabling them.
266 1.1 riastrad *
267 1.1 riastrad * max_period must be below UINT_MAX/4/hz to avoid arithmetic
268 1.1 riastrad * overflow and give room for slop.
269 1.1 riastrad *
270 1.1 riastrad * Caller must hold heartbeat_lock.
271 1.1 riastrad */
272 1.1 riastrad static void
273 1.1 riastrad set_max_period(unsigned max_period)
274 1.1 riastrad {
275 1.1 riastrad
276 1.1 riastrad KASSERTMSG(max_period <= UINT_MAX/4/hz,
277 1.1 riastrad "max_period=%u must not exceed UINT_MAX/4/hz=%u (hz=%u)",
278 1.1 riastrad max_period, UINT_MAX/4/hz, hz);
279 1.1 riastrad KASSERT(mutex_owned(&heartbeat_lock));
280 1.1 riastrad
281 1.1 riastrad /*
282 1.1 riastrad * If we're enabling heartbeat checks, make sure we have a
283 1.1 riastrad * reasonably up-to-date time_uptime cache on all CPUs so we
284 1.1 riastrad * don't think we had an instant heart attack.
285 1.1 riastrad */
286 1.4 riastrad if (heartbeat_max_period_secs == 0 && max_period != 0) {
287 1.4 riastrad if (cold) {
288 1.4 riastrad CPU_INFO_ITERATOR cii;
289 1.4 riastrad struct cpu_info *ci;
290 1.4 riastrad
291 1.4 riastrad for (CPU_INFO_FOREACH(cii, ci))
292 1.4 riastrad heartbeat_resume_cpu(ci);
293 1.4 riastrad } else {
294 1.4 riastrad const uint64_t ticket =
295 1.4 riastrad xc_broadcast(0, &heartbeat_reset_xc, NULL, NULL);
296 1.4 riastrad xc_wait(ticket);
297 1.4 riastrad }
298 1.4 riastrad }
299 1.1 riastrad
300 1.1 riastrad /*
301 1.1 riastrad * Once the heartbeat state has been updated on all (online)
302 1.1 riastrad * CPUs, set the period. At this point, heartbeat checks can
303 1.1 riastrad * begin.
304 1.1 riastrad */
305 1.1 riastrad atomic_store_relaxed(&heartbeat_max_period_secs, max_period);
306 1.1 riastrad atomic_store_relaxed(&heartbeat_max_period_ticks, max_period*hz);
307 1.1 riastrad }
308 1.1 riastrad
309 1.1 riastrad /*
310 1.1 riastrad * heartbeat_max_period_ticks(SYSCTLFN_ARGS)
311 1.1 riastrad *
312 1.1 riastrad * Sysctl handler for sysctl kern.heartbeat.max_period. Verifies
313 1.1 riastrad * it lies within a reasonable interval and sets it.
314 1.1 riastrad */
315 1.1 riastrad static int
316 1.1 riastrad heartbeat_max_period_sysctl(SYSCTLFN_ARGS)
317 1.1 riastrad {
318 1.1 riastrad struct sysctlnode node;
319 1.1 riastrad unsigned max_period;
320 1.1 riastrad int error;
321 1.1 riastrad
322 1.1 riastrad mutex_enter(&heartbeat_lock);
323 1.1 riastrad
324 1.1 riastrad max_period = heartbeat_max_period_secs;
325 1.1 riastrad node = *rnode;
326 1.1 riastrad node.sysctl_data = &max_period;
327 1.1 riastrad error = sysctl_lookup(SYSCTLFN_CALL(&node));
328 1.1 riastrad if (error || newp == NULL)
329 1.1 riastrad goto out;
330 1.1 riastrad
331 1.1 riastrad /*
332 1.1 riastrad * Ensure there's plenty of slop between heartbeats.
333 1.1 riastrad */
334 1.1 riastrad if (max_period > UINT_MAX/4/hz) {
335 1.1 riastrad error = EOVERFLOW;
336 1.1 riastrad goto out;
337 1.1 riastrad }
338 1.1 riastrad
339 1.1 riastrad /*
340 1.1 riastrad * Success! Set the period. This enables heartbeat checks if
341 1.1 riastrad * we went from zero period to nonzero period, or disables them
342 1.1 riastrad * if the other way around.
343 1.1 riastrad */
344 1.1 riastrad set_max_period(max_period);
345 1.1 riastrad error = 0;
346 1.1 riastrad
347 1.1 riastrad out: mutex_exit(&heartbeat_lock);
348 1.1 riastrad return error;
349 1.1 riastrad }
350 1.1 riastrad
351 1.1 riastrad /*
352 1.1 riastrad * sysctl_heartbeat_setup()
353 1.1 riastrad *
354 1.1 riastrad * Set up the kern.heartbeat.* sysctl subtree.
355 1.1 riastrad */
356 1.1 riastrad SYSCTL_SETUP(sysctl_heartbeat_setup, "sysctl kern.heartbeat setup")
357 1.1 riastrad {
358 1.1 riastrad const struct sysctlnode *rnode;
359 1.1 riastrad int error;
360 1.1 riastrad
361 1.1 riastrad mutex_init(&heartbeat_lock, MUTEX_DEFAULT, IPL_NONE);
362 1.1 riastrad
363 1.1 riastrad /* kern.heartbeat */
364 1.1 riastrad error = sysctl_createv(NULL, 0, NULL, &rnode,
365 1.1 riastrad CTLFLAG_PERMANENT,
366 1.1 riastrad CTLTYPE_NODE, "heartbeat",
367 1.1 riastrad SYSCTL_DESCR("Kernel heartbeat parameters"),
368 1.1 riastrad NULL, 0, NULL, 0,
369 1.1 riastrad CTL_KERN, CTL_CREATE, CTL_EOL);
370 1.1 riastrad if (error) {
371 1.1 riastrad printf("%s: failed to create kern.heartbeat: %d\n",
372 1.1 riastrad __func__, error);
373 1.1 riastrad return;
374 1.1 riastrad }
375 1.1 riastrad
376 1.1 riastrad /* kern.heartbeat.max_period */
377 1.1 riastrad error = sysctl_createv(NULL, 0, &rnode, NULL,
378 1.1 riastrad CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
379 1.1 riastrad CTLTYPE_INT, "max_period",
380 1.1 riastrad SYSCTL_DESCR("Max seconds between heartbeats before panic"),
381 1.1 riastrad &heartbeat_max_period_sysctl, 0, NULL, 0,
382 1.1 riastrad CTL_CREATE, CTL_EOL);
383 1.1 riastrad if (error) {
384 1.1 riastrad printf("%s: failed to create kern.heartbeat.max_period: %d\n",
385 1.1 riastrad __func__, error);
386 1.1 riastrad return;
387 1.1 riastrad }
388 1.1 riastrad }
389 1.1 riastrad
390 1.1 riastrad /*
391 1.1 riastrad * heartbeat_intr(cookie)
392 1.1 riastrad *
393 1.1 riastrad * Soft interrupt handler to update the local CPU's view of the
394 1.1 riastrad * system uptime. This runs at the same priority level as
395 1.1 riastrad * callouts, so if callouts are stuck on this CPU, it won't run,
396 1.1 riastrad * and eventually another CPU will notice that this one is stuck.
397 1.1 riastrad *
398 1.1 riastrad * Don't do spl* here -- keep it to a minimum so if anything goes
399 1.1 riastrad * wrong we don't end up with hard interrupts blocked and unable
400 1.1 riastrad * to detect a missed heartbeat.
401 1.1 riastrad */
402 1.1 riastrad static void
403 1.1 riastrad heartbeat_intr(void *cookie)
404 1.1 riastrad {
405 1.1 riastrad unsigned count = atomic_load_relaxed(&curcpu()->ci_heartbeat_count);
406 1.5 riastrad unsigned uptime = time_uptime;
407 1.1 riastrad
408 1.1 riastrad atomic_store_relaxed(&curcpu()->ci_heartbeat_uptime_stamp, count);
409 1.1 riastrad atomic_store_relaxed(&curcpu()->ci_heartbeat_uptime_cache, uptime);
410 1.1 riastrad }
411 1.1 riastrad
412 1.1 riastrad /*
413 1.1 riastrad * heartbeat_start()
414 1.1 riastrad *
415 1.1 riastrad * Start system heartbeat monitoring.
416 1.1 riastrad */
417 1.1 riastrad void
418 1.1 riastrad heartbeat_start(void)
419 1.1 riastrad {
420 1.1 riastrad const unsigned max_period = HEARTBEAT_MAX_PERIOD_DEFAULT;
421 1.1 riastrad
422 1.1 riastrad /*
423 1.1 riastrad * Establish a softint so we can schedule it once ready. This
424 1.1 riastrad * should be at the lowest softint priority level so that we
425 1.1 riastrad * ensure all softint priorities are making progress.
426 1.1 riastrad */
427 1.1 riastrad heartbeat_sih = softint_establish(SOFTINT_CLOCK|SOFTINT_MPSAFE,
428 1.1 riastrad &heartbeat_intr, NULL);
429 1.1 riastrad
430 1.1 riastrad /*
431 1.1 riastrad * Now that the softint is established, kick off heartbeat
432 1.1 riastrad * monitoring with the default period. This will initialize
433 1.1 riastrad * the per-CPU state to an up-to-date cache of time_uptime.
434 1.1 riastrad */
435 1.1 riastrad mutex_enter(&heartbeat_lock);
436 1.1 riastrad set_max_period(max_period);
437 1.1 riastrad mutex_exit(&heartbeat_lock);
438 1.1 riastrad }
439 1.1 riastrad
440 1.1 riastrad /*
441 1.1 riastrad * defibrillator(cookie)
442 1.1 riastrad *
443 1.1 riastrad * IPI handler for defibrillation. If the CPU's heart has stopped
444 1.1 riastrad * beating normally, but the CPU can still execute things,
445 1.1 riastrad * acknowledge the IPI to the doctor and then panic so we at least
446 1.1 riastrad * get a stack trace from whatever the current CPU is stuck doing,
447 1.1 riastrad * if not a core dump.
448 1.1 riastrad *
449 1.1 riastrad * (This metaphor is a little stretched, since defibrillation is
450 1.1 riastrad * usually administered when the heart is beating errattically but
451 1.1 riastrad * hasn't stopped, and causes the heart to stop temporarily, and
452 1.1 riastrad * one hopes it is not fatal. But we're (software) engineers, so
453 1.1 riastrad * we can stretch metaphors like silly putty in a blender.)
454 1.1 riastrad */
455 1.1 riastrad static void
456 1.1 riastrad defibrillator(void *cookie)
457 1.1 riastrad {
458 1.1 riastrad bool *ack = cookie;
459 1.1 riastrad
460 1.1 riastrad atomic_store_relaxed(ack, true);
461 1.1 riastrad panic("%s[%d %s]: heart stopped beating", cpu_name(curcpu()),
462 1.1 riastrad curlwp->l_lid,
463 1.1 riastrad curlwp->l_name ? curlwp->l_name : curproc->p_comm);
464 1.1 riastrad }
465 1.1 riastrad
466 1.1 riastrad /*
467 1.1 riastrad * defibrillate(ci, unsigned d)
468 1.1 riastrad *
469 1.1 riastrad * The patient CPU ci's heart has stopped beating after d seconds.
470 1.1 riastrad * Force the patient CPU ci to panic, or panic on this CPU if the
471 1.1 riastrad * patient CPU doesn't respond within 1sec.
472 1.1 riastrad */
473 1.1 riastrad static void __noinline
474 1.1 riastrad defibrillate(struct cpu_info *ci, unsigned d)
475 1.1 riastrad {
476 1.1 riastrad bool ack = false;
477 1.1 riastrad ipi_msg_t msg = {
478 1.1 riastrad .func = &defibrillator,
479 1.1 riastrad .arg = &ack,
480 1.1 riastrad };
481 1.1 riastrad unsigned countdown = 1000; /* 1sec */
482 1.1 riastrad
483 1.2 riastrad KASSERT(curcpu_stable());
484 1.1 riastrad
485 1.1 riastrad /*
486 1.1 riastrad * First notify the console that the patient CPU's heart seems
487 1.1 riastrad * to have stopped beating.
488 1.1 riastrad */
489 1.1 riastrad printf("%s: found %s heart stopped beating after %u seconds\n",
490 1.1 riastrad cpu_name(curcpu()), cpu_name(ci), d);
491 1.1 riastrad
492 1.1 riastrad /*
493 1.1 riastrad * Next, give the patient CPU a chance to panic, so we get a
494 1.1 riastrad * stack trace on that CPU even if we don't get a crash dump.
495 1.1 riastrad */
496 1.1 riastrad ipi_unicast(&msg, ci);
497 1.1 riastrad
498 1.1 riastrad /*
499 1.1 riastrad * Busy-wait up to 1sec for the patient CPU to print a stack
500 1.1 riastrad * trace and panic. If the patient CPU acknowledges the IPI,
501 1.1 riastrad * or if we're panicking anyway, just give up and stop here --
502 1.1 riastrad * the system is coming down soon and we should avoid getting
503 1.1 riastrad * in the way.
504 1.1 riastrad */
505 1.1 riastrad while (countdown --> 0) {
506 1.1 riastrad if (atomic_load_relaxed(&ack) ||
507 1.1 riastrad atomic_load_relaxed(&panicstr) != NULL)
508 1.1 riastrad return;
509 1.1 riastrad DELAY(1000); /* 1ms */
510 1.1 riastrad }
511 1.1 riastrad
512 1.1 riastrad /*
513 1.1 riastrad * The patient CPU failed to acknowledge the panic request.
514 1.1 riastrad * Panic now; with any luck, we'll get a crash dump.
515 1.1 riastrad */
516 1.1 riastrad panic("%s: found %s heart stopped beating and unresponsive",
517 1.1 riastrad cpu_name(curcpu()), cpu_name(ci));
518 1.1 riastrad }
519 1.1 riastrad
520 1.1 riastrad /*
521 1.1 riastrad * select_patient()
522 1.1 riastrad *
523 1.1 riastrad * Select another CPU to check the heartbeat of. Returns NULL if
524 1.1 riastrad * there are no other online CPUs. Never returns curcpu().
525 1.1 riastrad * Caller must have kpreemption disabled.
526 1.1 riastrad */
527 1.1 riastrad static struct cpu_info *
528 1.1 riastrad select_patient(void)
529 1.1 riastrad {
530 1.1 riastrad CPU_INFO_ITERATOR cii;
531 1.1 riastrad struct cpu_info *first = NULL, *patient = NULL, *ci;
532 1.1 riastrad bool passedcur = false;
533 1.1 riastrad
534 1.2 riastrad KASSERT(curcpu_stable());
535 1.1 riastrad
536 1.1 riastrad /*
537 1.1 riastrad * In the iteration order of all CPUs, find the next online CPU
538 1.1 riastrad * after curcpu(), or the first online one if curcpu() is last
539 1.1 riastrad * in the iteration order.
540 1.1 riastrad */
541 1.1 riastrad for (CPU_INFO_FOREACH(cii, ci)) {
542 1.6 riastrad if (ci->ci_schedstate.spc_flags & SPCF_HEARTBEATSUSPENDED)
543 1.1 riastrad continue;
544 1.1 riastrad if (passedcur) {
545 1.1 riastrad /*
546 1.1 riastrad * (...|curcpu()|ci|...)
547 1.1 riastrad *
548 1.1 riastrad * Found the patient right after curcpu().
549 1.1 riastrad */
550 1.1 riastrad KASSERT(patient != ci);
551 1.1 riastrad patient = ci;
552 1.1 riastrad break;
553 1.1 riastrad }
554 1.1 riastrad if (ci == curcpu()) {
555 1.1 riastrad /*
556 1.1 riastrad * (...|prev|ci=curcpu()|next|...)
557 1.1 riastrad *
558 1.1 riastrad * Note that we want next (or first, if there's
559 1.1 riastrad * nothing after curcpu()).
560 1.1 riastrad */
561 1.1 riastrad passedcur = true;
562 1.1 riastrad continue;
563 1.1 riastrad }
564 1.1 riastrad if (first == NULL) {
565 1.1 riastrad /*
566 1.1 riastrad * (ci|...|curcpu()|...)
567 1.1 riastrad *
568 1.1 riastrad * Record ci as first in case there's nothing
569 1.1 riastrad * after curcpu().
570 1.1 riastrad */
571 1.1 riastrad first = ci;
572 1.1 riastrad continue;
573 1.1 riastrad }
574 1.1 riastrad }
575 1.1 riastrad
576 1.1 riastrad /*
577 1.1 riastrad * If we hit the end, wrap around to the beginning.
578 1.1 riastrad */
579 1.1 riastrad if (patient == NULL) {
580 1.1 riastrad KASSERT(passedcur);
581 1.1 riastrad patient = first;
582 1.1 riastrad }
583 1.1 riastrad
584 1.1 riastrad return patient;
585 1.1 riastrad }
586 1.1 riastrad
587 1.1 riastrad /*
588 1.1 riastrad * heartbeat()
589 1.1 riastrad *
590 1.1 riastrad * 1. Count a heartbeat on the local CPU.
591 1.1 riastrad *
592 1.1 riastrad * 2. Panic if the system uptime doesn't seem to have advanced in
593 1.1 riastrad * a while.
594 1.1 riastrad *
595 1.1 riastrad * 3. Panic if the soft interrupt on this CPU hasn't advanced the
596 1.1 riastrad * local view of the system uptime.
597 1.1 riastrad *
598 1.1 riastrad * 4. Schedule the soft interrupt to advance the local view of the
599 1.1 riastrad * system uptime.
600 1.1 riastrad *
601 1.1 riastrad * 5. Select another CPU to check the heartbeat of.
602 1.1 riastrad *
603 1.1 riastrad * 6. Panic if the other CPU hasn't advanced its view of the
604 1.1 riastrad * system uptime in a while.
605 1.1 riastrad */
606 1.1 riastrad void
607 1.1 riastrad heartbeat(void)
608 1.1 riastrad {
609 1.1 riastrad unsigned period_ticks, period_secs;
610 1.1 riastrad unsigned count, uptime, cache, stamp, d;
611 1.1 riastrad struct cpu_info *patient;
612 1.1 riastrad
613 1.2 riastrad KASSERT(curcpu_stable());
614 1.1 riastrad
615 1.1 riastrad period_ticks = atomic_load_relaxed(&heartbeat_max_period_ticks);
616 1.1 riastrad period_secs = atomic_load_relaxed(&heartbeat_max_period_secs);
617 1.1 riastrad if (__predict_false(period_ticks == 0) ||
618 1.1 riastrad __predict_false(period_secs == 0) ||
619 1.6 riastrad __predict_false(curcpu()->ci_schedstate.spc_flags &
620 1.6 riastrad SPCF_HEARTBEATSUSPENDED))
621 1.1 riastrad return;
622 1.1 riastrad
623 1.1 riastrad /*
624 1.1 riastrad * Count a heartbeat on this CPU.
625 1.1 riastrad */
626 1.1 riastrad count = curcpu()->ci_heartbeat_count++;
627 1.1 riastrad
628 1.1 riastrad /*
629 1.1 riastrad * If the uptime hasn't changed, make sure that we haven't
630 1.1 riastrad * counted too many of our own heartbeats since the uptime last
631 1.1 riastrad * changed, and stop here -- we only do the cross-CPU work once
632 1.1 riastrad * per second.
633 1.1 riastrad */
634 1.5 riastrad uptime = time_uptime;
635 1.1 riastrad cache = atomic_load_relaxed(&curcpu()->ci_heartbeat_uptime_cache);
636 1.1 riastrad if (__predict_true(cache == uptime)) {
637 1.1 riastrad /*
638 1.1 riastrad * Timecounter hasn't advanced by more than a second.
639 1.1 riastrad * Make sure the timecounter isn't stuck according to
640 1.7 riastrad * our heartbeats -- unless timecounter heartbeats are
641 1.7 riastrad * suspended too.
642 1.1 riastrad *
643 1.1 riastrad * Our own heartbeat count can't roll back, and
644 1.1 riastrad * time_uptime should be updated before it wraps
645 1.1 riastrad * around, so d should never go negative; hence no
646 1.1 riastrad * check for d < UINT_MAX/2.
647 1.1 riastrad */
648 1.1 riastrad stamp =
649 1.1 riastrad atomic_load_relaxed(&curcpu()->ci_heartbeat_uptime_stamp);
650 1.1 riastrad d = count - stamp;
651 1.7 riastrad if (__predict_false(d > period_ticks) &&
652 1.7 riastrad !heartbeat_timecounter_suspended()) {
653 1.1 riastrad panic("%s: time has not advanced in %u heartbeats",
654 1.1 riastrad cpu_name(curcpu()), d);
655 1.1 riastrad }
656 1.1 riastrad return;
657 1.1 riastrad }
658 1.1 riastrad
659 1.1 riastrad /*
660 1.1 riastrad * If the uptime has changed, make sure that it hasn't changed
661 1.1 riastrad * so much that softints must be stuck on this CPU. Since
662 1.1 riastrad * time_uptime is monotonic, this can't go negative, hence no
663 1.1 riastrad * check for d < UINT_MAX/2.
664 1.1 riastrad *
665 1.1 riastrad * This uses the hard timer interrupt handler on the current
666 1.1 riastrad * CPU to ensure soft interrupts at all priority levels have
667 1.1 riastrad * made progress.
668 1.1 riastrad */
669 1.1 riastrad d = uptime - cache;
670 1.1 riastrad if (__predict_false(d > period_secs)) {
671 1.1 riastrad panic("%s: softints stuck for %u seconds",
672 1.1 riastrad cpu_name(curcpu()), d);
673 1.1 riastrad }
674 1.1 riastrad
675 1.1 riastrad /*
676 1.1 riastrad * Schedule a softint to update our cache of the system uptime
677 1.1 riastrad * so the next call to heartbeat, on this or another CPU, can
678 1.1 riastrad * detect progress on this one.
679 1.1 riastrad */
680 1.1 riastrad softint_schedule(heartbeat_sih);
681 1.1 riastrad
682 1.1 riastrad /*
683 1.1 riastrad * Select a patient to check the heartbeat of. If there's no
684 1.1 riastrad * other online CPU, nothing to do.
685 1.1 riastrad */
686 1.1 riastrad patient = select_patient();
687 1.1 riastrad if (patient == NULL)
688 1.1 riastrad return;
689 1.1 riastrad
690 1.1 riastrad /*
691 1.1 riastrad * Verify that time is advancing on the patient CPU. If the
692 1.1 riastrad * delta exceeds UINT_MAX/2, that means it is already ahead by
693 1.1 riastrad * a little on the other CPU, and the subtraction went
694 1.6 riastrad * negative, which is OK. If the CPU's heartbeats have been
695 1.6 riastrad * suspended since we selected it, no worries.
696 1.1 riastrad *
697 1.1 riastrad * This uses the current CPU to ensure the other CPU has made
698 1.1 riastrad * progress, even if the other CPU's hard timer interrupt
699 1.1 riastrad * handler is stuck for some reason.
700 1.1 riastrad *
701 1.1 riastrad * XXX Maybe confirm it hasn't gone negative by more than
702 1.1 riastrad * max_period?
703 1.1 riastrad */
704 1.1 riastrad d = uptime - atomic_load_relaxed(&patient->ci_heartbeat_uptime_cache);
705 1.1 riastrad if (__predict_false(d > period_secs) &&
706 1.1 riastrad __predict_false(d < UINT_MAX/2) &&
707 1.6 riastrad ((patient->ci_schedstate.spc_flags & SPCF_HEARTBEATSUSPENDED)
708 1.6 riastrad == 0))
709 1.1 riastrad defibrillate(patient, d);
710 1.1 riastrad }
711 1.1 riastrad
712 1.1 riastrad /*
713 1.1 riastrad * heartbeat_dump()
714 1.1 riastrad *
715 1.1 riastrad * Print the heartbeat data of all CPUs. Can be called from ddb.
716 1.1 riastrad */
717 1.1 riastrad #ifdef DDB
718 1.1 riastrad static unsigned
719 1.6 riastrad db_read_unsigned(const volatile unsigned *p)
720 1.1 riastrad {
721 1.1 riastrad unsigned x;
722 1.1 riastrad
723 1.6 riastrad db_read_bytes((db_addr_t)(uintptr_t)p, sizeof(x), (char *)&x);
724 1.6 riastrad
725 1.6 riastrad return x;
726 1.6 riastrad }
727 1.6 riastrad
728 1.6 riastrad static int
729 1.6 riastrad db_read_signed(const volatile int *p)
730 1.6 riastrad {
731 1.6 riastrad int x;
732 1.6 riastrad
733 1.6 riastrad db_read_bytes((db_addr_t)(uintptr_t)p, sizeof(x), (char *)&x);
734 1.1 riastrad
735 1.1 riastrad return x;
736 1.1 riastrad }
737 1.1 riastrad
738 1.1 riastrad void
739 1.1 riastrad heartbeat_dump(void)
740 1.1 riastrad {
741 1.1 riastrad struct cpu_info *ci;
742 1.1 riastrad
743 1.1 riastrad db_printf("Heartbeats:\n");
744 1.1 riastrad for (ci = db_cpu_first(); ci != NULL; ci = db_cpu_next(ci)) {
745 1.6 riastrad db_printf("cpu%u: count %u uptime %u stamp %u%s\n",
746 1.1 riastrad db_read_unsigned(&ci->ci_index),
747 1.1 riastrad db_read_unsigned(&ci->ci_heartbeat_count),
748 1.1 riastrad db_read_unsigned(&ci->ci_heartbeat_uptime_cache),
749 1.6 riastrad db_read_unsigned(&ci->ci_heartbeat_uptime_stamp),
750 1.6 riastrad (db_read_signed(&ci->ci_schedstate.spc_flags) &
751 1.6 riastrad SPCF_HEARTBEATSUSPENDED ? " (suspended)" : ""));
752 1.1 riastrad }
753 1.1 riastrad }
754 1.1 riastrad #endif
755