[PATCH printk v2 0/6] Introduce policies for unsafe flushing

[PATCH printk v2 0/6] Introduce policies for unsafe flushing

[John Ogness]

v1 is here [0].

Until now unsafe flushing is only performed at the very end of
panic(), before entering the infinite loop. For other situations
(such as panic-kexec or panic-reboot or emergency-reboot) no
unsafe flushing is performed. The reasoning for this is because
an unsafe flush could lead to fireworks, which could prevent the
kexec or reboot from occurring.

However, some users may be willing to take on such risks in order
to see panic output. Indeed, for the netconsole (which does not
support safe atomic printing) it is a regression that such unsafe
printing does not occur. [1] 

This series adds unsafe flushing policy flags per-console to
allow individual consoles to perform unsafe flushing for such
scenarios. The unsafe flushing is hard-code-enabled for the
netconsole in patch 6/6. The justification is that this is not
less safe than the legacy netconsole.

Later these policy flags could be easily exposed to userspace
via /sys/class/consoles/, once the sysfs per-console interface
is available.

Changes since v1:

- Make console.unsafe_flush_flags unsigned.

- Add missing kerneldoc description for printk_trigger_flush().

- Remove the WARN_ON_ONCE() in
  nbcon_context_try_acquire_hostile() since hostile takeovers
  are now possible from non-panic contexts.

- Also provide a flush reason for console_flush_on_panic().

- Add a global variable @legacy_flush_reason to track reason
  for legacy flushing.

- Explicitly set PR_FLUSH_RUNTIME to 0 since it is now used to
  initialize @legacy_flush_reason.

- Temporarily set @legacy_flush_reason during legacy flushing
  of console_flush_on_panic() and printk_trigger_flush().

- Also set/check ctxt->allow_unsafe_takeover in
  nbcon_legacy_emit_next_record() to enforce flush policies
  for legacy flushing.

John Ogness

[0] https://lore.kernel.org/lkml/20261109123127.489676-1-john.ogness@linutronix.de
[1] https://lore.kernel.org/lkml/20260915100140.3631650-1-ryan.roberts@arm.com

John Ogness (6):
  printk: Introduce and specify flush reasons
  console: Introduce unsafe flush policy flags
  printk: Evaluate flush policy in nbcon_allow_unsafe_takeover()
  printk: Remove nbcon_atomic_flush_unsafe()
  printk: Add panic+kexec flush point
  netconsole: Always perform unsafe flushing on panic/kdb/restart

 arch/loongarch/kernel/reset.c  |   2 +-
 arch/powerpc/kernel/traps.c    |   2 +-
 arch/powerpc/kernel/watchdog.c |   2 +-
 drivers/net/netconsole.c       |   4 +
 include/linux/console.h        |  39 +++++++---
 include/linux/printk.h         |  27 +++++--
 kernel/crash_core.c            |   1 +
 kernel/debug/debug_core.c      |   2 +-
 kernel/panic.c                 |   8 +-
 kernel/printk/internal.h       |   5 +-
 kernel/printk/nbcon.c          | 129 ++++++++++++++++++++++-----------
 kernel/printk/printk.c         |  38 +++++++---
 kernel/reboot.c                |   2 +-
 lib/nmi_backtrace.c            |   2 +-
 14 files changed, 181 insertions(+), 82 deletions(-)


base-commit: d01f86a7da8161aac8c6304b377cf58fb75861ca
-- 
2.47.3

[PATCH printk v2 5/6] printk: Add panic+kexec flush point

[John Ogness]

During panic, nbcon consoles transition to atomic printing. However,
there are consoles that do not support safe atomic printing
(CON_NBCON_ATOMIC_UNSAFE). Such consoles will only flush during
panic if their unsafe flush policy allows them to do so.

The unsafe flush policy NBCON_PANIC_FLUSH only allows unsafe
flushing when particular flushes are explicitly invoked. Call
printk_trigger_flush(PR_FLUSH_RESTART) before performing the kexec
in order to give such consoles a chance to perform an unsafe flush.

Signed-off-by: John Ogness <john.ogness@linutronix.de>
---
 kernel/crash_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/crash_core.c b/kernel/crash_core.c
index d0bd2d0cf8990..064b0af903c38 100644
--- a/kernel/crash_core.c
+++ b/kernel/crash_core.c
@@ -140,6 +140,7 @@ void __noclone __crash_kexec(struct pt_regs *regs)
 
 			crash_setup_regs(&fixed_regs, regs);
 			crash_save_vmcoreinfo();
+			printk_trigger_flush(PR_FLUSH_RESTART);
 			machine_crash_shutdown(&fixed_regs);
 			crash_cma_clear_pending_dma();
 			machine_kexec(kexec_crash_image);
-- 
2.47.3

Re: [PATCH printk v2 5/6] printk: Add panic+kexec flush point

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] crash: printk_trigger_flush() in __crash_kexec() called with
  wrong panic_cpu
--

commit fef7b57cf45508b52c2322cc5354dee7d0cedbc1
Author: John Ogness <john.ogness@linutronix.de>

printk: Add panic+kexec flush point

This commit adds a call to printk_trigger_flush() in __crash_kexec() to
allow consoles with the panic flush policy to flush before booting into
the crash kernel.

> diff --git a/kernel/crash_core.c b/kernel/crash_core.c
> index d0bd2d0cf8990..064b0af903c38 100644
> --- a/kernel/crash_core.c
> +++ b/kernel/crash_core.c
> @@ -140,6 +140,7 @@ void __noclone __crash_kexec(struct pt_regs *regs)
>  
>  			crash_setup_regs(&fixed_regs, regs);
>  			crash_save_vmcoreinfo();
> +			printk_trigger_flush(PR_FLUSH_RESTART);

[Severity: Medium]
Can printk_trigger_flush() be called here on CPU0 while panic_cpu still
holds a non-zero CPU number or its invalid initial value?

On Hyper-V root partitions, crash_nmi_callback() parks all non-zero CPUs
when a panic occurs on another CPU (or when the hypervisor itself crashes
with panic_cpu unset), while CPU0 disables the hypervisor and calls
hv_crash_handle() -> __crash_kexec() without updating panic_cpu:

arch/x86/hyperv/hv_crash.c:hv_crash_handle() {
    ...
	/* we are now fully in devirtualized normal kernel mode */
	__crash_kexec(NULL);
}

Because panic_on_this_cpu() is false on CPU0, nbcon_get_default_prio()
returns normal priority instead of panic priority.  printk_trigger_flush()
then skips atomic panic flushing and takes the offload path via
defer_console_output() -> irq_work_queue().  When the local tick is
stopped, raising the self-interrupt calls hv_send_ipi_self(), which
invokes a hypercall after the hypervisor has already been disabled,
faulting and aborting machine_kexec().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111181942.593695-1-john.ogness@linutronix.de?part=5