Re: [PATCH v6 5/6] panic: allow force_cpu redirect from an NMI

[Petr Mladek <pmladek@suse.com>]

On Tue 2026-08-18 16:38:05, Bradley Morgan wrote:
> nmi_panic() claims panic_cpu via panic_try_start() before calling
> panic(). When the panic later reaches panic_try_force_cpu(), the
> panic_in_progress() check sees panic_cpu set and refuses to redirect.
> The crash kernel runs on the CPU that took the NMI instead of the CPU
> requested with panic_force_cpu=:
> 
>   nmi_panic()
>     panic_try_start()              wins, panic_cpu = X
>     panic("%s", msg)
>       vpanic()
>         panic_try_force_cpu()
>           panic_in_progress()      true, panic_cpu is X
>           return false             redirect bypassed
>         panic_try_start()          already won
>         __crash_kexec()            on X, not the requested CPU
> 
> Try the redirect before claiming panic_cpu instead, as suggested by
> Petr Mladek. nmi_panic() now calls panic_try_force_cpu() first and
> claims panic_cpu only when no redirect happened. The requested CPU
> claims panic_cpu itself when it runs panic(), so panic_cpu does not
> need to be handed off. panic_try_force_cpu() copies the arguments
> before formatting (patch 3), so nmi_panic() can pass them to vpanic()
> again when no redirect happens.
> 
> The redirect IPI is sent with smp_call_function_single_async(), which
> is not guaranteed to work from NMI context. Treat it as best effort.
> It is worth the risk because the redirection is only used when the
> crash kernel would not work on the panicking CPU anyway.
> 
> Keep returning when the panic is already running on this CPU. A
> nested NMI, for example with unknown_nmi_panic while this CPU is
> inside panic(), must return and let the interrupted panic() continue
> instead of parking the CPU in nmi_panic_self_stop().
> 
> Mark the redirecting CPU offline before stopping it, like vpanic()
> does, so that panic_other_cpus_shutdown() on the target CPU does not
> wait for it.
> 
> Fixes: 2e171ab29f91 ("panic: add panic_force_cpu= parameter to redirect panic to a specific CPU")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260708164312.19044-1-include@grrlz.net
> Cc: stable@vger.kernel.org
> Signed-off-by: Bradley Morgan <include@grrlz.net>

The patch looks good to me:

Reviewed-by: Petr Mladek <pmladek@suse.com>

See some comments below.

> --- a/kernel/panic.c
> +++ b/kernel/panic.c
> @@ -513,10 +513,11 @@ bool panic_on_other_cpu(void)
>  EXPORT_SYMBOL(panic_on_other_cpu);
>  
>  /*
> - * A variant of panic() called from NMI context. We return if we've already
> - * panicked on this CPU. If another CPU already panicked, loop in
> - * nmi_panic_self_stop() which can provide architecture dependent code such
> - * as saving register state for crash dump.
> + * A variant of panic() called from NMI context. The panic is first
> + * redirected to the CPU requested via panic_force_cpu=, when configured.
> + * We return if we've already panicked on this CPU. If another CPU already
> + * panicked, loop in nmi_panic_self_stop() which can provide architecture
> + * dependent code such as saving register state for crash dump.
>   */
>  __printf(2, 3)
>  void nmi_panic(struct pt_regs *regs, const char *fmt, ...)
> @@ -525,6 +526,16 @@ void nmi_panic(struct pt_regs *regs, const char *fmt, ...)
>  
>  	va_start(args, fmt);
>  
> +	/* Try to redirect to the requested CPU before claiming panic_cpu. */
> +	if (panic_try_force_cpu(fmt, args)) {
> +		/*
> +		 * Mark ourselves offline so panic_other_cpus_shutdown() won't
> +		 * wait for us on architectures that check num_online_cpus().
> +		 */
> +		set_cpu_online(raw_smp_processor_id(), false);

It is a bit strange that we set this CPU offline in this code path
but not when the below panic_try_start() fails.
nmi_panic_self_stop(regs) is called in both situations.

I guess that we should mark the CPU offline in the other case
as well. But it is an indepent change. We could fix this later.

Feel free to keep this patch as is.

> +		nmi_panic_self_stop(regs);
> +	}
> +
>  	if (panic_try_start())
>  		vpanic(fmt, args);

Sashiko AI complains here:

| Does this sequence result in printing the 'target CPU is offline' warning
| twice?
| 
| If panic_force_cpu is set to an offline CPU, the newly added call to
| panic_try_force_cpu() evaluates this logic:
| 
| 	/* Target CPU is offline, can't redirect */
| 	if (!cpu_online(panic_force_cpu)) {
| 		pr_warn("panic: target CPU %d is offline, continuing on CPU %d\n",
| 			panic_force_cpu, this_cpu);
| 		return false;
| 	}
| 
| Because the redirect fails, nmi_panic() continues and calls vpanic(). Since
| vpanic() unconditionally calls panic_try_force_cpu() as well, the same
| offline check will execute and the warning might be printed a second time
| before the panic_in_progress() check can abort the redundant redirect attempt.

It is right. We might fix this by checking that panic_try_force_cpu()
has been called twice, for example, by checking the
panic_redirect_cpu value at the beginning.

But I would personally ignore this problem. It is a corner case.
The fix would make the code more hairy. IMHO, it is not worth it.

Best Regards,
Petr