2 * Copyright (c) 2004 Robert N. M. Watson
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 #include "opt_mp_watchdog.h"
30 #include "opt_sched.h"
33 #error MP_WATCHDOG cannot currently be used with SCHED_ULE
36 #include <sys/param.h>
38 #include <sys/kernel.h>
40 #include <sys/mutex.h>
43 #include <sys/sysctl.h>
44 #include <sys/systm.h>
46 #include <machine/smp.h>
47 #include <x86/apicreg.h>
48 #include <x86/apicvar.h>
49 #include <machine/mp_watchdog.h>
52 * mp_watchdog hijacks the idle thread on a specified CPU, prevents new work
53 * from being scheduled there, and uses it as a "watchdog" to detect kernel
54 * failure on other CPUs. This is made reasonable by inclusion of logical
55 * processors in Xeon hardware. The watchdog is configured by setting the
56 * debug.watchdog sysctl/tunable to the CPU of interest. A callout will then
57 * begin executing reseting a timer that is gradually lowered by the watching
58 * thread. If the timer reaches 0, the watchdog fires by ether dropping
59 * directly to the debugger, or by sending an NMI IPI to the boot processor.
60 * This is a somewhat less efficient substitute for dedicated watchdog
61 * hardware, but can be quite an effective tool for debugging hangs.
63 * XXXRW: This should really use the watchdog(9)/watchdog(4) framework, but
66 static int watchdog_cpu
= -1;
67 static int watchdog_dontfire
= 1;
68 static int watchdog_timer
= -1;
69 static int watchdog_nmi
= 1;
71 SYSCTL_INT(_debug
, OID_AUTO
, watchdog_nmi
, CTLFLAG_RWTUN
, &watchdog_nmi
, 0,
72 "IPI the boot processor with an NMI to enter the debugger");
74 static struct callout watchdog_callout
;
76 static void watchdog_change(int wdcpu
);
79 * Number of seconds before the watchdog will fire if the callout fails to
82 #define WATCHDOG_THRESHOLD 10
85 watchdog_init(void *arg
)
88 callout_init(&watchdog_callout
, 1);
89 if (watchdog_cpu
!= -1)
90 watchdog_change(watchdog_cpu
);
94 * This callout resets a timer until the watchdog kicks in. It acquires some
95 * critical locks to make sure things haven't gotten wedged with hose locks
99 watchdog_function(void *arg
)
103 * Since the timer ran, we must not be wedged. Acquire some critical
104 * locks to make sure. Then reset the timer.
107 watchdog_timer
= WATCHDOG_THRESHOLD
;
109 callout_reset(&watchdog_callout
, 1 * hz
, watchdog_function
, NULL
);
111 SYSINIT(watchdog_init
, SI_SUB_DRIVERS
, SI_ORDER_ANY
, watchdog_init
, NULL
);
114 watchdog_change(int wdcpu
)
117 if (wdcpu
== -1 || wdcpu
== 0xffffffff) {
119 * Disable the watchdog.
122 watchdog_dontfire
= 1;
123 callout_stop(&watchdog_callout
);
124 printf("watchdog stopped\n");
126 watchdog_timer
= WATCHDOG_THRESHOLD
;
127 watchdog_dontfire
= 0;
128 watchdog_cpu
= wdcpu
;
129 callout_reset(&watchdog_callout
, 1 * hz
, watchdog_function
,
135 * This sysctl sets which CPU is the watchdog CPU. Set to -1 or 0xffffffff
136 * to disable the watchdog.
139 sysctl_watchdog(SYSCTL_HANDLER_ARGS
)
144 error
= sysctl_handle_int(oidp
, &temp
, 0, req
);
148 if (req
->newptr
!= NULL
)
149 watchdog_change(temp
);
152 SYSCTL_PROC(_debug
, OID_AUTO
, watchdog
, CTLTYPE_INT
|CTLFLAG_RW
, 0, 0,
153 sysctl_watchdog
, "I", "");
156 * Drop into the debugger by sending an IPI NMI to the boot processor.
159 watchdog_ipi_nmi(void)
163 * Deliver NMI to the boot processor. Why not?
165 lapic_ipi_raw(APIC_DEST_DESTFLD
| APIC_TRIGMOD_EDGE
|
166 APIC_LEVEL_ASSERT
| APIC_DESTMODE_PHY
| APIC_DELMODE_NMI
,
172 * ap_watchdog() is called by the SMP idle loop code. It works on the same
173 * premise that the disabling of logical processors does: that if the cpu is
174 * idle, then it can ignore the world from then on, as nothing will be
175 * scheduled on it. Leaving aside multi-runqueue schedulers (SCHED_ULE) and
176 * explicit process migration (sched_bind()), this is not an unreasonable
180 ap_watchdog(u_int cpuid
)
182 char old_pcomm
[MAXCOMLEN
+ 1];
185 if (watchdog_cpu
!= cpuid
)
188 printf("watchdog started on cpu %d\n", cpuid
);
190 bcopy(p
->p_comm
, old_pcomm
, MAXCOMLEN
+ 1);
191 snprintf(p
->p_comm
, MAXCOMLEN
+ 1, "mp_watchdog cpu %d", cpuid
);
193 DELAY(1000000); /* One second. */
194 if (watchdog_cpu
!= cpuid
)
196 atomic_subtract_int(&watchdog_timer
, 1);
197 if (watchdog_timer
< 4)
198 printf("Watchdog timer: %d\n", watchdog_timer
);
199 if (watchdog_timer
== 0 && watchdog_dontfire
== 0) {
200 printf("Watchdog firing!\n");
201 watchdog_dontfire
= 1;
205 kdb_enter(KDB_WHY_WATCHDOG
, "mp_watchdog");
208 bcopy(old_pcomm
, p
->p_comm
, MAXCOMLEN
+ 1);
209 printf("watchdog stopped on cpu %d\n", cpuid
);