[PATCH printk 0/6] Introduce policies for unsafe flushing

[PATCH printk 0/6] Introduce policies for unsafe flushing

[John Ogness]

Until now unsafe flushing is only performed at the very end of
panic(), before entering the infinite loop. For other situations
(such as panic-kexec or panic-reboot or emergency-reboot) no
unsafe flushing is performed. The reasoning for this is because
an unsafe flush could lead to fireworks, which could prevent the
kexec or reboot from occurring.

However, some users may be willing to take on such risks in order
to see panic output. Indeed, for the netconsole (which does not
support safe atomic printing) it is a regression that such unsafe
printing does not occur. [0] 

This series adds unsafe flushing policy flags per-console to
allow individual consoles to perform unsafe flushing for such
scenarios. The unsafe flushing is hard-code-enabled for the
netconsole in patch 6/6. The justification is that this is not
less safe than the legacy netconsole.

Later these policy flags could be easily exposed to userspace
via /sys/class/consoles/, once the sysfs per-console interface
is available.

John Ogness

[0] https://lore.kernel.org/lkml/20260915100140.3631650-1-ryan.roberts@arm.com

John Ogness (6):
  printk: Introduce and specify flush reasons
  console: Introduce unsafe flush policy flags
  printk: Evaluate flush policy in nbcon_allow_unsafe_takeover()
  printk: Remove nbcon_atomic_flush_unsafe()
  printk: Add panic+kexec flush point
  netconsole: Always perform unsafe flushing on panic/kdb/restart

 arch/powerpc/kernel/watchdog.c |   2 +-
 drivers/net/netconsole.c       |   4 ++
 include/linux/console.h        |  37 ++++++++---
 include/linux/printk.h         |  27 ++++++--
 kernel/crash_core.c            |   1 +
 kernel/panic.c                 |   2 +-
 kernel/printk/internal.h       |   4 +-
 kernel/printk/nbcon.c          | 117 ++++++++++++++++++++++-----------
 kernel/printk/printk.c         |  16 ++---
 kernel/reboot.c                |   2 +-
 lib/nmi_backtrace.c            |   2 +-
 11 files changed, 146 insertions(+), 68 deletions(-)


base-commit: d01f86a7da8161aac8c6304b377cf58fb75861ca
-- 
2.47.3

[PATCH printk 1/6] printk: Introduce and specify flush reasons

[John Ogness]

Prepare for per-console atomic flushing policies by introducing
enum pr_flush_reason to classify various reasons for performing a
printk backlog flush using printk_trigger_flush().

Propagate the reason down to __nbcon_atomic_flush_pending_con(),
where the actually atomic flushing is executed.

Update all printk_trigger_flush() call sites as well as an
explicit lower-level atomic flush calls to specify the reason.

Note that PR_FLUSH_RUNTIME is used for cases where the reason for
the flush is not clearly defined.

No functional change.

Signed-off-by: John Ogness <john.ogness@linutronix.de>
---
 arch/powerpc/kernel/watchdog.c |  2 +-
 include/linux/printk.h         | 22 ++++++++++++++++++++--
 kernel/printk/internal.h       |  4 ++--
 kernel/printk/nbcon.c          | 28 ++++++++++++++++++----------
 kernel/printk/printk.c         | 16 ++++++++--------
 kernel/reboot.c                |  2 +-
 lib/nmi_backtrace.c            |  2 +-
 7 files changed, 51 insertions(+), 25 deletions(-)

diff --git a/arch/powerpc/kernel/watchdog.c b/arch/powerpc/kernel/watchdog.c
index 582ee3fd71c1b..3d4f9dcb82866 100644
--- a/arch/powerpc/kernel/watchdog.c
+++ b/arch/powerpc/kernel/watchdog.c
@@ -365,7 +365,7 @@ static void watchdog_timer_interrupt(int cpu)
 		 *
 		 * See wd_lockup_ipi.
 		 */
-		printk_trigger_flush();
+		printk_trigger_flush(PR_FLUSH_RUNTIME);
 	}
 }
 
diff --git a/include/linux/printk.h b/include/linux/printk.h
index f594c1266bfd4..c669497bd3378 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -145,6 +145,24 @@ void early_printk(const char *s, ...) { }
 
 struct dev_printk_info;
 
+/**
+ * enum pr_flush_reason - Reason for a flush
+ * @PR_FLUSH_RUNTIME:	A flush while the kernel is running
+ * @PR_FLUSH_RESTART:	The kernel is ending, but another instance should
+ *			follow (reboot, kexec)
+ * @PR_FLUSH_HANG:	The kernel is ending and will enter an infinite loop
+ * @PR_FLUSH_KDB:	Printing while KDB is active
+ *
+ * Flush reasons are used to determine if unsafe atomic flushing should be
+ * performed, based on individual console policies.
+ */
+enum pr_flush_reason {
+	PR_FLUSH_RUNTIME,
+	PR_FLUSH_RESTART,
+	PR_FLUSH_HANG,
+	PR_FLUSH_KDB,
+};
+
 #ifdef CONFIG_PRINTK
 asmlinkage __printf(4, 0)
 int vprintk_emit(int facility, int level,
@@ -202,7 +220,7 @@ void dump_stack_print_info(const char *log_lvl);
 void show_regs_print_info(const char *log_lvl);
 extern asmlinkage void dump_stack_lvl(const char *log_lvl) __cold;
 extern asmlinkage void dump_stack(void) __cold;
-void printk_trigger_flush(void);
+void printk_trigger_flush(enum pr_flush_reason reason);
 void console_try_replay_all(void);
 void printk_legacy_allow_panic_sync(void);
 extern bool nbcon_device_try_acquire(struct console *con);
@@ -298,7 +316,7 @@ static inline void dump_stack_lvl(const char *log_lvl)
 static inline void dump_stack(void)
 {
 }
-static inline void printk_trigger_flush(void)
+static inline void printk_trigger_flush(enum pr_flush_reason reason)
 {
 }
 static inline void console_try_replay_all(void)
diff --git a/kernel/printk/internal.h b/kernel/printk/internal.h
index 85fbf1801cbe0..7f1f4677609da 100644
--- a/kernel/printk/internal.h
+++ b/kernel/printk/internal.h
@@ -104,7 +104,7 @@ void nbcon_seq_force(struct console *con, u64 seq);
 bool nbcon_alloc(struct console *con);
 void nbcon_free(struct console *con);
 enum nbcon_prio nbcon_get_default_prio(void);
-void nbcon_atomic_flush_pending(void);
+void nbcon_atomic_flush_pending(enum pr_flush_reason reason);
 bool nbcon_legacy_emit_next_record(struct console *con, bool *handover,
 				   int cookie, bool use_atomic);
 bool nbcon_kthread_create(struct console *con);
@@ -156,7 +156,7 @@ static inline void nbcon_seq_force(struct console *con, u64 seq) { }
 static inline bool nbcon_alloc(struct console *con) { return false; }
 static inline void nbcon_free(struct console *con) { }
 static inline enum nbcon_prio nbcon_get_default_prio(void) { return NBCON_PRIO_NONE; }
-static inline void nbcon_atomic_flush_pending(void) { }
+static inline void nbcon_atomic_flush_pending(enum pr_flush_reason reason) { }
 static inline bool nbcon_legacy_emit_next_record(struct console *con, bool *handover,
 						 int cookie, bool use_atomic) { return false; }
 static inline void nbcon_kthread_wake(struct console *con) { }
diff --git a/kernel/printk/nbcon.c b/kernel/printk/nbcon.c
index 5f8afaca88665..935fd6b86bac7 100644
--- a/kernel/printk/nbcon.c
+++ b/kernel/printk/nbcon.c
@@ -1542,6 +1542,7 @@ bool nbcon_legacy_emit_next_record(struct console *con, bool *handover,
  * __nbcon_atomic_flush_pending_con - Flush specified nbcon console using its
  *					write_atomic() callback
  * @con:			The nbcon console to flush
+ * @reason:			The reason for the flush
  * @stop_seq:			Flush up until this record
  *
  * Return:	0 if @con was flushed up to @stop_seq Otherwise, error code on
@@ -1561,7 +1562,8 @@ bool nbcon_legacy_emit_next_record(struct console *con, bool *handover,
  * returned, it cannot be expected that the unfinalized record will become
  * available.
  */
-static int __nbcon_atomic_flush_pending_con(struct console *con, u64 stop_seq)
+static int __nbcon_atomic_flush_pending_con(struct console *con, enum pr_flush_reason reason,
+					    u64 stop_seq)
 {
 	struct nbcon_write_context wctxt = { };
 	struct nbcon_context *ctxt = &ACCESS_PRIVATE(&wctxt, ctxt);
@@ -1610,6 +1612,7 @@ static int __nbcon_atomic_flush_pending_con(struct console *con, u64 stop_seq)
  * nbcon_atomic_flush_pending_con - Flush specified nbcon console using its
  *					write_atomic() callback
  * @con:			The nbcon console to flush
+ * @reason:			The reason for the flush
  * @stop_seq:			Flush up until this record
  *
  * This will stop flushing before @stop_seq if another context has ownership.
@@ -1617,13 +1620,14 @@ static int __nbcon_atomic_flush_pending_con(struct console *con, u64 stop_seq)
  * are added while this context was flushing and there is no other context
  * to handle the printing, this context must also flush those records.
  */
-static void nbcon_atomic_flush_pending_con(struct console *con, u64 stop_seq)
+static void nbcon_atomic_flush_pending_con(struct console *con, enum pr_flush_reason reason,
+					   u64 stop_seq)
 {
 	struct console_flush_type ft;
 	int err;
 
 again:
-	err = __nbcon_atomic_flush_pending_con(con, stop_seq);
+	err = __nbcon_atomic_flush_pending_con(con, reason, stop_seq);
 
 	/*
 	 * If there was a new owner (-EPERM, -EAGAIN), that context is
@@ -1652,9 +1656,10 @@ static void nbcon_atomic_flush_pending_con(struct console *con, u64 stop_seq)
 /**
  * __nbcon_atomic_flush_pending - Flush all nbcon consoles using their
  *					write_atomic() callback
+ * @reason:			The reason for the flush
  * @stop_seq:			Flush up until this record
  */
-static void __nbcon_atomic_flush_pending(u64 stop_seq)
+static void __nbcon_atomic_flush_pending(enum pr_flush_reason reason, u64 stop_seq)
 {
 	struct console *con;
 	int cookie;
@@ -1672,7 +1677,7 @@ static void __nbcon_atomic_flush_pending(u64 stop_seq)
 		if (nbcon_seq_read(con) >= stop_seq)
 			continue;
 
-		nbcon_atomic_flush_pending_con(con, stop_seq);
+		nbcon_atomic_flush_pending_con(con, reason, stop_seq);
 	}
 	console_srcu_read_unlock(cookie);
 }
@@ -1681,14 +1686,16 @@ static void __nbcon_atomic_flush_pending(u64 stop_seq)
  * nbcon_atomic_flush_pending - Flush all nbcon consoles using their
  *				write_atomic() callback
  *
+ * @reason:	The reason for the flush
+ *
  * Flush the backlog up through the currently newest record. Any new
  * records added while flushing will not be flushed if there is another
  * context available to handle the flushing. This is to avoid one CPU
  * printing unbounded because other CPUs continue to add records.
  */
-void nbcon_atomic_flush_pending(void)
+void nbcon_atomic_flush_pending(enum pr_flush_reason reason)
 {
-	__nbcon_atomic_flush_pending(prb_next_reserve_seq(prb));
+	__nbcon_atomic_flush_pending(reason, prb_next_reserve_seq(prb));
 }
 
 /**
@@ -1701,7 +1708,7 @@ void nbcon_atomic_flush_pending(void)
 void nbcon_atomic_flush_unsafe(void)
 {
 	panic_nbcon_allow_unsafe_takeover = true;
-	__nbcon_atomic_flush_pending(prb_next_reserve_seq(prb));
+	__nbcon_atomic_flush_pending(PR_FLUSH_HANG, prb_next_reserve_seq(prb));
 	panic_nbcon_allow_unsafe_takeover = false;
 }
 
@@ -1931,7 +1938,8 @@ void nbcon_device_release(struct console *con)
 		 * using the legacy loop.
 		 */
 		if (ft.nbcon_atomic) {
-			__nbcon_atomic_flush_pending_con(con, prb_next_reserve_seq(prb));
+			__nbcon_atomic_flush_pending_con(con, PR_FLUSH_RUNTIME,
+							 prb_next_reserve_seq(prb));
 		} else if (ft.legacy_direct) {
 			if (console_trylock())
 				console_unlock();
@@ -2001,7 +2009,7 @@ void nbcon_kdb_release(struct nbcon_write_context *wctxt)
 	 * The console was locked only when the write_atomic() callback
 	 * was usable.
 	 */
-	__nbcon_atomic_flush_pending_con(ctxt->console, prb_next_reserve_seq(prb));
+	__nbcon_atomic_flush_pending_con(ctxt->console, PR_FLUSH_KDB, prb_next_reserve_seq(prb));
 }
 
 /**
diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
index 5dbcf8a9909bb..ab9f2d6a6526a 100644
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@ -2455,7 +2455,7 @@ asmlinkage int vprintk_emit(int facility, int level,
 	printed_len = vprintk_store(facility, level, dev_info, fmt, args);
 
 	if (ft.nbcon_atomic)
-		nbcon_atomic_flush_pending();
+		nbcon_atomic_flush_pending(PR_FLUSH_RUNTIME);
 
 	if (ft.nbcon_offload)
 		nbcon_kthreads_wake();
@@ -2870,7 +2870,7 @@ static int console_cpu_notify(unsigned int cpu)
 	if (!cpuhp_tasks_frozen) {
 		printk_get_console_flush_type(&ft);
 		if (ft.nbcon_atomic)
-			nbcon_atomic_flush_pending();
+			nbcon_atomic_flush_pending(PR_FLUSH_RUNTIME);
 		if (ft.legacy_direct) {
 			if (console_trylock())
 				console_unlock();
@@ -3561,7 +3561,7 @@ void console_flush_on_panic(enum con_flush_mode mode)
 
 	printk_get_console_flush_type(&ft);
 	if (ft.nbcon_atomic)
-		nbcon_atomic_flush_pending();
+		nbcon_atomic_flush_pending(PR_FLUSH_RUNTIME);
 
 	/* Flush legacy consoles once allowed, even when dangerous. */
 	if (legacy_allow_panic_sync)
@@ -3775,7 +3775,7 @@ static void printk_kthreads_shutdown(void *data)
 		 * The threads may have been stopped while printing a
 		 * backlog. Flush any records left over.
 		 */
-		nbcon_atomic_flush_pending();
+		nbcon_atomic_flush_pending(PR_FLUSH_RUNTIME);
 	}
 	console_list_unlock();
 }
@@ -4537,7 +4537,7 @@ static bool __pr_flush(struct console *con, int timeout_ms, bool reset_on_progre
 	/* Flush the consoles so that records up to @seq are printed. */
 	printk_get_console_flush_type(&ft);
 	if (ft.nbcon_atomic)
-		nbcon_atomic_flush_pending();
+		nbcon_atomic_flush_pending(PR_FLUSH_RUNTIME);
 	if (ft.legacy_direct) {
 		console_lock();
 		console_unlock();
@@ -4732,13 +4732,13 @@ void defer_console_output(void)
  * This is best effort. Depending on the system state, console states,
  * and caller context, no actual flushing may result from this call.
  */
-void printk_trigger_flush(void)
+void printk_trigger_flush(enum pr_flush_reason reason)
 {
 	struct console_flush_type ft;
 
 	printk_get_console_flush_type(&ft);
 	if (ft.nbcon_atomic)
-		nbcon_atomic_flush_pending();
+		nbcon_atomic_flush_pending(reason);
 	if (ft.nbcon_offload)
 		nbcon_kthreads_wake();
 	if (ft.legacy_direct) {
@@ -5090,7 +5090,7 @@ void console_try_replay_all(void)
 	if (console_trylock()) {
 		__console_rewind_all();
 		if (ft.nbcon_atomic)
-			nbcon_atomic_flush_pending();
+			nbcon_atomic_flush_pending(PR_FLUSH_RUNTIME);
 		if (ft.nbcon_offload)
 			nbcon_kthreads_wake();
 		if (ft.legacy_offload)
diff --git a/kernel/reboot.c b/kernel/reboot.c
index a93c23b9e1948..f2f5dfa8e33ce 100644
--- a/kernel/reboot.c
+++ b/kernel/reboot.c
@@ -101,7 +101,7 @@ void emergency_restart(void)
 	 * the emergency restart. Move them to the atomic mode.
 	 */
 	nbcon_cpu_emergency_enter();
-	printk_trigger_flush();
+	printk_trigger_flush(PR_FLUSH_RESTART);
 
 	machine_emergency_restart();
 }
diff --git a/lib/nmi_backtrace.c b/lib/nmi_backtrace.c
index f39c9eca88885..925276113d3a0 100644
--- a/lib/nmi_backtrace.c
+++ b/lib/nmi_backtrace.c
@@ -91,7 +91,7 @@ void nmi_trigger_cpumask_backtrace(const cpumask_t *mask,
 	 * Force flush any remote buffers that might be stuck in IRQ context
 	 * and therefore could not run their irq_work.
 	 */
-	printk_trigger_flush();
+	printk_trigger_flush(PR_FLUSH_RUNTIME);
 
 	clear_bit_unlock(0, &backtrace_flag);
 	put_cpu();
-- 
2.47.3

Re: [PATCH printk 1/6] printk: Introduce and specify flush reasons

[kernel test robot]

Hi John,

kernel test robot noticed the following build warnings:

[auto build test WARNING on d01f86a7da8161aac8c6304b377cf58fb75861ca]

url:    https://github.com/intel-lab-lkp/linux/commits/John-Ogness/printk-Introduce-and-specify-flush-reasons/20261109-133718
base:   d01f86a7da8161aac8c6304b377cf58fb75861ca
patch link:    https://lore.kernel.org/r/20261109123127.489676-2-john.ogness%40linutronix.de
patch subject: [PATCH printk 1/6] printk: Introduce and specify flush reasons
config: openrisc-defconfig (https://download.01.org/0day-ci/archive/20261110/202611100015.e1CNRy54-lkp@intel.com/config)
compiler: or1k-linux-gcc (GCC) 16.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261110/202611100015.e1CNRy54-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202611100015.e1CNRy54-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> Warning: kernel/printk/printk.c:4735 function parameter 'reason' not described in 'printk_trigger_flush'
>> Warning: kernel/printk/printk.c:4735 function parameter 'reason' not described in 'printk_trigger_flush'

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

[PATCH printk 2/6] console: Introduce unsafe flush policy flags

[John Ogness]

Prepare for per-console atomic flushing policies by introducing a
new nbcon-specific console field @unsafe_flush_flags to store the
unsafe flush policies for a console. The policies are represented
by bits, specified by enum nbcon_unsafe_flush_flags.

Currently it is expected that any @unsafe_flush_flags bits are set
prior to console registration and do not change while registered.

No functional change.

Signed-off-by: John Ogness <john.ogness@linutronix.de>
---
 include/linux/console.h | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/include/linux/console.h b/include/linux/console.h
index df23148987eeb..0841bf5e88aac 100644
--- a/include/linux/console.h
+++ b/include/linux/console.h
@@ -194,6 +194,29 @@ enum cons_flags {
 	CON_NBCON_ATOMIC_UNSAFE	= BIT(9),
 };
 
+/**
+ * enum nbcon_unsafe_flush_flags - Unsafe atomic flush policy flags
+ * @NBCON_PANIC_FLUSH:		In panic, unsafe flush before kexec or reboot.
+ * @NBCON_PANIC_PRINTK:		In panic, unsafe flush on each printk().
+ * @NBCON_NORMAL_NOTHREAD:	During normal operation, when printing
+ *				kthreads are unreliable or have been shutdown,
+ *				unsafe flush on each printk() or on explicit
+ *				flushing.
+ * @NBCON_KDB:			Unsafe flush kdb output.
+ *
+ * NBCON unsafe atomic flushing always occurs at the end of panic() before
+ * the kernel enters an infinite loop. Users may choose to perform unsafe
+ * flushing in additional scenarios where the current kernel is ending in
+ * order to increase the chances of seeing console messages, even if it is
+ * not safe to do so.
+ */
+enum nbcon_unsafe_flush_flags {
+	NBCON_PANIC_FLUSH	= BIT(0),
+	NBCON_PANIC_PRINTK	= BIT(1),
+	NBCON_NORMAL_NOTHREAD	= BIT(2),
+	NBCON_KDB		= BIT(3),
+};
+
 /**
  * struct nbcon_state - console state for nbcon consoles
  * @atom:	Compound of the state fields for atomic operations
@@ -326,6 +349,7 @@ struct nbcon_write_context {
  * @data:		Driver private data
  * @node:		hlist node for the console list
  *
+ * @unsafe_flush_flags:	Unsafe atomic flush policy. See enum nbcon_unsafe_flush_flags
  * @nbcon_state:	State for nbcon consoles
  * @nbcon_seq:		Sequence number of the next record for nbcon to print
  * @nbcon_device_ctxt:	Context available for non-printing operations
@@ -461,6 +485,8 @@ struct console {
 	 */
 	void (*device_unlock)(struct console *con, unsigned long flags);
 
+	int			unsafe_flush_flags;
+
 	atomic_t		__private nbcon_state;
 	atomic_long_t		__private nbcon_seq;
 	struct nbcon_context	__private nbcon_device_ctxt;
-- 
2.47.3

Re: [PATCH printk 2/6] console: Introduce unsafe flush policy flags

[Andy Shevchenko]

On Mon, Nov 09, 2026 at 01:37:19PM +0106, John Ogness wrote:
> Prepare for per-console atomic flushing policies by introducing a
> new nbcon-specific console field @unsafe_flush_flags to store the
> unsafe flush policies for a console. The policies are represented
> by bits, specified by enum nbcon_unsafe_flush_flags.
> 
> Currently it is expected that any @unsafe_flush_flags bits are set
> prior to console registration and do not change while registered.
> 
> No functional change.

...

> +	int			unsafe_flush_flags;

Why are flags signed?

-- 
With Best Regards,
Andy Shevchenko

[PATCH printk 3/6] printk: Evaluate flush policy in nbcon_allow_unsafe_takeover()

[John Ogness]

Currently nbcon_allow_unsafe_takeover() is a hack, relying on the
temporary setting of a global variable @panic_nbcon_allow_unsafe_takeover
as a gate to determine if unsafe flushing is allowed. This hack works
because unsafe flushing is only performed at the end of panic().
However, this hack is _not_ sufficient if unsafe flushing is to be
allowed in other contexts.

Allow unsafe flushing in other contexts by modifying
nbcon_allow_unsafe_takeover() to take a console a flush reason as input
and, based on the unsafe flush policies of that console, determine if
unsafe flushing is allowed. This also allows the global variable
@panic_nbcon_allow_unsafe_takeover to be removed.

Remove the hard-coded policy for CON_NBCON_ATOMIC_UNSAFE from
console_is_usable() and implement that policy logic within
nbcon_allow_unsafe_takeover().

Note that this changes the flushing flow for CON_NBCON_ATOMIC_UNSAFE
consoles. Rather than console_is_usable() reporting that the console
is not usable, __nbcon_atomic_flush_pending_con() will report that it
is unable to acquire ownership.

Signed-off-by: John Ogness <john.ogness@linutronix.de>
---
 include/linux/console.h | 11 ++----
 kernel/printk/nbcon.c   | 79 ++++++++++++++++++++++++++++++++---------
 2 files changed, 64 insertions(+), 26 deletions(-)

diff --git a/include/linux/console.h b/include/linux/console.h
index 0841bf5e88aac..8f5097e7f4741 100644
--- a/include/linux/console.h
+++ b/include/linux/console.h
@@ -179,7 +179,8 @@ static inline void con_debug_leave(void) { }
  * @CON_NBCON:		Console can operate outside of the legacy style console_lock
  *			constraints.
  * @CON_NBCON_ATOMIC_UNSAFE: The write_atomic() callback is not safe and is
- *			therefore only used by nbcon_atomic_flush_unsafe().
+ *			therefore only called when allowed by
+ *			nbcon_allow_unsafe_takeover().
  */
 enum cons_flags {
 	CON_PRINTBUFFER		= BIT(0),
@@ -637,7 +638,6 @@ extern void nbcon_write_context_set_buf(struct nbcon_write_context *wctxt,
 extern bool nbcon_enter_unsafe(struct nbcon_write_context *wctxt);
 extern bool nbcon_exit_unsafe(struct nbcon_write_context *wctxt);
 extern void nbcon_reacquire_nobuf(struct nbcon_write_context *wctxt);
-extern bool nbcon_allow_unsafe_takeover(void);
 extern bool nbcon_kdb_try_acquire(struct console *con,
 				  struct nbcon_write_context *wctxt);
 extern void nbcon_kdb_release(struct nbcon_write_context *wctxt);
@@ -670,13 +670,6 @@ static inline bool console_is_usable(struct console *con, short flags, bool use_
 			/* The write_atomic() callback is optional. */
 			if (!con->write_atomic)
 				return false;
-
-			/*
-			 * An unsafe write_atomic() callback is only usable
-			 * when unsafe takeovers are allowed.
-			 */
-			if ((flags & CON_NBCON_ATOMIC_UNSAFE) && !nbcon_allow_unsafe_takeover())
-				return false;
 		}
 
 		/*
diff --git a/kernel/printk/nbcon.c b/kernel/printk/nbcon.c
index 935fd6b86bac7..513bfd399858c 100644
--- a/kernel/printk/nbcon.c
+++ b/kernel/printk/nbcon.c
@@ -1453,24 +1453,60 @@ enum nbcon_prio nbcon_get_default_prio(void)
 	return NBCON_PRIO_NORMAL;
 }
 
-/*
- * Track if it is allowed to perform unsafe hostile takeovers of console
- * ownership. When true, console drivers might perform unsafe actions while
- * printing. It is externally available via nbcon_allow_unsafe_takeover().
- */
-static bool panic_nbcon_allow_unsafe_takeover;
-
 /**
  * nbcon_allow_unsafe_takeover - Check if unsafe console takeovers are allowed
+ *					for a specified console and reason
  *
- * Return:	True, when it is permitted to perform unsafe console printing
+ * @con:	The console to check
+ * @reason:	The reason for the unsafe takeover
  *
- * This is also used by console_is_usable() to determine if it is allowed to
- * call write_atomic() callbacks flagged as unsafe (CON_NBCON_ATOMIC_UNSAFE).
+ * Return:	True, when @con is allowed to perform unsafe console printing
  */
-bool nbcon_allow_unsafe_takeover(void)
+static bool nbcon_allow_unsafe_takeover(struct console *con, enum pr_flush_reason reason)
 {
-	return panic_on_this_cpu() && panic_nbcon_allow_unsafe_takeover;
+	int unsafe_flags = con->unsafe_flush_flags;
+	bool in_panic = panic_on_this_cpu();
+	bool allow = false;
+
+	switch (reason) {
+	case PR_FLUSH_RUNTIME:
+		if (in_panic) {
+			if (unsafe_flags & NBCON_PANIC_PRINTK)
+				allow = true;
+
+		} else {
+			/* Only when the kthreads have been shutdown. */
+			if ((unsafe_flags & NBCON_NORMAL_NOTHREAD) &&
+			    !con->kthread &&
+			    system_state > SYSTEM_RUNNING) {
+				allow = true;
+			}
+		}
+		break;
+	case PR_FLUSH_RESTART:
+		/* kexec, reboot */
+
+		if (in_panic) {
+			if (unsafe_flags & NBCON_PANIC_FLUSH)
+				allow = true;
+
+		} else {
+			/* Printing kthreads not reliable. */
+			if (unsafe_flags & NBCON_NORMAL_NOTHREAD)
+				allow = true;
+		}
+		break;
+	case PR_FLUSH_HANG:
+		/* Always unsafe flush before hang. */
+		allow = true;
+		break;
+	case PR_FLUSH_KDB:
+		if (unsafe_flags & NBCON_KDB)
+			allow = true;
+		break;
+	}
+
+	return allow;
 }
 
 /**
@@ -1572,7 +1608,12 @@ static int __nbcon_atomic_flush_pending_con(struct console *con, enum pr_flush_r
 	ctxt->console			= con;
 	ctxt->spinwait_max_us		= 2000;
 	ctxt->prio			= nbcon_get_default_prio();
-	ctxt->allow_unsafe_takeover	= nbcon_allow_unsafe_takeover();
+	ctxt->allow_unsafe_takeover	= nbcon_allow_unsafe_takeover(con, reason);
+
+	if ((console_srcu_read_flags(con) & CON_NBCON_ATOMIC_UNSAFE) &&
+	    !ctxt->allow_unsafe_takeover) {
+		return -EPERM;
+	}
 
 	while (nbcon_seq_read(con) < stop_seq) {
 		/*
@@ -1707,9 +1748,7 @@ void nbcon_atomic_flush_pending(enum pr_flush_reason reason)
  */
 void nbcon_atomic_flush_unsafe(void)
 {
-	panic_nbcon_allow_unsafe_takeover = true;
 	__nbcon_atomic_flush_pending(PR_FLUSH_HANG, prb_next_reserve_seq(prb));
-	panic_nbcon_allow_unsafe_takeover = false;
 }
 
 /**
@@ -1976,8 +2015,14 @@ bool nbcon_kdb_try_acquire(struct console *con,
 	struct nbcon_context *ctxt = &ACCESS_PRIVATE(wctxt, ctxt);
 
 	memset(ctxt, 0, sizeof(*ctxt));
-	ctxt->console = con;
-	ctxt->prio    = NBCON_PRIO_EMERGENCY;
+	ctxt->console			= con;
+	ctxt->prio			= NBCON_PRIO_EMERGENCY;
+	ctxt->allow_unsafe_takeover	= nbcon_allow_unsafe_takeover(con, PR_FLUSH_KDB);
+
+	if ((console_srcu_read_flags(con) & CON_NBCON_ATOMIC_UNSAFE) &&
+	    !ctxt->allow_unsafe_takeover) {
+		return false;
+	}
 
 	if (!nbcon_context_try_acquire(ctxt, false))
 		return false;
-- 
2.47.3

Re: [PATCH printk 3/6] printk: Evaluate flush policy in nbcon_allow_unsafe_takeover()

[Breno Leitao]

On Mon, Nov 09, 2026 at 01:37:20PM +0106, John Ogness wrote:
> @@ -1572,7 +1608,12 @@ static int __nbcon_atomic_flush_pending_con(struct console *con, enum pr_flush_r
>  	ctxt->console			= con;
>  	ctxt->spinwait_max_us		= 2000;
>  	ctxt->prio			= nbcon_get_default_prio();
> -	ctxt->allow_unsafe_takeover	= nbcon_allow_unsafe_takeover();
> +	ctxt->allow_unsafe_takeover	= nbcon_allow_unsafe_takeover(con, reason);


Thanks for the series, I've tried it here, and I got:

  sysrq: Resetting
    ------------[ cut here ]------------
    WARNING: kernel/printk/nbcon.c:561 at nbcon_context_try_acquire+0x72c/0x790, CPU#0: sh/212
    Modules linked in: nbcon_hold(OE+)
    CPU: 0 UID: 0 PID: 212 Comm: sh Tainted: G           OE       7.4.0-rc1-next-20261105upstream-00006-g4170adac69fb #1 PREEMPT(full)
    Hardware name: linux,dummy-virt (DT)
    pc : nbcon_context_try_acquire+0x72c/0x790
    lr : nbcon_context_try_acquire+0x508/0x790
    ...
    Call trace:
     nbcon_context_try_acquire+0x72c/0x790 (P)
     __nbcon_atomic_flush_pending_con+0x1c0/0x358
     nbcon_atomic_flush_pending+0x224/0x390
     printk_trigger_flush+0x50/0x1c8
     emergency_restart+0x54/0x98
     sysrq_handle_reboot+0x5c/0x88
     __handle_sysrq+0x298/0x3c0
     write_sysrq_trigger+0x178/0x1d0
     proc_reg_write+0x148/0x270
     vfs_write+0x1d4/0x7c8
     ksys_write+0xbc/0x168
     __arm64_sys_write+0x88/0xa8
     invoke_syscall+0x74/0x188
     do_el0_svc+0x108/0x190
     el0_svc+0x60/0x1d8
     el0t_64_sync_handler+0x68/0xe0
     el0t_64_sync+0x198/0x1a0

That is coming from:

   550 static int nbcon_context_try_acquire_hostile(struct nbcon_context *ctxt,
   551                                              struct nbcon_state *cur)
   552 {
   553         unsigned int cpu = smp_processor_id();
   554         struct console *con = ctxt->console;
   555         struct nbcon_state new;
   556
   557         if (!ctxt->allow_unsafe_takeover)
   558                 return -EPERM;
   559
   560         /* Ensure caller is allowed to perform unsafe hostile takeovers. */
   561         if (WARN_ON_ONCE(ctxt->prio != NBCON_PRIO_PANIC))
   562                 return -EPERM;

Thanks,
--breno

Re: [PATCH printk 3/6] printk: Evaluate flush policy in nbcon_allow_unsafe_takeover()

[John Ogness]

On 2026-11-09, Breno Leitao <leitao@debian.org> wrote:
>> @@ -1572,7 +1608,12 @@ static int __nbcon_atomic_flush_pending_con(struct console *con, enum pr_flush_r
>>  	ctxt->console			= con;
>>  	ctxt->spinwait_max_us		= 2000;
>>  	ctxt->prio			= nbcon_get_default_prio();
>> -	ctxt->allow_unsafe_takeover	= nbcon_allow_unsafe_takeover();
>> +	ctxt->allow_unsafe_takeover	= nbcon_allow_unsafe_takeover(con, reason);
>
>
> Thanks for the series, I've tried it here, and I got:

Thanks for testing.

>   sysrq: Resetting
>     ------------[ cut here ]------------
>     WARNING: kernel/printk/nbcon.c:561 at nbcon_context_try_acquire+0x72c/0x790, CPU#0: sh/212
>     Modules linked in: nbcon_hold(OE+)
>     CPU: 0 UID: 0 PID: 212 Comm: sh Tainted: G           OE       7.4.0-rc1-next-20261105upstream-00006-g4170adac69fb #1 PREEMPT(full)
>     Hardware name: linux,dummy-virt (DT)
>     pc : nbcon_context_try_acquire+0x72c/0x790
>     lr : nbcon_context_try_acquire+0x508/0x790
>     ...
>     Call trace:
>      nbcon_context_try_acquire+0x72c/0x790 (P)
>      __nbcon_atomic_flush_pending_con+0x1c0/0x358
>      nbcon_atomic_flush_pending+0x224/0x390
>      printk_trigger_flush+0x50/0x1c8
>      emergency_restart+0x54/0x98
>      sysrq_handle_reboot+0x5c/0x88
>      __handle_sysrq+0x298/0x3c0
>      write_sysrq_trigger+0x178/0x1d0
>      proc_reg_write+0x148/0x270
>      vfs_write+0x1d4/0x7c8
>      ksys_write+0xbc/0x168
>      __arm64_sys_write+0x88/0xa8
>      invoke_syscall+0x74/0x188
>      do_el0_svc+0x108/0x190
>      el0_svc+0x60/0x1d8
>      el0t_64_sync_handler+0x68/0xe0
>      el0t_64_sync+0x198/0x1a0
>
> That is coming from:
>
>    550 static int nbcon_context_try_acquire_hostile(struct nbcon_context *ctxt,
>    551                                              struct nbcon_state *cur)
>    552 {
>    553         unsigned int cpu = smp_processor_id();
>    554         struct console *con = ctxt->console;
>    555         struct nbcon_state new;
>    556
>    557         if (!ctxt->allow_unsafe_takeover)
>    558                 return -EPERM;
>    559
>    560         /* Ensure caller is allowed to perform unsafe hostile takeovers. */
>    561         if (WARN_ON_ONCE(ctxt->prio != NBCON_PRIO_PANIC))
>    562                 return -EPERM;

Wow, you managed to get a hostile takeover. Out of curiousity, do you
know how dangerous this really is? Can this basically just result in
garbage on the network? Or is there dangers of running into the forest
with NULL or garbage pointers? And is the danger acceptable?

@pmladek: I expect we just need to remove the WARN_ON_ONCE() since this
series introduces unsafe takeovers when not in panic. Do you agree?

John

Re: [PATCH printk 3/6] printk: Evaluate flush policy in nbcon_allow_unsafe_takeover()

[Breno Leitao]

On Mon, Nov 09, 2026 at 03:34:32PM +0106, John Ogness wrote:
> On 2026-11-09, Breno Leitao <leitao@debian.org> wrote:
> > That is coming from:
> >
> >    550 static int nbcon_context_try_acquire_hostile(struct nbcon_context *ctxt,
> >    551                                              struct nbcon_state *cur)
> >    552 {
> >    553         unsigned int cpu = smp_processor_id();
> >    554         struct console *con = ctxt->console;
> >    555         struct nbcon_state new;
> >    556
> >    557         if (!ctxt->allow_unsafe_takeover)
> >    558                 return -EPERM;
> >    559
> >    560         /* Ensure caller is allowed to perform unsafe hostile takeovers. */
> >    561         if (WARN_ON_ONCE(ctxt->prio != NBCON_PRIO_PANIC))
> >    562                 return -EPERM;
> 
> Wow, you managed to get a hostile takeover. Out of curiousity, do you
> know how dangerous this really is? Can this basically just result in
> garbage on the network? Or is there dangers of running into the forest
> with NULL or garbage pointers? And is the danger acceptable?

Sure, I was playing with different scenarios, and this was done with a
test module that forces the takeover:

1) Acquire netcon_ext with nbcon_device_try_acquire(), so the console
   is owned at NORMAL priority and in an unsafe state

2) mdelay() for a few seconds without releasing it (simulating
   a possible netpoll busy TX queue -- or some other networkdelay)

3) echo b > /proc/sysrq-trigger from another CPU

--breno

[PATCH printk 4/6] printk: Remove nbcon_atomic_flush_unsafe()

[John Ogness]

There is no need for the special function nbcon_atomic_flush_unsafe(),
which is only called at the end of panic(). Its functionality is
replaced with printk_trigger_flush(PR_FLUSH_HANG).

Signed-off-by: John Ogness <john.ogness@linutronix.de>
---
 include/linux/printk.h |  5 -----
 kernel/panic.c         |  2 +-
 kernel/printk/nbcon.c  | 12 ------------
 3 files changed, 1 insertion(+), 18 deletions(-)

diff --git a/include/linux/printk.h b/include/linux/printk.h
index c669497bd3378..1c8947fc46411 100644
--- a/include/linux/printk.h
+++ b/include/linux/printk.h
@@ -225,7 +225,6 @@ void console_try_replay_all(void);
 void printk_legacy_allow_panic_sync(void);
 extern bool nbcon_device_try_acquire(struct console *con);
 extern void nbcon_device_release(struct console *con);
-void nbcon_atomic_flush_unsafe(void);
 bool pr_flush(int timeout_ms, bool reset_on_progress);
 #else
 static inline __printf(1, 0)
@@ -336,10 +335,6 @@ static inline void nbcon_device_release(struct console *con)
 {
 }
 
-static inline void nbcon_atomic_flush_unsafe(void)
-{
-}
-
 static inline bool pr_flush(int timeout_ms, bool reset_on_progress)
 {
 	return true;
diff --git a/kernel/panic.c b/kernel/panic.c
index a4dbb6b8cd2bf..7c03a17ba1288 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -765,7 +765,7 @@ void vpanic(const char *fmt, va_list args)
 	 * Explicitly flush the kernel log buffer one last time.
 	 */
 	console_flush_on_panic(CONSOLE_FLUSH_PENDING);
-	nbcon_atomic_flush_unsafe();
+	printk_trigger_flush(PR_FLUSH_HANG);
 
 	local_irq_enable();
 	for (i = 0; ; i += PANIC_TIMER_STEP) {
diff --git a/kernel/printk/nbcon.c b/kernel/printk/nbcon.c
index 513bfd399858c..0c832e33a8f2c 100644
--- a/kernel/printk/nbcon.c
+++ b/kernel/printk/nbcon.c
@@ -1739,18 +1739,6 @@ void nbcon_atomic_flush_pending(enum pr_flush_reason reason)
 	__nbcon_atomic_flush_pending(reason, prb_next_reserve_seq(prb));
 }
 
-/**
- * nbcon_atomic_flush_unsafe - Flush all nbcon consoles using their
- *	write_atomic() callback and allowing unsafe hostile takeovers
- *
- * Flush the backlog up through the currently newest record. Unsafe hostile
- * takeovers will be performed, if necessary.
- */
-void nbcon_atomic_flush_unsafe(void)
-{
-	__nbcon_atomic_flush_pending(PR_FLUSH_HANG, prb_next_reserve_seq(prb));
-}
-
 /**
  * nbcon_cpu_emergency_enter - Enter an emergency section where printk()
  *				messages for that CPU are flushed directly
-- 
2.47.3

[PATCH printk 5/6] printk: Add panic+kexec flush point

[John Ogness]

During panic, nbcon consoles transition to atomic printing. However,
there are consoles that do not support safe atomic printing
(CON_NBCON_ATOMIC_UNSAFE). Such consoles will only flush during
panic if their unsafe flush policy allows them to do so.

The unsafe flush policy NBCON_PANIC_FLUSH only allows unsafe
flushing when particular flushes are explicitly invoked. Call
printk_trigger_flush(PR_FLUSH_RESTART) before performing the kexec
in order to give such consoles a chance to perform an unsafe flush.

Signed-off-by: John Ogness <john.ogness@linutronix.de>
---
 kernel/crash_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/crash_core.c b/kernel/crash_core.c
index d0bd2d0cf8990..064b0af903c38 100644
--- a/kernel/crash_core.c
+++ b/kernel/crash_core.c
@@ -140,6 +140,7 @@ void __noclone __crash_kexec(struct pt_regs *regs)
 
 			crash_setup_regs(&fixed_regs, regs);
 			crash_save_vmcoreinfo();
+			printk_trigger_flush(PR_FLUSH_RESTART);
 			machine_crash_shutdown(&fixed_regs);
 			crash_cma_clear_pending_dma();
 			machine_kexec(kexec_crash_image);
-- 
2.47.3

[PATCH printk 6/6] netconsole: Always perform unsafe flushing on panic/kdb/restart

[John Ogness]

As a legacy console the netconsole would perform unsafe flushing
during panic/kdb/restart. With commit 7eab73b18630 ("netconsole:
convert to NBCON console infrastructure") the netconsole is now an
NBCON console, however it uses the CON_NBCON_ATOMIC_UNSAFE flag and
this prevents unsafe flushing except for at the very end of panic().

Enable unsafe flushing policies to allow the netconsole to perform
unsafe flushing during all panic/kdb/restart variations, just as it
did when it was a legacy console.

Signed-off-by: John Ogness <john.ogness@linutronix.de>
---
 drivers/net/netconsole.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index 267254f046de9..6c1587958e915 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -2695,6 +2695,8 @@ static void free_param_target(struct netconsole_target *nt)
 static struct console netconsole_ext = {
 	.name = "netcon_ext",
 	.flags = CON_ENABLED | CON_EXTENDED | CON_NBCON | CON_NBCON_ATOMIC_UNSAFE,
+	.unsafe_flush_flags = NBCON_PANIC_FLUSH | NBCON_PANIC_PRINTK | NBCON_KDB |
+			      NBCON_NORMAL_NOTHREAD,
 	.write_thread = netconsole_write_ext,
 	.write_atomic = netconsole_write_ext,
 	.device_lock = netconsole_device_lock,
@@ -2704,6 +2706,8 @@ static struct console netconsole_ext = {
 static struct console netconsole = {
 	.name = "netcon",
 	.flags = CON_ENABLED | CON_NBCON | CON_NBCON_ATOMIC_UNSAFE,
+	.unsafe_flush_flags = NBCON_PANIC_FLUSH | NBCON_PANIC_PRINTK | NBCON_KDB |
+			      NBCON_NORMAL_NOTHREAD,
 	.write_thread = netconsole_write_basic,
 	.write_atomic = netconsole_write_basic,
 	.device_lock = netconsole_device_lock,
-- 
2.47.3