kernel::debug::panic
Panic handling and the postmortem snapshot.
Semantics: a panic halts the system
Section titled “Semantics: a panic halts the system”Ordinary FlintOS tasks run in a single protection domain. A trusted task that panicked may already have written through a bad pointer, left a mutex held, or corrupted a queue another task is about to read. Killing just the offender and carrying on would be a guess about how far the damage spread.
So: mask every interrupt, record what happened, say so on the console, and
stop. The selected SoC may arrange a delayed, snapshot-preserving recovery
through [hal::reset::PanicRecovery]; without one the board stays halted.
Opt-in isolated compute tasks also use this fail-stop policy on unexpected
faults; isolation does not imply automatic task restart or resource repair.
The previous behaviour was neither halt nor recover. It ended in a bare
loop {} with interrupts still unmasked, which parks only the panicking
task: the tick kept firing, the scheduler kept running every other task, and
the “FLINT PANIC” banner was printed by a system that then carried on as
though it had not.
Functions
Section titled “Functions”handle
Section titled “handle”fn handle(args: &core::fmt::Arguments<'_>) -> !The kernel panic handler. Never returns.
handle_at
Section titled “handle_at”fn handle_at(args: &core::fmt::Arguments<'_>, location: Option<&core::panic::Location<'_>>) -> !The kernel panic handler, with the source location where the caller has one.
#[panic_handler] passes PanicInfo::location() through here. Kernel code
that calls [handle] directly names itself in the message instead.
handle_trap
Section titled “handle_trap”fn handle_trap(args: &core::fmt::Arguments<'_>, context: hal::arch::ContextDiagnostics) -> !Fatal exception with the actual interrupted PC/stack, rather than the last software context save (which may be stale or already reused on this stack).
References: ContextDiagnostics
has_snapshot
Section titled “has_snapshot”fn has_snapshot() -> boolWhether a panic snapshot from a previous boot is present.
previous_was_reported
Section titled “previous_was_reported”fn previous_was_reported() -> boolWhether this boot consumed and reported a retained panic snapshot.
report_previous
Section titled “report_previous”fn report_previous() -> boolPrint the previous boot’s panic, if there was one, then clear it.
Called once during boot, after the console is up. Without this the snapshot was written and never read — the region existed, the magic was set, and nothing in the tree ever looked. Clearing the magic is what makes this “the previous boot” rather than a message that reappears on every boot until the SRAM happens to be overwritten.