What is Kernel Taint ?
The Linux kernel maintains a “taint state” and logs for the same are stored in Kernel error messages.
Kernel taint state indicates that something has happened to the running
kernel that results in Kernel error or hang and this can be
troubleshooted by analysing the kernel source code.
Some of the information in the taint relates to whether the information
provided by the kernel in an error message can be considered
trustworthy.
Steps to check kernel taint status
root@server[#] cat /proc/sys/kernel/tainted
If it returns any non-zero value then it means your kernel is
tainted . The value will be a combined number of all applying kernel
taint flags added together. You can find a list of currently used kernel
flags under:
Taint values
1 – A module with a non-GPL license has been loaded, this includes
modules with no license. Set by modutils >= 2.4.9 and
module-init-tools.
2 – A module was force loaded by insmod -f. Set by modutils >= 2.4.9 and module-init-tools.
4 – Unsafe SMP processors: SMP with CPUs not designed for SMP.
8 – A module was forcibly unloaded from the system by rmmod -f.
16 – A hardware machine check error occurred on the system.
32 – A bad page was discovered on the system.
64 – The user has asked that the system be marked “tainted”. This could
be because they are running software that directly modifies the
hardware, or for other reasons.
128 – The system has died.
256 – The ACPI DSDT has been overridden with one supplied by the user instead of using the one provided by the hardware.
512 – A kernel warning has occurred.
1024 – A module from drivers/staging was loaded.
268435456 – Unsupported hardware
536870912 – Technology Preview code was loaded
Taint Flags
The taint status of the kernel not only indicates whether or not the kernel has been tainted but also indicates what type(s) of event caused the kernel to be marked as tainted. This information is encoded through single-character flags in the string following “Tainted:” in a kernel error message.
You can get the taint flags in dmesg command output
root@server[#] dmesg | grep -i taint
Below are the taint flags
- P: A module with a Proprietary license has been loaded, i.e. a module that is not licensed under the GNU General Public License (GPL) or a compatible license. This may indicate that source code for this module is not available to the Linux kernel developers or to Novell’s developers.
- G: The opposite of ‘P’: the kernel has been tainted (for a reason indicated by a different flag), but all modules loaded into it were licensed under the GPL or a license compatible with the GPL.
- F: A module was loaded using the Force option “-f” of insmod or modprobe, which caused a sanity check of the versioning information from the module (if present) to be skipped.
- R: A module which was in use or was not designed to be removed has been forcefully Removed from the running kernelusing the force option “-f” of rmmod.
- S: The Linux kernel is running with Symmetric MultiProcessor support (SMP), but the CPUs in the system are not designed or certified for SMP use.
- M: A Machine Check Exception (MCE) has been raised while the kernel was running. MCEs are triggered by the hardware to indicate a hardware related problem, for example the CPU’s temperature exceeding a treshold or a memory bank signaling an uncorrectable error.
- B: A process has been found in a Bad page state, indicating a corruption of the virtual memory subsystem, possibly caused by malfunctioning RAM or cache memory.
The taint flags above are implemented in the standard Linux kernel and indicate the information provided in kernel error messages is not necessarily to be trusted.
In SUSE kernels, additional taint flags are implemented.
- U or N: An Unsupported module has been loaded, i.e. a module which is not supported by Novell and which is not known to be supported by a third party. For example, the module is a driver that is not yet mature enough to be supportable or is a driver for an obsolete type of hardware which can no longer be tested adequately.
- X: A module that is not supported by Novell but that is supported eXternally by a third party has been loaded into the kernel.