RAS: add the support for handling UCNA/DEFERRED error

Until now, the mce_severity mechanism can only identify the severity of UCNA error as MCE_KEEP_SEVERITY. Meanwhile, it is not able to filter out DEFERRED error for ADM platform.

This patch aims to extend the mce_severity mechanism for handling UCNA/DEFERRED error. In order to do this, the patch introduces a new severity level - MCE_UCNA/DEFERRED_SEVERITY.

In addition, mce_severity is specific to machine check exception, and it will check MCIP/EIPV/RIPV bits. In order to use mce_severity mechanism in non-exception context, the patch also introduces a new argument (is_excp) for mce_severity. `is_excp' is used to explicitly specify the calling context of mce_severity.

Signed-off-by Chen Yucong <[email protected]>

---
  arch/x86/include/asm/mce.h                |    4 ++++
  arch/x86/kernel/cpu/mcheck/mce-internal.h |    4 +++-
  arch/x86/kernel/cpu/mcheck/mce-severity.c |   21 ++++++++++++++++-----
  arch/x86/kernel/cpu/mcheck/mce.c          |   14 ++++++++------
  drivers/edac/mce_amd.h                    |    3 ---
  5 files changed, 31 insertions(+), 15 deletions(-)

arch/x86/include/asm/mce.h +4 -0

index 276392f..51b26e89 100644
@@ -34,6 +34,10 @@
  #define MCI_STATUS_S	 (1ULL<<56)  /* Signaled machine check */
  #define MCI_STATUS_AR	 (1ULL<<55)  /* Action required */
 
+/* AMD-specific bits */
+#define MCI_STATUS_DEFERRED	(1ULL<<44)  /* declare an uncorrected error */
+#define MCI_STATUS_POISON	(1ULL<<43)  /* access poisonous data */
+
  /*
   * Note that the full MCACOD field of IA32_MCi_STATUS MSR is
   * bits 15:0.  But bit 12 is the 'F' bit, defined for corrected

arch/x86/kernel/cpu/mcheck/mce-internal.h +3 -1

index 09edd0b..10b4690 100644
@@ -3,6 +3,8 @@
 
  enum severity_level {
  	MCE_NO_SEVERITY,
+	MCE_DEFERRED_SEVERITY,
+	MCE_UCNA_SEVERITY = MCE_DEFERRED_SEVERITY,
  	MCE_KEEP_SEVERITY,
  	MCE_SOME_SEVERITY,
  	MCE_AO_SEVERITY,

@@ -21,7 +23,7 @@ struct mce_bank {
  	char			attrname[ATTR_LEN];	/* attribute name */
  };
 
-int mce_severity(struct mce *a, int tolerant, char **msg);
+int mce_severity(struct mce *a, int tolerant, char **msg, bool is_excp);
  struct dentry *mce_get_debugfs_dir(void);
 
  extern struct mce_bank *mce_banks;

arch/x86/kernel/cpu/mcheck/mce-severity.c +6 -2

index c370e1c..c61feb3 100644
@@ -31,6 +31,7 @@
 
  enum context { IN_KERNEL = 1, IN_USER = 2 };
  enum ser { SER_REQUIRED = 1, NO_SER = 2 };
+enum exception { EXCP_CONTEXT = 1, NO_EXCP = 2 };
 
  static struct severity {
  	u64 mask;

@@ -40,6 +41,7 @@ static struct severity {
  	unsigned char mcgres;
  	unsigned char ser;
  	unsigned char context;
+	unsigned char excp;
  	unsigned char covered;
  	char *msg;
  } severities[] = {

@@ -48,6 +50,8 @@ static struct severity {
  #define  USER		.context = IN_USER
  #define  SER		.ser = SER_REQUIRED
  #define  NOSER		.ser = NO_SER
+#define  EXCP		.excp = EXCP_CONTEXT
+#define  NOEXCP		.excp = NO_EXCP
  #define  BITCLR(x)	.mask = x, .result = 0
  #define  BITSET(x)	.mask = x, .result = x
  #define  MCGMASK(x, y)	.mcgmask = x, .mcgres = y

@@ -71,16 +75,20 @@ static struct severity {
  	/* When MCIP is not set something is very confused */
  	MCESEV(
  		PANIC, "MCIP not set in MCA handler",
-		MCGMASK(MCG_STATUS_MCIP, 0)
+		EXCP, MCGMASK(MCG_STATUS_MCIP, 0)
  		),
  	/* Neither return not error IP -- no chance to recover -> PANIC */
  	MCESEV(
  		PANIC, "Neither restart nor error IP",
-		MCGMASK(MCG_STATUS_RIPV|MCG_STATUS_EIPV, 0)
+		EXCP, MCGMASK(MCG_STATUS_RIPV|MCG_STATUS_EIPV, 0)

arch/x86/kernel/cpu/mcheck/mce-severity.c static struct severity { · line 92

Quoted 4 lines

arch/x86/kernel/cpu/mcheck/mce-severity.c +3 -0

+	MCESEV(
+		DEFERRED, "Deferred error",
+		NOSER, MASK(MCI_STATUS_UC|MCI_STATUS_DEFERRED|MCI_STATUS_POISON, MCI_STATUS_DEFERRED)
 		),

We don't need to have MCI_STATUS_POISON in the MASK() here as a deferred error is indicated by a {UC=0, Deferred = 1}
(Older docs might be unclear on that..)

And it still says ADM on the commit message :)

Quoted 7 lines · Aravind Gopalakrishnan

arch/x86/kernel/cpu/mcheck/mce-severity.c static struct severity { · line 92

Quoted 4 lines

arch/x86/kernel/cpu/mcheck/mce-severity.c +3 -0

+	MCESEV(
+		DEFERRED, "Deferred error",
+		NOSER, MASK(MCI_STATUS_UC|MCI_STATUS_DEFERRED|MCI_STATUS_POISON, MCI_STATUS_DEFERRED)
  		),

We don't need to have MCI_STATUS_POISON in the MASK() here as a deferred error is indicated by a {UC=0, Deferred = 1}
(Older docs might be unclear on that..)

Well, I think that's ok because the MASK() macro actually makes the check do:

look at bits MCI_STATUS_UC|MCI_STATUS_DEFERRED|MCI_STATUS_POISON and of them three MCI_STATUS_DEFERRED has to be the only one set.

And that makes sense - we want deferred errors where we didn't attempt to consume poisoned data (which is signalled by MCI_STATUS_POISON)....

But then I tested it ...

I injected a UC error to memory - then did a simple byte write to the target line. This resulted in two banks logging errors:

[  124.638045] poll: CPU54 saw ec00000000010092 in bank 7
[  124.639006] poll: severity = 0
[  124.647333] poll: CPU54 saw b800000000200179 in bank 3
[  124.648322] poll: severity = 1

The bank 7 error reported as severity 0 because EN=0 ... so we took no action for it.

The bank 3 error got past that hurdle, then through the next BIT(8) set indicates a cache error. Fell at the last check because ADDRV=0.

I think the severity table entry for the "EN" check should have been skipped when calling from the CMCI handler. Then we would have seen severity=1 from the bank 7 error. It would have passed the other tests too (BIT(7) and ADDRV).

Quoted 1 line

The bank 7 error reported as severity 0 because EN=0 ... so we took no action for it.

How come EN is 0? Bank7 error reporting is not enabled? Why? Or the error injection thing doesn't do it?

Quoted 2 lines

The bank 3 error got past that hurdle, then through the next BIT(8) set indicates a cache error. Fell at the last check because ADDRV=0.

I guess you could tweak the injection path to write in a default address so that that check gets bypassed...

Quoted 4 lines

Quoted 1 line

The bank 7 error reported as severity 0 because EN=0 ... so we took no action for it.

How come EN is 0? Bank7 error reporting is not enabled? Why? Or the error injection thing doesn't do it?

The "EN" bit is poorly named, and not well documented. Here's a clip from the SDM:

One of bullets in 15.10.4.1 Machine-Check Exception Handler for Error Recovery

When the EN flag is zero but the VAL and UC flags are one in the IA32_MCi_STATUS register, the reported uncorrected error in this bank is not enabled. As uncorrected errors with the EN flag = 0 are not the source of machine check exceptions, the MCE handler should log and clear non-enabled errors when the S bit is set and should continue searching for enabled errors from the other IA32_MCi_STATUS registers. Note that when IA32_MCG_CAP [24] is 0, any uncorrected error condition (VAL =1 and UC=1) including the one with the EN flag cleared are fatal and the handler must signal the operating system to reset the system. For the errors that do not generate machine check exceptions, the EN flag has no meaning. See Chapter 19: Table 19-15 to find the errors that do not generate machine check exceptions.

Unfortunately the reference to chapter 19 is stale (that is now all about performance monitoring - I'll log a bug with the SDM editor to find the right reference and fix this).

What this is trying to say is that the "EN" bit is to enable signaling of machine checks - so it only has meaning when checking banks from the machine check handler. Errors that are logged, but not signaled, or signaled as CMCI will have MCi_STATUS.EN=0

Quoted 5 lines

Quoted 2 lines

The bank 3 error got past that hurdle, then through the next BIT(8) set indicates a cache error. Fell at the last check because ADDRV=0.

I guess you could tweak the injection path to write in a default address so that that check gets bypassed...

I don't think this is an injection artifact. I think on this processor the mid-level-cache just isn't providing an address in this case. It doesn't help to make one up - our whole game plan is to offline a page with a UC error - and we must have an address to know which page to offline.

Perhaps the severity table entries for UCNA and DEFERRED errors should look to see if ADDRV is set - if not, don't report this as UCNA/DEFERRED?

Just as what you said, the severity table entry for the "EN" check should have been skipped when calling from the CMCI/Poll handler. As shown below:

       MCESEV(
               NO, "Not enabled",
               EXCP, BITCLR(MCI_STATUS_EN)
               ),

Uncorrected no action required (UCNA) - is a uncorrected recoverable machine check error that is not signaled via a machine check exception and, instead, is reported to system software as a corrected machine check error. UCNA errors indicate that some data in the system is corrupted, but the data has not been consumed and the processor state is valid and you may continue execution on this processor. UCNA errors require no action from system software to continue execution. Note that UCNA errors are supported by the processor only when IA32_MCG_CAP[24] (MCG_SER_P) is set.
-- Intel SDM Volume 3B

Deferred errors are errors that cannot be corrected by hardware, but do not cause an immediate interruption in program flow, loss of data integrity, or corruption of processor state. These errors indicate that data has been corrupted but not consumed. Hardware writes information to the status and address registers in the corresponding bank that identifies the source of the error if deferred errors are enabled for logging. Deferred errors are not reported via machine check exceptions; they can be seen by polling the MCi_STATUS registers.
-- AMD64 APM Volume 2

Above two items, both UCNA and Deferred errors belong to detected errors, but they can't be corrected by hardware, and this is very similar to Software Recoverable Action Optional (SRAO) errors. Therefore, we can take some actions that have been used for handling SRAO errors to handle UCNA and Deferred errors.

Signed-off-by Chen Yucong <[email protected]>

---
 arch/x86/kernel/cpu/mcheck/mce.c |   50 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)

arch/x86/kernel/cpu/mcheck/mce.c +3 -0

index 453e9bf..4b6e4cdf 100644
@@ -575,6 +575,41 @@ static void mce_read_aux(struct mce *m, int i)
 	}
 }
 
+static bool memory_error(struct mce *m)
+{
+	struct cpuinfo_x86 *c = &boot_cpu_data;

Before you go and "fix" this again, wait for me to clear up something else before you even go do that. I'll let you know.

In fact, you could redo this patch in the meantime without the AMD vendor check so that Tony can pick them up soon. I'll add the correct AMD bits later.

Quoted 3 lines

In fact, you could redo this patch in the meantime without the AMD vendor check so that Tony can pick them up soon. I'll add the correct AMD bits later.

You just want this hunk deleted ...

arch/x86/kernel/cpu/mcheck/mce.c +10 -0

+	if (c->x86_vendor == X86_VENDOR_AMD) {
+		/*
+		 * AMD BKDGs - Machine Check Error Codes
+		 *
+		 * Bit 8 of ErrCode[15:0] of MCi_STATUS is used for indicating
+		 * a memory-specific error. Note that this field encodes info-
+		 * rmation about memory-hierarchy level involved in the error.
+		 */
+		return (m->status & 0xff00) == BIT(8);
+	} else

I can do that without a repost. Or I can leave a reminder ...

Hi all,

At the suggestion of Boris, the first patch extends the mce_severity mechanism for handling UCNA/DEFERRED error.

Link https://lkml.org/lkml/2014/10/23/190

v2:
The first patch have also eliminated a big hack to make mce_severity() work when called from non-exception context on the advice of Tony and Boris.

Link https://lkml.org/lkml/2014/10/27/1017

And on the basis of the first patch, the second patch adds the support for identifying and handling UCNA/DEFERRED error in machine_check_poll.

V3:
According to Boris, the second patch have also split `memory_error' from mem_deferred_error so that the memory_error() function can be used in other code paths separately.

Link https://lkml.org/lkml/2014/11/6/452

Boris also reported the warning about "MCI_STATUS_POISON" and "MCI_STATUS_POISON" redefined.

Looks ok to me.

Tony, let me know if I should pick them up or you want to. Btw, there's already tip/x86/ras for 3.19.