[RFC net-next v2 1/3] devlink: move health state to uAPI

Move the health states into uAPI, so applications can use them.

Note that we need to change the name of the enum because
user space is likely already defining the same values.
E.g. iproute2 does.

Use this opportunity to shorten the names.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
.../net/ethernet/broadcom/bnxt/bnxt_devlink.c  |  4 ++--
.../ethernet/mellanox/mlx5/core/en/health.c    |  4 ++--
include/net/devlink.h                          |  7 +------
include/uapi/linux/devlink.h                   | 12 ++++++++++++
net/core/devlink.c                             | 18 +++++++++---------
5 files changed, 26 insertions(+), 19 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
index 64381be935a8..cafc98ab4b5e 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c

@@ -252,9 +252,9 @@ void bnxt_dl_health_status_update(struct bnxt *bp, bool healthy)

	u8 state;

	if (healthy)
-		state = DEVLINK_HEALTH_REPORTER_STATE_HEALTHY;
+		state = DL_HEALTH_STATE_HEALTHY;
	else
-		state = DEVLINK_HEALTH_REPORTER_STATE_ERROR;
+		state = DL_HEALTH_STATE_ERROR;

Currently devlink health does not give user any clear information
of what kind of remediation ->recover callback will perform. This
makes it difficult to understand the impact of enabling auto-
-remediation, and the severity of the error itself.

To allow users to make more informed decision add a new remediation
type attribute.

Note that we only allow one remediation type per reporter, this
is intentional. devlink health is not built for mixing issues
of different severity into one reporter since it only maintains
one dump, of the first event and a single error counter.
Nudging vendors towards categorizing issues beyond coarse
groups is an added bonus.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
include/net/devlink.h        |  2 ++
include/uapi/linux/devlink.h | 25 +++++++++++++++++++++++++
net/core/devlink.c           |  7 ++++++-
3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/include/net/devlink.h b/include/net/devlink.h
index b424328af658..72b37769761f 100644
--- a/include/net/devlink.h
+++ b/include/net/devlink.h

@@ -659,6 +659,7 @@ struct devlink_health_reporter;

/**
 * struct devlink_health_reporter_ops - Reporter operations
 * @name: reporter name
+ * remedy: severity of the remediation required
 * @recover: callback to recover from reported error
 *           if priv_ctx is NULL, run a full recover
 * @dump: callback to dump an object

@@ -669,6 +670,7 @@ struct devlink_health_reporter;

struct devlink_health_reporter_ops {
	char *name;
+	enum devlink_health_remedy remedy;
	int (*recover)(struct devlink_health_reporter *reporter,
		       void *priv_ctx, struct netlink_ext_ack *extack);
	int (*dump)(struct devlink_health_reporter *reporter,

diff --git a/include/uapi/linux/devlink.h b/include/uapi/linux/devlink.h
index 41a6ea3b2256..8cd1508b525b 100644
--- a/include/uapi/linux/devlink.h
+++ b/include/uapi/linux/devlink.h

@@ -534,6 +534,9 @@ enum devlink_attr {

	DEVLINK_ATTR_RELOAD_ACTION_STATS,       /* nested */

	DEVLINK_ATTR_PORT_PCI_SF_NUMBER,	/* u32 */
+
+	DEVLINK_ATTR_HEALTH_REPORTER_REMEDY,	/* u32 */
+
	/* add new attributes above here, update the policy in devlink.c */

	__DEVLINK_ATTR_MAX,

@@ -620,4 +623,26 @@ enum devlink_health_state {

	DL_HEALTH_STATE_ERROR,
};

+/**
+ * enum devlink_health_reporter_remedy - severity of remediation procedure
+ * @DL_HEALTH_REMEDY_NONE: transient error, no remediation required
+ * @DL_HEALTH_REMEDY_KICK: device stalled, processing will be re-triggered
+ * @DL_HEALTH_REMEDY_COMP_RESET: associated device component (e.g. device queue)
+ *			will be reset
+ * @DL_HEALTH_REMEDY_RESET: full device reset, will result in temporary
+ *			unavailability of the device, device configuration
+ *			should not be lost
+ * @DL_HEALTH_REMEDY_REINIT: device will be reinitialized and configuration lost
+ *
+ * Used in %DEVLINK_ATTR_HEALTH_REPORTER_REMEDY, categorizes the health reporter
+ * by the severity of the remediation.
+ */
+enum devlink_health_remedy {
+	DL_HEALTH_REMEDY_NONE = 1,
+	DL_HEALTH_REMEDY_KICK,
+	DL_HEALTH_REMEDY_COMP_RESET,
+	DL_HEALTH_REMEDY_RESET,
+	DL_HEALTH_REMEDY_REINIT,

+};
+
#endif /* _UAPI_LINUX_DEVLINK_H_ */

diff --git a/net/core/devlink.c b/net/core/devlink.c
index 8e4e4bd7bb36..09d77d43ff63 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c

@@ -6095,7 +6095,8 @@ __devlink_health_reporter_create(struct devlink *devlink,

{
	struct devlink_health_reporter *reporter;

-	if (WARN_ON(graceful_period && !ops->recover))
+	if (WARN_ON(graceful_period && !ops->recover) ||
+	    WARN_ON(ops->recover && !ops->remedy))
		return ERR_PTR(-EINVAL);

	reporter = kzalloc(sizeof(*reporter), GFP_KERNEL);

@@ -6265,6 +6266,10 @@ devlink_nl_health_reporter_fill(struct sk_buff *msg,

	if (nla_put_string(msg, DEVLINK_ATTR_HEALTH_REPORTER_NAME,
			   reporter->ops->name))
		goto reporter_nest_cancel;
+	if (reporter->ops->remedy &&
+	    nla_put_u32(msg, DEVLINK_ATTR_HEALTH_REPORTER_REMEDY,
+			reporter->ops->remedy))
+		goto reporter_nest_cancel;
	if (nla_put_u8(msg, DEVLINK_ATTR_HEALTH_REPORTER_STATE,
		       reporter->health_state))
		goto reporter_nest_cancel;
-- 
2.29.2

Extend the applicability of devlink health reporters
beyond what can be locally remedied. Add failure modes
which require re-flashing the NVM image or HW changes.

The expectation is that driver will call
devlink_health_reporter_state_update() to put hardware
health reporters into bad state.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
  include/uapi/linux/devlink.h | 7 +++++++
  net/core/devlink.c           | 3 +--
  2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/include/uapi/linux/devlink.h b/include/uapi/linux/devlink.h
index 8cd1508b525b..f623bbc63489 100644
--- a/include/uapi/linux/devlink.h
+++ b/include/uapi/linux/devlink.h

@@ -617,10 +617,17 @@ enum devlink_port_fn_opstate {
   * @DL_HEALTH_STATE_ERROR: error state, running health reporter's recovery
   *			may fix the issue, otherwise user needs to try
   *			power cycling or other forms of reset
+ * @DL_HEALTH_STATE_BAD_IMAGE: device's non-volatile memory needs
+ *			to be re-written, usually due to block corruption
+ * @DL_HEALTH_STATE_BAD_HW: hardware errors detected, device, host
+ *			or the connection between the two may be at fault
   */
  enum devlink_health_state {
  	DL_HEALTH_STATE_HEALTHY,
  	DL_HEALTH_STATE_ERROR,
+
+	DL_HEALTH_STATE_BAD_IMAGE,
+	DL_HEALTH_STATE_BAD_HW,
  };
  
  /**

diff --git a/net/core/devlink.c b/net/core/devlink.c
index 09d77d43ff63..4a9fa6288a4a 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c

@@ -6527,8 +6527,7 @@ void
  devlink_health_reporter_state_update(struct devlink_health_reporter *reporter,
  				     enum devlink_health_state state)
  {
-	if (WARN_ON(state != DL_HEALTH_STATE_HEALTHY &&
-		    state != DL_HEALTH_STATE_ERROR))
+	if (WARN_ON(state > DL_HEALTH_STATE_BAD_HW))
  		return;
  
  	if (reporter->health_state == state)

Currently devlink health does not give user any clear information
of what kind of remediation ->recover callback will perform. This
makes it difficult to understand the impact of enabling auto-
-remediation, and the severity of the error itself.

To allow users to make more informed decision add a new remediation
type attribute.

Note that we only allow one remediation type per reporter, this
is intentional. devlink health is not built for mixing issues
of different severity into one reporter since it only maintains
one dump, of the first event and a single error counter.
Nudging vendors towards categorizing issues beyond coarse
groups is an added bonus.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
  include/net/devlink.h        |  2 ++
  include/uapi/linux/devlink.h | 25 +++++++++++++++++++++++++
  net/core/devlink.c           |  7 ++++++-
  3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/include/net/devlink.h b/include/net/devlink.h
index b424328af658..72b37769761f 100644
--- a/include/net/devlink.h
+++ b/include/net/devlink.h

@@ -659,6 +659,7 @@ struct devlink_health_reporter;
  /**
   * struct devlink_health_reporter_ops - Reporter operations
   * @name: reporter name
+ * remedy: severity of the remediation required
   * @recover: callback to recover from reported error
   *           if priv_ctx is NULL, run a full recover
   * @dump: callback to dump an object

@@ -669,6 +670,7 @@ struct devlink_health_reporter;
  
  struct devlink_health_reporter_ops {
  	char *name;
+	enum devlink_health_remedy remedy;
  	int (*recover)(struct devlink_health_reporter *reporter,
  		       void *priv_ctx, struct netlink_ext_ack *extack);
  	int (*dump)(struct devlink_health_reporter *reporter,

diff --git a/include/uapi/linux/devlink.h b/include/uapi/linux/devlink.h
index 41a6ea3b2256..8cd1508b525b 100644
--- a/include/uapi/linux/devlink.h
+++ b/include/uapi/linux/devlink.h

@@ -534,6 +534,9 @@ enum devlink_attr {
  	DEVLINK_ATTR_RELOAD_ACTION_STATS,       /* nested */
  
  	DEVLINK_ATTR_PORT_PCI_SF_NUMBER,	/* u32 */
+
+	DEVLINK_ATTR_HEALTH_REPORTER_REMEDY,	/* u32 */
+
  	/* add new attributes above here, update the policy in devlink.c */
  
  	__DEVLINK_ATTR_MAX,

@@ -620,4 +623,26 @@ enum devlink_health_state {
  	DL_HEALTH_STATE_ERROR,
  };
  
+/**
+ * enum devlink_health_reporter_remedy - severity of remediation procedure
+ * @DL_HEALTH_REMEDY_NONE: transient error, no remediation required
+ * @DL_HEALTH_REMEDY_KICK: device stalled, processing will be re-triggered
+ * @DL_HEALTH_REMEDY_COMP_RESET: associated device component (e.g. device queue)
+ *			will be reset
+ * @DL_HEALTH_REMEDY_RESET: full device reset, will result in temporary
+ *			unavailability of the device, device configuration
+ *			should not be lost
+ * @DL_HEALTH_REMEDY_REINIT: device will be reinitialized and configuration lost
+ *
+ * Used in %DEVLINK_ATTR_HEALTH_REPORTER_REMEDY, categorizes the health reporter
+ * by the severity of the remediation.
+ */
+enum devlink_health_remedy {
+	DL_HEALTH_REMEDY_NONE = 1,

+	DL_HEALTH_REMEDY_KICK,
+	DL_HEALTH_REMEDY_COMP_RESET,
+	DL_HEALTH_REMEDY_RESET,
+	DL_HEALTH_REMEDY_REINIT,
+};
+
  #endif /* _UAPI_LINUX_DEVLINK_H_ */

diff --git a/net/core/devlink.c b/net/core/devlink.c
index 8e4e4bd7bb36..09d77d43ff63 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c

@@ -6095,7 +6095,8 @@ __devlink_health_reporter_create(struct devlink *devlink,
  {
  	struct devlink_health_reporter *reporter;
  
-	if (WARN_ON(graceful_period && !ops->recover))
+	if (WARN_ON(graceful_period && !ops->recover) ||
+	    WARN_ON(ops->recover && !ops->remedy))

  		return ERR_PTR(-EINVAL);
  
  	reporter = kzalloc(sizeof(*reporter), GFP_KERNEL);

@@ -6265,6 +6266,10 @@ devlink_nl_health_reporter_fill(struct sk_buff *msg,
  	if (nla_put_string(msg, DEVLINK_ATTR_HEALTH_REPORTER_NAME,
  			   reporter->ops->name))
  		goto reporter_nest_cancel;
+	if (reporter->ops->remedy &&
+	    nla_put_u32(msg, DEVLINK_ATTR_HEALTH_REPORTER_REMEDY,
+			reporter->ops->remedy))
+		goto reporter_nest_cancel;
  	if (nla_put_u8(msg, DEVLINK_ATTR_HEALTH_REPORTER_STATE,
  		       reporter->health_state))
  		goto reporter_nest_cancel;

quoted

Extend the applicability of devlink health reporters
beyond what can be locally remedied. Add failure modes
which require re-flashing the NVM image or HW changes.

The expectation is that driver will call
devlink_health_reporter_state_update() to put hardware
health reporters into bad state.

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
  include/uapi/linux/devlink.h | 7 +++++++
  net/core/devlink.c           | 3 +--
  2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/include/uapi/linux/devlink.h b/include/uapi/linux/devlink.h
index 8cd1508b525b..f623bbc63489 100644
--- a/include/uapi/linux/devlink.h
+++ b/include/uapi/linux/devlink.h

@@ -617,10 +617,17 @@ enum devlink_port_fn_opstate {
   * @DL_HEALTH_STATE_ERROR: error state, running health reporter's recovery
   *			may fix the issue, otherwise user needs to try
   *			power cycling or other forms of reset
+ * @DL_HEALTH_STATE_BAD_IMAGE: device's non-volatile memory needs
+ *			to be re-written, usually due to block corruption
+ * @DL_HEALTH_STATE_BAD_HW: hardware errors detected, device, host
+ *			or the connection between the two may be at fault
   */
  enum devlink_health_state {
  	DL_HEALTH_STATE_HEALTHY,
  	DL_HEALTH_STATE_ERROR,
+
+	DL_HEALTH_STATE_BAD_IMAGE,
+	DL_HEALTH_STATE_BAD_HW,
  };
  
  /**

diff --git a/net/core/devlink.c b/net/core/devlink.c
index 09d77d43ff63..4a9fa6288a4a 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c

@@ -6527,8 +6527,7 @@ void
  devlink_health_reporter_state_update(struct devlink_health_reporter *reporter,
  				     enum devlink_health_state state)
  {
-	if (WARN_ON(state != DL_HEALTH_STATE_HEALTHY &&
-		    state != DL_HEALTH_STATE_ERROR))
+	if (WARN_ON(state > DL_HEALTH_STATE_BAD_HW))
  		return;
  
  	if (reporter->health_state == state)
  

devlink_health_reporter_recover() requires an update as well.
something like:

@@ -6346,8 +6346,15 @@ devlink_health_reporter_recover(struct 

devlink_health_reporter *reporter,
  {
         int err;

-   if (reporter->health_state == DL_HEALTH_STATE_HEALTHY)
+ switch (reporter->health_state) {
+ case DL_HEALTH_STATE_HEALTHY:
                 return 0;
+ case DL_HEALTH_STATE_ERROR:
+         break;
+ case DL_HEALTH_STATE_BAD_IMAGE:
+ case DL_HEALTH_STATE_BAD_HW:
+         return -EOPNOTSUPP;
+ }

         if (!reporter->ops->recover)
                 return -EOPNOTSUPP;