amd64.esc revision c7d6cfd6e2ae5d7536ef67f65110733890f370a4
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License (the "License").
* You may not use this file except in compliance with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2008 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
/*
*/
/*
* SET_ADDR and SET_OFFSET are used to set a payload value in the fault that
* we diagnose for page faults, to record the physical address of the faulting
* page.
*/
payloadprop("resource[0].hc-specific.offset")))
/*
* RESOURCE_EXISTS is true if a member with name "resource" exists in the
* payload - regardless of type (e.g., nvlist or nvlist array) or value.
*/
/*
* CONTAINS_RANK is true if the "resource" nvlist array (as used in memory
* ereports) exists and one if its members matches the path for the
* rank node. Our memory propogation are of the form
*
*
* since cpus detect memory errors; in eversholt such a propogation, where
* the lhs path and rhs path do not match, expands to the cross-product of
* all dimms, ranks and cpus on the same chip (since chip appears in the
* path on both sides). We use CONTAINS_RANK to constrain the propogation
* such that it only happens if the payload resource matches the rank.
*/
|| payloadprop_contains("resource", \
/*
* The following will tell us whether a syndrome that is known to be
* correctable (from a mem_ce ereport) is single-bit or multi-bit. For a
* correctable ChipKill syndrome the number of bits set in the lowest
* nibble indicates how many bits were in error.
*/
((synd) == 0 || \
/* #PAGE#
* #DIMM_SCU#
* A single bit fault in a memory rank can cause:
*
* - mem_ce : reported by nb
* - inf_sys_ecc1: reported by ic or dc; inf_sys_ecc1 errors detected at the
* ic do not record a syndrome; these errors will not be triggered in
* ChipKill ECC mode (the NB corrects all ECC errors in that mode)
* - s_ecc1: reported by bu; this error will not be triggered in ChipKill
* ECC mode (the NB corrects all ECC in that mode)
*
* Single-bit errors are fed into a per-rank SERD engine; if a SERD engine
* trips we diagnose a fault.memory.page so that the response agent can
* retire the page that caused the trip. If the total number of pages
* faulted in this way on a single rank exceeds a threshold we will
* diagnose a fault.memory.dimm_sb against the containing dimm.
*
* Multibit ChipKill-correctable errors are treated identically to
* single-bit errors, but via separate serd engines to allow distinct
* parameters if desired.
*
* Uncorrectable errors produce an immediate page fault and corresponding
* fault.memory.dimm_ue.
*
* Page faults are essentially internal - action is only required when
* they are accompanied by a dimm fault. As such we include message=0
* on page faults.
*/
/*
* Single-bit correctable errors feed into per-rank
* SERD engines which diagnose fault.memory.page_sb if they trip.
*
* Multi-bit correctable (via ChipKill) errors feed
* into additional per-rank SERD engines which diagnose fault.memory.page_ck
* if they trip.
*
* The number of fault.memory.page and fault.memory.page_ck diagnosed is
* counted in stat engines for each type. These are used in deciding
* whether to declare a dimm faulty after repeated page faults.
*/
N=PAGE_SB_COUNT, T=PAGE_SB_TIME;
N=PAGE_CK_COUNT, T=PAGE_CK_TIME;
N=PAGE_SB_COUNT, T=PAGE_SB_TIME;
N=PAGE_CK_COUNT, T=PAGE_CK_TIME;
/*
* The fraction of pages on a single rank that must be diagnosed as faulty
* with single correctable unit faults before we will fault the rank.
* Once we have faulted the rank we will continue to diagnose any further page
* faults on the rank up to some maximum multiple of the threshold at which
* we faulted the dimm. This allows us to potentially contain some fairly
* far-reaching but still limited-extent fault (such as a partial column
* failure) without getting carried away and allowing a single faulty rank to
* use up the entire system-imposed page retirenment limit (which, once
* reached, causes retirement request to have no effect other than to fill
* the fault manager cache and logs).
*
* This fraction is specified in basis points, where 100 basis points are
* equivalent to 1 percent. It is applied on a per-rank basis.
*
* The system imposes an absolute maximum on the number of pages it will
* retire; the current value is 10 basis points, or 0.1% of 'physmem'. Note
* that 'physmem' is reduced from installed memory pages by an amount
* reflecting permanent kernel memory allocations. This system page retire
* limit bounds the maximum real response to page faults across all ranks
* that fault manager response agents can effect, but it should not be confused
* with any diagnosis threshold (i.e., the number of faulty pages we are
* prepared to tolerate from a single rank before faulting the rank is
* distinct from the total number of pages we are prepared to retire from use
* in response to that and other faults). It is, however, desirable to
* arrange that the maximum number of pages we are prepared to fault from
* any one rank is less than the system-wide quota.
*/
/*
* A macro to manipulate the above fraction. Given a size in bytes convert
* this to pages (4K pagesize) and calculate the number of those pages
* indicated by PAGE_RETIRE_LIMIT_BPS basis points.
*/
/*
* The single-correctable-unit threshold at which number of faulted pages
* on a rank we we fault the rank. We insist that this be at least 128 and
* never more than 512.
*/
/*
* The maximum number of single-correctable-unit page faults we will diagnose
* on a single rank (must be greater than RANK_THRESH). We set
* this at twice the rank fault threshold.
*/
/*
* "Single-correctable-unit" DIMM faults are diagnosed when the total number of
* page faults (diagnosed from repeated single-bit or multibit-chipkills)
* from any one rank on that DIMM reaches a threshold. A "correctable unit"
* is a single bit in normal 64/8 ECC mode, or a single symbol in ChipKill
* 128/16 mode (i.e., nibble-aligned nibble for the code used on Opteron).
*
* We do not stop diagnosing further single-bit page faults once we have
* declared a single-bit DIMM fault - we continue diagnosing them and
* response agents can continue to retire those pages up to the system-imposed
* retirement limit.
*
* Two distinct fault types may be diagnosed - fault.memory.dimm_sb and
* fault.memory.dimm_ck. Which one is diagnosed depends on whether we
* have reached the threshold for a majority of single-bit page faults or
* multibit page faults.
*
* Implementation: we maintain parallel SERD engines to the page_sb and
* page_ck engines, which trip in unison. On trip it generates a distinct
* ereport which we diagnose to a fault if the threshold has been reached.
*/
{ CONTAINS_RANK && SINGLE_BIT_CE &&
{ CONTAINS_RANK && !SINGLE_BIT_CE &&
/*
* If the address is not valid then no resource member will be included
* in a nb.mem_ce or nb.mem_ue ereport. These cases should be rare.
* We will also discard all inf_sys_ecc1 events detected at the ic since they
* have no syndrome and therefore no resource information.
* We will discard such ereports. An alternative may be to SERD them
* on a per MC basis and trip if we see too many such events.
*/
{ !RESOURCE_EXISTS } (1)->
/* #DIMM_UE#
* #PAGE_UE#
* An uncorrectable multi-bit fault in a memory dimm can cause:
*
* - mem_ue : reported by nb for an access from a remote cpu
* - inf_sys_eccm : reported by ic or dc; the ic does not report a syndrome
* - s_eccm : reported by bu
*
* Since on production systems we force HT Sync Flood on uncorrectable
* memory errors (if not already set as such by the BIOS, as it should be)
* we won't actually receive these ereports since the system will be reset.
*/
response=0;
{ CONTAINS_RANK } (1)->
{ !RESOURCE_EXISTS } (1)->
/* #CSTESTFAIL#
* If the BIOS fails a chip-select during POST, or perhaps after a
* sync flood from an uncorrectable error, then on revision F and G it
* should mark that chip-select as TestFail in the CS Base register.
* When the memory-controller driver discovers all the MC configuration
* it notes such failed chip-selects and creates topology nodes for the
* chip-select and associated dimms and ranks, and produces an ereport for each
* failed chip-select with detector set to the memory-controller node
* and resource indicating the failed chip-select.
*/
{ CONTAINS_CS };
/* #ADDRPAR#
*
* - dramaddr_par : reported by the nb; the NB status register includes
* a bit indicating which dram controller channel (A or B) experienced
* the error.
*/
/* #L2D_SINGLE#
* A single bit data array fault in an l2 cache can cause:
*
* - inf_l2_ecc1 : reported by ic on this cpu
* - inf_l2_ecc1 : reported by dc on this cpu
* - l2d_ecc1 : reported by bu on copyback or on snoop from another cpu
*/
/* #L2D_MULTI#
* A multi-bit data array fault in an l2 cache can cause:
*
* - inf_l2_eccm : reported by ic on this cpu
* - inf_l2_eccm : reported by dc on this cpu
* - l2d_eccm : reported by bu on copyback or on snoop from another cpu
*/
/* #L2T_SINGLE#
* A single bit tag array fault in an l2 cache can cause:
*
* - l2t_ecc1 : reported by bu on this cpu when detected during snoop
* - l2t_par : reported by bu on this cpu when detected other than during snoop
*/
/* #L2T_MULTI#
* A multi-bit tag array fault in an l2 cache can cause:
*
* - l2t_eccm : reported by bu on this cpu when detected during snoop
* - l2t_par : reported by bu on this cpu when detected other than during snoop
*/
/* #ICD_PAR#
* A data array parity fault in an I cache can cause:
*
* - data_par : reported by ic on this cpu
*/
/* #ICT_PAR#
* A tag array parity fault in an I cache can cause:
*
* - tag_par : reported by ic on this cpu
*/
/* #ICT_SNOOP#
* A snoop tag array parity fault in an I cache can cause:
*
* - stag_par : reported by ic on this cpu
*/
/* #ICTLB_1#
* An l1tlb parity fault in an I cache can cause:
*
* - l1tlb_par : reported by ic on this cpu
*/
/* #ICTLB_2#
* An l2tlb parity fault in an I cache can cause:
*
* - l2tlb_par : reported by ic on this cpu
*/
/* #DCD_SINGLE#
* A single bit data array fault in an D cache can cause:
*
* - data_ecc1 : reported by dc on this cpu by scrubber
* - data_ecc1_uc : reported by dc on this cpu other than by scrubber
*
* Make data_ecc1_uc fault immediately as it may have caused a panic, so
* it is handled by the multi-bit case in the following section.
*/
/* #DCD_MULTI#
* A multi-bit data array fault in an D cache can cause:
*
* - data_eccm : reported by dc on this cpu
*/
/* #DCT_PAR#
* A tag array parity fault in an D cache can cause:
*
* - tag_par : reported by dc on this cpu
*/
/* #DCT_SNOOP#
* A snoop tag array parity fault in an D cache can cause:
*
* - stag_par : reported by dc on this cpu
*/
/* #DCTLB_1#
* An l1tlb parity fault in an D cache can cause:
*
* - l1tlb_par : reported by dc on this cpu
*/
/* #DCTLB_2#
* An l2tlb parity fault in an D cache can cause:
*
* - l2tlb_par : reported by dc on this cpu
*/
/* #MISC#
* Ereports that should not normally happen and which we will discard
* without diagnosis if they do. These fall into a few categories:
*
* - the corresponding detector is not enabled, typically because
* (nb.ma, nb.ta, ls.rde, ic.rdde, bu.s_rde, nb.gart_walk)
* - the event is associated with a sync flood so even if the detector is
* enabled we will never handle the event and generate an ereport *and*
* even if the ereport did arrive we could perform no useful diagnosis
* e.g., the NB can be configured for sync flood on nb.mem_eccm
* but we don't choose to discard that ereport here since we could have
* made a useful diagnosis from it had it been delivered
* (nb.ht_sync, nb.ht_crc)
* - events that will be accompanied by an immediate panic and
* delivery of the ereport during subsequent reboot but from
* which no useful diagnosis can be made. (nb.rmw, nb.wdog)
*
* Ereports for all of these can be generated by error simulation and
* injection. We will perform a null diagnosos of all these ereports in order
* to avoid "no subscription" complaints during test harness runs.
*/