[PATCH v1 0/2] virtio: PCI ERS permanent failure teardown for virtio-blk

[PATCH v1 0/2] virtio: PCI ERS permanent failure teardown for virtio-blk

[Xixin Liu]

Hi,

This series adds proper PCI AER error recovery handling for virtio-pci and
completes virtio-blk teardown when ERS reports pci_channel_io_perm_failure.

virtio-pci only registered reset_prepare/reset_done.  The recovery core
treats devices without error_detected as NO_AER_DRIVER and does not
deliver perm_failure to the driver after a failed recovery.  When bus
reset fails (reproduced on QEMU with DLLLA not set within 100 ms after
secondary bus reset), virtio-blk disks stay live even though virtqueues
may already have been torn down during the frozen phase.

Patch 1 registers error_detected (frozen quiesce + perm_failure notify).
Patch 2 calls the virtio driver shutdown hook from virtio-pci on
perm_failure, implements virtio-blk shutdown with blk_mark_disk_dead(),
and fail-fast guards in virtio_queue_rq.

Thanks,
Xixin Liu

---

Xixin Liu (2):
  virtio-pci: add error_detected for PCI AER recovery
  virtio-blk: mark disk dead on ERS permanent failure

 drivers/block/virtio_blk.c         | 39 +++++++++++++++++++++++++++++++
 drivers/virtio/virtio_pci_common.c | 47 ++++++++++++++++++++++++++++++++++
 2 files changed, 85 insertions(+)

-- 
2.43.0

[PATCH v1 1/2] virtio-pci: add error_detected for PCI AER recovery

[Xixin Liu]

virtio-pci only registered reset_prepare/reset_done.  The PCI error
recovery core treats devices without error_detected as NO_AER_DRIVER and
does not deliver pci_channel_io_perm_failure to the driver after a failed
recovery.  Virtio devices therefore miss the normal ERS quiesce/teardown
sequence.

Register error_detected: quiesce on frozen (reset_prepare) before bus
reset; on perm_failure break virtqueues and return DISCONNECT.  Block-layer
cleanup for virtio-blk is handled in the follow-up patch.

Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
---
 drivers/virtio/virtio_pci_common.c | 30 +++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index 164f480b18a6..e2dda946e70e 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -828,7 +828,37 @@ static void virtio_pci_reset_done(struct pci_dev *pci_dev)
 		dev_warn(&pci_dev->dev, "Reset done failure: %d", ret);
 }
 
+static pci_ers_result_t virtio_pci_error_detected(struct pci_dev *pci_dev,
+						  pci_channel_state_t state)
+{
+	struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev);
+
+	/*
+	 * PCI ERS error_detected: quiesce on frozen before bus reset; on
+	 * permanent failure ask the virtio driver to shut down (virtio-blk
+	 * marks the disk dead in its .shutdown handler).
+	 */
+	switch (state) {
+	case pci_channel_io_normal:
+		return PCI_ERS_RESULT_CAN_RECOVER;
+	case pci_channel_io_frozen:
+		pci_info(pci_dev, "frozen error detected, quiesce device\n");
+		if (virtio_device_reset_prepare(&vp_dev->vdev))
+			dev_warn(&pci_dev->dev, "frozen: reset prepare failed\n");
+		return PCI_ERS_RESULT_NEED_RESET;
+	case pci_channel_io_perm_failure:
+		dev_warn(&pci_dev->dev,
+			 "permanent failure, disconnecting device\n");
+		virtio_break_device(&vp_dev->vdev);
+		return PCI_ERS_RESULT_DISCONNECT;
+	default:
+		break;
+	}
+	return PCI_ERS_RESULT_NEED_RESET;
+}
+
 static const struct pci_error_handlers virtio_pci_err_handler = {
+	.error_detected = virtio_pci_error_detected,
 	.reset_prepare  = virtio_pci_reset_prepare,
 	.reset_done     = virtio_pci_reset_done,
 };

[PATCH v1 2/2] virtio-blk: mark disk dead on ERS permanent failure

[Xixin Liu]

After ERS reports pci_channel_io_perm_failure, virtio-pci must ask the
virtio driver to tear down the block device — not only mark virtqueues
broken.  Call the virtio driver shutdown hook from virtio-pci on
perm_failure; virtio-blk implements shutdown with blk_mark_disk_dead().
Fail new requests early in virtio_queue_rq when the disk is dead or
virtqueues were removed during frozen reset_prepare.

Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
---
 drivers/block/virtio_blk.c         | 39 +++++++++++++++++++++++++++++++++++++++
 drivers/virtio/virtio_pci_common.c | 10 +++++++++-
 2 files changed, 48 insertions(+), 1 deletion(-)

diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 32bf3ba07a9d..4740ae91d5be 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -435,6 +435,12 @@ static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx,
 	blk_status_t status;
 	int err;
 
+	/* Fail fast if ERS frozen tore down VQs or the disk was marked dead. */
+	if (unlikely(!disk_live(vblk->disk) || !vblk->vqs || !vblk->vdev)) {
+		blk_mq_start_request(req);
+		return BLK_STS_IOERR;
+	}
+
 	status = virtblk_prep_rq(hctx, vblk, req, vbr);
 	if (unlikely(status))
 		return status;
@@ -1561,6 +1567,29 @@ static int virtblk_probe(struct virtio_device *vdev)
 	return err;
 }
 
+/* Stop I/O and mark the gendisk dead (ERS perm_failure or system shutdown). */
+static void virtblk_shutdown(struct virtio_device *vdev)
+{
+	struct virtio_blk *vblk = vdev->priv;
+	struct request_queue *q;
+	unsigned int memflags;
+
+	if (!vblk || !vblk->disk)
+		return;
+
+	flush_work(&vblk->config_work);
+	virtio_break_device(vdev);
+
+	q = vblk->disk->queue;
+	memflags = blk_mq_freeze_queue(q);
+	blk_mq_quiesce_queue_nowait(q);
+
+	blk_mark_disk_dead(vblk->disk);
+
+	blk_mq_unquiesce_queue(q);
+	blk_mq_unfreeze_queue(q, memflags);
+}
+
 static void virtblk_remove(struct virtio_device *vdev)
 {
 	struct virtio_blk *vblk = vdev->priv;
@@ -1684,6 +1713,7 @@ static struct virtio_driver virtio_blk = {
 	.probe				= virtblk_probe,
 	.remove				= virtblk_remove,
 	.config_changed			= virtblk_config_changed,
+	.shutdown			= virtblk_shutdown,
 #ifdef CONFIG_PM_SLEEP
 	.freeze				= virtblk_freeze,
 	.restore			= virtblk_restore,
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index e2dda946e70e..924ceead436b 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -845,7 +845,15 @@ static pci_ers_result_t virtio_pci_error_detected(struct pci_dev *pci_dev,
 	case pci_channel_io_perm_failure:
 		dev_warn(&pci_dev->dev,
 			 "permanent failure, disconnecting device\n");
-		virtio_break_device(&vp_dev->vdev);
+		{
+			struct virtio_driver *drv =
+				drv_to_virtio(vp_dev->vdev.dev.driver);
+
+			if (drv && drv->shutdown)
+				drv->shutdown(&vp_dev->vdev);
+			else
+				virtio_break_device(&vp_dev->vdev);
+		}
 		return PCI_ERS_RESULT_DISCONNECT;
 	default:
 		break;

Re: [PATCH v1 2/2] virtio-blk: mark disk dead on ERS permanent failure

[Michael S. Tsirkin]

On Fri, Jun 12, 2026 at 06:00:00PM +0800, Xixin Liu wrote:
> After ERS reports pci_channel_io_perm_failure, virtio-pci must ask the
> virtio driver to tear down the block device — not only mark virtqueues
> broken.

Can you tell me was this written with use of AI? I ask because not many
people go out of their way to put in unicode dashes. Next step is what
emojis? Let's not go there pls.
And if yes pls disclose that as per Documentation.

>  Call the virtio driver shutdown hook from virtio-pci on
> perm_failure; virtio-blk implements shutdown with blk_mark_disk_dead().
> Fail new requests early in virtio_queue_rq when the disk is dead or
> virtqueues were removed during frozen reset_prepare.
> 
> Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
> ---
>  drivers/block/virtio_blk.c         | 39 +++++++++++++++++++++++++++++++++++++++
>  drivers/virtio/virtio_pci_common.c | 10 +++++++++-
>  2 files changed, 48 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
> index 32bf3ba07a9d..4740ae91d5be 100644
> --- a/drivers/block/virtio_blk.c
> +++ b/drivers/block/virtio_blk.c
> @@ -435,6 +435,12 @@ static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx,
>  	blk_status_t status;
>  	int err;
>  
> +	/* Fail fast if ERS frozen tore down VQs or the disk was marked dead. */
> +	if (unlikely(!disk_live(vblk->disk) || !vblk->vqs || !vblk->vdev)) {
> +		blk_mq_start_request(req);
> +		return BLK_STS_IOERR;
> +	}
> +

Do we need this? virtqueue add will fail anyway.

>  	status = virtblk_prep_rq(hctx, vblk, req, vbr);
>  	if (unlikely(status))
>  		return status;
> @@ -1561,6 +1567,29 @@ static int virtblk_probe(struct virtio_device *vdev)
>  	return err;
>  }
>  
> +/* Stop I/O and mark the gendisk dead (ERS perm_failure or system shutdown). */
> +static void virtblk_shutdown(struct virtio_device *vdev)
> +{
> +	struct virtio_blk *vblk = vdev->priv;
> +	struct request_queue *q;
> +	unsigned int memflags;
> +
> +	if (!vblk || !vblk->disk)
> +		return;
> +
> +	flush_work(&vblk->config_work);
> +	virtio_break_device(vdev);

why not break first?

> +	q = vblk->disk->queue;
> +	memflags = blk_mq_freeze_queue(q);
> +	blk_mq_quiesce_queue_nowait(q);
> +
> +	blk_mark_disk_dead(vblk->disk);
> +
> +	blk_mq_unquiesce_queue(q);
> +	blk_mq_unfreeze_queue(q, memflags);
> +}
> +
>  static void virtblk_remove(struct virtio_device *vdev)
>  {
>  	struct virtio_blk *vblk = vdev->priv;
> @@ -1684,6 +1713,7 @@ static struct virtio_driver virtio_blk = {
>  	.probe				= virtblk_probe,
>  	.remove				= virtblk_remove,
>  	.config_changed			= virtblk_config_changed,
> +	.shutdown			= virtblk_shutdown,
>  #ifdef CONFIG_PM_SLEEP
>  	.freeze				= virtblk_freeze,
>  	.restore			= virtblk_restore,
> diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
> index e2dda946e70e..924ceead436b 100644
> --- a/drivers/virtio/virtio_pci_common.c
> +++ b/drivers/virtio/virtio_pci_common.c
> @@ -845,7 +845,15 @@ static pci_ers_result_t virtio_pci_error_detected(struct pci_dev *pci_dev,
>  	case pci_channel_io_perm_failure:
>  		dev_warn(&pci_dev->dev,
>  			 "permanent failure, disconnecting device\n");
> -		virtio_break_device(&vp_dev->vdev);
> +		{
> +			struct virtio_driver *drv =
> +				drv_to_virtio(vp_dev->vdev.dev.driver);
> +
> +			if (drv && drv->shutdown)
> +				drv->shutdown(&vp_dev->vdev);
> +			else
> +				virtio_break_device(&vp_dev->vdev);
> +		}
>  		return PCI_ERS_RESULT_DISCONNECT;
>  	default:
>  		break;

Re: [PATCH v1 2/2] virtio-blk: mark disk dead on ERS permanent failure

[Xixin Liu]

Hi,

On Thu, 30 Jul 2026, Michael S. Tsirkin wrote:
> Can you tell me was this written with use of AI? I ask because not many
> people go out of their way to put in unicode dashes. Next step is what
> emojis? Let's not go there pls.
> And if yes pls disclose that as per Documentation.

Yes. I will add Assisted-by for the LLM help in v2.

> Do we need this? virtqueue add will fail anyway.

For a broken vq, yes, virtqueue_add already fails. The useful part is
the !vblk->vqs check: after reset_prepare/freeze_priv the vqs pointer
can be NULL, and virtio_queue_rq would deref it before add. v2 drops
disk_live() and keeps only the NULL guards.

> why not break first?

Agreed. v2 calls virtio_break_device() before flush_work().

Thanks,
Xixin

Re: [PATCH v1 0/2] virtio: PCI ERS permanent failure teardown for virtio-blk

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 1472 bytes --]

On Mon, Jun 15, 2026 at 10:00:00AM +0800, Xixin Liu wrote:
> Hi,
> 
> This series adds proper PCI AER error recovery handling for virtio-pci and
> completes virtio-blk teardown when ERS reports pci_channel_io_perm_failure.

CCing Parav because he previously looked at surprise removal:
https://lore.kernel.org/virtualization/20250822091706.21170-1-parav@nvidia.com/

> 
> virtio-pci only registered reset_prepare/reset_done.  The recovery core
> treats devices without error_detected as NO_AER_DRIVER and does not
> deliver perm_failure to the driver after a failed recovery.  When bus
> reset fails (reproduced on QEMU with DLLLA not set within 100 ms after
> secondary bus reset), virtio-blk disks stay live even though virtqueues
> may already have been torn down during the frozen phase.
> 
> Patch 1 registers error_detected (frozen quiesce + perm_failure notify).
> Patch 2 calls the virtio driver shutdown hook from virtio-pci on
> perm_failure, implements virtio-blk shutdown with blk_mark_disk_dead(),
> and fail-fast guards in virtio_queue_rq.
> 
> Thanks,
> Xixin Liu
> 
> ---
> 
> Xixin Liu (2):
>   virtio-pci: add error_detected for PCI AER recovery
>   virtio-blk: mark disk dead on ERS permanent failure
> 
>  drivers/block/virtio_blk.c         | 39 +++++++++++++++++++++++++++++++
>  drivers/virtio/virtio_pci_common.c | 47 ++++++++++++++++++++++++++++++++++
>  2 files changed, 85 insertions(+)
> 
> -- 
> 2.43.0
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[PATCH v2 0/2] virtio: PCI ERS permanent failure teardown for virtio-blk

[Xixin Liu]

Hi,

This series adds PCI AER error_detected for virtio-pci and completes
virtio-blk teardown when ERS reports pci_channel_io_perm_failure.

virtio-pci only registered reset_prepare/reset_done.  The recovery core
treats devices without error_detected as NO_AER_DRIVER and does not
deliver perm_failure to the driver after a failed recovery.  When bus
reset fails (reproduced on QEMU with DLLLA not set within 100 ms after
secondary bus reset), virtio-blk disks stay live even though virtqueues
may already have been torn down during the frozen phase.

Patch 1 registers error_detected (frozen quiesce + perm_failure notify).
Patch 2 calls the virtio driver shutdown hook from virtio-pci on
perm_failure and implements virtio-blk shutdown with blk_mark_disk_dead().

Changes since v1 (thanks for the review on v1):
- Disclose LLM help on the commit message (Assisted-by); ASCII only
- virtblk_shutdown: virtio_break_device() before flush_work()
- virtio_queue_rq: drop disk_live(); keep NULL vqs/vdev guards only
  (broken vq already fails in virtqueue_add)

Based on linux-next next-20260730.

Thanks,
Xixin Liu
---
Xixin Liu (2):
  virtio-pci: add error_detected for PCI AER recovery
  virtio-blk: mark disk dead on ERS permanent failure

 drivers/block/virtio_blk.c         | 31 ++++++++++++++++++++++++
 drivers/virtio/virtio_pci_common.c | 38 ++++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+)

-- 
2.43.0

[PATCH v2 1/2] virtio-pci: add error_detected for PCI AER recovery

[Xixin Liu]

virtio-pci only registered reset_prepare/reset_done.  The PCI error
recovery core treats devices without error_detected as NO_AER_DRIVER and
does not deliver pci_channel_io_perm_failure to the driver after a failed
recovery.  Virtio devices therefore miss the normal ERS quiesce/teardown
sequence.

Register error_detected: quiesce on frozen (reset_prepare) before bus
reset; on perm_failure break virtqueues and return DISCONNECT.  Block-layer
cleanup for virtio-blk is handled in the follow-up patch.

Assisted-by: DeepSeek:deepseek-v3
Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
---
 drivers/virtio/virtio_pci_common.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index 164f480b18a6..fff6b6e2d0c5 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -828,7 +828,37 @@ static void virtio_pci_reset_done(struct pci_dev *pci_dev)
 		dev_warn(&pci_dev->dev, "Reset done failure: %d", ret);
 }
 
+static pci_ers_result_t virtio_pci_error_detected(struct pci_dev *pci_dev,
+						  pci_channel_state_t state)
+{
+	struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev);
+
+	/*
+	 * PCI ERS error_detected: quiesce on frozen before bus reset; on
+	 * permanent failure break virtqueues (follow-up may call driver
+	 * .shutdown for block teardown).
+	 */
+	switch (state) {
+	case pci_channel_io_normal:
+		return PCI_ERS_RESULT_CAN_RECOVER;
+	case pci_channel_io_frozen:
+		pci_info(pci_dev, "frozen error detected, quiesce device\n");
+		if (virtio_device_reset_prepare(&vp_dev->vdev))
+			dev_warn(&pci_dev->dev, "frozen: reset prepare failed\n");
+		return PCI_ERS_RESULT_NEED_RESET;
+	case pci_channel_io_perm_failure:
+		dev_warn(&pci_dev->dev,
+			 "permanent failure, disconnecting device\n");
+		virtio_break_device(&vp_dev->vdev);
+		return PCI_ERS_RESULT_DISCONNECT;
+	default:
+		break;
+	}
+	return PCI_ERS_RESULT_NEED_RESET;
+}
+
 static const struct pci_error_handlers virtio_pci_err_handler = {
+	.error_detected = virtio_pci_error_detected,
 	.reset_prepare  = virtio_pci_reset_prepare,
 	.reset_done     = virtio_pci_reset_done,
 };
-- 
2.43.0

Re: [PATCH v2 1/2] virtio-pci: add error_detected for PCI AER recovery

[Michael S. Tsirkin]

On Fri, Jul 31, 2026 at 11:17:00AM +0800, Xixin Liu wrote:
> virtio-pci only registered reset_prepare/reset_done.  The PCI error
> recovery core treats devices without error_detected as NO_AER_DRIVER and
> does not deliver pci_channel_io_perm_failure to the driver after a failed
> recovery.

Maybe it should?

> Virtio devices therefore miss the normal ERS quiesce/teardown
> sequence.
> 
> Register error_detected: quiesce on frozen (reset_prepare) before bus
> reset; on perm_failure break virtqueues and return DISCONNECT.  Block-layer
> cleanup for virtio-blk is handled in the follow-up patch.
> 
> Assisted-by: DeepSeek:deepseek-v3
> Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
> ---
>  drivers/virtio/virtio_pci_common.c | 30 ++++++++++++++++++++++++++++++
>  1 file changed, 30 insertions(+)
> 
> diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
> index 164f480b18a6..fff6b6e2d0c5 100644
> --- a/drivers/virtio/virtio_pci_common.c
> +++ b/drivers/virtio/virtio_pci_common.c
> @@ -828,7 +828,37 @@ static void virtio_pci_reset_done(struct pci_dev *pci_dev)
>  		dev_warn(&pci_dev->dev, "Reset done failure: %d", ret);
>  }
>  
> +static pci_ers_result_t virtio_pci_error_detected(struct pci_dev *pci_dev,
> +						  pci_channel_state_t state)
> +{
> +	struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev);
> +
> +	/*
> +	 * PCI ERS error_detected: quiesce on frozen before bus reset; on
> +	 * permanent failure break virtqueues (follow-up may call driver
> +	 * .shutdown for block teardown).

block specifically? this is common code.

> +	 */
> +	switch (state) {
> +	case pci_channel_io_normal:
> +		return PCI_ERS_RESULT_CAN_RECOVER;
> +	case pci_channel_io_frozen:
> +		pci_info(pci_dev, "frozen error detected, quiesce device\n");
> +		if (virtio_device_reset_prepare(&vp_dev->vdev))
> +			dev_warn(&pci_dev->dev, "frozen: reset prepare failed\n");
> +		return PCI_ERS_RESULT_NEED_RESET;

so I guess pci will do slot reset? but what will call driver reset later? confused.


> +	case pci_channel_io_perm_failure:
> +		dev_warn(&pci_dev->dev,
> +			 "permanent failure, disconnecting device\n");
> +		virtio_break_device(&vp_dev->vdev);
> +		return PCI_ERS_RESULT_DISCONNECT;
> +	default:
> +		break;
> +	}
> +	return PCI_ERS_RESULT_NEED_RESET;

here, too, and we didn't virtio_device_reset_prepare either.

> +}
> +
>  static const struct pci_error_handlers virtio_pci_err_handler = {
> +	.error_detected = virtio_pci_error_detected,
>  	.reset_prepare  = virtio_pci_reset_prepare,
>  	.reset_done     = virtio_pci_reset_done,
>  };
> -- 
> 2.43.0

Re: [PATCH v2 1/2] virtio-pci: add error_detected for PCI AER recovery

[Xixin Liu]

Hi Michael,

Thanks for the review.  I will post a v3 with the following.

On Sun, Aug 02, 2026 at 05:10:21PM -0400, Michael S. Tsirkin wrote:
> On Fri, Jul 31, 2026 at 11:17:00AM +0800, Xixin Liu wrote:
> > virtio-pci only registered reset_prepare/reset_done.  The PCI error
> > recovery core treats devices without error_detected as NO_AER_DRIVER and
> > does not deliver pci_channel_io_perm_failure to the driver after a failed
> > recovery.
>
> Maybe it should?

Agreed that the current PCI core behaviour is awkward for drivers that
only wire reset_prepare/reset_done.

Without .error_detected the recovery core votes NO_AER_DRIVER on the
first broadcast, and report_perm_failure_detected skips the driver
callback whenever overall status is not RECOVERED.  That skip covers
NO_AER_DRIVER even when subordinate reset succeeded.  uevent DISCONNECT
is still emitted.

Changing the core would be a PCI-wide policy change.  This series
registers .error_detected and joins the existing ERS contract the same
way other ERS-aware drivers do.  Happy to follow up on the PCI side if
that is preferred.

> > +	 * permanent failure break virtqueues (follow-up may call driver
> > +	 * .shutdown for block teardown).
>
> block specifically? this is common code.

Right, that wording was wrong for virtio-pci.  On perm_failure the
common path only calls virtio_break_device() and returns DISCONNECT.
Same for every virtio device.

> > +		return PCI_ERS_RESULT_NEED_RESET;
>
> so I guess pci will do slot reset? but what will call driver reset
> later? confused.

NEED_RESET asks for a PCI bus or slot reset.  On AER that is
aer_root_reset() then pci_bus_error_reset().  That path does not call
.reset_prepare or .reset_done; those hooks still serve FLR.  Driver
restore after a successful reset is .slot_reset.  v3 adds that hook and
it restores config then calls virtio_device_reset_done().  Quiesce stays
in error_detected on frozen via virtio_device_reset_prepare().  If the
PCI reset fails, .slot_reset is skipped and perm_failure only breaks
the device.

> > +	default:
> > +		break;
> > +	}
> > +	return PCI_ERS_RESULT_NEED_RESET;
>
> here, too, and we didn't virtio_device_reset_prepare either.

Right.  pci_channel_state_t today is only normal, frozen, and
perm_failure.  In v3 frozen and default share one path: quiesce via
virtio_device_reset_prepare(), then NEED_RESET.

Thanks,
Xixin

[PATCH v2 2/2] virtio-blk: mark disk dead on ERS permanent failure

[Xixin Liu]

After ERS reports pci_channel_io_perm_failure, virtio-pci must ask the
virtio driver to tear down the block device, not only mark virtqueues
broken.  Call the virtio driver shutdown hook from virtio-pci on
perm_failure; virtio-blk implements shutdown with blk_mark_disk_dead().

Fail new requests early in virtio_queue_rq when virtqueues were removed
during frozen reset_prepare (vqs == NULL).  A broken vq already fails in
virtqueue_add; no separate disk_live() check is needed.

Assisted-by: DeepSeek:deepseek-v3
Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
---
 drivers/block/virtio_blk.c         | 31 ++++++++++++++++++++++++++++++
 drivers/virtio/virtio_pci_common.c | 10 +++++++++-
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 32bf3ba07a9d..fda2d4f3c7c6 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -435,6 +435,12 @@ static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx,
 	blk_status_t status;
 	int err;
 
+	/* VQs may be gone after frozen reset_prepare; avoid NULL deref. */
+	if (unlikely(!vblk->vqs || !vblk->vdev)) {
+		blk_mq_start_request(req);
+		return BLK_STS_IOERR;
+	}
+
 	status = virtblk_prep_rq(hctx, vblk, req, vbr);
 	if (unlikely(status))
 		return status;
@@ -1561,6 +1567,30 @@ static int virtblk_probe(struct virtio_device *vdev)
 	return err;
 }
 
+
+/* Stop I/O and mark the gendisk dead (ERS perm_failure or system shutdown). */
+static void virtblk_shutdown(struct virtio_device *vdev)
+{
+	struct virtio_blk *vblk = vdev->priv;
+	struct request_queue *q;
+	unsigned int memflags;
+
+	if (!vblk || !vblk->disk)
+		return;
+
+	virtio_break_device(vdev);
+	flush_work(&vblk->config_work);
+
+	q = vblk->disk->queue;
+	memflags = blk_mq_freeze_queue(q);
+	blk_mq_quiesce_queue_nowait(q);
+
+	blk_mark_disk_dead(vblk->disk);
+
+	blk_mq_unquiesce_queue(q);
+	blk_mq_unfreeze_queue(q, memflags);
+}
+
 static void virtblk_remove(struct virtio_device *vdev)
 {
 	struct virtio_blk *vblk = vdev->priv;
@@ -1684,6 +1714,7 @@ static struct virtio_driver virtio_blk = {
 	.probe				= virtblk_probe,
 	.remove				= virtblk_remove,
 	.config_changed			= virtblk_config_changed,
+	.shutdown			= virtblk_shutdown,
 #ifdef CONFIG_PM_SLEEP
 	.freeze				= virtblk_freeze,
 	.restore			= virtblk_restore,
diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index fff6b6e2d0c5..957b3282865c 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -849,7 +849,15 @@ static pci_ers_result_t virtio_pci_error_detected(struct pci_dev *pci_dev,
 	case pci_channel_io_perm_failure:
 		dev_warn(&pci_dev->dev,
 			 "permanent failure, disconnecting device\n");
-		virtio_break_device(&vp_dev->vdev);
+		{
+			struct virtio_driver *drv =
+				drv_to_virtio(vp_dev->vdev.dev.driver);
+
+			if (drv && drv->shutdown)
+				drv->shutdown(&vp_dev->vdev);
+			else
+				virtio_break_device(&vp_dev->vdev);
+		}
 		return PCI_ERS_RESULT_DISCONNECT;
 	default:
 		break;
-- 
2.43.0

Re: [PATCH v2 2/2] virtio-blk: mark disk dead on ERS permanent failure

[Michael S. Tsirkin]

On Fri, Jul 31, 2026 at 11:19:00AM +0800, Xixin Liu wrote:
> After ERS reports pci_channel_io_perm_failure, virtio-pci must ask the
> virtio driver to tear down the block device, not only mark virtqueues
> broken.  Call the virtio driver shutdown hook from virtio-pci on
> perm_failure; virtio-blk implements shutdown with blk_mark_disk_dead().
> 
> Fail new requests early in virtio_queue_rq when virtqueues were removed
> during frozen reset_prepare (vqs == NULL).  A broken vq already fails in
> virtqueue_add; no separate disk_live() check is needed.
> 
> Assisted-by: DeepSeek:deepseek-v3
> Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
> ---
>  drivers/block/virtio_blk.c         | 31 ++++++++++++++++++++++++++++++
>  drivers/virtio/virtio_pci_common.c | 10 +++++++++-
>  2 files changed, 40 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
> index 32bf3ba07a9d..fda2d4f3c7c6 100644
> --- a/drivers/block/virtio_blk.c
> +++ b/drivers/block/virtio_blk.c
> @@ -435,6 +435,12 @@ static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx,
>  	blk_status_t status;
>  	int err;
>  
> +	/* VQs may be gone after frozen reset_prepare; avoid NULL deref. */
> +	if (unlikely(!vblk->vqs || !vblk->vdev)) {
> +		blk_mq_start_request(req);
> +		return BLK_STS_IOERR;
> +	}
> +
>  	status = virtblk_prep_rq(hctx, vblk, req, vbr);
>  	if (unlikely(status))
>  		return status;
> @@ -1561,6 +1567,30 @@ static int virtblk_probe(struct virtio_device *vdev)
>  	return err;
>  }
>  
> +
> +/* Stop I/O and mark the gendisk dead (ERS perm_failure or system shutdown). */
> +static void virtblk_shutdown(struct virtio_device *vdev)
> +{
> +	struct virtio_blk *vblk = vdev->priv;
> +	struct request_queue *q;
> +	unsigned int memflags;
> +
> +	if (!vblk || !vblk->disk)
> +		return;
> +
> +	virtio_break_device(vdev);
> +	flush_work(&vblk->config_work);
> +
> +	q = vblk->disk->queue;
> +	memflags = blk_mq_freeze_queue(q);
> +	blk_mq_quiesce_queue_nowait(q);
> +
> +	blk_mark_disk_dead(vblk->disk);
> +
> +	blk_mq_unquiesce_queue(q);
> +	blk_mq_unfreeze_queue(q, memflags);
> +}
> +
>  static void virtblk_remove(struct virtio_device *vdev)
>  {
>  	struct virtio_blk *vblk = vdev->priv;

what happens with requests already outstanding in the queues?
e.g. does this leak memory?

> @@ -1684,6 +1714,7 @@ static struct virtio_driver virtio_blk = {
>  	.probe				= virtblk_probe,
>  	.remove				= virtblk_remove,
>  	.config_changed			= virtblk_config_changed,
> +	.shutdown			= virtblk_shutdown,
>  #ifdef CONFIG_PM_SLEEP
>  	.freeze				= virtblk_freeze,
>  	.restore			= virtblk_restore,
> diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
> index fff6b6e2d0c5..957b3282865c 100644
> --- a/drivers/virtio/virtio_pci_common.c
> +++ b/drivers/virtio/virtio_pci_common.c
> @@ -849,7 +849,15 @@ static pci_ers_result_t virtio_pci_error_detected(struct pci_dev *pci_dev,
>  	case pci_channel_io_perm_failure:
>  		dev_warn(&pci_dev->dev,
>  			 "permanent failure, disconnecting device\n");
> -		virtio_break_device(&vp_dev->vdev);
> +		{
> +			struct virtio_driver *drv =
> +				drv_to_virtio(vp_dev->vdev.dev.driver);
> +
> +			if (drv && drv->shutdown)
> +				drv->shutdown(&vp_dev->vdev);
> +			else
> +				virtio_break_device(&vp_dev->vdev);
> +		}
>  		return PCI_ERS_RESULT_DISCONNECT;

So this is blk specifically, I am somewhat lost as to why
is blk treated differently from other drivers here.


>  	default:
>  		break;
> -- 
> 2.43.0

Re: [PATCH v2 2/2] virtio-blk: mark disk dead on ERS permanent failure

[Xixin Liu]

Hi Michael,

Thanks for the review.  I will post a v3 with the following.

On Sun, Aug 02, 2026 at 04:59:08PM -0400, Michael S. Tsirkin wrote:
> what happens with requests already outstanding in the queues?
> e.g. does this leak memory?

virtio_driver.shutdown runs on system shutdown via virtio_dev_shutdown.
It calls blk_mq_freeze_queue() first: every in-flight request holds a
q_usage_counter reference until virtblk_done frees it, so freeze
returns only after those completions have reclaimed the request PDU
and any chained sg.  Only then does it virtio_break_device() and
blk_mark_disk_dead().  Break must come after freeze; after break,
vring callbacks no longer run.

> So this is blk specifically, I am somewhat lost as to why
> is blk treated differently from other drivers here.

virtio-blk owns the gendisk and request_queue itself, so block
teardown and queue lifetime sit in virtio-blk, not in virtio-pci
common code.

In v3, AER perm_failure stays common for every virtio device:
virtio_break_device() and DISCONNECT only.  Patch 2 keeps the
blk-side pieces in virtio-blk: system-shutdown .shutdown does freeze,
break, and mark_disk_dead, plus the queue_rq guard after frozen
del_vqs.  Neither is wired from AER.

Thanks,
Xixin

[PATCH v3 0/2] virtio: PCI AER error_detected and virtio-blk shutdown

[Xixin Liu]

Hi,

This series fills in missing PCI AER callbacks on virtio-pci, and adds
matching virtio-blk pieces for queue_rq after VQ removal plus
system-shutdown teardown.

virtio-pci only registered reset_prepare/reset_done.  Without
.error_detected the recovery core votes NO_AER_DRIVER on the first
broadcast, and report_perm_failure_detected skips the driver callback
whenever overall status is not RECOVERED.  Patch 1 registers
.error_detected and .slot_reset: frozen/unknown call
virtio_device_reset_prepare() then NEED_RESET; after a successful PCI
reset, slot_reset restores config and calls virtio_device_reset_done();
perm_failure only virtio_break_device() and DISCONNECT.  AER bus reset
via pci_bus_error_reset does not invoke .reset_prepare, so quiesce and
restore for that path live in error_detected and slot_reset.  The
existing .reset_prepare and .reset_done still serve FLR.

Patch 2 fails new requests early in virtio_queue_rq when vqs were
removed during frozen reset_prepare.  It also registers
virtio_driver.shutdown for reboot and poweroff via virtio_dev_shutdown,
with freeze-before-break reclaim and blk_mark_disk_dead().

Changes since v2, thanks to Michael for the review:
- perm_failure: only virtio_break_device()
- default and frozen share one quiesce then NEED_RESET path
- Add .slot_reset to restore after successful AER PCI reset
- Drop PCI common to drv->shutdown wiring; virtio-blk .shutdown for
  system shutdown via virtio_dev_shutdown

Based on linux-next next-20260730.

Thanks,
Xixin Liu
---
Xixin Liu (2):
  virtio-pci: add error_detected and slot_reset for AER
  virtio-blk: add shutdown and fail queue_rq after VQ teardown

 drivers/block/virtio_blk.c         | 36 ++++++++++++++++++++++++++++++
 drivers/virtio/virtio_pci_common.c | 53 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 89 insertions(+)

-- 
2.43.0

[PATCH v3 1/2] virtio-pci: add error_detected and slot_reset for AER

[Xixin Liu]

virtio-pci only registered reset_prepare/reset_done.  Without
.error_detected the recovery core votes NO_AER_DRIVER on the first
broadcast, and report_perm_failure_detected skips the driver callback
whenever overall status is not RECOVERED.  That skip covers
NO_AER_DRIVER even when subordinate reset succeeded.  Virtio therefore
misses the normal ERS path and pci_channel_io_perm_failure.

AER's aer_root_reset() uses pci_bus_error_reset(), which does a bus or
slot reset without pci_dev_save_and_disable().  The existing
.reset_prepare and .reset_done therefore do not run on that path.
Those hooks still serve FLR and pci_reset_function.

Register error_detected and slot_reset:
- frozen / unknown: virtio_device_reset_prepare() then NEED_RESET
- after a successful PCI reset: restore config, virtio_device_reset_done()
- perm_failure: virtio_break_device() and return DISCONNECT

Assisted-by: DeepSeek:deepseek-v3
Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
---
 drivers/virtio/virtio_pci_common.c | 53 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index 164f480b18a6..c0ffeed00004 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c
@@ -828,7 +828,60 @@ static void virtio_pci_reset_done(struct pci_dev *pci_dev)
 		dev_warn(&pci_dev->dev, "Reset done failure: %d", ret);
 }
 
+static pci_ers_result_t virtio_pci_error_detected(struct pci_dev *pci_dev,
+						  pci_channel_state_t state)
+{
+	struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev);
+
+	/*
+	 * Quiesce on frozen/unknown before AER bus reset.  That path does
+	 * not call .reset_prepare.  On permanent failure only break
+	 * virtqueues.
+	 */
+	switch (state) {
+	case pci_channel_io_normal:
+		return PCI_ERS_RESULT_CAN_RECOVER;
+	case pci_channel_io_perm_failure:
+		dev_warn(&pci_dev->dev,
+			 "permanent failure, disconnecting device\n");
+		virtio_break_device(&vp_dev->vdev);
+		return PCI_ERS_RESULT_DISCONNECT;
+	case pci_channel_io_frozen:
+	default:
+		pci_info(pci_dev, "channel state %u, quiesce device\n", state);
+		if (virtio_device_reset_prepare(&vp_dev->vdev))
+			dev_warn(&pci_dev->dev, "reset prepare failed\n");
+		return PCI_ERS_RESULT_NEED_RESET;
+	}
+}
+
+static pci_ers_result_t virtio_pci_slot_reset(struct pci_dev *pci_dev)
+{
+	struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev);
+	int ret;
+
+	if (pci_enable_device(pci_dev)) {
+		dev_err(&pci_dev->dev,
+			"Cannot re-enable PCI device after reset\n");
+		return PCI_ERS_RESULT_DISCONNECT;
+	}
+
+	pci_set_master(pci_dev);
+	pci_restore_state(pci_dev);
+
+	ret = virtio_device_reset_done(&vp_dev->vdev);
+	if (ret && ret != -EOPNOTSUPP) {
+		dev_warn(&pci_dev->dev, "slot reset restore failed: %d\n",
+			 ret);
+		return PCI_ERS_RESULT_DISCONNECT;
+	}
+
+	return PCI_ERS_RESULT_RECOVERED;
+}
+
 static const struct pci_error_handlers virtio_pci_err_handler = {
+	.error_detected = virtio_pci_error_detected,
+	.slot_reset     = virtio_pci_slot_reset,
 	.reset_prepare  = virtio_pci_reset_prepare,
 	.reset_done     = virtio_pci_reset_done,
 };
-- 
2.43.0

[PATCH v3 2/2] virtio-blk: add shutdown and fail queue_rq after VQ teardown

[Xixin Liu]

Register virtio_driver.shutdown for reboot and poweroff via
virtio_dev_shutdown: freeze to reclaim in-flight requests, then
break virtqueues and mark the disk dead.

Also fail queue_rq early when vqs were removed during frozen
reset_prepare and vqs is NULL.

Assisted-by: DeepSeek:deepseek-v3
Signed-off-by: Xixin Liu <liuxixin@kylinos.cn>
---
 drivers/block/virtio_blk.c | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 32bf3ba07a9d..bbbbbbbbbbbb 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -435,6 +435,12 @@ static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx,
 	blk_status_t status;
 	int err;
 
+	/* VQs may be gone after frozen reset_prepare; avoid NULL deref. */
+	if (unlikely(!vblk->vqs || !vblk->vdev)) {
+		blk_mq_start_request(req);
+		return BLK_STS_IOERR;
+	}
+
 	status = virtblk_prep_rq(hctx, vblk, req, vbr);
 	if (unlikely(status))
 		return status;
@@ -1561,6 +1561,34 @@ static int virtblk_probe(struct virtio_device *vdev)
 	return err;
 }
 
+/* System shutdown: reclaim in-flight requests, then break and mark dead. */
+static void virtblk_shutdown(struct virtio_device *vdev)
+{
+	struct virtio_blk *vblk = vdev->priv;
+	struct request_queue *q;
+	unsigned int memflags;
+
+	if (!vblk || !vblk->disk)
+		return;
+
+	q = vblk->disk->queue;
+	/*
+	 * Reclaim request memory before break: freeze waits until
+	 * q_usage_counter is zero (PDU + chained sg freed in done path).
+	 * After virtio_break_device(), completions no longer run.
+	 */
+	memflags = blk_mq_freeze_queue(q);
+	blk_mq_quiesce_queue_nowait(q);
+
+	virtio_break_device(vdev);
+	flush_work(&vblk->config_work);
+
+	blk_mark_disk_dead(vblk->disk);
+
+	blk_mq_unquiesce_queue(q);
+	blk_mq_unfreeze_queue(q, memflags);
+}
+
 static void virtblk_remove(struct virtio_device *vdev)
 {
 	struct virtio_blk *vblk = vdev->priv;
@@ -1684,6 +1712,7 @@ static struct virtio_driver virtio_blk = {
 	.probe				= virtblk_probe,
 	.remove				= virtblk_remove,
 	.config_changed			= virtblk_config_changed,
+	.shutdown			= virtblk_shutdown,
 #ifdef CONFIG_PM_SLEEP
 	.freeze				= virtblk_freeze,
 	.restore			= virtblk_restore,
-- 
2.43.0