Re: [PATCH v6 1/2] acpi: apei: Rename ghes_severity() to ghes_cper_severity()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 05/22/2018 12:57 PM, Luck, Tony wrote:
On Tue, May 22, 2018 at 04:54:26PM +0200, Borislav Petkov wrote:
I especially don't want to have the case where a PCIe error is *really*
fatal and then we noodle in some handlers debating about the severity
because it got marked as recoverable intermittently and end up causing
data corruption on the storage device. Here's a real no-no for ya.

All that we have is a message from the BIOS that this is a "fatal"
error.  When did we start trusting the BIOS to give us accurate
information?

When we merged ACPI handling.

PCIe fatal means that the link or the device is broken. But that
seems a poor reason to take down a large server that may have
dozens of devices (some of them set up specifically to handle
errors ... e.g. mirrored disks on separate controllers, or NIC
devices that have been "bonded" together).

So, as long as the action for a "fatal" error is to mark a link
down and offline the device, that seems a pretty reasonable course
of action.

The argument gets a lot more marginal if you simply reset the
link and re-enable the device to "fix" it. That might be enough,
but I don't think the OS has enough data to make the call.

I'm not 100% satisfied with how AER handler works, and how certain drivers (nvme!!!) interface with AER handling. But this is an arguments that belongs in PCI code, and a fight I will fight with Bjorn and Keith. The issue we're having with Borislav and Rafael's estate is that we can't make it to PCI land.

I'm seeing here the same fight that I saw with firmware vs OS, where fw wants to have control, and OS wants to have control. I saw the same with ME/CSE/CSME team vs ChromeOS team, where ME team did everything possible to make sure only they can access the boot vector and boot the processor, and ChromeOS team couldn't use this approach because they wanted their own root of trust. I've seen this in other places as well, though confidentiality agreements prevent me from talking about it.

It's the issue of control, and it's a fact of life. Borislav and Rafael don't want to relinquish control until they can be 100% certain that going further will result in 100% recovery. That is a goal I aspire to as well, but an unachievable ideal nonetheless.

I thought the best compromise would be to be as close as possible to native handling. That is, if AER can't recover, we don't recover the device, but the machine keeps running. I think there's some deeper history to GHES handling, which I didn't take into consideration. The fight is to convince appropriate parties to share the responsibility in a way which doesn't kill the machine. We still have a ways to go until we get there.

Alex

-Tony

P.S. I deliberately put "fatal" in quotes above because to
quote "The Princess Bride" -- "that word, I do not think it
means what you think it means". :-)

--
To unsubscribe from this list: send the line "unsubscribe linux-acpi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux IBM ACPI]     [Linux Power Management]     [Linux Kernel]     [Linux Laptop]     [Kernel Newbies]     [Share Photos]     [Security]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]     [Linux Resources]

  Powered by Linux