On 05/22/2018 12:57 PM, Luck, Tony wrote:
On Tue, May 22, 2018 at 04:54:26PM +0200, Borislav Petkov wrote:
I especially don't want to have the case where a PCIe error is *really*
fatal and then we noodle in some handlers debating about the severity
because it got marked as recoverable intermittently and end up causing
data corruption on the storage device. Here's a real no-no for ya.
All that we have is a message from the BIOS that this is a "fatal"
error. When did we start trusting the BIOS to give us accurate
information?
When we merged ACPI handling.
PCIe fatal means that the link or the device is broken. But that
seems a poor reason to take down a large server that may have
dozens of devices (some of them set up specifically to handle
errors ... e.g. mirrored disks on separate controllers, or NIC
devices that have been "bonded" together).
So, as long as the action for a "fatal" error is to mark a link
down and offline the device, that seems a pretty reasonable course
of action.
The argument gets a lot more marginal if you simply reset the
link and re-enable the device to "fix" it. That might be enough,
but I don't think the OS has enough data to make the call.
I'm not 100% satisfied with how AER handler works, and how certain
drivers (nvme!!!) interface with AER handling. But this is an arguments
that belongs in PCI code, and a fight I will fight with Bjorn and Keith.
The issue we're having with Borislav and Rafael's estate is that we
can't make it to PCI land.
I'm seeing here the same fight that I saw with firmware vs OS, where fw
wants to have control, and OS wants to have control. I saw the same with
ME/CSE/CSME team vs ChromeOS team, where ME team did everything possible
to make sure only they can access the boot vector and boot the
processor, and ChromeOS team couldn't use this approach because they
wanted their own root of trust. I've seen this in other places as well,
though confidentiality agreements prevent me from talking about it.
It's the issue of control, and it's a fact of life. Borislav and Rafael
don't want to relinquish control until they can be 100% certain that
going further will result in 100% recovery. That is a goal I aspire to
as well, but an unachievable ideal nonetheless.
I thought the best compromise would be to be as close as possible to
native handling. That is, if AER can't recover, we don't recover the
device, but the machine keeps running. I think there's some deeper
history to GHES handling, which I didn't take into consideration. The
fight is to convince appropriate parties to share the responsibility in
a way which doesn't kill the machine. We still have a ways to go until
we get there.
Alex
-Tony
P.S. I deliberately put "fatal" in quotes above because to
quote "The Princess Bride" -- "that word, I do not think it
means what you think it means". :-)
--
To unsubscribe from this list: send the line "unsubscribe linux-acpi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
