On Sun, Mar 10, 2019 at 5:22 PM Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> wrote: > > On Sun, Mar 10, 2019 at 4:54 PM Dan Williams <dan.j.williams@xxxxxxxxx> wrote: > > > > Unfortunately this particular b0rkage is not constrained to nvmem. > > I.e. there's nothing specific about nvmem requiring mc-safe memory > > copy, it's a cpu problem consuming any poison regardless of > > source-media-type with "rep; movs". > > So why is it sold and used for the nvdimm pmem driver? > > People told me it was a big deal and machines died. > > You can't suddenly change the story just because you want to expose it > to user space. > > You can't have it both ways. Either nvdimms have more likelihood of, > and problems with, machine checks, or it doesn't. > > The end result is the same: if intel believes the kernel needs to > treat nvdimms specially, then we're sure as hell not exposing those > snowflakes to user space. > > And if intel *doesn't* believe that, then we're removing the mcsafe_* functions. > > There's no "oh, it's safe to show to user space, but the kernel is > magical" middle ground here that makes sense to me. I don't think anyone is trying to claim both ways... the mcsafe memcpy is not implemented because NVDIMMs have a higher chance of encountering poison, it's implemented because the pmem driver affords an error model that just isn't possible in other kernel poison consumption paths. Even if this issue didn't exist there would still be a rep; mov based mcsafe memcpy for the driver to use on the expectation that userspace would prefer EIO to a reboot for kernel-space consumed poison. That said, I agree with the argument that a kernel mcsafe copy is not sufficient when DAX is there to arrange for the bulk of memory-mapped-I/O to be issued from userspace. Another feature the userspace tooling can support for the PMEM as RAM case is the ability to complete an Address Range Scrub of the range before it is added to the core-mm. I.e at least ensure that previously encountered poison is eliminated. The driver can also publish an attribute to indicate when rep; mov is recoverable, and gate the hotplug policy on the result. In my opinion a positive indicator of the cpu's ability to recover rep; mov exceptions is a gap that needs addressing.
