lkml.org 
[lkml]   [2018]   [May]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v6 1/2] acpi: apei: Rename ghes_severity() to ghes_cper_severity()
From
Date
On 05/22/2018 12:57 PM, Luck, Tony wrote:
> On Tue, May 22, 2018 at 04:54:26PM +0200, Borislav Petkov wrote:
>> I especially don't want to have the case where a PCIe error is *really*
>> fatal and then we noodle in some handlers debating about the severity
>> because it got marked as recoverable intermittently and end up causing
>> data corruption on the storage device. Here's a real no-no for ya.
>
> All that we have is a message from the BIOS that this is a "fatal"
> error. When did we start trusting the BIOS to give us accurate
> information?

When we merged ACPI handling.

> PCIe fatal means that the link or the device is broken. But that
> seems a poor reason to take down a large server that may have
> dozens of devices (some of them set up specifically to handle
> errors ... e.g. mirrored disks on separate controllers, or NIC
> devices that have been "bonded" together).
>
> So, as long as the action for a "fatal" error is to mark a link
> down and offline the device, that seems a pretty reasonable course
> of action.
>
> The argument gets a lot more marginal if you simply reset the
> link and re-enable the device to "fix" it. That might be enough,
> but I don't think the OS has enough data to make the call.

I'm not 100% satisfied with how AER handler works, and how certain
drivers (nvme!!!) interface with AER handling. But this is an arguments
that belongs in PCI code, and a fight I will fight with Bjorn and Keith.
The issue we're having with Borislav and Rafael's estate is that we
can't make it to PCI land.

I'm seeing here the same fight that I saw with firmware vs OS, where fw
wants to have control, and OS wants to have control. I saw the same with
ME/CSE/CSME team vs ChromeOS team, where ME team did everything possible
to make sure only they can access the boot vector and boot the
processor, and ChromeOS team couldn't use this approach because they
wanted their own root of trust. I've seen this in other places as well,
though confidentiality agreements prevent me from talking about it.

It's the issue of control, and it's a fact of life. Borislav and Rafael
don't want to relinquish control until they can be 100% certain that
going further will result in 100% recovery. That is a goal I aspire to
as well, but an unachievable ideal nonetheless.

I thought the best compromise would be to be as close as possible to
native handling. That is, if AER can't recover, we don't recover the
device, but the machine keeps running. I think there's some deeper
history to GHES handling, which I didn't take into consideration. The
fight is to convince appropriate parties to share the responsibility in
a way which doesn't kill the machine. We still have a ways to go until
we get there.

Alex

> -Tony
>
> P.S. I deliberately put "fatal" in quotes above because to
> quote "The Princess Bride" -- "that word, I do not think it
> means what you think it means". :-)
>

\
 
 \ /
  Last update: 2018-05-22 20:14    [W:0.207 / U:0.744 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site