From: Cao jin <caoj.fnst@cn.fujitsu.com>
To: "Michael S. Tsirkin" <mst@redhat.com>,
Alex Williamson <alex.williamson@redhat.com>
Cc: <linux-kernel@vger.kernel.org>, <izumi.taku@jp.fujitsu.com>,
<qemu-devel@nongnu.org>, <kvm@vger.kernel.org>
Subject: Re: vfio/pci: guest error recovery proposal
Date: Wed, 28 Dec 2016 10:52:13 +0800 [thread overview]
Message-ID: <586328DD.3040203@cn.fujitsu.com> (raw)
In-Reply-To: <20161216003520-mutt-send-email-mst@kernel.org>
On 12/16/2016 07:02 AM, Michael S. Tsirkin wrote:
>
>> 1) We need to do the right thing for the guest, I don't think we
>> should be presuming that different reset types are equivalent,
>> leaving gaps where we expect the guest/host to do a reset and don't
>> follow through on other reset requests, and we need to notify the
>> guest immediately for the error.
> c> 2) We need to do the right thing for the host, that means we should
>> not give the user the opportunity to leave a device in a state
>> where we haven't at least performed a bus reset on link error (this
>> may be our current state and if so we should fix it).
>
> Ok so here is a concrete proposal for improving guest device error
> recovery (1). This is not trying to fix current bugs for 2, but
> also does not lock us into not fixing them.
>
> I'll write up proposal for (2) but I feel we can't properly
> fix host without fixing (1) first and without breaking compatibility.
>
> Background:
>
> non-fatal errors:
>
> - These errors are due to data link problems.
> The problem is that a transaction was lost, so driver and device are
> out of sync. Device reset is in theory enough to recover from these,
> in practice some drivers might try to do link level reset instead.
>
>
> fatal errors:
>
> - These errors are due to physical problems.
> The problem is that a transaction was lost, so driver and device are
> out of sync. Link reset might be necessary to recover from these,
> sometimes device reset might be enough for very simple devices.
> If a link above the device reports errors, device might have went away,
> link reset is the only thing that might being it back.
>
> current behaviour:
>
> - vfio will always report that it recovered function from an error.
> - whether link reset will trigger depends on whether any other
> function on the same link has a host driver that reports an error.
> - also, if there's a host driver that can't handle errors,
> link reset will never trigger
>
>
> proposed enhancement:
>
> 1- allow userspace to request reporting non fatal/fatal errors separately
> 2- report errors on monitor as events as well
> 3- forward correct error type to guest
> 4- set link error flag in userspace (this is optional, used for 5 below)
> 5- if guest requests link reset, and error flag is set,
> stop vm (I hope we can distinguish this
> from resets that happen on reboot here.
> if yes we might not need error flag in 4 above)
>
Hi,
I have a question about vm stop on fatal error.
Recently, When test my patches, I often saw fatal error(Malformed TLP
Status) happens, which disturbed my test. So I am wondering: why vm stop
is a better choice than qdev_unplug? Although we told user "Please
collect any data possible and then kill the guest", I still don't know
how to save any possible data. For example, if user is editing document,
vm_stop caused by a device fatal error will destroy user's effort.
--
Sincerely,
Cao jin
>
> Results:
> The advantage of this is that we don't need to manage any state at all.
> Most drivers will handle non fatal errors by FLR and will recover fine.
> Drivers that attempt link reset will get vmstop which is not
> worse than what we have now.
>
> I don't see how this can break any reasonable configuration
> that is not already broken, but we might want a flag
> to suppress aer reports to guest and just do vmstop
> unconditionally.
> Alternatively, management can pause vm itself when it sees the error.
>
>
> Pls remember to Cc qemu list on discussion, not just kvm.
>
next prev parent reply other threads:[~2016-12-28 2:48 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-12-15 23:02 vfio/pci: guest error recovery proposal Michael S. Tsirkin
2016-12-15 23:37 ` vfio/pci: host " Michael S. Tsirkin
2016-12-28 2:52 ` Cao jin [this message]
2017-01-09 22:50 ` vfio/pci: guest " Michael S. Tsirkin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=586328DD.3040203@cn.fujitsu.com \
--to=caoj.fnst@cn.fujitsu.com \
--cc=alex.williamson@redhat.com \
--cc=izumi.taku@jp.fujitsu.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mst@redhat.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).