2                       PCI Error Recovery
   3                       ------------------
   4                        February 2, 2006
   6                 Current document maintainer:
   7             Linas Vepstas <>
  10Many PCI bus controllers are able to detect a variety of hardware
  11PCI errors on the bus, such as parity errors on the data and address
  12busses, as well as SERR and PERR errors.  Some of the more advanced
  13chipsets are able to deal with these errors; these include PCI-E chipsets,
  14and the PCI-host bridges found on IBM Power4 and Power5-based pSeries
  15boxes. A typical action taken is to disconnect the affected device,
  16halting all I/O to it.  The goal of a disconnection is to avoid system
  17corruption; for example, to halt system memory corruption due to DMA's
  18to "wild" addresses. Typically, a reconnection mechanism is also
  19offered, so that the affected PCI device(s) are reset and put back
  20into working condition. The reset phase requires coordination
  21between the affected device drivers and the PCI controller chip.
  22This document describes a generic API for notifying device drivers
  23of a bus disconnection, and then performing error recovery.
  24This API is currently implemented in the 2.6.16 and later kernels.
  26Reporting and recovery is performed in several steps. First, when
  27a PCI hardware error has resulted in a bus disconnect, that event
  28is reported as soon as possible to all affected device drivers,
  29including multiple instances of a device driver on multi-function
  30cards. This allows device drivers to avoid deadlocking in spinloops,
  31waiting for some i/o-space register to change, when it never will.
  32It also gives the drivers a chance to defer incoming I/O as
  35Next, recovery is performed in several stages. Most of the complexity
  36is forced by the need to handle multi-function devices, that is,
  37devices that have multiple device drivers associated with them.
  38In the first stage, each driver is allowed to indicate what type
  39of reset it desires, the choices being a simple re-enabling of I/O
  40or requesting a hard reset (a full electrical #RST of the PCI card).
  41If any driver requests a full reset, that is what will be done.
  43After a full reset and/or a re-enabling of I/O, all drivers are
  44again notified, so that they may then perform any device setup/config
  45that may be required.  After these have all completed, a final
  46"resume normal operations" event is sent out.
  48The biggest reason for choosing a kernel-based implementation rather
  49than a user-space implementation was the need to deal with bus
  50disconnects of PCI devices attached to storage media, and, in particular,
  51disconnects from devices holding the root file system.  If the root
  52file system is disconnected, a user-space mechanism would have to go
  53through a large number of contortions to complete recovery. Almost all
  54of the current Linux file systems are not tolerant of disconnection
  55from/reconnection to their underlying block device. By contrast,
  56bus errors are easy to manage in the device driver. Indeed, most
  57device drivers already handle very similar recovery procedures;
  58for example, the SCSI-generic layer already provides significant
  59mechanisms for dealing with SCSI bus errors and SCSI bus resets.
  62Detailed Design
  64Design and implementation details below, based on a chain of
  65public email discussions with Ben Herrenschmidt, circa 5 April 2005.
  67The error recovery API support is exposed to the driver in the form of
  68a structure of function pointers pointed to by a new field in struct
  69pci_driver. A driver that fails to provide the structure is "non-aware",
  70and the actual recovery steps taken are platform dependent.  The
  71arch/powerpc implementation will simulate a PCI hotplug remove/add.
  73This structure has the form:
  74struct pci_error_handlers
  76        int (*error_detected)(struct pci_dev *dev, enum pci_channel_state);
  77        int (*mmio_enabled)(struct pci_dev *dev);
  78        int (*link_reset)(struct pci_dev *dev);
  79        int (*slot_reset)(struct pci_dev *dev);
  80        void (*resume)(struct pci_dev *dev);
  83The possible channel states are:
  84enum pci_channel_state {
  85        pci_channel_io_normal,  /* I/O channel is in normal state */
  86        pci_channel_io_frozen,  /* I/O to channel is blocked */
  87        pci_channel_io_perm_failure, /* PCI card is dead */
  90Possible return values are:
  91enum pci_ers_result {
  92        PCI_ERS_RESULT_NONE,        /* no result/none/not supported in device driver */
  93        PCI_ERS_RESULT_CAN_RECOVER, /* Device driver can recover without slot reset */
  94        PCI_ERS_RESULT_NEED_RESET,  /* Device driver wants slot to be reset. */
  95        PCI_ERS_RESULT_DISCONNECT,  /* Device has completely failed, is unrecoverable */
  96        PCI_ERS_RESULT_RECOVERED,   /* Device driver is fully recovered and operational */
  99A driver does not have to implement all of these callbacks; however,
 100if it implements any, it must implement error_detected(). If a callback
 101is not implemented, the corresponding feature is considered unsupported.
 102For example, if mmio_enabled() and resume() aren't there, then it
 103is assumed that the driver is not doing any direct recovery and requires
 104a reset. If link_reset() is not implemented, the card is assumed as
 105not care about link resets. Typically a driver will want to know about
 106a slot_reset().
 108The actual steps taken by a platform to recover from a PCI error
 109event will be platform-dependent, but will follow the general
 110sequence described below.
 112STEP 0: Error Event
 114PCI bus error is detect by the PCI hardware.  On powerpc, the slot
 115is isolated, in that all I/O is blocked: all reads return 0xffffffff,
 116all writes are ignored.
 119STEP 1: Notification
 121Platform calls the error_detected() callback on every instance of
 122every driver affected by the error.
 124At this point, the device might not be accessible anymore, depending on
 125the platform (the slot will be isolated on powerpc). The driver may
 126already have "noticed" the error because of a failing I/O, but this
 127is the proper "synchronization point", that is, it gives the driver
 128a chance to cleanup, waiting for pending stuff (timers, whatever, etc...)
 129to complete; it can take semaphores, schedule, etc... everything but
 130touch the device. Within this function and after it returns, the driver
 131shouldn't do any new IOs. Called in task context. This is sort of a
 132"quiesce" point. See note about interrupts at the end of this doc.
 134All drivers participating in this system must implement this call.
 135The driver must return one of the following result codes:
 136                - PCI_ERS_RESULT_CAN_RECOVER:
 137                  Driver returns this if it thinks it might be able to recover
 138                  the HW by just banging IOs or if it wants to be given
 139                  a chance to extract some diagnostic information (see
 140                  mmio_enable, below).
 141                - PCI_ERS_RESULT_NEED_RESET:
 142                  Driver returns this if it can't recover without a hard
 143                  slot reset.
 144                - PCI_ERS_RESULT_DISCONNECT:
 145                  Driver returns this if it doesn't want to recover at all.
 147The next step taken will depend on the result codes returned by the
 150If all drivers on the segment/slot return PCI_ERS_RESULT_CAN_RECOVER,
 151then the platform should re-enable IOs on the slot (or do nothing in
 152particular, if the platform doesn't isolate slots), and recovery
 153proceeds to STEP 2 (MMIO Enable).
 155If any driver requested a slot reset (by returning PCI_ERS_RESULT_NEED_RESET),
 156then recovery proceeds to STEP 4 (Slot Reset).
 158If the platform is unable to recover the slot, the next step
 159is STEP 6 (Permanent Failure).
 161>>> The current powerpc implementation assumes that a device driver will
 162>>> *not* schedule or semaphore in this routine; the current powerpc
 163>>> implementation uses one kernel thread to notify all devices;
 164>>> thus, if one device sleeps/schedules, all devices are affected.
 165>>> Doing better requires complex multi-threaded logic in the error
 166>>> recovery implementation (e.g. waiting for all notification threads
 167>>> to "join" before proceeding with recovery.)  This seems excessively
 168>>> complex and not worth implementing.
 170>>> The current powerpc implementation doesn't much care if the device
 171>>> attempts I/O at this point, or not.  I/O's will fail, returning
 172>>> a value of 0xff on read, and writes will be dropped. If the device
 173>>> driver attempts more than 10K I/O's to a frozen adapter, it will
 174>>> assume that the device driver has gone into an infinite loop, and
 175>>> it will panic the kernel. There doesn't seem to be any other
 176>>> way of stopping a device driver that insists on spinning on I/O.
 178STEP 2: MMIO Enabled
 180The platform re-enables MMIO to the device (but typically not the
 181DMA), and then calls the mmio_enabled() callback on all affected
 182device drivers.
 184This is the "early recovery" call. IOs are allowed again, but DMA is
 185not (hrm... to be discussed, I prefer not), with some restrictions. This
 186is NOT a callback for the driver to start operations again, only to
 187peek/poke at the device, extract diagnostic information, if any, and
 188eventually do things like trigger a device local reset or some such,
 189but not restart operations. This is callback is made if all drivers on
 190a segment agree that they can try to recover and if no automatic link reset
 191was performed by the HW. If the platform can't just re-enable IOs without
 192a slot reset or a link reset, it wont call this callback, and instead
 193will have gone directly to STEP 3 (Link Reset) or STEP 4 (Slot Reset)
 195>>> The following is proposed; no platform implements this yet:
 196>>> Proposal: All I/O's should be done _synchronously_ from within
 197>>> this callback, errors triggered by them will be returned via
 198>>> the normal pci_check_whatever() API, no new error_detected()
 199>>> callback will be issued due to an error happening here. However,
 200>>> such an error might cause IOs to be re-blocked for the whole
 201>>> segment, and thus invalidate the recovery that other devices
 202>>> on the same segment might have done, forcing the whole segment
 203>>> into one of the next states, that is, link reset or slot reset.
 205The driver should return one of the following result codes:
 206                - PCI_ERS_RESULT_RECOVERED
 207                  Driver returns this if it thinks the device is fully
 208                  functional and thinks it is ready to start
 209                  normal driver operations again. There is no
 210                  guarantee that the driver will actually be
 211                  allowed to proceed, as another driver on the
 212                  same segment might have failed and thus triggered a
 213                  slot reset on platforms that support it.
 215                - PCI_ERS_RESULT_NEED_RESET
 216                  Driver returns this if it thinks the device is not
 217                  recoverable in it's current state and it needs a slot
 218                  reset to proceed.
 220                - PCI_ERS_RESULT_DISCONNECT
 221                  Same as above. Total failure, no recovery even after
 222                  reset driver dead. (To be defined more precisely)
 224The next step taken depends on the results returned by the drivers.
 225If all drivers returned PCI_ERS_RESULT_RECOVERED, then the platform
 226proceeds to either STEP3 (Link Reset) or to STEP 5 (Resume Operations).
 228If any driver returned PCI_ERS_RESULT_NEED_RESET, then the platform
 229proceeds to STEP 4 (Slot Reset)
 231>>> The current powerpc implementation does not implement this callback.
 234STEP 3: Link Reset
 236The platform resets the link, and then calls the link_reset() callback
 237on all affected device drivers.  This is a PCI-Express specific state
 238and is done whenever a non-fatal error has been detected that can be
 239"solved" by resetting the link. This call informs the driver of the
 240reset and the driver should check to see if the device appears to be
 241in working condition.
 243The driver is not supposed to restart normal driver I/O operations
 244at this point.  It should limit itself to "probing" the device to
 245check it's recoverability status. If all is right, then the platform
 246will call resume() once all drivers have ack'd link_reset().
 248        Result codes:
 249                (identical to STEP 3 (MMIO Enabled)
 251The platform then proceeds to either STEP 4 (Slot Reset) or STEP 5
 252(Resume Operations).
 254>>> The current powerpc implementation does not implement this callback.
 257STEP 4: Slot Reset
 259The platform performs a soft or hard reset of the device, and then
 260calls the slot_reset() callback.
 262A soft reset consists of asserting the adapter #RST line and then
 263restoring the PCI BAR's and PCI configuration header to a state
 264that is equivalent to what it would be after a fresh system
 265power-on followed by power-on BIOS/system firmware initialization.
 266If the platform supports PCI hotplug, then the reset might be
 267performed by toggling the slot electrical power off/on.
 269It is important for the platform to restore the PCI config space
 270to the "fresh poweron" state, rather than the "last state". After
 271a slot reset, the device driver will almost always use its standard
 272device initialization routines, and an unusual config space setup
 273may result in hung devices, kernel panics, or silent data corruption.
 275This call gives drivers the chance to re-initialize the hardware
 276(re-download firmware, etc.).  At this point, the driver may assume
 277that he card is in a fresh state and is fully functional. In
 278particular, interrupt generation should work normally.
 280Drivers should not yet restart normal I/O processing operations
 281at this point.  If all device drivers report success on this
 282callback, the platform will call resume() to complete the sequence,
 283and let the driver restart normal I/O processing.
 285A driver can still return a critical failure for this function if
 286it can't get the device operational after reset.  If the platform
 287previously tried a soft reset, it might now try a hard reset (power
 288cycle) and then call slot_reset() again.  It the device still can't
 289be recovered, there is nothing more that can be done;  the platform
 290will typically report a "permanent failure" in such a case.  The
 291device will be considered "dead" in this case.
 293Drivers for multi-function cards will need to coordinate among
 294themselves as to which driver instance will perform any "one-shot"
 295or global device initialization. For example, the Symbios sym53cxx2
 296driver performs device init only from PCI function 0:
 298+       if (PCI_FUNC(pdev->devfn) == 0)
 299+               sym_reset_scsi_bus(np, 0);
 301        Result codes:
 302                - PCI_ERS_RESULT_DISCONNECT
 303                Same as above.
 305Platform proceeds either to STEP 5 (Resume Operations) or STEP 6 (Permanent
 308>>> The current powerpc implementation does not currently try a
 309>>> power-cycle reset if the driver returned PCI_ERS_RESULT_DISCONNECT.
 310>>> However, it probably should.
 313STEP 5: Resume Operations
 315The platform will call the resume() callback on all affected device
 316drivers if all drivers on the segment have returned
 317PCI_ERS_RESULT_RECOVERED from one of the 3 previous callbacks.
 318The goal of this callback is to tell the driver to restart activity,
 319that everything is back and running. This callback does not return
 320a result code.
 322At this point, if a new error happens, the platform will restart
 323a new error recovery sequence.
 325STEP 6: Permanent Failure
 327A "permanent failure" has occurred, and the platform cannot recover
 328the device.  The platform will call error_detected() with a
 329pci_channel_state value of pci_channel_io_perm_failure.
 331The device driver should, at this point, assume the worst. It should
 332cancel all pending I/O, refuse all new I/O, returning -EIO to
 333higher layers. The device driver should then clean up all of its
 334memory and remove itself from kernel operations, much as it would
 335during system shutdown.
 337The platform will typically notify the system operator of the
 338permanent failure in some way.  If the device is hotplug-capable,
 339the operator will probably want to remove and replace the device.
 340Note, however, not all failures are truly "permanent". Some are
 341caused by over-heating, some by a poorly seated card. Many
 342PCI error events are caused by software bugs, e.g. DMA's to
 343wild addresses or bogus split transactions due to programming
 344errors. See the discussion in powerpc/eeh-pci-error-recovery.txt
 345for additional detail on real-life experience of the causes of
 346software errors.
 349Conclusion; General Remarks
 351The way those callbacks are called is platform policy. A platform with
 352no slot reset capability may want to just "ignore" drivers that can't
 353recover (disconnect them) and try to let other cards on the same segment
 354recover. Keep in mind that in most real life cases, though, there will
 355be only one driver per segment.
 357Now, a note about interrupts. If you get an interrupt and your
 358device is dead or has been isolated, there is a problem :)
 359The current policy is to turn this into a platform policy.
 360That is, the recovery API only requires that:
 362 - There is no guarantee that interrupt delivery can proceed from any
 363device on the segment starting from the error detection and until the
 364resume callback is sent, at which point interrupts are expected to be
 365fully operational.
 367 - There is no guarantee that interrupt delivery is stopped, that is,
 368a driver that gets an interrupt after detecting an error, or that detects
 369an error within the interrupt handler such that it prevents proper
 370ack'ing of the interrupt (and thus removal of the source) should just
 371return IRQ_NOTHANDLED. It's up to the platform to deal with that
 372condition, typically by masking the IRQ source during the duration of
 373the error handling. It is expected that the platform "knows" which
 374interrupts are routed to error-management capable slots and can deal
 375with temporarily disabling that IRQ number during error processing (this
 376isn't terribly complex). That means some IRQ latency for other devices
 377sharing the interrupt, but there is simply no other way. High end
 378platforms aren't supposed to share interrupts between many devices
 379anyway :)
 381>>> Implementation details for the powerpc platform are discussed in
 382>>> the file Documentation/powerpc/eeh-pci-error-recovery.txt
 384>>> As of this writing, there are six device drivers with patches
 385>>> implementing error recovery. Not all of these patches are in
 386>>> mainline yet. These may be used as "examples":
 388>>> drivers/scsi/ipr.c
 389>>> drivers/scsi/sym53cxx_2
 390>>> drivers/next/e100.c
 391>>> drivers/net/e1000
 392>>> drivers/net/ixgb
 393>>> drivers/net/s2io.c
 395The End