linux/Documentation/PCI/pci-error-recovery.rst
<<
>>
Prefs
   1.. SPDX-License-Identifier: GPL-2.0
   2
   3==================
   4PCI Error Recovery
   5==================
   6
   7
   8:Authors: - Linas Vepstas <linasvepstas@gmail.com>
   9          - Richard Lary <rlary@us.ibm.com>
  10          - Mike Mason <mmlnx@us.ibm.com>
  11
  12
  13Many PCI bus controllers are able to detect a variety of hardware
  14PCI errors on the bus, such as parity errors on the data and address
  15buses, as well as SERR and PERR errors.  Some of the more advanced
  16chipsets are able to deal with these errors; these include PCI-E chipsets,
  17and the PCI-host bridges found on IBM Power4, Power5 and Power6-based
  18pSeries boxes. A typical action taken is to disconnect the affected device,
  19halting all I/O to it.  The goal of a disconnection is to avoid system
  20corruption; for example, to halt system memory corruption due to DMA's
  21to "wild" addresses. Typically, a reconnection mechanism is also
  22offered, so that the affected PCI device(s) are reset and put back
  23into working condition. The reset phase requires coordination
  24between the affected device drivers and the PCI controller chip.
  25This document describes a generic API for notifying device drivers
  26of a bus disconnection, and then performing error recovery.
  27This API is currently implemented in the 2.6.16 and later kernels.
  28
  29Reporting and recovery is performed in several steps. First, when
  30a PCI hardware error has resulted in a bus disconnect, that event
  31is reported as soon as possible to all affected device drivers,
  32including multiple instances of a device driver on multi-function
  33cards. This allows device drivers to avoid deadlocking in spinloops,
  34waiting for some i/o-space register to change, when it never will.
  35It also gives the drivers a chance to defer incoming I/O as
  36needed.
  37
  38Next, recovery is performed in several stages. Most of the complexity
  39is forced by the need to handle multi-function devices, that is,
  40devices that have multiple device drivers associated with them.
  41In the first stage, each driver is allowed to indicate what type
  42of reset it desires, the choices being a simple re-enabling of I/O
  43or requesting a slot reset.
  44
  45If any driver requests a slot reset, that is what will be done.
  46
  47After a reset and/or a re-enabling of I/O, all drivers are
  48again notified, so that they may then perform any device setup/config
  49that may be required.  After these have all completed, a final
  50"resume normal operations" event is sent out.
  51
  52The biggest reason for choosing a kernel-based implementation rather
  53than a user-space implementation was the need to deal with bus
  54disconnects of PCI devices attached to storage media, and, in particular,
  55disconnects from devices holding the root file system.  If the root
  56file system is disconnected, a user-space mechanism would have to go
  57through a large number of contortions to complete recovery. Almost all
  58of the current Linux file systems are not tolerant of disconnection
  59from/reconnection to their underlying block device. By contrast,
  60bus errors are easy to manage in the device driver. Indeed, most
  61device drivers already handle very similar recovery procedures;
  62for example, the SCSI-generic layer already provides significant
  63mechanisms for dealing with SCSI bus errors and SCSI bus resets.
  64
  65
  66Detailed Design
  67===============
  68
  69Design and implementation details below, based on a chain of
  70public email discussions with Ben Herrenschmidt, circa 5 April 2005.
  71
  72The error recovery API support is exposed to the driver in the form of
  73a structure of function pointers pointed to by a new field in struct
  74pci_driver. A driver that fails to provide the structure is "non-aware",
  75and the actual recovery steps taken are platform dependent.  The
  76arch/powerpc implementation will simulate a PCI hotplug remove/add.
  77
  78This structure has the form::
  79
  80        struct pci_error_handlers
  81        {
  82                int (*error_detected)(struct pci_dev *dev, pci_channel_state_t);
  83                int (*mmio_enabled)(struct pci_dev *dev);
  84                int (*slot_reset)(struct pci_dev *dev);
  85                void (*resume)(struct pci_dev *dev);
  86        };
  87
  88The possible channel states are::
  89
  90        typedef enum {
  91                pci_channel_io_normal,  /* I/O channel is in normal state */
  92                pci_channel_io_frozen,  /* I/O to channel is blocked */
  93                pci_channel_io_perm_failure, /* PCI card is dead */
  94        } pci_channel_state_t;
  95
  96Possible return values are::
  97
  98        enum pci_ers_result {
  99                PCI_ERS_RESULT_NONE,        /* no result/none/not supported in device driver */
 100                PCI_ERS_RESULT_CAN_RECOVER, /* Device driver can recover without slot reset */
 101                PCI_ERS_RESULT_NEED_RESET,  /* Device driver wants slot to be reset. */
 102                PCI_ERS_RESULT_DISCONNECT,  /* Device has completely failed, is unrecoverable */
 103                PCI_ERS_RESULT_RECOVERED,   /* Device driver is fully recovered and operational */
 104        };
 105
 106A driver does not have to implement all of these callbacks; however,
 107if it implements any, it must implement error_detected(). If a callback
 108is not implemented, the corresponding feature is considered unsupported.
 109For example, if mmio_enabled() and resume() aren't there, then it
 110is assumed that the driver is not doing any direct recovery and requires
 111a slot reset.  Typically a driver will want to know about
 112a slot_reset().
 113
 114The actual steps taken by a platform to recover from a PCI error
 115event will be platform-dependent, but will follow the general
 116sequence described below.
 117
 118STEP 0: Error Event
 119-------------------
 120A PCI bus error is detected by the PCI hardware.  On powerpc, the slot
 121is isolated, in that all I/O is blocked: all reads return 0xffffffff,
 122all writes are ignored.
 123
 124
 125STEP 1: Notification
 126--------------------
 127Platform calls the error_detected() callback on every instance of
 128every driver affected by the error.
 129
 130At this point, the device might not be accessible anymore, depending on
 131the platform (the slot will be isolated on powerpc). The driver may
 132already have "noticed" the error because of a failing I/O, but this
 133is the proper "synchronization point", that is, it gives the driver
 134a chance to cleanup, waiting for pending stuff (timers, whatever, etc...)
 135to complete; it can take semaphores, schedule, etc... everything but
 136touch the device. Within this function and after it returns, the driver
 137shouldn't do any new IOs. Called in task context. This is sort of a
 138"quiesce" point. See note about interrupts at the end of this doc.
 139
 140All drivers participating in this system must implement this call.
 141The driver must return one of the following result codes:
 142
 143  - PCI_ERS_RESULT_CAN_RECOVER
 144      Driver returns this if it thinks it might be able to recover
 145      the HW by just banging IOs or if it wants to be given
 146      a chance to extract some diagnostic information (see
 147      mmio_enable, below).
 148  - PCI_ERS_RESULT_NEED_RESET
 149      Driver returns this if it can't recover without a
 150      slot reset.
 151  - PCI_ERS_RESULT_DISCONNECT
 152      Driver returns this if it doesn't want to recover at all.
 153
 154The next step taken will depend on the result codes returned by the
 155drivers.
 156
 157If all drivers on the segment/slot return PCI_ERS_RESULT_CAN_RECOVER,
 158then the platform should re-enable IOs on the slot (or do nothing in
 159particular, if the platform doesn't isolate slots), and recovery
 160proceeds to STEP 2 (MMIO Enable).
 161
 162If any driver requested a slot reset (by returning PCI_ERS_RESULT_NEED_RESET),
 163then recovery proceeds to STEP 4 (Slot Reset).
 164
 165If the platform is unable to recover the slot, the next step
 166is STEP 6 (Permanent Failure).
 167
 168.. note::
 169
 170   The current powerpc implementation assumes that a device driver will
 171   *not* schedule or semaphore in this routine; the current powerpc
 172   implementation uses one kernel thread to notify all devices;
 173   thus, if one device sleeps/schedules, all devices are affected.
 174   Doing better requires complex multi-threaded logic in the error
 175   recovery implementation (e.g. waiting for all notification threads
 176   to "join" before proceeding with recovery.)  This seems excessively
 177   complex and not worth implementing.
 178
 179   The current powerpc implementation doesn't much care if the device
 180   attempts I/O at this point, or not.  I/O's will fail, returning
 181   a value of 0xff on read, and writes will be dropped. If more than
 182   EEH_MAX_FAILS I/O's are attempted to a frozen adapter, EEH
 183   assumes that the device driver has gone into an infinite loop
 184   and prints an error to syslog.  A reboot is then required to
 185   get the device working again.
 186
 187STEP 2: MMIO Enabled
 188--------------------
 189The platform re-enables MMIO to the device (but typically not the
 190DMA), and then calls the mmio_enabled() callback on all affected
 191device drivers.
 192
 193This is the "early recovery" call. IOs are allowed again, but DMA is
 194not, with some restrictions. This is NOT a callback for the driver to
 195start operations again, only to peek/poke at the device, extract diagnostic
 196information, if any, and eventually do things like trigger a device local
 197reset or some such, but not restart operations. This callback is made if
 198all drivers on a segment agree that they can try to recover and if no automatic
 199link reset was performed by the HW. If the platform can't just re-enable IOs
 200without a slot reset or a link reset, it will not call this callback, and
 201instead will have gone directly to STEP 3 (Link Reset) or STEP 4 (Slot Reset)
 202
 203.. note::
 204
 205   The following is proposed; no platform implements this yet:
 206   Proposal: All I/O's should be done _synchronously_ from within
 207   this callback, errors triggered by them will be returned via
 208   the normal pci_check_whatever() API, no new error_detected()
 209   callback will be issued due to an error happening here. However,
 210   such an error might cause IOs to be re-blocked for the whole
 211   segment, and thus invalidate the recovery that other devices
 212   on the same segment might have done, forcing the whole segment
 213   into one of the next states, that is, link reset or slot reset.
 214
 215The driver should return one of the following result codes:
 216  - PCI_ERS_RESULT_RECOVERED
 217      Driver returns this if it thinks the device is fully
 218      functional and thinks it is ready to start
 219      normal driver operations again. There is no
 220      guarantee that the driver will actually be
 221      allowed to proceed, as another driver on the
 222      same segment might have failed and thus triggered a
 223      slot reset on platforms that support it.
 224
 225  - PCI_ERS_RESULT_NEED_RESET
 226      Driver returns this if it thinks the device is not
 227      recoverable in its current state and it needs a slot
 228      reset to proceed.
 229
 230  - PCI_ERS_RESULT_DISCONNECT
 231      Same as above. Total failure, no recovery even after
 232      reset driver dead. (To be defined more precisely)
 233
 234The next step taken depends on the results returned by the drivers.
 235If all drivers returned PCI_ERS_RESULT_RECOVERED, then the platform
 236proceeds to either STEP3 (Link Reset) or to STEP 5 (Resume Operations).
 237
 238If any driver returned PCI_ERS_RESULT_NEED_RESET, then the platform
 239proceeds to STEP 4 (Slot Reset)
 240
 241STEP 3: Link Reset
 242------------------
 243The platform resets the link.  This is a PCI-Express specific step
 244and is done whenever a fatal error has been detected that can be
 245"solved" by resetting the link.
 246
 247STEP 4: Slot Reset
 248------------------
 249
 250In response to a return value of PCI_ERS_RESULT_NEED_RESET, the
 251platform will perform a slot reset on the requesting PCI device(s).
 252The actual steps taken by a platform to perform a slot reset
 253will be platform-dependent. Upon completion of slot reset, the
 254platform will call the device slot_reset() callback.
 255
 256Powerpc platforms implement two levels of slot reset:
 257soft reset(default) and fundamental(optional) reset.
 258
 259Powerpc soft reset consists of asserting the adapter #RST line and then
 260restoring the PCI BAR's and PCI configuration header to a state
 261that is equivalent to what it would be after a fresh system
 262power-on followed by power-on BIOS/system firmware initialization.
 263Soft reset is also known as hot-reset.
 264
 265Powerpc fundamental reset is supported by PCI Express cards only
 266and results in device's state machines, hardware logic, port states and
 267configuration registers to initialize to their default conditions.
 268
 269For most PCI devices, a soft reset will be sufficient for recovery.
 270Optional fundamental reset is provided to support a limited number
 271of PCI Express devices for which a soft reset is not sufficient
 272for recovery.
 273
 274If the platform supports PCI hotplug, then the reset might be
 275performed by toggling the slot electrical power off/on.
 276
 277It is important for the platform to restore the PCI config space
 278to the "fresh poweron" state, rather than the "last state". After
 279a slot reset, the device driver will almost always use its standard
 280device initialization routines, and an unusual config space setup
 281may result in hung devices, kernel panics, or silent data corruption.
 282
 283This call gives drivers the chance to re-initialize the hardware
 284(re-download firmware, etc.).  At this point, the driver may assume
 285that the card is in a fresh state and is fully functional. The slot
 286is unfrozen and the driver has full access to PCI config space,
 287memory mapped I/O space and DMA. Interrupts (Legacy, MSI, or MSI-X)
 288will also be available.
 289
 290Drivers should not restart normal I/O processing operations
 291at this point.  If all device drivers report success on this
 292callback, the platform will call resume() to complete the sequence,
 293and let the driver restart normal I/O processing.
 294
 295A driver can still return a critical failure for this function if
 296it can't get the device operational after reset.  If the platform
 297previously tried a soft reset, it might now try a hard reset (power
 298cycle) and then call slot_reset() again.  If the device still can't
 299be recovered, there is nothing more that can be done;  the platform
 300will typically report a "permanent failure" in such a case.  The
 301device will be considered "dead" in this case.
 302
 303Drivers for multi-function cards will need to coordinate among
 304themselves as to which driver instance will perform any "one-shot"
 305or global device initialization. For example, the Symbios sym53cxx2
 306driver performs device init only from PCI function 0::
 307
 308        +       if (PCI_FUNC(pdev->devfn) == 0)
 309        +               sym_reset_scsi_bus(np, 0);
 310
 311Result codes:
 312        - PCI_ERS_RESULT_DISCONNECT
 313          Same as above.
 314
 315Drivers for PCI Express cards that require a fundamental reset must
 316set the needs_freset bit in the pci_dev structure in their probe function.
 317For example, the QLogic qla2xxx driver sets the needs_freset bit for certain
 318PCI card types::
 319
 320        +       /* Set EEH reset type to fundamental if required by hba  */
 321        +       if (IS_QLA24XX(ha) || IS_QLA25XX(ha) || IS_QLA81XX(ha))
 322        +               pdev->needs_freset = 1;
 323        +
 324
 325Platform proceeds either to STEP 5 (Resume Operations) or STEP 6 (Permanent
 326Failure).
 327
 328.. note::
 329
 330   The current powerpc implementation does not try a power-cycle
 331   reset if the driver returned PCI_ERS_RESULT_DISCONNECT.
 332   However, it probably should.
 333
 334
 335STEP 5: Resume Operations
 336-------------------------
 337The platform will call the resume() callback on all affected device
 338drivers if all drivers on the segment have returned
 339PCI_ERS_RESULT_RECOVERED from one of the 3 previous callbacks.
 340The goal of this callback is to tell the driver to restart activity,
 341that everything is back and running. This callback does not return
 342a result code.
 343
 344At this point, if a new error happens, the platform will restart
 345a new error recovery sequence.
 346
 347STEP 6: Permanent Failure
 348-------------------------
 349A "permanent failure" has occurred, and the platform cannot recover
 350the device.  The platform will call error_detected() with a
 351pci_channel_state_t value of pci_channel_io_perm_failure.
 352
 353The device driver should, at this point, assume the worst. It should
 354cancel all pending I/O, refuse all new I/O, returning -EIO to
 355higher layers. The device driver should then clean up all of its
 356memory and remove itself from kernel operations, much as it would
 357during system shutdown.
 358
 359The platform will typically notify the system operator of the
 360permanent failure in some way.  If the device is hotplug-capable,
 361the operator will probably want to remove and replace the device.
 362Note, however, not all failures are truly "permanent". Some are
 363caused by over-heating, some by a poorly seated card. Many
 364PCI error events are caused by software bugs, e.g. DMA's to
 365wild addresses or bogus split transactions due to programming
 366errors. See the discussion in powerpc/eeh-pci-error-recovery.txt
 367for additional detail on real-life experience of the causes of
 368software errors.
 369
 370
 371Conclusion; General Remarks
 372---------------------------
 373The way the callbacks are called is platform policy. A platform with
 374no slot reset capability may want to just "ignore" drivers that can't
 375recover (disconnect them) and try to let other cards on the same segment
 376recover. Keep in mind that in most real life cases, though, there will
 377be only one driver per segment.
 378
 379Now, a note about interrupts. If you get an interrupt and your
 380device is dead or has been isolated, there is a problem :)
 381The current policy is to turn this into a platform policy.
 382That is, the recovery API only requires that:
 383
 384 - There is no guarantee that interrupt delivery can proceed from any
 385   device on the segment starting from the error detection and until the
 386   slot_reset callback is called, at which point interrupts are expected
 387   to be fully operational.
 388
 389 - There is no guarantee that interrupt delivery is stopped, that is,
 390   a driver that gets an interrupt after detecting an error, or that detects
 391   an error within the interrupt handler such that it prevents proper
 392   ack'ing of the interrupt (and thus removal of the source) should just
 393   return IRQ_NOTHANDLED. It's up to the platform to deal with that
 394   condition, typically by masking the IRQ source during the duration of
 395   the error handling. It is expected that the platform "knows" which
 396   interrupts are routed to error-management capable slots and can deal
 397   with temporarily disabling that IRQ number during error processing (this
 398   isn't terribly complex). That means some IRQ latency for other devices
 399   sharing the interrupt, but there is simply no other way. High end
 400   platforms aren't supposed to share interrupts between many devices
 401   anyway :)
 402
 403.. note::
 404
 405   Implementation details for the powerpc platform are discussed in
 406   the file Documentation/powerpc/eeh-pci-error-recovery.rst
 407
 408   As of this writing, there is a growing list of device drivers with
 409   patches implementing error recovery. Not all of these patches are in
 410   mainline yet. These may be used as "examples":
 411
 412   - drivers/scsi/ipr
 413   - drivers/scsi/sym53c8xx_2
 414   - drivers/scsi/qla2xxx
 415   - drivers/scsi/lpfc
 416   - drivers/next/bnx2.c
 417   - drivers/next/e100.c
 418   - drivers/net/e1000
 419   - drivers/net/e1000e
 420   - drivers/net/ixgb
 421   - drivers/net/ixgbe
 422   - drivers/net/cxgb3
 423   - drivers/net/s2io.c
 424
 425The End
 426-------
 427