About Kernel Documentation Linux Kernel Contact Linux Resources Linux Blog

Documentation / PCI / pci-error-recovery.txt


Based on kernel version 4.16.1. Page generated on 2018-04-09 11:53 EST.

1	
2	                       PCI Error Recovery
3	                       ------------------
4	                        February 2, 2006
5	
6	                 Current document maintainer:
7	             Linas Vepstas <linasvepstas@gmail.com>
8	          updated by Richard Lary <rlary@us.ibm.com>
9	       and Mike Mason <mmlnx@us.ibm.com> on 27-Jul-2009
10	
11	
12	Many PCI bus controllers are able to detect a variety of hardware
13	PCI errors on the bus, such as parity errors on the data and address
14	buses, as well as SERR and PERR errors.  Some of the more advanced
15	chipsets are able to deal with these errors; these include PCI-E chipsets,
16	and the PCI-host bridges found on IBM Power4, Power5 and Power6-based
17	pSeries boxes. A typical action taken is to disconnect the affected device,
18	halting all I/O to it.  The goal of a disconnection is to avoid system
19	corruption; for example, to halt system memory corruption due to DMA's
20	to "wild" addresses. Typically, a reconnection mechanism is also
21	offered, so that the affected PCI device(s) are reset and put back
22	into working condition. The reset phase requires coordination
23	between the affected device drivers and the PCI controller chip.
24	This document describes a generic API for notifying device drivers
25	of a bus disconnection, and then performing error recovery.
26	This API is currently implemented in the 2.6.16 and later kernels.
27	
28	Reporting and recovery is performed in several steps. First, when
29	a PCI hardware error has resulted in a bus disconnect, that event
30	is reported as soon as possible to all affected device drivers,
31	including multiple instances of a device driver on multi-function
32	cards. This allows device drivers to avoid deadlocking in spinloops,
33	waiting for some i/o-space register to change, when it never will.
34	It also gives the drivers a chance to defer incoming I/O as
35	needed.
36	
37	Next, recovery is performed in several stages. Most of the complexity
38	is forced by the need to handle multi-function devices, that is,
39	devices that have multiple device drivers associated with them.
40	In the first stage, each driver is allowed to indicate what type
41	of reset it desires, the choices being a simple re-enabling of I/O
42	or requesting a slot reset.
43	
44	If any driver requests a slot reset, that is what will be done.
45	
46	After a reset and/or a re-enabling of I/O, all drivers are
47	again notified, so that they may then perform any device setup/config
48	that may be required.  After these have all completed, a final
49	"resume normal operations" event is sent out.
50	
51	The biggest reason for choosing a kernel-based implementation rather
52	than a user-space implementation was the need to deal with bus
53	disconnects of PCI devices attached to storage media, and, in particular,
54	disconnects from devices holding the root file system.  If the root
55	file system is disconnected, a user-space mechanism would have to go
56	through a large number of contortions to complete recovery. Almost all
57	of the current Linux file systems are not tolerant of disconnection
58	from/reconnection to their underlying block device. By contrast,
59	bus errors are easy to manage in the device driver. Indeed, most
60	device drivers already handle very similar recovery procedures;
61	for example, the SCSI-generic layer already provides significant
62	mechanisms for dealing with SCSI bus errors and SCSI bus resets.
63	
64	
65	Detailed Design
66	---------------
67	Design and implementation details below, based on a chain of
68	public email discussions with Ben Herrenschmidt, circa 5 April 2005.
69	
70	The error recovery API support is exposed to the driver in the form of
71	a structure of function pointers pointed to by a new field in struct
72	pci_driver. A driver that fails to provide the structure is "non-aware",
73	and the actual recovery steps taken are platform dependent.  The
74	arch/powerpc implementation will simulate a PCI hotplug remove/add.
75	
76	This structure has the form:
77	struct pci_error_handlers
78	{
79		int (*error_detected)(struct pci_dev *dev, enum pci_channel_state);
80		int (*mmio_enabled)(struct pci_dev *dev);
81		int (*slot_reset)(struct pci_dev *dev);
82		void (*resume)(struct pci_dev *dev);
83	};
84	
85	The possible channel states are:
86	enum pci_channel_state {
87		pci_channel_io_normal,  /* I/O channel is in normal state */
88		pci_channel_io_frozen,  /* I/O to channel is blocked */
89		pci_channel_io_perm_failure, /* PCI card is dead */
90	};
91	
92	Possible return values are:
93	enum pci_ers_result {
94		PCI_ERS_RESULT_NONE,        /* no result/none/not supported in device driver */
95		PCI_ERS_RESULT_CAN_RECOVER, /* Device driver can recover without slot reset */
96		PCI_ERS_RESULT_NEED_RESET,  /* Device driver wants slot to be reset. */
97		PCI_ERS_RESULT_DISCONNECT,  /* Device has completely failed, is unrecoverable */
98		PCI_ERS_RESULT_RECOVERED,   /* Device driver is fully recovered and operational */
99	};
100	
101	A driver does not have to implement all of these callbacks; however,
102	if it implements any, it must implement error_detected(). If a callback
103	is not implemented, the corresponding feature is considered unsupported.
104	For example, if mmio_enabled() and resume() aren't there, then it
105	is assumed that the driver is not doing any direct recovery and requires
106	a slot reset.  Typically a driver will want to know about
107	a slot_reset().
108	
109	The actual steps taken by a platform to recover from a PCI error
110	event will be platform-dependent, but will follow the general
111	sequence described below.
112	
113	STEP 0: Error Event
114	-------------------
115	A PCI bus error is detected by the PCI hardware.  On powerpc, the slot
116	is isolated, in that all I/O is blocked: all reads return 0xffffffff,
117	all writes are ignored.
118	
119	
120	STEP 1: Notification
121	--------------------
122	Platform calls the error_detected() callback on every instance of
123	every driver affected by the error.
124	
125	At this point, the device might not be accessible anymore, depending on
126	the platform (the slot will be isolated on powerpc). The driver may
127	already have "noticed" the error because of a failing I/O, but this
128	is the proper "synchronization point", that is, it gives the driver
129	a chance to cleanup, waiting for pending stuff (timers, whatever, etc...)
130	to complete; it can take semaphores, schedule, etc... everything but
131	touch the device. Within this function and after it returns, the driver
132	shouldn't do any new IOs. Called in task context. This is sort of a
133	"quiesce" point. See note about interrupts at the end of this doc.
134	
135	All drivers participating in this system must implement this call.
136	The driver must return one of the following result codes:
137			- PCI_ERS_RESULT_CAN_RECOVER:
138			  Driver returns this if it thinks it might be able to recover
139			  the HW by just banging IOs or if it wants to be given
140			  a chance to extract some diagnostic information (see
141			  mmio_enable, below).
142			- PCI_ERS_RESULT_NEED_RESET:
143			  Driver returns this if it can't recover without a
144			  slot reset.
145			- PCI_ERS_RESULT_DISCONNECT:
146			  Driver returns this if it doesn't want to recover at all.
147	
148	The next step taken will depend on the result codes returned by the
149	drivers.
150	
151	If all drivers on the segment/slot return PCI_ERS_RESULT_CAN_RECOVER,
152	then the platform should re-enable IOs on the slot (or do nothing in
153	particular, if the platform doesn't isolate slots), and recovery
154	proceeds to STEP 2 (MMIO Enable).
155	
156	If any driver requested a slot reset (by returning PCI_ERS_RESULT_NEED_RESET),
157	then recovery proceeds to STEP 4 (Slot Reset).
158	
159	If the platform is unable to recover the slot, the next step
160	is STEP 6 (Permanent Failure).
161	
162	>>> The current powerpc implementation assumes that a device driver will
163	>>> *not* schedule or semaphore in this routine; the current powerpc
164	>>> implementation uses one kernel thread to notify all devices;
165	>>> thus, if one device sleeps/schedules, all devices are affected.
166	>>> Doing better requires complex multi-threaded logic in the error
167	>>> recovery implementation (e.g. waiting for all notification threads
168	>>> to "join" before proceeding with recovery.)  This seems excessively
169	>>> complex and not worth implementing.
170	
171	>>> The current powerpc implementation doesn't much care if the device
172	>>> attempts I/O at this point, or not.  I/O's will fail, returning
173	>>> a value of 0xff on read, and writes will be dropped. If more than
174	>>> EEH_MAX_FAILS I/O's are attempted to a frozen adapter, EEH
175	>>> assumes that the device driver has gone into an infinite loop
176	>>> and prints an error to syslog.  A reboot is then required to
177	>>> get the device working again.
178	
179	STEP 2: MMIO Enabled
180	-------------------
181	The platform re-enables MMIO to the device (but typically not the
182	DMA), and then calls the mmio_enabled() callback on all affected
183	device drivers.
184	
185	This is the "early recovery" call. IOs are allowed again, but DMA is
186	not, with some restrictions. This is NOT a callback for the driver to
187	start operations again, only to peek/poke at the device, extract diagnostic
188	information, if any, and eventually do things like trigger a device local
189	reset or some such, but not restart operations. This callback is made if
190	all drivers on a segment agree that they can try to recover and if no automatic
191	link reset was performed by the HW. If the platform can't just re-enable IOs
192	without a slot reset or a link reset, it will not call this callback, and
193	instead will have gone directly to STEP 3 (Link Reset) or STEP 4 (Slot Reset)
194	
195	>>> The following is proposed; no platform implements this yet:
196	>>> Proposal: All I/O's should be done _synchronously_ from within
197	>>> this callback, errors triggered by them will be returned via
198	>>> the normal pci_check_whatever() API, no new error_detected()
199	>>> callback will be issued due to an error happening here. However,
200	>>> such an error might cause IOs to be re-blocked for the whole
201	>>> segment, and thus invalidate the recovery that other devices
202	>>> on the same segment might have done, forcing the whole segment
203	>>> into one of the next states, that is, link reset or slot reset.
204	
205	The driver should return one of the following result codes:
206			- PCI_ERS_RESULT_RECOVERED
207			  Driver returns this if it thinks the device is fully
208			  functional and thinks it is ready to start
209			  normal driver operations again. There is no
210			  guarantee that the driver will actually be
211			  allowed to proceed, as another driver on the
212			  same segment might have failed and thus triggered a
213			  slot reset on platforms that support it.
214	
215			- PCI_ERS_RESULT_NEED_RESET
216			  Driver returns this if it thinks the device is not
217			  recoverable in its current state and it needs a slot
218			  reset to proceed.
219	
220			- PCI_ERS_RESULT_DISCONNECT
221			  Same as above. Total failure, no recovery even after
222			  reset driver dead. (To be defined more precisely)
223	
224	The next step taken depends on the results returned by the drivers.
225	If all drivers returned PCI_ERS_RESULT_RECOVERED, then the platform
226	proceeds to either STEP3 (Link Reset) or to STEP 5 (Resume Operations).
227	
228	If any driver returned PCI_ERS_RESULT_NEED_RESET, then the platform
229	proceeds to STEP 4 (Slot Reset)
230	
231	STEP 3: Link Reset
232	------------------
233	The platform resets the link.  This is a PCI-Express specific step
234	and is done whenever a fatal error has been detected that can be
235	"solved" by resetting the link.
236	
237	STEP 4: Slot Reset
238	------------------
239	
240	In response to a return value of PCI_ERS_RESULT_NEED_RESET, the
241	the platform will perform a slot reset on the requesting PCI device(s).
242	The actual steps taken by a platform to perform a slot reset
243	will be platform-dependent. Upon completion of slot reset, the
244	platform will call the device slot_reset() callback.
245	
246	Powerpc platforms implement two levels of slot reset:
247	soft reset(default) and fundamental(optional) reset.
248	
249	Powerpc soft reset consists of asserting the adapter #RST line and then
250	restoring the PCI BAR's and PCI configuration header to a state
251	that is equivalent to what it would be after a fresh system
252	power-on followed by power-on BIOS/system firmware initialization.
253	Soft reset is also known as hot-reset.
254	
255	Powerpc fundamental reset is supported by PCI Express cards only
256	and results in device's state machines, hardware logic, port states and
257	configuration registers to initialize to their default conditions.
258	
259	For most PCI devices, a soft reset will be sufficient for recovery.
260	Optional fundamental reset is provided to support a limited number
261	of PCI Express devices for which a soft reset is not sufficient
262	for recovery.
263	
264	If the platform supports PCI hotplug, then the reset might be
265	performed by toggling the slot electrical power off/on.
266	
267	It is important for the platform to restore the PCI config space
268	to the "fresh poweron" state, rather than the "last state". After
269	a slot reset, the device driver will almost always use its standard
270	device initialization routines, and an unusual config space setup
271	may result in hung devices, kernel panics, or silent data corruption.
272	
273	This call gives drivers the chance to re-initialize the hardware
274	(re-download firmware, etc.).  At this point, the driver may assume
275	that the card is in a fresh state and is fully functional. The slot
276	is unfrozen and the driver has full access to PCI config space,
277	memory mapped I/O space and DMA. Interrupts (Legacy, MSI, or MSI-X)
278	will also be available.
279	
280	Drivers should not restart normal I/O processing operations
281	at this point.  If all device drivers report success on this
282	callback, the platform will call resume() to complete the sequence,
283	and let the driver restart normal I/O processing.
284	
285	A driver can still return a critical failure for this function if
286	it can't get the device operational after reset.  If the platform
287	previously tried a soft reset, it might now try a hard reset (power
288	cycle) and then call slot_reset() again.  It the device still can't
289	be recovered, there is nothing more that can be done;  the platform
290	will typically report a "permanent failure" in such a case.  The
291	device will be considered "dead" in this case.
292	
293	Drivers for multi-function cards will need to coordinate among
294	themselves as to which driver instance will perform any "one-shot"
295	or global device initialization. For example, the Symbios sym53cxx2
296	driver performs device init only from PCI function 0:
297	
298	+       if (PCI_FUNC(pdev->devfn) == 0)
299	+               sym_reset_scsi_bus(np, 0);
300	
301		Result codes:
302			- PCI_ERS_RESULT_DISCONNECT
303			Same as above.
304	
305	Drivers for PCI Express cards that require a fundamental reset must
306	set the needs_freset bit in the pci_dev structure in their probe function.
307	For example, the QLogic qla2xxx driver sets the needs_freset bit for certain
308	PCI card types:
309	
310	+	/* Set EEH reset type to fundamental if required by hba  */
311	+	if (IS_QLA24XX(ha) || IS_QLA25XX(ha) || IS_QLA81XX(ha))
312	+		pdev->needs_freset = 1;
313	+
314	
315	Platform proceeds either to STEP 5 (Resume Operations) or STEP 6 (Permanent
316	Failure).
317	
318	>>> The current powerpc implementation does not try a power-cycle
319	>>> reset if the driver returned PCI_ERS_RESULT_DISCONNECT.
320	>>> However, it probably should.
321	
322	
323	STEP 5: Resume Operations
324	-------------------------
325	The platform will call the resume() callback on all affected device
326	drivers if all drivers on the segment have returned
327	PCI_ERS_RESULT_RECOVERED from one of the 3 previous callbacks.
328	The goal of this callback is to tell the driver to restart activity,
329	that everything is back and running. This callback does not return
330	a result code.
331	
332	At this point, if a new error happens, the platform will restart
333	a new error recovery sequence.
334	
335	STEP 6: Permanent Failure
336	-------------------------
337	A "permanent failure" has occurred, and the platform cannot recover
338	the device.  The platform will call error_detected() with a
339	pci_channel_state value of pci_channel_io_perm_failure.
340	
341	The device driver should, at this point, assume the worst. It should
342	cancel all pending I/O, refuse all new I/O, returning -EIO to
343	higher layers. The device driver should then clean up all of its
344	memory and remove itself from kernel operations, much as it would
345	during system shutdown.
346	
347	The platform will typically notify the system operator of the
348	permanent failure in some way.  If the device is hotplug-capable,
349	the operator will probably want to remove and replace the device.
350	Note, however, not all failures are truly "permanent". Some are
351	caused by over-heating, some by a poorly seated card. Many
352	PCI error events are caused by software bugs, e.g. DMA's to
353	wild addresses or bogus split transactions due to programming
354	errors. See the discussion in powerpc/eeh-pci-error-recovery.txt
355	for additional detail on real-life experience of the causes of
356	software errors.
357	
358	
359	Conclusion; General Remarks
360	---------------------------
361	The way the callbacks are called is platform policy. A platform with
362	no slot reset capability may want to just "ignore" drivers that can't
363	recover (disconnect them) and try to let other cards on the same segment
364	recover. Keep in mind that in most real life cases, though, there will
365	be only one driver per segment.
366	
367	Now, a note about interrupts. If you get an interrupt and your
368	device is dead or has been isolated, there is a problem :)
369	The current policy is to turn this into a platform policy.
370	That is, the recovery API only requires that:
371	
372	 - There is no guarantee that interrupt delivery can proceed from any
373	device on the segment starting from the error detection and until the
374	slot_reset callback is called, at which point interrupts are expected
375	to be fully operational.
376	
377	 - There is no guarantee that interrupt delivery is stopped, that is,
378	a driver that gets an interrupt after detecting an error, or that detects
379	an error within the interrupt handler such that it prevents proper
380	ack'ing of the interrupt (and thus removal of the source) should just
381	return IRQ_NOTHANDLED. It's up to the platform to deal with that
382	condition, typically by masking the IRQ source during the duration of
383	the error handling. It is expected that the platform "knows" which
384	interrupts are routed to error-management capable slots and can deal
385	with temporarily disabling that IRQ number during error processing (this
386	isn't terribly complex). That means some IRQ latency for other devices
387	sharing the interrupt, but there is simply no other way. High end
388	platforms aren't supposed to share interrupts between many devices
389	anyway :)
390	
391	>>> Implementation details for the powerpc platform are discussed in
392	>>> the file Documentation/powerpc/eeh-pci-error-recovery.txt
393	
394	>>> As of this writing, there is a growing list of device drivers with
395	>>> patches implementing error recovery. Not all of these patches are in
396	>>> mainline yet. These may be used as "examples":
397	>>>
398	>>> drivers/scsi/ipr
399	>>> drivers/scsi/sym53c8xx_2
400	>>> drivers/scsi/qla2xxx
401	>>> drivers/scsi/lpfc
402	>>> drivers/next/bnx2.c
403	>>> drivers/next/e100.c
404	>>> drivers/net/e1000
405	>>> drivers/net/e1000e
406	>>> drivers/net/ixgb
407	>>> drivers/net/ixgbe
408	>>> drivers/net/cxgb3
409	>>> drivers/net/s2io.c
410	>>> drivers/net/qlge
411	
412	The End
413	-------
Hide Line Numbers


About Kernel Documentation Linux Kernel Contact Linux Resources Linux Blog