433 lines · plain
1.. SPDX-License-Identifier: GPL-2.02 3==================4PCI Error Recovery5==================6 7 8:Authors: - Linas Vepstas <linasvepstas@gmail.com>9 - Richard Lary <rlary@us.ibm.com>10 - Mike Mason <mmlnx@us.ibm.com>11 12 13Many PCI bus controllers are able to detect a variety of hardware14PCI errors on the bus, such as parity errors on the data and address15buses, as well as SERR and PERR errors. Some of the more advanced16chipsets are able to deal with these errors; these include PCI-E chipsets,17and the PCI-host bridges found on IBM Power4, Power5 and Power6-based18pSeries boxes. A typical action taken is to disconnect the affected device,19halting all I/O to it. The goal of a disconnection is to avoid system20corruption; for example, to halt system memory corruption due to DMAs21to "wild" addresses. Typically, a reconnection mechanism is also22offered, so that the affected PCI device(s) are reset and put back23into working condition. The reset phase requires coordination24between the affected device drivers and the PCI controller chip.25This document describes a generic API for notifying device drivers26of a bus disconnection, and then performing error recovery.27This API is currently implemented in the 2.6.16 and later kernels.28 29Reporting and recovery is performed in several steps. First, when30a PCI hardware error has resulted in a bus disconnect, that event31is reported as soon as possible to all affected device drivers,32including multiple instances of a device driver on multi-function33cards. This allows device drivers to avoid deadlocking in spinloops,34waiting for some i/o-space register to change, when it never will.35It also gives the drivers a chance to defer incoming I/O as36needed.37 38Next, recovery is performed in several stages. Most of the complexity39is forced by the need to handle multi-function devices, that is,40devices that have multiple device drivers associated with them.41In the first stage, each driver is allowed to indicate what type42of reset it desires, the choices being a simple re-enabling of I/O43or requesting a slot reset.44 45If any driver requests a slot reset, that is what will be done.46 47After a reset and/or a re-enabling of I/O, all drivers are48again notified, so that they may then perform any device setup/config49that may be required. After these have all completed, a final50"resume normal operations" event is sent out.51 52The biggest reason for choosing a kernel-based implementation rather53than a user-space implementation was the need to deal with bus54disconnects of PCI devices attached to storage media, and, in particular,55disconnects from devices holding the root file system. If the root56file system is disconnected, a user-space mechanism would have to go57through a large number of contortions to complete recovery. Almost all58of the current Linux file systems are not tolerant of disconnection59from/reconnection to their underlying block device. By contrast,60bus errors are easy to manage in the device driver. Indeed, most61device drivers already handle very similar recovery procedures;62for example, the SCSI-generic layer already provides significant63mechanisms for dealing with SCSI bus errors and SCSI bus resets.64 65 66Detailed Design67===============68 69Design and implementation details below, based on a chain of70public email discussions with Ben Herrenschmidt, circa 5 April 2005.71 72The error recovery API support is exposed to the driver in the form of73a structure of function pointers pointed to by a new field in struct74pci_driver. A driver that fails to provide the structure is "non-aware",75and the actual recovery steps taken are platform dependent. The76arch/powerpc implementation will simulate a PCI hotplug remove/add.77 78This structure has the form::79 80 struct pci_error_handlers81 {82 int (*error_detected)(struct pci_dev *dev, pci_channel_state_t);83 int (*mmio_enabled)(struct pci_dev *dev);84 int (*slot_reset)(struct pci_dev *dev);85 void (*resume)(struct pci_dev *dev);86 void (*cor_error_detected)(struct pci_dev *dev);87 };88 89The possible channel states are::90 91 typedef enum {92 pci_channel_io_normal, /* I/O channel is in normal state */93 pci_channel_io_frozen, /* I/O to channel is blocked */94 pci_channel_io_perm_failure, /* PCI card is dead */95 } pci_channel_state_t;96 97Possible return values are::98 99 enum pci_ers_result {100 PCI_ERS_RESULT_NONE, /* no result/none/not supported in device driver */101 PCI_ERS_RESULT_CAN_RECOVER, /* Device driver can recover without slot reset */102 PCI_ERS_RESULT_NEED_RESET, /* Device driver wants slot to be reset. */103 PCI_ERS_RESULT_DISCONNECT, /* Device has completely failed, is unrecoverable */104 PCI_ERS_RESULT_RECOVERED, /* Device driver is fully recovered and operational */105 };106 107A driver does not have to implement all of these callbacks; however,108if it implements any, it must implement error_detected(). If a callback109is not implemented, the corresponding feature is considered unsupported.110For example, if mmio_enabled() and resume() aren't there, then it111is assumed that the driver is not doing any direct recovery and requires112a slot reset. Typically a driver will want to know about113a slot_reset().114 115The actual steps taken by a platform to recover from a PCI error116event will be platform-dependent, but will follow the general117sequence described below.118 119STEP 0: Error Event120-------------------121A PCI bus error is detected by the PCI hardware. On powerpc, the slot122is isolated, in that all I/O is blocked: all reads return 0xffffffff,123all writes are ignored.124 125 126STEP 1: Notification127--------------------128Platform calls the error_detected() callback on every instance of129every driver affected by the error.130 131At this point, the device might not be accessible anymore, depending on132the platform (the slot will be isolated on powerpc). The driver may133already have "noticed" the error because of a failing I/O, but this134is the proper "synchronization point", that is, it gives the driver135a chance to cleanup, waiting for pending stuff (timers, whatever, etc...)136to complete; it can take semaphores, schedule, etc... everything but137touch the device. Within this function and after it returns, the driver138shouldn't do any new IOs. Called in task context. This is sort of a139"quiesce" point. See note about interrupts at the end of this doc.140 141All drivers participating in this system must implement this call.142The driver must return one of the following result codes:143 144 - PCI_ERS_RESULT_CAN_RECOVER145 Driver returns this if it thinks it might be able to recover146 the HW by just banging IOs or if it wants to be given147 a chance to extract some diagnostic information (see148 mmio_enable, below).149 - PCI_ERS_RESULT_NEED_RESET150 Driver returns this if it can't recover without a151 slot reset.152 - PCI_ERS_RESULT_DISCONNECT153 Driver returns this if it doesn't want to recover at all.154 155The next step taken will depend on the result codes returned by the156drivers.157 158If all drivers on the segment/slot return PCI_ERS_RESULT_CAN_RECOVER,159then the platform should re-enable IOs on the slot (or do nothing in160particular, if the platform doesn't isolate slots), and recovery161proceeds to STEP 2 (MMIO Enable).162 163If any driver requested a slot reset (by returning PCI_ERS_RESULT_NEED_RESET),164then recovery proceeds to STEP 4 (Slot Reset).165 166If the platform is unable to recover the slot, the next step167is STEP 6 (Permanent Failure).168 169.. note::170 171 The current powerpc implementation assumes that a device driver will172 *not* schedule or semaphore in this routine; the current powerpc173 implementation uses one kernel thread to notify all devices;174 thus, if one device sleeps/schedules, all devices are affected.175 Doing better requires complex multi-threaded logic in the error176 recovery implementation (e.g. waiting for all notification threads177 to "join" before proceeding with recovery.) This seems excessively178 complex and not worth implementing.179 180 The current powerpc implementation doesn't much care if the device181 attempts I/O at this point, or not. I/Os will fail, returning182 a value of 0xff on read, and writes will be dropped. If more than183 EEH_MAX_FAILS I/Os are attempted to a frozen adapter, EEH184 assumes that the device driver has gone into an infinite loop185 and prints an error to syslog. A reboot is then required to186 get the device working again.187 188STEP 2: MMIO Enabled189--------------------190The platform re-enables MMIO to the device (but typically not the191DMA), and then calls the mmio_enabled() callback on all affected192device drivers.193 194This is the "early recovery" call. IOs are allowed again, but DMA is195not, with some restrictions. This is NOT a callback for the driver to196start operations again, only to peek/poke at the device, extract diagnostic197information, if any, and eventually do things like trigger a device local198reset or some such, but not restart operations. This callback is made if199all drivers on a segment agree that they can try to recover and if no automatic200link reset was performed by the HW. If the platform can't just re-enable IOs201without a slot reset or a link reset, it will not call this callback, and202instead will have gone directly to STEP 3 (Link Reset) or STEP 4 (Slot Reset)203 204.. note::205 206 The following is proposed; no platform implements this yet:207 Proposal: All I/Os should be done _synchronously_ from within208 this callback, errors triggered by them will be returned via209 the normal pci_check_whatever() API, no new error_detected()210 callback will be issued due to an error happening here. However,211 such an error might cause IOs to be re-blocked for the whole212 segment, and thus invalidate the recovery that other devices213 on the same segment might have done, forcing the whole segment214 into one of the next states, that is, link reset or slot reset.215 216The driver should return one of the following result codes:217 - PCI_ERS_RESULT_RECOVERED218 Driver returns this if it thinks the device is fully219 functional and thinks it is ready to start220 normal driver operations again. There is no221 guarantee that the driver will actually be222 allowed to proceed, as another driver on the223 same segment might have failed and thus triggered a224 slot reset on platforms that support it.225 226 - PCI_ERS_RESULT_NEED_RESET227 Driver returns this if it thinks the device is not228 recoverable in its current state and it needs a slot229 reset to proceed.230 231 - PCI_ERS_RESULT_DISCONNECT232 Same as above. Total failure, no recovery even after233 reset driver dead. (To be defined more precisely)234 235The next step taken depends on the results returned by the drivers.236If all drivers returned PCI_ERS_RESULT_RECOVERED, then the platform237proceeds to either STEP3 (Link Reset) or to STEP 5 (Resume Operations).238 239If any driver returned PCI_ERS_RESULT_NEED_RESET, then the platform240proceeds to STEP 4 (Slot Reset)241 242STEP 3: Link Reset243------------------244The platform resets the link. This is a PCI-Express specific step245and is done whenever a fatal error has been detected that can be246"solved" by resetting the link.247 248STEP 4: Slot Reset249------------------250 251In response to a return value of PCI_ERS_RESULT_NEED_RESET, the252platform will perform a slot reset on the requesting PCI device(s).253The actual steps taken by a platform to perform a slot reset254will be platform-dependent. Upon completion of slot reset, the255platform will call the device slot_reset() callback.256 257Powerpc platforms implement two levels of slot reset:258soft reset(default) and fundamental(optional) reset.259 260Powerpc soft reset consists of asserting the adapter #RST line and then261restoring the PCI BARs and PCI configuration header to a state262that is equivalent to what it would be after a fresh system263power-on followed by power-on BIOS/system firmware initialization.264Soft reset is also known as hot-reset.265 266Powerpc fundamental reset is supported by PCI Express cards only267and results in device's state machines, hardware logic, port states and268configuration registers to initialize to their default conditions.269 270For most PCI devices, a soft reset will be sufficient for recovery.271Optional fundamental reset is provided to support a limited number272of PCI Express devices for which a soft reset is not sufficient273for recovery.274 275If the platform supports PCI hotplug, then the reset might be276performed by toggling the slot electrical power off/on.277 278It is important for the platform to restore the PCI config space279to the "fresh poweron" state, rather than the "last state". After280a slot reset, the device driver will almost always use its standard281device initialization routines, and an unusual config space setup282may result in hung devices, kernel panics, or silent data corruption.283 284This call gives drivers the chance to re-initialize the hardware285(re-download firmware, etc.). At this point, the driver may assume286that the card is in a fresh state and is fully functional. The slot287is unfrozen and the driver has full access to PCI config space,288memory mapped I/O space and DMA. Interrupts (Legacy, MSI, or MSI-X)289will also be available.290 291Drivers should not restart normal I/O processing operations292at this point. If all device drivers report success on this293callback, the platform will call resume() to complete the sequence,294and let the driver restart normal I/O processing.295 296A driver can still return a critical failure for this function if297it can't get the device operational after reset. If the platform298previously tried a soft reset, it might now try a hard reset (power299cycle) and then call slot_reset() again. If the device still can't300be recovered, there is nothing more that can be done; the platform301will typically report a "permanent failure" in such a case. The302device will be considered "dead" in this case.303 304Drivers for multi-function cards will need to coordinate among305themselves as to which driver instance will perform any "one-shot"306or global device initialization. For example, the Symbios sym53cxx2307driver performs device init only from PCI function 0::308 309 + if (PCI_FUNC(pdev->devfn) == 0)310 + sym_reset_scsi_bus(np, 0);311 312Result codes:313 - PCI_ERS_RESULT_DISCONNECT314 Same as above.315 316Drivers for PCI Express cards that require a fundamental reset must317set the needs_freset bit in the pci_dev structure in their probe function.318For example, the QLogic qla2xxx driver sets the needs_freset bit for certain319PCI card types::320 321 + /* Set EEH reset type to fundamental if required by hba */322 + if (IS_QLA24XX(ha) || IS_QLA25XX(ha) || IS_QLA81XX(ha))323 + pdev->needs_freset = 1;324 +325 326Platform proceeds either to STEP 5 (Resume Operations) or STEP 6 (Permanent327Failure).328 329.. note::330 331 The current powerpc implementation does not try a power-cycle332 reset if the driver returned PCI_ERS_RESULT_DISCONNECT.333 However, it probably should.334 335 336STEP 5: Resume Operations337-------------------------338The platform will call the resume() callback on all affected device339drivers if all drivers on the segment have returned340PCI_ERS_RESULT_RECOVERED from one of the 3 previous callbacks.341The goal of this callback is to tell the driver to restart activity,342that everything is back and running. This callback does not return343a result code.344 345At this point, if a new error happens, the platform will restart346a new error recovery sequence.347 348STEP 6: Permanent Failure349-------------------------350A "permanent failure" has occurred, and the platform cannot recover351the device. The platform will call error_detected() with a352pci_channel_state_t value of pci_channel_io_perm_failure.353 354The device driver should, at this point, assume the worst. It should355cancel all pending I/O, refuse all new I/O, returning -EIO to356higher layers. The device driver should then clean up all of its357memory and remove itself from kernel operations, much as it would358during system shutdown.359 360The platform will typically notify the system operator of the361permanent failure in some way. If the device is hotplug-capable,362the operator will probably want to remove and replace the device.363Note, however, not all failures are truly "permanent". Some are364caused by over-heating, some by a poorly seated card. Many365PCI error events are caused by software bugs, e.g. DMAs to366wild addresses or bogus split transactions due to programming367errors. See the discussion in Documentation/arch/powerpc/eeh-pci-error-recovery.rst368for additional detail on real-life experience of the causes of369software errors.370 371 372Conclusion; General Remarks373---------------------------374The way the callbacks are called is platform policy. A platform with375no slot reset capability may want to just "ignore" drivers that can't376recover (disconnect them) and try to let other cards on the same segment377recover. Keep in mind that in most real life cases, though, there will378be only one driver per segment.379 380Now, a note about interrupts. If you get an interrupt and your381device is dead or has been isolated, there is a problem :)382The current policy is to turn this into a platform policy.383That is, the recovery API only requires that:384 385 - There is no guarantee that interrupt delivery can proceed from any386 device on the segment starting from the error detection and until the387 slot_reset callback is called, at which point interrupts are expected388 to be fully operational.389 390 - There is no guarantee that interrupt delivery is stopped, that is,391 a driver that gets an interrupt after detecting an error, or that detects392 an error within the interrupt handler such that it prevents proper393 ack'ing of the interrupt (and thus removal of the source) should just394 return IRQ_NOTHANDLED. It's up to the platform to deal with that395 condition, typically by masking the IRQ source during the duration of396 the error handling. It is expected that the platform "knows" which397 interrupts are routed to error-management capable slots and can deal398 with temporarily disabling that IRQ number during error processing (this399 isn't terribly complex). That means some IRQ latency for other devices400 sharing the interrupt, but there is simply no other way. High end401 platforms aren't supposed to share interrupts between many devices402 anyway :)403 404.. note::405 406 Implementation details for the powerpc platform are discussed in407 the file Documentation/arch/powerpc/eeh-pci-error-recovery.rst408 409 As of this writing, there is a growing list of device drivers with410 patches implementing error recovery. Not all of these patches are in411 mainline yet. These may be used as "examples":412 413 - drivers/scsi/ipr414 - drivers/scsi/sym53c8xx_2415 - drivers/scsi/qla2xxx416 - drivers/scsi/lpfc417 - drivers/next/bnx2.c418 - drivers/next/e100.c419 - drivers/net/e1000420 - drivers/net/e1000e421 - drivers/net/ixgbe422 - drivers/net/cxgb3423 - drivers/net/s2io.c424 425 The cor_error_detected() callback is invoked in handle_error_source() when426 the error severity is "correctable". The callback is optional and allows427 additional logging to be done if desired. See example:428 429 - drivers/cxl/pci.c430 431The End432-------433