1 .. SPDX-License-Identifier: GPL-2.0 2 3 ======= 4 SCSI EH 5 ======= 6 7 This document describes SCSI midlayer error handling infrastructure. 8 Please refer to Documentation/scsi/scsi_mid_low_api.rst for more 9 information regarding SCSI midlayer. 10 11 .. TABLE OF CONTENTS 12 13 [1] How SCSI commands travel through the midlayer and to EH 14 [1-1] struct scsi_cmnd 15 [1-2] How do scmd's get completed? 16 [1-2-1] Completing a scmd w/ scsi_done 17 [1-2-2] Completing a scmd w/ timeout 18 [1-3] How EH takes over 19 [2] How SCSI EH works 20 [2-1] EH through fine-grained callbacks 21 [2-1-1] Overview 22 [2-1-2] Flow of scmds through EH 23 [2-1-3] Flow of control 24 [2-2] EH through transportt->eh_strategy_handler() 25 [2-2-1] Pre transportt->eh_strategy_handler() SCSI midlayer conditions 26 [2-2-2] Post transportt->eh_strategy_handler() SCSI midlayer conditions 27 [2-2-3] Things to consider 28 29 30 1. How SCSI commands travel through the midlayer and to EH 31 ========================================================== 32 33 1.1 struct scsi_cmnd 34 -------------------- 35 36 Each SCSI command is represented with struct scsi_cmnd (== scmd). A 37 scmd has two list_head's to link itself into lists. The two are 38 scmd->list and scmd->eh_entry. The former is used for free list or 39 per-device allocated scmd list and not of much interest to this EH 40 discussion. The latter is used for completion and EH lists and unless 41 otherwise stated scmds are always linked using scmd->eh_entry in this 42 discussion. 43 44 45 1.2 How do scmd's get completed? 46 -------------------------------- 47 48 Once LLDD gets hold of a scmd, either the LLDD will complete the 49 command by calling scsi_done callback passed from midlayer when 50 invoking hostt->queuecommand() or the block layer will time it out. 51 52 53 1.2.1 Completing a scmd w/ scsi_done 54 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 55 56 For all non-EH commands, scsi_done() is the completion callback. It 57 just calls blk_complete_request() to delete the block layer timer and 58 raise SCSI_SOFTIRQ 59 60 SCSI_SOFTIRQ handler scsi_softirq calls scsi_decide_disposition() to 61 determine what to do with the command. scsi_decide_disposition() 62 looks at the scmd->result value and sense data to determine what to do 63 with the command. 64 65 - SUCCESS 66 67 scsi_finish_command() is invoked for the command. The 68 function does some maintenance chores and then calls 69 scsi_io_completion() to finish the I/O. 70 scsi_io_completion() then notifies the block layer on 71 the completed request by calling blk_end_request and 72 friends or figures out what to do with the remainder 73 of the data in case of an error. 74 75 - NEEDS_RETRY 76 77 - ADD_TO_MLQUEUE 78 79 scmd is requeued to blk queue. 80 81 - otherwise 82 83 scsi_eh_scmd_add(scmd) is invoked for the command. See 84 [1-3] for details of this function. 85 86 87 1.2.2 Completing a scmd w/ timeout 88 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 89 90 The timeout handler is scsi_timeout(). When a timeout occurs, this function 91 92 1. invokes optional hostt->eh_timed_out() callback. Return value can 93 be one of 94 95 - SCSI_EH_RESET_TIMER 96 This indicates that more time is required to finish the 97 command. Timer is restarted. 98 99 - SCSI_EH_NOT_HANDLED 100 eh_timed_out() callback did not handle the command. 101 Step #2 is taken. 102 103 - SCSI_EH_DONE 104 eh_timed_out() completed the command. 105 106 2. scsi_abort_command() is invoked to schedule an asynchronous abort which may 107 issue a retry scmd->allowed + 1 times. Asynchronous aborts are not invoked 108 for commands for which the SCSI_EH_ABORT_SCHEDULED flag is set (this 109 indicates that the command already had been aborted once, and this is a 110 retry which failed), when retries are exceeded, or when the EH deadline is 111 expired. In these cases Step #3 is taken. 112 113 3. scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD) is invoked for the 114 command. See [1-4] for more information. 115 116 1.3 Asynchronous command aborts 117 ------------------------------- 118 119 After a timeout occurs a command abort is scheduled from 120 scsi_abort_command(). If the abort is successful the command 121 will either be retried (if the number of retries is not exhausted) 122 or terminated with DID_TIME_OUT. 123 124 Otherwise scsi_eh_scmd_add() is invoked for the command. 125 See [1-4] for more information. 126 127 1.4 How EH takes over 128 --------------------- 129 130 scmds enter EH via scsi_eh_scmd_add(), which does the following. 131 132 1. Links scmd->eh_entry to shost->eh_cmd_q 133 134 2. Sets SHOST_RECOVERY bit in shost->shost_state 135 136 3. Increments shost->host_failed 137 138 4. Wakes up SCSI EH thread if shost->host_busy == shost->host_failed 139 140 As can be seen above, once any scmd is added to shost->eh_cmd_q, 141 SHOST_RECOVERY shost_state bit is turned on. This prevents any new 142 scmd to be issued from blk queue to the host; eventually, all scmds on 143 the host either complete normally, fail and get added to eh_cmd_q, or 144 time out and get added to shost->eh_cmd_q. 145 146 If all scmds either complete or fail, the number of in-flight scmds 147 becomes equal to the number of failed scmds - i.e. shost->host_busy == 148 shost->host_failed. This wakes up SCSI EH thread. So, once woken up, 149 SCSI EH thread can expect that all in-flight commands have failed and 150 are linked on shost->eh_cmd_q. 151 152 Note that this does not mean lower layers are quiescent. If a LLDD 153 completed a scmd with error status, the LLDD and lower layers are 154 assumed to forget about the scmd at that point. However, if a scmd 155 has timed out, unless hostt->eh_timed_out() made lower layers forget 156 about the scmd, which currently no LLDD does, the command is still 157 active as long as lower layers are concerned and completion could 158 occur at any time. Of course, all such completions are ignored as the 159 timer has already expired. 160 161 We'll talk about how SCSI EH takes actions to abort - make LLDD 162 forget about - timed out scmds later. 163 164 165 2. How SCSI EH works 166 ==================== 167 168 LLDD's can implement SCSI EH actions in one of the following two 169 ways. 170 171 - Fine-grained EH callbacks 172 LLDD can implement fine-grained EH callbacks and let SCSI 173 midlayer drive error handling and call appropriate callbacks. 174 This will be discussed further in [2-1]. 175 176 - eh_strategy_handler() callback 177 This is one big callback which should perform whole error 178 handling. As such, it should do all chores the SCSI midlayer 179 performs during recovery. This will be discussed in [2-2]. 180 181 Once recovery is complete, SCSI EH resumes normal operation by 182 calling scsi_restart_operations(), which 183 184 1. Checks if door locking is needed and locks door. 185 186 2. Clears SHOST_RECOVERY shost_state bit 187 188 3. Wakes up waiters on shost->host_wait. This occurs if someone 189 calls scsi_block_when_processing_errors() on the host. 190 (*QUESTION* why is it needed? All operations will be blocked 191 anyway after it reaches blk queue.) 192 193 4. Kicks queues in all devices on the host in the asses 194 195 196 2.1 EH through fine-grained callbacks 197 ------------------------------------- 198 199 2.1.1 Overview 200 ^^^^^^^^^^^^^^ 201 202 If eh_strategy_handler() is not present, SCSI midlayer takes charge 203 of driving error handling. EH's goals are two - make LLDD, host and 204 device forget about timed out scmds and make them ready for new 205 commands. A scmd is said to be recovered if the scmd is forgotten by 206 lower layers and lower layers are ready to process or fail the scmd 207 again. 208 209 To achieve these goals, EH performs recovery actions with increasing 210 severity. Some actions are performed by issuing SCSI commands and 211 others are performed by invoking one of the following fine-grained 212 hostt EH callbacks. Callbacks may be omitted and omitted ones are 213 considered to fail always. 214 215 :: 216 217 int (* eh_abort_handler)(struct scsi_cmnd *); 218 int (* eh_device_reset_handler)(struct scsi_cmnd *); 219 int (* eh_bus_reset_handler)(struct scsi_cmnd *); 220 int (* eh_host_reset_handler)(struct scsi_cmnd *); 221 222 Higher-severity actions are taken only when lower-severity actions 223 cannot recover some of failed scmds. Also, note that failure of the 224 highest-severity action means EH failure and results in offlining of 225 all unrecovered devices. 226 227 During recovery, the following rules are followed 228 229 - Recovery actions are performed on failed scmds on the to do list, 230 eh_work_q. If a recovery action succeeds for a scmd, recovered 231 scmds are removed from eh_work_q. 232 233 Note that single recovery action on a scmd can recover multiple 234 scmds. e.g. resetting a device recovers all failed scmds on the 235 device. 236 237 - Higher severity actions are taken iff eh_work_q is not empty after 238 lower severity actions are complete. 239 240 - EH reuses failed scmds to issue commands for recovery. For 241 timed-out scmds, SCSI EH ensures that LLDD forgets about a scmd 242 before reusing it for EH commands. 243 244 When a scmd is recovered, the scmd is moved from eh_work_q to EH 245 local eh_done_q using scsi_eh_finish_cmd(). After all scmds are 246 recovered (eh_work_q is empty), scsi_eh_flush_done_q() is invoked to 247 either retry or error-finish (notify upper layer of failure) recovered 248 scmds. 249 250 scmds are retried iff its sdev is still online (not offlined during 251 EH), REQ_FAILFAST is not set and ++scmd->retries is less than 252 scmd->allowed. 253 254 255 2.1.2 Flow of scmds through EH 256 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 257 258 1. Error completion / time out 259 260 :ACTION: scsi_eh_scmd_add() is invoked for scmd 261 262 - add scmd to shost->eh_cmd_q 263 - set SHOST_RECOVERY 264 - shost->host_failed++ 265 266 :LOCKING: shost->host_lock 267 268 2. EH starts 269 270 :ACTION: move all scmds to EH's local eh_work_q. shost->eh_cmd_q 271 is cleared. 272 273 :LOCKING: shost->host_lock (not strictly necessary, just for 274 consistency) 275 276 3. scmd recovered 277 278 :ACTION: scsi_eh_finish_cmd() is invoked to EH-finish scmd 279 280 - scsi_setup_cmd_retry() 281 - move from local eh_work_q to local eh_done_q 282 283 :LOCKING: none 284 285 :CONCURRENCY: at most one thread per separate eh_work_q to 286 keep queue manipulation lockless 287 288 4. EH completes 289 290 :ACTION: scsi_eh_flush_done_q() retries scmds or notifies upper 291 layer of failure. May be called concurrently but must have 292 a no more than one thread per separate eh_work_q to 293 manipulate the queue locklessly 294 295 - scmd is removed from eh_done_q and scmd->eh_entry is cleared 296 - if retry is necessary, scmd is requeued using 297 scsi_queue_insert() 298 - otherwise, scsi_finish_command() is invoked for scmd 299 - zero shost->host_failed 300 301 :LOCKING: queue or finish function performs appropriate locking 302 303 304 2.1.3 Flow of control 305 ^^^^^^^^^^^^^^^^^^^^^^ 306 307 EH through fine-grained callbacks start from scsi_unjam_host(). 308 309 ``scsi_unjam_host`` 310 311 1. Lock shost->host_lock, splice_init shost->eh_cmd_q into local 312 eh_work_q and unlock host_lock. Note that shost->eh_cmd_q is 313 cleared by this action. 314 315 2. Invoke scsi_eh_get_sense. 316 317 ``scsi_eh_get_sense`` 318 319 This action is taken for each error-completed 320 (!SCSI_EH_CANCEL_CMD) commands without valid sense data. Most 321 SCSI transports/LLDDs automatically acquire sense data on 322 command failures (autosense). Autosense is recommended for 323 performance reasons and as sense information could get out of 324 sync between occurrence of CHECK CONDITION and this action. 325 326 Note that if autosense is not supported, scmd->sense_buffer 327 contains invalid sense data when error-completing the scmd 328 with scsi_done(). scsi_decide_disposition() always returns 329 FAILED in such cases thus invoking SCSI EH. When the scmd 330 reaches here, sense data is acquired and 331 scsi_decide_disposition() is called again. 332 333 1. Invoke scsi_request_sense() which issues REQUEST_SENSE 334 command. If fails, no action. Note that taking no action 335 causes higher-severity recovery to be taken for the scmd. 336 337 2. Invoke scsi_decide_disposition() on the scmd 338 339 - SUCCESS 340 scmd->retries is set to scmd->allowed preventing 341 scsi_eh_flush_done_q() from retrying the scmd and 342 scsi_eh_finish_cmd() is invoked. 343 344 - NEEDS_RETRY 345 scsi_eh_finish_cmd() invoked 346 347 - otherwise 348 No action. 349 350 3. If !list_empty(&eh_work_q), invoke scsi_eh_abort_cmds(). 351 352 ``scsi_eh_abort_cmds`` 353 354 This action is taken for each timed out command when 355 no_async_abort is enabled in the host template. 356 hostt->eh_abort_handler() is invoked for each scmd. The 357 handler returns SUCCESS if it has succeeded to make LLDD and 358 all related hardware forget about the scmd. 359 360 If a timedout scmd is successfully aborted and the sdev is 361 either offline or ready, scsi_eh_finish_cmd() is invoked for 362 the scmd. Otherwise, the scmd is left in eh_work_q for 363 higher-severity actions. 364 365 Note that both offline and ready status mean that the sdev is 366 ready to process new scmds, where processing also implies 367 immediate failing; thus, if a sdev is in one of the two 368 states, no further recovery action is needed. 369 370 Device readiness is tested using scsi_eh_tur() which issues 371 TEST_UNIT_READY command. Note that the scmd must have been 372 aborted successfully before reusing it for TEST_UNIT_READY. 373 374 4. If !list_empty(&eh_work_q), invoke scsi_eh_ready_devs() 375 376 ``scsi_eh_ready_devs`` 377 378 This function takes four increasingly more severe measures to 379 make failed sdevs ready for new commands. 380 381 1. Invoke scsi_eh_stu() 382 383 ``scsi_eh_stu`` 384 385 For each sdev which has failed scmds with valid sense data 386 of which scsi_check_sense()'s verdict is FAILED, 387 START_STOP_UNIT command is issued w/ start=1. Note that 388 as we explicitly choose error-completed scmds, it is known 389 that lower layers have forgotten about the scmd and we can 390 reuse it for STU. 391 392 If STU succeeds and the sdev is either offline or ready, 393 all failed scmds on the sdev are EH-finished with 394 scsi_eh_finish_cmd(). 395 396 *NOTE* If hostt->eh_abort_handler() isn't implemented or 397 failed, we may still have timed out scmds at this point 398 and STU doesn't make lower layers forget about those 399 scmds. Yet, this function EH-finish all scmds on the sdev 400 if STU succeeds leaving lower layers in an inconsistent 401 state. It seems that STU action should be taken only when 402 a sdev has no timed out scmd. 403 404 2. If !list_empty(&eh_work_q), invoke scsi_eh_bus_device_reset(). 405 406 ``scsi_eh_bus_device_reset`` 407 408 This action is very similar to scsi_eh_stu() except that, 409 instead of issuing STU, hostt->eh_device_reset_handler() 410 is used. Also, as we're not issuing SCSI commands and 411 resetting clears all scmds on the sdev, there is no need 412 to choose error-completed scmds. 413 414 3. If !list_empty(&eh_work_q), invoke scsi_eh_bus_reset() 415 416 ``scsi_eh_bus_reset`` 417 418 hostt->eh_bus_reset_handler() is invoked for each channel 419 with failed scmds. If bus reset succeeds, all failed 420 scmds on all ready or offline sdevs on the channel are 421 EH-finished. 422 423 4. If !list_empty(&eh_work_q), invoke scsi_eh_host_reset() 424 425 ``scsi_eh_host_reset`` 426 427 This is the last resort. hostt->eh_host_reset_handler() 428 is invoked. If host reset succeeds, all failed scmds on 429 all ready or offline sdevs on the host are EH-finished. 430 431 5. If !list_empty(&eh_work_q), invoke scsi_eh_offline_sdevs() 432 433 ``scsi_eh_offline_sdevs`` 434 435 Take all sdevs which still have unrecovered scmds offline 436 and EH-finish the scmds. 437 438 5. Invoke scsi_eh_flush_done_q(). 439 440 ``scsi_eh_flush_done_q`` 441 442 At this point all scmds are recovered (or given up) and 443 put on eh_done_q by scsi_eh_finish_cmd(). This function 444 flushes eh_done_q by either retrying or notifying upper 445 layer of failure of the scmds. 446 447 448 2.2 EH through transportt->eh_strategy_handler() 449 ------------------------------------------------ 450 451 transportt->eh_strategy_handler() is invoked in the place of 452 scsi_unjam_host() and it is responsible for whole recovery process. 453 On completion, the handler should have made lower layers forget about 454 all failed scmds and either ready for new commands or offline. Also, 455 it should perform SCSI EH maintenance chores to maintain integrity of 456 SCSI midlayer. IOW, of the steps described in [2-1-2], all steps 457 except for #1 must be implemented by eh_strategy_handler(). 458 459 460 2.2.1 Pre transportt->eh_strategy_handler() SCSI midlayer conditions 461 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 462 463 The following conditions are true on entry to the handler. 464 465 - Each failed scmd's eh_flags field is set appropriately. 466 467 - Each failed scmd is linked on scmd->eh_cmd_q by scmd->eh_entry. 468 469 - SHOST_RECOVERY is set. 470 471 - shost->host_failed == shost->host_busy 472 473 474 2.2.2 Post transportt->eh_strategy_handler() SCSI midlayer conditions 475 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 476 477 The following conditions must be true on exit from the handler. 478 479 - shost->host_failed is zero. 480 481 - Each scmd is in such a state that scsi_setup_cmd_retry() on the 482 scmd doesn't make any difference. 483 484 - shost->eh_cmd_q is cleared. 485 486 - Each scmd->eh_entry is cleared. 487 488 - Either scsi_queue_insert() or scsi_finish_command() is called on 489 each scmd. Note that the handler is free to use scmd->retries and 490 ->allowed to limit the number of retries. 491 492 493 2.2.3 Things to consider 494 ^^^^^^^^^^^^^^^^^^^^^^^^ 495 496 - Know that timed out scmds are still active on lower layers. Make 497 lower layers forget about them before doing anything else with 498 those scmds. 499 500 - For consistency, when accessing/modifying shost data structure, 501 grab shost->host_lock. 502 503 - On completion, each failed sdev must have forgotten about all 504 active scmds. 505 506 - On completion, each failed sdev must be ready for new commands or 507 offline. 508 509 510 Tejun Heo 511 htejun@gmail.com 512 513 11th September 2005
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.