1 .. SPDX-License-Identifier: GPL-2.0
7 This document describes SCSI midlayer error handling infrastructure.
8 Please refer to Documentation/scsi/scsi_mid_low_api.rst for more
9 information regarding SCSI midlayer.
13 [1] How SCSI commands travel through the midlayer and to EH
14 [1-1] struct scsi_cmnd
15 [1-2] How do scmd's get completed?
16 [1-2-1] Completing a scmd w/ scsi_done
17 [1-2-2] Completing a scmd w/ timeout
18 [1-3] How EH takes over
20 [2-1] EH through fine-grained callbacks
22 [2-1-2] Flow of scmds through EH
23 [2-1-3] Flow of control
24 [2-2] EH through transportt->eh_strategy_handler()
25 [2-2-1] Pre transportt->eh_strategy_handler() SCSI midlayer conditions
26 [2-2-2] Post transportt->eh_strategy_handler() SCSI midlayer conditions
27 [2-2-3] Things to consider
30 1. How SCSI commands travel through the midlayer and to EH
31 ==========================================================
36 Each SCSI command is represented with struct scsi_cmnd (== scmd). A
37 scmd has two list_head's to link itself into lists. The two are
38 scmd->list and scmd->eh_entry. The former is used for free list or
39 per-device allocated scmd list and not of much interest to this EH
40 discussion. The latter is used for completion and EH lists and unless
41 otherwise stated scmds are always linked using scmd->eh_entry in this
45 1.2 How do scmd's get completed?
46 --------------------------------
48 Once LLDD gets hold of a scmd, either the LLDD will complete the
49 command by calling scsi_done callback passed from midlayer when
50 invoking hostt->queuecommand() or the block layer will time it out.
53 1.2.1 Completing a scmd w/ scsi_done
54 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
56 For all non-EH commands, scsi_done() is the completion callback. It
57 just calls blk_complete_request() to delete the block layer timer and
60 SCSI_SOFTIRQ handler scsi_softirq calls scsi_decide_disposition() to
61 determine what to do with the command. scsi_decide_disposition()
62 looks at the scmd->result value and sense data to determine what to do
67 scsi_finish_command() is invoked for the command. The
68 function does some maintenance chores and then calls
69 scsi_io_completion() to finish the I/O.
70 scsi_io_completion() then notifies the block layer on
71 the completed request by calling blk_end_request and
72 friends or figures out what to do with the remainder
73 of the data in case of an error.
79 scmd is requeued to blk queue.
83 scsi_eh_scmd_add(scmd) is invoked for the command. See
84 [1-3] for details of this function.
87 1.2.2 Completing a scmd w/ timeout
88 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
90 The timeout handler is scsi_times_out(). When a timeout occurs, this
93 1. invokes optional hostt->eh_timed_out() callback. Return value can
97 This indicates that more time is required to finish the
98 command. Timer is restarted.
101 eh_timed_out() callback did not handle the command.
104 2. scsi_abort_command() is invoked to schedule an asynchronous abort which may
105 issue a retry scmd->allowed + 1 times. Asynchronous aborts are not invoked
106 for commands for which the SCSI_EH_ABORT_SCHEDULED flag is set (this
107 indicates that the command already had been aborted once, and this is a
108 retry which failed), when retries are exceeded, or when the EH deadline is
109 expired. In these cases Step #3 is taken.
111 3. scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD) is invoked for the
112 command. See [1-4] for more information.
114 1.3 Asynchronous command aborts
115 -------------------------------
117 After a timeout occurs a command abort is scheduled from
118 scsi_abort_command(). If the abort is successful the command
119 will either be retried (if the number of retries is not exhausted)
120 or terminated with DID_TIME_OUT.
122 Otherwise scsi_eh_scmd_add() is invoked for the command.
123 See [1-4] for more information.
125 1.4 How EH takes over
126 ---------------------
128 scmds enter EH via scsi_eh_scmd_add(), which does the following.
130 1. Links scmd->eh_entry to shost->eh_cmd_q
132 2. Sets SHOST_RECOVERY bit in shost->shost_state
134 3. Increments shost->host_failed
136 4. Wakes up SCSI EH thread if shost->host_busy == shost->host_failed
138 As can be seen above, once any scmd is added to shost->eh_cmd_q,
139 SHOST_RECOVERY shost_state bit is turned on. This prevents any new
140 scmd to be issued from blk queue to the host; eventually, all scmds on
141 the host either complete normally, fail and get added to eh_cmd_q, or
142 time out and get added to shost->eh_cmd_q.
144 If all scmds either complete or fail, the number of in-flight scmds
145 becomes equal to the number of failed scmds - i.e. shost->host_busy ==
146 shost->host_failed. This wakes up SCSI EH thread. So, once woken up,
147 SCSI EH thread can expect that all in-flight commands have failed and
148 are linked on shost->eh_cmd_q.
150 Note that this does not mean lower layers are quiescent. If a LLDD
151 completed a scmd with error status, the LLDD and lower layers are
152 assumed to forget about the scmd at that point. However, if a scmd
153 has timed out, unless hostt->eh_timed_out() made lower layers forget
154 about the scmd, which currently no LLDD does, the command is still
155 active as long as lower layers are concerned and completion could
156 occur at any time. Of course, all such completions are ignored as the
157 timer has already expired.
159 We'll talk about how SCSI EH takes actions to abort - make LLDD
160 forget about - timed out scmds later.
166 LLDD's can implement SCSI EH actions in one of the following two
169 - Fine-grained EH callbacks
170 LLDD can implement fine-grained EH callbacks and let SCSI
171 midlayer drive error handling and call appropriate callbacks.
172 This will be discussed further in [2-1].
174 - eh_strategy_handler() callback
175 This is one big callback which should perform whole error
176 handling. As such, it should do all chores the SCSI midlayer
177 performs during recovery. This will be discussed in [2-2].
179 Once recovery is complete, SCSI EH resumes normal operation by
180 calling scsi_restart_operations(), which
182 1. Checks if door locking is needed and locks door.
184 2. Clears SHOST_RECOVERY shost_state bit
186 3. Wakes up waiters on shost->host_wait. This occurs if someone
187 calls scsi_block_when_processing_errors() on the host.
188 (*QUESTION* why is it needed? All operations will be blocked
189 anyway after it reaches blk queue.)
191 4. Kicks queues in all devices on the host in the asses
194 2.1 EH through fine-grained callbacks
195 -------------------------------------
200 If eh_strategy_handler() is not present, SCSI midlayer takes charge
201 of driving error handling. EH's goals are two - make LLDD, host and
202 device forget about timed out scmds and make them ready for new
203 commands. A scmd is said to be recovered if the scmd is forgotten by
204 lower layers and lower layers are ready to process or fail the scmd
207 To achieve these goals, EH performs recovery actions with increasing
208 severity. Some actions are performed by issuing SCSI commands and
209 others are performed by invoking one of the following fine-grained
210 hostt EH callbacks. Callbacks may be omitted and omitted ones are
211 considered to fail always.
215 int (* eh_abort_handler)(struct scsi_cmnd *);
216 int (* eh_device_reset_handler)(struct scsi_cmnd *);
217 int (* eh_bus_reset_handler)(struct scsi_cmnd *);
218 int (* eh_host_reset_handler)(struct scsi_cmnd *);
220 Higher-severity actions are taken only when lower-severity actions
221 cannot recover some of failed scmds. Also, note that failure of the
222 highest-severity action means EH failure and results in offlining of
223 all unrecovered devices.
225 During recovery, the following rules are followed
227 - Recovery actions are performed on failed scmds on the to do list,
228 eh_work_q. If a recovery action succeeds for a scmd, recovered
229 scmds are removed from eh_work_q.
231 Note that single recovery action on a scmd can recover multiple
232 scmds. e.g. resetting a device recovers all failed scmds on the
235 - Higher severity actions are taken iff eh_work_q is not empty after
236 lower severity actions are complete.
238 - EH reuses failed scmds to issue commands for recovery. For
239 timed-out scmds, SCSI EH ensures that LLDD forgets about a scmd
240 before reusing it for EH commands.
242 When a scmd is recovered, the scmd is moved from eh_work_q to EH
243 local eh_done_q using scsi_eh_finish_cmd(). After all scmds are
244 recovered (eh_work_q is empty), scsi_eh_flush_done_q() is invoked to
245 either retry or error-finish (notify upper layer of failure) recovered
248 scmds are retried iff its sdev is still online (not offlined during
249 EH), REQ_FAILFAST is not set and ++scmd->retries is less than
253 2.1.2 Flow of scmds through EH
254 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
256 1. Error completion / time out
258 :ACTION: scsi_eh_scmd_add() is invoked for scmd
260 - add scmd to shost->eh_cmd_q
262 - shost->host_failed++
264 :LOCKING: shost->host_lock
268 :ACTION: move all scmds to EH's local eh_work_q. shost->eh_cmd_q
271 :LOCKING: shost->host_lock (not strictly necessary, just for
276 :ACTION: scsi_eh_finish_cmd() is invoked to EH-finish scmd
278 - scsi_setup_cmd_retry()
279 - move from local eh_work_q to local eh_done_q
283 :CONCURRENCY: at most one thread per separate eh_work_q to
284 keep queue manipulation lockless
288 :ACTION: scsi_eh_flush_done_q() retries scmds or notifies upper
289 layer of failure. May be called concurrently but must have
290 a no more than one thread per separate eh_work_q to
291 manipulate the queue locklessly
293 - scmd is removed from eh_done_q and scmd->eh_entry is cleared
294 - if retry is necessary, scmd is requeued using
296 - otherwise, scsi_finish_command() is invoked for scmd
297 - zero shost->host_failed
299 :LOCKING: queue or finish function performs appropriate locking
302 2.1.3 Flow of control
303 ^^^^^^^^^^^^^^^^^^^^^^
305 EH through fine-grained callbacks start from scsi_unjam_host().
309 1. Lock shost->host_lock, splice_init shost->eh_cmd_q into local
310 eh_work_q and unlock host_lock. Note that shost->eh_cmd_q is
311 cleared by this action.
313 2. Invoke scsi_eh_get_sense.
315 ``scsi_eh_get_sense``
317 This action is taken for each error-completed
318 (!SCSI_EH_CANCEL_CMD) commands without valid sense data. Most
319 SCSI transports/LLDDs automatically acquire sense data on
320 command failures (autosense). Autosense is recommended for
321 performance reasons and as sense information could get out of
322 sync between occurrence of CHECK CONDITION and this action.
324 Note that if autosense is not supported, scmd->sense_buffer
325 contains invalid sense data when error-completing the scmd
326 with scsi_done(). scsi_decide_disposition() always returns
327 FAILED in such cases thus invoking SCSI EH. When the scmd
328 reaches here, sense data is acquired and
329 scsi_decide_disposition() is called again.
331 1. Invoke scsi_request_sense() which issues REQUEST_SENSE
332 command. If fails, no action. Note that taking no action
333 causes higher-severity recovery to be taken for the scmd.
335 2. Invoke scsi_decide_disposition() on the scmd
338 scmd->retries is set to scmd->allowed preventing
339 scsi_eh_flush_done_q() from retrying the scmd and
340 scsi_eh_finish_cmd() is invoked.
343 scsi_eh_finish_cmd() invoked
348 3. If !list_empty(&eh_work_q), invoke scsi_eh_abort_cmds().
350 ``scsi_eh_abort_cmds``
352 This action is taken for each timed out command when
353 no_async_abort is enabled in the host template.
354 hostt->eh_abort_handler() is invoked for each scmd. The
355 handler returns SUCCESS if it has succeeded to make LLDD and
356 all related hardware forget about the scmd.
358 If a timedout scmd is successfully aborted and the sdev is
359 either offline or ready, scsi_eh_finish_cmd() is invoked for
360 the scmd. Otherwise, the scmd is left in eh_work_q for
361 higher-severity actions.
363 Note that both offline and ready status mean that the sdev is
364 ready to process new scmds, where processing also implies
365 immediate failing; thus, if a sdev is in one of the two
366 states, no further recovery action is needed.
368 Device readiness is tested using scsi_eh_tur() which issues
369 TEST_UNIT_READY command. Note that the scmd must have been
370 aborted successfully before reusing it for TEST_UNIT_READY.
372 4. If !list_empty(&eh_work_q), invoke scsi_eh_ready_devs()
374 ``scsi_eh_ready_devs``
376 This function takes four increasingly more severe measures to
377 make failed sdevs ready for new commands.
379 1. Invoke scsi_eh_stu()
383 For each sdev which has failed scmds with valid sense data
384 of which scsi_check_sense()'s verdict is FAILED,
385 START_STOP_UNIT command is issued w/ start=1. Note that
386 as we explicitly choose error-completed scmds, it is known
387 that lower layers have forgotten about the scmd and we can
390 If STU succeeds and the sdev is either offline or ready,
391 all failed scmds on the sdev are EH-finished with
392 scsi_eh_finish_cmd().
394 *NOTE* If hostt->eh_abort_handler() isn't implemented or
395 failed, we may still have timed out scmds at this point
396 and STU doesn't make lower layers forget about those
397 scmds. Yet, this function EH-finish all scmds on the sdev
398 if STU succeeds leaving lower layers in an inconsistent
399 state. It seems that STU action should be taken only when
400 a sdev has no timed out scmd.
402 2. If !list_empty(&eh_work_q), invoke scsi_eh_bus_device_reset().
404 ``scsi_eh_bus_device_reset``
406 This action is very similar to scsi_eh_stu() except that,
407 instead of issuing STU, hostt->eh_device_reset_handler()
408 is used. Also, as we're not issuing SCSI commands and
409 resetting clears all scmds on the sdev, there is no need
410 to choose error-completed scmds.
412 3. If !list_empty(&eh_work_q), invoke scsi_eh_bus_reset()
414 ``scsi_eh_bus_reset``
416 hostt->eh_bus_reset_handler() is invoked for each channel
417 with failed scmds. If bus reset succeeds, all failed
418 scmds on all ready or offline sdevs on the channel are
421 4. If !list_empty(&eh_work_q), invoke scsi_eh_host_reset()
423 ``scsi_eh_host_reset``
425 This is the last resort. hostt->eh_host_reset_handler()
426 is invoked. If host reset succeeds, all failed scmds on
427 all ready or offline sdevs on the host are EH-finished.
429 5. If !list_empty(&eh_work_q), invoke scsi_eh_offline_sdevs()
431 ``scsi_eh_offline_sdevs``
433 Take all sdevs which still have unrecovered scmds offline
434 and EH-finish the scmds.
436 5. Invoke scsi_eh_flush_done_q().
438 ``scsi_eh_flush_done_q``
440 At this point all scmds are recovered (or given up) and
441 put on eh_done_q by scsi_eh_finish_cmd(). This function
442 flushes eh_done_q by either retrying or notifying upper
443 layer of failure of the scmds.
446 2.2 EH through transportt->eh_strategy_handler()
447 ------------------------------------------------
449 transportt->eh_strategy_handler() is invoked in the place of
450 scsi_unjam_host() and it is responsible for whole recovery process.
451 On completion, the handler should have made lower layers forget about
452 all failed scmds and either ready for new commands or offline. Also,
453 it should perform SCSI EH maintenance chores to maintain integrity of
454 SCSI midlayer. IOW, of the steps described in [2-1-2], all steps
455 except for #1 must be implemented by eh_strategy_handler().
458 2.2.1 Pre transportt->eh_strategy_handler() SCSI midlayer conditions
459 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
461 The following conditions are true on entry to the handler.
463 - Each failed scmd's eh_flags field is set appropriately.
465 - Each failed scmd is linked on scmd->eh_cmd_q by scmd->eh_entry.
467 - SHOST_RECOVERY is set.
469 - shost->host_failed == shost->host_busy
472 2.2.2 Post transportt->eh_strategy_handler() SCSI midlayer conditions
473 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
475 The following conditions must be true on exit from the handler.
477 - shost->host_failed is zero.
479 - Each scmd is in such a state that scsi_setup_cmd_retry() on the
480 scmd doesn't make any difference.
482 - shost->eh_cmd_q is cleared.
484 - Each scmd->eh_entry is cleared.
486 - Either scsi_queue_insert() or scsi_finish_command() is called on
487 each scmd. Note that the handler is free to use scmd->retries and
488 ->allowed to limit the number of retries.
491 2.2.3 Things to consider
492 ^^^^^^^^^^^^^^^^^^^^^^^^
494 - Know that timed out scmds are still active on lower layers. Make
495 lower layers forget about them before doing anything else with
498 - For consistency, when accessing/modifying shost data structure,
499 grab shost->host_lock.
501 - On completion, each failed sdev must have forgotten about all
504 - On completion, each failed sdev must be ready for new commands or