Documentation/scsi/scsi_eh.txt

   1
   2 SCSI EH
   3 ======================================
   4
   5  This document describes SCSI midlayer error handling infrastructure.
   6 Please refer to Documentation/scsi/scsi_mid_low_api.txt for more
   7 information regarding SCSI midlayer.
   8
   9 TABLE OF CONTENTS
  10
  11 [1] How SCSI commands travel through the midlayer and to EH
  12     [1-1] struct scsi_cmnd
  13     [1-2] How do scmd's get completed?
  14         [1-2-1] Completing a scmd w/ scsi_done
  15         [1-2-2] Completing a scmd w/ timeout
  16     [1-3] How EH takes over
  17 [2] How SCSI EH works
  18     [2-1] EH through fine-grained callbacks
  19         [2-1-1] Overview
  20         [2-1-2] Flow of scmds through EH
  21         [2-1-3] Flow of control
  22     [2-2] EH through transportt->eh_strategy_handler()
  23         [2-2-1] Pre transportt->eh_strategy_handler() SCSI midlayer conditions
  24         [2-2-2] Post transportt->eh_strategy_handler() SCSI midlayer conditions
  25         [2-2-3] Things to consider
  26
  27
  28 [1] How SCSI commands travel through the midlayer and to EH
  29
  30 [1-1] struct scsi_cmnd
  31
  32  Each SCSI command is represented with struct scsi_cmnd (== scmd).  A
  33 scmd has two list_head's to link itself into lists.  The two are
  34 scmd->list and scmd->eh_entry.  The former is used for free list or
  35 per-device allocated scmd list and not of much interest to this EH
  36 discussion.  The latter is used for completion and EH lists and unless
  37 otherwise stated scmds are always linked using scmd->eh_entry in this
  38 discussion.
  39
  40
  41 [1-2] How do scmd's get completed?
  42
  43  Once LLDD gets hold of a scmd, either the LLDD will complete the
  44 command by calling scsi_done callback passed from midlayer when
  45 invoking hostt->queuecommand() or SCSI midlayer will time it out.
  46
  47
  48 [1-2-1] Completing a scmd w/ scsi_done
  49
  50  For all non-EH commands, scsi_done() is the completion callback.  It
  51 does the following.
  52
  53  1. Delete timeout timer.  If it fails, it means that timeout timer
  54     has expired and is going to finish the command.  Just return.
  55
  56  2. Link scmd to per-cpu scsi_done_q using scmd->en_entry
  57
  58  3. Raise SCSI_SOFTIRQ
  59
  60  SCSI_SOFTIRQ handler scsi_softirq calls scsi_decide_disposition() to
  61 determine what to do with the command.  scsi_decide_disposition()
  62 looks at the scmd->result value and sense data to determine what to do
  63 with the command.
  64
  65  - SUCCESS
  66         scsi_finish_command() is invoked for the command.  The
  67         function does some maintenance choirs and notify completion by
  68         calling scmd->done() callback, which, for fs requests, would
  69         be HLD completion callback - sd:sd_rw_intr, sr:rw_intr,
  70         st:st_intr.
  71
  72  - NEEDS_RETRY
  73  - ADD_TO_MLQUEUE
  74         scmd is requeued to blk queue.
  75
  76  - otherwise
  77         scsi_eh_scmd_add(scmd, 0) is invoked for the command.  See
  78         [1-3] for details of this function.
  79
  80
  81 [1-2-2] Completing a scmd w/ timeout
  82
  83  The timeout handler is scsi_times_out().  When a timeout occurs, this
  84 function
  85
  86  1. invokes optional hostt->eh_timed_out() callback.  Return value can
  87     be one of
  88
  89     - EH_HANDLED
  90         This indicates that eh_timed_out() dealt with the timeout.  The
  91         scmd is passed to __scsi_done() and thus linked into per-cpu
  92         scsi_done_q.  Normal command completion described in [1-2-1]
  93         follows.
  94
  95     - EH_RESET_TIMER
  96         This indicates that more time is required to finish the
  97         command.  Timer is restarted.  This action is counted as a
  98         retry and only allowed scmd->allowed + 1(!) times.  Once the
  99         limit is reached, action for EH_NOT_HANDLED is taken instead.
 100
 101         *NOTE* This action is racy as the LLDD could finish the scmd
 102         after the timeout has expired but before it's added back.  In
 103         such cases, scsi_done() would think that timeout has occurred
 104         and return without doing anything.  We lose completion and the
 105         command will time out again.
 106
 107     - EH_NOT_HANDLED
 108         This is the same as when eh_timed_out() callback doesn't exist.
 109         Step #2 is taken.
 110
 111  2. scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD) is invoked for the
 112     command.  See [1-3] for more information.
 113
 114
 115 [1-3] How EH takes over
 116
 117  scmds enter EH via scsi_eh_scmd_add(), which does the following.
 118
 119  1. Turns on scmd->eh_eflags as requested.  It's 0 for error
 120     completions and SCSI_EH_CANCEL_CMD for timeouts.
 121
 122  2. Links scmd->eh_entry to shost->eh_cmd_q
 123
 124  3. Sets SHOST_RECOVERY bit in shost->shost_state
 125
 126  4. Increments shost->host_failed
 127
 128  5. Wakes up SCSI EH thread if shost->host_busy == shost->host_failed
 129
 130  As can be seen above, once any scmd is added to shost->eh_cmd_q,
 131 SHOST_RECOVERY shost_state bit is turned on.  This prevents any new
 132 scmd to be issued from blk queue to the host; eventually, all scmds on
 133 the host either complete normally, fail and get added to eh_cmd_q, or
 134 time out and get added to shost->eh_cmd_q.
 135
 136  If all scmds either complete or fail, the number of in-flight scmds
 137 becomes equal to the number of failed scmds - i.e. shost->host_busy ==
 138 shost->host_failed.  This wakes up SCSI EH thread.  So, once woken up,
 139 SCSI EH thread can expect that all in-flight commands have failed and
 140 are linked on shost->eh_cmd_q.
 141
 142  Note that this does not mean lower layers are quiescent.  If a LLDD
 143 completed a scmd with error status, the LLDD and lower layers are
 144 assumed to forget about the scmd at that point.  However, if a scmd
 145 has timed out, unless hostt->eh_timed_out() made lower layers forget
 146 about the scmd, which currently no LLDD does, the command is still
 147 active as long as lower layers are concerned and completion could
 148 occur at any time.  Of course, all such completions are ignored as the
 149 timer has already expired.
 150
 151  We'll talk about how SCSI EH takes actions to abort - make LLDD
 152 forget about - timed out scmds later.
 153
 154
 155 [2] How SCSI EH works
 156
 157  LLDD's can implement SCSI EH actions in one of the following two
 158 ways.
 159
 160  - Fine-grained EH callbacks
 161         LLDD can implement fine-grained EH callbacks and let SCSI
 162         midlayer drive error handling and call appropriate callbacks.
 163         This will be discussed further in [2-1].
 164
 165  - eh_strategy_handler() callback
 166         This is one big callback which should perform whole error
 167         handling.  As such, it should do all choirs SCSI midlayer
 168         performs during recovery.  This will be discussed in [2-2].
 169
 170  Once recovery is complete, SCSI EH resumes normal operation by
 171 calling scsi_restart_operations(), which
 172
 173  1. Checks if door locking is needed and locks door.
 174
 175  2. Clears SHOST_RECOVERY shost_state bit
 176
 177  3. Wakes up waiters on shost->host_wait.  This occurs if someone
 178     calls scsi_block_when_processing_errors() on the host.
 179     (*QUESTION* why is it needed?  All operations will be blocked
 180     anyway after it reaches blk queue.)
 181
 182  4. Kicks queues in all devices on the host in the asses
 183
 184
 185 [2-1] EH through fine-grained callbacks
 186
 187 [2-1-1] Overview
 188
 189  If eh_strategy_handler() is not present, SCSI midlayer takes charge
 190 of driving error handling.  EH's goals are two - make LLDD, host and
 191 device forget about timed out scmds and make them ready for new
 192 commands.  A scmd is said to be recovered if the scmd is forgotten by
 193 lower layers and lower layers are ready to process or fail the scmd
 194 again.
 195
 196  To achieve these goals, EH performs recovery actions with increasing
 197 severity.  Some actions are performed by issuing SCSI commands and
 198 others are performed by invoking one of the following fine-grained
 199 hostt EH callbacks.  Callbacks may be omitted and omitted ones are
 200 considered to fail always.
 201
 202 int (* eh_abort_handler)(struct scsi_cmnd *);
 203 int (* eh_device_reset_handler)(struct scsi_cmnd *);
 204 int (* eh_bus_reset_handler)(struct scsi_cmnd *);
 205 int (* eh_host_reset_handler)(struct scsi_cmnd *);
 206
 207  Higher-severity actions are taken only when lower-severity actions
 208 cannot recover some of failed scmds.  Also, note that failure of the
 209 highest-severity action means EH failure and results in offlining of
 210 all unrecovered devices.
 211
 212  During recovery, the following rules are followed
 213
 214  - Recovery actions are performed on failed scmds on the to do list,
 215    eh_work_q.  If a recovery action succeeds for a scmd, recovered
 216    scmds are removed from eh_work_q.
 217
 218    Note that single recovery action on a scmd can recover multiple
 219    scmds.  e.g. resetting a device recovers all failed scmds on the
 220    device.
 221
 222  - Higher severity actions are taken iff eh_work_q is not empty after
 223    lower severity actions are complete.
 224
 225  - EH reuses failed scmds to issue commands for recovery.  For
 226    timed-out scmds, SCSI EH ensures that LLDD forgets about a scmd
 227    before reusing it for EH commands.
 228
 229  When a scmd is recovered, the scmd is moved from eh_work_q to EH
 230 local eh_done_q using scsi_eh_finish_cmd().  After all scmds are
 231 recovered (eh_work_q is empty), scsi_eh_flush_done_q() is invoked to
 232 either retry or error-finish (notify upper layer of failure) recovered
 233 scmds.
 234
 235  scmds are retried iff its sdev is still online (not offlined during
 236 EH), REQ_FAILFAST is not set and ++scmd->retries is less than
 237 scmd->allowed.
 238
 239
 240 [2-1-2] Flow of scmds through EH
 241
 242  1. Error completion / time out
 243     ACTION: scsi_eh_scmd_add() is invoked for scmd
 244         - set scmd->eh_eflags
 245         - add scmd to shost->eh_cmd_q
 246         - set SHOST_RECOVERY
 247         - shost->host_failed++
 248     LOCKING: shost->host_lock
 249
 250  2. EH starts
 251     ACTION: move all scmds to EH's local eh_work_q.  shost->eh_cmd_q
 252             is cleared.
 253     LOCKING: shost->host_lock (not strictly necessary, just for
 254              consistency)
 255
 256  3. scmd recovered
 257     ACTION: scsi_eh_finish_cmd() is invoked to EH-finish scmd
 258         - clear scmd->eh_eflags
 259         - scsi_setup_cmd_retry()
 260         - move from local eh_work_q to local eh_done_q
 261     LOCKING: none
 262     CONCURRENCY: at most one thread per separate eh_work_q to
 263                  keep queue manipulation lockless
 264
 265  4. EH completes
 266     ACTION: scsi_eh_flush_done_q() retries scmds or notifies upper
 267             layer of failure. May be called concurrently but must have
 268             a no more than one thread per separate eh_work_q to
 269             manipulate the queue locklessly
 270         - scmd is removed from eh_done_q and scmd->eh_entry is cleared
 271         - if retry is necessary, scmd is requeued using
 272           scsi_queue_insert()
 273         - otherwise, scsi_finish_command() is invoked for scmd
 274         - zero shost->host_failed
 275     LOCKING: queue or finish function performs appropriate locking
 276
 277
 278 [2-1-3] Flow of control
 279
 280  EH through fine-grained callbacks start from scsi_unjam_host().
 281
 282 <<scsi_unjam_host>>
 283
 284     1. Lock shost->host_lock, splice_init shost->eh_cmd_q into local
 285        eh_work_q and unlock host_lock.  Note that shost->eh_cmd_q is
 286        cleared by this action.
 287
 288     2. Invoke scsi_eh_get_sense.
 289
 290     <<scsi_eh_get_sense>>
 291
 292         This action is taken for each error-completed
 293         (!SCSI_EH_CANCEL_CMD) commands without valid sense data.  Most
 294         SCSI transports/LLDDs automatically acquire sense data on
 295         command failures (autosense).  Autosense is recommended for
 296         performance reasons and as sense information could get out of
 297         sync between occurrence of CHECK CONDITION and this action.
 298
 299         Note that if autosense is not supported, scmd->sense_buffer
 300         contains invalid sense data when error-completing the scmd
 301         with scsi_done().  scsi_decide_disposition() always returns
 302         FAILED in such cases thus invoking SCSI EH.  When the scmd
 303         reaches here, sense data is acquired and
 304         scsi_decide_disposition() is called again.
 305
 306         1. Invoke scsi_request_sense() which issues REQUEST_SENSE
 307            command.  If fails, no action.  Note that taking no action
 308            causes higher-severity recovery to be taken for the scmd.
 309
 310         2. Invoke scsi_decide_disposition() on the scmd
 311
 312            - SUCCESS
 313                 scmd->retries is set to scmd->allowed preventing
 314                 scsi_eh_flush_done_q() from retrying the scmd and
 315                 scsi_eh_finish_cmd() is invoked.
 316
 317            - NEEDS_RETRY
 318                 scsi_eh_finish_cmd() invoked
 319
 320            - otherwise
 321                 No action.
 322
 323     3. If !list_empty(&eh_work_q), invoke scsi_eh_abort_cmds().
 324
 325     <<scsi_eh_abort_cmds>>
 326
 327         This action is taken for each timed out command.
 328         hostt->eh_abort_handler() is invoked for each scmd.  The
 329         handler returns SUCCESS if it has succeeded to make LLDD and
 330         all related hardware forget about the scmd.
 331
 332         If a timedout scmd is successfully aborted and the sdev is
 333         either offline or ready, scsi_eh_finish_cmd() is invoked for
 334         the scmd.  Otherwise, the scmd is left in eh_work_q for
 335         higher-severity actions.
 336
 337         Note that both offline and ready status mean that the sdev is
 338         ready to process new scmds, where processing also implies
 339         immediate failing; thus, if a sdev is in one of the two
 340         states, no further recovery action is needed.
 341
 342         Device readiness is tested using scsi_eh_tur() which issues
 343         TEST_UNIT_READY command.  Note that the scmd must have been
 344         aborted successfully before reusing it for TEST_UNIT_READY.
 345
 346     4. If !list_empty(&eh_work_q), invoke scsi_eh_ready_devs()
 347
 348     <<scsi_eh_ready_devs>>
 349
 350         This function takes four increasingly more severe measures to
 351         make failed sdevs ready for new commands.
 352
 353         1. Invoke scsi_eh_stu()
 354
 355         <<scsi_eh_stu>>
 356
 357             For each sdev which has failed scmds with valid sense data
 358             of which scsi_check_sense()'s verdict is FAILED,
 359             START_STOP_UNIT command is issued w/ start=1.  Note that
 360             as we explicitly choose error-completed scmds, it is known
 361             that lower layers have forgotten about the scmd and we can
 362             reuse it for STU.
 363
 364             If STU succeeds and the sdev is either offline or ready,
 365             all failed scmds on the sdev are EH-finished with
 366             scsi_eh_finish_cmd().
 367
 368             *NOTE* If hostt->eh_abort_handler() isn't implemented or
 369             failed, we may still have timed out scmds at this point
 370             and STU doesn't make lower layers forget about those
 371             scmds.  Yet, this function EH-finish all scmds on the sdev
 372             if STU succeeds leaving lower layers in an inconsistent
 373             state.  It seems that STU action should be taken only when
 374             a sdev has no timed out scmd.
 375
 376         2. If !list_empty(&eh_work_q), invoke scsi_eh_bus_device_reset().
 377
 378         <<scsi_eh_bus_device_reset>>
 379
 380             This action is very similar to scsi_eh_stu() except that,
 381             instead of issuing STU, hostt->eh_device_reset_handler()
 382             is used.  Also, as we're not issuing SCSI commands and
 383             resetting clears all scmds on the sdev, there is no need
 384             to choose error-completed scmds.
 385
 386         3. If !list_empty(&eh_work_q), invoke scsi_eh_bus_reset()
 387
 388         <<scsi_eh_bus_reset>>
 389
 390             hostt->eh_bus_reset_handler() is invoked for each channel
 391             with failed scmds.  If bus reset succeeds, all failed
 392             scmds on all ready or offline sdevs on the channel are
 393             EH-finished.
 394
 395         4. If !list_empty(&eh_work_q), invoke scsi_eh_host_reset()
 396
 397         <<scsi_eh_host_reset>>
 398
 399             This is the last resort.  hostt->eh_host_reset_handler()
 400             is invoked.  If host reset succeeds, all failed scmds on
 401             all ready or offline sdevs on the host are EH-finished.
 402
 403         5. If !list_empty(&eh_work_q), invoke scsi_eh_offline_sdevs()
 404
 405         <<scsi_eh_offline_sdevs>>
 406
 407             Take all sdevs which still have unrecovered scmds offline
 408             and EH-finish the scmds.
 409
 410     5. Invoke scsi_eh_flush_done_q().
 411
 412         <<scsi_eh_flush_done_q>>
 413
 414             At this point all scmds are recovered (or given up) and
 415             put on eh_done_q by scsi_eh_finish_cmd().  This function
 416             flushes eh_done_q by either retrying or notifying upper
 417             layer of failure of the scmds.
 418
 419
 420 [2-2] EH through transportt->eh_strategy_handler()
 421
 422  transportt->eh_strategy_handler() is invoked in the place of
 423 scsi_unjam_host() and it is responsible for whole recovery process.
 424 On completion, the handler should have made lower layers forget about
 425 all failed scmds and either ready for new commands or offline.  Also,
 426 it should perform SCSI EH maintenance choirs to maintain integrity of
 427 SCSI midlayer.  IOW, of the steps described in [2-1-2], all steps
 428 except for #1 must be implemented by eh_strategy_handler().
 429
 430
 431 [2-2-1] Pre transportt->eh_strategy_handler() SCSI midlayer conditions
 432
 433  The following conditions are true on entry to the handler.
 434
 435  - Each failed scmd's eh_flags field is set appropriately.
 436
 437  - Each failed scmd is linked on scmd->eh_cmd_q by scmd->eh_entry.
 438
 439  - SHOST_RECOVERY is set.
 440
 441  - shost->host_failed == shost->host_busy
 442
 443
 444 [2-2-2] Post transportt->eh_strategy_handler() SCSI midlayer conditions
 445
 446  The following conditions must be true on exit from the handler.
 447
 448  - shost->host_failed is zero.
 449
 450  - Each scmd's eh_eflags field is cleared.
 451
 452  - Each scmd is in such a state that scsi_setup_cmd_retry() on the
 453    scmd doesn't make any difference.
 454
 455  - shost->eh_cmd_q is cleared.
 456
 457  - Each scmd->eh_entry is cleared.
 458
 459  - Either scsi_queue_insert() or scsi_finish_command() is called on
 460    each scmd.  Note that the handler is free to use scmd->retries and
 461    ->allowed to limit the number of retries.
 462
 463
 464 [2-2-3] Things to consider
 465
 466  - Know that timed out scmds are still active on lower layers.  Make
 467    lower layers forget about them before doing anything else with
 468    those scmds.
 469
 470  - For consistency, when accessing/modifying shost data structure,
 471    grab shost->host_lock.
 472
 473  - On completion, each failed sdev must have forgotten about all
 474    active scmds.
 475
 476  - On completion, each failed sdev must be ready for new commands or
 477    offline.
 478
 479
 480 --
 481 Tejun Heo
 482 htejun@gmail.com
 483 11th September 2005