xref: /linux/drivers/scsi/scsi_error.c (revision eb2bce7f5e7ac1ca6da434461217fadf3c688d2c)
1 /*
2  *  scsi_error.c Copyright (C) 1997 Eric Youngdale
3  *
4  *  SCSI error/timeout handling
5  *      Initial versions: Eric Youngdale.  Based upon conversations with
6  *                        Leonard Zubkoff and David Miller at Linux Expo,
7  *                        ideas originating from all over the place.
8  *
9  *	Restructured scsi_unjam_host and associated functions.
10  *	September 04, 2002 Mike Anderson (andmike@us.ibm.com)
11  *
12  *	Forward port of Russell King's (rmk@arm.linux.org.uk) changes and
13  *	minor  cleanups.
14  *	September 30, 2002 Mike Anderson (andmike@us.ibm.com)
15  */
16 
17 #include <linux/module.h>
18 #include <linux/sched.h>
19 #include <linux/timer.h>
20 #include <linux/string.h>
21 #include <linux/slab.h>
22 #include <linux/kernel.h>
23 #include <linux/kthread.h>
24 #include <linux/interrupt.h>
25 #include <linux/blkdev.h>
26 #include <linux/delay.h>
27 
28 #include <scsi/scsi.h>
29 #include <scsi/scsi_cmnd.h>
30 #include <scsi/scsi_dbg.h>
31 #include <scsi/scsi_device.h>
32 #include <scsi/scsi_eh.h>
33 #include <scsi/scsi_transport.h>
34 #include <scsi/scsi_host.h>
35 #include <scsi/scsi_ioctl.h>
36 
37 #include "scsi_priv.h"
38 #include "scsi_logging.h"
39 
40 #define SENSE_TIMEOUT		(10*HZ)
41 #define START_UNIT_TIMEOUT	(30*HZ)
42 
43 /*
44  * These should *probably* be handled by the host itself.
45  * Since it is allowed to sleep, it probably should.
46  */
47 #define BUS_RESET_SETTLE_TIME   (10)
48 #define HOST_RESET_SETTLE_TIME  (10)
49 
50 /* called with shost->host_lock held */
51 void scsi_eh_wakeup(struct Scsi_Host *shost)
52 {
53 	if (shost->host_busy == shost->host_failed) {
54 		wake_up_process(shost->ehandler);
55 		SCSI_LOG_ERROR_RECOVERY(5,
56 				printk("Waking error handler thread\n"));
57 	}
58 }
59 
60 /**
61  * scsi_schedule_eh - schedule EH for SCSI host
62  * @shost:	SCSI host to invoke error handling on.
63  *
64  * Schedule SCSI EH without scmd.
65  **/
66 void scsi_schedule_eh(struct Scsi_Host *shost)
67 {
68 	unsigned long flags;
69 
70 	spin_lock_irqsave(shost->host_lock, flags);
71 
72 	if (scsi_host_set_state(shost, SHOST_RECOVERY) == 0 ||
73 	    scsi_host_set_state(shost, SHOST_CANCEL_RECOVERY) == 0) {
74 		shost->host_eh_scheduled++;
75 		scsi_eh_wakeup(shost);
76 	}
77 
78 	spin_unlock_irqrestore(shost->host_lock, flags);
79 }
80 EXPORT_SYMBOL_GPL(scsi_schedule_eh);
81 
82 /**
83  * scsi_eh_scmd_add - add scsi cmd to error handling.
84  * @scmd:	scmd to run eh on.
85  * @eh_flag:	optional SCSI_EH flag.
86  *
87  * Return value:
88  *	0 on failure.
89  **/
90 int scsi_eh_scmd_add(struct scsi_cmnd *scmd, int eh_flag)
91 {
92 	struct Scsi_Host *shost = scmd->device->host;
93 	unsigned long flags;
94 	int ret = 0;
95 
96 	if (!shost->ehandler)
97 		return 0;
98 
99 	spin_lock_irqsave(shost->host_lock, flags);
100 	if (scsi_host_set_state(shost, SHOST_RECOVERY))
101 		if (scsi_host_set_state(shost, SHOST_CANCEL_RECOVERY))
102 			goto out_unlock;
103 
104 	ret = 1;
105 	scmd->eh_eflags |= eh_flag;
106 	list_add_tail(&scmd->eh_entry, &shost->eh_cmd_q);
107 	shost->host_failed++;
108 	scsi_eh_wakeup(shost);
109  out_unlock:
110 	spin_unlock_irqrestore(shost->host_lock, flags);
111 	return ret;
112 }
113 
114 /**
115  * scsi_add_timer - Start timeout timer for a single scsi command.
116  * @scmd:	scsi command that is about to start running.
117  * @timeout:	amount of time to allow this command to run.
118  * @complete:	timeout function to call if timer isn't canceled.
119  *
120  * Notes:
121  *    This should be turned into an inline function.  Each scsi command
122  *    has its own timer, and as it is added to the queue, we set up the
123  *    timer.  When the command completes, we cancel the timer.
124  **/
125 void scsi_add_timer(struct scsi_cmnd *scmd, int timeout,
126 		    void (*complete)(struct scsi_cmnd *))
127 {
128 
129 	/*
130 	 * If the clock was already running for this command, then
131 	 * first delete the timer.  The timer handling code gets rather
132 	 * confused if we don't do this.
133 	 */
134 	if (scmd->eh_timeout.function)
135 		del_timer(&scmd->eh_timeout);
136 
137 	scmd->eh_timeout.data = (unsigned long)scmd;
138 	scmd->eh_timeout.expires = jiffies + timeout;
139 	scmd->eh_timeout.function = (void (*)(unsigned long)) complete;
140 
141 	SCSI_LOG_ERROR_RECOVERY(5, printk("%s: scmd: %p, time:"
142 					  " %d, (%p)\n", __FUNCTION__,
143 					  scmd, timeout, complete));
144 
145 	add_timer(&scmd->eh_timeout);
146 }
147 
148 /**
149  * scsi_delete_timer - Delete/cancel timer for a given function.
150  * @scmd:	Cmd that we are canceling timer for
151  *
152  * Notes:
153  *     This should be turned into an inline function.
154  *
155  * Return value:
156  *     1 if we were able to detach the timer.  0 if we blew it, and the
157  *     timer function has already started to run.
158  **/
159 int scsi_delete_timer(struct scsi_cmnd *scmd)
160 {
161 	int rtn;
162 
163 	rtn = del_timer(&scmd->eh_timeout);
164 
165 	SCSI_LOG_ERROR_RECOVERY(5, printk("%s: scmd: %p,"
166 					 " rtn: %d\n", __FUNCTION__,
167 					 scmd, rtn));
168 
169 	scmd->eh_timeout.data = (unsigned long)NULL;
170 	scmd->eh_timeout.function = NULL;
171 
172 	return rtn;
173 }
174 
175 /**
176  * scsi_times_out - Timeout function for normal scsi commands.
177  * @scmd:	Cmd that is timing out.
178  *
179  * Notes:
180  *     We do not need to lock this.  There is the potential for a race
181  *     only in that the normal completion handling might run, but if the
182  *     normal completion function determines that the timer has already
183  *     fired, then it mustn't do anything.
184  **/
185 void scsi_times_out(struct scsi_cmnd *scmd)
186 {
187 	enum scsi_eh_timer_return (* eh_timed_out)(struct scsi_cmnd *);
188 
189 	scsi_log_completion(scmd, TIMEOUT_ERROR);
190 
191 	if (scmd->device->host->transportt->eh_timed_out)
192 		eh_timed_out = scmd->device->host->transportt->eh_timed_out;
193 	else if (scmd->device->host->hostt->eh_timed_out)
194 		eh_timed_out = scmd->device->host->hostt->eh_timed_out;
195 	else
196 		eh_timed_out = NULL;
197 
198 	if (eh_timed_out)
199 		switch (eh_timed_out(scmd)) {
200 		case EH_HANDLED:
201 			__scsi_done(scmd);
202 			return;
203 		case EH_RESET_TIMER:
204 			scsi_add_timer(scmd, scmd->timeout_per_command,
205 				       scsi_times_out);
206 			return;
207 		case EH_NOT_HANDLED:
208 			break;
209 		}
210 
211 	if (unlikely(!scsi_eh_scmd_add(scmd, SCSI_EH_CANCEL_CMD))) {
212 		scmd->result |= DID_TIME_OUT << 16;
213 		__scsi_done(scmd);
214 	}
215 }
216 
217 /**
218  * scsi_block_when_processing_errors - Prevent cmds from being queued.
219  * @sdev:	Device on which we are performing recovery.
220  *
221  * Description:
222  *     We block until the host is out of error recovery, and then check to
223  *     see whether the host or the device is offline.
224  *
225  * Return value:
226  *     0 when dev was taken offline by error recovery. 1 OK to proceed.
227  **/
228 int scsi_block_when_processing_errors(struct scsi_device *sdev)
229 {
230 	int online;
231 
232 	wait_event(sdev->host->host_wait, !scsi_host_in_recovery(sdev->host));
233 
234 	online = scsi_device_online(sdev);
235 
236 	SCSI_LOG_ERROR_RECOVERY(5, printk("%s: rtn: %d\n", __FUNCTION__,
237 					  online));
238 
239 	return online;
240 }
241 EXPORT_SYMBOL(scsi_block_when_processing_errors);
242 
243 #ifdef CONFIG_SCSI_LOGGING
244 /**
245  * scsi_eh_prt_fail_stats - Log info on failures.
246  * @shost:	scsi host being recovered.
247  * @work_q:	Queue of scsi cmds to process.
248  **/
249 static inline void scsi_eh_prt_fail_stats(struct Scsi_Host *shost,
250 					  struct list_head *work_q)
251 {
252 	struct scsi_cmnd *scmd;
253 	struct scsi_device *sdev;
254 	int total_failures = 0;
255 	int cmd_failed = 0;
256 	int cmd_cancel = 0;
257 	int devices_failed = 0;
258 
259 	shost_for_each_device(sdev, shost) {
260 		list_for_each_entry(scmd, work_q, eh_entry) {
261 			if (scmd->device == sdev) {
262 				++total_failures;
263 				if (scmd->eh_eflags & SCSI_EH_CANCEL_CMD)
264 					++cmd_cancel;
265 				else
266 					++cmd_failed;
267 			}
268 		}
269 
270 		if (cmd_cancel || cmd_failed) {
271 			SCSI_LOG_ERROR_RECOVERY(3,
272 				sdev_printk(KERN_INFO, sdev,
273 					    "%s: cmds failed: %d, cancel: %d\n",
274 					    __FUNCTION__, cmd_failed,
275 					    cmd_cancel));
276 			cmd_cancel = 0;
277 			cmd_failed = 0;
278 			++devices_failed;
279 		}
280 	}
281 
282 	SCSI_LOG_ERROR_RECOVERY(2, printk("Total of %d commands on %d"
283 					  " devices require eh work\n",
284 				  total_failures, devices_failed));
285 }
286 #endif
287 
288 /**
289  * scsi_check_sense - Examine scsi cmd sense
290  * @scmd:	Cmd to have sense checked.
291  *
292  * Return value:
293  * 	SUCCESS or FAILED or NEEDS_RETRY
294  *
295  * Notes:
296  *	When a deferred error is detected the current command has
297  *	not been executed and needs retrying.
298  **/
299 static int scsi_check_sense(struct scsi_cmnd *scmd)
300 {
301 	struct scsi_sense_hdr sshdr;
302 
303 	if (! scsi_command_normalize_sense(scmd, &sshdr))
304 		return FAILED;	/* no valid sense data */
305 
306 	if (scsi_sense_is_deferred(&sshdr))
307 		return NEEDS_RETRY;
308 
309 	/*
310 	 * Previous logic looked for FILEMARK, EOM or ILI which are
311 	 * mainly associated with tapes and returned SUCCESS.
312 	 */
313 	if (sshdr.response_code == 0x70) {
314 		/* fixed format */
315 		if (scmd->sense_buffer[2] & 0xe0)
316 			return SUCCESS;
317 	} else {
318 		/*
319 		 * descriptor format: look for "stream commands sense data
320 		 * descriptor" (see SSC-3). Assume single sense data
321 		 * descriptor. Ignore ILI from SBC-2 READ LONG and WRITE LONG.
322 		 */
323 		if ((sshdr.additional_length > 3) &&
324 		    (scmd->sense_buffer[8] == 0x4) &&
325 		    (scmd->sense_buffer[11] & 0xe0))
326 			return SUCCESS;
327 	}
328 
329 	switch (sshdr.sense_key) {
330 	case NO_SENSE:
331 		return SUCCESS;
332 	case RECOVERED_ERROR:
333 		return /* soft_error */ SUCCESS;
334 
335 	case ABORTED_COMMAND:
336 		return NEEDS_RETRY;
337 	case NOT_READY:
338 	case UNIT_ATTENTION:
339 		/*
340 		 * if we are expecting a cc/ua because of a bus reset that we
341 		 * performed, treat this just as a retry.  otherwise this is
342 		 * information that we should pass up to the upper-level driver
343 		 * so that we can deal with it there.
344 		 */
345 		if (scmd->device->expecting_cc_ua) {
346 			scmd->device->expecting_cc_ua = 0;
347 			return NEEDS_RETRY;
348 		}
349 		/*
350 		 * if the device is in the process of becoming ready, we
351 		 * should retry.
352 		 */
353 		if ((sshdr.asc == 0x04) && (sshdr.ascq == 0x01))
354 			return NEEDS_RETRY;
355 		/*
356 		 * if the device is not started, we need to wake
357 		 * the error handler to start the motor
358 		 */
359 		if (scmd->device->allow_restart &&
360 		    (sshdr.asc == 0x04) && (sshdr.ascq == 0x02))
361 			return FAILED;
362 		return SUCCESS;
363 
364 		/* these three are not supported */
365 	case COPY_ABORTED:
366 	case VOLUME_OVERFLOW:
367 	case MISCOMPARE:
368 		return SUCCESS;
369 
370 	case MEDIUM_ERROR:
371 		if (sshdr.asc == 0x11 || /* UNRECOVERED READ ERR */
372 		    sshdr.asc == 0x13 || /* AMNF DATA FIELD */
373 		    sshdr.asc == 0x14) { /* RECORD NOT FOUND */
374 			return SUCCESS;
375 		}
376 		return NEEDS_RETRY;
377 
378 	case HARDWARE_ERROR:
379 		if (scmd->device->retry_hwerror)
380 			return NEEDS_RETRY;
381 		else
382 			return SUCCESS;
383 
384 	case ILLEGAL_REQUEST:
385 	case BLANK_CHECK:
386 	case DATA_PROTECT:
387 	default:
388 		return SUCCESS;
389 	}
390 }
391 
392 /**
393  * scsi_eh_completed_normally - Disposition a eh cmd on return from LLD.
394  * @scmd:	SCSI cmd to examine.
395  *
396  * Notes:
397  *    This is *only* called when we are examining the status of commands
398  *    queued during error recovery.  the main difference here is that we
399  *    don't allow for the possibility of retries here, and we are a lot
400  *    more restrictive about what we consider acceptable.
401  **/
402 static int scsi_eh_completed_normally(struct scsi_cmnd *scmd)
403 {
404 	/*
405 	 * first check the host byte, to see if there is anything in there
406 	 * that would indicate what we need to do.
407 	 */
408 	if (host_byte(scmd->result) == DID_RESET) {
409 		/*
410 		 * rats.  we are already in the error handler, so we now
411 		 * get to try and figure out what to do next.  if the sense
412 		 * is valid, we have a pretty good idea of what to do.
413 		 * if not, we mark it as FAILED.
414 		 */
415 		return scsi_check_sense(scmd);
416 	}
417 	if (host_byte(scmd->result) != DID_OK)
418 		return FAILED;
419 
420 	/*
421 	 * next, check the message byte.
422 	 */
423 	if (msg_byte(scmd->result) != COMMAND_COMPLETE)
424 		return FAILED;
425 
426 	/*
427 	 * now, check the status byte to see if this indicates
428 	 * anything special.
429 	 */
430 	switch (status_byte(scmd->result)) {
431 	case GOOD:
432 	case COMMAND_TERMINATED:
433 		return SUCCESS;
434 	case CHECK_CONDITION:
435 		return scsi_check_sense(scmd);
436 	case CONDITION_GOOD:
437 	case INTERMEDIATE_GOOD:
438 	case INTERMEDIATE_C_GOOD:
439 		/*
440 		 * who knows?  FIXME(eric)
441 		 */
442 		return SUCCESS;
443 	case BUSY:
444 	case QUEUE_FULL:
445 	case RESERVATION_CONFLICT:
446 	default:
447 		return FAILED;
448 	}
449 	return FAILED;
450 }
451 
452 /**
453  * scsi_eh_done - Completion function for error handling.
454  * @scmd:	Cmd that is done.
455  **/
456 static void scsi_eh_done(struct scsi_cmnd *scmd)
457 {
458 	struct completion     *eh_action;
459 
460 	SCSI_LOG_ERROR_RECOVERY(3,
461 		printk("%s scmd: %p result: %x\n",
462 			__FUNCTION__, scmd, scmd->result));
463 
464 	eh_action = scmd->device->host->eh_action;
465 	if (eh_action)
466 		complete(eh_action);
467 }
468 
469 /**
470  * scsi_try_host_reset - ask host adapter to reset itself
471  * @scmd:	SCSI cmd to send hsot reset.
472  **/
473 static int scsi_try_host_reset(struct scsi_cmnd *scmd)
474 {
475 	unsigned long flags;
476 	int rtn;
477 
478 	SCSI_LOG_ERROR_RECOVERY(3, printk("%s: Snd Host RST\n",
479 					  __FUNCTION__));
480 
481 	if (!scmd->device->host->hostt->eh_host_reset_handler)
482 		return FAILED;
483 
484 	rtn = scmd->device->host->hostt->eh_host_reset_handler(scmd);
485 
486 	if (rtn == SUCCESS) {
487 		if (!scmd->device->host->hostt->skip_settle_delay)
488 			ssleep(HOST_RESET_SETTLE_TIME);
489 		spin_lock_irqsave(scmd->device->host->host_lock, flags);
490 		scsi_report_bus_reset(scmd->device->host,
491 				      scmd_channel(scmd));
492 		spin_unlock_irqrestore(scmd->device->host->host_lock, flags);
493 	}
494 
495 	return rtn;
496 }
497 
498 /**
499  * scsi_try_bus_reset - ask host to perform a bus reset
500  * @scmd:	SCSI cmd to send bus reset.
501  **/
502 static int scsi_try_bus_reset(struct scsi_cmnd *scmd)
503 {
504 	unsigned long flags;
505 	int rtn;
506 
507 	SCSI_LOG_ERROR_RECOVERY(3, printk("%s: Snd Bus RST\n",
508 					  __FUNCTION__));
509 
510 	if (!scmd->device->host->hostt->eh_bus_reset_handler)
511 		return FAILED;
512 
513 	rtn = scmd->device->host->hostt->eh_bus_reset_handler(scmd);
514 
515 	if (rtn == SUCCESS) {
516 		if (!scmd->device->host->hostt->skip_settle_delay)
517 			ssleep(BUS_RESET_SETTLE_TIME);
518 		spin_lock_irqsave(scmd->device->host->host_lock, flags);
519 		scsi_report_bus_reset(scmd->device->host,
520 				      scmd_channel(scmd));
521 		spin_unlock_irqrestore(scmd->device->host->host_lock, flags);
522 	}
523 
524 	return rtn;
525 }
526 
527 /**
528  * scsi_try_bus_device_reset - Ask host to perform a BDR on a dev
529  * @scmd:	SCSI cmd used to send BDR
530  *
531  * Notes:
532  *    There is no timeout for this operation.  if this operation is
533  *    unreliable for a given host, then the host itself needs to put a
534  *    timer on it, and set the host back to a consistent state prior to
535  *    returning.
536  **/
537 static int scsi_try_bus_device_reset(struct scsi_cmnd *scmd)
538 {
539 	int rtn;
540 
541 	if (!scmd->device->host->hostt->eh_device_reset_handler)
542 		return FAILED;
543 
544 	rtn = scmd->device->host->hostt->eh_device_reset_handler(scmd);
545 	if (rtn == SUCCESS) {
546 		scmd->device->was_reset = 1;
547 		scmd->device->expecting_cc_ua = 1;
548 	}
549 
550 	return rtn;
551 }
552 
553 static int __scsi_try_to_abort_cmd(struct scsi_cmnd *scmd)
554 {
555 	if (!scmd->device->host->hostt->eh_abort_handler)
556 		return FAILED;
557 
558 	return scmd->device->host->hostt->eh_abort_handler(scmd);
559 }
560 
561 /**
562  * scsi_try_to_abort_cmd - Ask host to abort a running command.
563  * @scmd:	SCSI cmd to abort from Lower Level.
564  *
565  * Notes:
566  *    This function will not return until the user's completion function
567  *    has been called.  there is no timeout on this operation.  if the
568  *    author of the low-level driver wishes this operation to be timed,
569  *    they can provide this facility themselves.  helper functions in
570  *    scsi_error.c can be supplied to make this easier to do.
571  **/
572 static int scsi_try_to_abort_cmd(struct scsi_cmnd *scmd)
573 {
574 	/*
575 	 * scsi_done was called just after the command timed out and before
576 	 * we had a chance to process it. (db)
577 	 */
578 	if (scmd->serial_number == 0)
579 		return SUCCESS;
580 	return __scsi_try_to_abort_cmd(scmd);
581 }
582 
583 static void scsi_abort_eh_cmnd(struct scsi_cmnd *scmd)
584 {
585 	if (__scsi_try_to_abort_cmd(scmd) != SUCCESS)
586 		if (scsi_try_bus_device_reset(scmd) != SUCCESS)
587 			if (scsi_try_bus_reset(scmd) != SUCCESS)
588 				scsi_try_host_reset(scmd);
589 }
590 
591 /**
592  * scsi_send_eh_cmnd  - submit a scsi command as part of error recory
593  * @scmd:       SCSI command structure to hijack
594  * @cmnd:       CDB to send
595  * @cmnd_size:  size in bytes of @cmnd
596  * @timeout:    timeout for this request
597  * @copy_sense: request sense data if set to 1
598  *
599  * This function is used to send a scsi command down to a target device
600  * as part of the error recovery process.  If @copy_sense is 0 the command
601  * sent must be one that does not transfer any data.  If @copy_sense is 1
602  * the command must be REQUEST_SENSE and this functions copies out the
603  * sense buffer it got into @scmd->sense_buffer.
604  *
605  * Return value:
606  *    SUCCESS or FAILED or NEEDS_RETRY
607  **/
608 static int scsi_send_eh_cmnd(struct scsi_cmnd *scmd, unsigned char *cmnd,
609 			     int cmnd_size, int timeout, int copy_sense)
610 {
611 	struct scsi_device *sdev = scmd->device;
612 	struct Scsi_Host *shost = sdev->host;
613 	int old_result = scmd->result;
614 	DECLARE_COMPLETION_ONSTACK(done);
615 	unsigned long timeleft;
616 	unsigned long flags;
617 	struct scatterlist sgl;
618 	unsigned char old_cmnd[MAX_COMMAND_SIZE];
619 	enum dma_data_direction old_data_direction;
620 	unsigned short old_use_sg;
621 	unsigned char old_cmd_len;
622 	unsigned old_bufflen;
623 	void *old_buffer;
624 	int rtn;
625 
626 	/*
627 	 * We need saved copies of a number of fields - this is because
628 	 * error handling may need to overwrite these with different values
629 	 * to run different commands, and once error handling is complete,
630 	 * we will need to restore these values prior to running the actual
631 	 * command.
632 	 */
633 	old_buffer = scmd->request_buffer;
634 	old_bufflen = scmd->request_bufflen;
635 	memcpy(old_cmnd, scmd->cmnd, sizeof(scmd->cmnd));
636 	old_data_direction = scmd->sc_data_direction;
637 	old_cmd_len = scmd->cmd_len;
638 	old_use_sg = scmd->use_sg;
639 
640 	memset(scmd->cmnd, 0, sizeof(scmd->cmnd));
641 	memcpy(scmd->cmnd, cmnd, cmnd_size);
642 
643 	if (copy_sense) {
644 		gfp_t gfp_mask = GFP_ATOMIC;
645 
646 		if (shost->hostt->unchecked_isa_dma)
647 			gfp_mask |= __GFP_DMA;
648 
649 		sgl.page = alloc_page(gfp_mask);
650 		if (!sgl.page)
651 			return FAILED;
652 		sgl.offset = 0;
653 		sgl.length = 252;
654 
655 		scmd->sc_data_direction = DMA_FROM_DEVICE;
656 		scmd->request_bufflen = sgl.length;
657 		scmd->request_buffer = &sgl;
658 		scmd->use_sg = 1;
659 	} else {
660 		scmd->request_buffer = NULL;
661 		scmd->request_bufflen = 0;
662 		scmd->sc_data_direction = DMA_NONE;
663 		scmd->use_sg = 0;
664 	}
665 
666 	scmd->underflow = 0;
667 	scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
668 
669 	if (sdev->scsi_level <= SCSI_2)
670 		scmd->cmnd[1] = (scmd->cmnd[1] & 0x1f) |
671 			(sdev->lun << 5 & 0xe0);
672 
673 	/*
674 	 * Zero the sense buffer.  The scsi spec mandates that any
675 	 * untransferred sense data should be interpreted as being zero.
676 	 */
677 	memset(scmd->sense_buffer, 0, sizeof(scmd->sense_buffer));
678 
679 	shost->eh_action = &done;
680 
681 	spin_lock_irqsave(shost->host_lock, flags);
682 	scsi_log_send(scmd);
683 	shost->hostt->queuecommand(scmd, scsi_eh_done);
684 	spin_unlock_irqrestore(shost->host_lock, flags);
685 
686 	timeleft = wait_for_completion_timeout(&done, timeout);
687 
688 	shost->eh_action = NULL;
689 
690 	scsi_log_completion(scmd, SUCCESS);
691 
692 	SCSI_LOG_ERROR_RECOVERY(3,
693 		printk("%s: scmd: %p, timeleft: %ld\n",
694 			__FUNCTION__, scmd, timeleft));
695 
696 	/*
697 	 * If there is time left scsi_eh_done got called, and we will
698 	 * examine the actual status codes to see whether the command
699 	 * actually did complete normally, else tell the host to forget
700 	 * about this command.
701 	 */
702 	if (timeleft) {
703 		rtn = scsi_eh_completed_normally(scmd);
704 		SCSI_LOG_ERROR_RECOVERY(3,
705 			printk("%s: scsi_eh_completed_normally %x\n",
706 			       __FUNCTION__, rtn));
707 
708 		switch (rtn) {
709 		case SUCCESS:
710 		case NEEDS_RETRY:
711 		case FAILED:
712 			break;
713 		default:
714 			rtn = FAILED;
715 			break;
716 		}
717 	} else {
718 		scsi_abort_eh_cmnd(scmd);
719 		rtn = FAILED;
720 	}
721 
722 
723 	/*
724 	 * Last chance to have valid sense data.
725 	 */
726 	if (copy_sense) {
727 		if (!SCSI_SENSE_VALID(scmd)) {
728 			memcpy(scmd->sense_buffer, page_address(sgl.page),
729 			       sizeof(scmd->sense_buffer));
730 		}
731 		__free_page(sgl.page);
732 	}
733 
734 
735 	/*
736 	 * Restore original data
737 	 */
738 	scmd->request_buffer = old_buffer;
739 	scmd->request_bufflen = old_bufflen;
740 	memcpy(scmd->cmnd, old_cmnd, sizeof(scmd->cmnd));
741 	scmd->sc_data_direction = old_data_direction;
742 	scmd->cmd_len = old_cmd_len;
743 	scmd->use_sg = old_use_sg;
744 	scmd->result = old_result;
745 	return rtn;
746 }
747 
748 /**
749  * scsi_request_sense - Request sense data from a particular target.
750  * @scmd:	SCSI cmd for request sense.
751  *
752  * Notes:
753  *    Some hosts automatically obtain this information, others require
754  *    that we obtain it on our own. This function will *not* return until
755  *    the command either times out, or it completes.
756  **/
757 static int scsi_request_sense(struct scsi_cmnd *scmd)
758 {
759 	static unsigned char generic_sense[6] =
760 		{REQUEST_SENSE, 0, 0, 0, 252, 0};
761 
762 	return scsi_send_eh_cmnd(scmd, generic_sense, 6, SENSE_TIMEOUT, 1);
763 }
764 
765 /**
766  * scsi_eh_finish_cmd - Handle a cmd that eh is finished with.
767  * @scmd:	Original SCSI cmd that eh has finished.
768  * @done_q:	Queue for processed commands.
769  *
770  * Notes:
771  *    We don't want to use the normal command completion while we are are
772  *    still handling errors - it may cause other commands to be queued,
773  *    and that would disturb what we are doing.  thus we really want to
774  *    keep a list of pending commands for final completion, and once we
775  *    are ready to leave error handling we handle completion for real.
776  **/
777 void scsi_eh_finish_cmd(struct scsi_cmnd *scmd, struct list_head *done_q)
778 {
779 	scmd->device->host->host_failed--;
780 	scmd->eh_eflags = 0;
781 	list_move_tail(&scmd->eh_entry, done_q);
782 }
783 EXPORT_SYMBOL(scsi_eh_finish_cmd);
784 
785 /**
786  * scsi_eh_get_sense - Get device sense data.
787  * @work_q:	Queue of commands to process.
788  * @done_q:	Queue of proccessed commands..
789  *
790  * Description:
791  *    See if we need to request sense information.  if so, then get it
792  *    now, so we have a better idea of what to do.
793  *
794  * Notes:
795  *    This has the unfortunate side effect that if a shost adapter does
796  *    not automatically request sense information, that we end up shutting
797  *    it down before we request it.
798  *
799  *    All drivers should request sense information internally these days,
800  *    so for now all I have to say is tough noogies if you end up in here.
801  *
802  *    XXX: Long term this code should go away, but that needs an audit of
803  *         all LLDDs first.
804  **/
805 int scsi_eh_get_sense(struct list_head *work_q,
806 		      struct list_head *done_q)
807 {
808 	struct scsi_cmnd *scmd, *next;
809 	int rtn;
810 
811 	list_for_each_entry_safe(scmd, next, work_q, eh_entry) {
812 		if ((scmd->eh_eflags & SCSI_EH_CANCEL_CMD) ||
813 		    SCSI_SENSE_VALID(scmd))
814 			continue;
815 
816 		SCSI_LOG_ERROR_RECOVERY(2, scmd_printk(KERN_INFO, scmd,
817 						  "%s: requesting sense\n",
818 						  current->comm));
819 		rtn = scsi_request_sense(scmd);
820 		if (rtn != SUCCESS)
821 			continue;
822 
823 		SCSI_LOG_ERROR_RECOVERY(3, printk("sense requested for %p"
824 						  " result %x\n", scmd,
825 						  scmd->result));
826 		SCSI_LOG_ERROR_RECOVERY(3, scsi_print_sense("bh", scmd));
827 
828 		rtn = scsi_decide_disposition(scmd);
829 
830 		/*
831 		 * if the result was normal, then just pass it along to the
832 		 * upper level.
833 		 */
834 		if (rtn == SUCCESS)
835 			/* we don't want this command reissued, just
836 			 * finished with the sense data, so set
837 			 * retries to the max allowed to ensure it
838 			 * won't get reissued */
839 			scmd->retries = scmd->allowed;
840 		else if (rtn != NEEDS_RETRY)
841 			continue;
842 
843 		scsi_eh_finish_cmd(scmd, done_q);
844 	}
845 
846 	return list_empty(work_q);
847 }
848 EXPORT_SYMBOL_GPL(scsi_eh_get_sense);
849 
850 /**
851  * scsi_eh_tur - Send TUR to device.
852  * @scmd:	Scsi cmd to send TUR
853  *
854  * Return value:
855  *    0 - Device is ready. 1 - Device NOT ready.
856  **/
857 static int scsi_eh_tur(struct scsi_cmnd *scmd)
858 {
859 	static unsigned char tur_command[6] = {TEST_UNIT_READY, 0, 0, 0, 0, 0};
860 	int retry_cnt = 1, rtn;
861 
862 retry_tur:
863 	rtn = scsi_send_eh_cmnd(scmd, tur_command, 6, SENSE_TIMEOUT, 0);
864 
865 	SCSI_LOG_ERROR_RECOVERY(3, printk("%s: scmd %p rtn %x\n",
866 		__FUNCTION__, scmd, rtn));
867 
868 	switch (rtn) {
869 	case NEEDS_RETRY:
870 		if (retry_cnt--)
871 			goto retry_tur;
872 		/*FALLTHRU*/
873 	case SUCCESS:
874 		return 0;
875 	default:
876 		return 1;
877 	}
878 }
879 
880 /**
881  * scsi_eh_abort_cmds - abort canceled commands.
882  * @shost:	scsi host being recovered.
883  * @eh_done_q:	list_head for processed commands.
884  *
885  * Decription:
886  *    Try and see whether or not it makes sense to try and abort the
887  *    running command.  this only works out to be the case if we have one
888  *    command that has timed out.  if the command simply failed, it makes
889  *    no sense to try and abort the command, since as far as the shost
890  *    adapter is concerned, it isn't running.
891  **/
892 static int scsi_eh_abort_cmds(struct list_head *work_q,
893 			      struct list_head *done_q)
894 {
895 	struct scsi_cmnd *scmd, *next;
896 	int rtn;
897 
898 	list_for_each_entry_safe(scmd, next, work_q, eh_entry) {
899 		if (!(scmd->eh_eflags & SCSI_EH_CANCEL_CMD))
900 			continue;
901 		SCSI_LOG_ERROR_RECOVERY(3, printk("%s: aborting cmd:"
902 						  "0x%p\n", current->comm,
903 						  scmd));
904 		rtn = scsi_try_to_abort_cmd(scmd);
905 		if (rtn == SUCCESS) {
906 			scmd->eh_eflags &= ~SCSI_EH_CANCEL_CMD;
907 			if (!scsi_device_online(scmd->device) ||
908 			    !scsi_eh_tur(scmd)) {
909 				scsi_eh_finish_cmd(scmd, done_q);
910 			}
911 
912 		} else
913 			SCSI_LOG_ERROR_RECOVERY(3, printk("%s: aborting"
914 							  " cmd failed:"
915 							  "0x%p\n",
916 							  current->comm,
917 							  scmd));
918 	}
919 
920 	return list_empty(work_q);
921 }
922 
923 /**
924  * scsi_eh_try_stu - Send START_UNIT to device.
925  * @scmd:	Scsi cmd to send START_UNIT
926  *
927  * Return value:
928  *    0 - Device is ready. 1 - Device NOT ready.
929  **/
930 static int scsi_eh_try_stu(struct scsi_cmnd *scmd)
931 {
932 	static unsigned char stu_command[6] = {START_STOP, 0, 0, 0, 1, 0};
933 
934 	if (scmd->device->allow_restart) {
935 		int i, rtn = NEEDS_RETRY;
936 
937 		for (i = 0; rtn == NEEDS_RETRY && i < 2; i++)
938 			rtn = scsi_send_eh_cmnd(scmd, stu_command, 6,
939 						START_UNIT_TIMEOUT, 0);
940 
941 		if (rtn == SUCCESS)
942 			return 0;
943 	}
944 
945 	return 1;
946 }
947 
948  /**
949  * scsi_eh_stu - send START_UNIT if needed
950  * @shost:	scsi host being recovered.
951  * @eh_done_q:	list_head for processed commands.
952  *
953  * Notes:
954  *    If commands are failing due to not ready, initializing command required,
955  *	try revalidating the device, which will end up sending a start unit.
956  **/
957 static int scsi_eh_stu(struct Scsi_Host *shost,
958 			      struct list_head *work_q,
959 			      struct list_head *done_q)
960 {
961 	struct scsi_cmnd *scmd, *stu_scmd, *next;
962 	struct scsi_device *sdev;
963 
964 	shost_for_each_device(sdev, shost) {
965 		stu_scmd = NULL;
966 		list_for_each_entry(scmd, work_q, eh_entry)
967 			if (scmd->device == sdev && SCSI_SENSE_VALID(scmd) &&
968 			    scsi_check_sense(scmd) == FAILED ) {
969 				stu_scmd = scmd;
970 				break;
971 			}
972 
973 		if (!stu_scmd)
974 			continue;
975 
976 		SCSI_LOG_ERROR_RECOVERY(3, printk("%s: Sending START_UNIT to sdev:"
977 						  " 0x%p\n", current->comm, sdev));
978 
979 		if (!scsi_eh_try_stu(stu_scmd)) {
980 			if (!scsi_device_online(sdev) ||
981 			    !scsi_eh_tur(stu_scmd)) {
982 				list_for_each_entry_safe(scmd, next,
983 							  work_q, eh_entry) {
984 					if (scmd->device == sdev)
985 						scsi_eh_finish_cmd(scmd, done_q);
986 				}
987 			}
988 		} else {
989 			SCSI_LOG_ERROR_RECOVERY(3,
990 						printk("%s: START_UNIT failed to sdev:"
991 						       " 0x%p\n", current->comm, sdev));
992 		}
993 	}
994 
995 	return list_empty(work_q);
996 }
997 
998 
999 /**
1000  * scsi_eh_bus_device_reset - send bdr if needed
1001  * @shost:	scsi host being recovered.
1002  * @eh_done_q:	list_head for processed commands.
1003  *
1004  * Notes:
1005  *    Try a bus device reset.  still, look to see whether we have multiple
1006  *    devices that are jammed or not - if we have multiple devices, it
1007  *    makes no sense to try bus_device_reset - we really would need to try
1008  *    a bus_reset instead.
1009  **/
1010 static int scsi_eh_bus_device_reset(struct Scsi_Host *shost,
1011 				    struct list_head *work_q,
1012 				    struct list_head *done_q)
1013 {
1014 	struct scsi_cmnd *scmd, *bdr_scmd, *next;
1015 	struct scsi_device *sdev;
1016 	int rtn;
1017 
1018 	shost_for_each_device(sdev, shost) {
1019 		bdr_scmd = NULL;
1020 		list_for_each_entry(scmd, work_q, eh_entry)
1021 			if (scmd->device == sdev) {
1022 				bdr_scmd = scmd;
1023 				break;
1024 			}
1025 
1026 		if (!bdr_scmd)
1027 			continue;
1028 
1029 		SCSI_LOG_ERROR_RECOVERY(3, printk("%s: Sending BDR sdev:"
1030 						  " 0x%p\n", current->comm,
1031 						  sdev));
1032 		rtn = scsi_try_bus_device_reset(bdr_scmd);
1033 		if (rtn == SUCCESS) {
1034 			if (!scsi_device_online(sdev) ||
1035 			    !scsi_eh_tur(bdr_scmd)) {
1036 				list_for_each_entry_safe(scmd, next,
1037 							 work_q, eh_entry) {
1038 					if (scmd->device == sdev)
1039 						scsi_eh_finish_cmd(scmd,
1040 								   done_q);
1041 				}
1042 			}
1043 		} else {
1044 			SCSI_LOG_ERROR_RECOVERY(3, printk("%s: BDR"
1045 							  " failed sdev:"
1046 							  "0x%p\n",
1047 							  current->comm,
1048 							   sdev));
1049 		}
1050 	}
1051 
1052 	return list_empty(work_q);
1053 }
1054 
1055 /**
1056  * scsi_eh_bus_reset - send a bus reset
1057  * @shost:	scsi host being recovered.
1058  * @eh_done_q:	list_head for processed commands.
1059  **/
1060 static int scsi_eh_bus_reset(struct Scsi_Host *shost,
1061 			     struct list_head *work_q,
1062 			     struct list_head *done_q)
1063 {
1064 	struct scsi_cmnd *scmd, *chan_scmd, *next;
1065 	unsigned int channel;
1066 	int rtn;
1067 
1068 	/*
1069 	 * we really want to loop over the various channels, and do this on
1070 	 * a channel by channel basis.  we should also check to see if any
1071 	 * of the failed commands are on soft_reset devices, and if so, skip
1072 	 * the reset.
1073 	 */
1074 
1075 	for (channel = 0; channel <= shost->max_channel; channel++) {
1076 		chan_scmd = NULL;
1077 		list_for_each_entry(scmd, work_q, eh_entry) {
1078 			if (channel == scmd_channel(scmd)) {
1079 				chan_scmd = scmd;
1080 				break;
1081 				/*
1082 				 * FIXME add back in some support for
1083 				 * soft_reset devices.
1084 				 */
1085 			}
1086 		}
1087 
1088 		if (!chan_scmd)
1089 			continue;
1090 		SCSI_LOG_ERROR_RECOVERY(3, printk("%s: Sending BRST chan:"
1091 						  " %d\n", current->comm,
1092 						  channel));
1093 		rtn = scsi_try_bus_reset(chan_scmd);
1094 		if (rtn == SUCCESS) {
1095 			list_for_each_entry_safe(scmd, next, work_q, eh_entry) {
1096 				if (channel == scmd_channel(scmd))
1097 					if (!scsi_device_online(scmd->device) ||
1098 					    !scsi_eh_tur(scmd))
1099 						scsi_eh_finish_cmd(scmd,
1100 								   done_q);
1101 			}
1102 		} else {
1103 			SCSI_LOG_ERROR_RECOVERY(3, printk("%s: BRST"
1104 							  " failed chan: %d\n",
1105 							  current->comm,
1106 							  channel));
1107 		}
1108 	}
1109 	return list_empty(work_q);
1110 }
1111 
1112 /**
1113  * scsi_eh_host_reset - send a host reset
1114  * @work_q:	list_head for processed commands.
1115  * @done_q:	list_head for processed commands.
1116  **/
1117 static int scsi_eh_host_reset(struct list_head *work_q,
1118 			      struct list_head *done_q)
1119 {
1120 	struct scsi_cmnd *scmd, *next;
1121 	int rtn;
1122 
1123 	if (!list_empty(work_q)) {
1124 		scmd = list_entry(work_q->next,
1125 				  struct scsi_cmnd, eh_entry);
1126 
1127 		SCSI_LOG_ERROR_RECOVERY(3, printk("%s: Sending HRST\n"
1128 						  , current->comm));
1129 
1130 		rtn = scsi_try_host_reset(scmd);
1131 		if (rtn == SUCCESS) {
1132 			list_for_each_entry_safe(scmd, next, work_q, eh_entry) {
1133 				if (!scsi_device_online(scmd->device) ||
1134 				    (!scsi_eh_try_stu(scmd) && !scsi_eh_tur(scmd)) ||
1135 				    !scsi_eh_tur(scmd))
1136 					scsi_eh_finish_cmd(scmd, done_q);
1137 			}
1138 		} else {
1139 			SCSI_LOG_ERROR_RECOVERY(3, printk("%s: HRST"
1140 							  " failed\n",
1141 							  current->comm));
1142 		}
1143 	}
1144 	return list_empty(work_q);
1145 }
1146 
1147 /**
1148  * scsi_eh_offline_sdevs - offline scsi devices that fail to recover
1149  * @work_q:	list_head for processed commands.
1150  * @done_q:	list_head for processed commands.
1151  *
1152  **/
1153 static void scsi_eh_offline_sdevs(struct list_head *work_q,
1154 				  struct list_head *done_q)
1155 {
1156 	struct scsi_cmnd *scmd, *next;
1157 
1158 	list_for_each_entry_safe(scmd, next, work_q, eh_entry) {
1159 		sdev_printk(KERN_INFO, scmd->device,
1160 			    "scsi: Device offlined - not"
1161 			    " ready after error recovery\n");
1162 		scsi_device_set_state(scmd->device, SDEV_OFFLINE);
1163 		if (scmd->eh_eflags & SCSI_EH_CANCEL_CMD) {
1164 			/*
1165 			 * FIXME: Handle lost cmds.
1166 			 */
1167 		}
1168 		scsi_eh_finish_cmd(scmd, done_q);
1169 	}
1170 	return;
1171 }
1172 
1173 /**
1174  * scsi_decide_disposition - Disposition a cmd on return from LLD.
1175  * @scmd:	SCSI cmd to examine.
1176  *
1177  * Notes:
1178  *    This is *only* called when we are examining the status after sending
1179  *    out the actual data command.  any commands that are queued for error
1180  *    recovery (e.g. test_unit_ready) do *not* come through here.
1181  *
1182  *    When this routine returns failed, it means the error handler thread
1183  *    is woken.  In cases where the error code indicates an error that
1184  *    doesn't require the error handler read (i.e. we don't need to
1185  *    abort/reset), this function should return SUCCESS.
1186  **/
1187 int scsi_decide_disposition(struct scsi_cmnd *scmd)
1188 {
1189 	int rtn;
1190 
1191 	/*
1192 	 * if the device is offline, then we clearly just pass the result back
1193 	 * up to the top level.
1194 	 */
1195 	if (!scsi_device_online(scmd->device)) {
1196 		SCSI_LOG_ERROR_RECOVERY(5, printk("%s: device offline - report"
1197 						  " as SUCCESS\n",
1198 						  __FUNCTION__));
1199 		return SUCCESS;
1200 	}
1201 
1202 	/*
1203 	 * first check the host byte, to see if there is anything in there
1204 	 * that would indicate what we need to do.
1205 	 */
1206 	switch (host_byte(scmd->result)) {
1207 	case DID_PASSTHROUGH:
1208 		/*
1209 		 * no matter what, pass this through to the upper layer.
1210 		 * nuke this special code so that it looks like we are saying
1211 		 * did_ok.
1212 		 */
1213 		scmd->result &= 0xff00ffff;
1214 		return SUCCESS;
1215 	case DID_OK:
1216 		/*
1217 		 * looks good.  drop through, and check the next byte.
1218 		 */
1219 		break;
1220 	case DID_NO_CONNECT:
1221 	case DID_BAD_TARGET:
1222 	case DID_ABORT:
1223 		/*
1224 		 * note - this means that we just report the status back
1225 		 * to the top level driver, not that we actually think
1226 		 * that it indicates SUCCESS.
1227 		 */
1228 		return SUCCESS;
1229 		/*
1230 		 * when the low level driver returns did_soft_error,
1231 		 * it is responsible for keeping an internal retry counter
1232 		 * in order to avoid endless loops (db)
1233 		 *
1234 		 * actually this is a bug in this function here.  we should
1235 		 * be mindful of the maximum number of retries specified
1236 		 * and not get stuck in a loop.
1237 		 */
1238 	case DID_SOFT_ERROR:
1239 		goto maybe_retry;
1240 	case DID_IMM_RETRY:
1241 		return NEEDS_RETRY;
1242 
1243 	case DID_REQUEUE:
1244 		return ADD_TO_MLQUEUE;
1245 
1246 	case DID_ERROR:
1247 		if (msg_byte(scmd->result) == COMMAND_COMPLETE &&
1248 		    status_byte(scmd->result) == RESERVATION_CONFLICT)
1249 			/*
1250 			 * execute reservation conflict processing code
1251 			 * lower down
1252 			 */
1253 			break;
1254 		/* fallthrough */
1255 
1256 	case DID_BUS_BUSY:
1257 	case DID_PARITY:
1258 		goto maybe_retry;
1259 	case DID_TIME_OUT:
1260 		/*
1261 		 * when we scan the bus, we get timeout messages for
1262 		 * these commands if there is no device available.
1263 		 * other hosts report did_no_connect for the same thing.
1264 		 */
1265 		if ((scmd->cmnd[0] == TEST_UNIT_READY ||
1266 		     scmd->cmnd[0] == INQUIRY)) {
1267 			return SUCCESS;
1268 		} else {
1269 			return FAILED;
1270 		}
1271 	case DID_RESET:
1272 		return SUCCESS;
1273 	default:
1274 		return FAILED;
1275 	}
1276 
1277 	/*
1278 	 * next, check the message byte.
1279 	 */
1280 	if (msg_byte(scmd->result) != COMMAND_COMPLETE)
1281 		return FAILED;
1282 
1283 	/*
1284 	 * check the status byte to see if this indicates anything special.
1285 	 */
1286 	switch (status_byte(scmd->result)) {
1287 	case QUEUE_FULL:
1288 		/*
1289 		 * the case of trying to send too many commands to a
1290 		 * tagged queueing device.
1291 		 */
1292 	case BUSY:
1293 		/*
1294 		 * device can't talk to us at the moment.  Should only
1295 		 * occur (SAM-3) when the task queue is empty, so will cause
1296 		 * the empty queue handling to trigger a stall in the
1297 		 * device.
1298 		 */
1299 		return ADD_TO_MLQUEUE;
1300 	case GOOD:
1301 	case COMMAND_TERMINATED:
1302 	case TASK_ABORTED:
1303 		return SUCCESS;
1304 	case CHECK_CONDITION:
1305 		rtn = scsi_check_sense(scmd);
1306 		if (rtn == NEEDS_RETRY)
1307 			goto maybe_retry;
1308 		/* if rtn == FAILED, we have no sense information;
1309 		 * returning FAILED will wake the error handler thread
1310 		 * to collect the sense and redo the decide
1311 		 * disposition */
1312 		return rtn;
1313 	case CONDITION_GOOD:
1314 	case INTERMEDIATE_GOOD:
1315 	case INTERMEDIATE_C_GOOD:
1316 	case ACA_ACTIVE:
1317 		/*
1318 		 * who knows?  FIXME(eric)
1319 		 */
1320 		return SUCCESS;
1321 
1322 	case RESERVATION_CONFLICT:
1323 		sdev_printk(KERN_INFO, scmd->device,
1324 			    "reservation conflict\n");
1325 		return SUCCESS; /* causes immediate i/o error */
1326 	default:
1327 		return FAILED;
1328 	}
1329 	return FAILED;
1330 
1331       maybe_retry:
1332 
1333 	/* we requeue for retry because the error was retryable, and
1334 	 * the request was not marked fast fail.  Note that above,
1335 	 * even if the request is marked fast fail, we still requeue
1336 	 * for queue congestion conditions (QUEUE_FULL or BUSY) */
1337 	if ((++scmd->retries) <= scmd->allowed
1338 	    && !blk_noretry_request(scmd->request)) {
1339 		return NEEDS_RETRY;
1340 	} else {
1341 		/*
1342 		 * no more retries - report this one back to upper level.
1343 		 */
1344 		return SUCCESS;
1345 	}
1346 }
1347 
1348 /**
1349  * scsi_eh_lock_door - Prevent medium removal for the specified device
1350  * @sdev:	SCSI device to prevent medium removal
1351  *
1352  * Locking:
1353  * 	We must be called from process context; scsi_allocate_request()
1354  * 	may sleep.
1355  *
1356  * Notes:
1357  * 	We queue up an asynchronous "ALLOW MEDIUM REMOVAL" request on the
1358  * 	head of the devices request queue, and continue.
1359  *
1360  * Bugs:
1361  * 	scsi_allocate_request() may sleep waiting for existing requests to
1362  * 	be processed.  However, since we haven't kicked off any request
1363  * 	processing for this host, this may deadlock.
1364  *
1365  *	If scsi_allocate_request() fails for what ever reason, we
1366  *	completely forget to lock the door.
1367  **/
1368 static void scsi_eh_lock_door(struct scsi_device *sdev)
1369 {
1370 	unsigned char cmnd[MAX_COMMAND_SIZE];
1371 
1372 	cmnd[0] = ALLOW_MEDIUM_REMOVAL;
1373 	cmnd[1] = 0;
1374 	cmnd[2] = 0;
1375 	cmnd[3] = 0;
1376 	cmnd[4] = SCSI_REMOVAL_PREVENT;
1377 	cmnd[5] = 0;
1378 
1379 	scsi_execute_async(sdev, cmnd, 6, DMA_NONE, NULL, 0, 0, 10 * HZ,
1380 			   5, NULL, NULL, GFP_KERNEL);
1381 }
1382 
1383 
1384 /**
1385  * scsi_restart_operations - restart io operations to the specified host.
1386  * @shost:	Host we are restarting.
1387  *
1388  * Notes:
1389  *    When we entered the error handler, we blocked all further i/o to
1390  *    this device.  we need to 'reverse' this process.
1391  **/
1392 static void scsi_restart_operations(struct Scsi_Host *shost)
1393 {
1394 	struct scsi_device *sdev;
1395 	unsigned long flags;
1396 
1397 	/*
1398 	 * If the door was locked, we need to insert a door lock request
1399 	 * onto the head of the SCSI request queue for the device.  There
1400 	 * is no point trying to lock the door of an off-line device.
1401 	 */
1402 	shost_for_each_device(sdev, shost) {
1403 		if (scsi_device_online(sdev) && sdev->locked)
1404 			scsi_eh_lock_door(sdev);
1405 	}
1406 
1407 	/*
1408 	 * next free up anything directly waiting upon the host.  this
1409 	 * will be requests for character device operations, and also for
1410 	 * ioctls to queued block devices.
1411 	 */
1412 	SCSI_LOG_ERROR_RECOVERY(3, printk("%s: waking up host to restart\n",
1413 					  __FUNCTION__));
1414 
1415 	spin_lock_irqsave(shost->host_lock, flags);
1416 	if (scsi_host_set_state(shost, SHOST_RUNNING))
1417 		if (scsi_host_set_state(shost, SHOST_CANCEL))
1418 			BUG_ON(scsi_host_set_state(shost, SHOST_DEL));
1419 	spin_unlock_irqrestore(shost->host_lock, flags);
1420 
1421 	wake_up(&shost->host_wait);
1422 
1423 	/*
1424 	 * finally we need to re-initiate requests that may be pending.  we will
1425 	 * have had everything blocked while error handling is taking place, and
1426 	 * now that error recovery is done, we will need to ensure that these
1427 	 * requests are started.
1428 	 */
1429 	scsi_run_host_queues(shost);
1430 }
1431 
1432 /**
1433  * scsi_eh_ready_devs - check device ready state and recover if not.
1434  * @shost: 	host to be recovered.
1435  * @eh_done_q:	list_head for processed commands.
1436  *
1437  **/
1438 void scsi_eh_ready_devs(struct Scsi_Host *shost,
1439 			struct list_head *work_q,
1440 			struct list_head *done_q)
1441 {
1442 	if (!scsi_eh_stu(shost, work_q, done_q))
1443 		if (!scsi_eh_bus_device_reset(shost, work_q, done_q))
1444 			if (!scsi_eh_bus_reset(shost, work_q, done_q))
1445 				if (!scsi_eh_host_reset(work_q, done_q))
1446 					scsi_eh_offline_sdevs(work_q, done_q);
1447 }
1448 EXPORT_SYMBOL_GPL(scsi_eh_ready_devs);
1449 
1450 /**
1451  * scsi_eh_flush_done_q - finish processed commands or retry them.
1452  * @done_q:	list_head of processed commands.
1453  *
1454  **/
1455 void scsi_eh_flush_done_q(struct list_head *done_q)
1456 {
1457 	struct scsi_cmnd *scmd, *next;
1458 
1459 	list_for_each_entry_safe(scmd, next, done_q, eh_entry) {
1460 		list_del_init(&scmd->eh_entry);
1461 		if (scsi_device_online(scmd->device) &&
1462 		    !blk_noretry_request(scmd->request) &&
1463 		    (++scmd->retries <= scmd->allowed)) {
1464 			SCSI_LOG_ERROR_RECOVERY(3, printk("%s: flush"
1465 							  " retry cmd: %p\n",
1466 							  current->comm,
1467 							  scmd));
1468 				scsi_queue_insert(scmd, SCSI_MLQUEUE_EH_RETRY);
1469 		} else {
1470 			/*
1471 			 * If just we got sense for the device (called
1472 			 * scsi_eh_get_sense), scmd->result is already
1473 			 * set, do not set DRIVER_TIMEOUT.
1474 			 */
1475 			if (!scmd->result)
1476 				scmd->result |= (DRIVER_TIMEOUT << 24);
1477 			SCSI_LOG_ERROR_RECOVERY(3, printk("%s: flush finish"
1478 							" cmd: %p\n",
1479 							current->comm, scmd));
1480 			scsi_finish_command(scmd);
1481 		}
1482 	}
1483 }
1484 EXPORT_SYMBOL(scsi_eh_flush_done_q);
1485 
1486 /**
1487  * scsi_unjam_host - Attempt to fix a host which has a cmd that failed.
1488  * @shost:	Host to unjam.
1489  *
1490  * Notes:
1491  *    When we come in here, we *know* that all commands on the bus have
1492  *    either completed, failed or timed out.  we also know that no further
1493  *    commands are being sent to the host, so things are relatively quiet
1494  *    and we have freedom to fiddle with things as we wish.
1495  *
1496  *    This is only the *default* implementation.  it is possible for
1497  *    individual drivers to supply their own version of this function, and
1498  *    if the maintainer wishes to do this, it is strongly suggested that
1499  *    this function be taken as a template and modified.  this function
1500  *    was designed to correctly handle problems for about 95% of the
1501  *    different cases out there, and it should always provide at least a
1502  *    reasonable amount of error recovery.
1503  *
1504  *    Any command marked 'failed' or 'timeout' must eventually have
1505  *    scsi_finish_cmd() called for it.  we do all of the retry stuff
1506  *    here, so when we restart the host after we return it should have an
1507  *    empty queue.
1508  **/
1509 static void scsi_unjam_host(struct Scsi_Host *shost)
1510 {
1511 	unsigned long flags;
1512 	LIST_HEAD(eh_work_q);
1513 	LIST_HEAD(eh_done_q);
1514 
1515 	spin_lock_irqsave(shost->host_lock, flags);
1516 	list_splice_init(&shost->eh_cmd_q, &eh_work_q);
1517 	spin_unlock_irqrestore(shost->host_lock, flags);
1518 
1519 	SCSI_LOG_ERROR_RECOVERY(1, scsi_eh_prt_fail_stats(shost, &eh_work_q));
1520 
1521 	if (!scsi_eh_get_sense(&eh_work_q, &eh_done_q))
1522 		if (!scsi_eh_abort_cmds(&eh_work_q, &eh_done_q))
1523 			scsi_eh_ready_devs(shost, &eh_work_q, &eh_done_q);
1524 
1525 	scsi_eh_flush_done_q(&eh_done_q);
1526 }
1527 
1528 /**
1529  * scsi_error_handler - SCSI error handler thread
1530  * @data:	Host for which we are running.
1531  *
1532  * Notes:
1533  *    This is the main error handling loop.  This is run as a kernel thread
1534  *    for every SCSI host and handles all error handling activity.
1535  **/
1536 int scsi_error_handler(void *data)
1537 {
1538 	struct Scsi_Host *shost = data;
1539 
1540 	current->flags |= PF_NOFREEZE;
1541 
1542 	/*
1543 	 * We use TASK_INTERRUPTIBLE so that the thread is not
1544 	 * counted against the load average as a running process.
1545 	 * We never actually get interrupted because kthread_run
1546 	 * disables singal delivery for the created thread.
1547 	 */
1548 	set_current_state(TASK_INTERRUPTIBLE);
1549 	while (!kthread_should_stop()) {
1550 		if ((shost->host_failed == 0 && shost->host_eh_scheduled == 0) ||
1551 		    shost->host_failed != shost->host_busy) {
1552 			SCSI_LOG_ERROR_RECOVERY(1,
1553 				printk("Error handler scsi_eh_%d sleeping\n",
1554 					shost->host_no));
1555 			schedule();
1556 			set_current_state(TASK_INTERRUPTIBLE);
1557 			continue;
1558 		}
1559 
1560 		__set_current_state(TASK_RUNNING);
1561 		SCSI_LOG_ERROR_RECOVERY(1,
1562 			printk("Error handler scsi_eh_%d waking up\n",
1563 				shost->host_no));
1564 
1565 		/*
1566 		 * We have a host that is failing for some reason.  Figure out
1567 		 * what we need to do to get it up and online again (if we can).
1568 		 * If we fail, we end up taking the thing offline.
1569 		 */
1570 		if (shost->transportt->eh_strategy_handler)
1571 			shost->transportt->eh_strategy_handler(shost);
1572 		else
1573 			scsi_unjam_host(shost);
1574 
1575 		/*
1576 		 * Note - if the above fails completely, the action is to take
1577 		 * individual devices offline and flush the queue of any
1578 		 * outstanding requests that may have been pending.  When we
1579 		 * restart, we restart any I/O to any other devices on the bus
1580 		 * which are still online.
1581 		 */
1582 		scsi_restart_operations(shost);
1583 		set_current_state(TASK_INTERRUPTIBLE);
1584 	}
1585 	__set_current_state(TASK_RUNNING);
1586 
1587 	SCSI_LOG_ERROR_RECOVERY(1,
1588 		printk("Error handler scsi_eh_%d exiting\n", shost->host_no));
1589 	shost->ehandler = NULL;
1590 	return 0;
1591 }
1592 
1593 /*
1594  * Function:    scsi_report_bus_reset()
1595  *
1596  * Purpose:     Utility function used by low-level drivers to report that
1597  *		they have observed a bus reset on the bus being handled.
1598  *
1599  * Arguments:   shost       - Host in question
1600  *		channel     - channel on which reset was observed.
1601  *
1602  * Returns:     Nothing
1603  *
1604  * Lock status: Host lock must be held.
1605  *
1606  * Notes:       This only needs to be called if the reset is one which
1607  *		originates from an unknown location.  Resets originated
1608  *		by the mid-level itself don't need to call this, but there
1609  *		should be no harm.
1610  *
1611  *		The main purpose of this is to make sure that a CHECK_CONDITION
1612  *		is properly treated.
1613  */
1614 void scsi_report_bus_reset(struct Scsi_Host *shost, int channel)
1615 {
1616 	struct scsi_device *sdev;
1617 
1618 	__shost_for_each_device(sdev, shost) {
1619 		if (channel == sdev_channel(sdev)) {
1620 			sdev->was_reset = 1;
1621 			sdev->expecting_cc_ua = 1;
1622 		}
1623 	}
1624 }
1625 EXPORT_SYMBOL(scsi_report_bus_reset);
1626 
1627 /*
1628  * Function:    scsi_report_device_reset()
1629  *
1630  * Purpose:     Utility function used by low-level drivers to report that
1631  *		they have observed a device reset on the device being handled.
1632  *
1633  * Arguments:   shost       - Host in question
1634  *		channel     - channel on which reset was observed
1635  *		target	    - target on which reset was observed
1636  *
1637  * Returns:     Nothing
1638  *
1639  * Lock status: Host lock must be held
1640  *
1641  * Notes:       This only needs to be called if the reset is one which
1642  *		originates from an unknown location.  Resets originated
1643  *		by the mid-level itself don't need to call this, but there
1644  *		should be no harm.
1645  *
1646  *		The main purpose of this is to make sure that a CHECK_CONDITION
1647  *		is properly treated.
1648  */
1649 void scsi_report_device_reset(struct Scsi_Host *shost, int channel, int target)
1650 {
1651 	struct scsi_device *sdev;
1652 
1653 	__shost_for_each_device(sdev, shost) {
1654 		if (channel == sdev_channel(sdev) &&
1655 		    target == sdev_id(sdev)) {
1656 			sdev->was_reset = 1;
1657 			sdev->expecting_cc_ua = 1;
1658 		}
1659 	}
1660 }
1661 EXPORT_SYMBOL(scsi_report_device_reset);
1662 
1663 static void
1664 scsi_reset_provider_done_command(struct scsi_cmnd *scmd)
1665 {
1666 }
1667 
1668 /*
1669  * Function:	scsi_reset_provider
1670  *
1671  * Purpose:	Send requested reset to a bus or device at any phase.
1672  *
1673  * Arguments:	device	- device to send reset to
1674  *		flag - reset type (see scsi.h)
1675  *
1676  * Returns:	SUCCESS/FAILURE.
1677  *
1678  * Notes:	This is used by the SCSI Generic driver to provide
1679  *		Bus/Device reset capability.
1680  */
1681 int
1682 scsi_reset_provider(struct scsi_device *dev, int flag)
1683 {
1684 	struct scsi_cmnd *scmd = scsi_get_command(dev, GFP_KERNEL);
1685 	struct Scsi_Host *shost = dev->host;
1686 	struct request req;
1687 	unsigned long flags;
1688 	int rtn;
1689 
1690 	scmd->request = &req;
1691 	memset(&scmd->eh_timeout, 0, sizeof(scmd->eh_timeout));
1692 
1693 	memset(&scmd->cmnd, '\0', sizeof(scmd->cmnd));
1694 
1695 	scmd->scsi_done		= scsi_reset_provider_done_command;
1696 	scmd->done			= NULL;
1697 	scmd->request_buffer		= NULL;
1698 	scmd->request_bufflen		= 0;
1699 
1700 	scmd->cmd_len			= 0;
1701 
1702 	scmd->sc_data_direction		= DMA_BIDIRECTIONAL;
1703 
1704 	init_timer(&scmd->eh_timeout);
1705 
1706 	/*
1707 	 * Sometimes the command can get back into the timer chain,
1708 	 * so use the pid as an identifier.
1709 	 */
1710 	scmd->pid			= 0;
1711 
1712 	spin_lock_irqsave(shost->host_lock, flags);
1713 	shost->tmf_in_progress = 1;
1714 	spin_unlock_irqrestore(shost->host_lock, flags);
1715 
1716 	switch (flag) {
1717 	case SCSI_TRY_RESET_DEVICE:
1718 		rtn = scsi_try_bus_device_reset(scmd);
1719 		if (rtn == SUCCESS)
1720 			break;
1721 		/* FALLTHROUGH */
1722 	case SCSI_TRY_RESET_BUS:
1723 		rtn = scsi_try_bus_reset(scmd);
1724 		if (rtn == SUCCESS)
1725 			break;
1726 		/* FALLTHROUGH */
1727 	case SCSI_TRY_RESET_HOST:
1728 		rtn = scsi_try_host_reset(scmd);
1729 		break;
1730 	default:
1731 		rtn = FAILED;
1732 	}
1733 
1734 	spin_lock_irqsave(shost->host_lock, flags);
1735 	shost->tmf_in_progress = 0;
1736 	spin_unlock_irqrestore(shost->host_lock, flags);
1737 
1738 	/*
1739 	 * be sure to wake up anyone who was sleeping or had their queue
1740 	 * suspended while we performed the TMF.
1741 	 */
1742 	SCSI_LOG_ERROR_RECOVERY(3,
1743 		printk("%s: waking up host to restart after TMF\n",
1744 		__FUNCTION__));
1745 
1746 	wake_up(&shost->host_wait);
1747 
1748 	scsi_run_host_queues(shost);
1749 
1750 	scsi_next_command(scmd);
1751 	return rtn;
1752 }
1753 EXPORT_SYMBOL(scsi_reset_provider);
1754 
1755 /**
1756  * scsi_normalize_sense - normalize main elements from either fixed or
1757  *			descriptor sense data format into a common format.
1758  *
1759  * @sense_buffer:	byte array containing sense data returned by device
1760  * @sb_len:		number of valid bytes in sense_buffer
1761  * @sshdr:		pointer to instance of structure that common
1762  *			elements are written to.
1763  *
1764  * Notes:
1765  *	The "main elements" from sense data are: response_code, sense_key,
1766  *	asc, ascq and additional_length (only for descriptor format).
1767  *
1768  *	Typically this function can be called after a device has
1769  *	responded to a SCSI command with the CHECK_CONDITION status.
1770  *
1771  * Return value:
1772  *	1 if valid sense data information found, else 0;
1773  **/
1774 int scsi_normalize_sense(const u8 *sense_buffer, int sb_len,
1775                          struct scsi_sense_hdr *sshdr)
1776 {
1777 	if (!sense_buffer || !sb_len)
1778 		return 0;
1779 
1780 	memset(sshdr, 0, sizeof(struct scsi_sense_hdr));
1781 
1782 	sshdr->response_code = (sense_buffer[0] & 0x7f);
1783 
1784 	if (!scsi_sense_valid(sshdr))
1785 		return 0;
1786 
1787 	if (sshdr->response_code >= 0x72) {
1788 		/*
1789 		 * descriptor format
1790 		 */
1791 		if (sb_len > 1)
1792 			sshdr->sense_key = (sense_buffer[1] & 0xf);
1793 		if (sb_len > 2)
1794 			sshdr->asc = sense_buffer[2];
1795 		if (sb_len > 3)
1796 			sshdr->ascq = sense_buffer[3];
1797 		if (sb_len > 7)
1798 			sshdr->additional_length = sense_buffer[7];
1799 	} else {
1800 		/*
1801 		 * fixed format
1802 		 */
1803 		if (sb_len > 2)
1804 			sshdr->sense_key = (sense_buffer[2] & 0xf);
1805 		if (sb_len > 7) {
1806 			sb_len = (sb_len < (sense_buffer[7] + 8)) ?
1807 					 sb_len : (sense_buffer[7] + 8);
1808 			if (sb_len > 12)
1809 				sshdr->asc = sense_buffer[12];
1810 			if (sb_len > 13)
1811 				sshdr->ascq = sense_buffer[13];
1812 		}
1813 	}
1814 
1815 	return 1;
1816 }
1817 EXPORT_SYMBOL(scsi_normalize_sense);
1818 
1819 int scsi_command_normalize_sense(struct scsi_cmnd *cmd,
1820 				 struct scsi_sense_hdr *sshdr)
1821 {
1822 	return scsi_normalize_sense(cmd->sense_buffer,
1823 			sizeof(cmd->sense_buffer), sshdr);
1824 }
1825 EXPORT_SYMBOL(scsi_command_normalize_sense);
1826 
1827 /**
1828  * scsi_sense_desc_find - search for a given descriptor type in
1829  *			descriptor sense data format.
1830  *
1831  * @sense_buffer:	byte array of descriptor format sense data
1832  * @sb_len:		number of valid bytes in sense_buffer
1833  * @desc_type:		value of descriptor type to find
1834  *			(e.g. 0 -> information)
1835  *
1836  * Notes:
1837  *	only valid when sense data is in descriptor format
1838  *
1839  * Return value:
1840  *	pointer to start of (first) descriptor if found else NULL
1841  **/
1842 const u8 * scsi_sense_desc_find(const u8 * sense_buffer, int sb_len,
1843 				int desc_type)
1844 {
1845 	int add_sen_len, add_len, desc_len, k;
1846 	const u8 * descp;
1847 
1848 	if ((sb_len < 8) || (0 == (add_sen_len = sense_buffer[7])))
1849 		return NULL;
1850 	if ((sense_buffer[0] < 0x72) || (sense_buffer[0] > 0x73))
1851 		return NULL;
1852 	add_sen_len = (add_sen_len < (sb_len - 8)) ?
1853 			add_sen_len : (sb_len - 8);
1854 	descp = &sense_buffer[8];
1855 	for (desc_len = 0, k = 0; k < add_sen_len; k += desc_len) {
1856 		descp += desc_len;
1857 		add_len = (k < (add_sen_len - 1)) ? descp[1]: -1;
1858 		desc_len = add_len + 2;
1859 		if (descp[0] == desc_type)
1860 			return descp;
1861 		if (add_len < 0) // short descriptor ??
1862 			break;
1863 	}
1864 	return NULL;
1865 }
1866 EXPORT_SYMBOL(scsi_sense_desc_find);
1867 
1868 /**
1869  * scsi_get_sense_info_fld - attempts to get information field from
1870  *			sense data (either fixed or descriptor format)
1871  *
1872  * @sense_buffer:	byte array of sense data
1873  * @sb_len:		number of valid bytes in sense_buffer
1874  * @info_out:		pointer to 64 integer where 8 or 4 byte information
1875  *			field will be placed if found.
1876  *
1877  * Return value:
1878  *	1 if information field found, 0 if not found.
1879  **/
1880 int scsi_get_sense_info_fld(const u8 * sense_buffer, int sb_len,
1881 			    u64 * info_out)
1882 {
1883 	int j;
1884 	const u8 * ucp;
1885 	u64 ull;
1886 
1887 	if (sb_len < 7)
1888 		return 0;
1889 	switch (sense_buffer[0] & 0x7f) {
1890 	case 0x70:
1891 	case 0x71:
1892 		if (sense_buffer[0] & 0x80) {
1893 			*info_out = (sense_buffer[3] << 24) +
1894 				    (sense_buffer[4] << 16) +
1895 				    (sense_buffer[5] << 8) + sense_buffer[6];
1896 			return 1;
1897 		} else
1898 			return 0;
1899 	case 0x72:
1900 	case 0x73:
1901 		ucp = scsi_sense_desc_find(sense_buffer, sb_len,
1902 					   0 /* info desc */);
1903 		if (ucp && (0xa == ucp[1])) {
1904 			ull = 0;
1905 			for (j = 0; j < 8; ++j) {
1906 				if (j > 0)
1907 					ull <<= 8;
1908 				ull |= ucp[4 + j];
1909 			}
1910 			*info_out = ull;
1911 			return 1;
1912 		} else
1913 			return 0;
1914 	default:
1915 		return 0;
1916 	}
1917 }
1918 EXPORT_SYMBOL(scsi_get_sense_info_fld);
1919