Linux那些事儿之我是Block层(10)scsi命令的前世今生(四)

当然,while循环结束也可能是因为1453行的这两个判断.首先req如果没有了,另一个得看scsi_dev_queue_ready()的返回值,如果返回值为0,那么break也会被执行,从而结束循环.

1270 /*

1271 * scsi_dev_queue_ready: if we can send requests to sdev, return 1 else

1272 * return 0.

1273 *

1274 * Called with the queue_lock held.

1275 */

1276 static inline int scsi_dev_queue_ready(struct request_queue *q,

1277 struct scsi_device *sdev)

1278 {

1279 if (sdev->device_busy >= sdev->queue_depth)

1280 return 0;

1281 if (sdev->device_busy == 0 && sdev->device_blocked) {

1282 /*

1283 * unblock after device_blocked iterates to zero

1284 */

1285 if (--sdev->device_blocked == 0) {

1286 SCSI_LOG_MLQUEUE(3,

1287 sdev_printk(KERN_INFO, sdev,

1288 "unblocking device at zero depth/n"));

1289 } else {

1290 blk_plug_device(q);

1291 return 0;

1292 }

1293 }

1294 if (sdev->device_blocked)

1295 return 0;

1296

1297 return 1;

1298 }

这里需要判断的是device_busy.这个flag如果设置了,说明命令正在执行中,或者说命令已经传递到了底层驱动.因此,我们在调用scsi_dispatch_cmd之前先增加device_busy,即1469行.

另一个flag是device_blocked.这个flag是告诉世人这个设备不能再接收新的命令了,因为它十有八九是正在处理命令.正常情况下这个flag的值为0.除非你调用了scsi_queue_insert()函数.友情提示一下,scsi设备的这个flag是提供了sysfs的接口的,因此我们可以通过sysfs的接口看一下设备的这个值,下面列举了两个scsi设备的这个变量的值,可以看到都是0,应该说这是它的常态.

[root@localhost ~]# ls /sys/bus/scsi/devices/

0:0:8:0/ 0:2:0:0/ 1:0:0:0/ 2:0:0:0/

[root@localhost ~]# ls /sys/bus/scsi/devices/2/:0/:0/:0/

block:sdb/ iocounterbits modalias rev subsystem/ bus/ iodone_cnt model scsi_device:2:0:0:0/ timeout delete ioerr_cnt queue_depth scsi_disk:2:0:0:0/ type device_blocked iorequest_cnt queue_type scsi_level uevent driver/ max_sectors rescan state vendor

[root@localhost ~]# cat /sys/bus/scsi/devices/2/:0/:0/:0/device_blocked

0

[root@localhost ~]# cat /sys/bus/scsi/devices/0/:0/:8/:0/device_blocked

0

所以正常情况下,scsi_dev_queue_ready()函数的返回值就是1,这一点正如其注释里说的那样.但是所谓的常态,指的是单独执行一个命令,如果要执行多个命令,或者说我们提交了多个request,那么device_busy就会一次次的在1469行增加,从而使得device_busy有可能将超过queue_depth,这样子scsi_dev_queue_ready()就会返回0,从而scsi_request_fn()就有可能结束,这之后,__generic_unplug_device也将返回,之后blk_execute_rq_nowait()返回,回到blk_execute_rq()中,执行wait_for_completion(),于是就睡眠了,等待了,按照游戏规则,我们应该能找到一条complete()语句来唤醒它,那么这条语句在哪里呢?答案是blk_end_sync_rq.

网友”宁失身不失眠”非常好奇我是怎么知道的.说来话长,还记得我们当时在usb-storage中说的那个scsi_done么?命令执行完了就会call scsi_done.而scsi_done来自drivers/scsi/scsi.c,很显然这个函数是我们的突破口,我们找到了这个函数就好比国民党找到了甫志高,就好比王佳芝找到了易先生:

608 /**

609 * scsi_done - Enqueue the finished SCSI command into the done queue.

610 * @cmd: The SCSI Command for which a low-level device driver (LLDD) gives

611 * ownership back to SCSI Core -- i.e. the LLDD has finished with it.

612 *

613 * This function is the mid-level's (SCSI Core) interrupt routine, which

614 * regains ownership of the SCSI command (de facto) from a LLDD, and enqueues

615 * the command to the done queue for further processing.

616 *

617 * This is the producer of the done queue who enqueues at the tail.

618 *

619 * This function is interrupt context safe.

620 */

621 static void scsi_done(struct scsi_cmnd *cmd)

622 {

623 /*

624 * We don't have to worry about this one timing out any more.

625 * If we are unable to remove the timer, then the command

626 * has already timed out. In which case, we have no choice but to

627 * let the timeout function run, as we have no idea where in fact

628 * that function could really be. It might be on another processor,

629 * etc, etc.

630 */

631 if (!scsi_delete_timer(cmd))

632 return;

633 __scsi_done(cmd);

634 }

躲躲闪闪的是来自同一文件的__scsi_done,

636 /* Private entry to scsi_done() to complete a command when the timer

637 * isn't running --- used by scsi_times_out */

638 void __scsi_done(struct scsi_cmnd *cmd)

639 {

640 struct request *rq = cmd->request;

641

642 /*

643 * Set the serial numbers back to zero

644 */

645 cmd->serial_number = 0;

646

647 atomic_inc(&cmd->device->iodone_cnt);

648 if (cmd->result)

649 atomic_inc(&cmd->device->ioerr_cnt);

650

651 BUG_ON(!rq);

652

653 /*

654 * The uptodate/nbytes values don't matter, as we allow partial

655 * completes and thus will check this in the softirq callback

656 */

657 rq->completion_data = cmd;

658 blk_complete_request(rq);

659 }

别的我们都不关心,就关心最后这个blk_complete_request().

3588 /**

3589 * blk_complete_request - end I/O on a request

3590 * @req: the request being processed

3591 *

3592 * Description:

3593 * Ends all I/O on a request. It does not handle partial completions,

3594 * unless the driver actually implements this in its completion callback

3595 * through requeueing. Theh actual completion happens out-of-order,

3596 * through a softirq handler. The user must have registered a completion

3597 * callback through blk_queue_softirq_done().

3598 **/

3599

3600 void blk_complete_request(struct request *req)

3601 {

3602 struct list_head *cpu_list;

3603 unsigned long flags;

3604

3605 BUG_ON(!req->q->softirq_done_fn);

3606

3607 local_irq_save(flags);

3608

3609 cpu_list = &__get_cpu_var(blk_cpu_done);

3610 list_add_tail(&req->donelist, cpu_list);

3611 raise_softirq_irqoff(BLOCK_SOFTIRQ);

3612

3613 local_irq_restore(flags);

3614 }

其它的咱们不管,就管一管这个raise_softirq_irqoff().在很久很久以前,有一个函数,它的名字叫做blk_dev_init().它是我们这个故事的起源.在这个函数中我们曾经见过这么一行,

3720 open_softirq(BLOCK_SOFTIRQ, blk_done_softirq, NULL);

当时咱们就说过,它所做的就是初始化了一个softirq,即BLOCK_SOFTIRQ.并且绑定了softirq函数blk_done_softirq,而要触发这个软中断,咱们当时也说了,只要调用raise_softirq_irqoff()即可.所以现在我们也就这样做了.这也就意味着,blk_done_softirq会被调用.

3542 /*

3543 * splice the completion data to a local structure and hand off to

3544 * process_completion_queue() to complete the requests

3545 */

3546 static void blk_done_softirq(struct softirq_action *h)

3547 {

3548 struct list_head *cpu_list, local_list;

3549

3550 local_irq_disable();

3551 cpu_list = &__get_cpu_var(blk_cpu_done);

3552 list_replace_init(cpu_list, &local_list);

3553 local_irq_enable();

3554

3555 while (!list_empty(&local_list)) {

3556 struct request *rq = list_entry(local_list.next, struct request, donelist);

3557

3558 list_del_init(&rq->donelist);

3559 rq->q->softirq_done_fn(rq);

3560 }

3561 }

而这个softirq_done_fn是什么呢?不要说你不知道,其实我们也讲过.不过忘记了也不要紧,人最大的烦恼便是记忆太好,健忘的人容易快乐.在scsi_alloc_queue中,我们调用blk_queue_softirq_done把scsi_softirq_done赋给了q->softirq_done_fn,所以到了这里,被调用的就是scsi_softirq_done.

1376 static void scsi_softirq_done(struct request *rq)

1377 {

1378 struct scsi_cmnd *cmd = rq->completion_data;

1379 unsigned long wait_for = (cmd->allowed + 1) * cmd->timeout_per_command;

1380 int disposition;

1381

1382 INIT_LIST_HEAD(&cmd->eh_entry);

1383

1384 disposition = scsi_decide_disposition(cmd);

1385 if (disposition != SUCCESS &&

1386 time_before(cmd->jiffies_at_alloc + wait_for, jiffies)) {

1387 sdev_printk(KERN_ERR, cmd->device,

1388 "timing out command, waited %lus/n",

1389 wait_for/HZ);

1390 disposition = SUCCESS;

1391 }

1392

1393 scsi_log_completion(cmd, disposition);

1394

1395 switch (disposition) {

1396 case SUCCESS:

1397 scsi_finish_command(cmd);

1398 break;

1399 case NEEDS_RETRY:

1400 scsi_queue_insert(cmd, SCSI_MLQUEUE_EH_RETRY);

1401 break;

1402 case ADD_TO_MLQUEUE:

1403 scsi_queue_insert(cmd, SCSI_MLQUEUE_DEVICE_BUSY);

1404 break;

1405 default:

1406 if (!scsi_eh_scmd_add(cmd, 0))

1407 scsi_finish_command(cmd);

1408 }

1409 }

不用我多说,你也知道,scsi_softirq_done会调用scsi_finish_command,来自drivers/scsi/scsi.c:

661 /*

662 * Function: scsi_finish_command

663 *

664 * Purpose: Pass command off to upper layer for finishing of I/O

665 * request, waking processes that are waiting on results,

666 * etc.

667 */

668 void scsi_finish_command(struct scsi_cmnd *cmd)

669 {

670 struct scsi_device *sdev = cmd->device;

671 struct Scsi_Host *shost = sdev->host;

672

673 scsi_device_unbusy(sdev);

674

675 /*

676 * Clear the flags which say that the device/host is no longer

677 * capable of accepting new commands. These are set in scsi_queue.c

678 * for both the queue full condition on a device, and for a

679 * host full condition on the host.

680 *

681 * XXX(hch): What about locking?

682 */

683 shost->host_blocked = 0;

684 sdev->device_blocked = 0;

685

686 /*

687 * If we have valid sense information, then some kind of recovery

688 * must have taken place. Make a note of this.

689 */

690 if (SCSI_SENSE_VALID(cmd))

691 cmd->result |= (DRIVER_SENSE << 24);

692

693 SCSI_LOG_MLCOMPLETE(4, sdev_printk(KERN_INFO, sdev,

694 "Notifying upper driver of completion "

695 "(result %x)/n", cmd->result));

696

697 cmd->done(cmd);

698 }

也就是说,cmd->done会被调用,从而真正的幕后工作者scsi_blk_pc_done会被调用.因为,当初在scsi_setup_blk_pc_cmnd()中有这么一行,

1135 cmd->done = scsi_blk_pc_done;

而scsi_blk_pc_done来自drivers/scsi/scsi_lib.c:

1078 static void scsi_blk_pc_done(struct scsi_cmnd *cmd)

1079 {

1080 BUG_ON(!blk_pc_request(cmd->request));

1081 /*

1082 * This will complete the whole command with uptodate=1 so

1083 * as far as the block layer is concerned the command completed

1084 * successfully. Since this is a REQ_BLOCK_PC command the

1085 * caller should check the request's errors value

1086 */

1087 scsi_io_completion(cmd, cmd->request_bufflen);

1088 }

来自drivers/scsi/scsi_lib.c:

789 /*

790 * Function: scsi_io_completion()

791 *

792 * Purpose: Completion processing for block device I/O requests.

793 *

794 * Arguments: cmd - command that is finished.

795 *

796 * Lock status: Assumed that no lock is held upon entry.

797 *

798 * Returns: Nothing

799 *

800 * Notes: This function is matched in terms of capabilities to

801 * the function that created the scatter-gather list.

802 * In other words, if there are no bounce buffers

803 * (the normal case for most drivers), we don't need

804 * the logic to deal with cleaning up afterwards.

805 *

806 * We must do one of several things here:

807 *

808 * a) Call scsi_end_request. This will finish off the

809 * specified number of sectors. If we are done, the

810 * command block will be released, and the queue

811 * function will be goosed. If we are not done, then

812 * scsi_end_request will directly goose the queue.

813 *

814 * b) We can just use scsi_requeue_command() here. This would

815 * be used if we just wanted to retry, for example.

816 */

817 void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)

818 {

819 int result = cmd->result;

820 int this_count = cmd->request_bufflen;

821 request_queue_t *q = cmd->device->request_queue;

822 struct request *req = cmd->request;

823 int clear_errors = 1;

824 struct scsi_sense_hdr sshdr;

825 int sense_valid = 0;

826 int sense_deferred = 0;

827

828 scsi_release_buffers(cmd);

829

830 if (result) {

831 sense_valid = scsi_command_normalize_sense(cmd, &sshdr);

832 if (sense_valid)

833 sense_deferred = scsi_sense_is_deferred(&sshdr);

834 }

835

836 if (blk_pc_request(req)) { /* SG_IO ioctl from block level */

837 req->errors = result;

838 if (result) {

839 clear_errors = 0;

840 if (sense_valid && req->sense) {

841 /*

842 * SG_IO wants current and deferred errors

843 */

844 int len = 8 + cmd->sense_buffer[7];

845

846 if (len > SCSI_SENSE_BUFFERSIZE)

847 len = SCSI_SENSE_BUFFERSIZE;

848 memcpy(req->sense, cmd->sense_buffer, len);

849 req->sense_len = len;

850 }

851 }

852 req->data_len = cmd->resid;

853 }

854

855 /*

856 * Next deal with any sectors which we were able to correctly

857 * handle.

858 */

859 SCSI_LOG_HLCOMPLETE(1, printk("%ld sectors total, "

860 "%d bytes done./n",

861 req->nr_sectors, good_bytes));

862 SCSI_LOG_HLCOMPLETE(1, printk("use_sg is %d/n", cmd->use_sg));

863

864 if (clear_errors)

865 req->errors = 0;

866

867 /* A number of bytes were successfully read. If there

868 * are leftovers and there is some kind of error

869 * (result != 0), retry the rest.

870 */

871 if (scsi_end_request(cmd, 1, good_bytes, result == 0) == NULL)

872 return;

873

874 /* good_bytes = 0, or (inclusive) there were leftovers and

875 * result = 0, so scsi_end_request couldn't retry.

876 */

877 if (sense_valid && !sense_deferred) {

878 switch (sshdr.sense_key) {

879 case UNIT_ATTENTION:

880 if (cmd->device->removable) {

881 /* Detected disc change. Set a bit

882 * and quietly refuse further access.

883 */

884 cmd->device->changed = 1;

885 scsi_end_request(cmd, 0, this_count, 1);

886 return;

887 } else {

888 /* Must have been a power glitch, or a

889 * bus reset. Could not have been a

890 * media change, so we just retry the

891 * request and see what happens.

892 */

893 scsi_requeue_command(q, cmd);

894 return;

895 }

896 break;

897 case ILLEGAL_REQUEST:

898 /* If we had an ILLEGAL REQUEST returned, then

899 * we may have performed an unsupported

900 * command. The only thing this should be

901 * would be a ten byte read where only a six

902 * byte read was supported. Also, on a system

903 * where READ CAPACITY failed, we may have

904 * read past the end of the disk.

905 */

906 if ((cmd->device->use_10_for_rw &&

907 sshdr.asc == 0x20 && sshdr.ascq == 0x00) &&

908 (cmd->cmnd[0] == READ_10 ||

909 cmd->cmnd[0] == WRITE_10)) {

910 cmd->device->use_10_for_rw = 0;

911 /* This will cause a retry with a

912 * 6-byte command.

913 */

914 scsi_requeue_command(q, cmd);

915 return;

916 } else {

917 scsi_end_request(cmd, 0, this_count, 1);

918 return;

919 }

920 break;

921 case NOT_READY:

922 /* If the device is in the process of becoming

923 * ready, or has a temporary blockage, retry.

924 */

925 if (sshdr.asc == 0x04) {

926 switch (sshdr.ascq) {

927 case 0x01: /* becoming ready */

928 case 0x04: /* format in progress */

929 case 0x05: /* rebuild in progress */

930 case 0x06: /* recalculation in progress */

931 case 0x07: /* operation in progress */

932 case 0x08: /* Long write in progress */

933 case 0x09: /* self test in progress */

934 scsi_requeue_command(q, cmd);

935 return;

936 default:

937 break;

938 }

939 }

940 if (!(req->cmd_flags & REQ_QUIET)) {

941 scmd_printk(KERN_INFO, cmd,

942 "Device not ready: ");

943 scsi_print_sense_hdr("", &sshdr);

944 }

945 scsi_end_request(cmd, 0, this_count, 1);

946 return;

947 case VOLUME_OVERFLOW:

948 if (!(req->cmd_flags & REQ_QUIET)) {

949 scmd_printk(KERN_INFO, cmd,

950 "Volume overflow, CDB: ");

951 __scsi_print_command(cmd->cmnd);

952 scsi_print_sense("", cmd);

953 }

954 /* See SSC3rXX or current. */

955 scsi_end_request(cmd, 0, this_count, 1);

956 return;

957 default:

958 break;

959 }

960 }

961 if (host_byte(result) == DID_RESET) {

962 /* Third party bus reset or reset for error recovery

963 * reasons. Just retry the request and see what

964 * happens.

965 */

966 scsi_requeue_command(q, cmd);

967 return;

968 }

969 if (result) {

970 if (!(req->cmd_flags & REQ_QUIET)) {

971 scsi_print_result(cmd);

972 if (driver_byte(result) & DRIVER_SENSE)

973 scsi_print_sense("", cmd);

974 }

975 }

976 scsi_end_request(cmd, 0, this_count, !result);

977 }

又是一个令人发指的函数.但我什么都不想多说了.直接跳到最后一行,scsi_end_request().来自drivers/scsi_lib.c:

632 /*

633 * Function: scsi_end_request()

634 *

635 * Purpose: Post-processing of completed commands (usually invoked at end

636 * of upper level post-processing and scsi_io_completion).

637 *

638 * Arguments: cmd - command that is complete.

639 * uptodate - 1 if I/O indicates success, <= 0 for I/O error.

640 * bytes - number of bytes of completed I/O

641 * requeue - indicates whether we should requeue leftovers.

642 *

643 * Lock status: Assumed that lock is not held upon entry.

644 *

645 * Returns: cmd if requeue required, NULL otherwise.

646 *

647 * Notes: This is called for block device requests in order to

648 * mark some number of sectors as complete.

649 *

650 * We are guaranteeing that the request queue will be goosed

651 * at some point during this call.

652 * Notes: If cmd was requeued, upon return it will be a stale pointer.

653 */

654 static struct scsi_cmnd *scsi_end_request(struct scsi_cmnd *cmd, int uptodate,

655 int bytes, int requeue)

656 {

657 request_queue_t *q = cmd->device->request_queue;

658 struct request *req = cmd->request;

659 unsigned long flags;

660

661 /*

662 * If there are blocks left over at the end, set up the command

663 * to queue the remainder of them.

664 */

665 if (end_that_request_chunk(req, uptodate, bytes)) {

666 int leftover = (req->hard_nr_sectors << 9);

667

668 if (blk_pc_request(req))

669 leftover = req->data_len;

670

671 /* kill remainder if no retrys */

672 if (!uptodate && blk_noretry_request(req))

673 end_that_request_chunk(req, 0, leftover);

674 else {

675 if (requeue) {

676 /*

677 * Bleah. Leftovers again. Stick the

678 * leftovers in the front of the

679 * queue, and goose the queue again.

680 */

681 scsi_requeue_command(q, cmd);

682 cmd = NULL;

683 }

684 return cmd;

685 }

686 }

687

688 add_disk_randomness(req->rq_disk);

689

690 spin_lock_irqsave(q->queue_lock, flags);

691 if (blk_rq_tagged(req))

692 blk_queue_end_tag(q, req);

693 end_that_request_last(req, uptodate);

694 spin_unlock_irqrestore(q->queue_lock, flags);

695

696 /*

697 * This will goose the queue request function at the end, so we don't

698 * need to worry about launching another command.

699 */

700 scsi_next_command(cmd);

701 return NULL;

702 }

而我们最需要关心的,是693行end_that_request_last.

3618 /*

3619 * queue lock must be held

3620 */

3621 void end_that_request_last(struct request *req, int uptodate)

3622 {

3623 struct gendisk *disk = req->rq_disk;

3624 int error;

3625

3626 /*

3627 * extend uptodate bool to allow < 0 value to be direct io error

3628 */

3629 error = 0;

3630 if (end_io_error(uptodate))

3631 error = !uptodate ? -EIO : uptodate;

3632

3633 if (unlikely(laptop_mode) && blk_fs_request(req))

3634 laptop_io_completion();

3635

3636 /*

3637 * Account IO completion. bar_rq isn't accounted as a normal

3638 * IO on queueing nor completion. Accounting the containing

3639 * request is enough.

3640 */

3641 if (disk && blk_fs_request(req) && req != &req->q->bar_rq) {

3642 unsigned long duration = jiffies - req->start_time;

3643 const int rw = rq_data_dir(req);

3644

3645 __disk_stat_inc(disk, ios[rw]);

3646 __disk_stat_add(disk, ticks[rw], duration);

3647 disk_round_stats(disk);

3648 disk->in_flight--;

3649 }

3650 if (req->end_io)

3651 req->end_io(req, error);

3652 else

3653 __blk_put_request(req->q, req);

3654 }

好了,3651行这个end_io是最关键的代码.也许你早已忘记我们曾经见过end_io,但是不要紧,有我在.在blk_execute_rq_nowait()中,曾经有一行

2596 rq->end_io = done;

而done是这个函数的第四个参数.当初我们在调用这个函数的时候,在blk_execute_rq中,我们是这样写的:

2636 blk_execute_rq_nowait(q, bd_disk, rq, at_head, blk_end_sync_rq);

也就是说,rq->end_io被赋上了blk_end_sync_rq.

2786 /**

2787 * blk_end_sync_rq - executes a completion event on a request

2788 * @rq: request to complete

2789 * @error: end io status of the request

2790 */

2791 void blk_end_sync_rq(struct request *rq, int error)

2792 {

2793 struct completion *waiting = rq->end_io_data;

2794

2795 rq->end_io_data = NULL;

2796 __blk_put_request(rq->q, rq);

2797

2798 /*

2799 * complete last, if this is a stack request the process (and thus

2800 * the rq pointer) could be invalid right after this complete()

2801 */

2802 complete(waiting);

2803 }

终于我们找到了亲爱的可爱的相爱的深爱的最爱的complete().那么如何确定此waiting就是彼wait呢?对照一下这个waiting,当时在blk_execute_rq中我们有:

2635 rq->end_io_data = &wait;

而眼下我们又有:

2793 struct completion *waiting = rq->end_io_data;

由此可知我们没有搞错对象,毕竟我们深知,接吻可以搞错对象,发脾气则不可以,写代码则更加不可以.

至此,blk_execute_rq被唤醒,然后迅速返回.紧随其后的是scsi_execute的返回和scsi_execute_req的返回.这一刻,一个scsi命令终于从无到有最终到有,它经历了scsi命令到request的蜕变,也经历了request到scsi命令的历练.最终它完成了它的使命.对它来说,生命是一场幻觉,别离或者死亡是唯一的结局.