Linux NVMe adds TP8028 cross-controller path recovery

Mohamed Khalfella of Pure Storage has submitted a sixth-round Linux implementation of NVMe TP8028 Rapid Path Failure Recovery, covering both the host initiator and the in-kernel NVMe target.

The work targets multipath setups, especially NVMe over Fabrics. When one path to a subsystem fails, in-flight I/O on that controller must not be retried on another path until the original commands are known to be finished or dead. Retrying too soon risks the same I/O completing twice and corrupting data, a failure mode already called out in TP4129. Cross-Controller Reset (CCR) gives the host a way out: from a still-healthy controller in the same subsystem it can force the impacted controller to fail and drop its host connections, so recovery can move on without long stalls. If CCR is unavailable, requests stay held for a window based on keep-alive and command-quiesce timing before retry is allowed.

On the target side, the changes add the CCR admin command, a CCR log page that tracks pending resets, and asynchronous events that tell the host when a CCR has finished and retry is safe. Controller identity data is extended so a host can name the exact instance to reset.

On the host, two new controller states, FENCING and FENCED, hold in-flight work instead of canceling it at the first error. While fencing, queues stay up but new I/O is blocked, and reset or delete is deferred so a manual or automatic teardown cannot release requests early. The TCP, RDMA, and Fibre Channel transports enter that path on error, attempt CCR via a peer controller, then continue into ordinary reset recovery. New identity fields are exported in sysfs for diagnostics and manual admin commands.

Together the host and target pieces wire the TP8028 recovery model into Linux multipath NVMe so path loss can be cleared quickly without gambling on unsafe failover.