The disable path only claims what is in flight at that moment. An I/O
submitted after a reset was requested rang a doorbell that the reset
then wiped, so it was lost. An I/O sent as soon as the queue was back
reached the device before the bring-up had initialized it, and the
device answered NOT READY.
Keep such an I/O on a list instead, without a slot, from the moment a
reset is requested until the bring-up has finished, and send the list
in order then. A request that a reset returned to CAM comes back while
the list is still held, so it waits there too. A completion sends the
next one when the slots have run out. If the controller fails first,
the failure path completes the list with an error. Admin and task
management requests still go out, because the reset task waits on its
own commands and the watchdog sends the aborts. This is how nvme(4)
holds requests while a queue is in recovery.
Sponsored by: Samsung Electronics