[Bug 267539] Bhyve virtio-scsi warnings about illegal SCSI tag reuse

From: <bugzilla-noreply_at_freebsd.org>
Date: Thu, 03 Nov 2022 12:57:14 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=267539

            Bug ID: 267539
           Summary: Bhyve virtio-scsi warnings about illegal SCSI tag
                    reuse
           Product: Base System
           Version: 13.1-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: bhyve
          Assignee: virtualization@FreeBSD.org
          Reporter: crest@rlwinm.de

Created attachment 237838
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=237838&action=edit
Replace the virtio_scsi tags with an atomic 32 bit counter.

I'm running FreeBSD 13.1/amd64 both as bhyve host and guest. The guests access
to block storage is provided via virtio-scsi backed by local ZVOLs. Under heavy
disk I/O (e.g. fio benchmarks on a UFS file system of ~30GB) I get these
warnings every few seconds inside the guest:

(da1:vtscsi0:0:0:1): WRITE(10). CDB: 2a 00 00 cc 17 88 00 00 08 00
(da1:vtscsi0:0:0:1): CAM status: SCSI Status Error
(da1:vtscsi0:0:0:1): SCSI status: Check Condition
(da1:vtscsi0:0:0:1): SCSI sense: ILLEGAL REQUEST asc:4d,af ((null))
(da1:vtscsi0:0:0:1): Retrying command (per sense data)

(da1:vtscsi0:0:0:1): WRITE(10). CDB: 2a 00 00 cc f6 30 00 00 08 00
(da1:vtscsi0:0:0:1): CAM status: SCSI Status Error
(da1:vtscsi0:0:0:1): SCSI status: Check Condition
(da1:vtscsi0:0:0:1): SCSI sense: ILLEGAL REQUEST asc:4d,20 ((null))
(da1:vtscsi0:0:0:1): Retrying command (per sense data)

(da1:vtscsi0:0:0:1): WRITE(10). CDB: 2a 00 00 30 ad 20 00 00 08 00
(da1:vtscsi0:0:0:1): CAM status: SCSI Status Error
(da1:vtscsi0:0:0:1): SCSI status: Check Condition
(da1:vtscsi0:0:0:1): SCSI sense: ILLEGAL REQUEST asc:4d,f6 ((null))
(da1:vtscsi0:0:0:1): Retrying command (per sense data)

The SCSI sense code reported (ILLEGAL REQUEST asc:4d,XX) decodes to the illegal
reuse of a tag value that's already pending. I looked into the virtio_scsi
guest driver and it uses the pointer a struct csio (casted to a 64bit
uintptr_t) as SCSI tag, but on the host side inside CTL SCSI tags are truncated
to 32 bit. I suspect this causes pointers with identical lower 32 bits to map
to the same tag as seen by CTL, but an attempt to patch the virtio_scsi guest
driver to use an atomic 32 bit counter (cargo culting the iSCSI tag handling)
instead didn't solve the problem. I still attached the experimental patch.

-- 
You are receiving this mail because:
You are the assignee for the bug.