data corruption with 'splt' workload to XFS on DM cache with its 3 underlying devices being on same NVMe device

From the BZ's comment#0:

SO seems pretty clear something is still wrong with request-based DM multipath ontop of NVMe... sadly we don't have any negative check in blk-core, NVMe or elsewhere to offer any clue :(

Hi,

I've opened the following public BZ:
https://bugzilla.redhat.com/show_bug.cgi?id=1607527

Feel free to add comments to that BZ if you have a redhat bugzilla account.

But otherwise, happy to get as much feedback and discussion going purely on the relevant lists. I've taken ~1.5 weeks to categorize and isolate this issue. But I've reached a point where I'm getting diminishing returns and could _really_ use the collective eyeballs and expertise of the community. This is by far one of the most nasty cases of corruption I've seen in a while. Not sure where the ultimate cause of corruption lies (that the money question) but it _feels_ rooted in NVMe and is unique to this particular workload I've stumbled onto via customer escalation and then trying to replicate an rbd device using a more approachable one (request-based DM multipath in this case).

Quoted 8 lines · Mike Snitzer

Hi,

I've opened the following public BZ:
https://bugzilla.redhat.com/show_bug.cgi?id=1607527

Feel free to add comments to that BZ if you have a redhat bugzilla account.

Quoted 11 lines

But otherwise, happy to get as much feedback and discussion going purely on the relevant lists. I've taken ~1.5 weeks to categorize and isolate this issue. But I've reached a point where I'm getting diminishing returns and could _really_ use the collective eyeballs and expertise of the community. This is by far one of the most nasty cases of corruption I've seen in a while. Not sure where the ultimate cause of corruption lies (that the money question) but it _feels_ rooted in NVMe and is unique to this particular workload I've stumbled onto via customer escalation and then trying to replicate an rbd device using a more approachable one (request-based DM multipath in this case).

I might be stating the obvious, but so far we only have considered request-based multipath as being active for the _entire_ device. To my knowledge we've never tested that when running on a partition.

So, have you tested that request-based multipathing works on a partition _at all_? I'm not sure if partition mapping is done correctly here; we never remap the start of the request (nor bio, come to speak of it), so it looks as if we would be doing the wrong things here.

Have you checked that partition remapping is done correctly?

Quoted 31 lines · Hannes Reinecke

Quoted 20 lines · Mike Snitzer

Hi,

I've opened the following public BZ:
https://bugzilla.redhat.com/show_bug.cgi?id=1607527

Feel free to add comments to that BZ if you have a redhat bugzilla
account.

But otherwise, happy to get as much feedback and discussion going purely
on the relevant lists.  I've taken ~1.5 weeks to categorize and isolate
this issue.  But I've reached a point where I'm getting diminishing
returns and could _really_ use the collective eyeballs and expertise of
the community.  This is by far one of the most nasty cases of corruption
I've seen in a while.  Not sure where the ultimate cause of

Quoted 9 lines

corruption
lies (that the money question) but it _feels_ rooted in NVMe and is
unique to this particular workload I've stumbled onto via customer
escalation and then trying to replicate an rbd device using a more
approachable one (request-based DM multipath in this case).

Quoted 4 lines

I might be stating the obvious, but so far we only have considered request-based multipath as being active for the _entire_ device. To my knowledge we've never tested that when running on a partition.

True.  We only ever support mapping the partitions ontop of request-based multipath (via dm-linear volumes created by kpartx).

Quoted 7 lines

So, have you tested that request-based multipathing works on a partition _at all_? I'm not sure if partition mapping is done correctly here; we never remap the start of the request (nor bio, come to speak of it), so it looks as if we would be doing the wrong things here.

Have you checked that partition remapping is done correctly?

It clearly doesn't work.  Not quite following why but...

After running the test the partition table at the start of the whole NVMe device is overwritten by XFS.  So likely the IO destined to the dm-cache's "slow" (dm-mpath device on NVMe partition) was issued to the
whole NVMe device:

# pvcreate /dev/nvme1n1
WARNING: xfs signature detected on /dev/nvme1n1 at offset 0. Wipe it?
[y/n]

# vgcreate test /dev/nvme1n1
# lvcreate -n slow -L 512G test
WARNING: xfs signature detected on /dev/test/slow at offset 0. Wipe
it?
[y/n]: y
  Wiping xfs signature on /dev/test/slow.
  Logical volume "slow" created.

Isn't this a failing of block core's partitioning?  Why should a target
that is given the entire partition of a device need to be concerned with
remapping IO?  Shouldn't block core handle that mapping?

Anyway, yesterday I went so far as to hack together request-based support for DM linear (because request-based DM cannot stack on bio-based DM) .  With this, request-based linear devices instead of conventional partitioning, I no longer see the XFS corruption when running the test:

 drivers/md/dm-linear.c | 45
++++++++++++++++++++++++++++++++++++++++++---

 1 file changed, 42 insertions(+), 3 deletions(-)

drivers/md/dm-linear.c +1 -0

index d10964d41fd7..d4a65dd20c6e 100644
@@ -12,6 +12,7 @@
  #include <linux/dax.h>
  #include <linux/slab.h>
  #include <linux/device-mapper.h>
+#include <linux/blk-mq.h>

 #define DM_MSG_PREFIX "linear"

drivers/md/dm-linear.c +0 -0

@@ -24,7 +25,7 @@ struct linear_c {
  };

 /*
- * Construct a linear mapping: <dev_path> <offset>
+ * Construct a linear mapping: <dev_path> <offset> [<# optional params> <optional params>]
  */
 static int linear_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 {

drivers/md/dm-linear.c +0 -0

@@ -57,6 +58,11 @@ static int linear_ctr(struct dm_target *ti,
 unsigned int argc, char **argv)
  		goto bad;
  	}

drivers/md/dm-linear.c +5 -0

+	// FIXME: need to parse optional args
+	// FIXME: model  alloc_multipath_stage2()?
+	// Call: dm_table_set_type()
+	dm_table_set_type(ti->table, DM_TYPE_MQ_REQUEST_BASED);
+

  ti->num_flush_bios = 1;
  ti->num_discard_bios = 1;
  ti->num_secure_erase_bios = 1;

drivers/md/dm-linear.c +0 -0

@@ -113,6 +119,37 @@ static int linear_end_io(struct dm_target *ti,
 struct bio *bio,
  	return DM_ENDIO_DONE;
  }

+static int linear_clone_and_map(struct dm_target *ti, struct request *rq,

drivers/md/dm-linear.c +8 -0

+				union map_info *map_context,
+				struct request **__clone)
+{
+	struct linear_c *lc = ti->private;
+	struct block_device *bdev = lc->dev->bdev;
+	struct request_queue *q = bdev_get_queue(bdev);
+
+	struct request *clone = blk_get_request(q, rq->cmd_flags |

REQ_NOMERGE,

drivers/md/dm-linear.c +22 -0

+						BLK_MQ_REQ_NOWAIT);
+	if (IS_ERR(clone)) {
+		if (blk_queue_dying(q) || !q->mq_ops)
+			return DM_MAPIO_DELAY_REQUEUE;
+
+		return DM_MAPIO_REQUEUE;
+	}
+
+	clone->__sector = linear_map_sector(ti, rq->__sector);
+	clone->bio = clone->biotail = NULL;
+	clone->rq_disk = bdev->bd_disk;
+	clone->cmd_flags |= REQ_FAILFAST_TRANSPORT;
+	*__clone = clone;
+
+	return DM_MAPIO_REMAPPED;
+}
+
+static void linear_release_clone(struct request *clone)
+{
+	blk_put_request(clone);
+}
+

 static void linear_status(struct dm_target *ti, status_type_t type, unsigned status_flags, char *result, unsigned maxlen)
 {

drivers/md/dm-linear.c +0 -0

@@ -207,13 +244,15 @@ static size_t linear_dax_copy_to_iter(struct
 dm_target *ti, pgoff_t pgoff,

 static struct target_type linear_target = {
  .name   = "linear",

drivers/md/dm-linear.c +2 -2

-	.version = {1, 4, 0},
-	.features = DM_TARGET_PASSES_INTEGRITY | DM_TARGET_ZONED_HM,
+	.version = {1, 5, 0},
+	.features = DM_TARGET_IMMUTABLE | DM_TARGET_PASSES_INTEGRITY

| DM_TARGET_ZONED_HM,
  .module = THIS_MODULE,
  .ctr    = linear_ctr,
  .dtr    = linear_dtr,
  .map    = linear_map,
  .end_io = linear_end_io,

drivers/md/dm-linear.c +2 -0

+	.clone_and_map_rq = linear_clone_and_map,
+	.release_clone_rq = linear_release_clone,

  .status = linear_status, .prepare_ioctl = linear_prepare_ioctl, .iterate_devices = linear_iterate_devices,

Quoted 20 lines · Hannes Reinecke

Quoted 8 lines · Mike Snitzer

Hi,

I've opened the following public BZ:
https://bugzilla.redhat.com/show_bug.cgi?id=1607527

Feel free to add comments to that BZ if you have a redhat bugzilla account.

Quoted 11 lines

But otherwise, happy to get as much feedback and discussion going purely on the relevant lists. I've taken ~1.5 weeks to categorize and isolate this issue. But I've reached a point where I'm getting diminishing returns and could _really_ use the collective eyeballs and expertise of the community. This is by far one of the most nasty cases of corruption I've seen in a while. Not sure where the ultimate cause of corruption lies (that the money question) but it _feels_ rooted in NVMe and is unique to this particular workload I've stumbled onto via customer escalation and then trying to replicate an rbd device using a more approachable one (request-based DM multipath in this case).

Quoted 3 lines

I might be stating the obvious, but so far we only have considered request-based multipath as being active for the _entire_ device. To my knowledge we've never tested that when running on a partition.

True. We only ever support mapping the partitions ontop of request-based multipath (via dm-linear volumes created by kpartx).

Quoted 7 lines

So, have you tested that request-based multipathing works on a partition _at all_? I'm not sure if partition mapping is done correctly here; we never remap the start of the request (nor bio, come to speak of it), so it looks as if we would be doing the wrong things here.

Have you checked that partition remapping is done correctly?

It clearly doesn't work. Not quite following why but...

After running the test the partition table at the start of the whole NVMe device is overwritten by XFS. So likely the IO destined to the dm-cache's "slow" (dm-mpath device on NVMe partition) was issued to the whole NVMe device:

# pvcreate /dev/nvme1n1
WARNING: xfs signature detected on /dev/nvme1n1 at offset 0. Wipe it? [y/n]

# vgcreate test /dev/nvme1n1
# lvcreate -n slow -L 512G test
WARNING: xfs signature detected on /dev/test/slow at offset 0. Wipe it?
[y/n]: y
   Wiping xfs signature on /dev/test/slow.
   Logical volume "slow" created.

Isn't this a failing of block core's partitioning? Why should a target that is given the entire partition of a device need to be concerned with remapping IO? Shouldn't block core handle that mapping?

Anyway, yesterday I went so far as to hack together request-based support for DM linear (because request-based DM cannot stack on bio-based DM) . With this, request-based linear devices instead of conventional partitioning, I no longer see the XFS corruption when running the test:

Quoted 74 lines · Mike Snitzer

Quoted 31 lines · Hannes Reinecke

Quoted 20 lines · Mike Snitzer

Hi,

I've opened the following public BZ:
https://bugzilla.redhat.com/show_bug.cgi?id=1607527

Feel free to add comments to that BZ if you have a redhat bugzilla
account.

But otherwise, happy to get as much feedback and discussion going purely
on the relevant lists.  I've taken ~1.5 weeks to categorize and isolate
this issue.  But I've reached a point where I'm getting diminishing
returns and could _really_ use the collective eyeballs and expertise of
the community.  This is by far one of the most nasty cases of corruption
I've seen in a while.  Not sure where the ultimate cause of

Quoted 9 lines

corruption
lies (that the money question) but it _feels_ rooted in NVMe and is
unique to this particular workload I've stumbled onto via customer
escalation and then trying to replicate an rbd device using a more
approachable one (request-based DM multipath in this case).

Quoted 5 lines

I might be stating the obvious, but so far we only have considered
request-based multipath as being active for the _entire_ device. To my knowledge we've never tested that when running on a partition.

True.  We only ever support mapping the partitions ontop of request-based multipath (via dm-linear volumes created by kpartx).

Quoted 8 lines

So, have you tested that request-based multipathing works on a partition _at all_? I'm not sure if partition mapping is done correctly here; we never remap the start of the request (nor bio, come to speak of it), so it looks as if we would be doing the wrong
things here.

Have you checked that partition remapping is done correctly?

It clearly doesn't work.  Not quite following why but...

After running the test the partition table at the start of the whole
NVMe device is overwritten by XFS.  So likely the IO destined to the
dm-cache's "slow" (dm-mpath device on NVMe partition) was issued to the
whole NVMe device:

# pvcreate /dev/nvme1n1
WARNING: xfs signature detected on /dev/nvme1n1 at offset 0. Wipe
it? [y/n]

# vgcreate test /dev/nvme1n1
# lvcreate -n slow -L 512G test
WARNING: xfs signature detected on /dev/test/slow at offset 0. Wipe
it?
[y/n]: y
   Wiping xfs signature on /dev/test/slow.
   Logical volume "slow" created.

Quoted 6 lines

Isn't this a failing of block core's partitioning?  Why should a target
that is given the entire partition of a device need to be concerned with
remapping IO?  Shouldn't block core handle that mapping?

Only if the device is marked a 'partitionable', which device-mapper devices are not.
But I thought you knew that ...

Quoted 6 lines

Anyway, yesterday I went so far as to hack together request-based support for DM linear (because request-based DM cannot stack on bio-based DM) .  With this, request-based linear devices instead of conventional partitioning, I no longer see the XFS corruption when running the test:

_Actually_, I would've done it the other way around; after all, where't
the point in running dm-multipath on a partition? Anything running on the other partitions would suffer from the issues
dm-multipath is designed to handle (temporary path loss etc), so I'm not
quite sure what you are trying to achieve with your testcase. Can you enlighten me?

Cheers,

Hannes

Quoted 8 lines · Hannes Reinecke

_Actually_, I would've done it the other way around; after all, where't the point in running dm-multipath on a partition? Anything running on the other partitions would suffer from the issues dm-multipath is designed to handle (temporary path loss etc), so I'm not quite sure what you are trying to achieve with your testcase. Can you enlighten me?

Quoted 3 lines

Cheers,

Hannes

This came about because a customer is using nvme for a dm-cache device and created multiple partitions so as to use the same nvme to cache multiple different "slower" devices. The corruption was noticed in XFS and I engaged Mike to assist in figuring out what was going on.

Quoted 10 lines · Laurence Oberman

Quoted 9 lines · Hannes Reinecke

_Actually_, I would've done it the other way around; after all, where't the point in running dm-multipath on a partition? Anything running on the other partitions would suffer from the issues dm-multipath is designed to handle (temporary path loss etc), so I'm
not quite sure what you are trying to achieve with your testcase. Can you enlighten me?

Quoted 3 lines

Quoted 3 lines

Cheers,

Hannes

I wasn't looking to deply this (multipath on partition) in production or
suggest it to others.  It was a means to experiment.  More below.

Quoted 6 lines

This came about because a customer is using nvme for a dm-cache device
and created multiple partitions so as to use the same nvme to cache multiple different "slower" devices. The corruption was noticed in XFS
and I engaged Mike to assist in figuring out what was going on.

Yes, so topology for the customer's setup is:

1) MD raid1 on 2 NVMe partitions (from separate NVMe devices).
2) Then DM cache's "fast" and "metadata" devices layered on dm-linear mapping ontop of the MD raid1.
3) Then Ceph's rbd for DM-cache's slow device.

I was just looking to simplify the stack to try to assess why XFS corruption was being seen without all the insanity.

One issue was corruption due to incorrect shutdown order (network was getting shutdown out from underneath rbd, and in turn DM-cache couldn't
complete its IO migrations during cache_postsuspend()).

So I elected to try using DM multipath with queue_if_no_path to try to
replicate rbd losing network _without_ needing a full Ceph/rbd setup.

The rest is history... a rat-hole of corruption that likely is very different than the customer's setup.

Mike

True. We only ever support mapping the partitions ontop of request-based multipath (via dm-linear volumes created by kpartx).

Quoted 6 lines

So, have you tested that request-based multipathing works on a partition _at all_? I'm not sure if partition mapping is done correctly here; we never remap the start of the request (nor bio, come to speak of it), so it looks as if we would be doing the wrong things here.

Quoted 1 line

Have you checked that partition remapping is done correctly?

It clearly doesn't work. Not quite following why but...

So, have you tested that request-based multipathing works on a partition _at all_? I'm not sure if partition mapping is done correctly here; we never remap the start of the request (nor bio, come to speak of it), so it looks as if we would be doing the wrong things here.

Have you checked that partition remapping is done correctly?

Quoted 6 lines · Hannes Reinecke

So, have you tested that request-based multipathing works on a partition _at all_? I'm not sure if partition mapping is done correctly here; we never remap the start of the request (nor bio, come to speak of it), so it looks as if we would be doing the wrong things here.

Have you checked that partition remapping is done correctly?

I think generic_make_request() takes care of partition remapping by calling blk_partition_remap(). generic_make_request() is called by submit_bio(). Is that sufficient to cover all dm drivers?