Comment 22 for bug 1856434

vmware deve's comment for the issue "blk_update_request: I/O error, dev sda, sector 3270728 op 0x9 VM ubuntu-20.04-live-server in ESXi 7.0GA" :

I noticed that when it's happening, abnormal kernel log:
[ 0.000000] ? lockdown_lsm_init+0x21/0x25
[ 0.000000] Kernel is locked down from EFI Secure Boot mode; see man kernel_lockdown.7
.....
[ 66.261508] Lockdown: fwupd: /dev/mem,kmem,port is restricted; see man kernel_lockdown.7
[ 233.169823] ata3: SATA link down (SStatus 0 SControl 300)
[ 238.577700] ata3: SATA link down (SStatus 0 SControl 300)
[ 243.953448] ata3: SATA link down (SStatus 0 SControl 300)
[ 243.953455] ata3.00: disabled
[ 243.953481] sr 2:0:0:0: rejecting I/O to offline device
[ 243.958034] ata3.00: detaching (SCSI 2:0:0:0)
[ 304.517077] sd 3:0:0:0: [sda] tag#55 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
[ 304.517081] sd 3:0:0:0: [sda] tag#55 Sense Key : Vendor Specific(9) [current]
[ 304.517086] sd 3:0:0:0: [sda] tag#55 <<vendor>>ASC=0x80 <<vendor>>ASCQ=0x85
[ 304.517090] sd 3:0:0:0: [sda] tag#55 CDB: Write same(16) 93 08 00 00 00 00 00 31 e7 e8 00 00 00 18 00 00
[ 304.517100] blk_update_request: I/O error, dev sda, sector 3270632 op 0x9:(WRITE_ZEROES) flags 0x800 phys_seg 0 prio class 0
[ 314.319273] sd 3:0:0:0: [sda] tag#11 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_SENSE
[ 314.319275] sd 3:0:0:0: [sda] tag#11 Sense Key : Vendor Specific(9) [current]
[ 314.319278] sd 3:0:0:0: [sda] tag#11 <<vendor>>ASC=0x80 <<vendor>>ASCQ=0x85
[ 314.319295] sd 3:0:0:0: [sda] tag#11 CDB: Write same(16) 93 08 00 00 00 00 00 31 e8 10 00 00 00 18 00 00
[ 314.319299] blk_update_request: I/O error, dev sda, sector 3270672 op 0x9:(WRITE_ZEROES) flags 0x800 phys_seg 0 prio class 0

And no error log in hostside.

Noticed you enabled secure boot in uefi and ubuntu are configured with lockdown

vmware@ubuntu:~$ cat /boot/config-5.4.0-26-generic | grep LOCK_DOWN
CONFIG_LOCK_DOWN_IN_SECURE_BOOT=y
CONFIG_LOCK_DOWN_KERNEL_FORCE_NONE=y

So the error should caused by uefi lockdown feature.

Please refer to https://mjg59.dreamwidth.org/50577.html for more details.

To workaroud this,
echo 1 > /proc/sys/kernel/sysrq
echo x > /proc/sysrq-trigger

or you can use sudo mokutil --disable-validation to disable it.

I tried "echo to /proc" way, the error msg disappered. You might try the second way. Anyway, it's an upstream bug.