kern/54205: mvsata(4): buffer load failed: error=27

[Izumi Tsutsui <tsutsui%ceres.dti.ne.jp@localhost>]

>Number:         54205
>Category:       kern
>Synopsis:       mvsata(4): buffer load failed: error=27
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue May 14 13:05:00 +0000 2019
>Originator:     Izumi Tsutsui
>Release:        NetBSD 8.0
>Organization:
>Environment:
System: NetBSD 8.0 (HPT5325) #13: Tue Apr 30 13:24:19 JST 2019
        tsutsui@mirage:/s/src/sys/arch/evbarm/compile/HPT5325
Architecture: earm
Machine: evbarm
>Description:
When I tried to dump(8) a file system on an SATA drive to backup,
it failed with the following mvsata(4) error messages:

---
mvsata0:0:1: buffer load failed: error=27wd1a: DMA error reading fsbn 128 of 128-255 (wd1 bn 1048704; cn 1040 tn 6 sn 6), retrying
mvsata0:0:1: buffer load failed: error=27wd1a: DMA error reading fsbn 128 of 128-255 (wd1 bn 1048704; cn 1040 tn 6 sn 6), retrying
mvsata0:0:1: buffer load failed: error=27wd1a: DMA error reading fsbn 128 of 128-255 (wd1 bn 1048704; cn 1040 tn 6 sn 6), retrying
mvsata0:0:1: buffer load failed: error=27wd1a: DMA error reading fsbn 128 of 128-255 (wd1 bn 1048704; cn 1040 tn 6 sn 6), retrying
wd1a: DMA error reading fsbn 128 of 128-255 (wd1 bn 1048704; cn 1040 tn 6 sn 6), retrying
---

error=27 is EFBIG, maybe from sys/arch/arm/arm32/bus_dma.c
bus_dmamap_load_paddr().

>How-To-Repeat:
- newfs -b 16384 -f 4096 -i 8192 /dev/rwd1a
  on an sata drive on mvsata(4) on T5325 (or other Marvell SoC)
- extract NetBSD/evbarm 8.0 binary sets onto it
- dump 0f - /dev/rwd1a | (cd /mnt; restore xf -)

>Fix:
In mvsata.c maxsegsz passed to bus_dmamap_create(9) for data DMA transfers
is "MAXPHYS / PAGE_SIZE", but maybe it should be "MAXPHYS / PAGE_SIZE + 1"
for page unaligned transfers, as pciide_common.c etc. do.

---
Index: sys/dev/ic/mvsata.c
===================================================================
RCS file: /cvsroot/src/sys/dev/ic/mvsata.c,v
retrieving revision 1.35
diff -u -p -d -r1.35 mvsata.c
--- sys/dev/ic/mvsata.c	2 May 2016 19:18:29 -0000	1.35
+++ sys/dev/ic/mvsata.c	14 May 2019 12:58:57 -0000
@@ -103,7 +103,8 @@ int	mvsata_debug = 2;
 					   sending a cmd */
 #define ATAPI_MODE_DELAY	1000	/* 1s, timeout for SET_FEATURE cmds */
 
-#define MVSATA_EPRD_MAX_SIZE	(sizeof(struct eprd) * (MAXPHYS / PAGE_SIZE))
+#define MVSATA_MAX_SEGS		(MAXPHYS / PAGE_SIZE + 1)
+#define MVSATA_EPRD_MAX_SIZE	(sizeof(struct eprd) * MVSATA_MAX_SEGS)
 
 
 static void mvsata_probe_drive(struct ata_channel *);
@@ -2918,7 +2919,7 @@ mvsata_port_init(struct mvsata_hc *mvhc,
 	}
 	for (i = 0; i < MVSATA_EDMAQ_LEN; i++) {
 		rv = bus_dmamap_create(mvport->port_dmat, MAXPHYS,
-		    MAXPHYS / PAGE_SIZE, MAXPHYS, 0, BUS_DMA_NOWAIT,
+		    MVSATA_MAX_SEGS, MAXPHYS, 0, BUS_DMA_NOWAIT,
 		    &mvport->port_reqtbl[i].data_dmamap);
 		if (rv != 0) {
 			aprint_error("%s:%d:%d:"

---
Izumi Tsutsui