summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAndrew Jeffery <andrew@aj.id.au>2018-03-23 12:27:15 +1030
committerAndrew Jeffery <andrew@aj.id.au>2018-04-04 07:56:23 +0000
commit3da0de69628d1341e38608067a9f5198a1e35954 (patch)
tree2005a7879167f1a0669b8e7124299ec0aab08316
parent0d087f17f868587ca01259632ba0bd584b66aae4 (diff)
downloadphosphor-mboxd-3da0de69628d1341e38608067a9f5198a1e35954.zip
phosphor-mboxd-3da0de69628d1341e38608067a9f5198a1e35954.tar.gz
mboxd_windows: Shrink windows accessing the end of flash
The host may request a window over the end of the flash where the window size combined with the requested offset exceeds the limit of the flash. This issue was introduced with the virtual PNOR, as copy_flash() now may return a size less than requested. This leads to offset requests that are still block aligned, but the windows may no longer be aligned with respect to the flash size. This issue triggers the read error reported from the Petitboot environment in an earlier commit message: / # cat /dev/mtd0 > /dev/null [ 501.061616288,3] MBOX-FLASH: Bad response code from BMC 2 [ 501.150405995,3] MBOX-FLASH: Error waiting for BMC cat: read error: Input/output error / # echo $? 1 / # With the corresponding mboxd trace on the BMC: [ 1519966031.652036815] Received MBOX command: 4 [ 1519966031.652272613] Host requested flash @ 0x03f1a000 [ 1519966031.652411603] Tried to open read window past flash limit [ 1519966031.652500088] Couldn't create window mapping for offset 0x03f1a000 [ 1519966031.652607966] Error handling mbox cmd: 4 [ 1519966031.652661421] Writing MBOX response: 2 [ 1519966031.652762229] Error handling MBOX event Instead, shrink the request such that the resulting window exactly maps the flash limit, and no further. Change-Id: Id33ae3b14252eb40240ef1925311f22aceb103b4 Signed-off-by: Andrew Jeffery <andrew@aj.id.au>
-rw-r--r--mboxd_windows.c13
-rw-r--r--test/vpnor/Makefile.am.include2
2 files changed, 9 insertions, 6 deletions
diff --git a/mboxd_windows.c b/mboxd_windows.c
index 275f38a..233bfdd 100644
--- a/mboxd_windows.c
+++ b/mboxd_windows.c
@@ -592,7 +592,10 @@ int create_map_window(struct mbox_context *context,
}
#endif
- if ((offset + cur->size) > context->flash_size) {
+ if (offset > context->flash_size) {
+ MSG_ERR("Tried to open read window past flash limit\n");
+ return -MBOX_R_PARAM_ERROR;
+ } else if ((offset + cur->size) > context->flash_size) {
/*
* There is V1 skiboot implementations out there which don't
* mask offset with window size, meaning when we have
@@ -607,9 +610,11 @@ int create_map_window(struct mbox_context *context,
cur->size = align_down(context->flash_size - offset,
1 << context->block_size_shift);
} else {
- /* Trying to read past the end of flash */
- MSG_ERR("Tried to open read window past flash limit\n");
- return -MBOX_R_PARAM_ERROR;
+ /*
+ * Allow requests to exceed the flash size, but limit
+ * the response to the size of the flash.
+ */
+ cur->size = context->flash_size - offset;
}
}
diff --git a/test/vpnor/Makefile.am.include b/test/vpnor/Makefile.am.include
index 5f71697..ed637bc 100644
--- a/test/vpnor/Makefile.am.include
+++ b/test/vpnor/Makefile.am.include
@@ -316,6 +316,4 @@ check_PROGRAMS += \
%reldir%/dump_flash \
%reldir%/create_read_window_size \
%reldir%/create_read_window_remap
-
-XFAIL_TESTS += %reldir%/dump_flash
endif
OpenPOWER on IntegriCloud