From 1a3f843cb202a6f77b513eff37283afbb4064202 Mon Sep 17 00:00:00 2001 From: Andrew Jeffery Date: Fri, 2 Mar 2018 10:18:02 +1030 Subject: pnor_partition: Handle requests exceeding partition's actual size Partitions with patch files whose size was less than the partition size in the ToC could not be completely read by the host. For example when scanning over the entire PNOR on the host with `cat /dev/mtd0 > /dev/null` the host would lock up. A trace from mboxd under these circumstances shows: [ 1519832857.966501396] Received MBOX command: 4 [ 1519832857.966695620] Host requested flash @ 0x02a44000 [ 1519832857.968642020] Window @ 0x730ce000 for size 0x00024000 maps flash offset 0x02a44000 [ 1519832857.968808728] Writing MBOX response: 1 [ 1519832858.222090630] Received MBOX command: 4 [ 1519832858.222284692] Host requested flash @ 0x02a68000 [ 1519832858.223964544] Window @ 0x73cce000 for size 0x00009000 maps flash offset 0x02a68000 [ 1519832858.224136142] Writing MBOX response: 1 [ 1519832858.435944292] Received MBOX command: 4 [ 1519832858.436138394] Host requested flash @ 0x02a71000 [ 1519832858.437026725] Window @ 0x734ce000 for size 0x00007000 maps flash offset 0x02a71000 [ 1519832858.437195251] Writing MBOX response: 1 [ 1519832858.646768070] Received MBOX command: 4 [ 1519832858.646968637] Host requested flash @ 0x02a78000 [ 1519832858.647567228] Window @ 0x768ce000 for size 0x00001000 maps flash offset 0x02a78000 [ 1519832858.647731755] Writing MBOX response: 1 [ 1519832858.848288015] Received MBOX command: 4 [ 1519832858.848489188] Host requested flash @ 0x02a79000 [ 1519832858.849006404] Window @ 0x758ce000 for size 0x00000000 maps flash offset 0x02a79000 [ 1519832858.849168870] Writing MBOX response: 1 [ 1519832859.048631708] Received MBOX command: 4 [ 1519832859.048827305] Host requested flash @ 0x02a79000 [ 1519832859.049343956] Window @ 0x756ce000 for size 0x00000000 maps flash offset 0x02a79000 [ 1519832859.049503553] Writing MBOX response: 1 [ 1519832859.248950916] Received MBOX command: 4 [ 1519832859.249142069] Host requested flash @ 0x02a79000 [ 1519832859.249649871] Window @ 0x741ce000 for size 0x00000000 maps flash offset 0x02a79000 Of significance are the last three CREATE_READ_WINDOW requests, where the request succeeds but mboxd reports back a zero-sized window to the host. The host immediately considers itself done with the window, and requests a new window offset from the previous by size, which is zero. Thus it re-requests the same offset, and receives the same zero-sized window in return. As a result, firmware gets stuck in an unterminated loop, stealing the core from Linux, which promptly starts reporting a constant stream of RCU stall warnings among the rest of the failures. Everyone is miserable. The offset in question maps to a partition but not to a valid offset in the file backing that partition. Resize the backing file to meet the maximum access address within the limits of the partition size defined in the ToC. By doing so, we are able to map as much of the partition as necessary. However, we're not done. Whilst we no longer crash the host, we still don't successfully complete the operation the host requested. From Petitboot: / # cat /dev/mtd0 > /dev/null [ 501.061616288,3] MBOX-FLASH: Bad response code from BMC 2 [ 501.150405995,3] MBOX-FLASH: Error waiting for BMC cat: read error: Input/output error / # echo $? 1 / # And the corresponding mboxd trace on the BMC: [ 1519966031.652036815] Received MBOX command: 4 [ 1519966031.652272613] Host requested flash @ 0x03f1a000 [ 1519966031.652411603] Tried to open read window past flash limit [ 1519966031.652500088] Couldn't create window mapping for offset 0x03f1a000 [ 1519966031.652607966] Error handling mbox cmd: 4 [ 1519966031.652661421] Writing MBOX response: 2 [ 1519966031.652762229] Error handling MBOX event The read failure will be fixed in a follow-up patch. Change-Id: Iffdfb8af6f739df5e6d9c171b584a7244bdb7099 Signed-off-by: Andrew Jeffery --- mboxd_windows.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'mboxd_windows.c') diff --git a/mboxd_windows.c b/mboxd_windows.c index fd679bc..9742180 100644 --- a/mboxd_windows.c +++ b/mboxd_windows.c @@ -619,7 +619,12 @@ int create_map_window(struct mbox_context *context, reset_window(context, cur); return rc; } - /* rc isn't guaranteed to be aligned, so align up */ + /* + * rc isn't guaranteed to be aligned, so align up + * + * FIXME: This should only be the case for the vpnor ToC now, so handle + * it there + */ cur->size = align_up(rc, (1ULL << context->block_size_shift)); /* Would like a known value, pick 0xFF to it looks like erased flash */ memset(cur->mem + rc, 0xFF, cur->size - rc); -- cgit v1.2.1