tree 6bba6e8bf0a9eb18f87ecf937bf1224d5e6c18a3
parent 742a1f6ac66eac80cd1f814430972256b62f9ac5
author Andrew Jeffery <andrew@aj.id.au> 1519948082 +1030
committer Andrew Jeffery <andrew@aj.id.au> 1522767869 +0930

pnor_partition: Handle requests exceeding partition's actual size

Partitions with patch files whose size was less than the partition size
in the ToC could not be completely read by the host. For example when
scanning over the entire PNOR on the host with `cat /dev/mtd0 >
/dev/null` the host would lock up. A trace from mboxd under these
circumstances shows:

    [ 1519832857.966501396] Received MBOX command: 4
    [ 1519832857.966695620] Host requested flash @ 0x02a44000
    [ 1519832857.968642020] Window @ 0x730ce000 for size 0x00024000 maps flash offset 0x02a44000
    [ 1519832857.968808728] Writing MBOX response: 1
    [ 1519832858.222090630] Received MBOX command: 4
    [ 1519832858.222284692] Host requested flash @ 0x02a68000
    [ 1519832858.223964544] Window @ 0x73cce000 for size 0x00009000 maps flash offset 0x02a68000
    [ 1519832858.224136142] Writing MBOX response: 1
    [ 1519832858.435944292] Received MBOX command: 4
    [ 1519832858.436138394] Host requested flash @ 0x02a71000
    [ 1519832858.437026725] Window @ 0x734ce000 for size 0x00007000 maps flash offset 0x02a71000
    [ 1519832858.437195251] Writing MBOX response: 1
    [ 1519832858.646768070] Received MBOX command: 4
    [ 1519832858.646968637] Host requested flash @ 0x02a78000
    [ 1519832858.647567228] Window @ 0x768ce000 for size 0x00001000 maps flash offset 0x02a78000
    [ 1519832858.647731755] Writing MBOX response: 1
    [ 1519832858.848288015] Received MBOX command: 4
    [ 1519832858.848489188] Host requested flash @ 0x02a79000
    [ 1519832858.849006404] Window @ 0x758ce000 for size 0x00000000 maps flash offset 0x02a79000
    [ 1519832858.849168870] Writing MBOX response: 1
    [ 1519832859.048631708] Received MBOX command: 4
    [ 1519832859.048827305] Host requested flash @ 0x02a79000
    [ 1519832859.049343956] Window @ 0x756ce000 for size 0x00000000 maps flash offset 0x02a79000
    [ 1519832859.049503553] Writing MBOX response: 1
    [ 1519832859.248950916] Received MBOX command: 4
    [ 1519832859.249142069] Host requested flash @ 0x02a79000
    [ 1519832859.249649871] Window @ 0x741ce000 for size 0x00000000 maps flash offset 0x02a79000

Of significance are the last three CREATE_READ_WINDOW requests, where
the request succeeds but mboxd reports back a zero-sized window to the
host. The host immediately considers itself done with the window, and
requests a new window offset from the previous by size, which is zero.
Thus it re-requests the same offset, and receives the same zero-sized
window in return.

As a result, firmware gets stuck in an unterminated loop, stealing the
core from Linux, which promptly starts reporting a constant stream of
RCU stall warnings among the rest of the failures. Everyone is
miserable.

The offset in question maps to a partition but not to a valid offset in
the file backing that partition. Resize the backing file to meet the
maximum access address within the limits of the partition size defined
in the ToC. By doing so, we are able to map as much of the partition as
necessary.

However, we're not done. Whilst we no longer crash the host, we still
don't successfully complete the operation the host requested. From
Petitboot:

    / # cat /dev/mtd0 > /dev/null
    [  501.061616288,3] MBOX-FLASH: Bad response code from BMC 2
    [  501.150405995,3] MBOX-FLASH: Error waiting for BMC
    cat: read error: Input/output error
    / # echo $?
    1
    / #

And the corresponding mboxd trace on the BMC:

    [ 1519966031.652036815] Received MBOX command: 4
    [ 1519966031.652272613] Host requested flash @ 0x03f1a000
    [ 1519966031.652411603] Tried to open read window past flash limit
    [ 1519966031.652500088] Couldn't create window mapping for offset 0x03f1a000
    [ 1519966031.652607966] Error handling mbox cmd: 4
    [ 1519966031.652661421] Writing MBOX response: 2
    [ 1519966031.652762229] Error handling MBOX event

The read failure will be fixed in a follow-up patch.

Change-Id: Iffdfb8af6f739df5e6d9c171b584a7244bdb7099
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>