1 /* 2 * ipmi_bt_sm.c 3 * 4 * The state machine for an Open IPMI BT sub-driver under ipmi_si.c, part 5 * of the driver architecture at http://sourceforge.net/project/openipmi 6 * 7 * Author: Rocky Craig <first.last@hp.com> 8 * 9 * This program is free software; you can redistribute it and/or modify it 10 * under the terms of the GNU General Public License as published by the 11 * Free Software Foundation; either version 2 of the License, or (at your 12 * option) any later version. 13 * 14 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED 15 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 16 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 19 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 20 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 21 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR 22 * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE 23 * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24 * 25 * You should have received a copy of the GNU General Public License along 26 * with this program; if not, write to the Free Software Foundation, Inc., 27 * 675 Mass Ave, Cambridge, MA 02139, USA. */ 28 29 #include <linux/kernel.h> /* For printk. */ 30 #include <linux/string.h> 31 #include <linux/module.h> 32 #include <linux/moduleparam.h> 33 #include <linux/ipmi_msgdefs.h> /* for completion codes */ 34 #include "ipmi_si_sm.h" 35 36 static int bt_debug = 0x00; /* Production value 0, see following flags */ 37 38 #define BT_DEBUG_ENABLE 1 39 #define BT_DEBUG_MSG 2 40 #define BT_DEBUG_STATES 4 41 module_param(bt_debug, int, 0644); 42 MODULE_PARM_DESC(bt_debug, "debug bitmask, 1=enable, 2=messages, 4=states"); 43 44 /* Typical "Get BT Capabilities" values are 2-3 retries, 5-10 seconds, 45 and 64 byte buffers. However, one HP implementation wants 255 bytes of 46 buffer (with a documented message of 160 bytes) so go for the max. 47 Since the Open IPMI architecture is single-message oriented at this 48 stage, the queue depth of BT is of no concern. */ 49 50 #define BT_NORMAL_TIMEOUT 5000000 /* seconds in microseconds */ 51 #define BT_RETRY_LIMIT 2 52 #define BT_RESET_DELAY 6000000 /* 6 seconds after warm reset */ 53 54 enum bt_states { 55 BT_STATE_IDLE, 56 BT_STATE_XACTION_START, 57 BT_STATE_WRITE_BYTES, 58 BT_STATE_WRITE_END, 59 BT_STATE_WRITE_CONSUME, 60 BT_STATE_B2H_WAIT, 61 BT_STATE_READ_END, 62 BT_STATE_RESET1, /* These must come last */ 63 BT_STATE_RESET2, 64 BT_STATE_RESET3, 65 BT_STATE_RESTART, 66 BT_STATE_HOSED 67 }; 68 69 struct si_sm_data { 70 enum bt_states state; 71 enum bt_states last_state; /* assist printing and resets */ 72 unsigned char seq; /* BT sequence number */ 73 struct si_sm_io *io; 74 unsigned char write_data[IPMI_MAX_MSG_LENGTH]; 75 int write_count; 76 unsigned char read_data[IPMI_MAX_MSG_LENGTH]; 77 int read_count; 78 int truncated; 79 long timeout; 80 unsigned int error_retries; /* end of "common" fields */ 81 int nonzero_status; /* hung BMCs stay all 0 */ 82 }; 83 84 #define BT_CLR_WR_PTR 0x01 /* See IPMI 1.5 table 11.6.4 */ 85 #define BT_CLR_RD_PTR 0x02 86 #define BT_H2B_ATN 0x04 87 #define BT_B2H_ATN 0x08 88 #define BT_SMS_ATN 0x10 89 #define BT_OEM0 0x20 90 #define BT_H_BUSY 0x40 91 #define BT_B_BUSY 0x80 92 93 /* Some bits are toggled on each write: write once to set it, once 94 more to clear it; writing a zero does nothing. To absolutely 95 clear it, check its state and write if set. This avoids the "get 96 current then use as mask" scheme to modify one bit. Note that the 97 variable "bt" is hardcoded into these macros. */ 98 99 #define BT_STATUS bt->io->inputb(bt->io, 0) 100 #define BT_CONTROL(x) bt->io->outputb(bt->io, 0, x) 101 102 #define BMC2HOST bt->io->inputb(bt->io, 1) 103 #define HOST2BMC(x) bt->io->outputb(bt->io, 1, x) 104 105 #define BT_INTMASK_R bt->io->inputb(bt->io, 2) 106 #define BT_INTMASK_W(x) bt->io->outputb(bt->io, 2, x) 107 108 /* Convenience routines for debugging. These are not multi-open safe! 109 Note the macros have hardcoded variables in them. */ 110 111 static char *state2txt(unsigned char state) 112 { 113 switch (state) { 114 case BT_STATE_IDLE: return("IDLE"); 115 case BT_STATE_XACTION_START: return("XACTION"); 116 case BT_STATE_WRITE_BYTES: return("WR_BYTES"); 117 case BT_STATE_WRITE_END: return("WR_END"); 118 case BT_STATE_WRITE_CONSUME: return("WR_CONSUME"); 119 case BT_STATE_B2H_WAIT: return("B2H_WAIT"); 120 case BT_STATE_READ_END: return("RD_END"); 121 case BT_STATE_RESET1: return("RESET1"); 122 case BT_STATE_RESET2: return("RESET2"); 123 case BT_STATE_RESET3: return("RESET3"); 124 case BT_STATE_RESTART: return("RESTART"); 125 case BT_STATE_HOSED: return("HOSED"); 126 } 127 return("BAD STATE"); 128 } 129 #define STATE2TXT state2txt(bt->state) 130 131 static char *status2txt(unsigned char status, char *buf) 132 { 133 strcpy(buf, "[ "); 134 if (status & BT_B_BUSY) strcat(buf, "B_BUSY "); 135 if (status & BT_H_BUSY) strcat(buf, "H_BUSY "); 136 if (status & BT_OEM0) strcat(buf, "OEM0 "); 137 if (status & BT_SMS_ATN) strcat(buf, "SMS "); 138 if (status & BT_B2H_ATN) strcat(buf, "B2H "); 139 if (status & BT_H2B_ATN) strcat(buf, "H2B "); 140 strcat(buf, "]"); 141 return buf; 142 } 143 #define STATUS2TXT(buf) status2txt(status, buf) 144 145 /* This will be called from within this module on a hosed condition */ 146 #define FIRST_SEQ 0 147 static unsigned int bt_init_data(struct si_sm_data *bt, struct si_sm_io *io) 148 { 149 bt->state = BT_STATE_IDLE; 150 bt->last_state = BT_STATE_IDLE; 151 bt->seq = FIRST_SEQ; 152 bt->io = io; 153 bt->write_count = 0; 154 bt->read_count = 0; 155 bt->error_retries = 0; 156 bt->nonzero_status = 0; 157 bt->truncated = 0; 158 bt->timeout = BT_NORMAL_TIMEOUT; 159 return 3; /* We claim 3 bytes of space; ought to check SPMI table */ 160 } 161 162 static int bt_start_transaction(struct si_sm_data *bt, 163 unsigned char *data, 164 unsigned int size) 165 { 166 unsigned int i; 167 168 if ((size < 2) || (size > IPMI_MAX_MSG_LENGTH)) 169 return -1; 170 171 if ((bt->state != BT_STATE_IDLE) && (bt->state != BT_STATE_HOSED)) 172 return -2; 173 174 if (bt_debug & BT_DEBUG_MSG) { 175 printk(KERN_WARNING "+++++++++++++++++++++++++++++++++++++\n"); 176 printk(KERN_WARNING "BT: write seq=0x%02X:", bt->seq); 177 for (i = 0; i < size; i ++) 178 printk (" %02x", data[i]); 179 printk("\n"); 180 } 181 bt->write_data[0] = size + 1; /* all data plus seq byte */ 182 bt->write_data[1] = *data; /* NetFn/LUN */ 183 bt->write_data[2] = bt->seq; 184 memcpy(bt->write_data + 3, data + 1, size - 1); 185 bt->write_count = size + 2; 186 187 bt->error_retries = 0; 188 bt->nonzero_status = 0; 189 bt->read_count = 0; 190 bt->truncated = 0; 191 bt->state = BT_STATE_XACTION_START; 192 bt->last_state = BT_STATE_IDLE; 193 bt->timeout = BT_NORMAL_TIMEOUT; 194 return 0; 195 } 196 197 /* After the upper state machine has been told SI_SM_TRANSACTION_COMPLETE 198 it calls this. Strip out the length and seq bytes. */ 199 200 static int bt_get_result(struct si_sm_data *bt, 201 unsigned char *data, 202 unsigned int length) 203 { 204 int i, msg_len; 205 206 msg_len = bt->read_count - 2; /* account for length & seq */ 207 /* Always NetFn, Cmd, cCode */ 208 if (msg_len < 3 || msg_len > IPMI_MAX_MSG_LENGTH) { 209 printk(KERN_DEBUG "BT results: bad msg_len = %d\n", msg_len); 210 data[0] = bt->write_data[1] | 0x4; /* Kludge a response */ 211 data[1] = bt->write_data[3]; 212 data[2] = IPMI_ERR_UNSPECIFIED; 213 msg_len = 3; 214 } else { 215 data[0] = bt->read_data[1]; 216 data[1] = bt->read_data[3]; 217 if (length < msg_len) 218 bt->truncated = 1; 219 if (bt->truncated) { /* can be set in read_all_bytes() */ 220 data[2] = IPMI_ERR_MSG_TRUNCATED; 221 msg_len = 3; 222 } else 223 memcpy(data + 2, bt->read_data + 4, msg_len - 2); 224 225 if (bt_debug & BT_DEBUG_MSG) { 226 printk (KERN_WARNING "BT: res (raw)"); 227 for (i = 0; i < msg_len; i++) 228 printk(" %02x", data[i]); 229 printk ("\n"); 230 } 231 } 232 bt->read_count = 0; /* paranoia */ 233 return msg_len; 234 } 235 236 /* This bit's functionality is optional */ 237 #define BT_BMC_HWRST 0x80 238 239 static void reset_flags(struct si_sm_data *bt) 240 { 241 if (BT_STATUS & BT_H_BUSY) 242 BT_CONTROL(BT_H_BUSY); 243 if (BT_STATUS & BT_B_BUSY) 244 BT_CONTROL(BT_B_BUSY); 245 BT_CONTROL(BT_CLR_WR_PTR); 246 BT_CONTROL(BT_SMS_ATN); 247 248 if (BT_STATUS & BT_B2H_ATN) { 249 int i; 250 BT_CONTROL(BT_H_BUSY); 251 BT_CONTROL(BT_B2H_ATN); 252 BT_CONTROL(BT_CLR_RD_PTR); 253 for (i = 0; i < IPMI_MAX_MSG_LENGTH + 2; i++) 254 BMC2HOST; 255 BT_CONTROL(BT_H_BUSY); 256 } 257 } 258 259 static inline void write_all_bytes(struct si_sm_data *bt) 260 { 261 int i; 262 263 if (bt_debug & BT_DEBUG_MSG) { 264 printk(KERN_WARNING "BT: write %d bytes seq=0x%02X", 265 bt->write_count, bt->seq); 266 for (i = 0; i < bt->write_count; i++) 267 printk (" %02x", bt->write_data[i]); 268 printk ("\n"); 269 } 270 for (i = 0; i < bt->write_count; i++) 271 HOST2BMC(bt->write_data[i]); 272 } 273 274 static inline int read_all_bytes(struct si_sm_data *bt) 275 { 276 unsigned char i; 277 278 bt->read_data[0] = BMC2HOST; 279 bt->read_count = bt->read_data[0]; 280 if (bt_debug & BT_DEBUG_MSG) 281 printk(KERN_WARNING "BT: read %d bytes:", bt->read_count); 282 283 /* minimum: length, NetFn, Seq, Cmd, cCode == 5 total, or 4 more 284 following the length byte. */ 285 if (bt->read_count < 4 || bt->read_count >= IPMI_MAX_MSG_LENGTH) { 286 if (bt_debug & BT_DEBUG_MSG) 287 printk("bad length %d\n", bt->read_count); 288 bt->truncated = 1; 289 return 1; /* let next XACTION START clean it up */ 290 } 291 for (i = 1; i <= bt->read_count; i++) 292 bt->read_data[i] = BMC2HOST; 293 bt->read_count++; /* account for the length byte */ 294 295 if (bt_debug & BT_DEBUG_MSG) { 296 for (i = 0; i < bt->read_count; i++) 297 printk (" %02x", bt->read_data[i]); 298 printk ("\n"); 299 } 300 if (bt->seq != bt->write_data[2]) /* idiot check */ 301 printk(KERN_DEBUG "BT: internal error: sequence mismatch\n"); 302 303 /* per the spec, the (NetFn, Seq, Cmd) tuples should match */ 304 if ((bt->read_data[3] == bt->write_data[3]) && /* Cmd */ 305 (bt->read_data[2] == bt->write_data[2]) && /* Sequence */ 306 ((bt->read_data[1] & 0xF8) == (bt->write_data[1] & 0xF8))) 307 return 1; 308 309 if (bt_debug & BT_DEBUG_MSG) 310 printk(KERN_WARNING "BT: bad packet: " 311 "want 0x(%02X, %02X, %02X) got (%02X, %02X, %02X)\n", 312 bt->write_data[1], bt->write_data[2], bt->write_data[3], 313 bt->read_data[1], bt->read_data[2], bt->read_data[3]); 314 return 0; 315 } 316 317 /* Modifies bt->state appropriately, need to get into the bt_event() switch */ 318 319 static void error_recovery(struct si_sm_data *bt, char *reason) 320 { 321 unsigned char status; 322 char buf[40]; /* For getting status */ 323 324 bt->timeout = BT_NORMAL_TIMEOUT; /* various places want to retry */ 325 326 status = BT_STATUS; 327 printk(KERN_DEBUG "BT: %s in %s %s\n", reason, STATE2TXT, 328 STATUS2TXT(buf)); 329 330 (bt->error_retries)++; 331 if (bt->error_retries > BT_RETRY_LIMIT) { 332 printk(KERN_DEBUG "retry limit (%d) exceeded\n", BT_RETRY_LIMIT); 333 bt->state = BT_STATE_HOSED; 334 if (!bt->nonzero_status) 335 printk(KERN_ERR "IPMI: BT stuck, try power cycle\n"); 336 else if (bt->error_retries <= BT_RETRY_LIMIT + 1) { 337 printk(KERN_DEBUG "IPMI: BT reset (takes 5 secs)\n"); 338 bt->state = BT_STATE_RESET1; 339 } 340 return; 341 } 342 343 /* Sometimes the BMC queues get in an "off-by-one" state...*/ 344 if ((bt->state == BT_STATE_B2H_WAIT) && (status & BT_B2H_ATN)) { 345 printk(KERN_DEBUG "retry B2H_WAIT\n"); 346 return; 347 } 348 349 printk(KERN_DEBUG "restart command\n"); 350 bt->state = BT_STATE_RESTART; 351 } 352 353 /* Check the status and (possibly) advance the BT state machine. The 354 default return is SI_SM_CALL_WITH_DELAY. */ 355 356 static enum si_sm_result bt_event(struct si_sm_data *bt, long time) 357 { 358 unsigned char status; 359 char buf[40]; /* For getting status */ 360 int i; 361 362 status = BT_STATUS; 363 bt->nonzero_status |= status; 364 365 if ((bt_debug & BT_DEBUG_STATES) && (bt->state != bt->last_state)) 366 printk(KERN_WARNING "BT: %s %s TO=%ld - %ld \n", 367 STATE2TXT, 368 STATUS2TXT(buf), 369 bt->timeout, 370 time); 371 bt->last_state = bt->state; 372 373 if (bt->state == BT_STATE_HOSED) 374 return SI_SM_HOSED; 375 376 if (bt->state != BT_STATE_IDLE) { /* do timeout test */ 377 bt->timeout -= time; 378 if ((bt->timeout < 0) && (bt->state < BT_STATE_RESET1)) { 379 error_recovery(bt, "timed out"); 380 return SI_SM_CALL_WITHOUT_DELAY; 381 } 382 } 383 384 switch (bt->state) { 385 386 case BT_STATE_IDLE: /* check for asynchronous messages */ 387 if (status & BT_SMS_ATN) { 388 BT_CONTROL(BT_SMS_ATN); /* clear it */ 389 return SI_SM_ATTN; 390 } 391 return SI_SM_IDLE; 392 393 case BT_STATE_XACTION_START: 394 if (status & BT_H_BUSY) { 395 BT_CONTROL(BT_H_BUSY); 396 break; 397 } 398 if (status & BT_B2H_ATN) 399 break; 400 bt->state = BT_STATE_WRITE_BYTES; 401 return SI_SM_CALL_WITHOUT_DELAY; /* for logging */ 402 403 case BT_STATE_WRITE_BYTES: 404 if (status & (BT_B_BUSY | BT_H2B_ATN)) 405 break; 406 BT_CONTROL(BT_CLR_WR_PTR); 407 write_all_bytes(bt); 408 BT_CONTROL(BT_H2B_ATN); /* clears too fast to catch? */ 409 bt->state = BT_STATE_WRITE_CONSUME; 410 return SI_SM_CALL_WITHOUT_DELAY; /* it MIGHT sail through */ 411 412 case BT_STATE_WRITE_CONSUME: /* BMCs usually blow right thru here */ 413 if (status & (BT_H2B_ATN | BT_B_BUSY)) 414 break; 415 bt->state = BT_STATE_B2H_WAIT; 416 /* fall through with status */ 417 418 /* Stay in BT_STATE_B2H_WAIT until a packet matches. However, spinning 419 hard here, constantly reading status, seems to hold off the 420 generation of B2H_ATN so ALWAYS return CALL_WITH_DELAY. */ 421 422 case BT_STATE_B2H_WAIT: 423 if (!(status & BT_B2H_ATN)) 424 break; 425 426 /* Assume ordered, uncached writes: no need to wait */ 427 if (!(status & BT_H_BUSY)) 428 BT_CONTROL(BT_H_BUSY); /* set */ 429 BT_CONTROL(BT_B2H_ATN); /* clear it, ACK to the BMC */ 430 BT_CONTROL(BT_CLR_RD_PTR); /* reset the queue */ 431 i = read_all_bytes(bt); 432 BT_CONTROL(BT_H_BUSY); /* clear */ 433 if (!i) /* Try this state again */ 434 break; 435 bt->state = BT_STATE_READ_END; 436 return SI_SM_CALL_WITHOUT_DELAY; /* for logging */ 437 438 case BT_STATE_READ_END: 439 440 /* I could wait on BT_H_BUSY to go clear for a truly clean 441 exit. However, this is already done in XACTION_START 442 and the (possible) extra loop/status/possible wait affects 443 performance. So, as long as it works, just ignore H_BUSY */ 444 445 #ifdef MAKE_THIS_TRUE_IF_NECESSARY 446 447 if (status & BT_H_BUSY) 448 break; 449 #endif 450 bt->seq++; 451 bt->state = BT_STATE_IDLE; 452 return SI_SM_TRANSACTION_COMPLETE; 453 454 case BT_STATE_RESET1: 455 reset_flags(bt); 456 bt->timeout = BT_RESET_DELAY; 457 bt->state = BT_STATE_RESET2; 458 break; 459 460 case BT_STATE_RESET2: /* Send a soft reset */ 461 BT_CONTROL(BT_CLR_WR_PTR); 462 HOST2BMC(3); /* number of bytes following */ 463 HOST2BMC(0x18); /* NetFn/LUN == Application, LUN 0 */ 464 HOST2BMC(42); /* Sequence number */ 465 HOST2BMC(3); /* Cmd == Soft reset */ 466 BT_CONTROL(BT_H2B_ATN); 467 bt->state = BT_STATE_RESET3; 468 break; 469 470 case BT_STATE_RESET3: 471 if (bt->timeout > 0) 472 return SI_SM_CALL_WITH_DELAY; 473 bt->state = BT_STATE_RESTART; /* printk in debug modes */ 474 break; 475 476 case BT_STATE_RESTART: /* don't reset retries! */ 477 reset_flags(bt); 478 bt->write_data[2] = ++bt->seq; 479 bt->read_count = 0; 480 bt->nonzero_status = 0; 481 bt->timeout = BT_NORMAL_TIMEOUT; 482 bt->state = BT_STATE_XACTION_START; 483 break; 484 485 default: /* HOSED is supposed to be caught much earlier */ 486 error_recovery(bt, "internal logic error"); 487 break; 488 } 489 return SI_SM_CALL_WITH_DELAY; 490 } 491 492 static int bt_detect(struct si_sm_data *bt) 493 { 494 /* It's impossible for the BT status and interrupt registers to be 495 all 1's, (assuming a properly functioning, self-initialized BMC) 496 but that's what you get from reading a bogus address, so we 497 test that first. The calling routine uses negative logic. */ 498 499 if ((BT_STATUS == 0xFF) && (BT_INTMASK_R == 0xFF)) 500 return 1; 501 reset_flags(bt); 502 return 0; 503 } 504 505 static void bt_cleanup(struct si_sm_data *bt) 506 { 507 } 508 509 static int bt_size(void) 510 { 511 return sizeof(struct si_sm_data); 512 } 513 514 struct si_sm_handlers bt_smi_handlers = 515 { 516 .init_data = bt_init_data, 517 .start_transaction = bt_start_transaction, 518 .get_result = bt_get_result, 519 .event = bt_event, 520 .detect = bt_detect, 521 .cleanup = bt_cleanup, 522 .size = bt_size, 523 }; 524