Clean up the protocol_negotiate_version() mess. The existing approach
came about due to viewing the vpnor implementation as an edge case in
its own right. The code becomes much neater if we consider all backends
as equal and afford them the callbacks necessary for correct behaviour.

Change-Id: Ifaeee9da459818cf22b2f137ddc5b8d0356b9be9
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

protocol_reset() encapsulates the actions necessary to return the LPC
state to what's required to boot the host. This is backend dependent;
for the mtd backend we can simply point the bridge at the host flash
AHB mapping, and for the virtual pnor we want to rearrange the content
of the LPC reserved memory (leaving the bridge pointed there). In either
case the state of the FWH address space is distured, so inform the host
as necessary.

Change-Id: Ie8efd1f703a3616c33f76f4e735c1efea039146c
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

If a host firmware image is provided where the placement of HBB exceeds
the reserved memory size then an out-of-bounds write would occur.

Change-Id: I0a98cb7417511cc8dd5bd2e12c9232ebc912dcd6
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Otherwise we observe invalid memory accesses due to uninitialised
variables.

Change-Id: I8b9063ccc9a25b225a562ebe120f2a99a28788ca
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Change-Id: I8f08db1b0ae19197c3fb8c4053deab900154a125
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

No need to try to exit gracefully in the test cases.

Change-Id: Id558c5201c08bdb0b34859cb3af1a0efa1a2809b
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Include ordering and whether or not C linkage is forced by `extern "C"`
blocks can cause headaches at link time. Ensure that all C dependencies
are included in an `extern C` block before other includes occur. Also
include the C++ versions of string.h and assert.h

Change-Id: Ia96f6044d40c8eccb907b65924efcf62ac7a89c3
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

ax_pkg_check_modules provides a wrapper to pkg_check_modules, such that
one can specify private and public dependencies.  This is not used,
therefore use the underlying macro.

Change-Id: I556f9e29da236e069b7a9b69448fb4cbcba7bbe1
Signed-off-by: Patrick Venture <venture@google.com>

Use the defaults in the pkg check where the default error message is
sufficient to identify which package is missing.

Change-Id: Ide33a6c676d6b4db07a10aeb35e5076f9b3aeb91
Signed-off-by: Patrick Venture <venture@google.com>

These are replaced by the equivalent properties.

Change-Id: Ie2acb98cc592c0ed1f2039f8aa570f1c7944b1e2
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

The virtual PNOR implementation never properly honoured writes to the
FFS ToC, as the ToC's binary representation is generated from the CSV
file shipped in the PNOR squashfs image.

What *did* happen was that opening a write window to the ToC region
succeeded and writes could be flushed, but the flushed writes were never
read, and ToC representation internal to mboxd was never updated to
match the written state. Thus the written values "persisted" until the
ToC's window fell out of the cache (with 64MiB reserved regions,
probably on a host reboot).

Short circuit the insanity of handling FFS more than we have to by
forcefully marking the ToC as read-only, regardless of the flag
configuration shipped in the CSV representation. This prevents the host
from successfully opening a write window and thus the host can have no
expectation of write persistence.

Change-Id: Ib2788c56b245da506cb7d607c0758b17785766cf
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

This ensures that the ToC presented to the host indicates that it is not
writable. The virtual PNOR implementation has never properly honoured
writes to the ToC, so lets at least tell the host.

As the code has not yet been fixed to implement the desired behaviour,
add the test to XFAIL_TESTS.

Change-Id: Ia13a0f907f916d6dec3979b17685d54bc578a106
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Tests if mutations survive re-opening the window. They don't, so add the
test to XFAIL_TESTS.

Change-Id: Ic2f844c30a7da35033bf03012ea452718d2843e4
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

This resolves skiboot failing to receive the mboxd termination message
if mboxd has been killed unexpectedly or due to some race on shutdown
where the message fails to propagate.

Change-Id: I7a0974fc17f6853ac62c1f5f7b43d2e367260cf6
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

A set of races was discovered around the propagation of HIOMAP protocol
BMC status events during BMC shutdown. In particular the change impacts
the design of the DBus transport defined in the protocol specification,
as signalling of both acknowledgeable and non-acknowledgeable events
could not be made atomic.

A particular case where this matters is when the daemon is terminated,
at which point it should simultaneously clear BMC_EVENT_DAEMON_READY and
set BMC_EVENT_PROTOCOL_RESET. The DBus interface as designed required
this be done as two separate messages, which lead to races propagating
the complete state update to the host during shutdown of ipmid.

Change-Id: Iaf38f77c28b8e4e4dd092b0de97dc7e777bfac65
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

When building outside of OpenBMC, none of the C++ libraries are
required.

Change-Id: I0677b13c373492977301cd6f1db9753a3a0fcb54
Signed-off-by: Joel Stanley <joel@jms.id.au>

This is necessary for the host firmware to properly recover from a
daemon restart event, as it needs to re-perform the GET_INFO handshake
and re-establish any window it had active prior to the daemon
restarting.

While we're here, rename the symbol to align with the documentation.

Change-Id: I628d2ee5972177b7ad78392a86122d16104e7011
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

The code as it stood only sent the state update at startup on the active
transport, which is somewhat arbitrarily chosen as an implementation
detail of the mbox initialisation function.

If the host firmware is using IPMI, it will not learn of the update
unless it attempts to contact mboxd, which it won't do if it knows the
daemon isn't there, which it may have learned of by receiving a state
update from the daemon's shutdown path. In this circumstance the host
firmware is now stuck.

Relieve the host firmware of this problem by always sending the daemon
state on all supported transports. To avoid some insanity we introduce a
new callback in struct transport_ops that allows use to send the BMC's
entire event state rather than just set or clear updates.

Change-Id: I094ff4089eeebd8be99fbd343b94f7bbef023fb1
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Events were not quite being handled as per the intent of the recent
refactor: The protocol layer was meant to record the raw set of events
and provide the protocol-version-specific mask to the transport layer,
which the transport layer would then use to flush out the state in
accordance with its implementation-specific requirements.

What was going wrong was that the transport implementations were
overwriting the raw set of events with the protocol-specific masked set
of events, meaning that we'd lose the raw state and provide an
incomplete BMC state value on protocol upgrade.

Rework the event handling to make sure the responsibilities are properly
split between the layers.

Change-Id: Iace6615a121e4ce7dcca690d9adf62e5ab9ccee2
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

The daemon implements the argument with a boolean type parameter but we
were passing a char from mboxctl, which makes the call fail.

Fix the parameter type in mboxctl to match mboxd.

Change-Id: Ib271d165e823cf9e793e6493cec409c45f82d231
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

This uses the AX_CXX_COMPILE_STDCXX() instead of
AX_CXX_COMPILE_STDCXX_1{4,7}() so that the error messages we generate
make slightly more sense.

We get errors like:
configure.ac:24: error: invalid first argument `20' to AX_CXX_COMPILE_STDCXX

Instead of:
./configure: line 5132: syntax error near unexpected token `noext'
./configure: line 5132: `AX_CXX_COMPILE_STDCXX_20(noext)'

Tested:
    Builds and passes unit tests.

Change-Id: I22f71b4f83fec0507de1175ac656ce63e9acecea
Signed-off-by: William A. Kennington III <wak@google.com>

This makes it consistent with other openbmc projects for c++ formatting.

Tested:
    Run through the unit test suite.

Change-Id: I92030ce5b42de01360393687fb438faf26f36ac8
Signed-off-by: William A. Kennington III <wak@google.com>

Other projects use the provided from the unit-test environment building
the project. Lets do the same here but fall back to our expected version
6.0 if no CLANG_FORMAT variable is provided. This removes
clang-format-5.0 since it is not consistent with the rules enforce by
clang-format-6.0.

Tested:
    Ran through unit test suite.

Change-Id: If5a137d3981cf0896a426b98c78e1788ec029bf2
Signed-off-by: William A. Kennington III <wak@google.com>

The rewrite addresses two main issues in the original documentation:

1. The conflation of the protocol specification with the mailbox transport
2. Formatting and discoverability of command and event definitions

Additionally, the rewrite documents two new transports - IPMI and DBus.
It's noted that DBus is intended as a transport internal to the BMC,
while the IPMI transport is the new transport exposed to the host.

Finally, some commands and events have been renamed, however this has no
impact on the behaviour of the protocol.

Change-Id: Icc78141f4ead4395e8a348b80443cadd2300a751
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Change-Id: If74d8d1983c2b32b3ed6264bbdb7f49118d5a1f2
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

windows_reset_all() doesn't perform a flush of the currently open
window like the comment suggests. Iron out whether the comment or the
behaviour is incorrect.

Change-Id: Id10384651c02e397f4c8d2a749b66f8881bfe08b
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Tests for the condition where the minimum age is less than any window's
current age, in which case we can get a NULL dereference if the
windows_reset_all() implementation is broken.

    windows.c:409:23: runtime error: member access within null pointer of type 'struct window_context'
    ASAN:DEADLYSIGNAL
    =================================================================
    ==31400==ERROR: AddressSanitizer: SEGV on unknown address 0x00000004 (pc 0x0002b658 bp 0x74c00270 sp 0x7eb7c678 T0)
    ==31400==The signal is caused by a WRITE memory access.
    ==31400==Hint: address points to the zero page.
        #0 0x2b657 in window_reset windows.c:410
        #1 0x2cc9b in windows_create_map windows.c:572
        #2 0x1f3f3 in protocol_v1_create_window protocol.c:167
        #3 0x2121b in protocol_v2_create_window protocol.c:417
        #4 0x24cd7f in generic_vpnor_create_window vpnor/protocol.cpp:51
        #5 0x24d053 in protocol_v2_vpnor_create_window vpnor/protocol.cpp:63
        #6 0x2663b in mbox_handle_create_window transport_mbox.c:282
        #7 0x276db in handle_mbox_req transport_mbox.c:568
        #8 0x276db in transport_mbox_dispatch transport_mbox.c:649
        #9 0x17fcb in poll_loop mboxd.c:185
        #10 0x17fcb in main mboxd.c:423
        #11 0x46b68517 in __libc_start_main (/lib/libc.so.6+0x46b68517)

    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV windows.c:410 in window_reset
    ==31400==ABORTING

Change-Id: I8161e2ea17953e196d4bb3ca90d19e44ec10c86d
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

windows_reset_all() returns a boolean value, so make sure we don't place
annoying requirements on the users.

Change-Id: I0f9a45256e2236c0a76696e2cc8a2df2ad0a98bd
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Change-Id: Ic10ba2be78deb6307af195fc01daceb19a82ef95
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Change-Id: If34f2f6cac002fae417d99baec8c08f675cdb974
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Change-Id: I989d5e2a65950cb936fca77d28f7a540d3ec90a2
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Change-Id: I9f261b56fe66e56d71c069d63f5caba5394cbe12
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Change-Id: I85b318cae135cfe8203cb01c54ab4872fcc947c0
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Change-Id: I1d16f72c28a4ce2ab8dd92d17b29ad9227ea542b
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Change-Id: Ibf94de2dfa3554c5e81fe53ee2b422f9a4014581
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Change-Id: I15de434610b0f2a3cd54061c353dcc4d9434352b
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Change-Id: I652b76adea470de02d1d01dc1d062caf52a37448
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Change-Id: I99b13eca8f25d9855aac2af0a9ec46dfe5390834
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

Change-Id: I873c60ef072c2e46d1306a086ce81d28927b593c
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>

The protocol layer now just filters the events based on the version of
the protocol in use, and leaves it to the transport layer to manage how
the resulting state is represented. For the moment this simply moves
manipulation of bmc_events in struct mbox_context down in to the
transport layer.

Change-Id: Iff1df934505dc9c769be3d376396d425fb4e8264
Signed-off-by: Andrew Jeffery <andrew@aj.id.au>