cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

ipmi-bt-test.c (11827B)


      1/*
      2 * IPMI BT test cases, using the external interface for checking
      3 *
      4 * Copyright (c) 2012 Corey Minyard <cminyard@mvista.com>
      5 *
      6 * Permission is hereby granted, free of charge, to any person obtaining a copy
      7 * of this software and associated documentation files (the "Software"), to deal
      8 * in the Software without restriction, including without limitation the rights
      9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     10 * copies of the Software, and to permit persons to whom the Software is
     11 * furnished to do so, subject to the following conditions:
     12 *
     13 * The above copyright notice and this permission notice shall be included in
     14 * all copies or substantial portions of the Software.
     15 *
     16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     22 * THE SOFTWARE.
     23 */
     24
     25#include "qemu/osdep.h"
     26
     27#include <sys/socket.h>
     28#include <netinet/in.h>
     29#include <netinet/ip.h>
     30#include <netinet/tcp.h>
     31
     32
     33#include "libqtest-single.h"
     34#include "qemu-common.h"
     35
     36#define IPMI_IRQ        5
     37
     38#define IPMI_BT_BASE    0xe4
     39
     40#define IPMI_BT_CTLREG_CLR_WR_PTR  0
     41#define IPMI_BT_CTLREG_CLR_RD_PTR  1
     42#define IPMI_BT_CTLREG_H2B_ATN     2
     43#define IPMI_BT_CTLREG_B2H_ATN     3
     44#define IPMI_BT_CTLREG_SMS_ATN     4
     45#define IPMI_BT_CTLREG_H_BUSY      6
     46#define IPMI_BT_CTLREG_B_BUSY      7
     47
     48#define IPMI_BT_CTLREG_GET(b) ((bt_get_ctrlreg() >> (b)) & 1)
     49#define IPMI_BT_CTLREG_GET_H2B_ATN() IPMI_BT_CTLREG_GET(IPMI_BT_CTLREG_H2B_ATN)
     50#define IPMI_BT_CTLREG_GET_B2H_ATN() IPMI_BT_CTLREG_GET(IPMI_BT_CTLREG_B2H_ATN)
     51#define IPMI_BT_CTLREG_GET_SMS_ATN() IPMI_BT_CTLREG_GET(IPMI_BT_CTLREG_SMS_ATN)
     52#define IPMI_BT_CTLREG_GET_H_BUSY()  IPMI_BT_CTLREG_GET(IPMI_BT_CTLREG_H_BUSY)
     53#define IPMI_BT_CTLREG_GET_B_BUSY()  IPMI_BT_CTLREG_GET(IPMI_BT_CTLREG_B_BUSY)
     54
     55#define IPMI_BT_CTLREG_SET(b) bt_write_ctrlreg(1 << (b))
     56#define IPMI_BT_CTLREG_SET_CLR_WR_PTR() IPMI_BT_CTLREG_SET( \
     57                                                IPMI_BT_CTLREG_CLR_WR_PTR)
     58#define IPMI_BT_CTLREG_SET_CLR_RD_PTR() IPMI_BT_CTLREG_SET( \
     59                                                IPMI_BT_CTLREG_CLR_RD_PTR)
     60#define IPMI_BT_CTLREG_SET_H2B_ATN()  IPMI_BT_CTLREG_SET(IPMI_BT_CTLREG_H2B_ATN)
     61#define IPMI_BT_CTLREG_SET_B2H_ATN()  IPMI_BT_CTLREG_SET(IPMI_BT_CTLREG_B2H_ATN)
     62#define IPMI_BT_CTLREG_SET_SMS_ATN()  IPMI_BT_CTLREG_SET(IPMI_BT_CTLREG_SMS_ATN)
     63#define IPMI_BT_CTLREG_SET_H_BUSY()   IPMI_BT_CTLREG_SET(IPMI_BT_CTLREG_H_BUSY)
     64
     65static int bt_ints_enabled;
     66
     67static uint8_t bt_get_ctrlreg(void)
     68{
     69    return inb(IPMI_BT_BASE);
     70}
     71
     72static void bt_write_ctrlreg(uint8_t val)
     73{
     74    outb(IPMI_BT_BASE, val);
     75}
     76
     77static uint8_t bt_get_buf(void)
     78{
     79    return inb(IPMI_BT_BASE + 1);
     80}
     81
     82static void bt_write_buf(uint8_t val)
     83{
     84    outb(IPMI_BT_BASE + 1, val);
     85}
     86
     87static uint8_t bt_get_irqreg(void)
     88{
     89    return inb(IPMI_BT_BASE + 2);
     90}
     91
     92static void bt_write_irqreg(uint8_t val)
     93{
     94    outb(IPMI_BT_BASE + 2, val);
     95}
     96
     97static void bt_wait_b_busy(void)
     98{
     99    unsigned int count = 1000;
    100    while (IPMI_BT_CTLREG_GET_B_BUSY() != 0) {
    101        --count;
    102        g_assert(count != 0);
    103        usleep(100);
    104    }
    105}
    106
    107static void bt_wait_b2h_atn(void)
    108{
    109    unsigned int count = 1000;
    110    while (IPMI_BT_CTLREG_GET_B2H_ATN() == 0) {
    111        --count;
    112        g_assert(count != 0);
    113        usleep(100);
    114    }
    115}
    116
    117
    118static int emu_lfd;
    119static int emu_fd;
    120static in_port_t emu_port;
    121static uint8_t inbuf[100];
    122static unsigned int inbuf_len;
    123static unsigned int inbuf_pos;
    124static int last_was_aa;
    125
    126static void read_emu_data(void)
    127{
    128    fd_set readfds;
    129    int rv;
    130    struct timeval tv;
    131
    132    FD_ZERO(&readfds);
    133    FD_SET(emu_fd, &readfds);
    134    tv.tv_sec = 10;
    135    tv.tv_usec = 0;
    136    rv = select(emu_fd + 1, &readfds, NULL, NULL, &tv);
    137    if (rv == -1) {
    138        perror("select");
    139    }
    140    g_assert(rv == 1);
    141    rv = read(emu_fd, inbuf, sizeof(inbuf));
    142    if (rv == -1) {
    143        perror("read");
    144    }
    145    g_assert(rv > 0);
    146    inbuf_len = rv;
    147    inbuf_pos = 0;
    148}
    149
    150static void write_emu_msg(uint8_t *msg, unsigned int len)
    151{
    152    int rv;
    153
    154#ifdef DEBUG_TEST
    155    {
    156        unsigned int i;
    157        printf("sending:");
    158        for (i = 0; i < len; i++) {
    159            printf(" %2.2x", msg[i]);
    160        }
    161        printf("\n");
    162    }
    163#endif
    164    rv = write(emu_fd, msg, len);
    165    g_assert(rv == len);
    166}
    167
    168static void get_emu_msg(uint8_t *msg, unsigned int *len)
    169{
    170    unsigned int outpos = 0;
    171
    172    for (;;) {
    173        while (inbuf_pos < inbuf_len) {
    174            uint8_t ch = inbuf[inbuf_pos++];
    175
    176            g_assert(outpos < *len);
    177            if (last_was_aa) {
    178                assert(ch & 0x10);
    179                msg[outpos++] = ch & ~0x10;
    180                last_was_aa = 0;
    181            } else if (ch == 0xaa) {
    182                last_was_aa = 1;
    183            } else {
    184                msg[outpos++] = ch;
    185                if ((ch == 0xa0) || (ch == 0xa1)) {
    186                    /* Message complete */
    187                    *len = outpos;
    188                    goto done;
    189                }
    190            }
    191        }
    192        read_emu_data();
    193    }
    194 done:
    195#ifdef DEBUG_TEST
    196    {
    197        unsigned int i;
    198        printf("Msg:");
    199        for (i = 0; i < outpos; i++) {
    200            printf(" %2.2x", msg[i]);
    201        }
    202        printf("\n");
    203    }
    204#endif
    205    return;
    206}
    207
    208static uint8_t
    209ipmb_checksum(const unsigned char *data, int size, unsigned char start)
    210{
    211        unsigned char csum = start;
    212
    213        for (; size > 0; size--, data++) {
    214                csum += *data;
    215        }
    216        return csum;
    217}
    218
    219static uint8_t get_dev_id_cmd[] = { 0x18, 0x01 };
    220static uint8_t get_dev_id_rsp[] = { 0x1c, 0x01, 0x00, 0x20, 0x00, 0x00, 0x00,
    221                                    0x02, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00 };
    222
    223static uint8_t set_bmc_globals_cmd[] = { 0x18, 0x2e, 0x0f };
    224static uint8_t set_bmc_globals_rsp[] = { 0x1c, 0x2e, 0x00 };
    225static uint8_t enable_irq_cmd[] = { 0x05, 0xa1 };
    226
    227static void emu_msg_handler(void)
    228{
    229    uint8_t msg[100];
    230    unsigned int msg_len = sizeof(msg);
    231
    232    get_emu_msg(msg, &msg_len);
    233    g_assert(msg_len >= 5);
    234    g_assert(msg[msg_len - 1] == 0xa0);
    235    msg_len--;
    236    g_assert(ipmb_checksum(msg, msg_len, 0) == 0);
    237    msg_len--;
    238    if ((msg[1] == get_dev_id_cmd[0]) && (msg[2] == get_dev_id_cmd[1])) {
    239        memcpy(msg + 1, get_dev_id_rsp, sizeof(get_dev_id_rsp));
    240        msg_len = sizeof(get_dev_id_rsp) + 1;
    241        msg[msg_len] = -ipmb_checksum(msg, msg_len, 0);
    242        msg_len++;
    243        msg[msg_len++] = 0xa0;
    244        write_emu_msg(msg, msg_len);
    245    } else if ((msg[1] == set_bmc_globals_cmd[0]) &&
    246               (msg[2] == set_bmc_globals_cmd[1])) {
    247        write_emu_msg(enable_irq_cmd, sizeof(enable_irq_cmd));
    248        memcpy(msg + 1, set_bmc_globals_rsp, sizeof(set_bmc_globals_rsp));
    249        msg_len = sizeof(set_bmc_globals_rsp) + 1;
    250        msg[msg_len] = -ipmb_checksum(msg, msg_len, 0);
    251        msg_len++;
    252        msg[msg_len++] = 0xa0;
    253        write_emu_msg(msg, msg_len);
    254    } else {
    255        g_assert(0);
    256    }
    257}
    258
    259static void bt_cmd(uint8_t *cmd, unsigned int cmd_len,
    260                    uint8_t *rsp, unsigned int *rsp_len)
    261{
    262    unsigned int i, len, j = 0;
    263    uint8_t seq = 5;
    264
    265    /* Should be idle */
    266    g_assert(bt_get_ctrlreg() == 0);
    267
    268    bt_wait_b_busy();
    269    IPMI_BT_CTLREG_SET_CLR_WR_PTR();
    270    bt_write_buf(cmd_len + 1);
    271    bt_write_buf(cmd[0]);
    272    bt_write_buf(seq);
    273    for (i = 1; i < cmd_len; i++) {
    274        bt_write_buf(cmd[i]);
    275    }
    276    IPMI_BT_CTLREG_SET_H2B_ATN();
    277
    278    emu_msg_handler(); /* We should get a message on the socket here. */
    279
    280    bt_wait_b2h_atn();
    281    if (bt_ints_enabled) {
    282        g_assert((bt_get_irqreg() & 0x02) == 0x02);
    283        g_assert(get_irq(IPMI_IRQ));
    284        bt_write_irqreg(0x03);
    285    } else {
    286        g_assert(!get_irq(IPMI_IRQ));
    287    }
    288    IPMI_BT_CTLREG_SET_H_BUSY();
    289    IPMI_BT_CTLREG_SET_B2H_ATN();
    290    IPMI_BT_CTLREG_SET_CLR_RD_PTR();
    291    len = bt_get_buf();
    292    g_assert(len >= 4);
    293    rsp[0] = bt_get_buf();
    294    assert(bt_get_buf() == seq);
    295    len--;
    296    for (j = 1; j < len; j++) {
    297        rsp[j] = bt_get_buf();
    298    }
    299    IPMI_BT_CTLREG_SET_H_BUSY();
    300    *rsp_len = j;
    301}
    302
    303
    304/*
    305 * We should get a connect request and a short message with capabilities.
    306 */
    307static void test_connect(void)
    308{
    309    fd_set readfds;
    310    int rv;
    311    int val;
    312    struct timeval tv;
    313    uint8_t msg[100];
    314    unsigned int msglen;
    315    static uint8_t exp1[] = { 0xff, 0x01, 0xa1 }; /* A protocol version */
    316    static uint8_t exp2[] = { 0x08, 0x3f, 0xa1 }; /* A capabilities cmd */
    317
    318    FD_ZERO(&readfds);
    319    FD_SET(emu_lfd, &readfds);
    320    tv.tv_sec = 10;
    321    tv.tv_usec = 0;
    322    rv = select(emu_lfd + 1, &readfds, NULL, NULL, &tv);
    323    g_assert(rv == 1);
    324    emu_fd = accept(emu_lfd, NULL, 0);
    325    if (emu_fd < 0) {
    326        perror("accept");
    327    }
    328    g_assert(emu_fd >= 0);
    329
    330    val = 1;
    331    rv = setsockopt(emu_fd, IPPROTO_TCP, TCP_NODELAY, &val, sizeof(val));
    332    g_assert(rv != -1);
    333
    334    /* Report our version */
    335    write_emu_msg(exp1, sizeof(exp1));
    336
    337    /* Validate that we get the info we expect. */
    338    msglen = sizeof(msg);
    339    get_emu_msg(msg, &msglen);
    340    g_assert(msglen == sizeof(exp1));
    341    g_assert(memcmp(msg, exp1, msglen) == 0);
    342    msglen = sizeof(msg);
    343    get_emu_msg(msg, &msglen);
    344    g_assert(msglen == sizeof(exp2));
    345    g_assert(memcmp(msg, exp2, msglen) == 0);
    346}
    347
    348/*
    349 * Send a get_device_id to do a basic test.
    350 */
    351static void test_bt_base(void)
    352{
    353    uint8_t rsp[20];
    354    unsigned int rsplen = sizeof(rsp);
    355
    356    bt_cmd(get_dev_id_cmd, sizeof(get_dev_id_cmd), rsp, &rsplen);
    357    g_assert(rsplen == sizeof(get_dev_id_rsp));
    358    g_assert(memcmp(get_dev_id_rsp, rsp, rsplen) == 0);
    359}
    360
    361/*
    362 * Enable IRQs for the interface.
    363 */
    364static void test_enable_irq(void)
    365{
    366    uint8_t rsp[20];
    367    unsigned int rsplen = sizeof(rsp);
    368
    369    bt_cmd(set_bmc_globals_cmd, sizeof(set_bmc_globals_cmd), rsp, &rsplen);
    370    g_assert(rsplen == sizeof(set_bmc_globals_rsp));
    371    g_assert(memcmp(set_bmc_globals_rsp, rsp, rsplen) == 0);
    372    bt_write_irqreg(0x01);
    373    bt_ints_enabled = 1;
    374}
    375
    376/*
    377 * Create a local TCP socket with any port, then save off the port we got.
    378 */
    379static void open_socket(void)
    380{
    381    struct sockaddr_in myaddr = {};
    382    socklen_t addrlen;
    383
    384    myaddr.sin_family = AF_INET;
    385    myaddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
    386    myaddr.sin_port = 0;
    387    emu_lfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
    388    if (emu_lfd == -1) {
    389        perror("socket");
    390        exit(1);
    391    }
    392    if (bind(emu_lfd, (struct sockaddr *) &myaddr, sizeof(myaddr)) == -1) {
    393        perror("bind");
    394        exit(1);
    395    }
    396    addrlen = sizeof(myaddr);
    397    if (getsockname(emu_lfd, (struct sockaddr *) &myaddr , &addrlen) == -1) {
    398        perror("getsockname");
    399        exit(1);
    400    }
    401    emu_port = ntohs(myaddr.sin_port);
    402    assert(listen(emu_lfd, 1) != -1);
    403}
    404
    405int main(int argc, char **argv)
    406{
    407    int ret;
    408
    409    open_socket();
    410
    411    /* Run the tests */
    412    g_test_init(&argc, &argv, NULL);
    413
    414    global_qtest = qtest_initf(
    415        " -chardev socket,id=ipmi0,host=localhost,port=%d,reconnect=10"
    416        " -device ipmi-bmc-extern,chardev=ipmi0,id=bmc0"
    417        " -device isa-ipmi-bt,bmc=bmc0", emu_port);
    418    qtest_irq_intercept_in(global_qtest, "ioapic");
    419    qtest_add_func("/ipmi/extern/connect", test_connect);
    420    qtest_add_func("/ipmi/extern/bt_base", test_bt_base);
    421    qtest_add_func("/ipmi/extern/bt_enable_irq", test_enable_irq);
    422    qtest_add_func("/ipmi/extern/bt_base_irq", test_bt_base);
    423    ret = g_test_run();
    424    qtest_quit(global_qtest);
    425
    426    return ret;
    427}