qemu: RS485 bridge to sim, portal E2E scenario, CI wiring
Phase 3 of the device sim, all verified on QEMU 10.0.11: - qemu/rs485-bridge/: std-only crate bridging a QEMU serial chardev (unix socket) to warden_sim::ModbusSlave — gap-based RTU framing (CRC failures degrade to real-slave silence), line-protocol control socket for register seeding and fault injection (drop/exception/clear), bounds-checked so a scenario typo answers err instead of panicking the bus. 7 unit tests, bench in the sim_bench pattern. Verified end-to-end: guest master frame on /dev/ttyS4 (pci-serial) answered from the sim slave, CRC-correct. - virt machine gains highmem=off: the 32-bit non-LPAE kernel cannot reach virt's default 40-bit PCIe ECAM (pci-host-generic EOVERFLOW); with it the full PCI set probes (16550A ttyS0, i6300esb). - Watchdog scenario verified: guest arms /dev/watchdog, no petting, i6300esb resets the VM ~30s later (first environment where this arm is testable). - qemu/tests/portal-scenario.sh: the real static-musl warden-flared inside the VM against flare-edge's mock portal on the host — authenticated check-in, firmware desired-state pull, and download of a real signed tier-1 .wfw offer, asserted from the portal log. Found and filed flare-edge#106 (fatal SIGBUS in the HPMCU boot-loaded probe on non-RV1106 memory maps); runs against a flared built from the qemu-vm-support fix branch. - stage-2 init: WARDEN_FLARE_INSECURE=1 + WARDEN_HPMCU=0 (documented VM deviations), firmware-version stamp, newline-terminated state seeds. - CI: rs485-bridge joins the test loop and bench job; new qemu-tools job (shellcheck + initramfs + disk image on hosted runners); kernel-build gains a fail-closed qemu boot-smoke step. All qemu scripts shellcheck-clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018HUayid7W5w7jBdb9Rrj1K
This commit is contained in:
BFE Engineering
co-authored by
Claude Fable 5
Claude Fable 5
parent
bf3c93cf85
commit
c7e06514ad
@@ -0,0 +1,332 @@
|
||||
//! Bridge a QEMU serial chardev (unix socket) to `warden_sim::ModbusSlave`.
|
||||
//!
|
||||
//! The guest side is the *master* (flare-edge's `warden-modbus` scanner, polling
|
||||
//! what it believes is /dev/ttyS4); this bridge is the wire and every slave on
|
||||
//! it. Frames are delimited by an inter-frame gap of silence: RTU's 3.5-char
|
||||
//! rule cannot survive a socket transport, so a wall-clock gap stands in for it.
|
||||
//! A mis-split frame fails CRC inside `handle_frame`, which answers `None` —
|
||||
//! exactly a real slave staying silent — and the master already treats silence
|
||||
//! as a timeout, so the failure mode degrades to a dropped poll, never a
|
||||
//! phantom reply.
|
||||
//!
|
||||
//! A second unix socket (the control channel) scripts the simulated bus from
|
||||
//! test harnesses: fault injection (`drop`, `exception`, `clear`) and register
|
||||
//! seeding/reading, one command per line.
|
||||
|
||||
use std::io::{Read, Write};
|
||||
use std::os::unix::net::UnixStream;
|
||||
use std::sync::Mutex;
|
||||
use std::time::Duration;
|
||||
use warden_sim::ModbusSlave;
|
||||
|
||||
/// Default inter-frame gap. Generous next to real RTU (3.5 chars at 9600 baud
|
||||
/// is ~4 ms) because a loaded host can stall a reader; the guest master's
|
||||
/// response timeout is orders of magnitude larger.
|
||||
pub const DEFAULT_GAP: Duration = Duration::from_millis(10);
|
||||
|
||||
/// The shared bus: the slave plus its declared dimensions. The sim's register
|
||||
/// setters panic on out-of-range indices (deliberate test-harness semantics);
|
||||
/// the control channel must bounds-check first so a typo in a scenario script
|
||||
/// answers `err` instead of killing the VM's whole field bus.
|
||||
pub struct Bus {
|
||||
pub slave: Mutex<ModbusSlave>,
|
||||
pub regs: usize,
|
||||
pub bits: usize,
|
||||
}
|
||||
|
||||
impl Bus {
|
||||
pub fn new(address: u8, regs: usize, bits: usize) -> Self {
|
||||
Bus {
|
||||
slave: Mutex::new(ModbusSlave::new(address, regs, bits)),
|
||||
regs,
|
||||
bits,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Pump one serial connection until EOF: accumulate bytes, dispatch a frame to
|
||||
/// the slave after `gap` of silence, write back the reply when the slave
|
||||
/// answers. Any pending bytes are dispatched on EOF so a final unflushed frame
|
||||
/// is not lost.
|
||||
pub fn pump_serial(
|
||||
stream: &UnixStream,
|
||||
slave: &Mutex<ModbusSlave>,
|
||||
gap: Duration,
|
||||
) -> std::io::Result<()> {
|
||||
stream.set_read_timeout(Some(gap))?;
|
||||
let mut buf: Vec<u8> = Vec::new();
|
||||
let mut chunk = [0u8; 256];
|
||||
loop {
|
||||
match (&*stream).read(&mut chunk) {
|
||||
Ok(0) => {
|
||||
if !buf.is_empty() {
|
||||
dispatch(&mut buf, stream, slave)?;
|
||||
}
|
||||
return Ok(());
|
||||
}
|
||||
Ok(n) => buf.extend_from_slice(&chunk[..n]),
|
||||
Err(e)
|
||||
if e.kind() == std::io::ErrorKind::WouldBlock
|
||||
|| e.kind() == std::io::ErrorKind::TimedOut =>
|
||||
{
|
||||
if !buf.is_empty() {
|
||||
dispatch(&mut buf, stream, slave)?;
|
||||
}
|
||||
}
|
||||
Err(e) if e.kind() == std::io::ErrorKind::Interrupted => continue,
|
||||
Err(e) => return Err(e),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn dispatch(
|
||||
buf: &mut Vec<u8>,
|
||||
stream: &UnixStream,
|
||||
slave: &Mutex<ModbusSlave>,
|
||||
) -> std::io::Result<()> {
|
||||
let reply = slave.lock().unwrap().handle_frame(buf);
|
||||
match &reply {
|
||||
Some(r) => eprintln!("rs485: {} -> {}", hex(buf), hex(r)),
|
||||
None => eprintln!("rs485: {} -> (silence)", hex(buf)),
|
||||
}
|
||||
buf.clear();
|
||||
if let Some(r) = reply {
|
||||
(&*stream).write_all(&r)?;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn hex(bytes: &[u8]) -> String {
|
||||
bytes
|
||||
.iter()
|
||||
.map(|b| format!("{b:02x}"))
|
||||
.collect::<Vec<_>>()
|
||||
.join("")
|
||||
}
|
||||
|
||||
/// Execute one control-channel command against the slave. One command per
|
||||
/// line; the reply is `ok`, `ok <value>`, or `err <reason>`.
|
||||
///
|
||||
/// drop <n> answer the next n requests with silence
|
||||
/// exception <code> NAK everything with this exception code (0x01..)
|
||||
/// clear clear injected faults
|
||||
/// holding <addr>=<v> seed a holding register
|
||||
/// input <addr>=<v> seed an input register
|
||||
/// coil <addr>=<0|1> seed a coil
|
||||
/// discrete <addr>=<0|1> seed a discrete input
|
||||
/// get-holding <addr> read a holding register back
|
||||
/// get-coil <addr> read a coil back
|
||||
/// ping liveness check
|
||||
pub fn handle_control_line(line: &str, bus: &Bus) -> String {
|
||||
let mut words = line.split_whitespace();
|
||||
let cmd = match words.next() {
|
||||
Some(c) => c,
|
||||
None => return "err empty command".into(),
|
||||
};
|
||||
let arg = words.next();
|
||||
if words.next().is_some() {
|
||||
return format!("err trailing arguments after '{cmd}'");
|
||||
}
|
||||
let bound = |cmd: &str| match cmd {
|
||||
"holding" | "input" | "get-holding" => bus.regs,
|
||||
_ => bus.bits,
|
||||
};
|
||||
let mut s = bus.slave.lock().unwrap();
|
||||
match (cmd, arg) {
|
||||
("ping", None) => "ok".into(),
|
||||
("clear", None) => {
|
||||
s.clear_faults();
|
||||
"ok".into()
|
||||
}
|
||||
("drop", Some(n)) => match n.parse::<usize>() {
|
||||
Ok(n) => {
|
||||
s.drop_next(n);
|
||||
"ok".into()
|
||||
}
|
||||
Err(_) => format!("err bad count '{n}'"),
|
||||
},
|
||||
("exception", Some(c)) => match parse_u16(c) {
|
||||
Some(c) if c <= 0xff => {
|
||||
s.force_exception(c as u8);
|
||||
"ok".into()
|
||||
}
|
||||
_ => format!("err bad exception code '{c}'"),
|
||||
},
|
||||
("holding" | "input" | "coil" | "discrete", Some(kv)) => {
|
||||
let (addr, val) = match kv.split_once('=') {
|
||||
Some((a, v)) => (parse_u16(a), parse_u16(v)),
|
||||
None => (None, None),
|
||||
};
|
||||
match (addr, val) {
|
||||
(Some(a), _) if (a as usize) >= bound(cmd) => {
|
||||
format!("err address {a} out of range (0..{})", bound(cmd))
|
||||
}
|
||||
(Some(a), Some(v)) => {
|
||||
match cmd {
|
||||
"holding" => s.set_holding(a as usize, v),
|
||||
"input" => s.set_input(a as usize, v),
|
||||
"coil" => s.set_coil(a as usize, v != 0),
|
||||
_ => s.set_discrete(a as usize, v != 0),
|
||||
}
|
||||
"ok".into()
|
||||
}
|
||||
_ => format!("err expected <addr>=<value>, got '{kv}'"),
|
||||
}
|
||||
}
|
||||
("get-holding" | "get-coil", Some(a)) => match parse_u16(a) {
|
||||
Some(a) if (a as usize) >= bound(cmd) => {
|
||||
format!("err address {a} out of range (0..{})", bound(cmd))
|
||||
}
|
||||
Some(a) if cmd == "get-holding" => format!("ok {}", s.holding(a as usize)),
|
||||
Some(a) => format!("ok {}", u8::from(s.coil(a as usize))),
|
||||
None => format!("err bad address '{a}'"),
|
||||
},
|
||||
_ => format!("err unknown or malformed command '{line}'"),
|
||||
}
|
||||
}
|
||||
|
||||
fn parse_u16(s: &str) -> Option<u16> {
|
||||
if let Some(h) = s.strip_prefix("0x").or_else(|| s.strip_prefix("0X")) {
|
||||
u16::from_str_radix(h, 16).ok()
|
||||
} else {
|
||||
s.parse().ok()
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
use std::thread;
|
||||
use std::time::Duration;
|
||||
use warden_sim::modbus::{crc_ok, read_holding};
|
||||
|
||||
// Test gap is larger than DEFAULT_GAP so a loaded CI runner cannot split
|
||||
// a frame that the test wrote in two deliberate chunks.
|
||||
const GAP: Duration = Duration::from_millis(25);
|
||||
const SETTLE: Duration = Duration::from_millis(100);
|
||||
|
||||
fn bus() -> Bus {
|
||||
let b = Bus::new(1, 16, 16);
|
||||
b.slave.lock().unwrap().set_holding(2, 0xbeef);
|
||||
b
|
||||
}
|
||||
|
||||
fn with_pump<F: FnOnce(&UnixStream)>(bus: &Bus, f: F) {
|
||||
let (master, wire) = UnixStream::pair().unwrap();
|
||||
thread::scope(|sc| {
|
||||
sc.spawn(|| pump_serial(&wire, &bus.slave, GAP).unwrap());
|
||||
f(&master);
|
||||
master.shutdown(std::net::Shutdown::Both).unwrap();
|
||||
});
|
||||
}
|
||||
|
||||
fn read_reply(master: &UnixStream) -> Vec<u8> {
|
||||
master.set_read_timeout(Some(Duration::from_secs(2))).unwrap();
|
||||
let mut buf = [0u8; 256];
|
||||
let n = (&*master).read(&mut buf).expect("expected a reply frame");
|
||||
buf[..n].to_vec()
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn whole_frame_gets_a_valid_reply() {
|
||||
let s = bus();
|
||||
with_pump(&s, |master| {
|
||||
(&*master).write_all(&read_holding(1, 2, 1)).unwrap();
|
||||
let reply = read_reply(master);
|
||||
assert!(crc_ok(&reply), "reply must carry a valid CRC");
|
||||
// addr, fc, byte count, 0xbeef
|
||||
assert_eq!(&reply[..5], &[1, 0x03, 2, 0xbe, 0xef]);
|
||||
});
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn frame_split_across_writes_within_gap_is_one_frame() {
|
||||
let s = bus();
|
||||
with_pump(&s, |master| {
|
||||
let req = read_holding(1, 2, 1);
|
||||
let (a, b) = req.split_at(3);
|
||||
(&*master).write_all(a).unwrap();
|
||||
thread::sleep(Duration::from_millis(2)); // well inside GAP
|
||||
(&*master).write_all(b).unwrap();
|
||||
let reply = read_reply(master);
|
||||
assert_eq!(&reply[..5], &[1, 0x03, 2, 0xbe, 0xef]);
|
||||
});
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn two_frames_separated_by_gap_get_two_replies() {
|
||||
let s = bus();
|
||||
with_pump(&s, |master| {
|
||||
(&*master).write_all(&read_holding(1, 2, 1)).unwrap();
|
||||
let first = read_reply(master);
|
||||
assert_eq!(&first[..5], &[1, 0x03, 2, 0xbe, 0xef]);
|
||||
thread::sleep(SETTLE);
|
||||
(&*master).write_all(&read_holding(1, 2, 1)).unwrap();
|
||||
let second = read_reply(master);
|
||||
assert_eq!(second, first);
|
||||
});
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn injected_drop_is_silence_then_recovery() {
|
||||
let s = bus();
|
||||
assert_eq!(handle_control_line("drop 1", &s), "ok");
|
||||
with_pump(&s, |master| {
|
||||
(&*master).write_all(&read_holding(1, 2, 1)).unwrap();
|
||||
master
|
||||
.set_read_timeout(Some(Duration::from_millis(200)))
|
||||
.unwrap();
|
||||
let mut buf = [0u8; 16];
|
||||
assert!(
|
||||
(&*master).read(&mut buf).is_err(),
|
||||
"dropped request must produce silence"
|
||||
);
|
||||
(&*master).write_all(&read_holding(1, 2, 1)).unwrap();
|
||||
let reply = read_reply(master);
|
||||
assert_eq!(&reply[..5], &[1, 0x03, 2, 0xbe, 0xef]);
|
||||
});
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn control_seeds_and_reads_registers() {
|
||||
let s = bus();
|
||||
assert_eq!(handle_control_line("holding 5=1234", &s), "ok");
|
||||
assert_eq!(handle_control_line("get-holding 5", &s), "ok 1234");
|
||||
assert_eq!(handle_control_line("coil 3=1", &s), "ok");
|
||||
assert_eq!(handle_control_line("get-coil 3", &s), "ok 1");
|
||||
assert_eq!(handle_control_line("holding 0xF=0xff", &s), "ok");
|
||||
assert_eq!(handle_control_line("get-holding 15", &s), "ok 255");
|
||||
// Out of range must answer err, never panic the bus (16-reg slave).
|
||||
assert!(handle_control_line("holding 0x10=0xff", &s).starts_with("err"));
|
||||
assert!(handle_control_line("get-holding 16", &s).starts_with("err"));
|
||||
assert!(handle_control_line("coil 16=1", &s).starts_with("err"));
|
||||
assert_eq!(handle_control_line("ping", &s), "ok");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn control_rejects_malformed_lines() {
|
||||
let s = bus();
|
||||
assert!(handle_control_line("", &s).starts_with("err"));
|
||||
assert!(handle_control_line("drop many", &s).starts_with("err"));
|
||||
assert!(handle_control_line("holding 5", &s).starts_with("err"));
|
||||
assert!(handle_control_line("exception 300", &s).starts_with("err"));
|
||||
assert!(handle_control_line("frobnicate 1", &s).starts_with("err"));
|
||||
assert!(handle_control_line("drop 1 2", &s).starts_with("err"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn forced_exception_naks_and_clear_recovers() {
|
||||
let s = bus();
|
||||
assert_eq!(handle_control_line("exception 0x02", &s), "ok");
|
||||
with_pump(&s, |master| {
|
||||
(&*master).write_all(&read_holding(1, 2, 1)).unwrap();
|
||||
let nak = read_reply(master);
|
||||
assert_eq!(&nak[..3], &[1, 0x83, 0x02], "fc|0x80 + exception code");
|
||||
assert_eq!(handle_control_line("clear", &s), "ok");
|
||||
thread::sleep(SETTLE);
|
||||
(&*master).write_all(&read_holding(1, 2, 1)).unwrap();
|
||||
let reply = read_reply(master);
|
||||
assert_eq!(&reply[..5], &[1, 0x03, 2, 0xbe, 0xef]);
|
||||
});
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,105 @@
|
||||
//! CLI wiring for the RS-485 bridge. All behavior lives in the lib (tested
|
||||
//! there); this file only parses arguments, connects sockets, and spawns the
|
||||
//! control listener.
|
||||
//!
|
||||
//! Typical use (matches qemu/run.sh --rs485):
|
||||
//!
|
||||
//! qemu/run.sh --kernel ... --rs485 /tmp/warden-rs485.sock &
|
||||
//! rs485-bridge --serial /tmp/warden-rs485.sock --control /tmp/warden-rs485-ctl.sock
|
||||
|
||||
use std::io::{BufRead, BufReader, Write};
|
||||
use std::os::unix::net::{UnixListener, UnixStream};
|
||||
use std::process::exit;
|
||||
use std::time::{Duration, Instant};
|
||||
use warden_rs485_bridge::{handle_control_line, pump_serial, Bus, DEFAULT_GAP};
|
||||
|
||||
fn usage() -> ! {
|
||||
eprintln!(
|
||||
"usage: rs485-bridge --serial <sock> [--control <sock>] [--address N] \
|
||||
[--regs N] [--bits N] [--gap-ms N]"
|
||||
);
|
||||
exit(2);
|
||||
}
|
||||
|
||||
fn main() {
|
||||
let mut serial: Option<String> = None;
|
||||
let mut control: Option<String> = None;
|
||||
let mut address: u8 = 1;
|
||||
let mut regs: usize = 128;
|
||||
let mut bits: usize = 64;
|
||||
let mut gap = DEFAULT_GAP;
|
||||
|
||||
let mut args = std::env::args().skip(1);
|
||||
while let Some(a) = args.next() {
|
||||
let mut val = |name: &str| args.next().unwrap_or_else(|| {
|
||||
eprintln!("{name} needs a value");
|
||||
usage()
|
||||
});
|
||||
match a.as_str() {
|
||||
"--serial" => serial = Some(val("--serial")),
|
||||
"--control" => control = Some(val("--control")),
|
||||
"--address" => address = val("--address").parse().unwrap_or_else(|_| usage()),
|
||||
"--regs" => regs = val("--regs").parse().unwrap_or_else(|_| usage()),
|
||||
"--bits" => bits = val("--bits").parse().unwrap_or_else(|_| usage()),
|
||||
"--gap-ms" => {
|
||||
gap = Duration::from_millis(val("--gap-ms").parse().unwrap_or_else(|_| usage()))
|
||||
}
|
||||
_ => usage(),
|
||||
}
|
||||
}
|
||||
let serial = serial.unwrap_or_else(|| usage());
|
||||
|
||||
// The bus is shared between the serial pump and the control channel.
|
||||
// 'static so the control thread needs no scoped lifetime: the bridge runs
|
||||
// until killed.
|
||||
let bus: &'static Bus = Box::leak(Box::new(Bus::new(address, regs, bits)));
|
||||
|
||||
if let Some(path) = control {
|
||||
let _ = std::fs::remove_file(&path); // stale socket from a previous run
|
||||
let listener = UnixListener::bind(&path).unwrap_or_else(|e| {
|
||||
eprintln!("FATAL: cannot bind control socket {path}: {e}");
|
||||
exit(1);
|
||||
});
|
||||
eprintln!("rs485: control socket at {path}");
|
||||
std::thread::spawn(move || {
|
||||
for conn in listener.incoming().flatten() {
|
||||
let reader = BufReader::new(conn.try_clone().expect("clone control conn"));
|
||||
let mut writer = conn;
|
||||
for line in reader.lines() {
|
||||
let line = match line {
|
||||
Ok(l) => l,
|
||||
Err(_) => break,
|
||||
};
|
||||
let reply = handle_control_line(&line, bus);
|
||||
if writeln!(writer, "{reply}").is_err() {
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
// QEMU (chardev server=on) may come up after us: retry the connect briefly
|
||||
// instead of racing the VM launch.
|
||||
let deadline = Instant::now() + Duration::from_secs(15);
|
||||
let stream = loop {
|
||||
match UnixStream::connect(&serial) {
|
||||
Ok(s) => break s,
|
||||
Err(e) if Instant::now() < deadline => {
|
||||
eprintln!("rs485: waiting for {serial} ({e})");
|
||||
std::thread::sleep(Duration::from_millis(500));
|
||||
}
|
||||
Err(e) => {
|
||||
eprintln!("FATAL: cannot connect serial socket {serial}: {e}");
|
||||
exit(1);
|
||||
}
|
||||
}
|
||||
};
|
||||
eprintln!("rs485: connected to {serial}, slave address {address}, gap {gap:?}");
|
||||
|
||||
if let Err(e) = pump_serial(&stream, &bus.slave, gap) {
|
||||
eprintln!("FATAL: serial pump: {e}");
|
||||
exit(1);
|
||||
}
|
||||
eprintln!("rs485: serial closed (VM gone), exiting");
|
||||
}
|
||||
Reference in New Issue
Block a user