[3823] in RedHat Linux List
Re: UPS reccomendations
daemon@ATHENA.MIT.EDU (Eric Smith)
Mon Nov 11 02:21:38 1996
Date: 11 Nov 1996 08:09:28 -0000
From: Eric Smith <eric@brouhaha.com>
To: redhat-list@redhat.com
CC: David Myers <dem@skyline.rtp.nc.us>,
Pavel Korensky <pavelk@dator3.anet.cz>,
Kevin Smolkowski <kevins@tigger.oslc.org>
In-reply-to: <199611110219.VAA08225@skyline.rtp.nc.us> (message from David
Myers on Sun, 10 Nov 1996 21:19:36 -0500 (EST))
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
I wrote about UPS signalling protocols and the "apcd" program for Linux to
communicate with the APC SmartUPS.
David Myers <dem@skyline.rtp.nc.us> replied:
> Someone made an RPM, but I caution those who install it that it
> doesn't shut down your system properly. It contains a hard-coded
> sequence of commands to halt the OS, rather than signalling the init
> process to carry out an orderly shutdown. Not a good idea.
Agreed, and the author of apcd even touted that as a feature! I'm not sure
why he would think that to be a good idea, but in any case I am grateful to
him and the others who invested the time to reverse-engineer the protocol.
I'm working on hacking some APC communication code into powerd to do things
by the book.
> I'm exchanging mail with APC about licensing their UPS communications
> code. If their licensing terms allow me to create a freely distributable
> UPS daemon, I'll do it. If not, then perhaps I'll borrow the necessary
> code from apcd.
Great, given how much copious free time I have available, you'll probably
beat me to it (which is good). I'll look forward to seeing it; please be
sure to let us know about your progress.
A few words of warning:
The APC commands are mostly just single characters, with no special framing.
A few commands do rely on special timing (notably "K" and "Z"), seemingly
infringing on the Hayes modem escape sequence patent. There is allegedly a
"Y" command that is necessary to get the attention of the SmartUPS, but as
near as I can determine once the thing has seen a "Y" it will keep listening
for commands indefinitely (or longer than I have patience to wait). Perhaps
there is another "unattention" command, but I haven't found it.
It is possible to send dangerous commands to the SmartUPS. A trivial example
is to send the command to switch it to battery power. If somehow this happens
while the unit is unattended, perhaps by a rogue program writing to the serial
port, it will run down the battery and ultimately kill power to the system.
Under Linux this is obviously not too much of a threat since you can set the
permissions on the serial port to prevent unintended access. However, it
scares me to think what could happen under other, less secure, operating
systems. DOS, Windows, and Windows 95 come to mind, although perhaps Windows
NT might be immune to this if it is configured properly. But I have quite a
bit of engineering software for DOS and Windows that automatically send out
bizarre character sequences to all the serial ports searching for dongles,
microcontroller and device programmers, and other peripheral equipment.
This situation wouldn't be so bad, except that in my effort to discover what
other hitherto undocumented commands the SmartUPS responds to, I found that
it is possible to break it completely.
Commands that aren't implemented return the string "NA", logically enough.
The only immediately obvious command I found was Control-A (0x01), which
causes the SmartUPS to reply with its model number, e.g., "SMART-UPS 1400"
for my unit. However, in continuing to experiment with it, I evidently
managed to get it into a service mode or something. I noticed that some
characters I'd previously gotten a "NA" response from now returned other
responses.
And unfortunately, I somehow stumbled into a command that caused it to
lose its mind. All of a sudden it started beeping like line power had failed
(which it hadn't), sent to the computer the "!!" sequence which indicates
power loss, displayed zero on the UPS load bar graph, AND dropped the
battery charge bar graph instantly from full to empty.
Everything I tried to do at the point, including the self test, failed to
restore proper operation. Furthermore, now a Control-A returned the response
"SMART-UPS 450"!!! My guess is that I somehow got it to erase some internal
non-volatile memory, and that now it needs to go through the factory
calibration process again.
Frankly, I am appalled that on an otherwise seemingly well-engineered product,
it is trivially possible to send a character sequence that breaks the product.
They really should document the risk, how to avoid it, and perhaps provide
utilities to backup and restore the internal non-volatile memory in case you
do manage to break it.
Given that the device talking to the UPS can ordinarilly be expected to be
capable of running fairly complex software, and that APC in fact tries really
hard to sell said software, it seems unconsionable to me that they couldn't
have invented a better protocol with some sort of framing and error checking,
which could reduce the probability of the UPS inadvertently accepting random
garbage as commands. Of course, that probably wouldn't have stopped me in
my determined effort to find all the commands, but it would make me a lot
happier in the knowledge that rogue software wouldn't accidentally destroy
the product.
At this point I am seriously considering making a microcontroller-based
frob that sits in the line between the computer and the SmartUPS, and talks
a more sophisticated protocol to the PC, an in the process making sure that
the PC only is able to send well-understood commands to the Smart-UPS.
One last note:
It seems that the "P" command, which is documented in the apcd package as
returning the load on the UPS in VA, seems to in fact measure it in some
other units, such as possibly percentage of rated load. I put enough load
on the SmartUPS 1400 to make it's front panel load bargraph turn on two out
of five LEDs, but the P command only returned "034.8".
Cheers,
Eric
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
________________________________________________________________________
http://www.redhat.com/RedHat-FAQ http://www.redhat.com/RedHat-Errata
http://www.redhat.com/RedHat-Tips http://www.redhat.com/mailing-lists
------------------------------------------------------------------------
To unsubscribe: mail -s unsubscribe redhat-list-request@redhat.com < /dev/null
