4 * Copyright (c) 2013 Kevin Wolf <kwolf@redhat.com>
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
32 #include "libqos/pci-pc.h"
33 #include "libqos/malloc-pc.h"
35 #include "qemu-common.h"
36 #include "hw/pci/pci_ids.h"
37 #include "hw/pci/pci_regs.h"
39 #define TEST_IMAGE_SIZE 64 * 1024 * 1024
42 #define IDE_PCI_FUNC 1
44 #define IDE_BASE 0x1f0
45 #define IDE_PRIMARY_IRQ 14
80 CMD_FLUSH_CACHE
= 0xe7,
89 BM_CMD_WRITE
= 0x8, /* write = from device to memory */
99 PRDT_EOT
= 0x80000000,
102 #define assert_bit_set(data, mask) g_assert_cmphex((data) & (mask), ==, (mask))
103 #define assert_bit_clear(data, mask) g_assert_cmphex((data) & (mask), ==, 0)
105 static QPCIBus
*pcibus
= NULL
;
106 static QGuestAllocator
*guest_malloc
;
108 static char tmp_path
[] = "/tmp/qtest.XXXXXX";
109 static char debug_path
[] = "/tmp/qtest-blkdebug.XXXXXX";
111 static void ide_test_start(const char *cmdline_fmt
, ...)
116 va_start(ap
, cmdline_fmt
);
117 cmdline
= g_strdup_vprintf(cmdline_fmt
, ap
);
120 qtest_start(cmdline
);
121 guest_malloc
= pc_alloc_init();
126 static void ide_test_quit(void)
128 pc_alloc_uninit(guest_malloc
);
133 static QPCIDevice
*get_pci_device(uint16_t *bmdma_base
)
136 uint16_t vendor_id
, device_id
;
139 pcibus
= qpci_init_pc();
142 /* Find PCI device and verify it's the right one */
143 dev
= qpci_device_find(pcibus
, QPCI_DEVFN(IDE_PCI_DEV
, IDE_PCI_FUNC
));
144 g_assert(dev
!= NULL
);
146 vendor_id
= qpci_config_readw(dev
, PCI_VENDOR_ID
);
147 device_id
= qpci_config_readw(dev
, PCI_DEVICE_ID
);
148 g_assert(vendor_id
== PCI_VENDOR_ID_INTEL
);
149 g_assert(device_id
== PCI_DEVICE_ID_INTEL_82371SB_1
);
152 *bmdma_base
= (uint16_t)(uintptr_t) qpci_iomap(dev
, 4, NULL
);
154 qpci_device_enable(dev
);
159 static void free_pci_device(QPCIDevice
*dev
)
161 /* libqos doesn't have a function for this, so free it manually */
165 typedef struct PrdtEntry
{
168 } QEMU_PACKED PrdtEntry
;
170 #define assert_bit_set(data, mask) g_assert_cmphex((data) & (mask), ==, (mask))
171 #define assert_bit_clear(data, mask) g_assert_cmphex((data) & (mask), ==, 0)
173 static int send_dma_request(int cmd
, uint64_t sector
, int nb_sectors
,
174 PrdtEntry
*prdt
, int prdt_entries
)
178 uintptr_t guest_prdt
;
184 dev
= get_pci_device(&bmdma_base
);
197 g_assert_not_reached();
200 if (flags
& CMDF_NO_BM
) {
201 qpci_config_writew(dev
, PCI_COMMAND
,
202 PCI_COMMAND_IO
| PCI_COMMAND_MEMORY
);
205 /* Select device 0 */
206 outb(IDE_BASE
+ reg_device
, 0 | LBA
);
208 /* Stop any running transfer, clear any pending interrupt */
209 outb(bmdma_base
+ bmreg_cmd
, 0);
210 outb(bmdma_base
+ bmreg_status
, BM_STS_INTR
);
213 len
= sizeof(*prdt
) * prdt_entries
;
214 guest_prdt
= guest_alloc(guest_malloc
, len
);
215 memwrite(guest_prdt
, prdt
, len
);
216 outl(bmdma_base
+ bmreg_prdt
, guest_prdt
);
218 /* ATA DMA command */
219 outb(IDE_BASE
+ reg_nsectors
, nb_sectors
);
221 outb(IDE_BASE
+ reg_lba_low
, sector
& 0xff);
222 outb(IDE_BASE
+ reg_lba_middle
, (sector
>> 8) & 0xff);
223 outb(IDE_BASE
+ reg_lba_high
, (sector
>> 16) & 0xff);
225 outb(IDE_BASE
+ reg_command
, cmd
);
227 /* Start DMA transfer */
228 outb(bmdma_base
+ bmreg_cmd
, BM_CMD_START
| (from_dev
? BM_CMD_WRITE
: 0));
230 if (flags
& CMDF_ABORT
) {
231 outb(bmdma_base
+ bmreg_cmd
, 0);
234 /* Wait for the DMA transfer to complete */
236 status
= inb(bmdma_base
+ bmreg_status
);
237 } while ((status
& (BM_STS_ACTIVE
| BM_STS_INTR
)) == BM_STS_ACTIVE
);
239 g_assert_cmpint(get_irq(IDE_PRIMARY_IRQ
), ==, !!(status
& BM_STS_INTR
));
241 /* Check IDE status code */
242 assert_bit_set(inb(IDE_BASE
+ reg_status
), DRDY
);
243 assert_bit_clear(inb(IDE_BASE
+ reg_status
), BSY
| DRQ
);
245 /* Reading the status register clears the IRQ */
246 g_assert(!get_irq(IDE_PRIMARY_IRQ
));
248 /* Stop DMA transfer if still active */
249 if (status
& BM_STS_ACTIVE
) {
250 outb(bmdma_base
+ bmreg_cmd
, 0);
253 free_pci_device(dev
);
258 static void test_bmdma_simple_rw(void)
264 uintptr_t guest_buf
= guest_alloc(guest_malloc
, len
);
268 .addr
= cpu_to_le32(guest_buf
),
269 .size
= cpu_to_le32(len
| PRDT_EOT
),
274 cmpbuf
= g_malloc(len
);
276 /* Write 0x55 pattern to sector 0 */
277 memset(buf
, 0x55, len
);
278 memwrite(guest_buf
, buf
, len
);
280 status
= send_dma_request(CMD_WRITE_DMA
, 0, 1, prdt
, ARRAY_SIZE(prdt
));
281 g_assert_cmphex(status
, ==, BM_STS_INTR
);
282 assert_bit_clear(inb(IDE_BASE
+ reg_status
), DF
| ERR
);
284 /* Write 0xaa pattern to sector 1 */
285 memset(buf
, 0xaa, len
);
286 memwrite(guest_buf
, buf
, len
);
288 status
= send_dma_request(CMD_WRITE_DMA
, 1, 1, prdt
, ARRAY_SIZE(prdt
));
289 g_assert_cmphex(status
, ==, BM_STS_INTR
);
290 assert_bit_clear(inb(IDE_BASE
+ reg_status
), DF
| ERR
);
292 /* Read and verify 0x55 pattern in sector 0 */
293 memset(cmpbuf
, 0x55, len
);
295 status
= send_dma_request(CMD_READ_DMA
, 0, 1, prdt
, ARRAY_SIZE(prdt
));
296 g_assert_cmphex(status
, ==, BM_STS_INTR
);
297 assert_bit_clear(inb(IDE_BASE
+ reg_status
), DF
| ERR
);
299 memread(guest_buf
, buf
, len
);
300 g_assert(memcmp(buf
, cmpbuf
, len
) == 0);
302 /* Read and verify 0xaa pattern in sector 1 */
303 memset(cmpbuf
, 0xaa, len
);
305 status
= send_dma_request(CMD_READ_DMA
, 1, 1, prdt
, ARRAY_SIZE(prdt
));
306 g_assert_cmphex(status
, ==, BM_STS_INTR
);
307 assert_bit_clear(inb(IDE_BASE
+ reg_status
), DF
| ERR
);
309 memread(guest_buf
, buf
, len
);
310 g_assert(memcmp(buf
, cmpbuf
, len
) == 0);
317 static void test_bmdma_short_prdt(void)
324 .size
= cpu_to_le32(0x10 | PRDT_EOT
),
329 status
= send_dma_request(CMD_READ_DMA
, 0, 1,
330 prdt
, ARRAY_SIZE(prdt
));
331 g_assert_cmphex(status
, ==, 0);
332 assert_bit_clear(inb(IDE_BASE
+ reg_status
), DF
| ERR
);
334 /* Abort the request before it completes */
335 status
= send_dma_request(CMD_READ_DMA
| CMDF_ABORT
, 0, 1,
336 prdt
, ARRAY_SIZE(prdt
));
337 g_assert_cmphex(status
, ==, 0);
338 assert_bit_clear(inb(IDE_BASE
+ reg_status
), DF
| ERR
);
341 static void test_bmdma_long_prdt(void)
348 .size
= cpu_to_le32(0x1000 | PRDT_EOT
),
353 status
= send_dma_request(CMD_READ_DMA
, 0, 1,
354 prdt
, ARRAY_SIZE(prdt
));
355 g_assert_cmphex(status
, ==, BM_STS_ACTIVE
| BM_STS_INTR
);
356 assert_bit_clear(inb(IDE_BASE
+ reg_status
), DF
| ERR
);
358 /* Abort the request before it completes */
359 status
= send_dma_request(CMD_READ_DMA
| CMDF_ABORT
, 0, 1,
360 prdt
, ARRAY_SIZE(prdt
));
361 g_assert_cmphex(status
, ==, BM_STS_INTR
);
362 assert_bit_clear(inb(IDE_BASE
+ reg_status
), DF
| ERR
);
365 static void test_bmdma_no_busmaster(void)
369 /* No PRDT_EOT, each entry addr 0/size 64k, and in theory qemu shouldn't be
370 * able to access it anyway because the Bus Master bit in the PCI command
371 * register isn't set. This is complete nonsense, but it used to be pretty
372 * good at confusing and occasionally crashing qemu. */
373 PrdtEntry prdt
[4096] = { };
375 status
= send_dma_request(CMD_READ_DMA
| CMDF_NO_BM
, 0, 512,
376 prdt
, ARRAY_SIZE(prdt
));
378 /* Not entirely clear what the expected result is, but this is what we get
379 * in practice. At least we want to be aware of any changes. */
380 g_assert_cmphex(status
, ==, BM_STS_ACTIVE
| BM_STS_INTR
);
381 assert_bit_clear(inb(IDE_BASE
+ reg_status
), DF
| ERR
);
384 static void test_bmdma_setup(void)
387 "-drive file=%s,if=ide,serial=%s,cache=writeback,format=raw "
388 "-global ide-hd.ver=%s",
389 tmp_path
, "testdisk", "version");
390 qtest_irq_intercept_in(global_qtest
, "ioapic");
393 static void test_bmdma_teardown(void)
398 static void string_cpu_to_be16(uint16_t *s
, size_t bytes
)
400 g_assert((bytes
& 1) == 0);
404 *s
= cpu_to_be16(*s
);
409 static void test_identify(void)
417 "-drive file=%s,if=ide,serial=%s,cache=writeback,format=raw "
418 "-global ide-hd.ver=%s",
419 tmp_path
, "testdisk", "version");
421 /* IDENTIFY command on device 0*/
422 outb(IDE_BASE
+ reg_device
, 0);
423 outb(IDE_BASE
+ reg_command
, CMD_IDENTIFY
);
425 /* Read in the IDENTIFY buffer and check registers */
426 data
= inb(IDE_BASE
+ reg_device
);
427 g_assert_cmpint(data
& DEV
, ==, 0);
429 for (i
= 0; i
< 256; i
++) {
430 data
= inb(IDE_BASE
+ reg_status
);
431 assert_bit_set(data
, DRDY
| DRQ
);
432 assert_bit_clear(data
, BSY
| DF
| ERR
);
434 ((uint16_t*) buf
)[i
] = inw(IDE_BASE
+ reg_data
);
437 data
= inb(IDE_BASE
+ reg_status
);
438 assert_bit_set(data
, DRDY
);
439 assert_bit_clear(data
, BSY
| DF
| ERR
| DRQ
);
441 /* Check serial number/version in the buffer */
442 string_cpu_to_be16(&buf
[10], 20);
443 ret
= memcmp(&buf
[10], "testdisk ", 20);
446 string_cpu_to_be16(&buf
[23], 8);
447 ret
= memcmp(&buf
[23], "version ", 8);
450 /* Write cache enabled bit */
451 assert_bit_set(buf
[85], 0x20);
456 static void test_flush(void)
461 "-drive file=blkdebug::%s,if=ide,cache=writeback,format=raw",
464 /* Delay the completion of the flush request until we explicitly do it */
465 qmp_discard_response("{'execute':'human-monitor-command', 'arguments': {"
467 " 'qemu-io ide0-hd0 \"break flush_to_os A\"'} }");
469 /* FLUSH CACHE command on device 0*/
470 outb(IDE_BASE
+ reg_device
, 0);
471 outb(IDE_BASE
+ reg_command
, CMD_FLUSH_CACHE
);
473 /* Check status while request is in flight*/
474 data
= inb(IDE_BASE
+ reg_status
);
475 assert_bit_set(data
, BSY
| DRDY
);
476 assert_bit_clear(data
, DF
| ERR
| DRQ
);
478 /* Complete the command */
479 qmp_discard_response("{'execute':'human-monitor-command', 'arguments': {"
481 " 'qemu-io ide0-hd0 \"resume A\"'} }");
483 /* Check registers */
484 data
= inb(IDE_BASE
+ reg_device
);
485 g_assert_cmpint(data
& DEV
, ==, 0);
488 data
= inb(IDE_BASE
+ reg_status
);
489 } while (data
& BSY
);
491 assert_bit_set(data
, DRDY
);
492 assert_bit_clear(data
, BSY
| DF
| ERR
| DRQ
);
497 static void prepare_blkdebug_script(const char *debug_fn
, const char *event
)
499 FILE *debug_file
= fopen(debug_fn
, "w");
502 fprintf(debug_file
, "[inject-error]\n");
503 fprintf(debug_file
, "event = \"%s\"\n", event
);
504 fprintf(debug_file
, "errno = \"5\"\n");
505 fprintf(debug_file
, "state = \"1\"\n");
506 fprintf(debug_file
, "immediately = \"off\"\n");
507 fprintf(debug_file
, "once = \"on\"\n");
509 fprintf(debug_file
, "[set-state]\n");
510 fprintf(debug_file
, "event = \"%s\"\n", event
);
511 fprintf(debug_file
, "new_state = \"2\"\n");
513 g_assert(!ferror(debug_file
));
515 ret
= fclose(debug_file
);
519 static void test_retry_flush(const char *machine
)
525 prepare_blkdebug_script(debug_path
, "flush_to_disk");
529 "-drive file=blkdebug:%s:%s,if=ide,cache=writeback,format=raw,"
530 "rerror=stop,werror=stop",
531 debug_path
, tmp_path
);
533 /* FLUSH CACHE command on device 0*/
534 outb(IDE_BASE
+ reg_device
, 0);
535 outb(IDE_BASE
+ reg_command
, CMD_FLUSH_CACHE
);
537 /* Check status while request is in flight*/
538 data
= inb(IDE_BASE
+ reg_status
);
539 assert_bit_set(data
, BSY
| DRDY
);
540 assert_bit_clear(data
, DF
| ERR
| DRQ
);
542 for (;; response
= NULL
) {
543 response
= qmp_receive();
544 if ((qdict_haskey(response
, "event")) &&
545 (strcmp(qdict_get_str(response
, "event"), "STOP") == 0)) {
552 /* Complete the command */
553 s
= "{'execute':'cont' }";
554 qmp_discard_response(s
);
556 /* Check registers */
557 data
= inb(IDE_BASE
+ reg_device
);
558 g_assert_cmpint(data
& DEV
, ==, 0);
561 data
= inb(IDE_BASE
+ reg_status
);
562 } while (data
& BSY
);
564 assert_bit_set(data
, DRDY
);
565 assert_bit_clear(data
, BSY
| DF
| ERR
| DRQ
);
570 static void test_flush_nodev(void)
574 /* FLUSH CACHE command on device 0*/
575 outb(IDE_BASE
+ reg_device
, 0);
576 outb(IDE_BASE
+ reg_command
, CMD_FLUSH_CACHE
);
578 /* Just testing that qemu doesn't crash... */
583 static void test_pci_retry_flush(const char *machine
)
585 test_retry_flush("pc");
588 static void test_isa_retry_flush(const char *machine
)
590 test_retry_flush("isapc");
593 int main(int argc
, char **argv
)
595 const char *arch
= qtest_get_arch();
599 /* Check architecture */
600 if (strcmp(arch
, "i386") && strcmp(arch
, "x86_64")) {
601 g_test_message("Skipping test for non-x86\n");
605 /* Create temporary blkdebug instructions */
606 fd
= mkstemp(debug_path
);
610 /* Create a temporary raw image */
611 fd
= mkstemp(tmp_path
);
613 ret
= ftruncate(fd
, TEST_IMAGE_SIZE
);
618 g_test_init(&argc
, &argv
, NULL
);
620 qtest_add_func("/ide/identify", test_identify
);
622 qtest_add_func("/ide/bmdma/setup", test_bmdma_setup
);
623 qtest_add_func("/ide/bmdma/simple_rw", test_bmdma_simple_rw
);
624 qtest_add_func("/ide/bmdma/short_prdt", test_bmdma_short_prdt
);
625 qtest_add_func("/ide/bmdma/long_prdt", test_bmdma_long_prdt
);
626 qtest_add_func("/ide/bmdma/no_busmaster", test_bmdma_no_busmaster
);
627 qtest_add_func("/ide/bmdma/teardown", test_bmdma_teardown
);
629 qtest_add_func("/ide/flush", test_flush
);
630 qtest_add_func("/ide/flush/nodev", test_flush_nodev
);
631 qtest_add_func("/ide/flush/retry_pci", test_pci_retry_flush
);
632 qtest_add_func("/ide/flush/retry_isa", test_isa_retry_flush
);