tests/qtest/ide-test.c

   1 /*
   2  * IDE test cases
   3  *
   4  * Copyright (c) 2013 Kevin Wolf <kwolf@redhat.com>
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26
  27
  28 #include "libqtest.h"
  29 #include "libqos/libqos.h"
  30 #include "libqos/pci-pc.h"
  31 #include "libqos/malloc-pc.h"
  32 #include "qapi/qmp/qdict.h"
  33 #include "qemu/bswap.h"
  34 #include "hw/pci/pci_ids.h"
  35 #include "hw/pci/pci_regs.h"
  36
  37 /* Specified by ATA (physical) CHS geometry for ~64 MiB device.  */
  38 #define TEST_IMAGE_SIZE ((130 * 16 * 63) * 512)
  39
  40 #define IDE_PCI_DEV     1
  41 #define IDE_PCI_FUNC    1
  42
  43 #define IDE_BASE 0x1f0
  44 #define IDE_PRIMARY_IRQ 14
  45
  46 #define ATAPI_BLOCK_SIZE 2048
  47
  48 /* How many bytes to receive via ATAPI PIO at one time.
  49  * Must be less than 0xFFFF. */
  50 #define BYTE_COUNT_LIMIT 5120
  51
  52 enum {
  53     reg_data        = 0x0,
  54     reg_feature     = 0x1,
  55     reg_error       = 0x1,
  56     reg_nsectors    = 0x2,
  57     reg_lba_low     = 0x3,
  58     reg_lba_middle  = 0x4,
  59     reg_lba_high    = 0x5,
  60     reg_device      = 0x6,
  61     reg_status      = 0x7,
  62     reg_command     = 0x7,
  63 };
  64
  65 enum {
  66     BSY     = 0x80,
  67     DRDY    = 0x40,
  68     DF      = 0x20,
  69     DRQ     = 0x08,
  70     ERR     = 0x01,
  71 };
  72
  73 /* Error field */
  74 enum {
  75     ABRT    = 0x04,
  76 };
  77
  78 enum {
  79     DEV     = 0x10,
  80     LBA     = 0x40,
  81 };
  82
  83 enum {
  84     bmreg_cmd       = 0x0,
  85     bmreg_status    = 0x2,
  86     bmreg_prdt      = 0x4,
  87 };
  88
  89 enum {
  90     CMD_DSM         = 0x06,
  91     CMD_DIAGNOSE    = 0x90,
  92     CMD_INIT_DP     = 0x91,  /* INITIALIZE DEVICE PARAMETERS */
  93     CMD_READ_DMA    = 0xc8,
  94     CMD_WRITE_DMA   = 0xca,
  95     CMD_FLUSH_CACHE = 0xe7,
  96     CMD_IDENTIFY    = 0xec,
  97     CMD_PACKET      = 0xa0,
  98     CMD_READ_NATIVE = 0xf8,  /* READ NATIVE MAX ADDRESS */
  99
 100     CMDF_ABORT      = 0x100,
 101     CMDF_NO_BM      = 0x200,
 102 };
 103
 104 enum {
 105     BM_CMD_START    =  0x1,
 106     BM_CMD_WRITE    =  0x8, /* write = from device to memory */
 107 };
 108
 109 enum {
 110     BM_STS_ACTIVE   =  0x1,
 111     BM_STS_ERROR    =  0x2,
 112     BM_STS_INTR     =  0x4,
 113 };
 114
 115 enum {
 116     PRDT_EOT        = 0x80000000,
 117 };
 118
 119 #define assert_bit_set(data, mask) g_assert_cmphex((data) & (mask), ==, (mask))
 120 #define assert_bit_clear(data, mask) g_assert_cmphex((data) & (mask), ==, 0)
 121
 122 static QPCIBus *pcibus = NULL;
 123 static QGuestAllocator guest_malloc;
 124
 125 static char *tmp_path[2];
 126 static char *debug_path;
 127
 128 G_GNUC_PRINTF(1, 2)
 129 static QTestState *ide_test_start(const char *cmdline_fmt, ...)
 130 {
 131     QTestState *qts;
 132     g_autofree char *full_fmt = g_strdup_printf("-machine pc %s", cmdline_fmt);
 133     va_list ap;
 134
 135     va_start(ap, cmdline_fmt);
 136     qts = qtest_vinitf(full_fmt, ap);
 137     va_end(ap);
 138
 139     pc_alloc_init(&guest_malloc, qts, 0);
 140
 141     return qts;
 142 }
 143
 144 static void ide_test_quit(QTestState *qts)
 145 {
 146     if (pcibus) {
 147         qpci_free_pc(pcibus);
 148         pcibus = NULL;
 149     }
 150     alloc_destroy(&guest_malloc);
 151     qtest_quit(qts);
 152 }
 153
 154 static QPCIDevice *get_pci_device(QTestState *qts, QPCIBar *bmdma_bar,
 155                                   QPCIBar *ide_bar)
 156 {
 157     QPCIDevice *dev;
 158     uint16_t vendor_id, device_id;
 159
 160     if (!pcibus) {
 161         pcibus = qpci_new_pc(qts, NULL);
 162     }
 163
 164     /* Find PCI device and verify it's the right one */
 165     dev = qpci_device_find(pcibus, QPCI_DEVFN(IDE_PCI_DEV, IDE_PCI_FUNC));
 166     g_assert(dev != NULL);
 167
 168     vendor_id = qpci_config_readw(dev, PCI_VENDOR_ID);
 169     device_id = qpci_config_readw(dev, PCI_DEVICE_ID);
 170     g_assert(vendor_id == PCI_VENDOR_ID_INTEL);
 171     g_assert(device_id == PCI_DEVICE_ID_INTEL_82371SB_1);
 172
 173     /* Map bmdma BAR */
 174     *bmdma_bar = qpci_iomap(dev, 4, NULL);
 175
 176     *ide_bar = qpci_legacy_iomap(dev, IDE_BASE);
 177
 178     qpci_device_enable(dev);
 179
 180     return dev;
 181 }
 182
 183 static void free_pci_device(QPCIDevice *dev)
 184 {
 185     /* libqos doesn't have a function for this, so free it manually */
 186     g_free(dev);
 187 }
 188
 189 typedef struct PrdtEntry {
 190     uint32_t addr;
 191     uint32_t size;
 192 } QEMU_PACKED PrdtEntry;
 193
 194 #define assert_bit_set(data, mask) g_assert_cmphex((data) & (mask), ==, (mask))
 195 #define assert_bit_clear(data, mask) g_assert_cmphex((data) & (mask), ==, 0)
 196
 197 static uint64_t trim_range_le(uint64_t sector, uint16_t count)
 198 {
 199     /* 2-byte range, 6-byte LBA */
 200     return cpu_to_le64(((uint64_t)count << 48) + sector);
 201 }
 202
 203 static int send_dma_request(QTestState *qts, int cmd, uint64_t sector,
 204                             int nb_sectors, PrdtEntry *prdt, int prdt_entries,
 205                             void(*post_exec)(QPCIDevice *dev, QPCIBar ide_bar,
 206                                              uint64_t sector, int nb_sectors))
 207 {
 208     QPCIDevice *dev;
 209     QPCIBar bmdma_bar, ide_bar;
 210     uintptr_t guest_prdt;
 211     size_t len;
 212     bool from_dev;
 213     uint8_t status;
 214     int flags;
 215
 216     dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
 217
 218     flags = cmd & ~0xff;
 219     cmd &= 0xff;
 220
 221     switch (cmd) {
 222     case CMD_READ_DMA:
 223     case CMD_PACKET:
 224         /* Assuming we only test data reads w/ ATAPI, otherwise we need to know
 225          * the SCSI command being sent in the packet, too. */
 226         from_dev = true;
 227         break;
 228     case CMD_DSM:
 229     case CMD_WRITE_DMA:
 230         from_dev = false;
 231         break;
 232     default:
 233         g_assert_not_reached();
 234     }
 235
 236     if (flags & CMDF_NO_BM) {
 237         qpci_config_writew(dev, PCI_COMMAND,
 238                            PCI_COMMAND_IO | PCI_COMMAND_MEMORY);
 239     }
 240
 241     /* Select device 0 */
 242     qpci_io_writeb(dev, ide_bar, reg_device, 0 | LBA);
 243
 244     /* Stop any running transfer, clear any pending interrupt */
 245     qpci_io_writeb(dev, bmdma_bar, bmreg_cmd, 0);
 246     qpci_io_writeb(dev, bmdma_bar, bmreg_status, BM_STS_INTR);
 247
 248     /* Setup PRDT */
 249     len = sizeof(*prdt) * prdt_entries;
 250     guest_prdt = guest_alloc(&guest_malloc, len);
 251     qtest_memwrite(qts, guest_prdt, prdt, len);
 252     qpci_io_writel(dev, bmdma_bar, bmreg_prdt, guest_prdt);
 253
 254     /* ATA DMA command */
 255     if (cmd == CMD_PACKET) {
 256         /* Enables ATAPI DMA; otherwise PIO is attempted */
 257         qpci_io_writeb(dev, ide_bar, reg_feature, 0x01);
 258     } else {
 259         if (cmd == CMD_DSM) {
 260             /* trim bit */
 261             qpci_io_writeb(dev, ide_bar, reg_feature, 0x01);
 262         }
 263         qpci_io_writeb(dev, ide_bar, reg_nsectors, nb_sectors);
 264         qpci_io_writeb(dev, ide_bar, reg_lba_low,    sector & 0xff);
 265         qpci_io_writeb(dev, ide_bar, reg_lba_middle, (sector >> 8) & 0xff);
 266         qpci_io_writeb(dev, ide_bar, reg_lba_high,   (sector >> 16) & 0xff);
 267     }
 268
 269     qpci_io_writeb(dev, ide_bar, reg_command, cmd);
 270
 271     if (post_exec) {
 272         post_exec(dev, ide_bar, sector, nb_sectors);
 273     }
 274
 275     /* Start DMA transfer */
 276     qpci_io_writeb(dev, bmdma_bar, bmreg_cmd,
 277                    BM_CMD_START | (from_dev ? BM_CMD_WRITE : 0));
 278
 279     if (flags & CMDF_ABORT) {
 280         qpci_io_writeb(dev, bmdma_bar, bmreg_cmd, 0);
 281     }
 282
 283     /* Wait for the DMA transfer to complete */
 284     do {
 285         status = qpci_io_readb(dev, bmdma_bar, bmreg_status);
 286     } while ((status & (BM_STS_ACTIVE | BM_STS_INTR)) == BM_STS_ACTIVE);
 287
 288     g_assert_cmpint(qtest_get_irq(qts, IDE_PRIMARY_IRQ), ==,
 289                     !!(status & BM_STS_INTR));
 290
 291     /* Check IDE status code */
 292     assert_bit_set(qpci_io_readb(dev, ide_bar, reg_status), DRDY);
 293     assert_bit_clear(qpci_io_readb(dev, ide_bar, reg_status), BSY | DRQ);
 294
 295     /* Reading the status register clears the IRQ */
 296     g_assert(!qtest_get_irq(qts, IDE_PRIMARY_IRQ));
 297
 298     /* Stop DMA transfer if still active */
 299     if (status & BM_STS_ACTIVE) {
 300         qpci_io_writeb(dev, bmdma_bar, bmreg_cmd, 0);
 301     }
 302
 303     free_pci_device(dev);
 304
 305     return status;
 306 }
 307
 308 static QTestState *test_bmdma_setup(void)
 309 {
 310     QTestState *qts;
 311
 312     qts = ide_test_start(
 313         "-drive file=%s,if=ide,cache=writeback,format=raw "
 314         "-global ide-hd.serial=%s -global ide-hd.ver=%s",
 315         tmp_path[0], "testdisk", "version");
 316     qtest_irq_intercept_in(qts, "ioapic");
 317
 318     return qts;
 319 }
 320
 321 static void test_bmdma_teardown(QTestState *qts)
 322 {
 323     ide_test_quit(qts);
 324 }
 325
 326 static void test_bmdma_simple_rw(void)
 327 {
 328     QTestState *qts;
 329     QPCIDevice *dev;
 330     QPCIBar bmdma_bar, ide_bar;
 331     uint8_t status;
 332     uint8_t *buf;
 333     uint8_t *cmpbuf;
 334     size_t len = 512;
 335     uintptr_t guest_buf;
 336     PrdtEntry prdt[1];
 337
 338     qts = test_bmdma_setup();
 339
 340     guest_buf  = guest_alloc(&guest_malloc, len);
 341     prdt[0].addr = cpu_to_le32(guest_buf);
 342     prdt[0].size = cpu_to_le32(len | PRDT_EOT);
 343
 344     dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
 345
 346     buf = g_malloc(len);
 347     cmpbuf = g_malloc(len);
 348
 349     /* Write 0x55 pattern to sector 0 */
 350     memset(buf, 0x55, len);
 351     qtest_memwrite(qts, guest_buf, buf, len);
 352
 353     status = send_dma_request(qts, CMD_WRITE_DMA, 0, 1, prdt,
 354                               ARRAY_SIZE(prdt), NULL);
 355     g_assert_cmphex(status, ==, BM_STS_INTR);
 356     assert_bit_clear(qpci_io_readb(dev, ide_bar, reg_status), DF | ERR);
 357
 358     /* Write 0xaa pattern to sector 1 */
 359     memset(buf, 0xaa, len);
 360     qtest_memwrite(qts, guest_buf, buf, len);
 361
 362     status = send_dma_request(qts, CMD_WRITE_DMA, 1, 1, prdt,
 363                               ARRAY_SIZE(prdt), NULL);
 364     g_assert_cmphex(status, ==, BM_STS_INTR);
 365     assert_bit_clear(qpci_io_readb(dev, ide_bar, reg_status), DF | ERR);
 366
 367     /* Read and verify 0x55 pattern in sector 0 */
 368     memset(cmpbuf, 0x55, len);
 369
 370     status = send_dma_request(qts, CMD_READ_DMA, 0, 1, prdt, ARRAY_SIZE(prdt),
 371                               NULL);
 372     g_assert_cmphex(status, ==, BM_STS_INTR);
 373     assert_bit_clear(qpci_io_readb(dev, ide_bar, reg_status), DF | ERR);
 374
 375     qtest_memread(qts, guest_buf, buf, len);
 376     g_assert(memcmp(buf, cmpbuf, len) == 0);
 377
 378     /* Read and verify 0xaa pattern in sector 1 */
 379     memset(cmpbuf, 0xaa, len);
 380
 381     status = send_dma_request(qts, CMD_READ_DMA, 1, 1, prdt, ARRAY_SIZE(prdt),
 382                               NULL);
 383     g_assert_cmphex(status, ==, BM_STS_INTR);
 384     assert_bit_clear(qpci_io_readb(dev, ide_bar, reg_status), DF | ERR);
 385
 386     qtest_memread(qts, guest_buf, buf, len);
 387     g_assert(memcmp(buf, cmpbuf, len) == 0);
 388
 389     free_pci_device(dev);
 390     g_free(buf);
 391     g_free(cmpbuf);
 392
 393     test_bmdma_teardown(qts);
 394 }
 395
 396 static void test_bmdma_trim(void)
 397 {
 398     QTestState *qts;
 399     QPCIDevice *dev;
 400     QPCIBar bmdma_bar, ide_bar;
 401     uint8_t status;
 402     const uint64_t trim_range[] = { trim_range_le(0, 2),
 403                                     trim_range_le(6, 8),
 404                                     trim_range_le(10, 1),
 405                                   };
 406     const uint64_t bad_range = trim_range_le(TEST_IMAGE_SIZE / 512 - 1, 2);
 407     size_t len = 512;
 408     uint8_t *buf;
 409     uintptr_t guest_buf;
 410     PrdtEntry prdt[1];
 411
 412     qts = test_bmdma_setup();
 413
 414     guest_buf = guest_alloc(&guest_malloc, len);
 415     prdt[0].addr = cpu_to_le32(guest_buf),
 416     prdt[0].size = cpu_to_le32(len | PRDT_EOT),
 417
 418     dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
 419
 420     buf = g_malloc(len);
 421
 422     /* Normal request */
 423     *((uint64_t *)buf) = trim_range[0];
 424     *((uint64_t *)buf + 1) = trim_range[1];
 425
 426     qtest_memwrite(qts, guest_buf, buf, 2 * sizeof(uint64_t));
 427
 428     status = send_dma_request(qts, CMD_DSM, 0, 1, prdt,
 429                               ARRAY_SIZE(prdt), NULL);
 430     g_assert_cmphex(status, ==, BM_STS_INTR);
 431     assert_bit_clear(qpci_io_readb(dev, ide_bar, reg_status), DF | ERR);
 432
 433     /* Request contains invalid range */
 434     *((uint64_t *)buf) = trim_range[2];
 435     *((uint64_t *)buf + 1) = bad_range;
 436
 437     qtest_memwrite(qts, guest_buf, buf, 2 * sizeof(uint64_t));
 438
 439     status = send_dma_request(qts, CMD_DSM, 0, 1, prdt,
 440                               ARRAY_SIZE(prdt), NULL);
 441     g_assert_cmphex(status, ==, BM_STS_INTR);
 442     assert_bit_set(qpci_io_readb(dev, ide_bar, reg_status), ERR);
 443     assert_bit_set(qpci_io_readb(dev, ide_bar, reg_error), ABRT);
 444
 445     free_pci_device(dev);
 446     g_free(buf);
 447     test_bmdma_teardown(qts);
 448 }
 449
 450 /*
 451  * This test is developed according to the Programming Interface for
 452  * Bus Master IDE Controller (Revision 1.0 5/16/94)
 453  */
 454 static void test_bmdma_various_prdts(void)
 455 {
 456     int sectors = 0;
 457     uint32_t size = 0;
 458
 459     for (sectors = 1; sectors <= 256; sectors *= 2) {
 460         QTestState *qts = NULL;
 461         QPCIDevice *dev = NULL;
 462         QPCIBar bmdma_bar, ide_bar;
 463
 464         qts = test_bmdma_setup();
 465         dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
 466
 467         for (size = 0; size < 65536; size += 256) {
 468             uint32_t req_size = sectors * 512;
 469             uint32_t prd_size = size & 0xfffe; /* bit 0 is always set to 0 */
 470             uint8_t ret = 0;
 471             uint8_t req_status = 0;
 472             uint8_t abort_req_status = 0;
 473             PrdtEntry prdt[] = {
 474                 {
 475                     .addr = 0,
 476                     .size = cpu_to_le32(size | PRDT_EOT),
 477                 },
 478             };
 479
 480             /* A value of zero in PRD size indicates 64K */
 481             if (prd_size == 0) {
 482                 prd_size = 65536;
 483             }
 484
 485             /*
 486              * 1. If PRDs specified a smaller size than the IDE transfer
 487              * size, then the Interrupt and Active bits in the Controller
 488              * status register are not set (Error Condition).
 489              *
 490              * 2. If the size of the physical memory regions was equal to
 491              * the IDE device transfer size, the Interrupt bit in the
 492              * Controller status register is set to 1, Active bit is set to 0.
 493              *
 494              * 3. If PRDs specified a larger size than the IDE transfer size,
 495              * the Interrupt and Active bits in the Controller status register
 496              * are both set to 1.
 497              */
 498             if (prd_size < req_size) {
 499                 req_status = 0;
 500                 abort_req_status = 0;
 501             } else if (prd_size == req_size) {
 502                 req_status = BM_STS_INTR;
 503                 abort_req_status = BM_STS_INTR;
 504             } else {
 505                 req_status = BM_STS_ACTIVE | BM_STS_INTR;
 506                 abort_req_status = BM_STS_INTR;
 507             }
 508
 509             /* Test the request */
 510             ret = send_dma_request(qts, CMD_READ_DMA, 0, sectors,
 511                                    prdt, ARRAY_SIZE(prdt), NULL);
 512             g_assert_cmphex(ret, ==, req_status);
 513             assert_bit_clear(qpci_io_readb(dev, ide_bar, reg_status), DF | ERR);
 514
 515             /* Now test aborting the same request */
 516             ret = send_dma_request(qts, CMD_READ_DMA | CMDF_ABORT, 0,
 517                                    sectors, prdt, ARRAY_SIZE(prdt), NULL);
 518             g_assert_cmphex(ret, ==, abort_req_status);
 519             assert_bit_clear(qpci_io_readb(dev, ide_bar, reg_status), DF | ERR);
 520         }
 521
 522         free_pci_device(dev);
 523         test_bmdma_teardown(qts);
 524     }
 525 }
 526
 527 static void test_bmdma_no_busmaster(void)
 528 {
 529     QTestState *qts;
 530     QPCIDevice *dev;
 531     QPCIBar bmdma_bar, ide_bar;
 532     uint8_t status;
 533
 534     qts = test_bmdma_setup();
 535
 536     dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
 537
 538     /* No PRDT_EOT, each entry addr 0/size 64k, and in theory qemu shouldn't be
 539      * able to access it anyway because the Bus Master bit in the PCI command
 540      * register isn't set. This is complete nonsense, but it used to be pretty
 541      * good at confusing and occasionally crashing qemu. */
 542     PrdtEntry prdt[4096] = { };
 543
 544     status = send_dma_request(qts, CMD_READ_DMA | CMDF_NO_BM, 0, 512,
 545                               prdt, ARRAY_SIZE(prdt), NULL);
 546
 547     /* Not entirely clear what the expected result is, but this is what we get
 548      * in practice. At least we want to be aware of any changes. */
 549     g_assert_cmphex(status, ==, BM_STS_ACTIVE | BM_STS_INTR);
 550     assert_bit_clear(qpci_io_readb(dev, ide_bar, reg_status), DF | ERR);
 551     free_pci_device(dev);
 552     test_bmdma_teardown(qts);
 553 }
 554
 555 static void string_cpu_to_be16(uint16_t *s, size_t bytes)
 556 {
 557     g_assert((bytes & 1) == 0);
 558     bytes /= 2;
 559
 560     while (bytes--) {
 561         *s = cpu_to_be16(*s);
 562         s++;
 563     }
 564 }
 565
 566 static void test_specify(void)
 567 {
 568     QTestState *qts;
 569     QPCIDevice *dev;
 570     QPCIBar bmdma_bar, ide_bar;
 571     uint16_t cyls;
 572     uint8_t heads, spt;
 573
 574     qts = ide_test_start(
 575         "-blockdev driver=file,node-name=hda,filename=%s "
 576         "-device ide-hd,drive=hda,bus=ide.0,unit=0 ",
 577         tmp_path[0]);
 578
 579     dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
 580
 581     /* Initialize drive with zero sectors per track and one head.  */
 582     qpci_io_writeb(dev, ide_bar, reg_nsectors, 0);
 583     qpci_io_writeb(dev, ide_bar, reg_device, 0);
 584     qpci_io_writeb(dev, ide_bar, reg_command, CMD_INIT_DP);
 585
 586     /* READ NATIVE MAX ADDRESS (CHS mode).  */
 587     qpci_io_writeb(dev, ide_bar, reg_device, 0xa0);
 588     qpci_io_writeb(dev, ide_bar, reg_command, CMD_READ_NATIVE);
 589
 590     heads = qpci_io_readb(dev, ide_bar, reg_device) & 0xf;
 591     ++heads;
 592     g_assert_cmpint(heads, ==, 16);
 593
 594     cyls = qpci_io_readb(dev, ide_bar, reg_lba_high) << 8;
 595     cyls |= qpci_io_readb(dev, ide_bar, reg_lba_middle);
 596     ++cyls;
 597     g_assert_cmpint(cyls, ==, 130);
 598
 599     spt = qpci_io_readb(dev, ide_bar, reg_lba_low);
 600     g_assert_cmpint(spt, ==, 63);
 601
 602     ide_test_quit(qts);
 603     free_pci_device(dev);
 604 }
 605
 606 static void test_identify(void)
 607 {
 608     QTestState *qts;
 609     QPCIDevice *dev;
 610     QPCIBar bmdma_bar, ide_bar;
 611     uint8_t data;
 612     uint16_t buf[256];
 613     int i;
 614     int ret;
 615
 616     qts = ide_test_start(
 617         "-drive file=%s,if=ide,cache=writeback,format=raw "
 618         "-global ide-hd.serial=%s -global ide-hd.ver=%s",
 619         tmp_path[0], "testdisk", "version");
 620
 621     dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
 622
 623     /* IDENTIFY command on device 0*/
 624     qpci_io_writeb(dev, ide_bar, reg_device, 0);
 625     qpci_io_writeb(dev, ide_bar, reg_command, CMD_IDENTIFY);
 626
 627     /* Read in the IDENTIFY buffer and check registers */
 628     data = qpci_io_readb(dev, ide_bar, reg_device);
 629     g_assert_cmpint(data & DEV, ==, 0);
 630
 631     for (i = 0; i < 256; i++) {
 632         data = qpci_io_readb(dev, ide_bar, reg_status);
 633         assert_bit_set(data, DRDY | DRQ);
 634         assert_bit_clear(data, BSY | DF | ERR);
 635
 636         buf[i] = qpci_io_readw(dev, ide_bar, reg_data);
 637     }
 638
 639     data = qpci_io_readb(dev, ide_bar, reg_status);
 640     assert_bit_set(data, DRDY);
 641     assert_bit_clear(data, BSY | DF | ERR | DRQ);
 642
 643     /* Check serial number/version in the buffer */
 644     string_cpu_to_be16(&buf[10], 20);
 645     ret = memcmp(&buf[10], "testdisk            ", 20);
 646     g_assert(ret == 0);
 647
 648     string_cpu_to_be16(&buf[23], 8);
 649     ret = memcmp(&buf[23], "version ", 8);
 650     g_assert(ret == 0);
 651
 652     /* Write cache enabled bit */
 653     assert_bit_set(buf[85], 0x20);
 654
 655     ide_test_quit(qts);
 656     free_pci_device(dev);
 657 }
 658
 659 static void test_diagnostic(void)
 660 {
 661     QTestState *qts;
 662     QPCIDevice *dev;
 663     QPCIBar bmdma_bar, ide_bar;
 664     uint8_t data;
 665
 666     qts = ide_test_start(
 667         "-blockdev driver=file,node-name=hda,filename=%s "
 668         "-blockdev driver=file,node-name=hdb,filename=%s "
 669         "-device ide-hd,drive=hda,bus=ide.0,unit=0 "
 670         "-device ide-hd,drive=hdb,bus=ide.0,unit=1 ",
 671         tmp_path[0], tmp_path[1]);
 672
 673     dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
 674
 675     /* DIAGNOSE command on device 1 */
 676     qpci_io_writeb(dev, ide_bar, reg_device, DEV);
 677     data = qpci_io_readb(dev, ide_bar, reg_device);
 678     g_assert_cmphex(data & DEV, ==, DEV);
 679     qpci_io_writeb(dev, ide_bar, reg_command, CMD_DIAGNOSE);
 680
 681     /* Verify that DEVICE is now 0 */
 682     data = qpci_io_readb(dev, ide_bar, reg_device);
 683     g_assert_cmphex(data & DEV, ==, 0);
 684
 685     ide_test_quit(qts);
 686     free_pci_device(dev);
 687 }
 688
 689 /*
 690  * Write sector 1 with random data to make IDE storage dirty
 691  * Needed for flush tests so that flushes actually go though the block layer
 692  */
 693 static void make_dirty(QTestState *qts, uint8_t device)
 694 {
 695     QPCIDevice *dev;
 696     QPCIBar bmdma_bar, ide_bar;
 697     uint8_t status;
 698     size_t len = 512;
 699     uintptr_t guest_buf;
 700     void* buf;
 701
 702     dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
 703
 704     guest_buf = guest_alloc(&guest_malloc, len);
 705     buf = g_malloc(len);
 706     memset(buf, rand() % 255 + 1, len);
 707     g_assert(guest_buf);
 708     g_assert(buf);
 709
 710     qtest_memwrite(qts, guest_buf, buf, len);
 711
 712     PrdtEntry prdt[] = {
 713         {
 714             .addr = cpu_to_le32(guest_buf),
 715             .size = cpu_to_le32(len | PRDT_EOT),
 716         },
 717     };
 718
 719     status = send_dma_request(qts, CMD_WRITE_DMA, 1, 1, prdt,
 720                               ARRAY_SIZE(prdt), NULL);
 721     g_assert_cmphex(status, ==, BM_STS_INTR);
 722     assert_bit_clear(qpci_io_readb(dev, ide_bar, reg_status), DF | ERR);
 723
 724     g_free(buf);
 725     free_pci_device(dev);
 726 }
 727
 728 static void test_flush(void)
 729 {
 730     QTestState *qts;
 731     QPCIDevice *dev;
 732     QPCIBar bmdma_bar, ide_bar;
 733     uint8_t data;
 734
 735     qts = ide_test_start(
 736         "-drive file=blkdebug::%s,if=ide,cache=writeback,format=raw",
 737         tmp_path[0]);
 738
 739     dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
 740
 741     qtest_irq_intercept_in(qts, "ioapic");
 742
 743     /* Dirty media so that CMD_FLUSH_CACHE will actually go to disk */
 744     make_dirty(qts, 0);
 745
 746     /* Delay the completion of the flush request until we explicitly do it */
 747     g_free(qtest_hmp(qts, "qemu-io ide0-hd0 \"break flush_to_os A\""));
 748
 749     /* FLUSH CACHE command on device 0*/
 750     qpci_io_writeb(dev, ide_bar, reg_device, 0);
 751     qpci_io_writeb(dev, ide_bar, reg_command, CMD_FLUSH_CACHE);
 752
 753     /* Check status while request is in flight*/
 754     data = qpci_io_readb(dev, ide_bar, reg_status);
 755     assert_bit_set(data, BSY | DRDY);
 756     assert_bit_clear(data, DF | ERR | DRQ);
 757
 758     /* Complete the command */
 759     g_free(qtest_hmp(qts, "qemu-io ide0-hd0 \"resume A\""));
 760
 761     /* Check registers */
 762     data = qpci_io_readb(dev, ide_bar, reg_device);
 763     g_assert_cmpint(data & DEV, ==, 0);
 764
 765     do {
 766         data = qpci_io_readb(dev, ide_bar, reg_status);
 767     } while (data & BSY);
 768
 769     assert_bit_set(data, DRDY);
 770     assert_bit_clear(data, BSY | DF | ERR | DRQ);
 771
 772     ide_test_quit(qts);
 773     free_pci_device(dev);
 774 }
 775
 776 static void test_pci_retry_flush(void)
 777 {
 778     QTestState *qts;
 779     QPCIDevice *dev;
 780     QPCIBar bmdma_bar, ide_bar;
 781     uint8_t data;
 782
 783     prepare_blkdebug_script(debug_path, "flush_to_disk");
 784
 785     qts = ide_test_start(
 786         "-drive file=blkdebug:%s:%s,if=ide,cache=writeback,format=raw,"
 787         "rerror=stop,werror=stop",
 788         debug_path, tmp_path[0]);
 789
 790     dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
 791
 792     qtest_irq_intercept_in(qts, "ioapic");
 793
 794     /* Dirty media so that CMD_FLUSH_CACHE will actually go to disk */
 795     make_dirty(qts, 0);
 796
 797     /* FLUSH CACHE command on device 0*/
 798     qpci_io_writeb(dev, ide_bar, reg_device, 0);
 799     qpci_io_writeb(dev, ide_bar, reg_command, CMD_FLUSH_CACHE);
 800
 801     /* Check status while request is in flight*/
 802     data = qpci_io_readb(dev, ide_bar, reg_status);
 803     assert_bit_set(data, BSY | DRDY);
 804     assert_bit_clear(data, DF | ERR | DRQ);
 805
 806     qtest_qmp_eventwait(qts, "STOP");
 807
 808     /* Complete the command */
 809     qtest_qmp_assert_success(qts, "{'execute':'cont' }");
 810
 811     /* Check registers */
 812     data = qpci_io_readb(dev, ide_bar, reg_device);
 813     g_assert_cmpint(data & DEV, ==, 0);
 814
 815     do {
 816         data = qpci_io_readb(dev, ide_bar, reg_status);
 817     } while (data & BSY);
 818
 819     assert_bit_set(data, DRDY);
 820     assert_bit_clear(data, BSY | DF | ERR | DRQ);
 821
 822     ide_test_quit(qts);
 823     free_pci_device(dev);
 824 }
 825
 826 static void test_flush_nodev(void)
 827 {
 828     QTestState *qts;
 829     QPCIDevice *dev;
 830     QPCIBar bmdma_bar, ide_bar;
 831
 832     qts = ide_test_start("%s", "");
 833
 834     dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
 835
 836     /* FLUSH CACHE command on device 0*/
 837     qpci_io_writeb(dev, ide_bar, reg_device, 0);
 838     qpci_io_writeb(dev, ide_bar, reg_command, CMD_FLUSH_CACHE);
 839
 840     /* Just testing that qemu doesn't crash... */
 841
 842     free_pci_device(dev);
 843     ide_test_quit(qts);
 844 }
 845
 846 static void test_flush_empty_drive(void)
 847 {
 848     QTestState *qts;
 849     QPCIDevice *dev;
 850     QPCIBar bmdma_bar, ide_bar;
 851
 852     qts = ide_test_start("-device ide-cd,bus=ide.0");
 853     dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
 854
 855     /* FLUSH CACHE command on device 0 */
 856     qpci_io_writeb(dev, ide_bar, reg_device, 0);
 857     qpci_io_writeb(dev, ide_bar, reg_command, CMD_FLUSH_CACHE);
 858
 859     /* Just testing that qemu doesn't crash... */
 860
 861     free_pci_device(dev);
 862     ide_test_quit(qts);
 863 }
 864
 865 typedef struct Read10CDB {
 866     uint8_t opcode;
 867     uint8_t flags;
 868     uint32_t lba;
 869     uint8_t reserved;
 870     uint16_t nblocks;
 871     uint8_t control;
 872     uint16_t padding;
 873 } __attribute__((__packed__)) Read10CDB;
 874
 875 static void send_scsi_cdb_read10(QPCIDevice *dev, QPCIBar ide_bar,
 876                                  uint64_t lba, int nblocks)
 877 {
 878     Read10CDB pkt = { .padding = 0 };
 879     int i;
 880
 881     g_assert_cmpint(lba, <=, UINT32_MAX);
 882     g_assert_cmpint(nblocks, <=, UINT16_MAX);
 883     g_assert_cmpint(nblocks, >=, 0);
 884
 885     /* Construct SCSI CDB packet */
 886     pkt.opcode = 0x28;
 887     pkt.lba = cpu_to_be32(lba);
 888     pkt.nblocks = cpu_to_be16(nblocks);
 889
 890     /* Send Packet */
 891     for (i = 0; i < sizeof(Read10CDB)/2; i++) {
 892         qpci_io_writew(dev, ide_bar, reg_data,
 893                        le16_to_cpu(((uint16_t *)&pkt)[i]));
 894     }
 895 }
 896
 897 static void nsleep(QTestState *qts, int64_t nsecs)
 898 {
 899     const struct timespec val = { .tv_nsec = nsecs };
 900     nanosleep(&val, NULL);
 901     qtest_clock_set(qts, nsecs);
 902 }
 903
 904 static uint8_t ide_wait_clear(QTestState *qts, uint8_t flag)
 905 {
 906     QPCIDevice *dev;
 907     QPCIBar bmdma_bar, ide_bar;
 908     uint8_t data;
 909     time_t st;
 910
 911     dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
 912
 913     /* Wait with a 5 second timeout */
 914     time(&st);
 915     while (true) {
 916         data = qpci_io_readb(dev, ide_bar, reg_status);
 917         if (!(data & flag)) {
 918             free_pci_device(dev);
 919             return data;
 920         }
 921         if (difftime(time(NULL), st) > 5.0) {
 922             break;
 923         }
 924         nsleep(qts, 400);
 925     }
 926     g_assert_not_reached();
 927 }
 928
 929 static void ide_wait_intr(QTestState *qts, int irq)
 930 {
 931     time_t st;
 932     bool intr;
 933
 934     time(&st);
 935     while (true) {
 936         intr = qtest_get_irq(qts, irq);
 937         if (intr) {
 938             return;
 939         }
 940         if (difftime(time(NULL), st) > 5.0) {
 941             break;
 942         }
 943         nsleep(qts, 400);
 944     }
 945
 946     g_assert_not_reached();
 947 }
 948
 949 static void cdrom_pio_impl(int nblocks)
 950 {
 951     QTestState *qts;
 952     QPCIDevice *dev;
 953     QPCIBar bmdma_bar, ide_bar;
 954     FILE *fh;
 955     int patt_blocks = MAX(16, nblocks);
 956     size_t patt_len = ATAPI_BLOCK_SIZE * patt_blocks;
 957     char *pattern = g_malloc(patt_len);
 958     size_t rxsize = ATAPI_BLOCK_SIZE * nblocks;
 959     uint16_t *rx = g_malloc0(rxsize);
 960     int i, j;
 961     uint8_t data;
 962     uint16_t limit;
 963     size_t ret;
 964
 965     /* Prepopulate the CDROM with an interesting pattern */
 966     generate_pattern(pattern, patt_len, ATAPI_BLOCK_SIZE);
 967     fh = fopen(tmp_path[0], "wb+");
 968     ret = fwrite(pattern, ATAPI_BLOCK_SIZE, patt_blocks, fh);
 969     g_assert_cmpint(ret, ==, patt_blocks);
 970     fclose(fh);
 971
 972     qts = ide_test_start(
 973             "-drive if=none,file=%s,media=cdrom,format=raw,id=sr0,index=0 "
 974             "-device ide-cd,drive=sr0,bus=ide.0", tmp_path[0]);
 975     dev = get_pci_device(qts, &bmdma_bar, &ide_bar);
 976     qtest_irq_intercept_in(qts, "ioapic");
 977
 978     /* PACKET command on device 0 */
 979     qpci_io_writeb(dev, ide_bar, reg_device, 0);
 980     qpci_io_writeb(dev, ide_bar, reg_lba_middle, BYTE_COUNT_LIMIT & 0xFF);
 981     qpci_io_writeb(dev, ide_bar, reg_lba_high, (BYTE_COUNT_LIMIT >> 8 & 0xFF));
 982     qpci_io_writeb(dev, ide_bar, reg_command, CMD_PACKET);
 983     /* HP0: Check_Status_A State */
 984     nsleep(qts, 400);
 985     data = ide_wait_clear(qts, BSY);
 986     /* HP1: Send_Packet State */
 987     assert_bit_set(data, DRQ | DRDY);
 988     assert_bit_clear(data, ERR | DF | BSY);
 989
 990     /* SCSI CDB (READ10) -- read n*2048 bytes from block 0 */
 991     send_scsi_cdb_read10(dev, ide_bar, 0, nblocks);
 992
 993     /* Read data back: occurs in bursts of 'BYTE_COUNT_LIMIT' bytes.
 994      * If BYTE_COUNT_LIMIT is odd, we transfer BYTE_COUNT_LIMIT - 1 bytes.
 995      * We allow an odd limit only when the remaining transfer size is
 996      * less than BYTE_COUNT_LIMIT. However, SCSI's read10 command can only
 997      * request n blocks, so our request size is always even.
 998      * For this reason, we assume there is never a hanging byte to fetch. */
 999     g_assert(!(rxsize & 1));
1000     limit = BYTE_COUNT_LIMIT & ~1;
1001     for (i = 0; i < DIV_ROUND_UP(rxsize, limit); i++) {
1002         size_t offset = i * (limit / 2);
1003         size_t rem = (rxsize / 2) - offset;
1004
1005         /* HP3: INTRQ_Wait */
1006         ide_wait_intr(qts, IDE_PRIMARY_IRQ);
1007
1008         /* HP2: Check_Status_B (and clear IRQ) */
1009         data = ide_wait_clear(qts, BSY);
1010         assert_bit_set(data, DRQ | DRDY);
1011         assert_bit_clear(data, ERR | DF | BSY);
1012
1013         /* HP4: Transfer_Data */
1014         for (j = 0; j < MIN((limit / 2), rem); j++) {
1015             rx[offset + j] = cpu_to_le16(qpci_io_readw(dev, ide_bar,
1016                                                        reg_data));
1017         }
1018     }
1019
1020     /* Check for final completion IRQ */
1021     ide_wait_intr(qts, IDE_PRIMARY_IRQ);
1022
1023     /* Sanity check final state */
1024     data = ide_wait_clear(qts, DRQ);
1025     assert_bit_set(data, DRDY);
1026     assert_bit_clear(data, DRQ | ERR | DF | BSY);
1027
1028     g_assert_cmpint(memcmp(pattern, rx, rxsize), ==, 0);
1029     g_free(pattern);
1030     g_free(rx);
1031     test_bmdma_teardown(qts);
1032     free_pci_device(dev);
1033 }
1034
1035 static void test_cdrom_pio(void)
1036 {
1037     cdrom_pio_impl(1);
1038 }
1039
1040 static void test_cdrom_pio_large(void)
1041 {
1042     /* Test a few loops of the PIO DRQ mechanism. */
1043     cdrom_pio_impl(BYTE_COUNT_LIMIT * 4 / ATAPI_BLOCK_SIZE);
1044 }
1045
1046
1047 static void test_cdrom_dma(void)
1048 {
1049     QTestState *qts;
1050     static const size_t len = ATAPI_BLOCK_SIZE;
1051     size_t ret;
1052     char *pattern = g_malloc(ATAPI_BLOCK_SIZE * 16);
1053     char *rx = g_malloc0(len);
1054     uintptr_t guest_buf;
1055     PrdtEntry prdt[1];
1056     FILE *fh;
1057
1058     qts = ide_test_start(
1059             "-drive if=none,file=%s,media=cdrom,format=raw,id=sr0,index=0 "
1060             "-device ide-cd,drive=sr0,bus=ide.0", tmp_path[0]);
1061     qtest_irq_intercept_in(qts, "ioapic");
1062
1063     guest_buf = guest_alloc(&guest_malloc, len);
1064     prdt[0].addr = cpu_to_le32(guest_buf);
1065     prdt[0].size = cpu_to_le32(len | PRDT_EOT);
1066
1067     generate_pattern(pattern, ATAPI_BLOCK_SIZE * 16, ATAPI_BLOCK_SIZE);
1068     fh = fopen(tmp_path[0], "wb+");
1069     ret = fwrite(pattern, ATAPI_BLOCK_SIZE, 16, fh);
1070     g_assert_cmpint(ret, ==, 16);
1071     fclose(fh);
1072
1073     send_dma_request(qts, CMD_PACKET, 0, 1, prdt, 1, send_scsi_cdb_read10);
1074
1075     /* Read back data from guest memory into local qtest memory */
1076     qtest_memread(qts, guest_buf, rx, len);
1077     g_assert_cmpint(memcmp(pattern, rx, len), ==, 0);
1078
1079     g_free(pattern);
1080     g_free(rx);
1081     test_bmdma_teardown(qts);
1082 }
1083
1084 int main(int argc, char **argv)
1085 {
1086     const char *base;
1087     int i;
1088     int fd;
1089     int ret;
1090
1091     /*
1092      * "base" stores the starting point where we create temporary files.
1093      *
1094      * On Windows, this is set to the relative path of current working
1095      * directory, because the absolute path causes the blkdebug filename
1096      * parser fail to parse "blkdebug:path/to/config:path/to/image".
1097      */
1098 #ifndef _WIN32
1099     base = g_get_tmp_dir();
1100 #else
1101     base = ".";
1102 #endif
1103
1104     /* Create temporary blkdebug instructions */
1105     debug_path = g_strdup_printf("%s/qtest-blkdebug.XXXXXX", base);
1106     fd = g_mkstemp(debug_path);
1107     g_assert(fd >= 0);
1108     close(fd);
1109
1110     /* Create a temporary raw image */
1111     for (i = 0; i < 2; ++i) {
1112         tmp_path[i] = g_strdup_printf("%s/qtest.XXXXXX", base);
1113         fd = g_mkstemp(tmp_path[i]);
1114         g_assert(fd >= 0);
1115         ret = ftruncate(fd, TEST_IMAGE_SIZE);
1116         g_assert(ret == 0);
1117         close(fd);
1118     }
1119
1120     /* Run the tests */
1121     g_test_init(&argc, &argv, NULL);
1122
1123     qtest_add_func("/ide/read_native", test_specify);
1124
1125     qtest_add_func("/ide/identify", test_identify);
1126
1127     qtest_add_func("/ide/diagnostic", test_diagnostic);
1128
1129     qtest_add_func("/ide/bmdma/simple_rw", test_bmdma_simple_rw);
1130     qtest_add_func("/ide/bmdma/trim", test_bmdma_trim);
1131     qtest_add_func("/ide/bmdma/various_prdts", test_bmdma_various_prdts);
1132     qtest_add_func("/ide/bmdma/no_busmaster", test_bmdma_no_busmaster);
1133
1134     qtest_add_func("/ide/flush", test_flush);
1135     qtest_add_func("/ide/flush/nodev", test_flush_nodev);
1136     qtest_add_func("/ide/flush/empty_drive", test_flush_empty_drive);
1137     qtest_add_func("/ide/flush/retry_pci", test_pci_retry_flush);
1138
1139     qtest_add_func("/ide/cdrom/pio", test_cdrom_pio);
1140     qtest_add_func("/ide/cdrom/pio_large", test_cdrom_pio_large);
1141     qtest_add_func("/ide/cdrom/dma", test_cdrom_dma);
1142
1143     ret = g_test_run();
1144
1145     /* Cleanup */
1146     for (i = 0; i < 2; ++i) {
1147         unlink(tmp_path[i]);
1148         g_free(tmp_path[i]);
1149     }
1150     unlink(debug_path);
1151     g_free(debug_path);
1152
1153     return ret;
1154 }