tests/qtest/fdc-test.c

   1 /*
   2  * Floppy test cases.
   3  *
   4  * Copyright (c) 2012 Kevin Wolf <kwolf@redhat.com>
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26
  27
  28 #include "libqtest-single.h"
  29 #include "qapi/qmp/qdict.h"
  30 #include "qemu-common.h"
  31
  32 /* TODO actually test the results and get rid of this */
  33 #define qmp_discard_response(...) qobject_unref(qmp(__VA_ARGS__))
  34
  35 #define DRIVE_FLOPPY_BLANK \
  36     "-drive if=floppy,file=null-co://,file.read-zeroes=on,format=raw,size=1440k"
  37
  38 #define TEST_IMAGE_SIZE 1440 * 1024
  39
  40 #define FLOPPY_BASE 0x3f0
  41 #define FLOPPY_IRQ 6
  42
  43 enum {
  44     reg_sra         = 0x0,
  45     reg_srb         = 0x1,
  46     reg_dor         = 0x2,
  47     reg_msr         = 0x4,
  48     reg_dsr         = 0x4,
  49     reg_fifo        = 0x5,
  50     reg_dir         = 0x7,
  51 };
  52
  53 enum {
  54     CMD_SENSE_INT           = 0x08,
  55     CMD_READ_ID             = 0x0a,
  56     CMD_SEEK                = 0x0f,
  57     CMD_VERIFY              = 0x16,
  58     CMD_READ                = 0xe6,
  59     CMD_RELATIVE_SEEK_OUT   = 0x8f,
  60     CMD_RELATIVE_SEEK_IN    = 0xcf,
  61 };
  62
  63 enum {
  64     BUSY    = 0x10,
  65     NONDMA  = 0x20,
  66     RQM     = 0x80,
  67     DIO     = 0x40,
  68
  69     DSKCHG  = 0x80,
  70 };
  71
  72 static char test_image[] = "/tmp/qtest.XXXXXX";
  73
  74 #define assert_bit_set(data, mask) g_assert_cmphex((data) & (mask), ==, (mask))
  75 #define assert_bit_clear(data, mask) g_assert_cmphex((data) & (mask), ==, 0)
  76
  77 static uint8_t base = 0x70;
  78
  79 enum {
  80     CMOS_FLOPPY     = 0x10,
  81 };
  82
  83 static void floppy_send(uint8_t byte)
  84 {
  85     uint8_t msr;
  86
  87     msr = inb(FLOPPY_BASE + reg_msr);
  88     assert_bit_set(msr, RQM);
  89     assert_bit_clear(msr, DIO);
  90
  91     outb(FLOPPY_BASE + reg_fifo, byte);
  92 }
  93
  94 static uint8_t floppy_recv(void)
  95 {
  96     uint8_t msr;
  97
  98     msr = inb(FLOPPY_BASE + reg_msr);
  99     assert_bit_set(msr, RQM | DIO);
 100
 101     return inb(FLOPPY_BASE + reg_fifo);
 102 }
 103
 104 /* pcn: Present Cylinder Number */
 105 static void ack_irq(uint8_t *pcn)
 106 {
 107     uint8_t ret;
 108
 109     g_assert(get_irq(FLOPPY_IRQ));
 110     floppy_send(CMD_SENSE_INT);
 111     floppy_recv();
 112
 113     ret = floppy_recv();
 114     if (pcn != NULL) {
 115         *pcn = ret;
 116     }
 117
 118     g_assert(!get_irq(FLOPPY_IRQ));
 119 }
 120
 121 static uint8_t send_read_command(uint8_t cmd)
 122 {
 123     uint8_t drive = 0;
 124     uint8_t head = 0;
 125     uint8_t cyl = 0;
 126     uint8_t sect_addr = 1;
 127     uint8_t sect_size = 2;
 128     uint8_t eot = 1;
 129     uint8_t gap = 0x1b;
 130     uint8_t gpl = 0xff;
 131
 132     uint8_t msr = 0;
 133     uint8_t st0;
 134
 135     uint8_t ret = 0;
 136
 137     floppy_send(cmd);
 138     floppy_send(head << 2 | drive);
 139     g_assert(!get_irq(FLOPPY_IRQ));
 140     floppy_send(cyl);
 141     floppy_send(head);
 142     floppy_send(sect_addr);
 143     floppy_send(sect_size);
 144     floppy_send(eot);
 145     floppy_send(gap);
 146     floppy_send(gpl);
 147
 148     uint8_t i = 0;
 149     uint8_t n = 2;
 150     for (; i < n; i++) {
 151         msr = inb(FLOPPY_BASE + reg_msr);
 152         if (msr == 0xd0) {
 153             break;
 154         }
 155         sleep(1);
 156     }
 157
 158     if (i >= n) {
 159         return 1;
 160     }
 161
 162     st0 = floppy_recv();
 163     if (st0 != 0x40) {
 164         ret = 1;
 165     }
 166
 167     floppy_recv();
 168     floppy_recv();
 169     floppy_recv();
 170     floppy_recv();
 171     floppy_recv();
 172     floppy_recv();
 173
 174     return ret;
 175 }
 176
 177 static uint8_t send_read_no_dma_command(int nb_sect, uint8_t expected_st0)
 178 {
 179     uint8_t drive = 0;
 180     uint8_t head = 0;
 181     uint8_t cyl = 0;
 182     uint8_t sect_addr = 1;
 183     uint8_t sect_size = 2;
 184     uint8_t eot = nb_sect;
 185     uint8_t gap = 0x1b;
 186     uint8_t gpl = 0xff;
 187
 188     uint8_t msr = 0;
 189     uint8_t st0;
 190
 191     uint8_t ret = 0;
 192
 193     floppy_send(CMD_READ);
 194     floppy_send(head << 2 | drive);
 195     g_assert(!get_irq(FLOPPY_IRQ));
 196     floppy_send(cyl);
 197     floppy_send(head);
 198     floppy_send(sect_addr);
 199     floppy_send(sect_size);
 200     floppy_send(eot);
 201     floppy_send(gap);
 202     floppy_send(gpl);
 203
 204     uint16_t i = 0;
 205     uint8_t n = 2;
 206     for (; i < n; i++) {
 207         msr = inb(FLOPPY_BASE + reg_msr);
 208         if (msr == (BUSY | NONDMA | DIO | RQM)) {
 209             break;
 210         }
 211         sleep(1);
 212     }
 213
 214     if (i >= n) {
 215         return 1;
 216     }
 217
 218     /* Non-DMA mode */
 219     for (i = 0; i < 512 * 2 * nb_sect; i++) {
 220         msr = inb(FLOPPY_BASE + reg_msr);
 221         assert_bit_set(msr, BUSY | RQM | DIO);
 222         inb(FLOPPY_BASE + reg_fifo);
 223     }
 224
 225     msr = inb(FLOPPY_BASE + reg_msr);
 226     assert_bit_set(msr, BUSY | RQM | DIO);
 227     g_assert(get_irq(FLOPPY_IRQ));
 228
 229     st0 = floppy_recv();
 230     if (st0 != expected_st0) {
 231         ret = 1;
 232     }
 233
 234     floppy_recv();
 235     floppy_recv();
 236     floppy_recv();
 237     floppy_recv();
 238     floppy_recv();
 239     g_assert(get_irq(FLOPPY_IRQ));
 240     floppy_recv();
 241
 242     /* Check that we're back in command phase */
 243     msr = inb(FLOPPY_BASE + reg_msr);
 244     assert_bit_clear(msr, BUSY | DIO);
 245     assert_bit_set(msr, RQM);
 246     g_assert(!get_irq(FLOPPY_IRQ));
 247
 248     return ret;
 249 }
 250
 251 static void send_seek(int cyl)
 252 {
 253     int drive = 0;
 254     int head = 0;
 255
 256     floppy_send(CMD_SEEK);
 257     floppy_send(head << 2 | drive);
 258     g_assert(!get_irq(FLOPPY_IRQ));
 259     floppy_send(cyl);
 260     ack_irq(NULL);
 261 }
 262
 263 static uint8_t cmos_read(uint8_t reg)
 264 {
 265     outb(base + 0, reg);
 266     return inb(base + 1);
 267 }
 268
 269 static void test_cmos(void)
 270 {
 271     uint8_t cmos;
 272
 273     cmos = cmos_read(CMOS_FLOPPY);
 274     g_assert(cmos == 0x40 || cmos == 0x50);
 275 }
 276
 277 static void test_no_media_on_start(void)
 278 {
 279     uint8_t dir;
 280
 281     /* Media changed bit must be set all time after start if there is
 282      * no media in drive. */
 283     dir = inb(FLOPPY_BASE + reg_dir);
 284     assert_bit_set(dir, DSKCHG);
 285     dir = inb(FLOPPY_BASE + reg_dir);
 286     assert_bit_set(dir, DSKCHG);
 287     send_seek(1);
 288     dir = inb(FLOPPY_BASE + reg_dir);
 289     assert_bit_set(dir, DSKCHG);
 290     dir = inb(FLOPPY_BASE + reg_dir);
 291     assert_bit_set(dir, DSKCHG);
 292 }
 293
 294 static void test_read_without_media(void)
 295 {
 296     uint8_t ret;
 297
 298     ret = send_read_command(CMD_READ);
 299     g_assert(ret == 0);
 300 }
 301
 302 static void test_media_insert(void)
 303 {
 304     uint8_t dir;
 305
 306     /* Insert media in drive. DSKCHK should not be reset until a step pulse
 307      * is sent. */
 308     qmp_discard_response("{'execute':'blockdev-change-medium', 'arguments':{"
 309                          " 'id':'floppy0', 'filename': %s, 'format': 'raw' }}",
 310                          test_image);
 311
 312     dir = inb(FLOPPY_BASE + reg_dir);
 313     assert_bit_set(dir, DSKCHG);
 314     dir = inb(FLOPPY_BASE + reg_dir);
 315     assert_bit_set(dir, DSKCHG);
 316
 317     send_seek(0);
 318     dir = inb(FLOPPY_BASE + reg_dir);
 319     assert_bit_set(dir, DSKCHG);
 320     dir = inb(FLOPPY_BASE + reg_dir);
 321     assert_bit_set(dir, DSKCHG);
 322
 323     /* Step to next track should clear DSKCHG bit. */
 324     send_seek(1);
 325     dir = inb(FLOPPY_BASE + reg_dir);
 326     assert_bit_clear(dir, DSKCHG);
 327     dir = inb(FLOPPY_BASE + reg_dir);
 328     assert_bit_clear(dir, DSKCHG);
 329 }
 330
 331 static void test_media_change(void)
 332 {
 333     uint8_t dir;
 334
 335     test_media_insert();
 336
 337     /* Eject the floppy and check that DSKCHG is set. Reading it out doesn't
 338      * reset the bit. */
 339     qmp_discard_response("{'execute':'eject', 'arguments':{"
 340                          " 'id':'floppy0' }}");
 341
 342     dir = inb(FLOPPY_BASE + reg_dir);
 343     assert_bit_set(dir, DSKCHG);
 344     dir = inb(FLOPPY_BASE + reg_dir);
 345     assert_bit_set(dir, DSKCHG);
 346
 347     send_seek(0);
 348     dir = inb(FLOPPY_BASE + reg_dir);
 349     assert_bit_set(dir, DSKCHG);
 350     dir = inb(FLOPPY_BASE + reg_dir);
 351     assert_bit_set(dir, DSKCHG);
 352
 353     send_seek(1);
 354     dir = inb(FLOPPY_BASE + reg_dir);
 355     assert_bit_set(dir, DSKCHG);
 356     dir = inb(FLOPPY_BASE + reg_dir);
 357     assert_bit_set(dir, DSKCHG);
 358 }
 359
 360 static void test_sense_interrupt(void)
 361 {
 362     int drive = 0;
 363     int head = 0;
 364     int cyl = 0;
 365     int ret = 0;
 366
 367     floppy_send(CMD_SENSE_INT);
 368     ret = floppy_recv();
 369     g_assert(ret == 0x80);
 370
 371     floppy_send(CMD_SEEK);
 372     floppy_send(head << 2 | drive);
 373     g_assert(!get_irq(FLOPPY_IRQ));
 374     floppy_send(cyl);
 375
 376     floppy_send(CMD_SENSE_INT);
 377     ret = floppy_recv();
 378     g_assert(ret == 0x20);
 379     floppy_recv();
 380 }
 381
 382 static void test_relative_seek(void)
 383 {
 384     uint8_t drive = 0;
 385     uint8_t head = 0;
 386     uint8_t cyl = 1;
 387     uint8_t pcn;
 388
 389     /* Send seek to track 0 */
 390     send_seek(0);
 391
 392     /* Send relative seek to increase track by 1 */
 393     floppy_send(CMD_RELATIVE_SEEK_IN);
 394     floppy_send(head << 2 | drive);
 395     g_assert(!get_irq(FLOPPY_IRQ));
 396     floppy_send(cyl);
 397
 398     ack_irq(&pcn);
 399     g_assert(pcn == 1);
 400
 401     /* Send relative seek to decrease track by 1 */
 402     floppy_send(CMD_RELATIVE_SEEK_OUT);
 403     floppy_send(head << 2 | drive);
 404     g_assert(!get_irq(FLOPPY_IRQ));
 405     floppy_send(cyl);
 406
 407     ack_irq(&pcn);
 408     g_assert(pcn == 0);
 409 }
 410
 411 static void test_read_id(void)
 412 {
 413     uint8_t drive = 0;
 414     uint8_t head = 0;
 415     uint8_t cyl;
 416     uint8_t st0;
 417     uint8_t msr;
 418
 419     /* Seek to track 0 and check with READ ID */
 420     send_seek(0);
 421
 422     floppy_send(CMD_READ_ID);
 423     g_assert(!get_irq(FLOPPY_IRQ));
 424     floppy_send(head << 2 | drive);
 425
 426     msr = inb(FLOPPY_BASE + reg_msr);
 427     if (!get_irq(FLOPPY_IRQ)) {
 428         assert_bit_set(msr, BUSY);
 429         assert_bit_clear(msr, RQM);
 430     }
 431
 432     while (!get_irq(FLOPPY_IRQ)) {
 433         /* qemu involves a timer with READ ID... */
 434         clock_step(1000000000LL / 50);
 435     }
 436
 437     msr = inb(FLOPPY_BASE + reg_msr);
 438     assert_bit_set(msr, BUSY | RQM | DIO);
 439
 440     st0 = floppy_recv();
 441     floppy_recv();
 442     floppy_recv();
 443     cyl = floppy_recv();
 444     head = floppy_recv();
 445     floppy_recv();
 446     g_assert(get_irq(FLOPPY_IRQ));
 447     floppy_recv();
 448     g_assert(!get_irq(FLOPPY_IRQ));
 449
 450     g_assert_cmpint(cyl, ==, 0);
 451     g_assert_cmpint(head, ==, 0);
 452     g_assert_cmpint(st0, ==, head << 2);
 453
 454     /* Seek to track 8 on head 1 and check with READ ID */
 455     head = 1;
 456     cyl = 8;
 457
 458     floppy_send(CMD_SEEK);
 459     floppy_send(head << 2 | drive);
 460     g_assert(!get_irq(FLOPPY_IRQ));
 461     floppy_send(cyl);
 462     g_assert(get_irq(FLOPPY_IRQ));
 463     ack_irq(NULL);
 464
 465     floppy_send(CMD_READ_ID);
 466     g_assert(!get_irq(FLOPPY_IRQ));
 467     floppy_send(head << 2 | drive);
 468
 469     msr = inb(FLOPPY_BASE + reg_msr);
 470     if (!get_irq(FLOPPY_IRQ)) {
 471         assert_bit_set(msr, BUSY);
 472         assert_bit_clear(msr, RQM);
 473     }
 474
 475     while (!get_irq(FLOPPY_IRQ)) {
 476         /* qemu involves a timer with READ ID... */
 477         clock_step(1000000000LL / 50);
 478     }
 479
 480     msr = inb(FLOPPY_BASE + reg_msr);
 481     assert_bit_set(msr, BUSY | RQM | DIO);
 482
 483     st0 = floppy_recv();
 484     floppy_recv();
 485     floppy_recv();
 486     cyl = floppy_recv();
 487     head = floppy_recv();
 488     floppy_recv();
 489     g_assert(get_irq(FLOPPY_IRQ));
 490     floppy_recv();
 491     g_assert(!get_irq(FLOPPY_IRQ));
 492
 493     g_assert_cmpint(cyl, ==, 8);
 494     g_assert_cmpint(head, ==, 1);
 495     g_assert_cmpint(st0, ==, head << 2);
 496 }
 497
 498 static void test_read_no_dma_1(void)
 499 {
 500     uint8_t ret;
 501
 502     outb(FLOPPY_BASE + reg_dor, inb(FLOPPY_BASE + reg_dor) & ~0x08);
 503     send_seek(0);
 504     ret = send_read_no_dma_command(1, 0x04);
 505     g_assert(ret == 0);
 506 }
 507
 508 static void test_read_no_dma_18(void)
 509 {
 510     uint8_t ret;
 511
 512     outb(FLOPPY_BASE + reg_dor, inb(FLOPPY_BASE + reg_dor) & ~0x08);
 513     send_seek(0);
 514     ret = send_read_no_dma_command(18, 0x04);
 515     g_assert(ret == 0);
 516 }
 517
 518 static void test_read_no_dma_19(void)
 519 {
 520     uint8_t ret;
 521
 522     outb(FLOPPY_BASE + reg_dor, inb(FLOPPY_BASE + reg_dor) & ~0x08);
 523     send_seek(0);
 524     ret = send_read_no_dma_command(19, 0x20);
 525     g_assert(ret == 0);
 526 }
 527
 528 static void test_verify(void)
 529 {
 530     uint8_t ret;
 531
 532     ret = send_read_command(CMD_VERIFY);
 533     g_assert(ret == 0);
 534 }
 535
 536 /* success if no crash or abort */
 537 static void fuzz_registers(void)
 538 {
 539     unsigned int i;
 540
 541     for (i = 0; i < 1000; i++) {
 542         uint8_t reg, val;
 543
 544         reg = (uint8_t)g_test_rand_int_range(0, 8);
 545         val = (uint8_t)g_test_rand_int_range(0, 256);
 546
 547         outb(FLOPPY_BASE + reg, val);
 548         inb(FLOPPY_BASE + reg);
 549     }
 550 }
 551
 552 static bool qtest_check_clang_sanitizer(void)
 553 {
 554 #if defined(__SANITIZE_ADDRESS__) || __has_feature(address_sanitizer)
 555     return true;
 556 #else
 557     g_test_skip("QEMU not configured using --enable-sanitizers");
 558     return false;
 559 #endif
 560 }
 561 static void test_cve_2021_20196(void)
 562 {
 563     QTestState *s;
 564
 565     if (!qtest_check_clang_sanitizer()) {
 566         return;
 567     }
 568
 569     s = qtest_initf("-nographic -m 32M -nodefaults " DRIVE_FLOPPY_BLANK);
 570
 571     qtest_outw(s, 0x3f4, 0x0500);
 572     qtest_outb(s, 0x3f5, 0x00);
 573     qtest_outb(s, 0x3f5, 0x00);
 574     qtest_outw(s, 0x3f4, 0x0000);
 575     qtest_outb(s, 0x3f5, 0x00);
 576     qtest_outw(s, 0x3f1, 0x0400);
 577     qtest_outw(s, 0x3f4, 0x0000);
 578     qtest_outw(s, 0x3f4, 0x0000);
 579     qtest_outb(s, 0x3f5, 0x00);
 580     qtest_outb(s, 0x3f5, 0x01);
 581     qtest_outw(s, 0x3f1, 0x0500);
 582     qtest_outb(s, 0x3f5, 0x00);
 583     qtest_quit(s);
 584 }
 585
 586 int main(int argc, char **argv)
 587 {
 588     int fd;
 589     int ret;
 590
 591     /* Create a temporary raw image */
 592     fd = mkstemp(test_image);
 593     g_assert(fd >= 0);
 594     ret = ftruncate(fd, TEST_IMAGE_SIZE);
 595     g_assert(ret == 0);
 596     close(fd);
 597
 598     /* Run the tests */
 599     g_test_init(&argc, &argv, NULL);
 600
 601     qtest_start("-machine pc -device floppy,id=floppy0");
 602     qtest_irq_intercept_in(global_qtest, "ioapic");
 603     qtest_add_func("/fdc/cmos", test_cmos);
 604     qtest_add_func("/fdc/no_media_on_start", test_no_media_on_start);
 605     qtest_add_func("/fdc/read_without_media", test_read_without_media);
 606     qtest_add_func("/fdc/media_change", test_media_change);
 607     qtest_add_func("/fdc/sense_interrupt", test_sense_interrupt);
 608     qtest_add_func("/fdc/relative_seek", test_relative_seek);
 609     qtest_add_func("/fdc/read_id", test_read_id);
 610     qtest_add_func("/fdc/verify", test_verify);
 611     qtest_add_func("/fdc/media_insert", test_media_insert);
 612     qtest_add_func("/fdc/read_no_dma_1", test_read_no_dma_1);
 613     qtest_add_func("/fdc/read_no_dma_18", test_read_no_dma_18);
 614     qtest_add_func("/fdc/read_no_dma_19", test_read_no_dma_19);
 615     qtest_add_func("/fdc/fuzz-registers", fuzz_registers);
 616     qtest_add_func("/fdc/fuzz/cve_2021_20196", test_cve_2021_20196);
 617
 618     ret = g_test_run();
 619
 620     /* Cleanup */
 621     qtest_end();
 622     unlink(test_image);
 623
 624     return ret;
 625 }