1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25#include <stdint.h>
26#include <string.h>
27#include <stdio.h>
28
29#include <glib.h>
30
31#include "libqtest.h"
32#include "qemu-common.h"
33
34#define TEST_IMAGE_SIZE 1440 * 1024
35
36#define FLOPPY_BASE 0x3f0
37#define FLOPPY_IRQ 6
38
39enum {
40 reg_sra = 0x0,
41 reg_srb = 0x1,
42 reg_dor = 0x2,
43 reg_msr = 0x4,
44 reg_dsr = 0x4,
45 reg_fifo = 0x5,
46 reg_dir = 0x7,
47};
48
49enum {
50 CMD_SENSE_INT = 0x08,
51 CMD_READ_ID = 0x0a,
52 CMD_SEEK = 0x0f,
53 CMD_VERIFY = 0x16,
54 CMD_READ = 0xe6,
55 CMD_RELATIVE_SEEK_OUT = 0x8f,
56 CMD_RELATIVE_SEEK_IN = 0xcf,
57};
58
59enum {
60 BUSY = 0x10,
61 NONDMA = 0x20,
62 RQM = 0x80,
63 DIO = 0x40,
64
65 DSKCHG = 0x80,
66};
67
68char test_image[] = "/tmp/qtest.XXXXXX";
69
70#define assert_bit_set(data, mask) g_assert_cmphex((data) & (mask), ==, (mask))
71#define assert_bit_clear(data, mask) g_assert_cmphex((data) & (mask), ==, 0)
72
73static uint8_t base = 0x70;
74
75enum {
76 CMOS_FLOPPY = 0x10,
77};
78
79static void floppy_send(uint8_t byte)
80{
81 uint8_t msr;
82
83 msr = inb(FLOPPY_BASE + reg_msr);
84 assert_bit_set(msr, RQM);
85 assert_bit_clear(msr, DIO);
86
87 outb(FLOPPY_BASE + reg_fifo, byte);
88}
89
90static uint8_t floppy_recv(void)
91{
92 uint8_t msr;
93
94 msr = inb(FLOPPY_BASE + reg_msr);
95 assert_bit_set(msr, RQM | DIO);
96
97 return inb(FLOPPY_BASE + reg_fifo);
98}
99
100
101static void ack_irq(uint8_t *pcn)
102{
103 uint8_t ret;
104
105 g_assert(get_irq(FLOPPY_IRQ));
106 floppy_send(CMD_SENSE_INT);
107 floppy_recv();
108
109 ret = floppy_recv();
110 if (pcn != NULL) {
111 *pcn = ret;
112 }
113
114 g_assert(!get_irq(FLOPPY_IRQ));
115}
116
117static uint8_t send_read_command(uint8_t cmd)
118{
119 uint8_t drive = 0;
120 uint8_t head = 0;
121 uint8_t cyl = 0;
122 uint8_t sect_addr = 1;
123 uint8_t sect_size = 2;
124 uint8_t eot = 1;
125 uint8_t gap = 0x1b;
126 uint8_t gpl = 0xff;
127
128 uint8_t msr = 0;
129 uint8_t st0;
130
131 uint8_t ret = 0;
132
133 floppy_send(cmd);
134 floppy_send(head << 2 | drive);
135 g_assert(!get_irq(FLOPPY_IRQ));
136 floppy_send(cyl);
137 floppy_send(head);
138 floppy_send(sect_addr);
139 floppy_send(sect_size);
140 floppy_send(eot);
141 floppy_send(gap);
142 floppy_send(gpl);
143
144 uint8_t i = 0;
145 uint8_t n = 2;
146 for (; i < n; i++) {
147 msr = inb(FLOPPY_BASE + reg_msr);
148 if (msr == 0xd0) {
149 break;
150 }
151 sleep(1);
152 }
153
154 if (i >= n) {
155 return 1;
156 }
157
158 st0 = floppy_recv();
159 if (st0 != 0x40) {
160 ret = 1;
161 }
162
163 floppy_recv();
164 floppy_recv();
165 floppy_recv();
166 floppy_recv();
167 floppy_recv();
168 floppy_recv();
169
170 return ret;
171}
172
173static uint8_t send_read_no_dma_command(int nb_sect, uint8_t expected_st0)
174{
175 uint8_t drive = 0;
176 uint8_t head = 0;
177 uint8_t cyl = 0;
178 uint8_t sect_addr = 1;
179 uint8_t sect_size = 2;
180 uint8_t eot = nb_sect;
181 uint8_t gap = 0x1b;
182 uint8_t gpl = 0xff;
183
184 uint8_t msr = 0;
185 uint8_t st0;
186
187 uint8_t ret = 0;
188
189 floppy_send(CMD_READ);
190 floppy_send(head << 2 | drive);
191 g_assert(!get_irq(FLOPPY_IRQ));
192 floppy_send(cyl);
193 floppy_send(head);
194 floppy_send(sect_addr);
195 floppy_send(sect_size);
196 floppy_send(eot);
197 floppy_send(gap);
198 floppy_send(gpl);
199
200 uint16_t i = 0;
201 uint8_t n = 2;
202 for (; i < n; i++) {
203 msr = inb(FLOPPY_BASE + reg_msr);
204 if (msr == (BUSY | NONDMA | DIO | RQM)) {
205 break;
206 }
207 sleep(1);
208 }
209
210 if (i >= n) {
211 return 1;
212 }
213
214
215 for (i = 0; i < 512 * 2 * nb_sect; i++) {
216 msr = inb(FLOPPY_BASE + reg_msr);
217 assert_bit_set(msr, BUSY | RQM | DIO);
218 inb(FLOPPY_BASE + reg_fifo);
219 }
220
221 st0 = floppy_recv();
222 if (st0 != expected_st0) {
223 ret = 1;
224 }
225
226 floppy_recv();
227 floppy_recv();
228 floppy_recv();
229 floppy_recv();
230 floppy_recv();
231 floppy_recv();
232
233 return ret;
234}
235
236static void send_seek(int cyl)
237{
238 int drive = 0;
239 int head = 0;
240
241 floppy_send(CMD_SEEK);
242 floppy_send(head << 2 | drive);
243 g_assert(!get_irq(FLOPPY_IRQ));
244 floppy_send(cyl);
245 ack_irq(NULL);
246}
247
248static uint8_t cmos_read(uint8_t reg)
249{
250 outb(base + 0, reg);
251 return inb(base + 1);
252}
253
254static void test_cmos(void)
255{
256 uint8_t cmos;
257
258 cmos = cmos_read(CMOS_FLOPPY);
259 g_assert(cmos == 0x40);
260}
261
262static void test_no_media_on_start(void)
263{
264 uint8_t dir;
265
266
267
268 dir = inb(FLOPPY_BASE + reg_dir);
269 assert_bit_set(dir, DSKCHG);
270 dir = inb(FLOPPY_BASE + reg_dir);
271 assert_bit_set(dir, DSKCHG);
272 send_seek(1);
273 dir = inb(FLOPPY_BASE + reg_dir);
274 assert_bit_set(dir, DSKCHG);
275 dir = inb(FLOPPY_BASE + reg_dir);
276 assert_bit_set(dir, DSKCHG);
277}
278
279static void test_read_without_media(void)
280{
281 uint8_t ret;
282
283 ret = send_read_command(CMD_READ);
284 g_assert(ret == 0);
285}
286
287static void test_media_insert(void)
288{
289 uint8_t dir;
290
291
292
293 qmp_discard_response("{'execute':'change', 'arguments':{"
294 " 'device':'floppy0', 'target': '%s' }}",
295 test_image);
296 qmp_discard_response("");
297
298 qmp_discard_response("");
299
300 dir = inb(FLOPPY_BASE + reg_dir);
301 assert_bit_set(dir, DSKCHG);
302 dir = inb(FLOPPY_BASE + reg_dir);
303 assert_bit_set(dir, DSKCHG);
304
305 send_seek(0);
306 dir = inb(FLOPPY_BASE + reg_dir);
307 assert_bit_set(dir, DSKCHG);
308 dir = inb(FLOPPY_BASE + reg_dir);
309 assert_bit_set(dir, DSKCHG);
310
311
312 send_seek(1);
313 dir = inb(FLOPPY_BASE + reg_dir);
314 assert_bit_clear(dir, DSKCHG);
315 dir = inb(FLOPPY_BASE + reg_dir);
316 assert_bit_clear(dir, DSKCHG);
317}
318
319static void test_media_change(void)
320{
321 uint8_t dir;
322
323 test_media_insert();
324
325
326
327 qmp_discard_response("{'execute':'eject', 'arguments':{"
328 " 'device':'floppy0' }}");
329 qmp_discard_response("");
330
331 dir = inb(FLOPPY_BASE + reg_dir);
332 assert_bit_set(dir, DSKCHG);
333 dir = inb(FLOPPY_BASE + reg_dir);
334 assert_bit_set(dir, DSKCHG);
335
336 send_seek(0);
337 dir = inb(FLOPPY_BASE + reg_dir);
338 assert_bit_set(dir, DSKCHG);
339 dir = inb(FLOPPY_BASE + reg_dir);
340 assert_bit_set(dir, DSKCHG);
341
342 send_seek(1);
343 dir = inb(FLOPPY_BASE + reg_dir);
344 assert_bit_set(dir, DSKCHG);
345 dir = inb(FLOPPY_BASE + reg_dir);
346 assert_bit_set(dir, DSKCHG);
347}
348
349static void test_sense_interrupt(void)
350{
351 int drive = 0;
352 int head = 0;
353 int cyl = 0;
354 int ret = 0;
355
356 floppy_send(CMD_SENSE_INT);
357 ret = floppy_recv();
358 g_assert(ret == 0x80);
359
360 floppy_send(CMD_SEEK);
361 floppy_send(head << 2 | drive);
362 g_assert(!get_irq(FLOPPY_IRQ));
363 floppy_send(cyl);
364
365 floppy_send(CMD_SENSE_INT);
366 ret = floppy_recv();
367 g_assert(ret == 0x20);
368 floppy_recv();
369}
370
371static void test_relative_seek(void)
372{
373 uint8_t drive = 0;
374 uint8_t head = 0;
375 uint8_t cyl = 1;
376 uint8_t pcn;
377
378
379 send_seek(0);
380
381
382 floppy_send(CMD_RELATIVE_SEEK_IN);
383 floppy_send(head << 2 | drive);
384 g_assert(!get_irq(FLOPPY_IRQ));
385 floppy_send(cyl);
386
387 ack_irq(&pcn);
388 g_assert(pcn == 1);
389
390
391 floppy_send(CMD_RELATIVE_SEEK_OUT);
392 floppy_send(head << 2 | drive);
393 g_assert(!get_irq(FLOPPY_IRQ));
394 floppy_send(cyl);
395
396 ack_irq(&pcn);
397 g_assert(pcn == 0);
398}
399
400static void test_read_id(void)
401{
402 uint8_t drive = 0;
403 uint8_t head = 0;
404 uint8_t cyl;
405 uint8_t st0;
406
407
408 send_seek(0);
409
410 floppy_send(CMD_READ_ID);
411 g_assert(!get_irq(FLOPPY_IRQ));
412 floppy_send(head << 2 | drive);
413
414 while (!get_irq(FLOPPY_IRQ)) {
415
416 clock_step(1000000000LL / 50);
417 }
418
419 st0 = floppy_recv();
420 floppy_recv();
421 floppy_recv();
422 cyl = floppy_recv();
423 head = floppy_recv();
424 floppy_recv();
425 floppy_recv();
426
427 g_assert_cmpint(cyl, ==, 0);
428 g_assert_cmpint(head, ==, 0);
429 g_assert_cmpint(st0, ==, head << 2);
430
431
432 head = 1;
433 cyl = 8;
434
435 floppy_send(CMD_SEEK);
436 floppy_send(head << 2 | drive);
437 g_assert(!get_irq(FLOPPY_IRQ));
438 floppy_send(cyl);
439 g_assert(get_irq(FLOPPY_IRQ));
440 ack_irq(NULL);
441
442 floppy_send(CMD_READ_ID);
443 g_assert(!get_irq(FLOPPY_IRQ));
444 floppy_send(head << 2 | drive);
445
446 while (!get_irq(FLOPPY_IRQ)) {
447
448 clock_step(1000000000LL / 50);
449 }
450
451 st0 = floppy_recv();
452 floppy_recv();
453 floppy_recv();
454 cyl = floppy_recv();
455 head = floppy_recv();
456 floppy_recv();
457 floppy_recv();
458
459 g_assert_cmpint(cyl, ==, 8);
460 g_assert_cmpint(head, ==, 1);
461 g_assert_cmpint(st0, ==, head << 2);
462}
463
464static void test_read_no_dma_1(void)
465{
466 uint8_t ret;
467
468 outb(FLOPPY_BASE + reg_dor, inb(FLOPPY_BASE + reg_dor) & ~0x08);
469 send_seek(0);
470 ret = send_read_no_dma_command(1, 0x04);
471 g_assert(ret == 0);
472}
473
474static void test_read_no_dma_18(void)
475{
476 uint8_t ret;
477
478 outb(FLOPPY_BASE + reg_dor, inb(FLOPPY_BASE + reg_dor) & ~0x08);
479 send_seek(0);
480 ret = send_read_no_dma_command(18, 0x04);
481 g_assert(ret == 0);
482}
483
484static void test_read_no_dma_19(void)
485{
486 uint8_t ret;
487
488 outb(FLOPPY_BASE + reg_dor, inb(FLOPPY_BASE + reg_dor) & ~0x08);
489 send_seek(0);
490 ret = send_read_no_dma_command(19, 0x20);
491 g_assert(ret == 0);
492}
493
494static void test_verify(void)
495{
496 uint8_t ret;
497
498 ret = send_read_command(CMD_VERIFY);
499 g_assert(ret == 0);
500}
501
502
503static void fuzz_registers(void)
504{
505 unsigned int i;
506
507 for (i = 0; i < 1000; i++) {
508 uint8_t reg, val;
509
510 reg = (uint8_t)g_test_rand_int_range(0, 8);
511 val = (uint8_t)g_test_rand_int_range(0, 256);
512
513 outb(FLOPPY_BASE + reg, val);
514 inb(FLOPPY_BASE + reg);
515 }
516}
517
518int main(int argc, char **argv)
519{
520 const char *arch = qtest_get_arch();
521 char *cmdline;
522 int fd;
523 int ret;
524
525
526 if (strcmp(arch, "i386") && strcmp(arch, "x86_64")) {
527 g_test_message("Skipping test for non-x86\n");
528 return 0;
529 }
530
531
532 fd = mkstemp(test_image);
533 g_assert(fd >= 0);
534 ret = ftruncate(fd, TEST_IMAGE_SIZE);
535 g_assert(ret == 0);
536 close(fd);
537
538
539 g_test_init(&argc, &argv, NULL);
540
541 cmdline = g_strdup_printf("-vnc none ");
542
543 qtest_start(cmdline);
544 qtest_irq_intercept_in(global_qtest, "ioapic");
545 qtest_add_func("/fdc/cmos", test_cmos);
546 qtest_add_func("/fdc/no_media_on_start", test_no_media_on_start);
547 qtest_add_func("/fdc/read_without_media", test_read_without_media);
548 qtest_add_func("/fdc/media_change", test_media_change);
549 qtest_add_func("/fdc/sense_interrupt", test_sense_interrupt);
550 qtest_add_func("/fdc/relative_seek", test_relative_seek);
551 qtest_add_func("/fdc/read_id", test_read_id);
552 qtest_add_func("/fdc/verify", test_verify);
553 qtest_add_func("/fdc/media_insert", test_media_insert);
554 qtest_add_func("/fdc/read_no_dma_1", test_read_no_dma_1);
555 qtest_add_func("/fdc/read_no_dma_18", test_read_no_dma_18);
556 qtest_add_func("/fdc/read_no_dma_19", test_read_no_dma_19);
557 qtest_add_func("/fdc/fuzz-registers", fuzz_registers);
558
559 ret = g_test_run();
560
561
562 qtest_end();
563 unlink(test_image);
564
565 return ret;
566}
567