11e8a1faeSThomas Huth /*
21e8a1faeSThomas Huth * QEMU boot sector testing helpers.
31e8a1faeSThomas Huth *
41e8a1faeSThomas Huth * Copyright (c) 2016 Red Hat Inc.
51e8a1faeSThomas Huth *
61e8a1faeSThomas Huth * Authors:
71e8a1faeSThomas Huth * Michael S. Tsirkin <mst@redhat.com>
81e8a1faeSThomas Huth * Victor Kaplansky <victork@redhat.com>
91e8a1faeSThomas Huth *
101e8a1faeSThomas Huth * This work is licensed under the terms of the GNU GPL, version 2 or later.
111e8a1faeSThomas Huth * See the COPYING file in the top-level directory.
121e8a1faeSThomas Huth */
131e8a1faeSThomas Huth #include "qemu/osdep.h"
141e8a1faeSThomas Huth #include "boot-sector.h"
15907b5105SMarc-André Lureau #include "libqtest.h"
161e8a1faeSThomas Huth
171e8a1faeSThomas Huth #define LOW(x) ((x) & 0xff)
181e8a1faeSThomas Huth #define HIGH(x) ((x) >> 8)
191e8a1faeSThomas Huth
201e8a1faeSThomas Huth #define SIGNATURE 0xdead
211e8a1faeSThomas Huth #define SIGNATURE_OFFSET 0x10
221e8a1faeSThomas Huth #define BOOT_SECTOR_ADDRESS 0x7c00
231e8a1faeSThomas Huth #define SIGNATURE_ADDR (BOOT_SECTOR_ADDRESS + SIGNATURE_OFFSET)
241e8a1faeSThomas Huth
251e8a1faeSThomas Huth /* x86 boot sector code: write SIGNATURE into memory,
261e8a1faeSThomas Huth * then halt.
271e8a1faeSThomas Huth */
281e8a1faeSThomas Huth static uint8_t x86_boot_sector[512] = {
291e8a1faeSThomas Huth /* The first sector will be placed at RAM address 00007C00, and
301e8a1faeSThomas Huth * the BIOS transfers control to 00007C00
311e8a1faeSThomas Huth */
321e8a1faeSThomas Huth
331e8a1faeSThomas Huth /* Data Segment register should be initialized, since pxe
341e8a1faeSThomas Huth * boot loader can leave it dirty.
351e8a1faeSThomas Huth */
361e8a1faeSThomas Huth
371e8a1faeSThomas Huth /* 7c00: move $0000,%ax */
381e8a1faeSThomas Huth [0x00] = 0xb8,
391e8a1faeSThomas Huth [0x01] = 0x00,
401e8a1faeSThomas Huth [0x02] = 0x00,
411e8a1faeSThomas Huth /* 7c03: move %ax,%ds */
421e8a1faeSThomas Huth [0x03] = 0x8e,
431e8a1faeSThomas Huth [0x04] = 0xd8,
441e8a1faeSThomas Huth
451e8a1faeSThomas Huth /* 7c05: mov $0xdead,%ax */
461e8a1faeSThomas Huth [0x05] = 0xb8,
471e8a1faeSThomas Huth [0x06] = LOW(SIGNATURE),
481e8a1faeSThomas Huth [0x07] = HIGH(SIGNATURE),
491e8a1faeSThomas Huth /* 7c08: mov %ax,0x7c10 */
501e8a1faeSThomas Huth [0x08] = 0xa3,
511e8a1faeSThomas Huth [0x09] = LOW(SIGNATURE_ADDR),
521e8a1faeSThomas Huth [0x0a] = HIGH(SIGNATURE_ADDR),
531e8a1faeSThomas Huth
541e8a1faeSThomas Huth /* 7c0b cli */
551e8a1faeSThomas Huth [0x0b] = 0xfa,
561e8a1faeSThomas Huth /* 7c0c: hlt */
571e8a1faeSThomas Huth [0x0c] = 0xf4,
581e8a1faeSThomas Huth /* 7c0e: jmp 0x7c07=0x7c0f-3 */
591e8a1faeSThomas Huth [0x0d] = 0xeb,
601e8a1faeSThomas Huth [0x0e] = LOW(-3),
611e8a1faeSThomas Huth /* We mov 0xdead here: set value to make debugging easier */
621e8a1faeSThomas Huth [SIGNATURE_OFFSET] = LOW(0xface),
631e8a1faeSThomas Huth [SIGNATURE_OFFSET + 1] = HIGH(0xface),
641e8a1faeSThomas Huth /* End of boot sector marker */
651e8a1faeSThomas Huth [0x1FE] = 0x55,
661e8a1faeSThomas Huth [0x1FF] = 0xAA,
671e8a1faeSThomas Huth };
681e8a1faeSThomas Huth
691e8a1faeSThomas Huth /* For s390x, use a mini "kernel" with the appropriate signature */
701e8a1faeSThomas Huth static const uint8_t s390x_psw_and_magic[] = {
711e8a1faeSThomas Huth 0x00, 0x08, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, /* Program status word */
721e8a1faeSThomas Huth 0x02, 0x00, 0x00, 0x18, 0x60, 0x00, 0x00, 0x50, /* Magic: */
731e8a1faeSThomas Huth 0x02, 0x00, 0x00, 0x68, 0x60, 0x00, 0x00, 0x50, /* see linux_s390_magic */
741e8a1faeSThomas Huth 0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x40 /* in the s390-ccw bios */
751e8a1faeSThomas Huth };
761e8a1faeSThomas Huth static const uint8_t s390x_code[] = {
771e8a1faeSThomas Huth 0xa7, 0xf4, 0x00, 0x08, /* j 0x10010 */
781e8a1faeSThomas Huth 0x00, 0x00, 0x00, 0x00,
791e8a1faeSThomas Huth 'S', '3', '9', '0',
801e8a1faeSThomas Huth 'E', 'P', 0x00, 0x01,
811e8a1faeSThomas Huth 0xa7, 0x39, HIGH(SIGNATURE_ADDR), LOW(SIGNATURE_ADDR), /* lghi r3,0x7c10 */
821e8a1faeSThomas Huth 0xa7, 0x48, LOW(SIGNATURE), HIGH(SIGNATURE), /* lhi r4,0xadde */
831e8a1faeSThomas Huth 0x40, 0x40, 0x30, 0x00, /* sth r4,0(r3) */
841e8a1faeSThomas Huth 0xa7, 0xf4, 0xff, 0xfa /* j 0x10010 */
851e8a1faeSThomas Huth };
861e8a1faeSThomas Huth
871e8a1faeSThomas Huth /* Create boot disk file. */
boot_sector_init(char * fname)881e8a1faeSThomas Huth int boot_sector_init(char *fname)
891e8a1faeSThomas Huth {
901e8a1faeSThomas Huth int fd, ret;
911e8a1faeSThomas Huth size_t len;
921e8a1faeSThomas Huth char *boot_code;
931e8a1faeSThomas Huth const char *arch = qtest_get_arch();
941e8a1faeSThomas Huth
951e8a1faeSThomas Huth fd = mkstemp(fname);
961e8a1faeSThomas Huth if (fd < 0) {
971e8a1faeSThomas Huth fprintf(stderr, "Couldn't open \"%s\": %s", fname, strerror(errno));
981e8a1faeSThomas Huth return 1;
991e8a1faeSThomas Huth }
1001e8a1faeSThomas Huth
1011e8a1faeSThomas Huth if (g_str_equal(arch, "i386") || g_str_equal(arch, "x86_64")) {
1021e8a1faeSThomas Huth /* Q35 requires a minimum 0x7e000 bytes disk (bug or feature?) */
1031e8a1faeSThomas Huth len = MAX(0x7e000, sizeof(x86_boot_sector));
1041e8a1faeSThomas Huth boot_code = g_malloc0(len);
1051e8a1faeSThomas Huth memcpy(boot_code, x86_boot_sector, sizeof(x86_boot_sector));
1061e8a1faeSThomas Huth } else if (g_str_equal(arch, "ppc64")) {
1071e8a1faeSThomas Huth /* For Open Firmware based system, use a Forth script */
1081e8a1faeSThomas Huth boot_code = g_strdup_printf("\\ Bootscript\n%x %x c! %x %x c!\n",
1091e8a1faeSThomas Huth LOW(SIGNATURE), SIGNATURE_ADDR,
1101e8a1faeSThomas Huth HIGH(SIGNATURE), SIGNATURE_ADDR + 1);
1111e8a1faeSThomas Huth len = strlen(boot_code);
1121e8a1faeSThomas Huth } else if (g_str_equal(arch, "s390x")) {
1131e8a1faeSThomas Huth len = 0x10000 + sizeof(s390x_code);
1141e8a1faeSThomas Huth boot_code = g_malloc0(len);
1151e8a1faeSThomas Huth memcpy(boot_code, s390x_psw_and_magic, sizeof(s390x_psw_and_magic));
1161e8a1faeSThomas Huth memcpy(&boot_code[0x10000], s390x_code, sizeof(s390x_code));
1171e8a1faeSThomas Huth } else {
1181e8a1faeSThomas Huth g_assert_not_reached();
1191e8a1faeSThomas Huth }
1201e8a1faeSThomas Huth
1211e8a1faeSThomas Huth ret = write(fd, boot_code, len);
1221e8a1faeSThomas Huth close(fd);
1231e8a1faeSThomas Huth
1241e8a1faeSThomas Huth g_free(boot_code);
1251e8a1faeSThomas Huth
1261e8a1faeSThomas Huth if (ret != len) {
1271e8a1faeSThomas Huth fprintf(stderr, "Could not write \"%s\"", fname);
1281e8a1faeSThomas Huth return 1;
1291e8a1faeSThomas Huth }
1301e8a1faeSThomas Huth
1311e8a1faeSThomas Huth return 0;
1321e8a1faeSThomas Huth }
1331e8a1faeSThomas Huth
1341e8a1faeSThomas Huth /* Loop until signature in memory is OK. */
boot_sector_test(QTestState * qts)1351e8a1faeSThomas Huth void boot_sector_test(QTestState *qts)
1361e8a1faeSThomas Huth {
1371e8a1faeSThomas Huth uint8_t signature_low;
1381e8a1faeSThomas Huth uint8_t signature_high;
1391e8a1faeSThomas Huth uint16_t signature;
14045d10d72SThomas Huth QDict *qrsp, *qret;
1411e8a1faeSThomas Huth int i;
1421e8a1faeSThomas Huth
1431e8a1faeSThomas Huth /* Wait at most 600 seconds (test is slow with TCI and --enable-debug) */
1441e8a1faeSThomas Huth #define TEST_DELAY (1 * G_USEC_PER_SEC / 10)
1451e8a1faeSThomas Huth #define TEST_CYCLES MAX((600 * G_USEC_PER_SEC / TEST_DELAY), 1)
1461e8a1faeSThomas Huth
1471e8a1faeSThomas Huth /* Poll until code has run and modified memory. Once it has we know BIOS
1481e8a1faeSThomas Huth * initialization is done. TODO: check that IP reached the halt
1491e8a1faeSThomas Huth * instruction.
1501e8a1faeSThomas Huth */
1511e8a1faeSThomas Huth for (i = 0; i < TEST_CYCLES; ++i) {
1521e8a1faeSThomas Huth signature_low = qtest_readb(qts, SIGNATURE_ADDR);
1531e8a1faeSThomas Huth signature_high = qtest_readb(qts, SIGNATURE_ADDR + 1);
1541e8a1faeSThomas Huth signature = (signature_high << 8) | signature_low;
1551e8a1faeSThomas Huth if (signature == SIGNATURE) {
1562efe88a9SIgor Mammedov /* wipe signature */
1572efe88a9SIgor Mammedov qtest_writeb(qts, SIGNATURE_ADDR, 0x00);
1581e8a1faeSThomas Huth break;
1591e8a1faeSThomas Huth }
16045d10d72SThomas Huth
16145d10d72SThomas Huth /* check that guest is still in "running" state and did not panic */
16245d10d72SThomas Huth qrsp = qtest_qmp(qts, "{ 'execute': 'query-status' }");
16345d10d72SThomas Huth qret = qdict_get_qdict(qrsp, "return");
16445d10d72SThomas Huth g_assert_nonnull(qret);
1656dfcb0e7SIgor Mammedov if (qdict_get_try_str(qret, "status")) {
16645d10d72SThomas Huth g_assert_cmpstr(qdict_get_try_str(qret, "status"), ==, "running");
1676dfcb0e7SIgor Mammedov }
16845d10d72SThomas Huth qobject_unref(qrsp);
16945d10d72SThomas Huth
1701e8a1faeSThomas Huth g_usleep(TEST_DELAY);
1711e8a1faeSThomas Huth }
1721e8a1faeSThomas Huth
1731e8a1faeSThomas Huth g_assert_cmphex(signature, ==, SIGNATURE);
1741e8a1faeSThomas Huth }
1751e8a1faeSThomas Huth
1761e8a1faeSThomas Huth /* unlink boot disk file. */
boot_sector_cleanup(const char * fname)1771e8a1faeSThomas Huth void boot_sector_cleanup(const char *fname)
1781e8a1faeSThomas Huth {
1791e8a1faeSThomas Huth unlink(fname);
1801e8a1faeSThomas Huth }
181