1 /*
2 * QEMU boot sector testing helpers.
3 *
4 * Copyright (c) 2016 Red Hat Inc.
5 *
6 * Authors:
7 * Michael S. Tsirkin <mst@redhat.com>
8 * Victor Kaplansky <victork@redhat.com>
9 *
10 * This work is licensed under the terms of the GNU GPL, version 2 or later.
11 * See the COPYING file in the top-level directory.
12 */
13 #include "qemu/osdep.h"
14 #include "boot-sector.h"
15 #include "libqtest.h"
16
17 #define LOW(x) ((x) & 0xff)
18 #define HIGH(x) ((x) >> 8)
19
20 #define SIGNATURE 0xdead
21 #define SIGNATURE_OFFSET 0x10
22 #define BOOT_SECTOR_ADDRESS 0x7c00
23 #define SIGNATURE_ADDR (BOOT_SECTOR_ADDRESS + SIGNATURE_OFFSET)
24
25 /* x86 boot sector code: write SIGNATURE into memory,
26 * then halt.
27 */
28 static uint8_t x86_boot_sector[512] = {
29 /* The first sector will be placed at RAM address 00007C00, and
30 * the BIOS transfers control to 00007C00
31 */
32
33 /* Data Segment register should be initialized, since pxe
34 * boot loader can leave it dirty.
35 */
36
37 /* 7c00: move $0000,%ax */
38 [0x00] = 0xb8,
39 [0x01] = 0x00,
40 [0x02] = 0x00,
41 /* 7c03: move %ax,%ds */
42 [0x03] = 0x8e,
43 [0x04] = 0xd8,
44
45 /* 7c05: mov $0xdead,%ax */
46 [0x05] = 0xb8,
47 [0x06] = LOW(SIGNATURE),
48 [0x07] = HIGH(SIGNATURE),
49 /* 7c08: mov %ax,0x7c10 */
50 [0x08] = 0xa3,
51 [0x09] = LOW(SIGNATURE_ADDR),
52 [0x0a] = HIGH(SIGNATURE_ADDR),
53
54 /* 7c0b cli */
55 [0x0b] = 0xfa,
56 /* 7c0c: hlt */
57 [0x0c] = 0xf4,
58 /* 7c0e: jmp 0x7c07=0x7c0f-3 */
59 [0x0d] = 0xeb,
60 [0x0e] = LOW(-3),
61 /* We mov 0xdead here: set value to make debugging easier */
62 [SIGNATURE_OFFSET] = LOW(0xface),
63 [SIGNATURE_OFFSET + 1] = HIGH(0xface),
64 /* End of boot sector marker */
65 [0x1FE] = 0x55,
66 [0x1FF] = 0xAA,
67 };
68
69 /* For s390x, use a mini "kernel" with the appropriate signature */
70 static const uint8_t s390x_psw_and_magic[] = {
71 0x00, 0x08, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, /* Program status word */
72 0x02, 0x00, 0x00, 0x18, 0x60, 0x00, 0x00, 0x50, /* Magic: */
73 0x02, 0x00, 0x00, 0x68, 0x60, 0x00, 0x00, 0x50, /* see linux_s390_magic */
74 0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x40 /* in the s390-ccw bios */
75 };
76 static const uint8_t s390x_code[] = {
77 0xa7, 0xf4, 0x00, 0x08, /* j 0x10010 */
78 0x00, 0x00, 0x00, 0x00,
79 'S', '3', '9', '0',
80 'E', 'P', 0x00, 0x01,
81 0xa7, 0x39, HIGH(SIGNATURE_ADDR), LOW(SIGNATURE_ADDR), /* lghi r3,0x7c10 */
82 0xa7, 0x48, LOW(SIGNATURE), HIGH(SIGNATURE), /* lhi r4,0xadde */
83 0x40, 0x40, 0x30, 0x00, /* sth r4,0(r3) */
84 0xa7, 0xf4, 0xff, 0xfa /* j 0x10010 */
85 };
86
87 /* Create boot disk file. */
boot_sector_init(char * fname)88 int boot_sector_init(char *fname)
89 {
90 int fd, ret;
91 size_t len;
92 char *boot_code;
93 const char *arch = qtest_get_arch();
94
95 fd = mkstemp(fname);
96 if (fd < 0) {
97 fprintf(stderr, "Couldn't open \"%s\": %s", fname, strerror(errno));
98 return 1;
99 }
100
101 if (g_str_equal(arch, "i386") || g_str_equal(arch, "x86_64")) {
102 /* Q35 requires a minimum 0x7e000 bytes disk (bug or feature?) */
103 len = MAX(0x7e000, sizeof(x86_boot_sector));
104 boot_code = g_malloc0(len);
105 memcpy(boot_code, x86_boot_sector, sizeof(x86_boot_sector));
106 } else if (g_str_equal(arch, "ppc64")) {
107 /* For Open Firmware based system, use a Forth script */
108 boot_code = g_strdup_printf("\\ Bootscript\n%x %x c! %x %x c!\n",
109 LOW(SIGNATURE), SIGNATURE_ADDR,
110 HIGH(SIGNATURE), SIGNATURE_ADDR + 1);
111 len = strlen(boot_code);
112 } else if (g_str_equal(arch, "s390x")) {
113 len = 0x10000 + sizeof(s390x_code);
114 boot_code = g_malloc0(len);
115 memcpy(boot_code, s390x_psw_and_magic, sizeof(s390x_psw_and_magic));
116 memcpy(&boot_code[0x10000], s390x_code, sizeof(s390x_code));
117 } else {
118 g_assert_not_reached();
119 }
120
121 ret = write(fd, boot_code, len);
122 close(fd);
123
124 g_free(boot_code);
125
126 if (ret != len) {
127 fprintf(stderr, "Could not write \"%s\"", fname);
128 return 1;
129 }
130
131 return 0;
132 }
133
134 /* Loop until signature in memory is OK. */
boot_sector_test(QTestState * qts)135 void boot_sector_test(QTestState *qts)
136 {
137 uint8_t signature_low;
138 uint8_t signature_high;
139 uint16_t signature;
140 QDict *qrsp, *qret;
141 int i;
142
143 /* Wait at most 600 seconds (test is slow with TCI and --enable-debug) */
144 #define TEST_DELAY (1 * G_USEC_PER_SEC / 10)
145 #define TEST_CYCLES MAX((600 * G_USEC_PER_SEC / TEST_DELAY), 1)
146
147 /* Poll until code has run and modified memory. Once it has we know BIOS
148 * initialization is done. TODO: check that IP reached the halt
149 * instruction.
150 */
151 for (i = 0; i < TEST_CYCLES; ++i) {
152 signature_low = qtest_readb(qts, SIGNATURE_ADDR);
153 signature_high = qtest_readb(qts, SIGNATURE_ADDR + 1);
154 signature = (signature_high << 8) | signature_low;
155 if (signature == SIGNATURE) {
156 /* wipe signature */
157 qtest_writeb(qts, SIGNATURE_ADDR, 0x00);
158 break;
159 }
160
161 /* check that guest is still in "running" state and did not panic */
162 qrsp = qtest_qmp(qts, "{ 'execute': 'query-status' }");
163 qret = qdict_get_qdict(qrsp, "return");
164 g_assert_nonnull(qret);
165 if (qdict_get_try_str(qret, "status")) {
166 g_assert_cmpstr(qdict_get_try_str(qret, "status"), ==, "running");
167 }
168 qobject_unref(qrsp);
169
170 g_usleep(TEST_DELAY);
171 }
172
173 g_assert_cmphex(signature, ==, SIGNATURE);
174 }
175
176 /* unlink boot disk file. */
boot_sector_cleanup(const char * fname)177 void boot_sector_cleanup(const char *fname)
178 {
179 unlink(fname);
180 }
181