1 /* 2 * QEMU boot sector testing helpers. 3 * 4 * Copyright (c) 2016 Red Hat Inc. 5 * 6 * Authors: 7 * Michael S. Tsirkin <mst@redhat.com> 8 * Victor Kaplansky <victork@redhat.com> 9 * 10 * This work is licensed under the terms of the GNU GPL, version 2 or later. 11 * See the COPYING file in the top-level directory. 12 */ 13 #include "qemu/osdep.h" 14 #include "boot-sector.h" 15 #include "libqtest.h" 16 17 #define LOW(x) ((x) & 0xff) 18 #define HIGH(x) ((x) >> 8) 19 20 #define SIGNATURE 0xdead 21 #define SIGNATURE_OFFSET 0x10 22 #define BOOT_SECTOR_ADDRESS 0x7c00 23 #define SIGNATURE_ADDR (BOOT_SECTOR_ADDRESS + SIGNATURE_OFFSET) 24 25 /* x86 boot sector code: write SIGNATURE into memory, 26 * then halt. 27 */ 28 static uint8_t x86_boot_sector[512] = { 29 /* The first sector will be placed at RAM address 00007C00, and 30 * the BIOS transfers control to 00007C00 31 */ 32 33 /* Data Segment register should be initialized, since pxe 34 * boot loader can leave it dirty. 35 */ 36 37 /* 7c00: move $0000,%ax */ 38 [0x00] = 0xb8, 39 [0x01] = 0x00, 40 [0x02] = 0x00, 41 /* 7c03: move %ax,%ds */ 42 [0x03] = 0x8e, 43 [0x04] = 0xd8, 44 45 /* 7c05: mov $0xdead,%ax */ 46 [0x05] = 0xb8, 47 [0x06] = LOW(SIGNATURE), 48 [0x07] = HIGH(SIGNATURE), 49 /* 7c08: mov %ax,0x7c10 */ 50 [0x08] = 0xa3, 51 [0x09] = LOW(SIGNATURE_ADDR), 52 [0x0a] = HIGH(SIGNATURE_ADDR), 53 54 /* 7c0b cli */ 55 [0x0b] = 0xfa, 56 /* 7c0c: hlt */ 57 [0x0c] = 0xf4, 58 /* 7c0e: jmp 0x7c07=0x7c0f-3 */ 59 [0x0d] = 0xeb, 60 [0x0e] = LOW(-3), 61 /* We mov 0xdead here: set value to make debugging easier */ 62 [SIGNATURE_OFFSET] = LOW(0xface), 63 [SIGNATURE_OFFSET + 1] = HIGH(0xface), 64 /* End of boot sector marker */ 65 [0x1FE] = 0x55, 66 [0x1FF] = 0xAA, 67 }; 68 69 /* For s390x, use a mini "kernel" with the appropriate signature */ 70 static const uint8_t s390x_psw_and_magic[] = { 71 0x00, 0x08, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, /* Program status word */ 72 0x02, 0x00, 0x00, 0x18, 0x60, 0x00, 0x00, 0x50, /* Magic: */ 73 0x02, 0x00, 0x00, 0x68, 0x60, 0x00, 0x00, 0x50, /* see linux_s390_magic */ 74 0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x40, 0x40 /* in the s390-ccw bios */ 75 }; 76 static const uint8_t s390x_code[] = { 77 0xa7, 0xf4, 0x00, 0x08, /* j 0x10010 */ 78 0x00, 0x00, 0x00, 0x00, 79 'S', '3', '9', '0', 80 'E', 'P', 0x00, 0x01, 81 0xa7, 0x39, HIGH(SIGNATURE_ADDR), LOW(SIGNATURE_ADDR), /* lghi r3,0x7c10 */ 82 0xa7, 0x48, LOW(SIGNATURE), HIGH(SIGNATURE), /* lhi r4,0xadde */ 83 0x40, 0x40, 0x30, 0x00, /* sth r4,0(r3) */ 84 0xa7, 0xf4, 0xff, 0xfa /* j 0x10010 */ 85 }; 86 87 /* Create boot disk file. */ 88 int boot_sector_init(char *fname) 89 { 90 int fd, ret; 91 size_t len; 92 char *boot_code; 93 const char *arch = qtest_get_arch(); 94 95 fd = mkstemp(fname); 96 if (fd < 0) { 97 fprintf(stderr, "Couldn't open \"%s\": %s", fname, strerror(errno)); 98 return 1; 99 } 100 101 if (g_str_equal(arch, "i386") || g_str_equal(arch, "x86_64")) { 102 /* Q35 requires a minimum 0x7e000 bytes disk (bug or feature?) */ 103 len = MAX(0x7e000, sizeof(x86_boot_sector)); 104 boot_code = g_malloc0(len); 105 memcpy(boot_code, x86_boot_sector, sizeof(x86_boot_sector)); 106 } else if (g_str_equal(arch, "ppc64")) { 107 /* For Open Firmware based system, use a Forth script */ 108 boot_code = g_strdup_printf("\\ Bootscript\n%x %x c! %x %x c!\n", 109 LOW(SIGNATURE), SIGNATURE_ADDR, 110 HIGH(SIGNATURE), SIGNATURE_ADDR + 1); 111 len = strlen(boot_code); 112 } else if (g_str_equal(arch, "s390x")) { 113 len = 0x10000 + sizeof(s390x_code); 114 boot_code = g_malloc0(len); 115 memcpy(boot_code, s390x_psw_and_magic, sizeof(s390x_psw_and_magic)); 116 memcpy(&boot_code[0x10000], s390x_code, sizeof(s390x_code)); 117 } else { 118 g_assert_not_reached(); 119 } 120 121 ret = write(fd, boot_code, len); 122 close(fd); 123 124 g_free(boot_code); 125 126 if (ret != len) { 127 fprintf(stderr, "Could not write \"%s\"", fname); 128 return 1; 129 } 130 131 return 0; 132 } 133 134 /* Loop until signature in memory is OK. */ 135 void boot_sector_test(QTestState *qts) 136 { 137 uint8_t signature_low; 138 uint8_t signature_high; 139 uint16_t signature; 140 QDict *qrsp, *qret; 141 int i; 142 143 /* Wait at most 600 seconds (test is slow with TCI and --enable-debug) */ 144 #define TEST_DELAY (1 * G_USEC_PER_SEC / 10) 145 #define TEST_CYCLES MAX((600 * G_USEC_PER_SEC / TEST_DELAY), 1) 146 147 /* Poll until code has run and modified memory. Once it has we know BIOS 148 * initialization is done. TODO: check that IP reached the halt 149 * instruction. 150 */ 151 for (i = 0; i < TEST_CYCLES; ++i) { 152 signature_low = qtest_readb(qts, SIGNATURE_ADDR); 153 signature_high = qtest_readb(qts, SIGNATURE_ADDR + 1); 154 signature = (signature_high << 8) | signature_low; 155 if (signature == SIGNATURE) { 156 /* wipe signature */ 157 qtest_writeb(qts, SIGNATURE_ADDR, 0x00); 158 break; 159 } 160 161 /* check that guest is still in "running" state and did not panic */ 162 qrsp = qtest_qmp(qts, "{ 'execute': 'query-status' }"); 163 qret = qdict_get_qdict(qrsp, "return"); 164 g_assert_nonnull(qret); 165 if (qdict_get_try_str(qret, "status")) { 166 g_assert_cmpstr(qdict_get_try_str(qret, "status"), ==, "running"); 167 } 168 qobject_unref(qrsp); 169 170 g_usleep(TEST_DELAY); 171 } 172 173 g_assert_cmphex(signature, ==, SIGNATURE); 174 } 175 176 /* unlink boot disk file. */ 177 void boot_sector_cleanup(const char *fname) 178 { 179 unlink(fname); 180 } 181