1 /* 2 * Floppy test cases. 3 * 4 * Copyright (c) 2012 Kevin Wolf <kwolf@redhat.com> 5 * 6 * Permission is hereby granted, free of charge, to any person obtaining a copy 7 * of this software and associated documentation files (the "Software"), to deal 8 * in the Software without restriction, including without limitation the rights 9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 * copies of the Software, and to permit persons to whom the Software is 11 * furnished to do so, subject to the following conditions: 12 * 13 * The above copyright notice and this permission notice shall be included in 14 * all copies or substantial portions of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL 19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 * THE SOFTWARE. 23 */ 24 25 #include "qemu/osdep.h" 26 27 28 #include "libqtest-single.h" 29 #include "qapi/qmp/qdict.h" 30 #include "qemu-common.h" 31 32 /* TODO actually test the results and get rid of this */ 33 #define qmp_discard_response(...) qobject_unref(qmp(__VA_ARGS__)) 34 35 #define DRIVE_FLOPPY_BLANK \ 36 "-drive if=floppy,file=null-co://,file.read-zeroes=on,format=raw,size=1440k" 37 38 #define TEST_IMAGE_SIZE 1440 * 1024 39 40 #define FLOPPY_BASE 0x3f0 41 #define FLOPPY_IRQ 6 42 43 enum { 44 reg_sra = 0x0, 45 reg_srb = 0x1, 46 reg_dor = 0x2, 47 reg_msr = 0x4, 48 reg_dsr = 0x4, 49 reg_fifo = 0x5, 50 reg_dir = 0x7, 51 }; 52 53 enum { 54 CMD_SENSE_INT = 0x08, 55 CMD_READ_ID = 0x0a, 56 CMD_SEEK = 0x0f, 57 CMD_VERIFY = 0x16, 58 CMD_READ = 0xe6, 59 CMD_RELATIVE_SEEK_OUT = 0x8f, 60 CMD_RELATIVE_SEEK_IN = 0xcf, 61 }; 62 63 enum { 64 BUSY = 0x10, 65 NONDMA = 0x20, 66 RQM = 0x80, 67 DIO = 0x40, 68 69 DSKCHG = 0x80, 70 }; 71 72 static char test_image[] = "/tmp/qtest.XXXXXX"; 73 74 #define assert_bit_set(data, mask) g_assert_cmphex((data) & (mask), ==, (mask)) 75 #define assert_bit_clear(data, mask) g_assert_cmphex((data) & (mask), ==, 0) 76 77 static uint8_t base = 0x70; 78 79 enum { 80 CMOS_FLOPPY = 0x10, 81 }; 82 83 static void floppy_send(uint8_t byte) 84 { 85 uint8_t msr; 86 87 msr = inb(FLOPPY_BASE + reg_msr); 88 assert_bit_set(msr, RQM); 89 assert_bit_clear(msr, DIO); 90 91 outb(FLOPPY_BASE + reg_fifo, byte); 92 } 93 94 static uint8_t floppy_recv(void) 95 { 96 uint8_t msr; 97 98 msr = inb(FLOPPY_BASE + reg_msr); 99 assert_bit_set(msr, RQM | DIO); 100 101 return inb(FLOPPY_BASE + reg_fifo); 102 } 103 104 /* pcn: Present Cylinder Number */ 105 static void ack_irq(uint8_t *pcn) 106 { 107 uint8_t ret; 108 109 g_assert(get_irq(FLOPPY_IRQ)); 110 floppy_send(CMD_SENSE_INT); 111 floppy_recv(); 112 113 ret = floppy_recv(); 114 if (pcn != NULL) { 115 *pcn = ret; 116 } 117 118 g_assert(!get_irq(FLOPPY_IRQ)); 119 } 120 121 static uint8_t send_read_command(uint8_t cmd) 122 { 123 uint8_t drive = 0; 124 uint8_t head = 0; 125 uint8_t cyl = 0; 126 uint8_t sect_addr = 1; 127 uint8_t sect_size = 2; 128 uint8_t eot = 1; 129 uint8_t gap = 0x1b; 130 uint8_t gpl = 0xff; 131 132 uint8_t msr = 0; 133 uint8_t st0; 134 135 uint8_t ret = 0; 136 137 floppy_send(cmd); 138 floppy_send(head << 2 | drive); 139 g_assert(!get_irq(FLOPPY_IRQ)); 140 floppy_send(cyl); 141 floppy_send(head); 142 floppy_send(sect_addr); 143 floppy_send(sect_size); 144 floppy_send(eot); 145 floppy_send(gap); 146 floppy_send(gpl); 147 148 uint8_t i = 0; 149 uint8_t n = 2; 150 for (; i < n; i++) { 151 msr = inb(FLOPPY_BASE + reg_msr); 152 if (msr == 0xd0) { 153 break; 154 } 155 sleep(1); 156 } 157 158 if (i >= n) { 159 return 1; 160 } 161 162 st0 = floppy_recv(); 163 if (st0 != 0x40) { 164 ret = 1; 165 } 166 167 floppy_recv(); 168 floppy_recv(); 169 floppy_recv(); 170 floppy_recv(); 171 floppy_recv(); 172 floppy_recv(); 173 174 return ret; 175 } 176 177 static uint8_t send_read_no_dma_command(int nb_sect, uint8_t expected_st0) 178 { 179 uint8_t drive = 0; 180 uint8_t head = 0; 181 uint8_t cyl = 0; 182 uint8_t sect_addr = 1; 183 uint8_t sect_size = 2; 184 uint8_t eot = nb_sect; 185 uint8_t gap = 0x1b; 186 uint8_t gpl = 0xff; 187 188 uint8_t msr = 0; 189 uint8_t st0; 190 191 uint8_t ret = 0; 192 193 floppy_send(CMD_READ); 194 floppy_send(head << 2 | drive); 195 g_assert(!get_irq(FLOPPY_IRQ)); 196 floppy_send(cyl); 197 floppy_send(head); 198 floppy_send(sect_addr); 199 floppy_send(sect_size); 200 floppy_send(eot); 201 floppy_send(gap); 202 floppy_send(gpl); 203 204 uint16_t i = 0; 205 uint8_t n = 2; 206 for (; i < n; i++) { 207 msr = inb(FLOPPY_BASE + reg_msr); 208 if (msr == (BUSY | NONDMA | DIO | RQM)) { 209 break; 210 } 211 sleep(1); 212 } 213 214 if (i >= n) { 215 return 1; 216 } 217 218 /* Non-DMA mode */ 219 for (i = 0; i < 512 * 2 * nb_sect; i++) { 220 msr = inb(FLOPPY_BASE + reg_msr); 221 assert_bit_set(msr, BUSY | RQM | DIO); 222 inb(FLOPPY_BASE + reg_fifo); 223 } 224 225 msr = inb(FLOPPY_BASE + reg_msr); 226 assert_bit_set(msr, BUSY | RQM | DIO); 227 g_assert(get_irq(FLOPPY_IRQ)); 228 229 st0 = floppy_recv(); 230 if (st0 != expected_st0) { 231 ret = 1; 232 } 233 234 floppy_recv(); 235 floppy_recv(); 236 floppy_recv(); 237 floppy_recv(); 238 floppy_recv(); 239 g_assert(get_irq(FLOPPY_IRQ)); 240 floppy_recv(); 241 242 /* Check that we're back in command phase */ 243 msr = inb(FLOPPY_BASE + reg_msr); 244 assert_bit_clear(msr, BUSY | DIO); 245 assert_bit_set(msr, RQM); 246 g_assert(!get_irq(FLOPPY_IRQ)); 247 248 return ret; 249 } 250 251 static void send_seek(int cyl) 252 { 253 int drive = 0; 254 int head = 0; 255 256 floppy_send(CMD_SEEK); 257 floppy_send(head << 2 | drive); 258 g_assert(!get_irq(FLOPPY_IRQ)); 259 floppy_send(cyl); 260 ack_irq(NULL); 261 } 262 263 static uint8_t cmos_read(uint8_t reg) 264 { 265 outb(base + 0, reg); 266 return inb(base + 1); 267 } 268 269 static void test_cmos(void) 270 { 271 uint8_t cmos; 272 273 cmos = cmos_read(CMOS_FLOPPY); 274 g_assert(cmos == 0x40 || cmos == 0x50); 275 } 276 277 static void test_no_media_on_start(void) 278 { 279 uint8_t dir; 280 281 /* Media changed bit must be set all time after start if there is 282 * no media in drive. */ 283 dir = inb(FLOPPY_BASE + reg_dir); 284 assert_bit_set(dir, DSKCHG); 285 dir = inb(FLOPPY_BASE + reg_dir); 286 assert_bit_set(dir, DSKCHG); 287 send_seek(1); 288 dir = inb(FLOPPY_BASE + reg_dir); 289 assert_bit_set(dir, DSKCHG); 290 dir = inb(FLOPPY_BASE + reg_dir); 291 assert_bit_set(dir, DSKCHG); 292 } 293 294 static void test_read_without_media(void) 295 { 296 uint8_t ret; 297 298 ret = send_read_command(CMD_READ); 299 g_assert(ret == 0); 300 } 301 302 static void test_media_insert(void) 303 { 304 uint8_t dir; 305 306 /* Insert media in drive. DSKCHK should not be reset until a step pulse 307 * is sent. */ 308 qmp_discard_response("{'execute':'blockdev-change-medium', 'arguments':{" 309 " 'id':'floppy0', 'filename': %s, 'format': 'raw' }}", 310 test_image); 311 312 dir = inb(FLOPPY_BASE + reg_dir); 313 assert_bit_set(dir, DSKCHG); 314 dir = inb(FLOPPY_BASE + reg_dir); 315 assert_bit_set(dir, DSKCHG); 316 317 send_seek(0); 318 dir = inb(FLOPPY_BASE + reg_dir); 319 assert_bit_set(dir, DSKCHG); 320 dir = inb(FLOPPY_BASE + reg_dir); 321 assert_bit_set(dir, DSKCHG); 322 323 /* Step to next track should clear DSKCHG bit. */ 324 send_seek(1); 325 dir = inb(FLOPPY_BASE + reg_dir); 326 assert_bit_clear(dir, DSKCHG); 327 dir = inb(FLOPPY_BASE + reg_dir); 328 assert_bit_clear(dir, DSKCHG); 329 } 330 331 static void test_media_change(void) 332 { 333 uint8_t dir; 334 335 test_media_insert(); 336 337 /* Eject the floppy and check that DSKCHG is set. Reading it out doesn't 338 * reset the bit. */ 339 qmp_discard_response("{'execute':'eject', 'arguments':{" 340 " 'id':'floppy0' }}"); 341 342 dir = inb(FLOPPY_BASE + reg_dir); 343 assert_bit_set(dir, DSKCHG); 344 dir = inb(FLOPPY_BASE + reg_dir); 345 assert_bit_set(dir, DSKCHG); 346 347 send_seek(0); 348 dir = inb(FLOPPY_BASE + reg_dir); 349 assert_bit_set(dir, DSKCHG); 350 dir = inb(FLOPPY_BASE + reg_dir); 351 assert_bit_set(dir, DSKCHG); 352 353 send_seek(1); 354 dir = inb(FLOPPY_BASE + reg_dir); 355 assert_bit_set(dir, DSKCHG); 356 dir = inb(FLOPPY_BASE + reg_dir); 357 assert_bit_set(dir, DSKCHG); 358 } 359 360 static void test_sense_interrupt(void) 361 { 362 int drive = 0; 363 int head = 0; 364 int cyl = 0; 365 int ret = 0; 366 367 floppy_send(CMD_SENSE_INT); 368 ret = floppy_recv(); 369 g_assert(ret == 0x80); 370 371 floppy_send(CMD_SEEK); 372 floppy_send(head << 2 | drive); 373 g_assert(!get_irq(FLOPPY_IRQ)); 374 floppy_send(cyl); 375 376 floppy_send(CMD_SENSE_INT); 377 ret = floppy_recv(); 378 g_assert(ret == 0x20); 379 floppy_recv(); 380 } 381 382 static void test_relative_seek(void) 383 { 384 uint8_t drive = 0; 385 uint8_t head = 0; 386 uint8_t cyl = 1; 387 uint8_t pcn; 388 389 /* Send seek to track 0 */ 390 send_seek(0); 391 392 /* Send relative seek to increase track by 1 */ 393 floppy_send(CMD_RELATIVE_SEEK_IN); 394 floppy_send(head << 2 | drive); 395 g_assert(!get_irq(FLOPPY_IRQ)); 396 floppy_send(cyl); 397 398 ack_irq(&pcn); 399 g_assert(pcn == 1); 400 401 /* Send relative seek to decrease track by 1 */ 402 floppy_send(CMD_RELATIVE_SEEK_OUT); 403 floppy_send(head << 2 | drive); 404 g_assert(!get_irq(FLOPPY_IRQ)); 405 floppy_send(cyl); 406 407 ack_irq(&pcn); 408 g_assert(pcn == 0); 409 } 410 411 static void test_read_id(void) 412 { 413 uint8_t drive = 0; 414 uint8_t head = 0; 415 uint8_t cyl; 416 uint8_t st0; 417 uint8_t msr; 418 419 /* Seek to track 0 and check with READ ID */ 420 send_seek(0); 421 422 floppy_send(CMD_READ_ID); 423 g_assert(!get_irq(FLOPPY_IRQ)); 424 floppy_send(head << 2 | drive); 425 426 msr = inb(FLOPPY_BASE + reg_msr); 427 if (!get_irq(FLOPPY_IRQ)) { 428 assert_bit_set(msr, BUSY); 429 assert_bit_clear(msr, RQM); 430 } 431 432 while (!get_irq(FLOPPY_IRQ)) { 433 /* qemu involves a timer with READ ID... */ 434 clock_step(1000000000LL / 50); 435 } 436 437 msr = inb(FLOPPY_BASE + reg_msr); 438 assert_bit_set(msr, BUSY | RQM | DIO); 439 440 st0 = floppy_recv(); 441 floppy_recv(); 442 floppy_recv(); 443 cyl = floppy_recv(); 444 head = floppy_recv(); 445 floppy_recv(); 446 g_assert(get_irq(FLOPPY_IRQ)); 447 floppy_recv(); 448 g_assert(!get_irq(FLOPPY_IRQ)); 449 450 g_assert_cmpint(cyl, ==, 0); 451 g_assert_cmpint(head, ==, 0); 452 g_assert_cmpint(st0, ==, head << 2); 453 454 /* Seek to track 8 on head 1 and check with READ ID */ 455 head = 1; 456 cyl = 8; 457 458 floppy_send(CMD_SEEK); 459 floppy_send(head << 2 | drive); 460 g_assert(!get_irq(FLOPPY_IRQ)); 461 floppy_send(cyl); 462 g_assert(get_irq(FLOPPY_IRQ)); 463 ack_irq(NULL); 464 465 floppy_send(CMD_READ_ID); 466 g_assert(!get_irq(FLOPPY_IRQ)); 467 floppy_send(head << 2 | drive); 468 469 msr = inb(FLOPPY_BASE + reg_msr); 470 if (!get_irq(FLOPPY_IRQ)) { 471 assert_bit_set(msr, BUSY); 472 assert_bit_clear(msr, RQM); 473 } 474 475 while (!get_irq(FLOPPY_IRQ)) { 476 /* qemu involves a timer with READ ID... */ 477 clock_step(1000000000LL / 50); 478 } 479 480 msr = inb(FLOPPY_BASE + reg_msr); 481 assert_bit_set(msr, BUSY | RQM | DIO); 482 483 st0 = floppy_recv(); 484 floppy_recv(); 485 floppy_recv(); 486 cyl = floppy_recv(); 487 head = floppy_recv(); 488 floppy_recv(); 489 g_assert(get_irq(FLOPPY_IRQ)); 490 floppy_recv(); 491 g_assert(!get_irq(FLOPPY_IRQ)); 492 493 g_assert_cmpint(cyl, ==, 8); 494 g_assert_cmpint(head, ==, 1); 495 g_assert_cmpint(st0, ==, head << 2); 496 } 497 498 static void test_read_no_dma_1(void) 499 { 500 uint8_t ret; 501 502 outb(FLOPPY_BASE + reg_dor, inb(FLOPPY_BASE + reg_dor) & ~0x08); 503 send_seek(0); 504 ret = send_read_no_dma_command(1, 0x04); 505 g_assert(ret == 0); 506 } 507 508 static void test_read_no_dma_18(void) 509 { 510 uint8_t ret; 511 512 outb(FLOPPY_BASE + reg_dor, inb(FLOPPY_BASE + reg_dor) & ~0x08); 513 send_seek(0); 514 ret = send_read_no_dma_command(18, 0x04); 515 g_assert(ret == 0); 516 } 517 518 static void test_read_no_dma_19(void) 519 { 520 uint8_t ret; 521 522 outb(FLOPPY_BASE + reg_dor, inb(FLOPPY_BASE + reg_dor) & ~0x08); 523 send_seek(0); 524 ret = send_read_no_dma_command(19, 0x20); 525 g_assert(ret == 0); 526 } 527 528 static void test_verify(void) 529 { 530 uint8_t ret; 531 532 ret = send_read_command(CMD_VERIFY); 533 g_assert(ret == 0); 534 } 535 536 /* success if no crash or abort */ 537 static void fuzz_registers(void) 538 { 539 unsigned int i; 540 541 for (i = 0; i < 1000; i++) { 542 uint8_t reg, val; 543 544 reg = (uint8_t)g_test_rand_int_range(0, 8); 545 val = (uint8_t)g_test_rand_int_range(0, 256); 546 547 outb(FLOPPY_BASE + reg, val); 548 inb(FLOPPY_BASE + reg); 549 } 550 } 551 552 static bool qtest_check_clang_sanitizer(void) 553 { 554 #if defined(__SANITIZE_ADDRESS__) || __has_feature(address_sanitizer) 555 return true; 556 #else 557 g_test_skip("QEMU not configured using --enable-sanitizers"); 558 return false; 559 #endif 560 } 561 static void test_cve_2021_20196(void) 562 { 563 QTestState *s; 564 565 if (!qtest_check_clang_sanitizer()) { 566 return; 567 } 568 569 s = qtest_initf("-nographic -m 32M -nodefaults " DRIVE_FLOPPY_BLANK); 570 571 qtest_outw(s, 0x3f4, 0x0500); 572 qtest_outb(s, 0x3f5, 0x00); 573 qtest_outb(s, 0x3f5, 0x00); 574 qtest_outw(s, 0x3f4, 0x0000); 575 qtest_outb(s, 0x3f5, 0x00); 576 qtest_outw(s, 0x3f1, 0x0400); 577 qtest_outw(s, 0x3f4, 0x0000); 578 qtest_outw(s, 0x3f4, 0x0000); 579 qtest_outb(s, 0x3f5, 0x00); 580 qtest_outb(s, 0x3f5, 0x01); 581 qtest_outw(s, 0x3f1, 0x0500); 582 qtest_outb(s, 0x3f5, 0x00); 583 qtest_quit(s); 584 } 585 586 int main(int argc, char **argv) 587 { 588 int fd; 589 int ret; 590 591 /* Create a temporary raw image */ 592 fd = mkstemp(test_image); 593 g_assert(fd >= 0); 594 ret = ftruncate(fd, TEST_IMAGE_SIZE); 595 g_assert(ret == 0); 596 close(fd); 597 598 /* Run the tests */ 599 g_test_init(&argc, &argv, NULL); 600 601 qtest_start("-device floppy,id=floppy0"); 602 qtest_irq_intercept_in(global_qtest, "ioapic"); 603 qtest_add_func("/fdc/cmos", test_cmos); 604 qtest_add_func("/fdc/no_media_on_start", test_no_media_on_start); 605 qtest_add_func("/fdc/read_without_media", test_read_without_media); 606 qtest_add_func("/fdc/media_change", test_media_change); 607 qtest_add_func("/fdc/sense_interrupt", test_sense_interrupt); 608 qtest_add_func("/fdc/relative_seek", test_relative_seek); 609 qtest_add_func("/fdc/read_id", test_read_id); 610 qtest_add_func("/fdc/verify", test_verify); 611 qtest_add_func("/fdc/media_insert", test_media_insert); 612 qtest_add_func("/fdc/read_no_dma_1", test_read_no_dma_1); 613 qtest_add_func("/fdc/read_no_dma_18", test_read_no_dma_18); 614 qtest_add_func("/fdc/read_no_dma_19", test_read_no_dma_19); 615 qtest_add_func("/fdc/fuzz-registers", fuzz_registers); 616 qtest_add_func("/fdc/fuzz/cve_2021_20196", test_cve_2021_20196); 617 618 ret = g_test_run(); 619 620 /* Cleanup */ 621 qtest_end(); 622 unlink(test_image); 623 624 return ret; 625 } 626