| 1 | /* |
| 2 | * QTest testcase for VirtIO SCSI |
| 3 | * |
| 4 | * Copyright (c) 2014 SUSE LINUX Products GmbH |
| 5 | * Copyright (c) 2015 Red Hat Inc. |
| 6 | * |
| 7 | * This work is licensed under the terms of the GNU GPL, version 2 or later. |
| 8 | * See the COPYING file in the top-level directory. |
| 9 | */ |
| 10 | |
| 11 | #include "qemu/osdep.h" |
| 12 | #include "libqtest-single.h" |
| 13 | #include "qemu/module.h" |
| 14 | #include "scsi/constants.h" |
| 15 | #include "libqos/libqos-pc.h" |
| 16 | #include "libqos/libqos-spapr.h" |
| 17 | #include "libqos/virtio.h" |
| 18 | #include "libqos/virtio-pci.h" |
| 19 | #include "standard-headers/linux/virtio_ids.h" |
| 20 | #include "standard-headers/linux/virtio_pci.h" |
| 21 | #include "standard-headers/linux/virtio_scsi.h" |
| 22 | #include "libqos/virtio-scsi.h" |
| 23 | #include "libqos/qgraph.h" |
| 24 | |
| 25 | #define PCI_SLOT 0x02 |
| 26 | #define PCI_FN 0x00 |
| 27 | #define QVIRTIO_SCSI_TIMEOUT_US (1 * 1000 * 1000) |
| 28 | |
| 29 | #define MAX_NUM_QUEUES 64 |
| 30 | |
| 31 | typedef struct { |
| 32 | QVirtioDevice *dev; |
| 33 | int num_queues; |
| 34 | QVirtQueue *vq[MAX_NUM_QUEUES + 2]; |
| 35 | } QVirtioSCSIQueues; |
| 36 | |
| 37 | static QGuestAllocator *alloc; |
| 38 | |
| 39 | static void qvirtio_scsi_pci_free(QVirtioSCSIQueues *vs) |
| 40 | { |
| 41 | int i; |
| 42 | |
| 43 | for (i = 0; i < vs->num_queues + 2; i++) { |
| 44 | qvirtqueue_cleanup(vs->dev->bus, vs->vq[i], alloc); |
| 45 | } |
| 46 | g_free(vs); |
| 47 | } |
| 48 | |
| 49 | static uint64_t qvirtio_scsi_alloc(QVirtioSCSIQueues *vs, size_t alloc_size, |
| 50 | const void *data) |
| 51 | { |
| 52 | uint64_t addr; |
| 53 | |
| 54 | addr = guest_alloc(alloc, alloc_size); |
| 55 | if (data) { |
| 56 | memwrite(addr, data, alloc_size); |
| 57 | } |
| 58 | |
| 59 | return addr; |
| 60 | } |
| 61 | |
| 62 | static uint8_t virtio_scsi_do_command(QVirtioSCSIQueues *vs, |
| 63 | const uint8_t *cdb, |
| 64 | const uint8_t *data_in, |
| 65 | size_t data_in_len, |
| 66 | uint8_t *data_out, size_t data_out_len, |
| 67 | struct virtio_scsi_cmd_resp *resp_out) |
| 68 | { |
| 69 | QVirtQueue *vq; |
| 70 | struct virtio_scsi_cmd_req req = { { 0 } }; |
| 71 | struct virtio_scsi_cmd_resp resp = { .response = 0xff, .status = 0xff }; |
| 72 | uint64_t req_addr, resp_addr, data_in_addr = 0, data_out_addr = 0; |
| 73 | uint8_t response; |
| 74 | uint32_t free_head; |
| 75 | QTestState *qts = global_qtest; |
| 76 | |
| 77 | vq = vs->vq[2]; |
| 78 | |
| 79 | req.lun[0] = 1; /* Select LUN */ |
| 80 | req.lun[1] = 1; /* Select target 1 */ |
| 81 | memcpy(req.cdb, cdb, VIRTIO_SCSI_CDB_SIZE); |
| 82 | |
| 83 | /* XXX: Fix endian if any multi-byte field in req/resp is used */ |
| 84 | |
| 85 | /* Add request header */ |
| 86 | req_addr = qvirtio_scsi_alloc(vs, sizeof(req), &req); |
| 87 | free_head = qvirtqueue_add(qts, vq, req_addr, sizeof(req), false, true); |
| 88 | |
| 89 | if (data_out_len) { |
| 90 | data_out_addr = qvirtio_scsi_alloc(vs, data_out_len, data_out); |
| 91 | qvirtqueue_add(qts, vq, data_out_addr, data_out_len, false, true); |
| 92 | } |
| 93 | |
| 94 | /* Add response header */ |
| 95 | resp_addr = qvirtio_scsi_alloc(vs, sizeof(resp), &resp); |
| 96 | qvirtqueue_add(qts, vq, resp_addr, sizeof(resp), true, !!data_in_len); |
| 97 | |
| 98 | if (data_in_len) { |
| 99 | data_in_addr = qvirtio_scsi_alloc(vs, data_in_len, data_in); |
| 100 | qvirtqueue_add(qts, vq, data_in_addr, data_in_len, true, false); |
| 101 | } |
| 102 | |
| 103 | qvirtqueue_kick(qts, vs->dev, vq, free_head); |
| 104 | qvirtio_wait_used_elem(qts, vs->dev, vq, free_head, NULL, |
| 105 | QVIRTIO_SCSI_TIMEOUT_US); |
| 106 | |
| 107 | response = readb(resp_addr + |
| 108 | offsetof(struct virtio_scsi_cmd_resp, response)); |
| 109 | |
| 110 | if (resp_out) { |
| 111 | memread(resp_addr, resp_out, sizeof(*resp_out)); |
| 112 | } |
| 113 | |
| 114 | guest_free(alloc, req_addr); |
| 115 | guest_free(alloc, resp_addr); |
| 116 | guest_free(alloc, data_in_addr); |
| 117 | guest_free(alloc, data_out_addr); |
| 118 | return response; |
| 119 | } |
| 120 | |
| 121 | static QVirtioSCSIQueues *qvirtio_scsi_init(QVirtioDevice *dev) |
| 122 | { |
| 123 | QVirtioSCSIQueues *vs; |
| 124 | const uint8_t test_unit_ready_cdb[VIRTIO_SCSI_CDB_SIZE] = {}; |
| 125 | struct virtio_scsi_cmd_resp resp; |
| 126 | uint64_t features; |
| 127 | int i; |
| 128 | |
| 129 | vs = g_new0(QVirtioSCSIQueues, 1); |
| 130 | vs->dev = dev; |
| 131 | |
| 132 | features = qvirtio_get_features(dev); |
| 133 | features &= ~(QVIRTIO_F_BAD_FEATURE | (1ull << VIRTIO_RING_F_EVENT_IDX)); |
| 134 | qvirtio_set_features(dev, features); |
| 135 | |
| 136 | vs->num_queues = qvirtio_config_readl(dev, 0); |
| 137 | |
| 138 | g_assert_cmpint(vs->num_queues, <, MAX_NUM_QUEUES); |
| 139 | |
| 140 | for (i = 0; i < vs->num_queues + 2; i++) { |
| 141 | vs->vq[i] = qvirtqueue_setup(dev, alloc, i); |
| 142 | } |
| 143 | |
| 144 | qvirtio_set_driver_ok(dev); |
| 145 | |
| 146 | /* Clear the POWER ON OCCURRED unit attention */ |
| 147 | g_assert_cmpint(virtio_scsi_do_command(vs, test_unit_ready_cdb, |
| 148 | NULL, 0, NULL, 0, &resp), |
| 149 | ==, 0); |
| 150 | g_assert_cmpint(resp.status, ==, CHECK_CONDITION); |
| 151 | g_assert_cmpint(resp.sense[0], ==, 0x70); /* Fixed format sense buffer */ |
| 152 | g_assert_cmpint(resp.sense[2], ==, UNIT_ATTENTION); |
| 153 | g_assert_cmpint(resp.sense[12], ==, 0x29); /* POWER ON */ |
| 154 | g_assert_cmpint(resp.sense[13], ==, 0x00); |
| 155 | |
| 156 | return vs; |
| 157 | } |
| 158 | |
| 159 | static void hotplug(void *obj, void *data, QGuestAllocator *t_alloc) |
| 160 | { |
| 161 | QTestState *qts = global_qtest; |
| 162 | |
| 163 | qtest_qmp_device_add(qts, "scsi-hd", "scsihd", "{'drive': 'drv1'}"); |
| 164 | qtest_qmp_device_del(qts, "scsihd"); |
| 165 | } |
| 166 | |
| 167 | /* Test WRITE SAME with the lba not aligned */ |
| 168 | static void test_unaligned_write_same(void *obj, void *data, |
| 169 | QGuestAllocator *t_alloc) |
| 170 | { |
| 171 | QVirtioSCSI *scsi = obj; |
| 172 | QVirtioSCSIQueues *vs; |
| 173 | uint8_t buf1[512] = { 0 }; |
| 174 | uint8_t buf2[512] = { 1 }; |
| 175 | const uint8_t write_same_cdb_1[VIRTIO_SCSI_CDB_SIZE] = { |
| 176 | 0x41, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x02, 0x00 |
| 177 | }; |
| 178 | const uint8_t write_same_cdb_2[VIRTIO_SCSI_CDB_SIZE] = { |
| 179 | 0x41, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x33, 0x00, 0x00 |
| 180 | }; |
| 181 | const uint8_t write_same_cdb_ndob[VIRTIO_SCSI_CDB_SIZE] = { |
| 182 | 0x41, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x33, 0x00, 0x00 |
| 183 | }; |
| 184 | |
| 185 | alloc = t_alloc; |
| 186 | vs = qvirtio_scsi_init(scsi->vdev); |
| 187 | |
| 188 | g_assert_cmphex(0, ==, |
| 189 | virtio_scsi_do_command(vs, write_same_cdb_1, NULL, 0, buf1, 512, |
| 190 | NULL)); |
| 191 | |
| 192 | g_assert_cmphex(0, ==, |
| 193 | virtio_scsi_do_command(vs, write_same_cdb_2, NULL, 0, buf2, 512, |
| 194 | NULL)); |
| 195 | |
| 196 | g_assert_cmphex(0, ==, |
| 197 | virtio_scsi_do_command(vs, write_same_cdb_ndob, NULL, 0, NULL, 0, |
| 198 | NULL)); |
| 199 | |
| 200 | qvirtio_scsi_pci_free(vs); |
| 201 | } |
| 202 | |
| 203 | /* Test UNMAP with a large LBA, issue #345 */ |
| 204 | static void test_unmap_large_lba(void *obj, void *data, |
| 205 | QGuestAllocator *t_alloc) |
| 206 | { |
| 207 | QVirtioSCSI *scsi = obj; |
| 208 | QVirtioSCSIQueues *vs; |
| 209 | const uint8_t unmap[VIRTIO_SCSI_CDB_SIZE] = { |
| 210 | 0x42, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0x00 |
| 211 | }; |
| 212 | |
| 213 | /* |
| 214 | * Default null-co device size is 2**30 |
| 215 | * LBA 0x7fff is ~ 1/8 into device, with 4k blocks |
| 216 | * if check_lba_range incorrectly using 512 bytes, will trigger sense error |
| 217 | */ |
| 218 | uint8_t unmap_params[0x18] = { |
| 219 | 0x00, 0x16, /* unmap data length */ |
| 220 | 0x00, 0x10, /* unmap block descriptor data length */ |
| 221 | 0x00, 0x00, 0x00, 0x00, /* reserved */ |
| 222 | 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x7f, 0xff, /* LBA */ |
| 223 | 0x00, 0x00, 0x03, 0xff, /* sector count */ |
| 224 | 0x00, 0x00, 0x00, 0x00, /* reserved */ |
| 225 | }; |
| 226 | struct virtio_scsi_cmd_resp resp; |
| 227 | |
| 228 | alloc = t_alloc; |
| 229 | vs = qvirtio_scsi_init(scsi->vdev); |
| 230 | |
| 231 | virtio_scsi_do_command(vs, unmap, NULL, 0, unmap_params, |
| 232 | sizeof(unmap_params), &resp); |
| 233 | g_assert_cmphex(resp.response, ==, 0); |
| 234 | g_assert_cmphex(resp.status, !=, CHECK_CONDITION); |
| 235 | |
| 236 | qvirtio_scsi_pci_free(vs); |
| 237 | } |
| 238 | |
| 239 | static void test_write_to_cdrom(void *obj, void *data, |
| 240 | QGuestAllocator *t_alloc) |
| 241 | { |
| 242 | QVirtioSCSI *scsi = obj; |
| 243 | QVirtioSCSIQueues *vs; |
| 244 | uint8_t buf[2048] = { 0 }; |
| 245 | const uint8_t write_cdb[VIRTIO_SCSI_CDB_SIZE] = { |
| 246 | /* WRITE(10) to LBA 0, transfer length 1 */ |
| 247 | 0x2a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00 |
| 248 | }; |
| 249 | struct virtio_scsi_cmd_resp resp; |
| 250 | |
| 251 | alloc = t_alloc; |
| 252 | vs = qvirtio_scsi_init(scsi->vdev); |
| 253 | |
| 254 | virtio_scsi_do_command(vs, write_cdb, NULL, 0, buf, 2048, &resp); |
| 255 | g_assert_cmphex(resp.response, ==, 0); |
| 256 | g_assert_cmphex(resp.status, ==, CHECK_CONDITION); |
| 257 | g_assert_cmphex(resp.sense[0], ==, 0x70); |
| 258 | g_assert_cmphex(resp.sense[2], ==, DATA_PROTECT); |
| 259 | g_assert_cmphex(resp.sense[12], ==, 0x27); /* WRITE PROTECTED */ |
| 260 | g_assert_cmphex(resp.sense[13], ==, 0x00); /* WRITE PROTECTED */ |
| 261 | |
| 262 | qvirtio_scsi_pci_free(vs); |
| 263 | } |
| 264 | |
| 265 | static void test_iothread_attach_node(void *obj, void *data, |
| 266 | QGuestAllocator *t_alloc) |
| 267 | { |
| 268 | QVirtioSCSIPCI *scsi_pci = obj; |
| 269 | QVirtioSCSI *scsi = &scsi_pci->scsi; |
| 270 | QVirtioSCSIQueues *vs; |
| 271 | g_autofree char *tmp_path = NULL; |
| 272 | int fd; |
| 273 | int ret; |
| 274 | |
| 275 | uint8_t buf[512] = { 0 }; |
| 276 | const uint8_t write_cdb[VIRTIO_SCSI_CDB_SIZE] = { |
| 277 | /* WRITE(10) to LBA 0, transfer length 1 */ |
| 278 | 0x2a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00 |
| 279 | }; |
| 280 | |
| 281 | alloc = t_alloc; |
| 282 | vs = qvirtio_scsi_init(scsi->vdev); |
| 283 | |
| 284 | /* Create a temporary qcow2 overlay*/ |
| 285 | fd = g_file_open_tmp("qtest.XXXXXX", &tmp_path, NULL); |
| 286 | g_assert(fd >= 0); |
| 287 | close(fd); |
| 288 | |
| 289 | if (!have_qemu_img()) { |
| 290 | g_test_message("QTEST_QEMU_IMG not set or qemu-img missing; " |
| 291 | "skipping snapshot test"); |
| 292 | goto fail; |
| 293 | } |
| 294 | |
| 295 | mkqcow2(tmp_path, 64); |
| 296 | |
| 297 | /* Attach the overlay to the null0 node */ |
| 298 | qtest_qmp_assert_success(scsi_pci->pci_vdev.pdev->bus->qts, |
| 299 | "{'execute': 'blockdev-add', 'arguments': {" |
| 300 | " 'driver': 'qcow2', 'node-name': 'overlay'," |
| 301 | " 'backing': 'null0', 'file': {" |
| 302 | " 'driver': 'file', 'filename': %s}}}", |
| 303 | tmp_path); |
| 304 | |
| 305 | /* Send a request to see if the AioContext is still right */ |
| 306 | ret = virtio_scsi_do_command(vs, write_cdb, NULL, 0, buf, 512, NULL); |
| 307 | g_assert_cmphex(ret, ==, 0); |
| 308 | |
| 309 | fail: |
| 310 | qvirtio_scsi_pci_free(vs); |
| 311 | unlink(tmp_path); |
| 312 | } |
| 313 | |
| 314 | static void test_iothread_virtio_error(void *obj, void *data, |
| 315 | QGuestAllocator *t_alloc) |
| 316 | { |
| 317 | QVirtioSCSIPCI *scsi_pci = obj; |
| 318 | QVirtioSCSI *scsi = &scsi_pci->scsi; |
| 319 | QVirtioSCSIQueues *vs; |
| 320 | QVirtQueue *vq; |
| 321 | |
| 322 | alloc = t_alloc; |
| 323 | vs = qvirtio_scsi_init(scsi->vdev); |
| 324 | vq = vs->vq[2]; |
| 325 | |
| 326 | /* Move avail.idx out of bounds to trigger virtio_error() */ |
| 327 | qvirtqueue_set_avail_idx(global_qtest, scsi->vdev, vq, vq->size * 2); |
| 328 | scsi->vdev->bus->virtqueue_kick(scsi->vdev, vq); |
| 329 | |
| 330 | /* |
| 331 | * Reset the device out of the error state. If QEMU hangs or crashes then |
| 332 | * this will fail. |
| 333 | */ |
| 334 | qvirtio_reset(scsi->vdev); |
| 335 | |
| 336 | qvirtio_scsi_pci_free(vs); |
| 337 | } |
| 338 | |
| 339 | static void *virtio_scsi_hotplug_setup(GString *cmd_line, void *arg) |
| 340 | { |
| 341 | g_string_append(cmd_line, |
| 342 | " -drive id=drv1,if=none,file=null-co://," |
| 343 | "file.read-zeroes=on,format=raw"); |
| 344 | return arg; |
| 345 | } |
| 346 | |
| 347 | static void *virtio_scsi_setup(GString *cmd_line, void *arg) |
| 348 | { |
| 349 | g_string_append(cmd_line, |
| 350 | " -drive file=blkdebug::null-co://," |
| 351 | "file.image.read-zeroes=on," |
| 352 | "if=none,id=dr1,format=raw,file.align=4k " |
| 353 | "-device scsi-hd,drive=dr1,lun=0,scsi-id=1"); |
| 354 | return arg; |
| 355 | } |
| 356 | |
| 357 | static void *virtio_scsi_setup_4k(GString *cmd_line, void *arg) |
| 358 | { |
| 359 | g_string_append(cmd_line, |
| 360 | " -drive file=blkdebug::null-co://," |
| 361 | "file.image.read-zeroes=on," |
| 362 | "if=none,id=dr1,format=raw " |
| 363 | "-device scsi-hd,drive=dr1,lun=0,scsi-id=1" |
| 364 | ",logical_block_size=4k,physical_block_size=4k"); |
| 365 | return arg; |
| 366 | } |
| 367 | |
| 368 | static void *virtio_scsi_setup_cd(GString *cmd_line, void *arg) |
| 369 | { |
| 370 | g_string_append(cmd_line, |
| 371 | " -drive file=null-co://," |
| 372 | "file.read-zeroes=on," |
| 373 | "if=none,id=dr1,format=raw " |
| 374 | "-device scsi-cd,drive=dr1,lun=0,scsi-id=1"); |
| 375 | return arg; |
| 376 | } |
| 377 | |
| 378 | static void *virtio_scsi_setup_iothread(GString *cmd_line, void *arg) |
| 379 | { |
| 380 | g_string_append(cmd_line, |
| 381 | " -object iothread,id=thread0" |
| 382 | " -blockdev driver=null-co,read-zeroes=on,node-name=null0" |
| 383 | " -device scsi-hd,drive=null0"); |
| 384 | return arg; |
| 385 | } |
| 386 | |
| 387 | static void register_virtio_scsi_test(void) |
| 388 | { |
| 389 | QOSGraphTestOptions opts = { }; |
| 390 | |
| 391 | opts.before = virtio_scsi_hotplug_setup; |
| 392 | qos_add_test("hotplug", "virtio-scsi", hotplug, &opts); |
| 393 | |
| 394 | opts.before = virtio_scsi_setup; |
| 395 | qos_add_test("unaligned-write-same", "virtio-scsi", |
| 396 | test_unaligned_write_same, &opts); |
| 397 | |
| 398 | opts.before = virtio_scsi_setup_4k; |
| 399 | qos_add_test("large-lba-unmap", "virtio-scsi", |
| 400 | test_unmap_large_lba, &opts); |
| 401 | |
| 402 | opts.before = virtio_scsi_setup_cd; |
| 403 | qos_add_test("write-to-cdrom", "virtio-scsi", test_write_to_cdrom, &opts); |
| 404 | |
| 405 | opts.before = virtio_scsi_setup_iothread; |
| 406 | opts.edge = (QOSGraphEdgeOptions) { |
| 407 | .extra_device_opts = "iothread=thread0", |
| 408 | }; |
| 409 | qos_add_test("iothread-attach-node", "virtio-scsi-pci", |
| 410 | test_iothread_attach_node, &opts); |
| 411 | |
| 412 | opts.before = virtio_scsi_setup_iothread; |
| 413 | opts.edge = (QOSGraphEdgeOptions) { |
| 414 | .extra_device_opts = "iothread=thread0", |
| 415 | }; |
| 416 | qos_add_test("iothread-virtio-error", "virtio-scsi-pci", |
| 417 | test_iothread_virtio_error, &opts); |
| 418 | } |
| 419 | |
| 420 | libqos_init(register_virtio_scsi_test); |