cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

npcm7xx_emc-test.c (27516B)


      1/*
      2 * QTests for Nuvoton NPCM7xx EMC Modules.
      3 *
      4 * Copyright 2020 Google LLC
      5 *
      6 * This program is free software; you can redistribute it and/or modify it
      7 * under the terms of the GNU General Public License as published by the
      8 * Free Software Foundation; either version 2 of the License, or
      9 * (at your option) any later version.
     10 *
     11 * This program is distributed in the hope that it will be useful, but WITHOUT
     12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
     13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
     14 * for more details.
     15 */
     16
     17#include "qemu/osdep.h"
     18#include "qemu-common.h"
     19#include "libqos/libqos.h"
     20#include "qapi/qmp/qdict.h"
     21#include "qapi/qmp/qnum.h"
     22#include "qemu/bitops.h"
     23#include "qemu/iov.h"
     24
     25/* Name of the emc device. */
     26#define TYPE_NPCM7XX_EMC "npcm7xx-emc"
     27
     28/* Timeout for various operations, in seconds. */
     29#define TIMEOUT_SECONDS 10
     30
     31/* Address in memory of the descriptor. */
     32#define DESC_ADDR (1 << 20) /* 1 MiB */
     33
     34/* Address in memory of the data packet. */
     35#define DATA_ADDR (DESC_ADDR + 4096)
     36
     37#define CRC_LENGTH 4
     38
     39#define NUM_TX_DESCRIPTORS 3
     40#define NUM_RX_DESCRIPTORS 2
     41
     42/* Size of tx,rx test buffers. */
     43#define TX_DATA_LEN 64
     44#define RX_DATA_LEN 64
     45
     46#define TX_STEP_COUNT 10000
     47#define RX_STEP_COUNT 10000
     48
     49/* 32-bit register indices. */
     50typedef enum NPCM7xxPWMRegister {
     51    /* Control registers. */
     52    REG_CAMCMR,
     53    REG_CAMEN,
     54
     55    /* There are 16 CAMn[ML] registers. */
     56    REG_CAMM_BASE,
     57    REG_CAML_BASE,
     58
     59    REG_TXDLSA = 0x22,
     60    REG_RXDLSA,
     61    REG_MCMDR,
     62    REG_MIID,
     63    REG_MIIDA,
     64    REG_FFTCR,
     65    REG_TSDR,
     66    REG_RSDR,
     67    REG_DMARFC,
     68    REG_MIEN,
     69
     70    /* Status registers. */
     71    REG_MISTA,
     72    REG_MGSTA,
     73    REG_MPCNT,
     74    REG_MRPC,
     75    REG_MRPCC,
     76    REG_MREPC,
     77    REG_DMARFS,
     78    REG_CTXDSA,
     79    REG_CTXBSA,
     80    REG_CRXDSA,
     81    REG_CRXBSA,
     82
     83    NPCM7XX_NUM_EMC_REGS,
     84} NPCM7xxPWMRegister;
     85
     86enum { NUM_CAMML_REGS = 16 };
     87
     88/* REG_CAMCMR fields */
     89/* Enable CAM Compare */
     90#define REG_CAMCMR_ECMP (1 << 4)
     91/* Accept Unicast Packet */
     92#define REG_CAMCMR_AUP (1 << 0)
     93
     94/* REG_MCMDR fields */
     95/* Software Reset */
     96#define REG_MCMDR_SWR (1 << 24)
     97/* Frame Transmission On */
     98#define REG_MCMDR_TXON (1 << 8)
     99/* Accept Long Packet */
    100#define REG_MCMDR_ALP (1 << 1)
    101/* Frame Reception On */
    102#define REG_MCMDR_RXON (1 << 0)
    103
    104/* REG_MIEN fields */
    105/* Enable Transmit Completion Interrupt */
    106#define REG_MIEN_ENTXCP (1 << 18)
    107/* Enable Transmit Interrupt */
    108#define REG_MIEN_ENTXINTR (1 << 16)
    109/* Enable Receive Good Interrupt */
    110#define REG_MIEN_ENRXGD (1 << 4)
    111/* ENable Receive Interrupt */
    112#define REG_MIEN_ENRXINTR (1 << 0)
    113
    114/* REG_MISTA fields */
    115/* Transmit Bus Error Interrupt */
    116#define REG_MISTA_TXBERR (1 << 24)
    117/* Transmit Descriptor Unavailable Interrupt */
    118#define REG_MISTA_TDU (1 << 23)
    119/* Transmit Completion Interrupt */
    120#define REG_MISTA_TXCP (1 << 18)
    121/* Transmit Interrupt */
    122#define REG_MISTA_TXINTR (1 << 16)
    123/* Receive Bus Error Interrupt */
    124#define REG_MISTA_RXBERR (1 << 11)
    125/* Receive Descriptor Unavailable Interrupt */
    126#define REG_MISTA_RDU (1 << 10)
    127/* DMA Early Notification Interrupt */
    128#define REG_MISTA_DENI (1 << 9)
    129/* Maximum Frame Length Interrupt */
    130#define REG_MISTA_DFOI (1 << 8)
    131/* Receive Good Interrupt */
    132#define REG_MISTA_RXGD (1 << 4)
    133/* Packet Too Long Interrupt */
    134#define REG_MISTA_PTLE (1 << 3)
    135/* Receive Interrupt */
    136#define REG_MISTA_RXINTR (1 << 0)
    137
    138typedef struct NPCM7xxEMCTxDesc NPCM7xxEMCTxDesc;
    139typedef struct NPCM7xxEMCRxDesc NPCM7xxEMCRxDesc;
    140
    141struct NPCM7xxEMCTxDesc {
    142    uint32_t flags;
    143    uint32_t txbsa;
    144    uint32_t status_and_length;
    145    uint32_t ntxdsa;
    146};
    147
    148struct NPCM7xxEMCRxDesc {
    149    uint32_t status_and_length;
    150    uint32_t rxbsa;
    151    uint32_t reserved;
    152    uint32_t nrxdsa;
    153};
    154
    155/* NPCM7xxEMCTxDesc.flags values */
    156/* Owner: 0 = cpu, 1 = emc */
    157#define TX_DESC_FLAG_OWNER_MASK (1 << 31)
    158/* Transmit interrupt enable */
    159#define TX_DESC_FLAG_INTEN (1 << 2)
    160
    161/* NPCM7xxEMCTxDesc.status_and_length values */
    162/* Transmission complete */
    163#define TX_DESC_STATUS_TXCP (1 << 19)
    164/* Transmit interrupt */
    165#define TX_DESC_STATUS_TXINTR (1 << 16)
    166
    167/* NPCM7xxEMCRxDesc.status_and_length values */
    168/* Owner: 0b00 = cpu, 0b10 = emc */
    169#define RX_DESC_STATUS_OWNER_SHIFT 30
    170#define RX_DESC_STATUS_OWNER_MASK 0xc0000000
    171/* Frame Reception Complete */
    172#define RX_DESC_STATUS_RXGD (1 << 20)
    173/* Packet too long */
    174#define RX_DESC_STATUS_PTLE (1 << 19)
    175/* Receive Interrupt */
    176#define RX_DESC_STATUS_RXINTR (1 << 16)
    177
    178#define RX_DESC_PKT_LEN(word) ((uint32_t) (word) & 0xffff)
    179
    180typedef struct EMCModule {
    181    int rx_irq;
    182    int tx_irq;
    183    uint64_t base_addr;
    184} EMCModule;
    185
    186typedef struct TestData {
    187    const EMCModule *module;
    188} TestData;
    189
    190static const EMCModule emc_module_list[] = {
    191    {
    192        .rx_irq     = 15,
    193        .tx_irq     = 16,
    194        .base_addr  = 0xf0825000
    195    },
    196    {
    197        .rx_irq     = 114,
    198        .tx_irq     = 115,
    199        .base_addr  = 0xf0826000
    200    }
    201};
    202
    203/* Returns the index of the EMC module. */
    204static int emc_module_index(const EMCModule *mod)
    205{
    206    ptrdiff_t diff = mod - emc_module_list;
    207
    208    g_assert_true(diff >= 0 && diff < ARRAY_SIZE(emc_module_list));
    209
    210    return diff;
    211}
    212
    213static void packet_test_clear(void *sockets)
    214{
    215    int *test_sockets = sockets;
    216
    217    close(test_sockets[0]);
    218    g_free(test_sockets);
    219}
    220
    221static int *packet_test_init(int module_num, GString *cmd_line)
    222{
    223    int *test_sockets = g_new(int, 2);
    224    int ret = socketpair(PF_UNIX, SOCK_STREAM, 0, test_sockets);
    225    g_assert_cmpint(ret, != , -1);
    226
    227    /*
    228     * KISS and use -nic. We specify two nics (both emc{0,1}) because there's
    229     * currently no way to specify only emc1: The driver implicitly relies on
    230     * emc[i] == nd_table[i].
    231     */
    232    if (module_num == 0) {
    233        g_string_append_printf(cmd_line,
    234                               " -nic socket,fd=%d,model=" TYPE_NPCM7XX_EMC " "
    235                               " -nic user,model=" TYPE_NPCM7XX_EMC " ",
    236                               test_sockets[1]);
    237    } else {
    238        g_string_append_printf(cmd_line,
    239                               " -nic user,model=" TYPE_NPCM7XX_EMC " "
    240                               " -nic socket,fd=%d,model=" TYPE_NPCM7XX_EMC " ",
    241                               test_sockets[1]);
    242    }
    243
    244    g_test_queue_destroy(packet_test_clear, test_sockets);
    245    return test_sockets;
    246}
    247
    248static uint32_t emc_read(QTestState *qts, const EMCModule *mod,
    249                         NPCM7xxPWMRegister regno)
    250{
    251    return qtest_readl(qts, mod->base_addr + regno * sizeof(uint32_t));
    252}
    253
    254static void emc_write(QTestState *qts, const EMCModule *mod,
    255                      NPCM7xxPWMRegister regno, uint32_t value)
    256{
    257    qtest_writel(qts, mod->base_addr + regno * sizeof(uint32_t), value);
    258}
    259
    260static void emc_read_tx_desc(QTestState *qts, uint32_t addr,
    261                             NPCM7xxEMCTxDesc *desc)
    262{
    263    qtest_memread(qts, addr, desc, sizeof(*desc));
    264    desc->flags = le32_to_cpu(desc->flags);
    265    desc->txbsa = le32_to_cpu(desc->txbsa);
    266    desc->status_and_length = le32_to_cpu(desc->status_and_length);
    267    desc->ntxdsa = le32_to_cpu(desc->ntxdsa);
    268}
    269
    270static void emc_write_tx_desc(QTestState *qts, const NPCM7xxEMCTxDesc *desc,
    271                              uint32_t addr)
    272{
    273    NPCM7xxEMCTxDesc le_desc;
    274
    275    le_desc.flags = cpu_to_le32(desc->flags);
    276    le_desc.txbsa = cpu_to_le32(desc->txbsa);
    277    le_desc.status_and_length = cpu_to_le32(desc->status_and_length);
    278    le_desc.ntxdsa = cpu_to_le32(desc->ntxdsa);
    279    qtest_memwrite(qts, addr, &le_desc, sizeof(le_desc));
    280}
    281
    282static void emc_read_rx_desc(QTestState *qts, uint32_t addr,
    283                             NPCM7xxEMCRxDesc *desc)
    284{
    285    qtest_memread(qts, addr, desc, sizeof(*desc));
    286    desc->status_and_length = le32_to_cpu(desc->status_and_length);
    287    desc->rxbsa = le32_to_cpu(desc->rxbsa);
    288    desc->reserved = le32_to_cpu(desc->reserved);
    289    desc->nrxdsa = le32_to_cpu(desc->nrxdsa);
    290}
    291
    292static void emc_write_rx_desc(QTestState *qts, const NPCM7xxEMCRxDesc *desc,
    293                              uint32_t addr)
    294{
    295    NPCM7xxEMCRxDesc le_desc;
    296
    297    le_desc.status_and_length = cpu_to_le32(desc->status_and_length);
    298    le_desc.rxbsa = cpu_to_le32(desc->rxbsa);
    299    le_desc.reserved = cpu_to_le32(desc->reserved);
    300    le_desc.nrxdsa = cpu_to_le32(desc->nrxdsa);
    301    qtest_memwrite(qts, addr, &le_desc, sizeof(le_desc));
    302}
    303
    304/*
    305 * Reset the EMC module.
    306 * The module must be reset before, e.g., TXDLSA,RXDLSA are changed.
    307 */
    308static bool emc_soft_reset(QTestState *qts, const EMCModule *mod)
    309{
    310    uint32_t val;
    311    uint64_t end_time;
    312
    313    emc_write(qts, mod, REG_MCMDR, REG_MCMDR_SWR);
    314
    315    /*
    316     * Wait for device to reset as the linux driver does.
    317     * During reset the AHB reads 0 for all registers. So first wait for
    318     * something that resets to non-zero, and then wait for SWR becoming 0.
    319     */
    320    end_time = g_get_monotonic_time() + TIMEOUT_SECONDS * G_TIME_SPAN_SECOND;
    321
    322    do {
    323        qtest_clock_step(qts, 100);
    324        val = emc_read(qts, mod, REG_FFTCR);
    325    } while (val == 0 && g_get_monotonic_time() < end_time);
    326    if (val != 0) {
    327        do {
    328            qtest_clock_step(qts, 100);
    329            val = emc_read(qts, mod, REG_MCMDR);
    330            if ((val & REG_MCMDR_SWR) == 0) {
    331                /*
    332                 * N.B. The CAMs have been reset here, so macaddr matching of
    333                 * incoming packets will not work.
    334                 */
    335                return true;
    336            }
    337        } while (g_get_monotonic_time() < end_time);
    338    }
    339
    340    g_message("%s: Timeout expired", __func__);
    341    return false;
    342}
    343
    344/* Check emc registers are reset to default value. */
    345static void test_init(gconstpointer test_data)
    346{
    347    const TestData *td = test_data;
    348    const EMCModule *mod = td->module;
    349    QTestState *qts = qtest_init("-machine quanta-gsj");
    350    int i;
    351
    352#define CHECK_REG(regno, value) \
    353  do { \
    354    g_assert_cmphex(emc_read(qts, mod, (regno)), ==, (value)); \
    355  } while (0)
    356
    357    CHECK_REG(REG_CAMCMR, 0);
    358    CHECK_REG(REG_CAMEN, 0);
    359    CHECK_REG(REG_TXDLSA, 0xfffffffc);
    360    CHECK_REG(REG_RXDLSA, 0xfffffffc);
    361    CHECK_REG(REG_MCMDR, 0);
    362    CHECK_REG(REG_MIID, 0);
    363    CHECK_REG(REG_MIIDA, 0x00900000);
    364    CHECK_REG(REG_FFTCR, 0x0101);
    365    CHECK_REG(REG_DMARFC, 0x0800);
    366    CHECK_REG(REG_MIEN, 0);
    367    CHECK_REG(REG_MISTA, 0);
    368    CHECK_REG(REG_MGSTA, 0);
    369    CHECK_REG(REG_MPCNT, 0x7fff);
    370    CHECK_REG(REG_MRPC, 0);
    371    CHECK_REG(REG_MRPCC, 0);
    372    CHECK_REG(REG_MREPC, 0);
    373    CHECK_REG(REG_DMARFS, 0);
    374    CHECK_REG(REG_CTXDSA, 0);
    375    CHECK_REG(REG_CTXBSA, 0);
    376    CHECK_REG(REG_CRXDSA, 0);
    377    CHECK_REG(REG_CRXBSA, 0);
    378
    379#undef CHECK_REG
    380
    381    for (i = 0; i < NUM_CAMML_REGS; ++i) {
    382        g_assert_cmpuint(emc_read(qts, mod, REG_CAMM_BASE + i * 2), ==,
    383                         0);
    384        g_assert_cmpuint(emc_read(qts, mod, REG_CAML_BASE + i * 2), ==,
    385                         0);
    386    }
    387
    388    qtest_quit(qts);
    389}
    390
    391static bool emc_wait_irq(QTestState *qts, const EMCModule *mod, int step,
    392                         bool is_tx)
    393{
    394    uint64_t end_time =
    395        g_get_monotonic_time() + TIMEOUT_SECONDS * G_TIME_SPAN_SECOND;
    396
    397    do {
    398        if (qtest_get_irq(qts, is_tx ? mod->tx_irq : mod->rx_irq)) {
    399            return true;
    400        }
    401        qtest_clock_step(qts, step);
    402    } while (g_get_monotonic_time() < end_time);
    403
    404    g_message("%s: Timeout expired", __func__);
    405    return false;
    406}
    407
    408static bool emc_wait_mista(QTestState *qts, const EMCModule *mod, int step,
    409                           uint32_t flag)
    410{
    411    uint64_t end_time =
    412        g_get_monotonic_time() + TIMEOUT_SECONDS * G_TIME_SPAN_SECOND;
    413
    414    do {
    415        uint32_t mista = emc_read(qts, mod, REG_MISTA);
    416        if (mista & flag) {
    417            return true;
    418        }
    419        qtest_clock_step(qts, step);
    420    } while (g_get_monotonic_time() < end_time);
    421
    422    g_message("%s: Timeout expired", __func__);
    423    return false;
    424}
    425
    426static bool wait_socket_readable(int fd)
    427{
    428    fd_set read_fds;
    429    struct timeval tv;
    430    int rv;
    431
    432    FD_ZERO(&read_fds);
    433    FD_SET(fd, &read_fds);
    434    tv.tv_sec = TIMEOUT_SECONDS;
    435    tv.tv_usec = 0;
    436    rv = select(fd + 1, &read_fds, NULL, NULL, &tv);
    437    if (rv == -1) {
    438        perror("select");
    439    } else if (rv == 0) {
    440        g_message("%s: Timeout expired", __func__);
    441    }
    442    return rv == 1;
    443}
    444
    445/* Initialize *desc (in host endian format). */
    446static void init_tx_desc(NPCM7xxEMCTxDesc *desc, size_t count,
    447                         uint32_t desc_addr)
    448{
    449    g_assert(count >= 2);
    450    memset(&desc[0], 0, sizeof(*desc) * count);
    451    /* Leave the last one alone, owned by the cpu -> stops transmission. */
    452    for (size_t i = 0; i < count - 1; ++i) {
    453        desc[i].flags =
    454            (TX_DESC_FLAG_OWNER_MASK | /* owner = 1: emc */
    455             TX_DESC_FLAG_INTEN |
    456             0 | /* crc append = 0 */
    457             0 /* padding enable = 0 */);
    458        desc[i].status_and_length =
    459            (0 | /* collision count = 0 */
    460             0 | /* SQE = 0 */
    461             0 | /* PAU = 0 */
    462             0 | /* TXHA = 0 */
    463             0 | /* LC = 0 */
    464             0 | /* TXABT = 0 */
    465             0 | /* NCS = 0 */
    466             0 | /* EXDEF = 0 */
    467             0 | /* TXCP = 0 */
    468             0 | /* DEF = 0 */
    469             0 | /* TXINTR = 0 */
    470             0 /* length filled in later */);
    471        desc[i].ntxdsa = desc_addr + (i + 1) * sizeof(*desc);
    472    }
    473}
    474
    475static void enable_tx(QTestState *qts, const EMCModule *mod,
    476                      const NPCM7xxEMCTxDesc *desc, size_t count,
    477                      uint32_t desc_addr, uint32_t mien_flags)
    478{
    479    /* Write the descriptors to guest memory. */
    480    for (size_t i = 0; i < count; ++i) {
    481        emc_write_tx_desc(qts, desc + i, desc_addr + i * sizeof(*desc));
    482    }
    483
    484    /* Trigger sending the packet. */
    485    /* The module must be reset before changing TXDLSA. */
    486    g_assert(emc_soft_reset(qts, mod));
    487    emc_write(qts, mod, REG_TXDLSA, desc_addr);
    488    emc_write(qts, mod, REG_CTXDSA, ~0);
    489    emc_write(qts, mod, REG_MIEN, REG_MIEN_ENTXCP | mien_flags);
    490    {
    491        uint32_t mcmdr = emc_read(qts, mod, REG_MCMDR);
    492        mcmdr |= REG_MCMDR_TXON;
    493        emc_write(qts, mod, REG_MCMDR, mcmdr);
    494    }
    495}
    496
    497static void emc_send_verify1(QTestState *qts, const EMCModule *mod, int fd,
    498                             bool with_irq, uint32_t desc_addr,
    499                             uint32_t next_desc_addr,
    500                             const char *test_data, int test_size)
    501{
    502    NPCM7xxEMCTxDesc result_desc;
    503    uint32_t expected_mask, expected_value, recv_len;
    504    int ret;
    505    char buffer[TX_DATA_LEN];
    506
    507    g_assert(wait_socket_readable(fd));
    508
    509    /* Read the descriptor back. */
    510    emc_read_tx_desc(qts, desc_addr, &result_desc);
    511    /* Descriptor should be owned by cpu now. */
    512    g_assert((result_desc.flags & TX_DESC_FLAG_OWNER_MASK) == 0);
    513    /* Test the status bits, ignoring the length field. */
    514    expected_mask = 0xffff << 16;
    515    expected_value = TX_DESC_STATUS_TXCP;
    516    if (with_irq) {
    517        expected_value |= TX_DESC_STATUS_TXINTR;
    518    }
    519    g_assert_cmphex((result_desc.status_and_length & expected_mask), ==,
    520                    expected_value);
    521
    522    /* Check data sent to the backend. */
    523    recv_len = ~0;
    524    ret = qemu_recv(fd, &recv_len, sizeof(recv_len), MSG_DONTWAIT);
    525    g_assert_cmpint(ret, == , sizeof(recv_len));
    526
    527    g_assert(wait_socket_readable(fd));
    528    memset(buffer, 0xff, sizeof(buffer));
    529    ret = qemu_recv(fd, buffer, test_size, MSG_DONTWAIT);
    530    g_assert_cmpmem(buffer, ret, test_data, test_size);
    531}
    532
    533static void emc_send_verify(QTestState *qts, const EMCModule *mod, int fd,
    534                            bool with_irq)
    535{
    536    NPCM7xxEMCTxDesc desc[NUM_TX_DESCRIPTORS];
    537    uint32_t desc_addr = DESC_ADDR;
    538    static const char test1_data[] = "TEST1";
    539    static const char test2_data[] = "Testing 1 2 3 ...";
    540    uint32_t data1_addr = DATA_ADDR;
    541    uint32_t data2_addr = data1_addr + sizeof(test1_data);
    542    bool got_tdu;
    543    uint32_t end_desc_addr;
    544
    545    /* Prepare test data buffer. */
    546    qtest_memwrite(qts, data1_addr, test1_data, sizeof(test1_data));
    547    qtest_memwrite(qts, data2_addr, test2_data, sizeof(test2_data));
    548
    549    init_tx_desc(&desc[0], NUM_TX_DESCRIPTORS, desc_addr);
    550    desc[0].txbsa = data1_addr;
    551    desc[0].status_and_length |= sizeof(test1_data);
    552    desc[1].txbsa = data2_addr;
    553    desc[1].status_and_length |= sizeof(test2_data);
    554
    555    enable_tx(qts, mod, &desc[0], NUM_TX_DESCRIPTORS, desc_addr,
    556              with_irq ? REG_MIEN_ENTXINTR : 0);
    557
    558    /* Prod the device to send the packet. */
    559    emc_write(qts, mod, REG_TSDR, 1);
    560
    561    /*
    562     * It's problematic to observe the interrupt for each packet.
    563     * Instead just wait until all the packets go out.
    564     */
    565    got_tdu = false;
    566    while (!got_tdu) {
    567        if (with_irq) {
    568            g_assert_true(emc_wait_irq(qts, mod, TX_STEP_COUNT,
    569                                       /*is_tx=*/true));
    570        } else {
    571            g_assert_true(emc_wait_mista(qts, mod, TX_STEP_COUNT,
    572                                         REG_MISTA_TXINTR));
    573        }
    574        got_tdu = !!(emc_read(qts, mod, REG_MISTA) & REG_MISTA_TDU);
    575        /* If we don't have TDU yet, reset the interrupt. */
    576        if (!got_tdu) {
    577            emc_write(qts, mod, REG_MISTA,
    578                      emc_read(qts, mod, REG_MISTA) & 0xffff0000);
    579        }
    580    }
    581
    582    end_desc_addr = desc_addr + 2 * sizeof(desc[0]);
    583    g_assert_cmphex(emc_read(qts, mod, REG_CTXDSA), ==, end_desc_addr);
    584    g_assert_cmphex(emc_read(qts, mod, REG_MISTA), ==,
    585                    REG_MISTA_TXCP | REG_MISTA_TXINTR | REG_MISTA_TDU);
    586
    587    emc_send_verify1(qts, mod, fd, with_irq,
    588                     desc_addr, end_desc_addr,
    589                     test1_data, sizeof(test1_data));
    590    emc_send_verify1(qts, mod, fd, with_irq,
    591                     desc_addr + sizeof(desc[0]), end_desc_addr,
    592                     test2_data, sizeof(test2_data));
    593}
    594
    595/* Initialize *desc (in host endian format). */
    596static void init_rx_desc(NPCM7xxEMCRxDesc *desc, size_t count,
    597                         uint32_t desc_addr, uint32_t data_addr)
    598{
    599    g_assert_true(count >= 2);
    600    memset(desc, 0, sizeof(*desc) * count);
    601    desc[0].rxbsa = data_addr;
    602    desc[0].status_and_length =
    603        (0b10 << RX_DESC_STATUS_OWNER_SHIFT | /* owner = 10: emc */
    604         0 | /* RP = 0 */
    605         0 | /* ALIE = 0 */
    606         0 | /* RXGD = 0 */
    607         0 | /* PTLE = 0 */
    608         0 | /* CRCE = 0 */
    609         0 | /* RXINTR = 0 */
    610         0   /* length (filled in later) */);
    611    /* Leave the last one alone, owned by the cpu -> stops transmission. */
    612    desc[0].nrxdsa = desc_addr + sizeof(*desc);
    613}
    614
    615static void enable_rx(QTestState *qts, const EMCModule *mod,
    616                      const NPCM7xxEMCRxDesc *desc, size_t count,
    617                      uint32_t desc_addr, uint32_t mien_flags,
    618                      uint32_t mcmdr_flags)
    619{
    620    /*
    621     * Write the descriptor to guest memory.
    622     * FWIW, IWBN if the docs said the buffer needs to be at least DMARFC
    623     * bytes.
    624     */
    625    for (size_t i = 0; i < count; ++i) {
    626        emc_write_rx_desc(qts, desc + i, desc_addr + i * sizeof(*desc));
    627    }
    628
    629    /* Trigger receiving the packet. */
    630    /* The module must be reset before changing RXDLSA. */
    631    g_assert(emc_soft_reset(qts, mod));
    632    emc_write(qts, mod, REG_RXDLSA, desc_addr);
    633    emc_write(qts, mod, REG_MIEN, REG_MIEN_ENRXGD | mien_flags);
    634
    635    /*
    636     * We don't know what the device's macaddr is, so just accept all
    637     * unicast packets (AUP).
    638     */
    639    emc_write(qts, mod, REG_CAMCMR, REG_CAMCMR_AUP);
    640    emc_write(qts, mod, REG_CAMEN, 1 << 0);
    641    {
    642        uint32_t mcmdr = emc_read(qts, mod, REG_MCMDR);
    643        mcmdr |= REG_MCMDR_RXON | mcmdr_flags;
    644        emc_write(qts, mod, REG_MCMDR, mcmdr);
    645    }
    646}
    647
    648static void emc_recv_verify(QTestState *qts, const EMCModule *mod, int fd,
    649                            bool with_irq, bool pump_rsdr)
    650{
    651    NPCM7xxEMCRxDesc desc[NUM_RX_DESCRIPTORS];
    652    uint32_t desc_addr = DESC_ADDR;
    653    uint32_t data_addr = DATA_ADDR;
    654    int ret;
    655    uint32_t expected_mask, expected_value;
    656    NPCM7xxEMCRxDesc result_desc;
    657
    658    /* Prepare test data buffer. */
    659    const char test[RX_DATA_LEN] = "TEST";
    660    int len = htonl(sizeof(test));
    661    const struct iovec iov[] = {
    662        {
    663            .iov_base = &len,
    664            .iov_len = sizeof(len),
    665        },{
    666            .iov_base = (char *) test,
    667            .iov_len = sizeof(test),
    668        },
    669    };
    670
    671    /*
    672     * Reset the device BEFORE sending a test packet, otherwise the packet
    673     * may get swallowed by an active device of an earlier test.
    674     */
    675    init_rx_desc(&desc[0], NUM_RX_DESCRIPTORS, desc_addr, data_addr);
    676    enable_rx(qts, mod, &desc[0], NUM_RX_DESCRIPTORS, desc_addr,
    677              with_irq ? REG_MIEN_ENRXINTR : 0, 0);
    678
    679    /*
    680     * If requested, prod the device to accept a packet.
    681     * This isn't necessary, the linux driver doesn't do this.
    682     * Test doing/not-doing this for robustness.
    683     */
    684    if (pump_rsdr) {
    685        emc_write(qts, mod, REG_RSDR, 1);
    686    }
    687
    688    /* Send test packet to device's socket. */
    689    ret = iov_send(fd, iov, 2, 0, sizeof(len) + sizeof(test));
    690    g_assert_cmpint(ret, == , sizeof(test) + sizeof(len));
    691
    692    /* Wait for RX interrupt. */
    693    if (with_irq) {
    694        g_assert_true(emc_wait_irq(qts, mod, RX_STEP_COUNT, /*is_tx=*/false));
    695    } else {
    696        g_assert_true(emc_wait_mista(qts, mod, RX_STEP_COUNT, REG_MISTA_RXGD));
    697    }
    698
    699    g_assert_cmphex(emc_read(qts, mod, REG_CRXDSA), ==,
    700                    desc_addr + sizeof(desc[0]));
    701
    702    expected_mask = 0xffff;
    703    expected_value = (REG_MISTA_DENI |
    704                      REG_MISTA_RXGD |
    705                      REG_MISTA_RXINTR);
    706    g_assert_cmphex((emc_read(qts, mod, REG_MISTA) & expected_mask),
    707                    ==, expected_value);
    708
    709    /* Read the descriptor back. */
    710    emc_read_rx_desc(qts, desc_addr, &result_desc);
    711    /* Descriptor should be owned by cpu now. */
    712    g_assert((result_desc.status_and_length & RX_DESC_STATUS_OWNER_MASK) == 0);
    713    /* Test the status bits, ignoring the length field. */
    714    expected_mask = 0xffff << 16;
    715    expected_value = RX_DESC_STATUS_RXGD;
    716    if (with_irq) {
    717        expected_value |= RX_DESC_STATUS_RXINTR;
    718    }
    719    g_assert_cmphex((result_desc.status_and_length & expected_mask), ==,
    720                    expected_value);
    721    g_assert_cmpint(RX_DESC_PKT_LEN(result_desc.status_and_length), ==,
    722                    RX_DATA_LEN + CRC_LENGTH);
    723
    724    {
    725        char buffer[RX_DATA_LEN];
    726        qtest_memread(qts, data_addr, buffer, sizeof(buffer));
    727        g_assert_cmpstr(buffer, == , "TEST");
    728    }
    729}
    730
    731static void emc_test_ptle(QTestState *qts, const EMCModule *mod, int fd)
    732{
    733    NPCM7xxEMCRxDesc desc[NUM_RX_DESCRIPTORS];
    734    uint32_t desc_addr = DESC_ADDR;
    735    uint32_t data_addr = DATA_ADDR;
    736    int ret;
    737    NPCM7xxEMCRxDesc result_desc;
    738    uint32_t expected_mask, expected_value;
    739
    740    /* Prepare test data buffer. */
    741#define PTLE_DATA_LEN 1600
    742    char test_data[PTLE_DATA_LEN];
    743    int len = htonl(sizeof(test_data));
    744    const struct iovec iov[] = {
    745        {
    746            .iov_base = &len,
    747            .iov_len = sizeof(len),
    748        },{
    749            .iov_base = (char *) test_data,
    750            .iov_len = sizeof(test_data),
    751        },
    752    };
    753    memset(test_data, 42, sizeof(test_data));
    754
    755    /*
    756     * Reset the device BEFORE sending a test packet, otherwise the packet
    757     * may get swallowed by an active device of an earlier test.
    758     */
    759    init_rx_desc(&desc[0], NUM_RX_DESCRIPTORS, desc_addr, data_addr);
    760    enable_rx(qts, mod, &desc[0], NUM_RX_DESCRIPTORS, desc_addr,
    761              REG_MIEN_ENRXINTR, REG_MCMDR_ALP);
    762
    763    /* Send test packet to device's socket. */
    764    ret = iov_send(fd, iov, 2, 0, sizeof(len) + sizeof(test_data));
    765    g_assert_cmpint(ret, == , sizeof(test_data) + sizeof(len));
    766
    767    /* Wait for RX interrupt. */
    768    g_assert_true(emc_wait_irq(qts, mod, RX_STEP_COUNT, /*is_tx=*/false));
    769
    770    /* Read the descriptor back. */
    771    emc_read_rx_desc(qts, desc_addr, &result_desc);
    772    /* Descriptor should be owned by cpu now. */
    773    g_assert((result_desc.status_and_length & RX_DESC_STATUS_OWNER_MASK) == 0);
    774    /* Test the status bits, ignoring the length field. */
    775    expected_mask = 0xffff << 16;
    776    expected_value = (RX_DESC_STATUS_RXGD |
    777                      RX_DESC_STATUS_PTLE |
    778                      RX_DESC_STATUS_RXINTR);
    779    g_assert_cmphex((result_desc.status_and_length & expected_mask), ==,
    780                    expected_value);
    781    g_assert_cmpint(RX_DESC_PKT_LEN(result_desc.status_and_length), ==,
    782                    PTLE_DATA_LEN + CRC_LENGTH);
    783
    784    {
    785        char buffer[PTLE_DATA_LEN];
    786        qtest_memread(qts, data_addr, buffer, sizeof(buffer));
    787        g_assert(memcmp(buffer, test_data, PTLE_DATA_LEN) == 0);
    788    }
    789}
    790
    791static void test_tx(gconstpointer test_data)
    792{
    793    const TestData *td = test_data;
    794    GString *cmd_line = g_string_new("-machine quanta-gsj");
    795    int *test_sockets = packet_test_init(emc_module_index(td->module),
    796                                         cmd_line);
    797    QTestState *qts = qtest_init(cmd_line->str);
    798
    799    /*
    800     * TODO: For pedantic correctness test_sockets[0] should be closed after
    801     * the fork and before the exec, but that will require some harness
    802     * improvements.
    803     */
    804    close(test_sockets[1]);
    805    /* Defensive programming */
    806    test_sockets[1] = -1;
    807
    808    qtest_irq_intercept_in(qts, "/machine/soc/a9mpcore/gic");
    809
    810    emc_send_verify(qts, td->module, test_sockets[0], /*with_irq=*/false);
    811    emc_send_verify(qts, td->module, test_sockets[0], /*with_irq=*/true);
    812
    813    qtest_quit(qts);
    814}
    815
    816static void test_rx(gconstpointer test_data)
    817{
    818    const TestData *td = test_data;
    819    GString *cmd_line = g_string_new("-machine quanta-gsj");
    820    int *test_sockets = packet_test_init(emc_module_index(td->module),
    821                                         cmd_line);
    822    QTestState *qts = qtest_init(cmd_line->str);
    823
    824    /*
    825     * TODO: For pedantic correctness test_sockets[0] should be closed after
    826     * the fork and before the exec, but that will require some harness
    827     * improvements.
    828     */
    829    close(test_sockets[1]);
    830    /* Defensive programming */
    831    test_sockets[1] = -1;
    832
    833    qtest_irq_intercept_in(qts, "/machine/soc/a9mpcore/gic");
    834
    835    emc_recv_verify(qts, td->module, test_sockets[0], /*with_irq=*/false,
    836                    /*pump_rsdr=*/false);
    837    emc_recv_verify(qts, td->module, test_sockets[0], /*with_irq=*/false,
    838                    /*pump_rsdr=*/true);
    839    emc_recv_verify(qts, td->module, test_sockets[0], /*with_irq=*/true,
    840                    /*pump_rsdr=*/false);
    841    emc_recv_verify(qts, td->module, test_sockets[0], /*with_irq=*/true,
    842                    /*pump_rsdr=*/true);
    843    emc_test_ptle(qts, td->module, test_sockets[0]);
    844
    845    qtest_quit(qts);
    846}
    847
    848static void emc_add_test(const char *name, const TestData* td,
    849                         GTestDataFunc fn)
    850{
    851    g_autofree char *full_name = g_strdup_printf(
    852            "npcm7xx_emc/emc[%d]/%s", emc_module_index(td->module), name);
    853    qtest_add_data_func(full_name, td, fn);
    854}
    855#define add_test(name, td) emc_add_test(#name, td, test_##name)
    856
    857int main(int argc, char **argv)
    858{
    859    TestData test_data_list[ARRAY_SIZE(emc_module_list)];
    860
    861    g_test_init(&argc, &argv, NULL);
    862
    863    for (int i = 0; i < ARRAY_SIZE(emc_module_list); ++i) {
    864        TestData *td = &test_data_list[i];
    865
    866        td->module = &emc_module_list[i];
    867
    868        add_test(init, td);
    869        add_test(tx, td);
    870        add_test(rx, td);
    871    }
    872
    873    return g_test_run();
    874}