blob: 392a7ae7edec44e3bd1a339b4286e1f7859f1d63 [file] [log] [blame]
Philippe Mathieu-Daudéaa629762021-11-23 12:17:32 +01001/* SPDX-License-Identifier: GPL-2.0-or-later */
2/*
3 * QTest fuzzer-generated testcase for LSI53C895A device
4 *
5 * Copyright (c) Red Hat
6 */
7
8#include "qemu/osdep.h"
Marc-André Lureau907b5102022-03-30 13:39:05 +04009#include "libqtest.h"
Philippe Mathieu-Daudéaa629762021-11-23 12:17:32 +010010
11/*
Mauro Matteo Cascella4367a202022-07-11 14:33:16 +020012 * This used to trigger a UAF in lsi_do_msgout()
13 * https://gitlab.com/qemu-project/qemu/-/issues/972
14 */
15static void test_lsi_do_msgout_cancel_req(void)
16{
17 QTestState *s;
18
19 if (sizeof(void *) == 4) {
20 g_test_skip("memory size too big for 32-bit build");
21 return;
22 }
23
Juan Quintelaf15cfe42022-09-02 18:51:19 +020024 s = qtest_init("-M q35 -m 2G -nodefaults "
Mauro Matteo Cascella4367a202022-07-11 14:33:16 +020025 "-device lsi53c895a,id=scsi "
26 "-device scsi-hd,drive=disk0 "
27 "-drive file=null-co://,id=disk0,if=none,format=raw");
28
29 qtest_outl(s, 0xcf8, 0x80000810);
30 qtest_outl(s, 0xcf8, 0xc000);
31 qtest_outl(s, 0xcf8, 0x80000810);
32 qtest_outw(s, 0xcfc, 0x7);
33 qtest_outl(s, 0xcf8, 0x80000810);
34 qtest_outl(s, 0xcfc, 0xc000);
35 qtest_outl(s, 0xcf8, 0x80000804);
36 qtest_outw(s, 0xcfc, 0x05);
37 qtest_writeb(s, 0x69736c10, 0x08);
38 qtest_writeb(s, 0x69736c13, 0x58);
39 qtest_writeb(s, 0x69736c1a, 0x01);
40 qtest_writeb(s, 0x69736c1b, 0x06);
41 qtest_writeb(s, 0x69736c22, 0x01);
42 qtest_writeb(s, 0x69736c23, 0x07);
43 qtest_writeb(s, 0x69736c2b, 0x02);
44 qtest_writeb(s, 0x69736c48, 0x08);
45 qtest_writeb(s, 0x69736c4b, 0x58);
46 qtest_writeb(s, 0x69736c52, 0x04);
47 qtest_writeb(s, 0x69736c53, 0x06);
48 qtest_writeb(s, 0x69736c5b, 0x02);
49 qtest_outl(s, 0xc02d, 0x697300);
50 qtest_writeb(s, 0x5a554662, 0x01);
51 qtest_writeb(s, 0x5a554663, 0x07);
52 qtest_writeb(s, 0x5a55466a, 0x10);
53 qtest_writeb(s, 0x5a55466b, 0x22);
54 qtest_writeb(s, 0x5a55466c, 0x5a);
55 qtest_writeb(s, 0x5a55466d, 0x5a);
56 qtest_writeb(s, 0x5a55466e, 0x34);
57 qtest_writeb(s, 0x5a55466f, 0x5a);
58 qtest_writeb(s, 0x5a345a5a, 0x77);
59 qtest_writeb(s, 0x5a345a5b, 0x55);
60 qtest_writeb(s, 0x5a345a5c, 0x51);
61 qtest_writeb(s, 0x5a345a5d, 0x27);
62 qtest_writeb(s, 0x27515577, 0x41);
63 qtest_outl(s, 0xc02d, 0x5a5500);
64 qtest_writeb(s, 0x364001d0, 0x08);
65 qtest_writeb(s, 0x364001d3, 0x58);
66 qtest_writeb(s, 0x364001da, 0x01);
67 qtest_writeb(s, 0x364001db, 0x26);
68 qtest_writeb(s, 0x364001dc, 0x0d);
69 qtest_writeb(s, 0x364001dd, 0xae);
70 qtest_writeb(s, 0x364001de, 0x41);
71 qtest_writeb(s, 0x364001df, 0x5a);
72 qtest_writeb(s, 0x5a41ae0d, 0xf8);
73 qtest_writeb(s, 0x5a41ae0e, 0x36);
74 qtest_writeb(s, 0x5a41ae0f, 0xd7);
75 qtest_writeb(s, 0x5a41ae10, 0x36);
76 qtest_writeb(s, 0x36d736f8, 0x0c);
77 qtest_writeb(s, 0x36d736f9, 0x80);
78 qtest_writeb(s, 0x36d736fa, 0x0d);
79 qtest_outl(s, 0xc02d, 0x364000);
80
81 qtest_quit(s);
82}
83
84/*
Philippe Mathieu-Daudéaa629762021-11-23 12:17:32 +010085 * This used to trigger the assert in lsi_do_dma()
86 * https://bugs.launchpad.net/qemu/+bug/697510
87 * https://bugs.launchpad.net/qemu/+bug/1905521
88 * https://bugs.launchpad.net/qemu/+bug/1908515
89 */
90static void test_lsi_do_dma_empty_queue(void)
91{
92 QTestState *s;
93
94 s = qtest_init("-M q35 -nographic -monitor none -serial none "
95 "-drive if=none,id=drive0,"
96 "file=null-co://,file.read-zeroes=on,format=raw "
97 "-device lsi53c895a,id=scsi0 "
98 "-device scsi-hd,drive=drive0,"
99 "bus=scsi0.0,channel=0,scsi-id=0,lun=0");
100 qtest_outl(s, 0xcf8, 0x80001814);
101 qtest_outl(s, 0xcfc, 0xe1068000);
102 qtest_outl(s, 0xcf8, 0x80001818);
103 qtest_outl(s, 0xcf8, 0x80001804);
104 qtest_outw(s, 0xcfc, 0x7);
105 qtest_outl(s, 0xcf8, 0x80002010);
106
107 qtest_writeb(s, 0xe106802e, 0xff); /* Fill DSP bits 16-23 */
108 qtest_writeb(s, 0xe106802f, 0xff); /* Fill DSP bits 24-31: trigger SCRIPT */
109
110 qtest_quit(s);
111}
112
113int main(int argc, char **argv)
114{
Philippe Mathieu-Daudéaa629762021-11-23 12:17:32 +0100115 g_test_init(&argc, &argv, NULL);
116
Thomas Huthb911c302022-04-14 15:01:27 +0200117 qtest_add_func("fuzz/lsi53c895a/lsi_do_dma_empty_queue",
118 test_lsi_do_dma_empty_queue);
Philippe Mathieu-Daudéaa629762021-11-23 12:17:32 +0100119
Mauro Matteo Cascella4367a202022-07-11 14:33:16 +0200120 qtest_add_func("fuzz/lsi53c895a/lsi_do_msgout_cancel_req",
121 test_lsi_do_msgout_cancel_req);
122
Philippe Mathieu-Daudéaa629762021-11-23 12:17:32 +0100123 return g_test_run();
124}