]>
Commit | Line | Data |
---|---|---|
aa62976c PMD |
1 | /* SPDX-License-Identifier: GPL-2.0-or-later */ |
2 | /* | |
3 | * QTest fuzzer-generated testcase for LSI53C895A device | |
4 | * | |
5 | * Copyright (c) Red Hat | |
6 | */ | |
7 | ||
8 | #include "qemu/osdep.h" | |
907b5105 | 9 | #include "libqtest.h" |
aa62976c | 10 | |
b987718b TH |
11 | /* |
12 | * This used to trigger a DMA reentrancy issue | |
13 | * leading to memory corruption bugs like stack | |
14 | * overflow or use-after-free | |
15 | * https://gitlab.com/qemu-project/qemu/-/issues/1563 | |
16 | */ | |
17 | static void test_lsi_dma_reentrancy(void) | |
18 | { | |
19 | QTestState *s; | |
20 | ||
21 | s = qtest_init("-M q35 -m 512M -nodefaults " | |
22 | "-blockdev driver=null-co,node-name=null0 " | |
23 | "-device lsi53c810 -device scsi-cd,drive=null0"); | |
24 | ||
25 | qtest_outl(s, 0xcf8, 0x80000804); /* PCI Command Register */ | |
26 | qtest_outw(s, 0xcfc, 0x7); /* Enables accesses */ | |
27 | qtest_outl(s, 0xcf8, 0x80000814); /* Memory Bar 1 */ | |
28 | qtest_outl(s, 0xcfc, 0xff100000); /* Set MMIO Address*/ | |
29 | qtest_outl(s, 0xcf8, 0x80000818); /* Memory Bar 2 */ | |
30 | qtest_outl(s, 0xcfc, 0xff000000); /* Set RAM Address*/ | |
31 | qtest_writel(s, 0xff000000, 0xc0000024); | |
32 | qtest_writel(s, 0xff000114, 0x00000080); | |
33 | qtest_writel(s, 0xff00012c, 0xff000000); | |
34 | qtest_writel(s, 0xff000004, 0xff000114); | |
35 | qtest_writel(s, 0xff000008, 0xff100014); | |
36 | qtest_writel(s, 0xff10002f, 0x000000ff); | |
37 | ||
38 | qtest_quit(s); | |
39 | } | |
40 | ||
4367a20c MMC |
41 | /* |
42 | * This used to trigger a UAF in lsi_do_msgout() | |
43 | * https://gitlab.com/qemu-project/qemu/-/issues/972 | |
44 | */ | |
45 | static void test_lsi_do_msgout_cancel_req(void) | |
46 | { | |
47 | QTestState *s; | |
48 | ||
49 | if (sizeof(void *) == 4) { | |
50 | g_test_skip("memory size too big for 32-bit build"); | |
51 | return; | |
52 | } | |
53 | ||
f15cfe41 | 54 | s = qtest_init("-M q35 -m 2G -nodefaults " |
4367a20c MMC |
55 | "-device lsi53c895a,id=scsi " |
56 | "-device scsi-hd,drive=disk0 " | |
57 | "-drive file=null-co://,id=disk0,if=none,format=raw"); | |
58 | ||
59 | qtest_outl(s, 0xcf8, 0x80000810); | |
60 | qtest_outl(s, 0xcf8, 0xc000); | |
61 | qtest_outl(s, 0xcf8, 0x80000810); | |
62 | qtest_outw(s, 0xcfc, 0x7); | |
63 | qtest_outl(s, 0xcf8, 0x80000810); | |
64 | qtest_outl(s, 0xcfc, 0xc000); | |
65 | qtest_outl(s, 0xcf8, 0x80000804); | |
66 | qtest_outw(s, 0xcfc, 0x05); | |
67 | qtest_writeb(s, 0x69736c10, 0x08); | |
68 | qtest_writeb(s, 0x69736c13, 0x58); | |
69 | qtest_writeb(s, 0x69736c1a, 0x01); | |
70 | qtest_writeb(s, 0x69736c1b, 0x06); | |
71 | qtest_writeb(s, 0x69736c22, 0x01); | |
72 | qtest_writeb(s, 0x69736c23, 0x07); | |
73 | qtest_writeb(s, 0x69736c2b, 0x02); | |
74 | qtest_writeb(s, 0x69736c48, 0x08); | |
75 | qtest_writeb(s, 0x69736c4b, 0x58); | |
76 | qtest_writeb(s, 0x69736c52, 0x04); | |
77 | qtest_writeb(s, 0x69736c53, 0x06); | |
78 | qtest_writeb(s, 0x69736c5b, 0x02); | |
79 | qtest_outl(s, 0xc02d, 0x697300); | |
80 | qtest_writeb(s, 0x5a554662, 0x01); | |
81 | qtest_writeb(s, 0x5a554663, 0x07); | |
82 | qtest_writeb(s, 0x5a55466a, 0x10); | |
83 | qtest_writeb(s, 0x5a55466b, 0x22); | |
84 | qtest_writeb(s, 0x5a55466c, 0x5a); | |
85 | qtest_writeb(s, 0x5a55466d, 0x5a); | |
86 | qtest_writeb(s, 0x5a55466e, 0x34); | |
87 | qtest_writeb(s, 0x5a55466f, 0x5a); | |
88 | qtest_writeb(s, 0x5a345a5a, 0x77); | |
89 | qtest_writeb(s, 0x5a345a5b, 0x55); | |
90 | qtest_writeb(s, 0x5a345a5c, 0x51); | |
91 | qtest_writeb(s, 0x5a345a5d, 0x27); | |
92 | qtest_writeb(s, 0x27515577, 0x41); | |
93 | qtest_outl(s, 0xc02d, 0x5a5500); | |
94 | qtest_writeb(s, 0x364001d0, 0x08); | |
95 | qtest_writeb(s, 0x364001d3, 0x58); | |
96 | qtest_writeb(s, 0x364001da, 0x01); | |
97 | qtest_writeb(s, 0x364001db, 0x26); | |
98 | qtest_writeb(s, 0x364001dc, 0x0d); | |
99 | qtest_writeb(s, 0x364001dd, 0xae); | |
100 | qtest_writeb(s, 0x364001de, 0x41); | |
101 | qtest_writeb(s, 0x364001df, 0x5a); | |
102 | qtest_writeb(s, 0x5a41ae0d, 0xf8); | |
103 | qtest_writeb(s, 0x5a41ae0e, 0x36); | |
104 | qtest_writeb(s, 0x5a41ae0f, 0xd7); | |
105 | qtest_writeb(s, 0x5a41ae10, 0x36); | |
106 | qtest_writeb(s, 0x36d736f8, 0x0c); | |
107 | qtest_writeb(s, 0x36d736f9, 0x80); | |
108 | qtest_writeb(s, 0x36d736fa, 0x0d); | |
109 | qtest_outl(s, 0xc02d, 0x364000); | |
110 | ||
111 | qtest_quit(s); | |
112 | } | |
113 | ||
aa62976c PMD |
114 | /* |
115 | * This used to trigger the assert in lsi_do_dma() | |
116 | * https://bugs.launchpad.net/qemu/+bug/697510 | |
117 | * https://bugs.launchpad.net/qemu/+bug/1905521 | |
118 | * https://bugs.launchpad.net/qemu/+bug/1908515 | |
119 | */ | |
120 | static void test_lsi_do_dma_empty_queue(void) | |
121 | { | |
122 | QTestState *s; | |
123 | ||
124 | s = qtest_init("-M q35 -nographic -monitor none -serial none " | |
125 | "-drive if=none,id=drive0," | |
126 | "file=null-co://,file.read-zeroes=on,format=raw " | |
127 | "-device lsi53c895a,id=scsi0 " | |
128 | "-device scsi-hd,drive=drive0," | |
129 | "bus=scsi0.0,channel=0,scsi-id=0,lun=0"); | |
130 | qtest_outl(s, 0xcf8, 0x80001814); | |
131 | qtest_outl(s, 0xcfc, 0xe1068000); | |
132 | qtest_outl(s, 0xcf8, 0x80001818); | |
133 | qtest_outl(s, 0xcf8, 0x80001804); | |
134 | qtest_outw(s, 0xcfc, 0x7); | |
135 | qtest_outl(s, 0xcf8, 0x80002010); | |
136 | ||
137 | qtest_writeb(s, 0xe106802e, 0xff); /* Fill DSP bits 16-23 */ | |
138 | qtest_writeb(s, 0xe106802f, 0xff); /* Fill DSP bits 24-31: trigger SCRIPT */ | |
139 | ||
140 | qtest_quit(s); | |
141 | } | |
142 | ||
143 | int main(int argc, char **argv) | |
144 | { | |
ae4b01b3 RJ |
145 | g_test_init(&argc, &argv, NULL); |
146 | ||
dee66bc9 FR |
147 | if (!qtest_has_device("lsi53c895a")) { |
148 | return 0; | |
149 | } | |
150 | ||
b911c30c TH |
151 | qtest_add_func("fuzz/lsi53c895a/lsi_do_dma_empty_queue", |
152 | test_lsi_do_dma_empty_queue); | |
aa62976c | 153 | |
4367a20c MMC |
154 | qtest_add_func("fuzz/lsi53c895a/lsi_do_msgout_cancel_req", |
155 | test_lsi_do_msgout_cancel_req); | |
156 | ||
b987718b TH |
157 | qtest_add_func("fuzz/lsi53c895a/lsi_dma_reentrancy", |
158 | test_lsi_dma_reentrancy); | |
159 | ||
aa62976c PMD |
160 | return g_test_run(); |
161 | } |