cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

fuzz-megasas-test.c (1382B)

      1/*
      2 * QTest fuzzer-generated testcase for megasas device
      3 *
      4 * Copyright (c) 2020 Li Qiang <liq3ea@gmail.com>
      5 *
      6 * This work is licensed under the terms of the GNU GPL, version 2 or later.
      7 * See the COPYING file in the top-level directory.
      8 */
      9
     10#include "qemu/osdep.h"
     11
     12#include "libqos/libqtest.h"
     13
     14/*
     15 * This used to trigger the assert in scsi_dma_complete
     16 * https://bugs.launchpad.net/qemu/+bug/1878263
     17 */
     18static void test_lp1878263_megasas_zero_iov_cnt(void)
     19{
     20    QTestState *s;
     21
     22    s = qtest_init("-nographic -monitor none -serial none "
     23                   "-M q35 -device megasas -device scsi-cd,drive=null0 "
     24                   "-blockdev driver=null-co,read-zeroes=on,node-name=null0");
     25    qtest_outl(s, 0xcf8, 0x80001818);
     26    qtest_outl(s, 0xcfc, 0xc101);
     27    qtest_outl(s, 0xcf8, 0x8000181c);
     28    qtest_outl(s, 0xcf8, 0x80001804);
     29    qtest_outw(s, 0xcfc, 0x7);
     30    qtest_outl(s, 0xcf8, 0x8000186a);
     31    qtest_writeb(s, 0x14, 0xfe);
     32    qtest_writeb(s, 0x0, 0x02);
     33    qtest_outb(s, 0xc1c0, 0x17);
     34    qtest_quit(s);
     35}
     36
     37int main(int argc, char **argv)
     38{
     39    const char *arch = qtest_get_arch();
     40
     41    g_test_init(&argc, &argv, NULL);
     42
     43    if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
     44        qtest_add_func("fuzz/test_lp1878263_megasas_zero_iov_cnt",
     45                       test_lp1878263_megasas_zero_iov_cnt);
     46    }
     47
     48    return g_test_run();
     49}