2  * virtio-blk Fuzzing Target
6  * Based on virtio-scsi-fuzz target.
9  * See the COPYING file in the top-level directory.
15 #include "tests/qtest/libqos/virtio-blk.h"
17 #include "tests/qtest/libqos/virtio-pci.h"
18 #include "standard-headers/linux/virtio_ids.h"
19 #include "standard-headers/linux/virtio_pci.h"
20 #include "standard-headers/linux/virtio_blk.h"
30 /* Based on tests/qtest/virtio-blk-test.c. */
36 static QVirtioBlkQueues *qvirtio_blk_init(QVirtioDevice *dev, uint64_t mask)  in qvirtio_blk_init()  argument
44     if (!mask) {  in qvirtio_blk_init()
45         mask = ~((1u << VIRTIO_RING_F_INDIRECT_DESC) |  in qvirtio_blk_init()
49     mask |= ~QVIRTIO_F_BAD_FEATURE;  in qvirtio_blk_init()
50     features &= mask;  in qvirtio_blk_init()
53     vs->num_queues = 1;  in qvirtio_blk_init()
54     vs->vq[0] = qvirtqueue_setup(dev, fuzz_qos_alloc, 0);  in qvirtio_blk_init()
85     QVirtioDevice *dev = blk->vdev;  in virtio_blk_fuzz()
89         /* Copy the action, so we can normalize length, queue and flags */  in virtio_blk_fuzz()
93         Size -= sizeof(vqa);  in virtio_blk_fuzz()
95         vqa.queue = vqa.queue % queues->num_queues;  in virtio_blk_fuzz()
102         q = queues->vq[vqa.queue];  in virtio_blk_fuzz()
120         Size -= vqa.length;  in virtio_blk_fuzz()
125             qvirtqueue_kick(s, dev, queues->vq[i], free_head[i]);  in virtio_blk_fuzz()
137         queues = qvirtio_blk_init(blk->vdev, *(uint64_t *)Data);  in virtio_blk_with_flag_fuzz()
139                 Data + sizeof(uint64_t), Size - sizeof(uint64_t));  in virtio_blk_with_flag_fuzz()
177                            " -drive if=none,id=drive0,file=%s,"  in virtio_blk_test_setup()
178                            "format=raw,auto-read-only=off ",  in virtio_blk_test_setup()
187                 .name = "virtio-blk-flags-fuzz",  in register_virtio_blk_fuzz_targets()
188                 .description = "Fuzz the virtio-blk virtual queues. "  in register_virtio_blk_fuzz_targets()
189                 "Also fuzzes the virtio flags)",  in register_virtio_blk_fuzz_targets()
192                 "virtio-blk",  in register_virtio_blk_fuzz_targets()