From: Alexander Bulekov <1909247@bugs.launchpad.net> To: qemu-devel@nongnu.org Subject: [Bug 1909247] [PATCH] tests/qtest: add more tests for am53c974 device Date: Mon, 29 Mar 2021 03:21:42 -0000 [thread overview] Message-ID: <20210329032142.430539-1-alxndr@bu.edu> (raw) In-Reply-To: 161667857481.32669.15954116519339833776.malone@soybean.canonical.com Add some more regression tests for the esp device. (Prasad's Patch) Based-on: <161657108250.32717.5311086901810004029.malone@soybean.canonical.com> (Mark's v2 Patchset) Based-on: <20210317230223.24854-1-mark.cave-ayland@ilande.co.uk> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> --- Hi Mark, Hopefully these are useful. I realized that my previous message was innacurate (I forgot to apply Prasad's patch, or your v2 patchset). The only corruptions that I am continuing to see are heap-overflows. I am guessing that most of these are due to some mututal root cause, so the number of tests far-exceeds the actual number of errors, but I am providing all of the crashes with unique-looking stack-traces, just in case. Please let me know if I can provide anything else that would help. -Alex tests/qtest/am53c974-test.c | 1137 +++++++++++++++++++++++++++++++++++ 1 file changed, 1137 insertions(+) diff --git a/tests/qtest/am53c974-test.c b/tests/qtest/am53c974-test.c index c90bd4c187..cb2a5646a6 100644 --- a/tests/qtest/am53c974-test.c +++ b/tests/qtest/am53c974-test.c @@ -9,6 +9,1125 @@ #include "libqos/libqtest.h" +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outb 0xc000 0x4 + * outb 0xc008 0xa0 + * outl 0xc03f 0x0300 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outl 0xc00b 0xc300 + * outl 0xc00b 0xc300 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outw 0xc00b 0x1000 + * EOF + */ +static void crash_0900379669(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outb(s, 0xc000, 0x4); + qtest_outb(s, 0xc008, 0xa0); + qtest_outl(s, 0xc03f, 0x0300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outw(s, 0xc00b, 0x1000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outl 0xc008 0x20 + * outw 0xc000 0x1 + * outb 0xc040 0x03 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outw 0xc00b 0x4200 + * outl 0xc00a 0x410000 + * EOF + */ +static void crash_094661a91b(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outl(s, 0xc008, 0x20); + qtest_outw(s, 0xc000, 0x1); + qtest_outb(s, 0xc040, 0x03); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outw(s, 0xc00b, 0x4200); + qtest_outl(s, 0xc00a, 0x410000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outb 0xc000 0x4 + * outl 0xc007 0x8000 + * outl 0xc03f 0x0300 + * outl 0xc00b 0x4300 + * outw 0xc00b 0x9000 + * outl 0xc00b 0xc300 + * outl 0xc00b 0xc300 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outw 0xc00b 0x1000 + * EOF + */ +static void crash_0fff2155cb(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outb(s, 0xc000, 0x4); + qtest_outl(s, 0xc007, 0x8000); + qtest_outl(s, 0xc03f, 0x0300); + qtest_outl(s, 0xc00b, 0x4300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outw(s, 0xc00b, 0x1000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outw 0xc00c 0x41 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x43 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outl 0xc006 0x00 + * outl 0xc00b 0x00 + * outw 0xc00b 0x0800 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outl 0xc006 0x00 + * outl 0xc00b 0x00 + * outw 0xc00b 0x0800 + * outw 0xc00b 0x00 + * outw 0xc00b 0x4100 + * outw 0xc00a 0x00 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x00 + * outw 0xc00c 0x43 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x100000 + * EOF + */ +static void crash_1548bd10e7(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outw(s, 0xc00c, 0x41); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x43); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outl(s, 0xc006, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x0800); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outl(s, 0xc006, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x0800); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x43); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x100000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outl 0xc00a 0x420000 + * outl 0xc00a 0x430000 + * outl 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outl 0xc00b 0x00 + * outw 0xc00b 0x00 + * outl 0xc00b 0x00 + * outw 0xc00b 0x00 + * outl 0xc00b 0x00 + * outb 0xc008 0x00 + * outw 0xc00b 0x00 + * outb 0xc008 0xa0 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outl 0xc00a 0x00 + * outw 0xc00b 0x00 + * outl 0xc00a 0x00 + * outl 0xc00a 0x00 + * outl 0xc00b 0x00 + * outw 0xc00b 0x00 + * outl 0xc00b 0x1000 + * outw 0xc00b 0x1000 + * EOF + */ +static void crash_1afe349482(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outl(s, 0xc00a, 0x420000); + qtest_outl(s, 0xc00a, 0x430000); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outb(s, 0xc008, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outb(s, 0xc008, 0xa0); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x1000); + qtest_outw(s, 0xc00b, 0x1000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outl 0xc007 0x2000 + * outw 0xc00b 0x0100 + * outw 0xc00c 0x43 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00c 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x00 + * outw 0xc00c 0x43 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x100000 + * EOF + */ +static void crash_1b42581317(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outl(s, 0xc007, 0x2000); + qtest_outw(s, 0xc00b, 0x0100); + qtest_outw(s, 0xc00c, 0x43); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x43); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x100000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outl 0xc007 0x1500 + * outw 0xc00b 0x4100 + * outw 0xc00b 0x4100 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x00 + * outw 0xc00b 0x1000 + * outw 0xc009 0x00 + * outl 0xc00b 0xc000 + * outl 0xc00b 0xc000 + * outl 0xc00b 0xc000 + * outl 0xc00b 0xc000 + * outl 0xc00b 0x0 + * outl 0xc00b 0xc000 + * outl 0xc00b 0xc000 + * outl 0xc00b 0xc000 + * outl 0xc007 0x00 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x1000 + * outl 0xc007 0x00 + * outw 0xc00b 0x4100 + * EOF + */ +static void crash_30e28cfa86(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outl(s, 0xc007, 0x1500); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x1000); + qtest_outw(s, 0xc009, 0x00); + qtest_outl(s, 0xc00b, 0xc000); + qtest_outl(s, 0xc00b, 0xc000); + qtest_outl(s, 0xc00b, 0xc000); + qtest_outl(s, 0xc00b, 0xc000); + qtest_outl(s, 0xc00b, 0x0); + qtest_outl(s, 0xc00b, 0xc000); + qtest_outl(s, 0xc00b, 0xc000); + qtest_outl(s, 0xc00b, 0xc000); + qtest_outl(s, 0xc007, 0x00); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x1000); + qtest_outl(s, 0xc007, 0x00); + qtest_outw(s, 0xc00b, 0x4100); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outb 0xc008 0x42 + * outw 0xc00b 0x4100 + * outw 0xc00b 0x4100 + * outw 0xc00b 0x00 + * outw 0xc00b 0x1000 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outw 0xc00b 0x1000 + * EOF + */ +static void crash_34093bfc7c(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outb(s, 0xc008, 0x42); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x1000); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outw(s, 0xc00b, 0x1000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outw 0xc000 0x1 + * outb 0xc040 0x03 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outw 0xc007 0xa000 + * outl 0xc00a 0x410000 + * EOF + */ +static void crash_3a05434a1f(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outw(s, 0xc000, 0x1); + qtest_outb(s, 0xc040, 0x03); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outw(s, 0xc007, 0xa000); + qtest_outl(s, 0xc00a, 0x410000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outw 0xc000 0x01 + * outb 0xc040 0x03 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0x4200 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0xc200 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outw 0xc00b 0x00 + * EOF + */ +static void crash_3ab5744bc3(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outw(s, 0xc000, 0x01); + qtest_outb(s, 0xc040, 0x03); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0x4200); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outl 0xc00b 0x4100 + * outw 0xc00b 0xc200 + * outl 0xc03f 0x0300 + * EOF + */ +static void crash_530ff2e211(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outl(s, 0xc00b, 0x4100); + qtest_outw(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc03f, 0x0300); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outl 0xc03f 0x0300 + * outw 0xc00b 0x4300 + * outw 0xc000 0x01 + * outw 0xc009 0x00 + * outw 0xc00b 0x1000 + * outl 0xc00d 0x02000000 + * outw 0xc00c 0xc2 + * outw 0xc00b 0x4100 + * outl 0xc00b 0x1000 + * EOF + */ +static void crash_76ab101171(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outl(s, 0xc03f, 0x0300); + qtest_outw(s, 0xc00b, 0x4300); + qtest_outw(s, 0xc000, 0x01); + qtest_outw(s, 0xc009, 0x00); + qtest_outw(s, 0xc00b, 0x1000); + qtest_outl(s, 0xc00d, 0x02000000); + qtest_outw(s, 0xc00c, 0xc2); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outl(s, 0xc00b, 0x1000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outb 0xc000 0x4 + * outw 0xc007 0x4000 + * outl 0xc03f 0x0300 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outl 0xc00b 0x00 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outw 0xc00b 0x1000 + * EOF + */ +static void crash_7f743a0082(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outb(s, 0xc000, 0x4); + qtest_outw(s, 0xc007, 0x4000); + qtest_outl(s, 0xc03f, 0x0300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outw(s, 0xc00b, 0x1000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outb 0xc000 0x4 + * outl 0xc03f 0x0300 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outl 0xc00b 0x00 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outl 0xc00b 0x00 + * outl 0xc00b 0xc300 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outw 0xc00b 0x1000 + * EOF + */ +static void crash_87744a2e67(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outb(s, 0xc000, 0x4); + qtest_outl(s, 0xc03f, 0x0300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outw(s, 0xc00b, 0x1000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outw 0xc00c 0x41 + * outl 0xc00a 0x00 + * outw 0xc00c 0x43 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00c 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x00 + * outw 0xc00c 0x43 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x100000 + * EOF + */ +static void crash_9f92a77bd6(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outw(s, 0xc00c, 0x41); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x43); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x43); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x100000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outb 0xc008 0xa + * outw 0xc00b 0x4100 + * outw 0xc00b 0x4100 + * outw 0xc00b 0x1000 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x4200 + * EOF + */ +static void crash_d94dc29565(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outb(s, 0xc008, 0xa); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outw(s, 0xc00b, 0x1000); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x4200); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outw 0xc00b 0x4100 + * outl 0xc00b 0x0300 + * inl 0xc00b + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x00 + * outl 0xc00a 0x410000 + * EOF + */ +static void crash_df5a21ccf3(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outl(s, 0xc00b, 0x0300); + qtest_inl(s, 0xc00b); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00a, 0x410000); + qtest_quit(s); +} static void test_cmdfifo_underflow_ok(void) { @@ -106,6 +1225,24 @@ int main(int argc, char **argv) g_test_init(&argc, &argv, NULL); if (strcmp(arch, "i386") == 0) { + qtest_add_func("fuzz/crash_0900379669", crash_0900379669); + qtest_add_func("fuzz/crash_094661a91b", crash_094661a91b); + qtest_add_func("fuzz/crash_0fff2155cb", crash_0fff2155cb); + qtest_add_func("fuzz/crash_1548bd10e7", crash_1548bd10e7); + qtest_add_func("fuzz/crash_1afe349482", crash_1afe349482); + qtest_add_func("fuzz/crash_1b42581317", crash_1b42581317); + qtest_add_func("fuzz/crash_30e28cfa86", crash_30e28cfa86); + qtest_add_func("fuzz/crash_34093bfc7c", crash_34093bfc7c); + qtest_add_func("fuzz/crash_3a05434a1f", crash_3a05434a1f); + qtest_add_func("fuzz/crash_3ab5744bc3", crash_3ab5744bc3); + qtest_add_func("fuzz/crash_530ff2e211", crash_530ff2e211); + qtest_add_func("fuzz/crash_76ab101171", crash_76ab101171); + qtest_add_func("fuzz/crash_7f743a0082", crash_7f743a0082); + qtest_add_func("fuzz/crash_87744a2e67", crash_87744a2e67); + qtest_add_func("fuzz/crash_9f92a77bd6", crash_9f92a77bd6); + qtest_add_func("fuzz/crash_d94dc29565", crash_d94dc29565); + qtest_add_func("fuzz/crash_dd24c44f80", crash_dd24c44f80); + qtest_add_func("fuzz/crash_df5a21ccf3", crash_df5a21ccf3); qtest_add_func("am53c974/test_cmdfifo_underflow_ok", test_cmdfifo_underflow_ok); qtest_add_func("am53c974/test_cmdfifo_overflow_ok", -- 2.28.0 -- You received this bug notification because you are a member of qemu- devel-ml, which is subscribed to QEMU. https://bugs.launchpad.net/bugs/1909247 Title: QEMU: use after free vulnerability in esp_do_dma() in hw/scsi/esp.c Status in QEMU: New Bug description: A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU. It could occur in the esp_do_dma() function in hw/scsi/esp.c while handling the 'Information Transfer' command (CMD_TI). A privileged guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service or potential code execution with the privileges of the QEMU process. This issue was reported by Cheolwoo Myung (Seoul National University). Original report: Using hypervisor fuzzer, hyfuzz, I found a use-after-free issue in am53c974 emulator of QEMU enabled ASan. It occurs while transferring information, as it does not check the buffer to be transferred. A malicious guest user/process could use this flaw to crash the QEMU process resulting in DoS scenario. To reproduce this issue, please run the QEMU with the following command line. # To enable ASan option, please set configuration with the following $ ./configure --target-list=i386-softmmu --disable-werror --enable-sanitizers $ make # To reproduce this issue, please run the QEMU process with the following command line $ ./qemu-system-i386 -m 512 -drive file=./hyfuzz.img,index=0,media=disk,format=raw \ -device am53c974,id=scsi -device scsi-hd,drive=SysDisk \ -drive id=SysDisk,if=none,file=./disk.img Please find attached the disk images to reproduce this issue. To manage notifications about this bug go to: https://bugs.launchpad.net/qemu/+bug/1909247/+subscriptions
WARNING: multiple messages have this Message-ID (diff)
From: Alexander Bulekov <alxndr@bu.edu> To: qemu-devel@nongnu.org Cc: Alexander Bulekov <alxndr@bu.edu>, Mark Cave-Ayland <1909247@bugs.launchpad.net> Subject: [PATCH] tests/qtest: add more tests for am53c974 device Date: Sun, 28 Mar 2021 23:21:42 -0400 [thread overview] Message-ID: <20210329032142.430539-1-alxndr@bu.edu> (raw) Message-ID: <20210329032142.FpP1bP_o78g0ttboxSKg1dg9LcCCqTtLxhchT2knW6A@z> (raw) In-Reply-To: <161667857481.32669.15954116519339833776.malone@soybean.canonical.com> Add some more regression tests for the esp device. (Prasad's Patch) Based-on: <161657108250.32717.5311086901810004029.malone@soybean.canonical.com> (Mark's v2 Patchset) Based-on: <20210317230223.24854-1-mark.cave-ayland@ilande.co.uk> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> --- Hi Mark, Hopefully these are useful. I realized that my previous message was innacurate (I forgot to apply Prasad's patch, or your v2 patchset). The only corruptions that I am continuing to see are heap-overflows. I am guessing that most of these are due to some mututal root cause, so the number of tests far-exceeds the actual number of errors, but I am providing all of the crashes with unique-looking stack-traces, just in case. Please let me know if I can provide anything else that would help. -Alex tests/qtest/am53c974-test.c | 1137 +++++++++++++++++++++++++++++++++++ 1 file changed, 1137 insertions(+) diff --git a/tests/qtest/am53c974-test.c b/tests/qtest/am53c974-test.c index c90bd4c187..cb2a5646a6 100644 --- a/tests/qtest/am53c974-test.c +++ b/tests/qtest/am53c974-test.c @@ -9,6 +9,1125 @@ #include "libqos/libqtest.h" +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outb 0xc000 0x4 + * outb 0xc008 0xa0 + * outl 0xc03f 0x0300 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outl 0xc00b 0xc300 + * outl 0xc00b 0xc300 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outw 0xc00b 0x1000 + * EOF + */ +static void crash_0900379669(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outb(s, 0xc000, 0x4); + qtest_outb(s, 0xc008, 0xa0); + qtest_outl(s, 0xc03f, 0x0300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outw(s, 0xc00b, 0x1000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outl 0xc008 0x20 + * outw 0xc000 0x1 + * outb 0xc040 0x03 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outw 0xc00b 0x4200 + * outl 0xc00a 0x410000 + * EOF + */ +static void crash_094661a91b(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outl(s, 0xc008, 0x20); + qtest_outw(s, 0xc000, 0x1); + qtest_outb(s, 0xc040, 0x03); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outw(s, 0xc00b, 0x4200); + qtest_outl(s, 0xc00a, 0x410000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outb 0xc000 0x4 + * outl 0xc007 0x8000 + * outl 0xc03f 0x0300 + * outl 0xc00b 0x4300 + * outw 0xc00b 0x9000 + * outl 0xc00b 0xc300 + * outl 0xc00b 0xc300 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outw 0xc00b 0x1000 + * EOF + */ +static void crash_0fff2155cb(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outb(s, 0xc000, 0x4); + qtest_outl(s, 0xc007, 0x8000); + qtest_outl(s, 0xc03f, 0x0300); + qtest_outl(s, 0xc00b, 0x4300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outw(s, 0xc00b, 0x1000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outw 0xc00c 0x41 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x43 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outl 0xc006 0x00 + * outl 0xc00b 0x00 + * outw 0xc00b 0x0800 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outl 0xc006 0x00 + * outl 0xc00b 0x00 + * outw 0xc00b 0x0800 + * outw 0xc00b 0x00 + * outw 0xc00b 0x4100 + * outw 0xc00a 0x00 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x00 + * outw 0xc00c 0x43 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x100000 + * EOF + */ +static void crash_1548bd10e7(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outw(s, 0xc00c, 0x41); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x43); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outl(s, 0xc006, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x0800); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outl(s, 0xc006, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x0800); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x43); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x100000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outl 0xc00a 0x420000 + * outl 0xc00a 0x430000 + * outl 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outl 0xc00b 0x00 + * outw 0xc00b 0x00 + * outl 0xc00b 0x00 + * outw 0xc00b 0x00 + * outl 0xc00b 0x00 + * outb 0xc008 0x00 + * outw 0xc00b 0x00 + * outb 0xc008 0xa0 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outl 0xc00a 0x00 + * outw 0xc00b 0x00 + * outl 0xc00a 0x00 + * outl 0xc00a 0x00 + * outl 0xc00b 0x00 + * outw 0xc00b 0x00 + * outl 0xc00b 0x1000 + * outw 0xc00b 0x1000 + * EOF + */ +static void crash_1afe349482(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outl(s, 0xc00a, 0x420000); + qtest_outl(s, 0xc00a, 0x430000); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outb(s, 0xc008, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outb(s, 0xc008, 0xa0); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x1000); + qtest_outw(s, 0xc00b, 0x1000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outl 0xc007 0x2000 + * outw 0xc00b 0x0100 + * outw 0xc00c 0x43 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00c 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x00 + * outw 0xc00c 0x43 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x100000 + * EOF + */ +static void crash_1b42581317(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outl(s, 0xc007, 0x2000); + qtest_outw(s, 0xc00b, 0x0100); + qtest_outw(s, 0xc00c, 0x43); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x43); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x100000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outl 0xc007 0x1500 + * outw 0xc00b 0x4100 + * outw 0xc00b 0x4100 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x00 + * outw 0xc00b 0x1000 + * outw 0xc009 0x00 + * outl 0xc00b 0xc000 + * outl 0xc00b 0xc000 + * outl 0xc00b 0xc000 + * outl 0xc00b 0xc000 + * outl 0xc00b 0x0 + * outl 0xc00b 0xc000 + * outl 0xc00b 0xc000 + * outl 0xc00b 0xc000 + * outl 0xc007 0x00 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x1000 + * outl 0xc007 0x00 + * outw 0xc00b 0x4100 + * EOF + */ +static void crash_30e28cfa86(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outl(s, 0xc007, 0x1500); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x1000); + qtest_outw(s, 0xc009, 0x00); + qtest_outl(s, 0xc00b, 0xc000); + qtest_outl(s, 0xc00b, 0xc000); + qtest_outl(s, 0xc00b, 0xc000); + qtest_outl(s, 0xc00b, 0xc000); + qtest_outl(s, 0xc00b, 0x0); + qtest_outl(s, 0xc00b, 0xc000); + qtest_outl(s, 0xc00b, 0xc000); + qtest_outl(s, 0xc00b, 0xc000); + qtest_outl(s, 0xc007, 0x00); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x1000); + qtest_outl(s, 0xc007, 0x00); + qtest_outw(s, 0xc00b, 0x4100); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outb 0xc008 0x42 + * outw 0xc00b 0x4100 + * outw 0xc00b 0x4100 + * outw 0xc00b 0x00 + * outw 0xc00b 0x1000 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outl 0xc00b 0x0300 + * outw 0xc00b 0x1000 + * EOF + */ +static void crash_34093bfc7c(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outb(s, 0xc008, 0x42); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x1000); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outl(s, 0xc00b, 0x0300); + qtest_outw(s, 0xc00b, 0x1000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outw 0xc000 0x1 + * outb 0xc040 0x03 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outw 0xc007 0xa000 + * outl 0xc00a 0x410000 + * EOF + */ +static void crash_3a05434a1f(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outw(s, 0xc000, 0x1); + qtest_outb(s, 0xc040, 0x03); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outw(s, 0xc007, 0xa000); + qtest_outl(s, 0xc00a, 0x410000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outw 0xc000 0x01 + * outb 0xc040 0x03 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0xc200 + * outl 0xc00b 0x4200 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0x4000 + * outl 0xc00b 0xc200 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outl 0xc00b 0x00 + * outw 0xc00b 0x00 + * EOF + */ +static void crash_3ab5744bc3(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outw(s, 0xc000, 0x01); + qtest_outb(s, 0xc040, 0x03); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0x4200); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0x4000); + qtest_outl(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outl 0xc00b 0x4100 + * outw 0xc00b 0xc200 + * outl 0xc03f 0x0300 + * EOF + */ +static void crash_530ff2e211(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outl(s, 0xc00b, 0x4100); + qtest_outw(s, 0xc00b, 0xc200); + qtest_outl(s, 0xc03f, 0x0300); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outl 0xc03f 0x0300 + * outw 0xc00b 0x4300 + * outw 0xc000 0x01 + * outw 0xc009 0x00 + * outw 0xc00b 0x1000 + * outl 0xc00d 0x02000000 + * outw 0xc00c 0xc2 + * outw 0xc00b 0x4100 + * outl 0xc00b 0x1000 + * EOF + */ +static void crash_76ab101171(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outl(s, 0xc03f, 0x0300); + qtest_outw(s, 0xc00b, 0x4300); + qtest_outw(s, 0xc000, 0x01); + qtest_outw(s, 0xc009, 0x00); + qtest_outw(s, 0xc00b, 0x1000); + qtest_outl(s, 0xc00d, 0x02000000); + qtest_outw(s, 0xc00c, 0xc2); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outl(s, 0xc00b, 0x1000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outb 0xc000 0x4 + * outw 0xc007 0x4000 + * outl 0xc03f 0x0300 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outl 0xc00b 0x00 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outw 0xc00b 0x1000 + * EOF + */ +static void crash_7f743a0082(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outb(s, 0xc000, 0x4); + qtest_outw(s, 0xc007, 0x4000); + qtest_outl(s, 0xc03f, 0x0300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outw(s, 0xc00b, 0x1000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outb 0xc000 0x4 + * outl 0xc03f 0x0300 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outl 0xc00b 0x00 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outl 0xc00b 0x00 + * outl 0xc00b 0xc300 + * outl 0xc00b 0xc300 + * outw 0xc00b 0x9000 + * outw 0xc00b 0x1000 + * EOF + */ +static void crash_87744a2e67(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outb(s, 0xc000, 0x4); + qtest_outl(s, 0xc03f, 0x0300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outl(s, 0xc00b, 0xc300); + qtest_outw(s, 0xc00b, 0x9000); + qtest_outw(s, 0xc00b, 0x1000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outw 0xc00c 0x41 + * outl 0xc00a 0x00 + * outw 0xc00c 0x43 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outl 0xc00a 0x00 + * outw 0xc00c 0x00 + * outw 0xc00b 0x00 + * outw 0xc00b 0x00 + * outw 0xc00c 0x00 + * outw 0xc00a 0x00 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x00 + * outw 0xc00c 0x43 + * outl 0xc00a 0x100000 + * outl 0xc00a 0x100000 + * EOF + */ +static void crash_9f92a77bd6(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outw(s, 0xc00c, 0x41); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x43); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00b, 0x00); + qtest_outw(s, 0xc00c, 0x00); + qtest_outw(s, 0xc00a, 0x00); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x00); + qtest_outw(s, 0xc00c, 0x43); + qtest_outl(s, 0xc00a, 0x100000); + qtest_outl(s, 0xc00a, 0x100000); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outb 0xc008 0xa + * outw 0xc00b 0x4100 + * outw 0xc00b 0x4100 + * outw 0xc00b 0x1000 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x0400 + * outl 0xc00b 0x4200 + * EOF + */ +static void crash_d94dc29565(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outb(s, 0xc008, 0xa); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outw(s, 0xc00b, 0x1000); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x0400); + qtest_outl(s, 0xc00b, 0x4200); + qtest_quit(s); +} +/* + * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \ + * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \ + * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio + * outl 0xcf8 0x80001010 + * outl 0xcfc 0xc000 + * outl 0xcf8 0x80001004 + * outw 0xcfc 0x01 + * outw 0xc00b 0x4100 + * outl 0xc00b 0x0300 + * inl 0xc00b + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x0800 + * outl 0xc00b 0x00 + * outl 0xc00a 0x410000 + * EOF + */ +static void crash_df5a21ccf3(void) +{ + QTestState *s = qtest_init( + "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 " + "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults"); + qtest_outl(s, 0xcf8, 0x80001010); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80001004); + qtest_outw(s, 0xcfc, 0x01); + qtest_outw(s, 0xc00b, 0x4100); + qtest_outl(s, 0xc00b, 0x0300); + qtest_inl(s, 0xc00b); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x0800); + qtest_outl(s, 0xc00b, 0x00); + qtest_outl(s, 0xc00a, 0x410000); + qtest_quit(s); +} static void test_cmdfifo_underflow_ok(void) { @@ -106,6 +1225,24 @@ int main(int argc, char **argv) g_test_init(&argc, &argv, NULL); if (strcmp(arch, "i386") == 0) { + qtest_add_func("fuzz/crash_0900379669", crash_0900379669); + qtest_add_func("fuzz/crash_094661a91b", crash_094661a91b); + qtest_add_func("fuzz/crash_0fff2155cb", crash_0fff2155cb); + qtest_add_func("fuzz/crash_1548bd10e7", crash_1548bd10e7); + qtest_add_func("fuzz/crash_1afe349482", crash_1afe349482); + qtest_add_func("fuzz/crash_1b42581317", crash_1b42581317); + qtest_add_func("fuzz/crash_30e28cfa86", crash_30e28cfa86); + qtest_add_func("fuzz/crash_34093bfc7c", crash_34093bfc7c); + qtest_add_func("fuzz/crash_3a05434a1f", crash_3a05434a1f); + qtest_add_func("fuzz/crash_3ab5744bc3", crash_3ab5744bc3); + qtest_add_func("fuzz/crash_530ff2e211", crash_530ff2e211); + qtest_add_func("fuzz/crash_76ab101171", crash_76ab101171); + qtest_add_func("fuzz/crash_7f743a0082", crash_7f743a0082); + qtest_add_func("fuzz/crash_87744a2e67", crash_87744a2e67); + qtest_add_func("fuzz/crash_9f92a77bd6", crash_9f92a77bd6); + qtest_add_func("fuzz/crash_d94dc29565", crash_d94dc29565); + qtest_add_func("fuzz/crash_dd24c44f80", crash_dd24c44f80); + qtest_add_func("fuzz/crash_df5a21ccf3", crash_df5a21ccf3); qtest_add_func("am53c974/test_cmdfifo_underflow_ok", test_cmdfifo_underflow_ok); qtest_add_func("am53c974/test_cmdfifo_overflow_ok", -- 2.28.0
next prev parent reply other threads:[~2021-03-29 3:31 UTC|newest] Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-12-24 17:02 [Bug 1909247] [NEW] QEMU: use after free vulnerability in esp_do_dma() in hw/scsi/esp.c Mauro Matteo Cascella 2020-12-24 17:09 ` [Bug 1909247] " Mauro Matteo Cascella 2021-01-15 16:16 ` Peter Maydell 2021-03-15 3:01 ` Alexander Bulekov 2021-03-15 12:11 ` Mauro Matteo Cascella 2021-03-15 13:50 ` Mauro Matteo Cascella 2021-03-15 14:02 ` Mauro Matteo Cascella 2021-03-15 14:19 ` Alexander Bulekov 2021-03-17 7:43 ` Mark Cave-Ayland 2021-03-24 7:31 ` P J P 2021-03-24 8:09 ` Mark Cave-Ayland 2021-03-24 9:51 ` Mauro Matteo Cascella 2021-03-24 15:53 ` Alexander Bulekov 2021-03-24 17:28 ` Philippe Mathieu-Daudé 2021-03-24 17:28 ` Philippe Mathieu-Daudé 2021-03-25 13:22 ` Mark Cave-Ayland 2021-03-29 3:21 ` Alexander Bulekov [this message] 2021-03-29 3:21 ` [PATCH] tests/qtest: add more tests for am53c974 device Alexander Bulekov 2021-04-01 8:15 ` [Bug 1909247] Re: QEMU: use after free vulnerability in esp_do_dma() in hw/scsi/esp.c Mark Cave-Ayland 2021-04-14 13:36 ` Mauro Matteo Cascella 2021-04-14 14:09 ` Mauro Matteo Cascella 2021-04-30 9:00 ` Thomas Huth
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210329032142.430539-1-alxndr@bu.edu \ --to=1909247@bugs.launchpad.net \ --cc=qemu-devel@nongnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).