1. Patchew
  2. QEMU
  3. View series

[Bug 1909247] [PATCH] tests/qtest: add more tests for am53c974 device

Alexander Bulekov posted 1 patch 3 years ago
Failed in applying to current master (apply log)
tests/qtest/am53c974-test.c | 1137 +++++++++++++++++++++++++++++++++++
1 file changed, 1137 insertions(+)
[Bug 1909247] [PATCH] tests/qtest: add more tests for am53c974 device
Posted by Alexander Bulekov 3 years ago 
Add some more regression tests for the esp device.

(Prasad's Patch)
Based-on: <161657108250.32717.5311086901810004029.malone@soybean.canonical.com>
(Mark's v2 Patchset)
Based-on: <20210317230223.24854-1-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
---

Hi Mark,
Hopefully these are useful. I realized that my previous message was
innacurate (I forgot to apply Prasad's patch, or your v2
patchset). The only corruptions that I am continuing to see are
heap-overflows. I am guessing that most of these are due to some mututal
root cause, so the number of tests far-exceeds the actual number of
errors, but I am providing all of the crashes with unique-looking
stack-traces, just in case.
Please let me know if I can provide anything else that would help.
-Alex

 tests/qtest/am53c974-test.c | 1137 +++++++++++++++++++++++++++++++++++
 1 file changed, 1137 insertions(+)

diff --git a/tests/qtest/am53c974-test.c b/tests/qtest/am53c974-test.c
index c90bd4c187..cb2a5646a6 100644
--- a/tests/qtest/am53c974-test.c
+++ b/tests/qtest/am53c974-test.c
@@ -9,6 +9,1125 @@
 
 #include "libqos/libqtest.h"
 
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outb 0xc000 0x4
+ * outb 0xc008 0xa0
+ * outl 0xc03f 0x0300
+ * outl 0xc00b 0xc300
+ * outw 0xc00b 0x9000
+ * outl 0xc00b 0xc300
+ * outl 0xc00b 0xc300
+ * outl 0xc00b 0xc300
+ * outw 0xc00b 0x9000
+ * outw 0xc00b 0x1000
+ * EOF
+ */
+static void crash_0900379669(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outb(s, 0xc000, 0x4);
+    qtest_outb(s, 0xc008, 0xa0);
+    qtest_outl(s, 0xc03f, 0x0300);
+    qtest_outl(s, 0xc00b, 0xc300);
+    qtest_outw(s, 0xc00b, 0x9000);
+    qtest_outl(s, 0xc00b, 0xc300);
+    qtest_outl(s, 0xc00b, 0xc300);
+    qtest_outl(s, 0xc00b, 0xc300);
+    qtest_outw(s, 0xc00b, 0x9000);
+    qtest_outw(s, 0xc00b, 0x1000);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outl 0xc008 0x20
+ * outw 0xc000 0x1
+ * outb 0xc040 0x03
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outw 0xc00b 0x4200
+ * outl 0xc00a 0x410000
+ * EOF
+ */
+static void crash_094661a91b(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outl(s, 0xc008, 0x20);
+    qtest_outw(s, 0xc000, 0x1);
+    qtest_outb(s, 0xc040, 0x03);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outw(s, 0xc00b, 0x4200);
+    qtest_outl(s, 0xc00a, 0x410000);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outb 0xc000 0x4
+ * outl 0xc007 0x8000
+ * outl 0xc03f 0x0300
+ * outl 0xc00b 0x4300
+ * outw 0xc00b 0x9000
+ * outl 0xc00b 0xc300
+ * outl 0xc00b 0xc300
+ * outl 0xc00b 0xc300
+ * outw 0xc00b 0x9000
+ * outw 0xc00b 0x1000
+ * EOF
+ */
+static void crash_0fff2155cb(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outb(s, 0xc000, 0x4);
+    qtest_outl(s, 0xc007, 0x8000);
+    qtest_outl(s, 0xc03f, 0x0300);
+    qtest_outl(s, 0xc00b, 0x4300);
+    qtest_outw(s, 0xc00b, 0x9000);
+    qtest_outl(s, 0xc00b, 0xc300);
+    qtest_outl(s, 0xc00b, 0xc300);
+    qtest_outl(s, 0xc00b, 0xc300);
+    qtest_outw(s, 0xc00b, 0x9000);
+    qtest_outw(s, 0xc00b, 0x1000);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outw 0xc00c 0x41
+ * outw 0xc00a 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x43
+ * outw 0xc00b 0x00
+ * outw 0xc00b 0x00
+ * outw 0xc00c 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00a 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00a 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00a 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x00
+ * outl 0xc00a 0x00
+ * outl 0xc006 0x00
+ * outl 0xc00b 0x00
+ * outw 0xc00b 0x0800
+ * outw 0xc00b 0x00
+ * outw 0xc00b 0x00
+ * outl 0xc006 0x00
+ * outl 0xc00b 0x00
+ * outw 0xc00b 0x0800
+ * outw 0xc00b 0x00
+ * outw 0xc00b 0x4100
+ * outw 0xc00a 0x00
+ * outl 0xc00a 0x100000
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x43
+ * outl 0xc00a 0x100000
+ * outl 0xc00a 0x100000
+ * EOF
+ */
+static void crash_1548bd10e7(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outw(s, 0xc00c, 0x41);
+    qtest_outw(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x43);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc006, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x0800);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc006, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x0800);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x4100);
+    qtest_outw(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x100000);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x43);
+    qtest_outl(s, 0xc00a, 0x100000);
+    qtest_outl(s, 0xc00a, 0x100000);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outl 0xc00a 0x420000
+ * outl 0xc00a 0x430000
+ * outl 0xc00b 0x00
+ * outw 0xc00b 0x00
+ * outw 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outw 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outw 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outb 0xc008 0x00
+ * outw 0xc00b 0x00
+ * outb 0xc008 0xa0
+ * outw 0xc00b 0x00
+ * outw 0xc00b 0x00
+ * outw 0xc00b 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00b 0x00
+ * outl 0xc00a 0x00
+ * outl 0xc00a 0x00
+ * outl 0xc00b 0x00
+ * outw 0xc00b 0x00
+ * outl 0xc00b 0x1000
+ * outw 0xc00b 0x1000
+ * EOF
+ */
+static void crash_1afe349482(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outl(s, 0xc00a, 0x420000);
+    qtest_outl(s, 0xc00a, 0x430000);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outb(s, 0xc008, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outb(s, 0xc008, 0xa0);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x1000);
+    qtest_outw(s, 0xc00b, 0x1000);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outl 0xc007 0x2000
+ * outw 0xc00b 0x0100
+ * outw 0xc00c 0x43
+ * outl 0xc00a 0x00
+ * outw 0xc00a 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00a 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00a 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x00
+ * outw 0xc00b 0x00
+ * outw 0xc00b 0x00
+ * outw 0xc00c 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00a 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x00
+ * outl 0xc00a 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x00
+ * outw 0xc00b 0x00
+ * outw 0xc00b 0x00
+ * outw 0xc00c 0x00
+ * outw 0xc00a 0x00
+ * outl 0xc00a 0x100000
+ * outl 0xc00a 0x100000
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x43
+ * outl 0xc00a 0x100000
+ * outl 0xc00a 0x100000
+ * EOF
+ */
+static void crash_1b42581317(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outl(s, 0xc007, 0x2000);
+    qtest_outw(s, 0xc00b, 0x0100);
+    qtest_outw(s, 0xc00c, 0x43);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outw(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x100000);
+    qtest_outl(s, 0xc00a, 0x100000);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x43);
+    qtest_outl(s, 0xc00a, 0x100000);
+    qtest_outl(s, 0xc00a, 0x100000);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outl 0xc007 0x1500
+ * outw 0xc00b 0x4100
+ * outw 0xc00b 0x4100
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x00
+ * outw 0xc00b 0x1000
+ * outw 0xc009 0x00
+ * outl 0xc00b 0xc000
+ * outl 0xc00b 0xc000
+ * outl 0xc00b 0xc000
+ * outl 0xc00b 0xc000
+ * outl 0xc00b 0x0
+ * outl 0xc00b 0xc000
+ * outl 0xc00b 0xc000
+ * outl 0xc00b 0xc000
+ * outl 0xc007 0x00
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x1000
+ * outl 0xc007 0x00
+ * outw 0xc00b 0x4100
+ * EOF
+ */
+static void crash_30e28cfa86(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outl(s, 0xc007, 0x1500);
+    qtest_outw(s, 0xc00b, 0x4100);
+    qtest_outw(s, 0xc00b, 0x4100);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x1000);
+    qtest_outw(s, 0xc009, 0x00);
+    qtest_outl(s, 0xc00b, 0xc000);
+    qtest_outl(s, 0xc00b, 0xc000);
+    qtest_outl(s, 0xc00b, 0xc000);
+    qtest_outl(s, 0xc00b, 0xc000);
+    qtest_outl(s, 0xc00b, 0x0);
+    qtest_outl(s, 0xc00b, 0xc000);
+    qtest_outl(s, 0xc00b, 0xc000);
+    qtest_outl(s, 0xc00b, 0xc000);
+    qtest_outl(s, 0xc007, 0x00);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x1000);
+    qtest_outl(s, 0xc007, 0x00);
+    qtest_outw(s, 0xc00b, 0x4100);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outb 0xc008 0x42
+ * outw 0xc00b 0x4100
+ * outw 0xc00b 0x4100
+ * outw 0xc00b 0x00
+ * outw 0xc00b 0x1000
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outl 0xc00b 0x0300
+ * outw 0xc00b 0x1000
+ * EOF
+ */
+static void crash_34093bfc7c(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outb(s, 0xc008, 0x42);
+    qtest_outw(s, 0xc00b, 0x4100);
+    qtest_outw(s, 0xc00b, 0x4100);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x1000);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_outw(s, 0xc00b, 0x1000);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outw 0xc000 0x1
+ * outb 0xc040 0x03
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outw 0xc007 0xa000
+ * outl 0xc00a 0x410000
+ * EOF
+ */
+static void crash_3a05434a1f(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outw(s, 0xc000, 0x1);
+    qtest_outb(s, 0xc040, 0x03);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outw(s, 0xc007, 0xa000);
+    qtest_outl(s, 0xc00a, 0x410000);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outw 0xc000 0x01
+ * outb 0xc040 0x03
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0x4200
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0x4000
+ * outl 0xc00b 0xc200
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0x00
+ * outw 0xc00b 0x00
+ * EOF
+ */
+static void crash_3ab5744bc3(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outw(s, 0xc000, 0x01);
+    qtest_outb(s, 0xc040, 0x03);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0x4200);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0x4000);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outl 0xc00b 0x4100
+ * outw 0xc00b 0xc200
+ * outl 0xc03f 0x0300
+ * EOF
+ */
+static void crash_530ff2e211(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outl(s, 0xc00b, 0x4100);
+    qtest_outw(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc03f, 0x0300);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outl 0xc03f 0x0300
+ * outw 0xc00b 0x4300
+ * outw 0xc000 0x01
+ * outw 0xc009 0x00
+ * outw 0xc00b 0x1000
+ * outl 0xc00d 0x02000000
+ * outw 0xc00c 0xc2
+ * outw 0xc00b 0x4100
+ * outl 0xc00b 0x1000
+ * EOF
+ */
+static void crash_76ab101171(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outl(s, 0xc03f, 0x0300);
+    qtest_outw(s, 0xc00b, 0x4300);
+    qtest_outw(s, 0xc000, 0x01);
+    qtest_outw(s, 0xc009, 0x00);
+    qtest_outw(s, 0xc00b, 0x1000);
+    qtest_outl(s, 0xc00d, 0x02000000);
+    qtest_outw(s, 0xc00c, 0xc2);
+    qtest_outw(s, 0xc00b, 0x4100);
+    qtest_outl(s, 0xc00b, 0x1000);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outb 0xc000 0x4
+ * outw 0xc007 0x4000
+ * outl 0xc03f 0x0300
+ * outl 0xc00b 0xc300
+ * outw 0xc00b 0x9000
+ * outl 0xc00b 0xc300
+ * outw 0xc00b 0x9000
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0xc300
+ * outw 0xc00b 0x9000
+ * outw 0xc00b 0x1000
+ * EOF
+ */
+static void crash_7f743a0082(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outb(s, 0xc000, 0x4);
+    qtest_outw(s, 0xc007, 0x4000);
+    qtest_outl(s, 0xc03f, 0x0300);
+    qtest_outl(s, 0xc00b, 0xc300);
+    qtest_outw(s, 0xc00b, 0x9000);
+    qtest_outl(s, 0xc00b, 0xc300);
+    qtest_outw(s, 0xc00b, 0x9000);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0xc300);
+    qtest_outw(s, 0xc00b, 0x9000);
+    qtest_outw(s, 0xc00b, 0x1000);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outb 0xc000 0x4
+ * outl 0xc03f 0x0300
+ * outl 0xc00b 0xc300
+ * outw 0xc00b 0x9000
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0xc300
+ * outw 0xc00b 0x9000
+ * outl 0xc00b 0x00
+ * outl 0xc00b 0xc300
+ * outl 0xc00b 0xc300
+ * outw 0xc00b 0x9000
+ * outw 0xc00b 0x1000
+ * EOF
+ */
+static void crash_87744a2e67(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outb(s, 0xc000, 0x4);
+    qtest_outl(s, 0xc03f, 0x0300);
+    qtest_outl(s, 0xc00b, 0xc300);
+    qtest_outw(s, 0xc00b, 0x9000);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0xc300);
+    qtest_outw(s, 0xc00b, 0x9000);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0xc300);
+    qtest_outl(s, 0xc00b, 0xc300);
+    qtest_outw(s, 0xc00b, 0x9000);
+    qtest_outw(s, 0xc00b, 0x1000);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outw 0xc00c 0x41
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x43
+ * outw 0xc00b 0x00
+ * outw 0xc00b 0x00
+ * outw 0xc00c 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00a 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00a 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00a 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x00
+ * outw 0xc00b 0x00
+ * outw 0xc00b 0x00
+ * outw 0xc00c 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00a 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x00
+ * outl 0xc00a 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x00
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x00
+ * outw 0xc00b 0x00
+ * outw 0xc00b 0x00
+ * outw 0xc00c 0x00
+ * outw 0xc00a 0x00
+ * outl 0xc00a 0x100000
+ * outl 0xc00a 0x100000
+ * outl 0xc00a 0x00
+ * outw 0xc00c 0x43
+ * outl 0xc00a 0x100000
+ * outl 0xc00a 0x100000
+ * EOF
+ */
+static void crash_9f92a77bd6(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outw(s, 0xc00c, 0x41);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x43);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00c, 0x00);
+    qtest_outw(s, 0xc00a, 0x00);
+    qtest_outl(s, 0xc00a, 0x100000);
+    qtest_outl(s, 0xc00a, 0x100000);
+    qtest_outl(s, 0xc00a, 0x00);
+    qtest_outw(s, 0xc00c, 0x43);
+    qtest_outl(s, 0xc00a, 0x100000);
+    qtest_outl(s, 0xc00a, 0x100000);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outb 0xc008 0xa
+ * outw 0xc00b 0x4100
+ * outw 0xc00b 0x4100
+ * outw 0xc00b 0x1000
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0400
+ * outl 0xc00b 0x0400
+ * outl 0xc00b 0x0400
+ * outl 0xc00b 0x0400
+ * outl 0xc00b 0x0400
+ * outl 0xc00b 0x0400
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0400
+ * outl 0xc00b 0x0400
+ * outl 0xc00b 0x0400
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0400
+ * outl 0xc00b 0x0400
+ * outl 0xc00b 0x0400
+ * outl 0xc00b 0x4200
+ * EOF
+ */
+static void crash_d94dc29565(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outb(s, 0xc008, 0xa);
+    qtest_outw(s, 0xc00b, 0x4100);
+    qtest_outw(s, 0xc00b, 0x4100);
+    qtest_outw(s, 0xc00b, 0x1000);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0400);
+    qtest_outl(s, 0xc00b, 0x0400);
+    qtest_outl(s, 0xc00b, 0x0400);
+    qtest_outl(s, 0xc00b, 0x0400);
+    qtest_outl(s, 0xc00b, 0x0400);
+    qtest_outl(s, 0xc00b, 0x0400);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0400);
+    qtest_outl(s, 0xc00b, 0x0400);
+    qtest_outl(s, 0xc00b, 0x0400);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0400);
+    qtest_outl(s, 0xc00b, 0x0400);
+    qtest_outl(s, 0xc00b, 0x0400);
+    qtest_outl(s, 0xc00b, 0x4200);
+    qtest_quit(s);
+}
+/*
+ * cat << EOF | ./qemu-system-i386 -display none -machine accel=qtest, -m \
+ * 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 -drive \
+ * id=disk0,if=none,file=null-co://,format=raw -nodefaults -qtest stdio
+ * outl 0xcf8 0x80001010
+ * outl 0xcfc 0xc000
+ * outl 0xcf8 0x80001004
+ * outw 0xcfc 0x01
+ * outw 0xc00b 0x4100
+ * outl 0xc00b 0x0300
+ * inl 0xc00b
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x0800
+ * outl 0xc00b 0x00
+ * outl 0xc00a 0x410000
+ * EOF
+ */
+static void crash_df5a21ccf3(void)
+{
+    QTestState *s = qtest_init(
+        "-display none -m 512M -device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outw(s, 0xc00b, 0x4100);
+    qtest_outl(s, 0xc00b, 0x0300);
+    qtest_inl(s, 0xc00b);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x0800);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00a, 0x410000);
+    qtest_quit(s);
+}
 
 static void test_cmdfifo_underflow_ok(void)
 {
@@ -106,6 +1225,24 @@ int main(int argc, char **argv)
     g_test_init(&argc, &argv, NULL);
 
     if (strcmp(arch, "i386") == 0) {
+        qtest_add_func("fuzz/crash_0900379669", crash_0900379669);
+        qtest_add_func("fuzz/crash_094661a91b", crash_094661a91b);
+        qtest_add_func("fuzz/crash_0fff2155cb", crash_0fff2155cb);
+        qtest_add_func("fuzz/crash_1548bd10e7", crash_1548bd10e7);
+        qtest_add_func("fuzz/crash_1afe349482", crash_1afe349482);
+        qtest_add_func("fuzz/crash_1b42581317", crash_1b42581317);
+        qtest_add_func("fuzz/crash_30e28cfa86", crash_30e28cfa86);
+        qtest_add_func("fuzz/crash_34093bfc7c", crash_34093bfc7c);
+        qtest_add_func("fuzz/crash_3a05434a1f", crash_3a05434a1f);
+        qtest_add_func("fuzz/crash_3ab5744bc3", crash_3ab5744bc3);
+        qtest_add_func("fuzz/crash_530ff2e211", crash_530ff2e211);
+        qtest_add_func("fuzz/crash_76ab101171", crash_76ab101171);
+        qtest_add_func("fuzz/crash_7f743a0082", crash_7f743a0082);
+        qtest_add_func("fuzz/crash_87744a2e67", crash_87744a2e67);
+        qtest_add_func("fuzz/crash_9f92a77bd6", crash_9f92a77bd6);
+        qtest_add_func("fuzz/crash_d94dc29565", crash_d94dc29565);
+        qtest_add_func("fuzz/crash_dd24c44f80", crash_dd24c44f80);
+        qtest_add_func("fuzz/crash_df5a21ccf3", crash_df5a21ccf3);
         qtest_add_func("am53c974/test_cmdfifo_underflow_ok",
                        test_cmdfifo_underflow_ok);
         qtest_add_func("am53c974/test_cmdfifo_overflow_ok",
-- 
2.28.0

-- 
You received this bug notification because you are a member of qemu-
devel-ml, which is subscribed to QEMU.
https://bugs.launchpad.net/bugs/1909247

Title:
  QEMU: use after free vulnerability in esp_do_dma() in hw/scsi/esp.c

Status in QEMU:
  New

Bug description:
  A use-after-free vulnerability was found in the am53c974 SCSI host bus
  adapter emulation of QEMU. It could occur in the esp_do_dma() function
  in hw/scsi/esp.c while handling the 'Information Transfer' command
  (CMD_TI). A privileged guest user may abuse this flaw to crash the
  QEMU process on the host, resulting in a denial of service or
  potential code execution with the privileges of the QEMU process.

  This issue was reported by Cheolwoo Myung (Seoul National University).

  Original report:
  Using hypervisor fuzzer, hyfuzz, I found a use-after-free issue in
  am53c974 emulator of QEMU enabled ASan.

  It occurs while transferring information, as it does not check the
  buffer to be transferred.

  A malicious guest user/process could use this flaw to crash the QEMU
  process resulting in DoS scenario.

  To reproduce this issue, please run the QEMU with the following command
  line.

  # To enable ASan option, please set configuration with the following
  $ ./configure --target-list=i386-softmmu --disable-werror --enable-sanitizers
  $ make

  # To reproduce this issue, please run the QEMU process with the following command line
  $ ./qemu-system-i386 -m 512 -drive file=./hyfuzz.img,index=0,media=disk,format=raw \
  -device am53c974,id=scsi -device scsi-hd,drive=SysDisk \
  -drive id=SysDisk,if=none,file=./disk.img

  Please find attached the disk images to reproduce this issue.

To manage notifications about this bug go to:
https://bugs.launchpad.net/qemu/+bug/1909247/+subscriptions

Patchew 2.1-devel-0870f84

© 2016 - 2024 Red Hat, Inc.