monitor: fix use after free
[qemu/ar7.git] / qtest.c
blobef0d99191c58589107b9cd06f160be635768cc16
1 /*
2 * Test Server
4 * Copyright IBM, Corp. 2011
6 * Authors:
7 * Anthony Liguori <aliguori@us.ibm.com>
9 * This work is licensed under the terms of the GNU GPL, version 2 or later.
10 * See the COPYING file in the top-level directory.
14 #include "sysemu/qtest.h"
15 #include "hw/qdev.h"
16 #include "sysemu/char.h"
17 #include "exec/ioport.h"
18 #include "exec/memory.h"
19 #include "hw/irq.h"
20 #include "sysemu/sysemu.h"
21 #include "sysemu/cpus.h"
22 #include "qemu/config-file.h"
23 #include "qemu/option.h"
24 #include "qemu/error-report.h"
26 #define MAX_IRQ 256
28 bool qtest_allowed;
30 static DeviceState *irq_intercept_dev;
31 static FILE *qtest_log_fp;
32 static CharDriverState *qtest_chr;
33 static GString *inbuf;
34 static int irq_levels[MAX_IRQ];
35 static qemu_timeval start_time;
36 static bool qtest_opened;
38 #define FMT_timeval "%ld.%06ld"
40 /**
41 * QTest Protocol
43 * Line based protocol, request/response based. Server can send async messages
44 * so clients should always handle many async messages before the response
45 * comes in.
47 * Valid requests
49 * Clock management:
51 * The qtest client is completely in charge of the QEMU_CLOCK_VIRTUAL. qtest commands
52 * let you adjust the value of the clock (monotonically). All the commands
53 * return the current value of the clock in nanoseconds.
55 * > clock_step
56 * < OK VALUE
58 * Advance the clock to the next deadline. Useful when waiting for
59 * asynchronous events.
61 * > clock_step NS
62 * < OK VALUE
64 * Advance the clock by NS nanoseconds.
66 * > clock_set NS
67 * < OK VALUE
69 * Advance the clock to NS nanoseconds (do nothing if it's already past).
71 * PIO and memory access:
73 * > outb ADDR VALUE
74 * < OK
76 * > outw ADDR VALUE
77 * < OK
79 * > outl ADDR VALUE
80 * < OK
82 * > inb ADDR
83 * < OK VALUE
85 * > inw ADDR
86 * < OK VALUE
88 * > inl ADDR
89 * < OK VALUE
91 * > writeb ADDR VALUE
92 * < OK
94 * > writew ADDR VALUE
95 * < OK
97 * > writel ADDR VALUE
98 * < OK
100 * > writeq ADDR VALUE
101 * < OK
103 * > readb ADDR
104 * < OK VALUE
106 * > readw ADDR
107 * < OK VALUE
109 * > readl ADDR
110 * < OK VALUE
112 * > readq ADDR
113 * < OK VALUE
115 * > read ADDR SIZE
116 * < OK DATA
118 * > write ADDR SIZE DATA
119 * < OK
121 * ADDR, SIZE, VALUE are all integers parsed with strtoul() with a base of 0.
123 * DATA is an arbitrarily long hex number prefixed with '0x'. If it's smaller
124 * than the expected size, the value will be zero filled at the end of the data
125 * sequence.
127 * IRQ management:
129 * > irq_intercept_in QOM-PATH
130 * < OK
132 * > irq_intercept_out QOM-PATH
133 * < OK
135 * Attach to the gpio-in (resp. gpio-out) pins exported by the device at
136 * QOM-PATH. When the pin is triggered, one of the following async messages
137 * will be printed to the qtest stream:
139 * IRQ raise NUM
140 * IRQ lower NUM
142 * where NUM is an IRQ number. For the PC, interrupts can be intercepted
143 * simply with "irq_intercept_in ioapic" (note that IRQ0 comes out with
144 * NUM=0 even though it is remapped to GSI 2).
147 static int hex2nib(char ch)
149 if (ch >= '0' && ch <= '9') {
150 return ch - '0';
151 } else if (ch >= 'a' && ch <= 'f') {
152 return 10 + (ch - 'a');
153 } else if (ch >= 'A' && ch <= 'F') {
154 return 10 + (ch - 'A');
155 } else {
156 return -1;
160 static void qtest_get_time(qemu_timeval *tv)
162 qemu_gettimeofday(tv);
163 tv->tv_sec -= start_time.tv_sec;
164 tv->tv_usec -= start_time.tv_usec;
165 if (tv->tv_usec < 0) {
166 tv->tv_usec += 1000000;
167 tv->tv_sec -= 1;
171 static void qtest_send_prefix(CharDriverState *chr)
173 qemu_timeval tv;
175 if (!qtest_log_fp || !qtest_opened) {
176 return;
179 qtest_get_time(&tv);
180 fprintf(qtest_log_fp, "[S +" FMT_timeval "] ",
181 (long) tv.tv_sec, (long) tv.tv_usec);
184 static void GCC_FMT_ATTR(2, 3) qtest_send(CharDriverState *chr,
185 const char *fmt, ...)
187 va_list ap;
188 char buffer[1024];
189 size_t len;
191 va_start(ap, fmt);
192 len = vsnprintf(buffer, sizeof(buffer), fmt, ap);
193 va_end(ap);
195 qemu_chr_fe_write_all(chr, (uint8_t *)buffer, len);
196 if (qtest_log_fp && qtest_opened) {
197 fprintf(qtest_log_fp, "%s", buffer);
201 static void qtest_irq_handler(void *opaque, int n, int level)
203 qemu_irq *old_irqs = opaque;
204 qemu_set_irq(old_irqs[n], level);
206 if (irq_levels[n] != level) {
207 CharDriverState *chr = qtest_chr;
208 irq_levels[n] = level;
209 qtest_send_prefix(chr);
210 qtest_send(chr, "IRQ %s %d\n",
211 level ? "raise" : "lower", n);
215 static void qtest_process_command(CharDriverState *chr, gchar **words)
217 const gchar *command;
219 g_assert(words);
221 command = words[0];
223 if (qtest_log_fp) {
224 qemu_timeval tv;
225 int i;
227 qtest_get_time(&tv);
228 fprintf(qtest_log_fp, "[R +" FMT_timeval "]",
229 (long) tv.tv_sec, (long) tv.tv_usec);
230 for (i = 0; words[i]; i++) {
231 fprintf(qtest_log_fp, " %s", words[i]);
233 fprintf(qtest_log_fp, "\n");
236 g_assert(command);
237 if (strcmp(words[0], "irq_intercept_out") == 0
238 || strcmp(words[0], "irq_intercept_in") == 0) {
239 DeviceState *dev;
240 NamedGPIOList *ngl;
242 g_assert(words[1]);
243 dev = DEVICE(object_resolve_path(words[1], NULL));
244 if (!dev) {
245 qtest_send_prefix(chr);
246 qtest_send(chr, "FAIL Unknown device\n");
247 return;
250 if (irq_intercept_dev) {
251 qtest_send_prefix(chr);
252 if (irq_intercept_dev != dev) {
253 qtest_send(chr, "FAIL IRQ intercept already enabled\n");
254 } else {
255 qtest_send(chr, "OK\n");
257 return;
260 QLIST_FOREACH(ngl, &dev->gpios, node) {
261 /* We don't support intercept of named GPIOs yet */
262 if (ngl->name) {
263 continue;
265 if (words[0][14] == 'o') {
266 qemu_irq_intercept_out(&ngl->out, qtest_irq_handler,
267 ngl->num_out);
268 } else {
269 qemu_irq_intercept_in(ngl->in, qtest_irq_handler,
270 ngl->num_in);
273 irq_intercept_dev = dev;
274 qtest_send_prefix(chr);
275 qtest_send(chr, "OK\n");
277 } else if (strcmp(words[0], "outb") == 0 ||
278 strcmp(words[0], "outw") == 0 ||
279 strcmp(words[0], "outl") == 0) {
280 uint16_t addr;
281 uint32_t value;
283 g_assert(words[1] && words[2]);
284 addr = strtoul(words[1], NULL, 0);
285 value = strtoul(words[2], NULL, 0);
287 if (words[0][3] == 'b') {
288 cpu_outb(addr, value);
289 } else if (words[0][3] == 'w') {
290 cpu_outw(addr, value);
291 } else if (words[0][3] == 'l') {
292 cpu_outl(addr, value);
294 qtest_send_prefix(chr);
295 qtest_send(chr, "OK\n");
296 } else if (strcmp(words[0], "inb") == 0 ||
297 strcmp(words[0], "inw") == 0 ||
298 strcmp(words[0], "inl") == 0) {
299 uint16_t addr;
300 uint32_t value = -1U;
302 g_assert(words[1]);
303 addr = strtoul(words[1], NULL, 0);
305 if (words[0][2] == 'b') {
306 value = cpu_inb(addr);
307 } else if (words[0][2] == 'w') {
308 value = cpu_inw(addr);
309 } else if (words[0][2] == 'l') {
310 value = cpu_inl(addr);
312 qtest_send_prefix(chr);
313 qtest_send(chr, "OK 0x%04x\n", value);
314 } else if (strcmp(words[0], "writeb") == 0 ||
315 strcmp(words[0], "writew") == 0 ||
316 strcmp(words[0], "writel") == 0 ||
317 strcmp(words[0], "writeq") == 0) {
318 uint64_t addr;
319 uint64_t value;
321 g_assert(words[1] && words[2]);
322 addr = strtoull(words[1], NULL, 0);
323 value = strtoull(words[2], NULL, 0);
325 if (words[0][5] == 'b') {
326 uint8_t data = value;
327 cpu_physical_memory_write(addr, &data, 1);
328 } else if (words[0][5] == 'w') {
329 uint16_t data = value;
330 tswap16s(&data);
331 cpu_physical_memory_write(addr, &data, 2);
332 } else if (words[0][5] == 'l') {
333 uint32_t data = value;
334 tswap32s(&data);
335 cpu_physical_memory_write(addr, &data, 4);
336 } else if (words[0][5] == 'q') {
337 uint64_t data = value;
338 tswap64s(&data);
339 cpu_physical_memory_write(addr, &data, 8);
341 qtest_send_prefix(chr);
342 qtest_send(chr, "OK\n");
343 } else if (strcmp(words[0], "readb") == 0 ||
344 strcmp(words[0], "readw") == 0 ||
345 strcmp(words[0], "readl") == 0 ||
346 strcmp(words[0], "readq") == 0) {
347 uint64_t addr;
348 uint64_t value = UINT64_C(-1);
350 g_assert(words[1]);
351 addr = strtoull(words[1], NULL, 0);
353 if (words[0][4] == 'b') {
354 uint8_t data;
355 cpu_physical_memory_read(addr, &data, 1);
356 value = data;
357 } else if (words[0][4] == 'w') {
358 uint16_t data;
359 cpu_physical_memory_read(addr, &data, 2);
360 value = tswap16(data);
361 } else if (words[0][4] == 'l') {
362 uint32_t data;
363 cpu_physical_memory_read(addr, &data, 4);
364 value = tswap32(data);
365 } else if (words[0][4] == 'q') {
366 cpu_physical_memory_read(addr, &value, 8);
367 tswap64s(&value);
369 qtest_send_prefix(chr);
370 qtest_send(chr, "OK 0x%016" PRIx64 "\n", value);
371 } else if (strcmp(words[0], "read") == 0) {
372 uint64_t addr, len, i;
373 uint8_t *data;
375 g_assert(words[1] && words[2]);
376 addr = strtoull(words[1], NULL, 0);
377 len = strtoull(words[2], NULL, 0);
379 data = g_malloc(len);
380 cpu_physical_memory_read(addr, data, len);
382 qtest_send_prefix(chr);
383 qtest_send(chr, "OK 0x");
384 for (i = 0; i < len; i++) {
385 qtest_send(chr, "%02x", data[i]);
387 qtest_send(chr, "\n");
389 g_free(data);
390 } else if (strcmp(words[0], "write") == 0) {
391 uint64_t addr, len, i;
392 uint8_t *data;
393 size_t data_len;
395 g_assert(words[1] && words[2] && words[3]);
396 addr = strtoull(words[1], NULL, 0);
397 len = strtoull(words[2], NULL, 0);
399 data_len = strlen(words[3]);
400 if (data_len < 3) {
401 qtest_send(chr, "ERR invalid argument size\n");
402 return;
405 data = g_malloc(len);
406 for (i = 0; i < len; i++) {
407 if ((i * 2 + 4) <= data_len) {
408 data[i] = hex2nib(words[3][i * 2 + 2]) << 4;
409 data[i] |= hex2nib(words[3][i * 2 + 3]);
410 } else {
411 data[i] = 0;
414 cpu_physical_memory_write(addr, data, len);
415 g_free(data);
417 qtest_send_prefix(chr);
418 qtest_send(chr, "OK\n");
419 } else if (qtest_enabled() && strcmp(words[0], "clock_step") == 0) {
420 int64_t ns;
422 if (words[1]) {
423 ns = strtoll(words[1], NULL, 0);
424 } else {
425 ns = qemu_clock_deadline_ns_all(QEMU_CLOCK_VIRTUAL);
427 qtest_clock_warp(qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + ns);
428 qtest_send_prefix(chr);
429 qtest_send(chr, "OK %"PRIi64"\n", (int64_t)qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
430 } else if (qtest_enabled() && strcmp(words[0], "clock_set") == 0) {
431 int64_t ns;
433 g_assert(words[1]);
434 ns = strtoll(words[1], NULL, 0);
435 qtest_clock_warp(ns);
436 qtest_send_prefix(chr);
437 qtest_send(chr, "OK %"PRIi64"\n", (int64_t)qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
438 } else {
439 qtest_send_prefix(chr);
440 qtest_send(chr, "FAIL Unknown command `%s'\n", words[0]);
444 static void qtest_process_inbuf(CharDriverState *chr, GString *inbuf)
446 char *end;
448 while ((end = strchr(inbuf->str, '\n')) != NULL) {
449 size_t offset;
450 GString *cmd;
451 gchar **words;
453 offset = end - inbuf->str;
455 cmd = g_string_new_len(inbuf->str, offset);
456 g_string_erase(inbuf, 0, offset + 1);
458 words = g_strsplit(cmd->str, " ", 0);
459 qtest_process_command(chr, words);
460 g_strfreev(words);
462 g_string_free(cmd, TRUE);
466 static void qtest_read(void *opaque, const uint8_t *buf, int size)
468 CharDriverState *chr = opaque;
470 g_string_append_len(inbuf, (const gchar *)buf, size);
471 qtest_process_inbuf(chr, inbuf);
474 static int qtest_can_read(void *opaque)
476 return 1024;
479 static void qtest_event(void *opaque, int event)
481 int i;
483 switch (event) {
484 case CHR_EVENT_OPENED:
486 * We used to call qemu_system_reset() here, hoping we could
487 * use the same process for multiple tests that way. Never
488 * used. Injects an extra reset even when it's not used, and
489 * that can mess up tests, e.g. -boot once.
491 for (i = 0; i < ARRAY_SIZE(irq_levels); i++) {
492 irq_levels[i] = 0;
494 qemu_gettimeofday(&start_time);
495 qtest_opened = true;
496 if (qtest_log_fp) {
497 fprintf(qtest_log_fp, "[I " FMT_timeval "] OPENED\n",
498 (long) start_time.tv_sec, (long) start_time.tv_usec);
500 break;
501 case CHR_EVENT_CLOSED:
502 qtest_opened = false;
503 if (qtest_log_fp) {
504 qemu_timeval tv;
505 qtest_get_time(&tv);
506 fprintf(qtest_log_fp, "[I +" FMT_timeval "] CLOSED\n",
507 (long) tv.tv_sec, (long) tv.tv_usec);
509 break;
510 default:
511 break;
515 static void configure_qtest_icount(const char *options)
517 QemuOpts *opts = qemu_opts_parse(qemu_find_opts("icount"), options, 1);
518 configure_icount(opts, &error_abort);
519 qemu_opts_del(opts);
522 int qtest_init_accel(MachineClass *mc)
524 configure_qtest_icount("0");
525 return 0;
528 void qtest_init(const char *qtest_chrdev, const char *qtest_log, Error **errp)
530 CharDriverState *chr;
532 chr = qemu_chr_new("qtest", qtest_chrdev, NULL);
534 if (chr == NULL) {
535 error_setg(errp, "Failed to initialize device for qtest: \"%s\"",
536 qtest_chrdev);
537 return;
540 qemu_chr_add_handlers(chr, qtest_can_read, qtest_read, qtest_event, chr);
541 qemu_chr_fe_set_echo(chr, true);
543 inbuf = g_string_new("");
545 if (qtest_log) {
546 if (strcmp(qtest_log, "none") != 0) {
547 qtest_log_fp = fopen(qtest_log, "w+");
549 } else {
550 qtest_log_fp = stderr;
553 qtest_chr = chr;
556 bool qtest_driver(void)
558 return qtest_chr;