xref: /openbmc/qemu/system/qtest.c (revision 9ef49528b5286f078061b52ac41e0ca19fa10e36)
1 /*
2  * Test Server
3  *
4  * Copyright IBM, Corp. 2011
5  *
6  * Authors:
7  *  Anthony Liguori   <aliguori@us.ibm.com>
8  *
9  * This work is licensed under the terms of the GNU GPL, version 2 or later.
10  * See the COPYING file in the top-level directory.
11  *
12  */
13 
14 #include "qemu/osdep.h"
15 #include "qapi/error.h"
16 #include "system/qtest.h"
17 #include "system/runstate.h"
18 #include "chardev/char-fe.h"
19 #include "system/ioport.h"
20 #include "system/memory.h"
21 #include "exec/tswap.h"
22 #include "hw/qdev-core.h"
23 #include "hw/irq.h"
24 #include "hw/core/cpu.h"
25 #include "qemu/accel.h"
26 #include "system/cpu-timers.h"
27 #include "qemu/config-file.h"
28 #include "qemu/option.h"
29 #include "qemu/error-report.h"
30 #include "qemu/module.h"
31 #include "qemu/cutils.h"
32 #include "qemu/target-info.h"
33 #include "qom/object_interfaces.h"
34 
35 #define MAX_IRQ 256
36 
37 #define TYPE_QTEST "qtest"
38 
39 OBJECT_DECLARE_SIMPLE_TYPE(QTest, QTEST)
40 
41 struct QTest {
42     Object parent;
43 
44     bool has_machine_link;
45     char *chr_name;
46     Chardev *chr;
47     CharFrontend qtest_chr;
48     char *log;
49 };
50 
51 bool qtest_allowed;
52 
53 static DeviceState *irq_intercept_dev;
54 static FILE *qtest_log_fp;
55 static QTest *qtest;
56 static GString *inbuf;
57 static int irq_levels[MAX_IRQ];
58 static GTimer *timer;
59 static bool qtest_opened;
60 static void (*qtest_server_send)(void*, const char*);
61 static void *qtest_server_send_opaque;
62 
63 #define FMT_timeval "%.06f"
64 
65 /**
66  * DOC: QTest Protocol
67  *
68  * Line based protocol, request/response based.  Server can send async messages
69  * so clients should always handle many async messages before the response
70  * comes in.
71  *
72  * Extra ASCII space characters in command inputs are permitted and ignored.
73  * Lines containing only spaces are permitted and ignored.
74  *
75  * Valid requests
76  * ^^^^^^^^^^^^^^
77  *
78  * Clock management:
79  * """""""""""""""""
80  *
81  * The qtest client is completely in charge of the QEMU_CLOCK_VIRTUAL.  qtest commands
82  * let you adjust the value of the clock (monotonically).  All the commands
83  * return the current value of the clock in nanoseconds.
84  *
85  * If the commands FAIL then time wasn't advanced which is likely
86  * because the machine was in a paused state or no timer events exist
87  * in the future. This will cause qtest to abort and the test will
88  * need to check its assumptions.
89  *
90  * .. code-block:: none
91  *
92  *  > clock_step
93  *  < OK VALUE
94  *
95  * Advance the clock to the next deadline.  Useful when waiting for
96  * asynchronous events.
97  *
98  * .. code-block:: none
99  *
100  *  > clock_step NS
101  *  < OK VALUE
102  *
103  * Advance the clock by NS nanoseconds.
104  *
105  * .. code-block:: none
106  *
107  *  > clock_set NS
108  *  < OK VALUE
109  *
110  * Advance the clock to NS nanoseconds (do nothing if it's already past).
111  *
112  * PIO and memory access:
113  * """"""""""""""""""""""
114  *
115  * .. code-block:: none
116  *
117  *  > outb ADDR VALUE
118  *  < OK
119  *
120  * .. code-block:: none
121  *
122  *  > outw ADDR VALUE
123  *  < OK
124  *
125  * .. code-block:: none
126  *
127  *  > outl ADDR VALUE
128  *  < OK
129  *
130  * .. code-block:: none
131  *
132  *  > inb ADDR
133  *  < OK VALUE
134  *
135  * .. code-block:: none
136  *
137  *  > inw ADDR
138  *  < OK VALUE
139  *
140  * .. code-block:: none
141  *
142  *  > inl ADDR
143  *  < OK VALUE
144  *
145  * .. code-block:: none
146  *
147  *  > writeb ADDR VALUE
148  *  < OK
149  *
150  * .. code-block:: none
151  *
152  *  > writew ADDR VALUE
153  *  < OK
154  *
155  * .. code-block:: none
156  *
157  *  > writel ADDR VALUE
158  *  < OK
159  *
160  * .. code-block:: none
161  *
162  *  > writeq ADDR VALUE
163  *  < OK
164  *
165  * .. code-block:: none
166  *
167  *  > readb ADDR
168  *  < OK VALUE
169  *
170  * .. code-block:: none
171  *
172  *  > readw ADDR
173  *  < OK VALUE
174  *
175  * .. code-block:: none
176  *
177  *  > readl ADDR
178  *  < OK VALUE
179  *
180  * .. code-block:: none
181  *
182  *  > readq ADDR
183  *  < OK VALUE
184  *
185  * .. code-block:: none
186  *
187  *  > read ADDR SIZE
188  *  < OK DATA
189  *
190  * .. code-block:: none
191  *
192  *  > write ADDR SIZE DATA
193  *  < OK
194  *
195  * .. code-block:: none
196  *
197  *  > b64read ADDR SIZE
198  *  < OK B64_DATA
199  *
200  * .. code-block:: none
201  *
202  *  > b64write ADDR SIZE B64_DATA
203  *  < OK
204  *
205  * .. code-block:: none
206  *
207  *  > memset ADDR SIZE VALUE
208  *  < OK
209  *
210  * ADDR, SIZE, VALUE are all integers parsed with strtoul() with a base of 0.
211  * For 'memset' a zero size is permitted and does nothing.
212  *
213  * DATA is an arbitrarily long hex number prefixed with '0x'.  If it's smaller
214  * than the expected size, the value will be zero filled at the end of the data
215  * sequence.
216  *
217  * B64_DATA is an arbitrarily long base64 encoded string.
218  * If the sizes do not match, the data will be truncated.
219  *
220  * IRQ management:
221  * """""""""""""""
222  *
223  * .. code-block:: none
224  *
225  *  > irq_intercept_in QOM-PATH
226  *  < OK
227  *
228  * .. code-block:: none
229  *
230  *  > irq_intercept_out QOM-PATH
231  *  < OK
232  *
233  * Attach to the gpio-in (resp. gpio-out) pins exported by the device at
234  * QOM-PATH.  When the pin is triggered, one of the following async messages
235  * will be printed to the qtest stream::
236  *
237  *  IRQ raise NUM
238  *  IRQ lower NUM
239  *
240  * where NUM is an IRQ number.  For the PC, interrupts can be intercepted
241  * simply with "irq_intercept_in ioapic" (note that IRQ0 comes out with
242  * NUM=0 even though it is remapped to GSI 2).
243  *
244  * Setting interrupt level:
245  * """"""""""""""""""""""""
246  *
247  * .. code-block:: none
248  *
249  *  > set_irq_in QOM-PATH NAME NUM LEVEL
250  *  < OK
251  *
252  * where NAME is the name of the irq/gpio list, NUM is an IRQ number and
253  * LEVEL is an signed integer IRQ level.
254  *
255  * Forcibly set the given interrupt pin to the given level.
256  *
257  */
258 
259 static int hex2nib(char ch)
260 {
261     if (ch >= '0' && ch <= '9') {
262         return ch - '0';
263     } else if (ch >= 'a' && ch <= 'f') {
264         return 10 + (ch - 'a');
265     } else if (ch >= 'A' && ch <= 'F') {
266         return 10 + (ch - 'A');
267     } else {
268         return -1;
269     }
270 }
271 
272 static void qtest_log_timestamp(void)
273 {
274     if (!qtest_log_fp || !qtest_opened) {
275         return;
276     }
277 
278     fprintf(qtest_log_fp, "[S +" FMT_timeval "] ", g_timer_elapsed(timer, NULL));
279 }
280 
281 static void G_GNUC_PRINTF(1, 2) qtest_log_send(const char *fmt, ...)
282 {
283     va_list ap;
284 
285     if (!qtest_log_fp || !qtest_opened) {
286         return;
287     }
288 
289     qtest_log_timestamp();
290 
291     va_start(ap, fmt);
292     vfprintf(qtest_log_fp, fmt, ap);
293     va_end(ap);
294 }
295 
296 static void qtest_server_char_be_send(void *opaque, const char *str)
297 {
298     size_t len = strlen(str);
299     CharFrontend* chr = (CharFrontend *)opaque;
300     qemu_chr_fe_write_all(chr, (uint8_t *)str, len);
301     if (qtest_log_fp && qtest_opened) {
302         fprintf(qtest_log_fp, "%s", str);
303     }
304 }
305 
306 static void qtest_send(CharFrontend *chr, const char *str)
307 {
308     qtest_log_timestamp();
309     qtest_server_send(qtest_server_send_opaque, str);
310 }
311 
312 void qtest_sendf(CharFrontend *chr, const char *fmt, ...)
313 {
314     va_list ap;
315     gchar *buffer;
316 
317     va_start(ap, fmt);
318     buffer = g_strdup_vprintf(fmt, ap);
319     qtest_send(chr, buffer);
320     g_free(buffer);
321     va_end(ap);
322 }
323 
324 static void qtest_irq_handler(void *opaque, int n, int level)
325 {
326     qemu_irq old_irq = *(qemu_irq *)opaque;
327     qemu_set_irq(old_irq, level);
328 
329     if (irq_levels[n] != level) {
330         CharFrontend *chr = &qtest->qtest_chr;
331         irq_levels[n] = level;
332         qtest_sendf(chr, "IRQ %s %d\n",
333                     level ? "raise" : "lower", n);
334     }
335 }
336 
337 static bool (*process_command_cb)(CharFrontend *chr, gchar **words);
338 
339 void qtest_set_command_cb(bool (*pc_cb)(CharFrontend *chr, gchar **words))
340 {
341     assert(!process_command_cb);  /* Switch to a list if we need more than one */
342 
343     process_command_cb = pc_cb;
344 }
345 
346 static void qtest_install_gpio_out_intercept(DeviceState *dev, const char *name, int n)
347 {
348     qemu_irq *disconnected = g_new0(qemu_irq, 1);
349     qemu_irq icpt = qemu_allocate_irq(qtest_irq_handler,
350                                       disconnected, n);
351 
352     *disconnected = qdev_intercept_gpio_out(dev, icpt, name, n);
353 }
354 
355 static void qtest_process_command(CharFrontend *chr, gchar **words)
356 {
357     const gchar *command;
358 
359     g_assert(words);
360 
361     command = words[0];
362 
363     if (qtest_log_fp) {
364         int i;
365 
366         fprintf(qtest_log_fp, "[R +" FMT_timeval "]", g_timer_elapsed(timer, NULL));
367         for (i = 0; words[i]; i++) {
368             fprintf(qtest_log_fp, " %s", words[i]);
369         }
370         fprintf(qtest_log_fp, "\n");
371     }
372 
373     if (!command) {
374         /* Input line was blank: ignore it */
375         return;
376     }
377 
378     if (strcmp(words[0], "irq_intercept_out") == 0
379         || strcmp(words[0], "irq_intercept_in") == 0) {
380         DeviceState *dev;
381         NamedGPIOList *ngl;
382         bool is_named;
383         bool is_outbound;
384         bool interception_succeeded = false;
385 
386         g_assert(words[1]);
387         is_named = words[2] != NULL;
388         is_outbound = words[0][14] == 'o';
389         dev = DEVICE(object_resolve_path(words[1], NULL));
390         if (!dev) {
391             qtest_send(chr, "FAIL Unknown device\n");
392             return;
393         }
394 
395         if (is_named && !is_outbound) {
396             qtest_send(chr, "FAIL Interception of named in-GPIOs not yet supported\n");
397             return;
398         }
399 
400         if (irq_intercept_dev) {
401             if (irq_intercept_dev != dev) {
402                 qtest_send(chr, "FAIL IRQ intercept already enabled\n");
403             } else {
404                 qtest_send(chr, "OK\n");
405             }
406             return;
407         }
408 
409         QLIST_FOREACH(ngl, &dev->gpios, node) {
410             /* We don't support inbound interception of named GPIOs yet */
411             if (is_outbound) {
412                 /* NULL is valid and matchable, for "unnamed GPIO" */
413                 if (g_strcmp0(ngl->name, words[2]) == 0) {
414                     int i;
415                     for (i = 0; i < ngl->num_out; ++i) {
416                         qtest_install_gpio_out_intercept(dev, ngl->name, i);
417                     }
418                     interception_succeeded = true;
419                 }
420             } else {
421                 qemu_irq_intercept_in(ngl->in, qtest_irq_handler,
422                                       ngl->num_in);
423                 interception_succeeded = true;
424             }
425         }
426 
427         if (interception_succeeded) {
428             irq_intercept_dev = dev;
429             qtest_send(chr, "OK\n");
430         } else {
431             qtest_send(chr, "FAIL No intercepts installed\n");
432         }
433     } else if (strcmp(words[0], "set_irq_in") == 0) {
434         DeviceState *dev;
435         qemu_irq irq;
436         char *name;
437         int ret;
438         int num;
439         int level;
440 
441         g_assert(words[1] && words[2] && words[3] && words[4]);
442 
443         dev = DEVICE(object_resolve_path(words[1], NULL));
444         if (!dev) {
445             qtest_send(chr, "FAIL Unknown device\n");
446             return;
447         }
448 
449         if (strcmp(words[2], "unnamed-gpio-in") == 0) {
450             name = NULL;
451         } else {
452             name = words[2];
453         }
454 
455         ret = qemu_strtoi(words[3], NULL, 0, &num);
456         g_assert(!ret);
457         ret = qemu_strtoi(words[4], NULL, 0, &level);
458         g_assert(!ret);
459 
460         irq = qdev_get_gpio_in_named(dev, name, num);
461 
462         qemu_set_irq(irq, level);
463         qtest_send(chr, "OK\n");
464     } else if (strcmp(words[0], "outb") == 0 ||
465                strcmp(words[0], "outw") == 0 ||
466                strcmp(words[0], "outl") == 0) {
467         unsigned long addr;
468         unsigned long value;
469         int ret;
470 
471         g_assert(words[1] && words[2]);
472         ret = qemu_strtoul(words[1], NULL, 0, &addr);
473         g_assert(ret == 0);
474         ret = qemu_strtoul(words[2], NULL, 0, &value);
475         g_assert(ret == 0);
476         g_assert(addr <= 0xffff);
477 
478         if (words[0][3] == 'b') {
479             cpu_outb(addr, value);
480         } else if (words[0][3] == 'w') {
481             cpu_outw(addr, value);
482         } else if (words[0][3] == 'l') {
483             cpu_outl(addr, value);
484         }
485         qtest_send(chr, "OK\n");
486     } else if (strcmp(words[0], "inb") == 0 ||
487         strcmp(words[0], "inw") == 0 ||
488         strcmp(words[0], "inl") == 0) {
489         unsigned long addr;
490         uint32_t value = -1U;
491         int ret;
492 
493         g_assert(words[1]);
494         ret = qemu_strtoul(words[1], NULL, 0, &addr);
495         g_assert(ret == 0);
496         g_assert(addr <= 0xffff);
497 
498         if (words[0][2] == 'b') {
499             value = cpu_inb(addr);
500         } else if (words[0][2] == 'w') {
501             value = cpu_inw(addr);
502         } else if (words[0][2] == 'l') {
503             value = cpu_inl(addr);
504         }
505         qtest_sendf(chr, "OK 0x%04x\n", value);
506     } else if (strcmp(words[0], "writeb") == 0 ||
507                strcmp(words[0], "writew") == 0 ||
508                strcmp(words[0], "writel") == 0 ||
509                strcmp(words[0], "writeq") == 0) {
510         uint64_t addr;
511         uint64_t value;
512         int ret;
513 
514         g_assert(words[1] && words[2]);
515         ret = qemu_strtou64(words[1], NULL, 0, &addr);
516         g_assert(ret == 0);
517         ret = qemu_strtou64(words[2], NULL, 0, &value);
518         g_assert(ret == 0);
519 
520         if (words[0][5] == 'b') {
521             uint8_t data = value;
522             address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
523                                 &data, 1);
524         } else if (words[0][5] == 'w') {
525             uint16_t data = value;
526             tswap16s(&data);
527             address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
528                                 &data, 2);
529         } else if (words[0][5] == 'l') {
530             uint32_t data = value;
531             tswap32s(&data);
532             address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
533                                 &data, 4);
534         } else if (words[0][5] == 'q') {
535             uint64_t data = value;
536             tswap64s(&data);
537             address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
538                                 &data, 8);
539         }
540         qtest_send(chr, "OK\n");
541     } else if (strcmp(words[0], "readb") == 0 ||
542                strcmp(words[0], "readw") == 0 ||
543                strcmp(words[0], "readl") == 0 ||
544                strcmp(words[0], "readq") == 0) {
545         uint64_t addr;
546         uint64_t value = UINT64_C(-1);
547         int ret;
548 
549         g_assert(words[1]);
550         ret = qemu_strtou64(words[1], NULL, 0, &addr);
551         g_assert(ret == 0);
552 
553         if (words[0][4] == 'b') {
554             uint8_t data;
555             address_space_read(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
556                                &data, 1);
557             value = data;
558         } else if (words[0][4] == 'w') {
559             uint16_t data;
560             address_space_read(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
561                                &data, 2);
562             value = tswap16(data);
563         } else if (words[0][4] == 'l') {
564             uint32_t data;
565             address_space_read(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
566                                &data, 4);
567             value = tswap32(data);
568         } else if (words[0][4] == 'q') {
569             address_space_read(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
570                                &value, 8);
571             tswap64s(&value);
572         }
573         qtest_sendf(chr, "OK 0x%016" PRIx64 "\n", value);
574     } else if (strcmp(words[0], "read") == 0) {
575         g_autoptr(GString) enc = NULL;
576         uint64_t addr, len;
577         uint8_t *data;
578         int ret;
579 
580         g_assert(words[1] && words[2]);
581         ret = qemu_strtou64(words[1], NULL, 0, &addr);
582         g_assert(ret == 0);
583         ret = qemu_strtou64(words[2], NULL, 0, &len);
584         g_assert(ret == 0);
585         /* We'd send garbage to libqtest if len is 0 */
586         g_assert(len);
587 
588         data = g_malloc(len);
589         address_space_read(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED, data,
590                            len);
591 
592         enc = qemu_hexdump_line(NULL, data, len, 0, 0);
593 
594         qtest_sendf(chr, "OK 0x%s\n", enc->str);
595 
596         g_free(data);
597     } else if (strcmp(words[0], "b64read") == 0) {
598         uint64_t addr, len;
599         uint8_t *data;
600         gchar *b64_data;
601         int ret;
602 
603         g_assert(words[1] && words[2]);
604         ret = qemu_strtou64(words[1], NULL, 0, &addr);
605         g_assert(ret == 0);
606         ret = qemu_strtou64(words[2], NULL, 0, &len);
607         g_assert(ret == 0);
608 
609         data = g_malloc(len);
610         address_space_read(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED, data,
611                            len);
612         b64_data = g_base64_encode(data, len);
613         qtest_sendf(chr, "OK %s\n", b64_data);
614 
615         g_free(data);
616         g_free(b64_data);
617     } else if (strcmp(words[0], "write") == 0) {
618         uint64_t addr, len, i;
619         uint8_t *data;
620         size_t data_len;
621         int ret;
622 
623         g_assert(words[1] && words[2] && words[3]);
624         ret = qemu_strtou64(words[1], NULL, 0, &addr);
625         g_assert(ret == 0);
626         ret = qemu_strtou64(words[2], NULL, 0, &len);
627         g_assert(ret == 0);
628 
629         data_len = strlen(words[3]);
630         if (data_len < 3) {
631             qtest_send(chr, "ERR invalid argument size\n");
632             return;
633         }
634 
635         data = g_malloc(len);
636         for (i = 0; i < len; i++) {
637             if ((i * 2 + 4) <= data_len) {
638                 data[i] = hex2nib(words[3][i * 2 + 2]) << 4;
639                 data[i] |= hex2nib(words[3][i * 2 + 3]);
640             } else {
641                 data[i] = 0;
642             }
643         }
644         address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED, data,
645                             len);
646         g_free(data);
647 
648         qtest_send(chr, "OK\n");
649     } else if (strcmp(words[0], "memset") == 0) {
650         uint64_t addr, len;
651         uint8_t *data;
652         unsigned long pattern;
653         int ret;
654 
655         g_assert(words[1] && words[2] && words[3]);
656         ret = qemu_strtou64(words[1], NULL, 0, &addr);
657         g_assert(ret == 0);
658         ret = qemu_strtou64(words[2], NULL, 0, &len);
659         g_assert(ret == 0);
660         ret = qemu_strtoul(words[3], NULL, 0, &pattern);
661         g_assert(ret == 0);
662 
663         if (len) {
664             data = g_malloc(len);
665             memset(data, pattern, len);
666             address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED,
667                                 data, len);
668             g_free(data);
669         }
670 
671         qtest_send(chr, "OK\n");
672     }  else if (strcmp(words[0], "b64write") == 0) {
673         uint64_t addr, len;
674         uint8_t *data;
675         size_t data_len;
676         gsize out_len;
677         int ret;
678 
679         g_assert(words[1] && words[2] && words[3]);
680         ret = qemu_strtou64(words[1], NULL, 0, &addr);
681         g_assert(ret == 0);
682         ret = qemu_strtou64(words[2], NULL, 0, &len);
683         g_assert(ret == 0);
684 
685         data_len = strlen(words[3]);
686         if (data_len < 3) {
687             qtest_send(chr, "ERR invalid argument size\n");
688             return;
689         }
690 
691         data = g_base64_decode_inplace(words[3], &out_len);
692         if (out_len != len) {
693             qtest_log_send("b64write: data length mismatch (told %"PRIu64", "
694                            "found %zu)\n",
695                            len, out_len);
696             out_len = MIN(out_len, len);
697         }
698 
699         address_space_write(first_cpu->as, addr, MEMTXATTRS_UNSPECIFIED, data,
700                             len);
701 
702         qtest_send(chr, "OK\n");
703     } else if (strcmp(words[0], "endianness") == 0) {
704         if (target_big_endian()) {
705             qtest_sendf(chr, "OK big\n");
706         } else {
707             qtest_sendf(chr, "OK little\n");
708         }
709     } else if (qtest_enabled() && strcmp(words[0], "clock_step") == 0) {
710         int64_t old_ns = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
711         int64_t ns, new_ns;
712 
713         if (words[1]) {
714             int ret = qemu_strtoi64(words[1], NULL, 0, &ns);
715             g_assert(ret == 0);
716         } else {
717             ns = qemu_clock_deadline_ns_all(QEMU_CLOCK_VIRTUAL,
718                                             QEMU_TIMER_ATTR_ALL);
719             if (ns < 0) {
720                 qtest_send(chr, "FAIL "
721                            "cannot advance clock to the next deadline "
722                            "because there is no pending deadline\n");
723                 return;
724             }
725         }
726         new_ns = qemu_clock_advance_virtual_time(old_ns + ns);
727         if (new_ns > old_ns) {
728             qtest_sendf(chr, "OK %"PRIi64"\n", new_ns);
729         } else {
730             qtest_sendf(chr, "FAIL could not advance time\n");
731         }
732     } else if (strcmp(words[0], "module_load") == 0) {
733         Error *local_err = NULL;
734         int rv;
735         g_assert(words[1] && words[2]);
736 
737         rv = module_load(words[1], words[2], &local_err);
738         if (rv > 0) {
739             qtest_sendf(chr, "OK\n");
740         } else {
741             if (rv < 0) {
742                 error_report_err(local_err);
743             }
744             qtest_sendf(chr, "FAIL\n");
745         }
746     } else if (qtest_enabled() && strcmp(words[0], "clock_set") == 0) {
747         int64_t ns, new_ns;
748         int ret;
749 
750         g_assert(words[1]);
751         ret = qemu_strtoi64(words[1], NULL, 0, &ns);
752         g_assert(ret == 0);
753         new_ns = qemu_clock_advance_virtual_time(ns);
754         qtest_sendf(chr, "%s %"PRIi64"\n",
755                     new_ns == ns ? "OK" : "FAIL", new_ns);
756     } else if (process_command_cb && process_command_cb(chr, words)) {
757         /* Command got consumed by the callback handler */
758     } else {
759         qtest_sendf(chr, "FAIL Unknown command '%s'\n", words[0]);
760     }
761 }
762 
763 /*
764  * Process as much of @inbuf as we can in newline terminated chunks.
765  * Remove the processed commands from @inbuf as we go.
766  */
767 static void qtest_process_inbuf(CharFrontend *chr, GString *inbuf)
768 {
769     char *end;
770 
771     while ((end = strchr(inbuf->str, '\n')) != NULL) {
772         size_t len = end - inbuf->str;
773         g_autofree char *cmd = g_strndup(inbuf->str, len);
774         g_auto(GStrv) words = g_strsplit(cmd, " ", 0);
775 
776         g_string_erase(inbuf, 0, len + 1);
777         qtest_process_command(chr, words);
778     }
779 }
780 
781 static void qtest_read(void *opaque, const uint8_t *buf, int size)
782 {
783     CharFrontend *chr = opaque;
784 
785     g_string_append_len(inbuf, (const gchar *)buf, size);
786     qtest_process_inbuf(chr, inbuf);
787 }
788 
789 static int qtest_can_read(void *opaque)
790 {
791     return 1024;
792 }
793 
794 static void qtest_event(void *opaque, QEMUChrEvent event)
795 {
796     int i;
797 
798     switch (event) {
799     case CHR_EVENT_OPENED:
800         /*
801          * We used to call qemu_system_reset() here, hoping we could
802          * use the same process for multiple tests that way.  Never
803          * used.  Injects an extra reset even when it's not used, and
804          * that can mess up tests, e.g. -boot once.
805          */
806         for (i = 0; i < ARRAY_SIZE(irq_levels); i++) {
807             irq_levels[i] = 0;
808         }
809 
810         g_clear_pointer(&timer, g_timer_destroy);
811         timer = g_timer_new();
812         qtest_opened = true;
813         if (qtest_log_fp) {
814             fprintf(qtest_log_fp, "[I " FMT_timeval "] OPENED\n", g_timer_elapsed(timer, NULL));
815         }
816         break;
817     case CHR_EVENT_CLOSED:
818         if (!qtest_opened) {
819             /* Ignore CLOSED events if we have already closed the log */
820             break;
821         }
822         qtest_opened = false;
823         if (qtest_log_fp) {
824             fprintf(qtest_log_fp, "[I +" FMT_timeval "] CLOSED\n", g_timer_elapsed(timer, NULL));
825         }
826         g_clear_pointer(&timer, g_timer_destroy);
827         break;
828     default:
829         break;
830     }
831 }
832 
833 void qtest_server_init(const char *qtest_chrdev, const char *qtest_log, Error **errp)
834 {
835     ERRP_GUARD();
836     Chardev *chr;
837     Object *qobj;
838 
839     chr = qemu_chr_new("qtest", qtest_chrdev, NULL);
840     if (chr == NULL) {
841         error_setg(errp, "Failed to initialize device for qtest: \"%s\"",
842                    qtest_chrdev);
843         return;
844     }
845 
846     qobj = object_new(TYPE_QTEST);
847     object_property_set_str(qobj, "chardev", chr->label, &error_abort);
848     if (qtest_log) {
849         object_property_set_str(qobj, "log", qtest_log, &error_abort);
850     }
851     object_property_add_child(qdev_get_machine(), "qtest", qobj);
852     user_creatable_complete(USER_CREATABLE(qobj), errp);
853     if (*errp) {
854         object_unparent(qobj);
855     }
856     object_unref(OBJECT(chr));
857     object_unref(qobj);
858 }
859 
860 static bool qtest_server_start(QTest *q, Error **errp)
861 {
862     Chardev *chr = q->chr;
863     const char *qtest_log = q->log;
864 
865     if (qtest_log) {
866         if (strcmp(qtest_log, "none") != 0) {
867             qtest_log_fp = fopen(qtest_log, "w+");
868         }
869     } else {
870         qtest_log_fp = stderr;
871     }
872 
873     if (!qemu_chr_fe_init(&q->qtest_chr, chr, errp)) {
874         return false;
875     }
876     qemu_chr_fe_set_handlers(&q->qtest_chr, qtest_can_read, qtest_read,
877                              qtest_event, NULL, &q->qtest_chr, NULL, true);
878     qemu_chr_fe_set_echo(&q->qtest_chr, true);
879 
880     inbuf = g_string_new("");
881 
882     if (!qtest_server_send) {
883         qtest_server_set_send_handler(qtest_server_char_be_send, &q->qtest_chr);
884     }
885     qtest = q;
886     return true;
887 }
888 
889 void qtest_server_set_send_handler(void (*send)(void*, const char*),
890                                    void *opaque)
891 {
892     qtest_server_send = send;
893     qtest_server_send_opaque = opaque;
894 }
895 
896 bool qtest_driver(void)
897 {
898     return qtest && qtest->qtest_chr.chr != NULL;
899 }
900 
901 void qtest_server_inproc_recv(void *dummy, const char *buf)
902 {
903     static GString *gstr;
904     if (!gstr) {
905         gstr = g_string_new(NULL);
906     }
907     g_string_append(gstr, buf);
908     if (gstr->str[gstr->len - 1] == '\n') {
909         qtest_process_inbuf(NULL, gstr);
910         g_string_truncate(gstr, 0);
911     }
912 }
913 
914 static void qtest_complete(UserCreatable *uc, Error **errp)
915 {
916     QTest *q = QTEST(uc);
917     if (qtest) {
918         error_setg(errp, "Only one instance of qtest can be created");
919         return;
920     }
921     if (!q->chr_name) {
922         error_setg(errp, "No backend specified");
923         return;
924     }
925 
926     if (OBJECT(uc)->parent != qdev_get_machine()) {
927         q->has_machine_link = true;
928         object_property_add_const_link(qdev_get_machine(), "qtest", OBJECT(uc));
929     } else {
930         /* -qtest was used.  */
931     }
932 
933     qtest_server_start(q, errp);
934 }
935 
936 static void qtest_unparent(Object *obj)
937 {
938     QTest *q = QTEST(obj);
939 
940     if (qtest == q) {
941         qemu_chr_fe_disconnect(&q->qtest_chr);
942         assert(!qtest_opened);
943         qemu_chr_fe_deinit(&q->qtest_chr, false);
944         if (qtest_log_fp) {
945             fclose(qtest_log_fp);
946             qtest_log_fp = NULL;
947         }
948         qtest = NULL;
949     }
950 
951     if (q->has_machine_link) {
952         object_property_del(qdev_get_machine(), "qtest");
953         q->has_machine_link = false;
954     }
955 }
956 
957 static void qtest_set_log(Object *obj, const char *value, Error **errp)
958 {
959     QTest *q = QTEST(obj);
960 
961     if (qtest == q) {
962         error_setg(errp, "Property 'log' can not be set now");
963     } else {
964         g_free(q->log);
965         q->log = g_strdup(value);
966     }
967 }
968 
969 static char *qtest_get_log(Object *obj, Error **errp)
970 {
971     QTest *q = QTEST(obj);
972 
973     return g_strdup(q->log);
974 }
975 
976 static void qtest_set_chardev(Object *obj, const char *value, Error **errp)
977 {
978     QTest *q = QTEST(obj);
979     Chardev *chr;
980 
981     if (qtest == q) {
982         error_setg(errp, "Property 'chardev' can not be set now");
983         return;
984     }
985 
986     chr = qemu_chr_find(value);
987     if (!chr) {
988         error_setg(errp, "Cannot find character device '%s'", value);
989         return;
990     }
991 
992     g_free(q->chr_name);
993     q->chr_name = g_strdup(value);
994 
995     if (q->chr) {
996         object_unref(q->chr);
997     }
998     q->chr = chr;
999     object_ref(chr);
1000 }
1001 
1002 static char *qtest_get_chardev(Object *obj, Error **errp)
1003 {
1004     QTest *q = QTEST(obj);
1005 
1006     return g_strdup(q->chr_name);
1007 }
1008 
1009 static void qtest_class_init(ObjectClass *oc, const void *data)
1010 {
1011     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
1012 
1013     oc->unparent = qtest_unparent;
1014     ucc->complete = qtest_complete;
1015 
1016     object_class_property_add_str(oc, "chardev",
1017                                   qtest_get_chardev, qtest_set_chardev);
1018     object_class_property_add_str(oc, "log",
1019                                   qtest_get_log, qtest_set_log);
1020 }
1021 
1022 static const TypeInfo qtest_info = {
1023     .name = TYPE_QTEST,
1024     .parent = TYPE_OBJECT,
1025     .class_init = qtest_class_init,
1026     .instance_size = sizeof(QTest),
1027     .interfaces = (const InterfaceInfo[]) {
1028         { TYPE_USER_CREATABLE },
1029         { }
1030     }
1031 };
1032 
1033 static void register_types(void)
1034 {
1035     type_register_static(&qtest_info);
1036 }
1037 
1038 type_init(register_types);
1039