monitor/misc.c

   1 /*
   2  * QEMU monitor
   3  *
   4  * Copyright (c) 2003-2004 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26 #include "monitor-internal.h"
  27 #include "monitor/qdev.h"
  28 #include "hw/usb.h"
  29 #include "hw/pci/pci.h"
  30 #include "sysemu/watchdog.h"
  31 #include "hw/loader.h"
  32 #include "exec/gdbstub.h"
  33 #include "net/net.h"
  34 #include "net/slirp.h"
  35 #include "ui/qemu-spice.h"
  36 #include "qemu/config-file.h"
  37 #include "qemu/ctype.h"
  38 #include "ui/console.h"
  39 #include "ui/input.h"
  40 #include "audio/audio.h"
  41 #include "disas/disas.h"
  42 #include "sysemu/balloon.h"
  43 #include "qemu/timer.h"
  44 #include "sysemu/hw_accel.h"
  45 #include "sysemu/runstate.h"
  46 #include "authz/list.h"
  47 #include "qapi/util.h"
  48 #include "sysemu/blockdev.h"
  49 #include "sysemu/sysemu.h"
  50 #include "sysemu/tcg.h"
  51 #include "sysemu/tpm.h"
  52 #include "qapi/qmp/qdict.h"
  53 #include "qapi/qmp/qerror.h"
  54 #include "qapi/qmp/qstring.h"
  55 #include "qom/object_interfaces.h"
  56 #include "trace/control.h"
  57 #include "monitor/hmp-target.h"
  58 #include "monitor/hmp.h"
  59 #ifdef CONFIG_TRACE_SIMPLE
  60 #include "trace/simple.h"
  61 #endif
  62 #include "exec/memory.h"
  63 #include "exec/exec-all.h"
  64 #include "qemu/option.h"
  65 #include "qemu/thread.h"
  66 #include "block/qapi.h"
  67 #include "block/block-hmp-cmds.h"
  68 #include "qapi/qapi-commands-char.h"
  69 #include "qapi/qapi-commands-control.h"
  70 #include "qapi/qapi-commands-migration.h"
  71 #include "qapi/qapi-commands-misc.h"
  72 #include "qapi/qapi-commands-qom.h"
  73 #include "qapi/qapi-commands-trace.h"
  74 #include "qapi/qapi-init-commands.h"
  75 #include "qapi/error.h"
  76 #include "qapi/qmp-event.h"
  77 #include "sysemu/cpus.h"
  78 #include "qemu/cutils.h"
  79
  80 #if defined(TARGET_S390X)
  81 #include "hw/s390x/storage-keys.h"
  82 #include "hw/s390x/storage-attributes.h"
  83 #endif
  84
  85 /* file descriptors passed via SCM_RIGHTS */
  86 typedef struct mon_fd_t mon_fd_t;
  87 struct mon_fd_t {
  88     char *name;
  89     int fd;
  90     QLIST_ENTRY(mon_fd_t) next;
  91 };
  92
  93 /* file descriptor associated with a file descriptor set */
  94 typedef struct MonFdsetFd MonFdsetFd;
  95 struct MonFdsetFd {
  96     int fd;
  97     bool removed;
  98     char *opaque;
  99     QLIST_ENTRY(MonFdsetFd) next;
 100 };
 101
 102 /* file descriptor set containing fds passed via SCM_RIGHTS */
 103 typedef struct MonFdset MonFdset;
 104 struct MonFdset {
 105     int64_t id;
 106     QLIST_HEAD(, MonFdsetFd) fds;
 107     QLIST_HEAD(, MonFdsetFd) dup_fds;
 108     QLIST_ENTRY(MonFdset) next;
 109 };
 110
 111 /* Protects mon_fdsets */
 112 static QemuMutex mon_fdsets_lock;
 113 static QLIST_HEAD(, MonFdset) mon_fdsets;
 114
 115 static HMPCommand hmp_info_cmds[];
 116
 117 char *qmp_human_monitor_command(const char *command_line, bool has_cpu_index,
 118                                 int64_t cpu_index, Error **errp)
 119 {
 120     char *output = NULL;
 121     MonitorHMP hmp = {};
 122
 123     monitor_data_init(&hmp.common, false, true, false);
 124
 125     if (has_cpu_index) {
 126         int ret = monitor_set_cpu(&hmp.common, cpu_index);
 127         if (ret < 0) {
 128             error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "cpu-index",
 129                        "a CPU number");
 130             goto out;
 131         }
 132     }
 133
 134     handle_hmp_command(&hmp, command_line);
 135
 136     WITH_QEMU_LOCK_GUARD(&hmp.common.mon_lock) {
 137         output = g_strdup(hmp.common.outbuf->str);
 138     }
 139
 140 out:
 141     monitor_data_destroy(&hmp.common);
 142     return output;
 143 }
 144
 145 /**
 146  * Is @name in the '|' separated list of names @list?
 147  */
 148 int hmp_compare_cmd(const char *name, const char *list)
 149 {
 150     const char *p, *pstart;
 151     int len;
 152     len = strlen(name);
 153     p = list;
 154     for (;;) {
 155         pstart = p;
 156         p = qemu_strchrnul(p, '|');
 157         if ((p - pstart) == len && !memcmp(pstart, name, len)) {
 158             return 1;
 159         }
 160         if (*p == '\0') {
 161             break;
 162         }
 163         p++;
 164     }
 165     return 0;
 166 }
 167
 168 static void do_help_cmd(Monitor *mon, const QDict *qdict)
 169 {
 170     help_cmd(mon, qdict_get_try_str(qdict, "name"));
 171 }
 172
 173 static void hmp_trace_event(Monitor *mon, const QDict *qdict)
 174 {
 175     const char *tp_name = qdict_get_str(qdict, "name");
 176     bool new_state = qdict_get_bool(qdict, "option");
 177     bool has_vcpu = qdict_haskey(qdict, "vcpu");
 178     int vcpu = qdict_get_try_int(qdict, "vcpu", 0);
 179     Error *local_err = NULL;
 180
 181     if (vcpu < 0) {
 182         monitor_printf(mon, "argument vcpu must be positive");
 183         return;
 184     }
 185
 186     qmp_trace_event_set_state(tp_name, new_state, true, true, has_vcpu, vcpu, &local_err);
 187     if (local_err) {
 188         error_report_err(local_err);
 189     }
 190 }
 191
 192 #ifdef CONFIG_TRACE_SIMPLE
 193 static void hmp_trace_file(Monitor *mon, const QDict *qdict)
 194 {
 195     const char *op = qdict_get_try_str(qdict, "op");
 196     const char *arg = qdict_get_try_str(qdict, "arg");
 197
 198     if (!op) {
 199         st_print_trace_file_status();
 200     } else if (!strcmp(op, "on")) {
 201         st_set_trace_file_enabled(true);
 202     } else if (!strcmp(op, "off")) {
 203         st_set_trace_file_enabled(false);
 204     } else if (!strcmp(op, "flush")) {
 205         st_flush_trace_buffer();
 206     } else if (!strcmp(op, "set")) {
 207         if (arg) {
 208             st_set_trace_file(arg);
 209         }
 210     } else {
 211         monitor_printf(mon, "unexpected argument \"%s\"\n", op);
 212         help_cmd(mon, "trace-file");
 213     }
 214 }
 215 #endif
 216
 217 static void hmp_info_help(Monitor *mon, const QDict *qdict)
 218 {
 219     help_cmd(mon, "info");
 220 }
 221
 222 static void monitor_init_qmp_commands(void)
 223 {
 224     /*
 225      * Two command lists:
 226      * - qmp_commands contains all QMP commands
 227      * - qmp_cap_negotiation_commands contains just
 228      *   "qmp_capabilities", to enforce capability negotiation
 229      */
 230
 231     qmp_init_marshal(&qmp_commands);
 232
 233     qmp_register_command(&qmp_commands, "device_add", qmp_device_add,
 234                          QCO_NO_OPTIONS);
 235
 236     QTAILQ_INIT(&qmp_cap_negotiation_commands);
 237     qmp_register_command(&qmp_cap_negotiation_commands, "qmp_capabilities",
 238                          qmp_marshal_qmp_capabilities, QCO_ALLOW_PRECONFIG);
 239 }
 240
 241 /* Set the current CPU defined by the user. Callers must hold BQL. */
 242 int monitor_set_cpu(Monitor *mon, int cpu_index)
 243 {
 244     CPUState *cpu;
 245
 246     cpu = qemu_get_cpu(cpu_index);
 247     if (cpu == NULL) {
 248         return -1;
 249     }
 250     g_free(mon->mon_cpu_path);
 251     mon->mon_cpu_path = object_get_canonical_path(OBJECT(cpu));
 252     return 0;
 253 }
 254
 255 /* Callers must hold BQL. */
 256 static CPUState *mon_get_cpu_sync(Monitor *mon, bool synchronize)
 257 {
 258     CPUState *cpu = NULL;
 259
 260     if (mon->mon_cpu_path) {
 261         cpu = (CPUState *) object_resolve_path_type(mon->mon_cpu_path,
 262                                                     TYPE_CPU, NULL);
 263         if (!cpu) {
 264             g_free(mon->mon_cpu_path);
 265             mon->mon_cpu_path = NULL;
 266         }
 267     }
 268     if (!mon->mon_cpu_path) {
 269         if (!first_cpu) {
 270             return NULL;
 271         }
 272         monitor_set_cpu(mon, first_cpu->cpu_index);
 273         cpu = first_cpu;
 274     }
 275     assert(cpu != NULL);
 276     if (synchronize) {
 277         cpu_synchronize_state(cpu);
 278     }
 279     return cpu;
 280 }
 281
 282 CPUState *mon_get_cpu(Monitor *mon)
 283 {
 284     return mon_get_cpu_sync(mon, true);
 285 }
 286
 287 CPUArchState *mon_get_cpu_env(Monitor *mon)
 288 {
 289     CPUState *cs = mon_get_cpu(mon);
 290
 291     return cs ? cs->env_ptr : NULL;
 292 }
 293
 294 int monitor_get_cpu_index(Monitor *mon)
 295 {
 296     CPUState *cs = mon_get_cpu_sync(mon, false);
 297
 298     return cs ? cs->cpu_index : UNASSIGNED_CPU_INDEX;
 299 }
 300
 301 static void hmp_info_registers(Monitor *mon, const QDict *qdict)
 302 {
 303     bool all_cpus = qdict_get_try_bool(qdict, "cpustate_all", false);
 304     CPUState *cs;
 305
 306     if (all_cpus) {
 307         CPU_FOREACH(cs) {
 308             monitor_printf(mon, "\nCPU#%d\n", cs->cpu_index);
 309             cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
 310         }
 311     } else {
 312         cs = mon_get_cpu(mon);
 313
 314         if (!cs) {
 315             monitor_printf(mon, "No CPU available\n");
 316             return;
 317         }
 318
 319         cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
 320     }
 321 }
 322
 323 #ifdef CONFIG_TCG
 324 static void hmp_info_jit(Monitor *mon, const QDict *qdict)
 325 {
 326     if (!tcg_enabled()) {
 327         error_report("JIT information is only available with accel=tcg");
 328         return;
 329     }
 330
 331     dump_exec_info();
 332     dump_drift_info();
 333 }
 334
 335 static void hmp_info_opcount(Monitor *mon, const QDict *qdict)
 336 {
 337     dump_opcount_info();
 338 }
 339 #endif
 340
 341 static void hmp_info_sync_profile(Monitor *mon, const QDict *qdict)
 342 {
 343     int64_t max = qdict_get_try_int(qdict, "max", 10);
 344     bool mean = qdict_get_try_bool(qdict, "mean", false);
 345     bool coalesce = !qdict_get_try_bool(qdict, "no_coalesce", false);
 346     enum QSPSortBy sort_by;
 347
 348     sort_by = mean ? QSP_SORT_BY_AVG_WAIT_TIME : QSP_SORT_BY_TOTAL_WAIT_TIME;
 349     qsp_report(max, sort_by, coalesce);
 350 }
 351
 352 static void hmp_info_history(Monitor *mon, const QDict *qdict)
 353 {
 354     MonitorHMP *hmp_mon = container_of(mon, MonitorHMP, common);
 355     int i;
 356     const char *str;
 357
 358     if (!hmp_mon->rs) {
 359         return;
 360     }
 361     i = 0;
 362     for(;;) {
 363         str = readline_get_history(hmp_mon->rs, i);
 364         if (!str) {
 365             break;
 366         }
 367         monitor_printf(mon, "%d: '%s'\n", i, str);
 368         i++;
 369     }
 370 }
 371
 372 static void hmp_info_trace_events(Monitor *mon, const QDict *qdict)
 373 {
 374     const char *name = qdict_get_try_str(qdict, "name");
 375     bool has_vcpu = qdict_haskey(qdict, "vcpu");
 376     int vcpu = qdict_get_try_int(qdict, "vcpu", 0);
 377     TraceEventInfoList *events;
 378     TraceEventInfoList *elem;
 379     Error *local_err = NULL;
 380
 381     if (name == NULL) {
 382         name = "*";
 383     }
 384     if (vcpu < 0) {
 385         monitor_printf(mon, "argument vcpu must be positive");
 386         return;
 387     }
 388
 389     events = qmp_trace_event_get_state(name, has_vcpu, vcpu, &local_err);
 390     if (local_err) {
 391         error_report_err(local_err);
 392         return;
 393     }
 394
 395     for (elem = events; elem != NULL; elem = elem->next) {
 396         monitor_printf(mon, "%s : state %u\n",
 397                        elem->value->name,
 398                        elem->value->state == TRACE_EVENT_STATE_ENABLED ? 1 : 0);
 399     }
 400     qapi_free_TraceEventInfoList(events);
 401 }
 402
 403 void qmp_client_migrate_info(const char *protocol, const char *hostname,
 404                              bool has_port, int64_t port,
 405                              bool has_tls_port, int64_t tls_port,
 406                              bool has_cert_subject, const char *cert_subject,
 407                              Error **errp)
 408 {
 409     if (strcmp(protocol, "spice") == 0) {
 410         if (!qemu_using_spice(errp)) {
 411             return;
 412         }
 413
 414         if (!has_port && !has_tls_port) {
 415             error_setg(errp, QERR_MISSING_PARAMETER, "port/tls-port");
 416             return;
 417         }
 418
 419         if (qemu_spice.migrate_info(hostname,
 420                                     has_port ? port : -1,
 421                                     has_tls_port ? tls_port : -1,
 422                                     cert_subject)) {
 423             error_setg(errp, "Could not set up display for migration");
 424             return;
 425         }
 426         return;
 427     }
 428
 429     error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "protocol", "'spice'");
 430 }
 431
 432 static void hmp_logfile(Monitor *mon, const QDict *qdict)
 433 {
 434     Error *err = NULL;
 435
 436     qemu_set_log_filename(qdict_get_str(qdict, "filename"), &err);
 437     if (err) {
 438         error_report_err(err);
 439     }
 440 }
 441
 442 static void hmp_log(Monitor *mon, const QDict *qdict)
 443 {
 444     int mask;
 445     const char *items = qdict_get_str(qdict, "items");
 446
 447     if (!strcmp(items, "none")) {
 448         mask = 0;
 449     } else {
 450         mask = qemu_str_to_log_mask(items);
 451         if (!mask) {
 452             help_cmd(mon, "log");
 453             return;
 454         }
 455     }
 456     qemu_set_log(mask);
 457 }
 458
 459 static void hmp_singlestep(Monitor *mon, const QDict *qdict)
 460 {
 461     const char *option = qdict_get_try_str(qdict, "option");
 462     if (!option || !strcmp(option, "on")) {
 463         singlestep = 1;
 464     } else if (!strcmp(option, "off")) {
 465         singlestep = 0;
 466     } else {
 467         monitor_printf(mon, "unexpected option %s\n", option);
 468     }
 469 }
 470
 471 static void hmp_gdbserver(Monitor *mon, const QDict *qdict)
 472 {
 473     const char *device = qdict_get_try_str(qdict, "device");
 474     if (!device) {
 475         device = "tcp::" DEFAULT_GDBSTUB_PORT;
 476     }
 477
 478     if (gdbserver_start(device) < 0) {
 479         monitor_printf(mon, "Could not open gdbserver on device '%s'\n",
 480                        device);
 481     } else if (strcmp(device, "none") == 0) {
 482         monitor_printf(mon, "Disabled gdbserver\n");
 483     } else {
 484         monitor_printf(mon, "Waiting for gdb connection on device '%s'\n",
 485                        device);
 486     }
 487 }
 488
 489 static void hmp_watchdog_action(Monitor *mon, const QDict *qdict)
 490 {
 491     const char *action = qdict_get_str(qdict, "action");
 492     if (select_watchdog_action(action) == -1) {
 493         monitor_printf(mon, "Unknown watchdog action '%s'\n", action);
 494     }
 495 }
 496
 497 static void monitor_printc(Monitor *mon, int c)
 498 {
 499     monitor_printf(mon, "'");
 500     switch(c) {
 501     case '\'':
 502         monitor_printf(mon, "\\'");
 503         break;
 504     case '\\':
 505         monitor_printf(mon, "\\\\");
 506         break;
 507     case '\n':
 508         monitor_printf(mon, "\\n");
 509         break;
 510     case '\r':
 511         monitor_printf(mon, "\\r");
 512         break;
 513     default:
 514         if (c >= 32 && c <= 126) {
 515             monitor_printf(mon, "%c", c);
 516         } else {
 517             monitor_printf(mon, "\\x%02x", c);
 518         }
 519         break;
 520     }
 521     monitor_printf(mon, "'");
 522 }
 523
 524 static void memory_dump(Monitor *mon, int count, int format, int wsize,
 525                         hwaddr addr, int is_physical)
 526 {
 527     int l, line_size, i, max_digits, len;
 528     uint8_t buf[16];
 529     uint64_t v;
 530     CPUState *cs = mon_get_cpu(mon);
 531
 532     if (!cs && (format == 'i' || !is_physical)) {
 533         monitor_printf(mon, "Can not dump without CPU\n");
 534         return;
 535     }
 536
 537     if (format == 'i') {
 538         monitor_disas(mon, cs, addr, count, is_physical);
 539         return;
 540     }
 541
 542     len = wsize * count;
 543     if (wsize == 1) {
 544         line_size = 8;
 545     } else {
 546         line_size = 16;
 547     }
 548     max_digits = 0;
 549
 550     switch(format) {
 551     case 'o':
 552         max_digits = DIV_ROUND_UP(wsize * 8, 3);
 553         break;
 554     default:
 555     case 'x':
 556         max_digits = (wsize * 8) / 4;
 557         break;
 558     case 'u':
 559     case 'd':
 560         max_digits = DIV_ROUND_UP(wsize * 8 * 10, 33);
 561         break;
 562     case 'c':
 563         wsize = 1;
 564         break;
 565     }
 566
 567     while (len > 0) {
 568         if (is_physical) {
 569             monitor_printf(mon, TARGET_FMT_plx ":", addr);
 570         } else {
 571             monitor_printf(mon, TARGET_FMT_lx ":", (target_ulong)addr);
 572         }
 573         l = len;
 574         if (l > line_size)
 575             l = line_size;
 576         if (is_physical) {
 577             AddressSpace *as = cs ? cs->as : &address_space_memory;
 578             MemTxResult r = address_space_read(as, addr,
 579                                                MEMTXATTRS_UNSPECIFIED, buf, l);
 580             if (r != MEMTX_OK) {
 581                 monitor_printf(mon, " Cannot access memory\n");
 582                 break;
 583             }
 584         } else {
 585             if (cpu_memory_rw_debug(cs, addr, buf, l, 0) < 0) {
 586                 monitor_printf(mon, " Cannot access memory\n");
 587                 break;
 588             }
 589         }
 590         i = 0;
 591         while (i < l) {
 592             switch(wsize) {
 593             default:
 594             case 1:
 595                 v = ldub_p(buf + i);
 596                 break;
 597             case 2:
 598                 v = lduw_p(buf + i);
 599                 break;
 600             case 4:
 601                 v = (uint32_t)ldl_p(buf + i);
 602                 break;
 603             case 8:
 604                 v = ldq_p(buf + i);
 605                 break;
 606             }
 607             monitor_printf(mon, " ");
 608             switch(format) {
 609             case 'o':
 610                 monitor_printf(mon, "%#*" PRIo64, max_digits, v);
 611                 break;
 612             case 'x':
 613                 monitor_printf(mon, "0x%0*" PRIx64, max_digits, v);
 614                 break;
 615             case 'u':
 616                 monitor_printf(mon, "%*" PRIu64, max_digits, v);
 617                 break;
 618             case 'd':
 619                 monitor_printf(mon, "%*" PRId64, max_digits, v);
 620                 break;
 621             case 'c':
 622                 monitor_printc(mon, v);
 623                 break;
 624             }
 625             i += wsize;
 626         }
 627         monitor_printf(mon, "\n");
 628         addr += l;
 629         len -= l;
 630     }
 631 }
 632
 633 static void hmp_memory_dump(Monitor *mon, const QDict *qdict)
 634 {
 635     int count = qdict_get_int(qdict, "count");
 636     int format = qdict_get_int(qdict, "format");
 637     int size = qdict_get_int(qdict, "size");
 638     target_long addr = qdict_get_int(qdict, "addr");
 639
 640     memory_dump(mon, count, format, size, addr, 0);
 641 }
 642
 643 static void hmp_physical_memory_dump(Monitor *mon, const QDict *qdict)
 644 {
 645     int count = qdict_get_int(qdict, "count");
 646     int format = qdict_get_int(qdict, "format");
 647     int size = qdict_get_int(qdict, "size");
 648     hwaddr addr = qdict_get_int(qdict, "addr");
 649
 650     memory_dump(mon, count, format, size, addr, 1);
 651 }
 652
 653 void *gpa2hva(MemoryRegion **p_mr, hwaddr addr, uint64_t size, Error **errp)
 654 {
 655     Int128 gpa_region_size;
 656     MemoryRegionSection mrs = memory_region_find(get_system_memory(),
 657                                                  addr, size);
 658
 659     if (!mrs.mr) {
 660         error_setg(errp, "No memory is mapped at address 0x%" HWADDR_PRIx, addr);
 661         return NULL;
 662     }
 663
 664     if (!memory_region_is_ram(mrs.mr) && !memory_region_is_romd(mrs.mr)) {
 665         error_setg(errp, "Memory at address 0x%" HWADDR_PRIx "is not RAM", addr);
 666         memory_region_unref(mrs.mr);
 667         return NULL;
 668     }
 669
 670     gpa_region_size = int128_make64(size);
 671     if (int128_lt(mrs.size, gpa_region_size)) {
 672         error_setg(errp, "Size of memory region at 0x%" HWADDR_PRIx
 673                    " exceeded.", addr);
 674         memory_region_unref(mrs.mr);
 675         return NULL;
 676     }
 677
 678     *p_mr = mrs.mr;
 679     return qemu_map_ram_ptr(mrs.mr->ram_block, mrs.offset_within_region);
 680 }
 681
 682 static void hmp_gpa2hva(Monitor *mon, const QDict *qdict)
 683 {
 684     hwaddr addr = qdict_get_int(qdict, "addr");
 685     Error *local_err = NULL;
 686     MemoryRegion *mr = NULL;
 687     void *ptr;
 688
 689     ptr = gpa2hva(&mr, addr, 1, &local_err);
 690     if (local_err) {
 691         error_report_err(local_err);
 692         return;
 693     }
 694
 695     monitor_printf(mon, "Host virtual address for 0x%" HWADDR_PRIx
 696                    " (%s) is %p\n",
 697                    addr, mr->name, ptr);
 698
 699     memory_region_unref(mr);
 700 }
 701
 702 static void hmp_gva2gpa(Monitor *mon, const QDict *qdict)
 703 {
 704     target_ulong addr = qdict_get_int(qdict, "addr");
 705     MemTxAttrs attrs;
 706     CPUState *cs = mon_get_cpu(mon);
 707     hwaddr gpa;
 708
 709     if (!cs) {
 710         monitor_printf(mon, "No cpu\n");
 711         return;
 712     }
 713
 714     gpa  = cpu_get_phys_page_attrs_debug(cs, addr & TARGET_PAGE_MASK, &attrs);
 715     if (gpa == -1) {
 716         monitor_printf(mon, "Unmapped\n");
 717     } else {
 718         monitor_printf(mon, "gpa: %#" HWADDR_PRIx "\n",
 719                        gpa + (addr & ~TARGET_PAGE_MASK));
 720     }
 721 }
 722
 723 #ifdef CONFIG_LINUX
 724 static uint64_t vtop(void *ptr, Error **errp)
 725 {
 726     uint64_t pinfo;
 727     uint64_t ret = -1;
 728     uintptr_t addr = (uintptr_t) ptr;
 729     uintptr_t pagesize = qemu_real_host_page_size;
 730     off_t offset = addr / pagesize * sizeof(pinfo);
 731     int fd;
 732
 733     fd = open("/proc/self/pagemap", O_RDONLY);
 734     if (fd == -1) {
 735         error_setg_errno(errp, errno, "Cannot open /proc/self/pagemap");
 736         return -1;
 737     }
 738
 739     /* Force copy-on-write if necessary.  */
 740     qatomic_add((uint8_t *)ptr, 0);
 741
 742     if (pread(fd, &pinfo, sizeof(pinfo), offset) != sizeof(pinfo)) {
 743         error_setg_errno(errp, errno, "Cannot read pagemap");
 744         goto out;
 745     }
 746     if ((pinfo & (1ull << 63)) == 0) {
 747         error_setg(errp, "Page not present");
 748         goto out;
 749     }
 750     ret = ((pinfo & 0x007fffffffffffffull) * pagesize) | (addr & (pagesize - 1));
 751
 752 out:
 753     close(fd);
 754     return ret;
 755 }
 756
 757 static void hmp_gpa2hpa(Monitor *mon, const QDict *qdict)
 758 {
 759     hwaddr addr = qdict_get_int(qdict, "addr");
 760     Error *local_err = NULL;
 761     MemoryRegion *mr = NULL;
 762     void *ptr;
 763     uint64_t physaddr;
 764
 765     ptr = gpa2hva(&mr, addr, 1, &local_err);
 766     if (local_err) {
 767         error_report_err(local_err);
 768         return;
 769     }
 770
 771     physaddr = vtop(ptr, &local_err);
 772     if (local_err) {
 773         error_report_err(local_err);
 774     } else {
 775         monitor_printf(mon, "Host physical address for 0x%" HWADDR_PRIx
 776                        " (%s) is 0x%" PRIx64 "\n",
 777                        addr, mr->name, (uint64_t) physaddr);
 778     }
 779
 780     memory_region_unref(mr);
 781 }
 782 #endif
 783
 784 static void do_print(Monitor *mon, const QDict *qdict)
 785 {
 786     int format = qdict_get_int(qdict, "format");
 787     hwaddr val = qdict_get_int(qdict, "val");
 788
 789     switch(format) {
 790     case 'o':
 791         monitor_printf(mon, "%#" HWADDR_PRIo, val);
 792         break;
 793     case 'x':
 794         monitor_printf(mon, "%#" HWADDR_PRIx, val);
 795         break;
 796     case 'u':
 797         monitor_printf(mon, "%" HWADDR_PRIu, val);
 798         break;
 799     default:
 800     case 'd':
 801         monitor_printf(mon, "%" HWADDR_PRId, val);
 802         break;
 803     case 'c':
 804         monitor_printc(mon, val);
 805         break;
 806     }
 807     monitor_printf(mon, "\n");
 808 }
 809
 810 static void hmp_sum(Monitor *mon, const QDict *qdict)
 811 {
 812     uint32_t addr;
 813     uint16_t sum;
 814     uint32_t start = qdict_get_int(qdict, "start");
 815     uint32_t size = qdict_get_int(qdict, "size");
 816
 817     sum = 0;
 818     for(addr = start; addr < (start + size); addr++) {
 819         uint8_t val = address_space_ldub(&address_space_memory, addr,
 820                                          MEMTXATTRS_UNSPECIFIED, NULL);
 821         /* BSD sum algorithm ('sum' Unix command) */
 822         sum = (sum >> 1) | (sum << 15);
 823         sum += val;
 824     }
 825     monitor_printf(mon, "%05d\n", sum);
 826 }
 827
 828 static int mouse_button_state;
 829
 830 static void hmp_mouse_move(Monitor *mon, const QDict *qdict)
 831 {
 832     int dx, dy, dz, button;
 833     const char *dx_str = qdict_get_str(qdict, "dx_str");
 834     const char *dy_str = qdict_get_str(qdict, "dy_str");
 835     const char *dz_str = qdict_get_try_str(qdict, "dz_str");
 836
 837     dx = strtol(dx_str, NULL, 0);
 838     dy = strtol(dy_str, NULL, 0);
 839     qemu_input_queue_rel(NULL, INPUT_AXIS_X, dx);
 840     qemu_input_queue_rel(NULL, INPUT_AXIS_Y, dy);
 841
 842     if (dz_str) {
 843         dz = strtol(dz_str, NULL, 0);
 844         if (dz != 0) {
 845             button = (dz > 0) ? INPUT_BUTTON_WHEEL_UP : INPUT_BUTTON_WHEEL_DOWN;
 846             qemu_input_queue_btn(NULL, button, true);
 847             qemu_input_event_sync();
 848             qemu_input_queue_btn(NULL, button, false);
 849         }
 850     }
 851     qemu_input_event_sync();
 852 }
 853
 854 static void hmp_mouse_button(Monitor *mon, const QDict *qdict)
 855 {
 856     static uint32_t bmap[INPUT_BUTTON__MAX] = {
 857         [INPUT_BUTTON_LEFT]       = MOUSE_EVENT_LBUTTON,
 858         [INPUT_BUTTON_MIDDLE]     = MOUSE_EVENT_MBUTTON,
 859         [INPUT_BUTTON_RIGHT]      = MOUSE_EVENT_RBUTTON,
 860     };
 861     int button_state = qdict_get_int(qdict, "button_state");
 862
 863     if (mouse_button_state == button_state) {
 864         return;
 865     }
 866     qemu_input_update_buttons(NULL, bmap, mouse_button_state, button_state);
 867     qemu_input_event_sync();
 868     mouse_button_state = button_state;
 869 }
 870
 871 static void hmp_ioport_read(Monitor *mon, const QDict *qdict)
 872 {
 873     int size = qdict_get_int(qdict, "size");
 874     int addr = qdict_get_int(qdict, "addr");
 875     int has_index = qdict_haskey(qdict, "index");
 876     uint32_t val;
 877     int suffix;
 878
 879     if (has_index) {
 880         int index = qdict_get_int(qdict, "index");
 881         cpu_outb(addr & IOPORTS_MASK, index & 0xff);
 882         addr++;
 883     }
 884     addr &= 0xffff;
 885
 886     switch(size) {
 887     default:
 888     case 1:
 889         val = cpu_inb(addr);
 890         suffix = 'b';
 891         break;
 892     case 2:
 893         val = cpu_inw(addr);
 894         suffix = 'w';
 895         break;
 896     case 4:
 897         val = cpu_inl(addr);
 898         suffix = 'l';
 899         break;
 900     }
 901     monitor_printf(mon, "port%c[0x%04x] = 0x%0*x\n",
 902                    suffix, addr, size * 2, val);
 903 }
 904
 905 static void hmp_ioport_write(Monitor *mon, const QDict *qdict)
 906 {
 907     int size = qdict_get_int(qdict, "size");
 908     int addr = qdict_get_int(qdict, "addr");
 909     int val = qdict_get_int(qdict, "val");
 910
 911     addr &= IOPORTS_MASK;
 912
 913     switch (size) {
 914     default:
 915     case 1:
 916         cpu_outb(addr, val);
 917         break;
 918     case 2:
 919         cpu_outw(addr, val);
 920         break;
 921     case 4:
 922         cpu_outl(addr, val);
 923         break;
 924     }
 925 }
 926
 927 static void hmp_boot_set(Monitor *mon, const QDict *qdict)
 928 {
 929     Error *local_err = NULL;
 930     const char *bootdevice = qdict_get_str(qdict, "bootdevice");
 931
 932     qemu_boot_set(bootdevice, &local_err);
 933     if (local_err) {
 934         error_report_err(local_err);
 935     } else {
 936         monitor_printf(mon, "boot device list now set to %s\n", bootdevice);
 937     }
 938 }
 939
 940 static void hmp_info_mtree(Monitor *mon, const QDict *qdict)
 941 {
 942     bool flatview = qdict_get_try_bool(qdict, "flatview", false);
 943     bool dispatch_tree = qdict_get_try_bool(qdict, "dispatch_tree", false);
 944     bool owner = qdict_get_try_bool(qdict, "owner", false);
 945     bool disabled = qdict_get_try_bool(qdict, "disabled", false);
 946
 947     mtree_info(flatview, dispatch_tree, owner, disabled);
 948 }
 949
 950 #ifdef CONFIG_PROFILER
 951
 952 int64_t dev_time;
 953
 954 static void hmp_info_profile(Monitor *mon, const QDict *qdict)
 955 {
 956     static int64_t last_cpu_exec_time;
 957     int64_t cpu_exec_time;
 958     int64_t delta;
 959
 960     cpu_exec_time = tcg_cpu_exec_time();
 961     delta = cpu_exec_time - last_cpu_exec_time;
 962
 963     monitor_printf(mon, "async time  %" PRId64 " (%0.3f)\n",
 964                    dev_time, dev_time / (double)NANOSECONDS_PER_SECOND);
 965     monitor_printf(mon, "qemu time   %" PRId64 " (%0.3f)\n",
 966                    delta, delta / (double)NANOSECONDS_PER_SECOND);
 967     last_cpu_exec_time = cpu_exec_time;
 968     dev_time = 0;
 969 }
 970 #else
 971 static void hmp_info_profile(Monitor *mon, const QDict *qdict)
 972 {
 973     monitor_printf(mon, "Internal profiler not compiled\n");
 974 }
 975 #endif
 976
 977 /* Capture support */
 978 static QLIST_HEAD (capture_list_head, CaptureState) capture_head;
 979
 980 static void hmp_info_capture(Monitor *mon, const QDict *qdict)
 981 {
 982     int i;
 983     CaptureState *s;
 984
 985     for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) {
 986         monitor_printf(mon, "[%d]: ", i);
 987         s->ops.info (s->opaque);
 988     }
 989 }
 990
 991 static void hmp_stopcapture(Monitor *mon, const QDict *qdict)
 992 {
 993     int i;
 994     int n = qdict_get_int(qdict, "n");
 995     CaptureState *s;
 996
 997     for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) {
 998         if (i == n) {
 999             s->ops.destroy (s->opaque);
1000             QLIST_REMOVE (s, entries);
1001             g_free (s);
1002             return;
1003         }
1004     }
1005 }
1006
1007 static void hmp_wavcapture(Monitor *mon, const QDict *qdict)
1008 {
1009     const char *path = qdict_get_str(qdict, "path");
1010     int freq = qdict_get_try_int(qdict, "freq", 44100);
1011     int bits = qdict_get_try_int(qdict, "bits", 16);
1012     int nchannels = qdict_get_try_int(qdict, "nchannels", 2);
1013     const char *audiodev = qdict_get_str(qdict, "audiodev");
1014     CaptureState *s;
1015     AudioState *as = audio_state_by_name(audiodev);
1016
1017     if (!as) {
1018         monitor_printf(mon, "Audiodev '%s' not found\n", audiodev);
1019         return;
1020     }
1021
1022     s = g_malloc0 (sizeof (*s));
1023
1024     if (wav_start_capture(as, s, path, freq, bits, nchannels)) {
1025         monitor_printf(mon, "Failed to add wave capture\n");
1026         g_free (s);
1027         return;
1028     }
1029     QLIST_INSERT_HEAD (&capture_head, s, entries);
1030 }
1031
1032 void qmp_getfd(const char *fdname, Error **errp)
1033 {
1034     Monitor *cur_mon = monitor_cur();
1035     mon_fd_t *monfd;
1036     int fd, tmp_fd;
1037
1038     fd = qemu_chr_fe_get_msgfd(&cur_mon->chr);
1039     if (fd == -1) {
1040         error_setg(errp, "No file descriptor supplied via SCM_RIGHTS");
1041         return;
1042     }
1043
1044     if (qemu_isdigit(fdname[0])) {
1045         close(fd);
1046         error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "fdname",
1047                    "a name not starting with a digit");
1048         return;
1049     }
1050
1051     QEMU_LOCK_GUARD(&cur_mon->mon_lock);
1052     QLIST_FOREACH(monfd, &cur_mon->fds, next) {
1053         if (strcmp(monfd->name, fdname) != 0) {
1054             continue;
1055         }
1056
1057         tmp_fd = monfd->fd;
1058         monfd->fd = fd;
1059         /* Make sure close() is outside critical section */
1060         close(tmp_fd);
1061         return;
1062     }
1063
1064     monfd = g_malloc0(sizeof(mon_fd_t));
1065     monfd->name = g_strdup(fdname);
1066     monfd->fd = fd;
1067
1068     QLIST_INSERT_HEAD(&cur_mon->fds, monfd, next);
1069 }
1070
1071 void qmp_closefd(const char *fdname, Error **errp)
1072 {
1073     Monitor *cur_mon = monitor_cur();
1074     mon_fd_t *monfd;
1075     int tmp_fd;
1076
1077     qemu_mutex_lock(&cur_mon->mon_lock);
1078     QLIST_FOREACH(monfd, &cur_mon->fds, next) {
1079         if (strcmp(monfd->name, fdname) != 0) {
1080             continue;
1081         }
1082
1083         QLIST_REMOVE(monfd, next);
1084         tmp_fd = monfd->fd;
1085         g_free(monfd->name);
1086         g_free(monfd);
1087         qemu_mutex_unlock(&cur_mon->mon_lock);
1088         /* Make sure close() is outside critical section */
1089         close(tmp_fd);
1090         return;
1091     }
1092
1093     qemu_mutex_unlock(&cur_mon->mon_lock);
1094     error_setg(errp, "File descriptor named '%s' not found", fdname);
1095 }
1096
1097 int monitor_get_fd(Monitor *mon, const char *fdname, Error **errp)
1098 {
1099     mon_fd_t *monfd;
1100
1101     QEMU_LOCK_GUARD(&mon->mon_lock);
1102     QLIST_FOREACH(monfd, &mon->fds, next) {
1103         int fd;
1104
1105         if (strcmp(monfd->name, fdname) != 0) {
1106             continue;
1107         }
1108
1109         fd = monfd->fd;
1110
1111         /* caller takes ownership of fd */
1112         QLIST_REMOVE(monfd, next);
1113         g_free(monfd->name);
1114         g_free(monfd);
1115
1116         return fd;
1117     }
1118
1119     error_setg(errp, "File descriptor named '%s' has not been found", fdname);
1120     return -1;
1121 }
1122
1123 static void monitor_fdset_cleanup(MonFdset *mon_fdset)
1124 {
1125     MonFdsetFd *mon_fdset_fd;
1126     MonFdsetFd *mon_fdset_fd_next;
1127
1128     QLIST_FOREACH_SAFE(mon_fdset_fd, &mon_fdset->fds, next, mon_fdset_fd_next) {
1129         if ((mon_fdset_fd->removed ||
1130                 (QLIST_EMPTY(&mon_fdset->dup_fds) && mon_refcount == 0)) &&
1131                 runstate_is_running()) {
1132             close(mon_fdset_fd->fd);
1133             g_free(mon_fdset_fd->opaque);
1134             QLIST_REMOVE(mon_fdset_fd, next);
1135             g_free(mon_fdset_fd);
1136         }
1137     }
1138
1139     if (QLIST_EMPTY(&mon_fdset->fds) && QLIST_EMPTY(&mon_fdset->dup_fds)) {
1140         QLIST_REMOVE(mon_fdset, next);
1141         g_free(mon_fdset);
1142     }
1143 }
1144
1145 void monitor_fdsets_cleanup(void)
1146 {
1147     MonFdset *mon_fdset;
1148     MonFdset *mon_fdset_next;
1149
1150     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1151     QLIST_FOREACH_SAFE(mon_fdset, &mon_fdsets, next, mon_fdset_next) {
1152         monitor_fdset_cleanup(mon_fdset);
1153     }
1154 }
1155
1156 AddfdInfo *qmp_add_fd(bool has_fdset_id, int64_t fdset_id, bool has_opaque,
1157                       const char *opaque, Error **errp)
1158 {
1159     int fd;
1160     Monitor *mon = monitor_cur();
1161     AddfdInfo *fdinfo;
1162
1163     fd = qemu_chr_fe_get_msgfd(&mon->chr);
1164     if (fd == -1) {
1165         error_setg(errp, "No file descriptor supplied via SCM_RIGHTS");
1166         goto error;
1167     }
1168
1169     fdinfo = monitor_fdset_add_fd(fd, has_fdset_id, fdset_id,
1170                                   has_opaque, opaque, errp);
1171     if (fdinfo) {
1172         return fdinfo;
1173     }
1174
1175 error:
1176     if (fd != -1) {
1177         close(fd);
1178     }
1179     return NULL;
1180 }
1181
1182 void qmp_remove_fd(int64_t fdset_id, bool has_fd, int64_t fd, Error **errp)
1183 {
1184     MonFdset *mon_fdset;
1185     MonFdsetFd *mon_fdset_fd;
1186     char fd_str[60];
1187
1188     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1189     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1190         if (mon_fdset->id != fdset_id) {
1191             continue;
1192         }
1193         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1194             if (has_fd) {
1195                 if (mon_fdset_fd->fd != fd) {
1196                     continue;
1197                 }
1198                 mon_fdset_fd->removed = true;
1199                 break;
1200             } else {
1201                 mon_fdset_fd->removed = true;
1202             }
1203         }
1204         if (has_fd && !mon_fdset_fd) {
1205             goto error;
1206         }
1207         monitor_fdset_cleanup(mon_fdset);
1208         return;
1209     }
1210
1211 error:
1212     if (has_fd) {
1213         snprintf(fd_str, sizeof(fd_str), "fdset-id:%" PRId64 ", fd:%" PRId64,
1214                  fdset_id, fd);
1215     } else {
1216         snprintf(fd_str, sizeof(fd_str), "fdset-id:%" PRId64, fdset_id);
1217     }
1218     error_setg(errp, "File descriptor named '%s' not found", fd_str);
1219 }
1220
1221 FdsetInfoList *qmp_query_fdsets(Error **errp)
1222 {
1223     MonFdset *mon_fdset;
1224     MonFdsetFd *mon_fdset_fd;
1225     FdsetInfoList *fdset_list = NULL;
1226
1227     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1228     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1229         FdsetInfo *fdset_info = g_malloc0(sizeof(*fdset_info));
1230
1231         fdset_info->fdset_id = mon_fdset->id;
1232
1233         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1234             FdsetFdInfo *fdsetfd_info;
1235
1236             fdsetfd_info = g_malloc0(sizeof(*fdsetfd_info));
1237             fdsetfd_info->fd = mon_fdset_fd->fd;
1238             if (mon_fdset_fd->opaque) {
1239                 fdsetfd_info->has_opaque = true;
1240                 fdsetfd_info->opaque = g_strdup(mon_fdset_fd->opaque);
1241             } else {
1242                 fdsetfd_info->has_opaque = false;
1243             }
1244
1245             QAPI_LIST_PREPEND(fdset_info->fds, fdsetfd_info);
1246         }
1247
1248         QAPI_LIST_PREPEND(fdset_list, fdset_info);
1249     }
1250
1251     return fdset_list;
1252 }
1253
1254 AddfdInfo *monitor_fdset_add_fd(int fd, bool has_fdset_id, int64_t fdset_id,
1255                                 bool has_opaque, const char *opaque,
1256                                 Error **errp)
1257 {
1258     MonFdset *mon_fdset = NULL;
1259     MonFdsetFd *mon_fdset_fd;
1260     AddfdInfo *fdinfo;
1261
1262     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1263     if (has_fdset_id) {
1264         QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1265             /* Break if match found or match impossible due to ordering by ID */
1266             if (fdset_id <= mon_fdset->id) {
1267                 if (fdset_id < mon_fdset->id) {
1268                     mon_fdset = NULL;
1269                 }
1270                 break;
1271             }
1272         }
1273     }
1274
1275     if (mon_fdset == NULL) {
1276         int64_t fdset_id_prev = -1;
1277         MonFdset *mon_fdset_cur = QLIST_FIRST(&mon_fdsets);
1278
1279         if (has_fdset_id) {
1280             if (fdset_id < 0) {
1281                 error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "fdset-id",
1282                            "a non-negative value");
1283                 return NULL;
1284             }
1285             /* Use specified fdset ID */
1286             QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1287                 mon_fdset_cur = mon_fdset;
1288                 if (fdset_id < mon_fdset_cur->id) {
1289                     break;
1290                 }
1291             }
1292         } else {
1293             /* Use first available fdset ID */
1294             QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1295                 mon_fdset_cur = mon_fdset;
1296                 if (fdset_id_prev == mon_fdset_cur->id - 1) {
1297                     fdset_id_prev = mon_fdset_cur->id;
1298                     continue;
1299                 }
1300                 break;
1301             }
1302         }
1303
1304         mon_fdset = g_malloc0(sizeof(*mon_fdset));
1305         if (has_fdset_id) {
1306             mon_fdset->id = fdset_id;
1307         } else {
1308             mon_fdset->id = fdset_id_prev + 1;
1309         }
1310
1311         /* The fdset list is ordered by fdset ID */
1312         if (!mon_fdset_cur) {
1313             QLIST_INSERT_HEAD(&mon_fdsets, mon_fdset, next);
1314         } else if (mon_fdset->id < mon_fdset_cur->id) {
1315             QLIST_INSERT_BEFORE(mon_fdset_cur, mon_fdset, next);
1316         } else {
1317             QLIST_INSERT_AFTER(mon_fdset_cur, mon_fdset, next);
1318         }
1319     }
1320
1321     mon_fdset_fd = g_malloc0(sizeof(*mon_fdset_fd));
1322     mon_fdset_fd->fd = fd;
1323     mon_fdset_fd->removed = false;
1324     if (has_opaque) {
1325         mon_fdset_fd->opaque = g_strdup(opaque);
1326     }
1327     QLIST_INSERT_HEAD(&mon_fdset->fds, mon_fdset_fd, next);
1328
1329     fdinfo = g_malloc0(sizeof(*fdinfo));
1330     fdinfo->fdset_id = mon_fdset->id;
1331     fdinfo->fd = mon_fdset_fd->fd;
1332
1333     return fdinfo;
1334 }
1335
1336 int monitor_fdset_dup_fd_add(int64_t fdset_id, int flags)
1337 {
1338 #ifdef _WIN32
1339     return -ENOENT;
1340 #else
1341     MonFdset *mon_fdset;
1342
1343     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1344     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1345         MonFdsetFd *mon_fdset_fd;
1346         MonFdsetFd *mon_fdset_fd_dup;
1347         int fd = -1;
1348         int dup_fd;
1349         int mon_fd_flags;
1350
1351         if (mon_fdset->id != fdset_id) {
1352             continue;
1353         }
1354
1355         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1356             mon_fd_flags = fcntl(mon_fdset_fd->fd, F_GETFL);
1357             if (mon_fd_flags == -1) {
1358                 return -1;
1359             }
1360
1361             if ((flags & O_ACCMODE) == (mon_fd_flags & O_ACCMODE)) {
1362                 fd = mon_fdset_fd->fd;
1363                 break;
1364             }
1365         }
1366
1367         if (fd == -1) {
1368             errno = EACCES;
1369             return -1;
1370         }
1371
1372         dup_fd = qemu_dup_flags(fd, flags);
1373         if (dup_fd == -1) {
1374             return -1;
1375         }
1376
1377         mon_fdset_fd_dup = g_malloc0(sizeof(*mon_fdset_fd_dup));
1378         mon_fdset_fd_dup->fd = dup_fd;
1379         QLIST_INSERT_HEAD(&mon_fdset->dup_fds, mon_fdset_fd_dup, next);
1380         return dup_fd;
1381     }
1382
1383     errno = ENOENT;
1384     return -1;
1385 #endif
1386 }
1387
1388 static int64_t monitor_fdset_dup_fd_find_remove(int dup_fd, bool remove)
1389 {
1390     MonFdset *mon_fdset;
1391     MonFdsetFd *mon_fdset_fd_dup;
1392
1393     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1394     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1395         QLIST_FOREACH(mon_fdset_fd_dup, &mon_fdset->dup_fds, next) {
1396             if (mon_fdset_fd_dup->fd == dup_fd) {
1397                 if (remove) {
1398                     QLIST_REMOVE(mon_fdset_fd_dup, next);
1399                     g_free(mon_fdset_fd_dup);
1400                     if (QLIST_EMPTY(&mon_fdset->dup_fds)) {
1401                         monitor_fdset_cleanup(mon_fdset);
1402                     }
1403                     return -1;
1404                 } else {
1405                     return mon_fdset->id;
1406                 }
1407             }
1408         }
1409     }
1410
1411     return -1;
1412 }
1413
1414 int64_t monitor_fdset_dup_fd_find(int dup_fd)
1415 {
1416     return monitor_fdset_dup_fd_find_remove(dup_fd, false);
1417 }
1418
1419 void monitor_fdset_dup_fd_remove(int dup_fd)
1420 {
1421     monitor_fdset_dup_fd_find_remove(dup_fd, true);
1422 }
1423
1424 int monitor_fd_param(Monitor *mon, const char *fdname, Error **errp)
1425 {
1426     int fd;
1427     Error *local_err = NULL;
1428
1429     if (!qemu_isdigit(fdname[0]) && mon) {
1430         fd = monitor_get_fd(mon, fdname, &local_err);
1431     } else {
1432         fd = qemu_parse_fd(fdname);
1433         if (fd == -1) {
1434             error_setg(&local_err, "Invalid file descriptor number '%s'",
1435                        fdname);
1436         }
1437     }
1438     if (local_err) {
1439         error_propagate(errp, local_err);
1440         assert(fd == -1);
1441     } else {
1442         assert(fd != -1);
1443     }
1444
1445     return fd;
1446 }
1447
1448 /* Please update hmp-commands.hx when adding or changing commands */
1449 static HMPCommand hmp_info_cmds[] = {
1450 #include "hmp-commands-info.h"
1451     { NULL, NULL, },
1452 };
1453
1454 /* hmp_cmds and hmp_info_cmds would be sorted at runtime */
1455 HMPCommand hmp_cmds[] = {
1456 #include "hmp-commands.h"
1457     { NULL, NULL, },
1458 };
1459
1460 /*
1461  * Set @pval to the value in the register identified by @name.
1462  * return 0 if OK, -1 if not found
1463  */
1464 int get_monitor_def(Monitor *mon, int64_t *pval, const char *name)
1465 {
1466     const MonitorDef *md = target_monitor_defs();
1467     CPUState *cs = mon_get_cpu(mon);
1468     void *ptr;
1469     uint64_t tmp = 0;
1470     int ret;
1471
1472     if (cs == NULL || md == NULL) {
1473         return -1;
1474     }
1475
1476     for(; md->name != NULL; md++) {
1477         if (hmp_compare_cmd(name, md->name)) {
1478             if (md->get_value) {
1479                 *pval = md->get_value(mon, md, md->offset);
1480             } else {
1481                 CPUArchState *env = mon_get_cpu_env(mon);
1482                 ptr = (uint8_t *)env + md->offset;
1483                 switch(md->type) {
1484                 case MD_I32:
1485                     *pval = *(int32_t *)ptr;
1486                     break;
1487                 case MD_TLONG:
1488                     *pval = *(target_long *)ptr;
1489                     break;
1490                 default:
1491                     *pval = 0;
1492                     break;
1493                 }
1494             }
1495             return 0;
1496         }
1497     }
1498
1499     ret = target_get_monitor_def(cs, name, &tmp);
1500     if (!ret) {
1501         *pval = (target_long) tmp;
1502     }
1503
1504     return ret;
1505 }
1506
1507 static void add_completion_option(ReadLineState *rs, const char *str,
1508                                   const char *option)
1509 {
1510     if (!str || !option) {
1511         return;
1512     }
1513     if (!strncmp(option, str, strlen(str))) {
1514         readline_add_completion(rs, option);
1515     }
1516 }
1517
1518 void chardev_add_completion(ReadLineState *rs, int nb_args, const char *str)
1519 {
1520     size_t len;
1521     ChardevBackendInfoList *list, *start;
1522
1523     if (nb_args != 2) {
1524         return;
1525     }
1526     len = strlen(str);
1527     readline_set_completion_index(rs, len);
1528
1529     start = list = qmp_query_chardev_backends(NULL);
1530     while (list) {
1531         const char *chr_name = list->value->name;
1532
1533         if (!strncmp(chr_name, str, len)) {
1534             readline_add_completion(rs, chr_name);
1535         }
1536         list = list->next;
1537     }
1538     qapi_free_ChardevBackendInfoList(start);
1539 }
1540
1541 void netdev_add_completion(ReadLineState *rs, int nb_args, const char *str)
1542 {
1543     size_t len;
1544     int i;
1545
1546     if (nb_args != 2) {
1547         return;
1548     }
1549     len = strlen(str);
1550     readline_set_completion_index(rs, len);
1551     for (i = 0; i < NET_CLIENT_DRIVER__MAX; i++) {
1552         add_completion_option(rs, str, NetClientDriver_str(i));
1553     }
1554 }
1555
1556 void device_add_completion(ReadLineState *rs, int nb_args, const char *str)
1557 {
1558     GSList *list, *elt;
1559     size_t len;
1560
1561     if (nb_args != 2) {
1562         return;
1563     }
1564
1565     len = strlen(str);
1566     readline_set_completion_index(rs, len);
1567     list = elt = object_class_get_list(TYPE_DEVICE, false);
1568     while (elt) {
1569         const char *name;
1570         DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, elt->data,
1571                                              TYPE_DEVICE);
1572         name = object_class_get_name(OBJECT_CLASS(dc));
1573
1574         if (dc->user_creatable
1575             && !strncmp(name, str, len)) {
1576             readline_add_completion(rs, name);
1577         }
1578         elt = elt->next;
1579     }
1580     g_slist_free(list);
1581 }
1582
1583 void object_add_completion(ReadLineState *rs, int nb_args, const char *str)
1584 {
1585     GSList *list, *elt;
1586     size_t len;
1587
1588     if (nb_args != 2) {
1589         return;
1590     }
1591
1592     len = strlen(str);
1593     readline_set_completion_index(rs, len);
1594     list = elt = object_class_get_list(TYPE_USER_CREATABLE, false);
1595     while (elt) {
1596         const char *name;
1597
1598         name = object_class_get_name(OBJECT_CLASS(elt->data));
1599         if (!strncmp(name, str, len) && strcmp(name, TYPE_USER_CREATABLE)) {
1600             readline_add_completion(rs, name);
1601         }
1602         elt = elt->next;
1603     }
1604     g_slist_free(list);
1605 }
1606
1607 static int qdev_add_hotpluggable_device(Object *obj, void *opaque)
1608 {
1609     GSList **list = opaque;
1610     DeviceState *dev = (DeviceState *)object_dynamic_cast(obj, TYPE_DEVICE);
1611
1612     if (dev == NULL) {
1613         return 0;
1614     }
1615
1616     if (dev->realized && object_property_get_bool(obj, "hotpluggable", NULL)) {
1617         *list = g_slist_append(*list, dev);
1618     }
1619
1620     return 0;
1621 }
1622
1623 static GSList *qdev_build_hotpluggable_device_list(Object *peripheral)
1624 {
1625     GSList *list = NULL;
1626
1627     object_child_foreach(peripheral, qdev_add_hotpluggable_device, &list);
1628
1629     return list;
1630 }
1631
1632 static void peripheral_device_del_completion(ReadLineState *rs,
1633                                              const char *str, size_t len)
1634 {
1635     Object *peripheral = container_get(qdev_get_machine(), "/peripheral");
1636     GSList *list, *item;
1637
1638     list = qdev_build_hotpluggable_device_list(peripheral);
1639     if (!list) {
1640         return;
1641     }
1642
1643     for (item = list; item; item = g_slist_next(item)) {
1644         DeviceState *dev = item->data;
1645
1646         if (dev->id && !strncmp(str, dev->id, len)) {
1647             readline_add_completion(rs, dev->id);
1648         }
1649     }
1650
1651     g_slist_free(list);
1652 }
1653
1654 void chardev_remove_completion(ReadLineState *rs, int nb_args, const char *str)
1655 {
1656     size_t len;
1657     ChardevInfoList *list, *start;
1658
1659     if (nb_args != 2) {
1660         return;
1661     }
1662     len = strlen(str);
1663     readline_set_completion_index(rs, len);
1664
1665     start = list = qmp_query_chardev(NULL);
1666     while (list) {
1667         ChardevInfo *chr = list->value;
1668
1669         if (!strncmp(chr->label, str, len)) {
1670             readline_add_completion(rs, chr->label);
1671         }
1672         list = list->next;
1673     }
1674     qapi_free_ChardevInfoList(start);
1675 }
1676
1677 static void ringbuf_completion(ReadLineState *rs, const char *str)
1678 {
1679     size_t len;
1680     ChardevInfoList *list, *start;
1681
1682     len = strlen(str);
1683     readline_set_completion_index(rs, len);
1684
1685     start = list = qmp_query_chardev(NULL);
1686     while (list) {
1687         ChardevInfo *chr_info = list->value;
1688
1689         if (!strncmp(chr_info->label, str, len)) {
1690             Chardev *chr = qemu_chr_find(chr_info->label);
1691             if (chr && CHARDEV_IS_RINGBUF(chr)) {
1692                 readline_add_completion(rs, chr_info->label);
1693             }
1694         }
1695         list = list->next;
1696     }
1697     qapi_free_ChardevInfoList(start);
1698 }
1699
1700 void ringbuf_write_completion(ReadLineState *rs, int nb_args, const char *str)
1701 {
1702     if (nb_args != 2) {
1703         return;
1704     }
1705     ringbuf_completion(rs, str);
1706 }
1707
1708 void device_del_completion(ReadLineState *rs, int nb_args, const char *str)
1709 {
1710     size_t len;
1711
1712     if (nb_args != 2) {
1713         return;
1714     }
1715
1716     len = strlen(str);
1717     readline_set_completion_index(rs, len);
1718     peripheral_device_del_completion(rs, str, len);
1719 }
1720
1721 void object_del_completion(ReadLineState *rs, int nb_args, const char *str)
1722 {
1723     ObjectPropertyInfoList *list, *start;
1724     size_t len;
1725
1726     if (nb_args != 2) {
1727         return;
1728     }
1729     len = strlen(str);
1730     readline_set_completion_index(rs, len);
1731
1732     start = list = qmp_qom_list("/objects", NULL);
1733     while (list) {
1734         ObjectPropertyInfo *info = list->value;
1735
1736         if (!strncmp(info->type, "child<", 5)
1737             && !strncmp(info->name, str, len)) {
1738             readline_add_completion(rs, info->name);
1739         }
1740         list = list->next;
1741     }
1742     qapi_free_ObjectPropertyInfoList(start);
1743 }
1744
1745 void sendkey_completion(ReadLineState *rs, int nb_args, const char *str)
1746 {
1747     int i;
1748     char *sep;
1749     size_t len;
1750
1751     if (nb_args != 2) {
1752         return;
1753     }
1754     sep = strrchr(str, '-');
1755     if (sep) {
1756         str = sep + 1;
1757     }
1758     len = strlen(str);
1759     readline_set_completion_index(rs, len);
1760     for (i = 0; i < Q_KEY_CODE__MAX; i++) {
1761         if (!strncmp(str, QKeyCode_str(i), len)) {
1762             readline_add_completion(rs, QKeyCode_str(i));
1763         }
1764     }
1765 }
1766
1767 void set_link_completion(ReadLineState *rs, int nb_args, const char *str)
1768 {
1769     size_t len;
1770
1771     len = strlen(str);
1772     readline_set_completion_index(rs, len);
1773     if (nb_args == 2) {
1774         NetClientState *ncs[MAX_QUEUE_NUM];
1775         int count, i;
1776         count = qemu_find_net_clients_except(NULL, ncs,
1777                                              NET_CLIENT_DRIVER_NONE,
1778                                              MAX_QUEUE_NUM);
1779         for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
1780             const char *name = ncs[i]->name;
1781             if (!strncmp(str, name, len)) {
1782                 readline_add_completion(rs, name);
1783             }
1784         }
1785     } else if (nb_args == 3) {
1786         add_completion_option(rs, str, "on");
1787         add_completion_option(rs, str, "off");
1788     }
1789 }
1790
1791 void netdev_del_completion(ReadLineState *rs, int nb_args, const char *str)
1792 {
1793     int len, count, i;
1794     NetClientState *ncs[MAX_QUEUE_NUM];
1795
1796     if (nb_args != 2) {
1797         return;
1798     }
1799
1800     len = strlen(str);
1801     readline_set_completion_index(rs, len);
1802     count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_DRIVER_NIC,
1803                                          MAX_QUEUE_NUM);
1804     for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
1805         const char *name = ncs[i]->name;
1806         if (strncmp(str, name, len)) {
1807             continue;
1808         }
1809         if (ncs[i]->is_netdev) {
1810             readline_add_completion(rs, name);
1811         }
1812     }
1813 }
1814
1815 void info_trace_events_completion(ReadLineState *rs, int nb_args, const char *str)
1816 {
1817     size_t len;
1818
1819     len = strlen(str);
1820     readline_set_completion_index(rs, len);
1821     if (nb_args == 2) {
1822         TraceEventIter iter;
1823         TraceEvent *ev;
1824         char *pattern = g_strdup_printf("%s*", str);
1825         trace_event_iter_init(&iter, pattern);
1826         while ((ev = trace_event_iter_next(&iter)) != NULL) {
1827             readline_add_completion(rs, trace_event_get_name(ev));
1828         }
1829         g_free(pattern);
1830     }
1831 }
1832
1833 void trace_event_completion(ReadLineState *rs, int nb_args, const char *str)
1834 {
1835     size_t len;
1836
1837     len = strlen(str);
1838     readline_set_completion_index(rs, len);
1839     if (nb_args == 2) {
1840         TraceEventIter iter;
1841         TraceEvent *ev;
1842         char *pattern = g_strdup_printf("%s*", str);
1843         trace_event_iter_init(&iter, pattern);
1844         while ((ev = trace_event_iter_next(&iter)) != NULL) {
1845             readline_add_completion(rs, trace_event_get_name(ev));
1846         }
1847         g_free(pattern);
1848     } else if (nb_args == 3) {
1849         add_completion_option(rs, str, "on");
1850         add_completion_option(rs, str, "off");
1851     }
1852 }
1853
1854 void watchdog_action_completion(ReadLineState *rs, int nb_args, const char *str)
1855 {
1856     int i;
1857
1858     if (nb_args != 2) {
1859         return;
1860     }
1861     readline_set_completion_index(rs, strlen(str));
1862     for (i = 0; i < WATCHDOG_ACTION__MAX; i++) {
1863         add_completion_option(rs, str, WatchdogAction_str(i));
1864     }
1865 }
1866
1867 void migrate_set_capability_completion(ReadLineState *rs, int nb_args,
1868                                        const char *str)
1869 {
1870     size_t len;
1871
1872     len = strlen(str);
1873     readline_set_completion_index(rs, len);
1874     if (nb_args == 2) {
1875         int i;
1876         for (i = 0; i < MIGRATION_CAPABILITY__MAX; i++) {
1877             const char *name = MigrationCapability_str(i);
1878             if (!strncmp(str, name, len)) {
1879                 readline_add_completion(rs, name);
1880             }
1881         }
1882     } else if (nb_args == 3) {
1883         add_completion_option(rs, str, "on");
1884         add_completion_option(rs, str, "off");
1885     }
1886 }
1887
1888 void migrate_set_parameter_completion(ReadLineState *rs, int nb_args,
1889                                       const char *str)
1890 {
1891     size_t len;
1892
1893     len = strlen(str);
1894     readline_set_completion_index(rs, len);
1895     if (nb_args == 2) {
1896         int i;
1897         for (i = 0; i < MIGRATION_PARAMETER__MAX; i++) {
1898             const char *name = MigrationParameter_str(i);
1899             if (!strncmp(str, name, len)) {
1900                 readline_add_completion(rs, name);
1901             }
1902         }
1903     }
1904 }
1905
1906 static void vm_completion(ReadLineState *rs, const char *str)
1907 {
1908     size_t len;
1909     BlockDriverState *bs;
1910     BdrvNextIterator it;
1911
1912     len = strlen(str);
1913     readline_set_completion_index(rs, len);
1914
1915     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
1916         SnapshotInfoList *snapshots, *snapshot;
1917         AioContext *ctx = bdrv_get_aio_context(bs);
1918         bool ok = false;
1919
1920         aio_context_acquire(ctx);
1921         if (bdrv_can_snapshot(bs)) {
1922             ok = bdrv_query_snapshot_info_list(bs, &snapshots, NULL) == 0;
1923         }
1924         aio_context_release(ctx);
1925         if (!ok) {
1926             continue;
1927         }
1928
1929         snapshot = snapshots;
1930         while (snapshot) {
1931             char *completion = snapshot->value->name;
1932             if (!strncmp(str, completion, len)) {
1933                 readline_add_completion(rs, completion);
1934             }
1935             completion = snapshot->value->id;
1936             if (!strncmp(str, completion, len)) {
1937                 readline_add_completion(rs, completion);
1938             }
1939             snapshot = snapshot->next;
1940         }
1941         qapi_free_SnapshotInfoList(snapshots);
1942     }
1943
1944 }
1945
1946 void delvm_completion(ReadLineState *rs, int nb_args, const char *str)
1947 {
1948     if (nb_args == 2) {
1949         vm_completion(rs, str);
1950     }
1951 }
1952
1953 void loadvm_completion(ReadLineState *rs, int nb_args, const char *str)
1954 {
1955     if (nb_args == 2) {
1956         vm_completion(rs, str);
1957     }
1958 }
1959
1960 static int
1961 compare_mon_cmd(const void *a, const void *b)
1962 {
1963     return strcmp(((const HMPCommand *)a)->name,
1964             ((const HMPCommand *)b)->name);
1965 }
1966
1967 static void sortcmdlist(void)
1968 {
1969     qsort(hmp_cmds, ARRAY_SIZE(hmp_cmds) - 1,
1970           sizeof(*hmp_cmds),
1971           compare_mon_cmd);
1972     qsort(hmp_info_cmds, ARRAY_SIZE(hmp_info_cmds) - 1,
1973           sizeof(*hmp_info_cmds),
1974           compare_mon_cmd);
1975 }
1976
1977 void monitor_init_globals(void)
1978 {
1979     monitor_init_globals_core();
1980     monitor_init_qmp_commands();
1981     sortcmdlist();
1982     qemu_mutex_init(&mon_fdsets_lock);
1983 }