monitor/misc.c

   1 /*
   2  * QEMU monitor
   3  *
   4  * Copyright (c) 2003-2004 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26 #include "monitor-internal.h"
  27 #include "cpu.h"
  28 #include "monitor/qdev.h"
  29 #include "hw/usb.h"
  30 #include "hw/pci/pci.h"
  31 #include "sysemu/watchdog.h"
  32 #include "hw/loader.h"
  33 #include "exec/gdbstub.h"
  34 #include "net/net.h"
  35 #include "net/slirp.h"
  36 #include "ui/qemu-spice.h"
  37 #include "qemu/config-file.h"
  38 #include "qemu/ctype.h"
  39 #include "ui/console.h"
  40 #include "ui/input.h"
  41 #include "audio/audio.h"
  42 #include "disas/disas.h"
  43 #include "sysemu/balloon.h"
  44 #include "qemu/timer.h"
  45 #include "sysemu/hw_accel.h"
  46 #include "sysemu/runstate.h"
  47 #include "authz/list.h"
  48 #include "qapi/util.h"
  49 #include "sysemu/blockdev.h"
  50 #include "sysemu/sysemu.h"
  51 #include "sysemu/tcg.h"
  52 #include "sysemu/tpm.h"
  53 #include "qapi/qmp/qdict.h"
  54 #include "qapi/qmp/qerror.h"
  55 #include "qapi/qmp/qstring.h"
  56 #include "qom/object_interfaces.h"
  57 #include "trace/control.h"
  58 #include "monitor/hmp-target.h"
  59 #include "monitor/hmp.h"
  60 #ifdef CONFIG_TRACE_SIMPLE
  61 #include "trace/simple.h"
  62 #endif
  63 #include "exec/memory.h"
  64 #include "exec/exec-all.h"
  65 #include "qemu/option.h"
  66 #include "qemu/thread.h"
  67 #include "block/qapi.h"
  68 #include "block/block-hmp-cmds.h"
  69 #include "qapi/qapi-commands-char.h"
  70 #include "qapi/qapi-commands-control.h"
  71 #include "qapi/qapi-commands-migration.h"
  72 #include "qapi/qapi-commands-misc.h"
  73 #include "qapi/qapi-commands-qom.h"
  74 #include "qapi/qapi-commands-trace.h"
  75 #include "qapi/qapi-init-commands.h"
  76 #include "qapi/error.h"
  77 #include "qapi/qmp-event.h"
  78 #include "sysemu/cpus.h"
  79 #include "qemu/cutils.h"
  80
  81 #if defined(TARGET_S390X)
  82 #include "hw/s390x/storage-keys.h"
  83 #include "hw/s390x/storage-attributes.h"
  84 #endif
  85
  86 /* file descriptors passed via SCM_RIGHTS */
  87 typedef struct mon_fd_t mon_fd_t;
  88 struct mon_fd_t {
  89     char *name;
  90     int fd;
  91     QLIST_ENTRY(mon_fd_t) next;
  92 };
  93
  94 /* file descriptor associated with a file descriptor set */
  95 typedef struct MonFdsetFd MonFdsetFd;
  96 struct MonFdsetFd {
  97     int fd;
  98     bool removed;
  99     char *opaque;
 100     QLIST_ENTRY(MonFdsetFd) next;
 101 };
 102
 103 /* file descriptor set containing fds passed via SCM_RIGHTS */
 104 typedef struct MonFdset MonFdset;
 105 struct MonFdset {
 106     int64_t id;
 107     QLIST_HEAD(, MonFdsetFd) fds;
 108     QLIST_HEAD(, MonFdsetFd) dup_fds;
 109     QLIST_ENTRY(MonFdset) next;
 110 };
 111
 112 /* Protects mon_fdsets */
 113 static QemuMutex mon_fdsets_lock;
 114 static QLIST_HEAD(, MonFdset) mon_fdsets;
 115
 116 static HMPCommand hmp_info_cmds[];
 117
 118 char *qmp_human_monitor_command(const char *command_line, bool has_cpu_index,
 119                                 int64_t cpu_index, Error **errp)
 120 {
 121     char *output = NULL;
 122     MonitorHMP hmp = {};
 123
 124     monitor_data_init(&hmp.common, false, true, false);
 125
 126     if (has_cpu_index) {
 127         int ret = monitor_set_cpu(&hmp.common, cpu_index);
 128         if (ret < 0) {
 129             error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "cpu-index",
 130                        "a CPU number");
 131             goto out;
 132         }
 133     }
 134
 135     handle_hmp_command(&hmp, command_line);
 136
 137     WITH_QEMU_LOCK_GUARD(&hmp.common.mon_lock) {
 138         output = g_strdup(hmp.common.outbuf->str);
 139     }
 140
 141 out:
 142     monitor_data_destroy(&hmp.common);
 143     return output;
 144 }
 145
 146 /**
 147  * Is @name in the '|' separated list of names @list?
 148  */
 149 int hmp_compare_cmd(const char *name, const char *list)
 150 {
 151     const char *p, *pstart;
 152     int len;
 153     len = strlen(name);
 154     p = list;
 155     for (;;) {
 156         pstart = p;
 157         p = qemu_strchrnul(p, '|');
 158         if ((p - pstart) == len && !memcmp(pstart, name, len)) {
 159             return 1;
 160         }
 161         if (*p == '\0') {
 162             break;
 163         }
 164         p++;
 165     }
 166     return 0;
 167 }
 168
 169 static void do_help_cmd(Monitor *mon, const QDict *qdict)
 170 {
 171     help_cmd(mon, qdict_get_try_str(qdict, "name"));
 172 }
 173
 174 static void hmp_trace_event(Monitor *mon, const QDict *qdict)
 175 {
 176     const char *tp_name = qdict_get_str(qdict, "name");
 177     bool new_state = qdict_get_bool(qdict, "option");
 178     bool has_vcpu = qdict_haskey(qdict, "vcpu");
 179     int vcpu = qdict_get_try_int(qdict, "vcpu", 0);
 180     Error *local_err = NULL;
 181
 182     if (vcpu < 0) {
 183         monitor_printf(mon, "argument vcpu must be positive");
 184         return;
 185     }
 186
 187     qmp_trace_event_set_state(tp_name, new_state, true, true, has_vcpu, vcpu, &local_err);
 188     if (local_err) {
 189         error_report_err(local_err);
 190     }
 191 }
 192
 193 #ifdef CONFIG_TRACE_SIMPLE
 194 static void hmp_trace_file(Monitor *mon, const QDict *qdict)
 195 {
 196     const char *op = qdict_get_try_str(qdict, "op");
 197     const char *arg = qdict_get_try_str(qdict, "arg");
 198
 199     if (!op) {
 200         st_print_trace_file_status();
 201     } else if (!strcmp(op, "on")) {
 202         st_set_trace_file_enabled(true);
 203     } else if (!strcmp(op, "off")) {
 204         st_set_trace_file_enabled(false);
 205     } else if (!strcmp(op, "flush")) {
 206         st_flush_trace_buffer();
 207     } else if (!strcmp(op, "set")) {
 208         if (arg) {
 209             st_set_trace_file(arg);
 210         }
 211     } else {
 212         monitor_printf(mon, "unexpected argument \"%s\"\n", op);
 213         help_cmd(mon, "trace-file");
 214     }
 215 }
 216 #endif
 217
 218 static void hmp_info_help(Monitor *mon, const QDict *qdict)
 219 {
 220     help_cmd(mon, "info");
 221 }
 222
 223 static void monitor_init_qmp_commands(void)
 224 {
 225     /*
 226      * Two command lists:
 227      * - qmp_commands contains all QMP commands
 228      * - qmp_cap_negotiation_commands contains just
 229      *   "qmp_capabilities", to enforce capability negotiation
 230      */
 231
 232     qmp_init_marshal(&qmp_commands);
 233
 234     qmp_register_command(&qmp_commands, "query-qmp-schema",
 235                          qmp_query_qmp_schema, QCO_ALLOW_PRECONFIG);
 236     qmp_register_command(&qmp_commands, "device_add", qmp_device_add,
 237                          QCO_NO_OPTIONS);
 238
 239     QTAILQ_INIT(&qmp_cap_negotiation_commands);
 240     qmp_register_command(&qmp_cap_negotiation_commands, "qmp_capabilities",
 241                          qmp_marshal_qmp_capabilities, QCO_ALLOW_PRECONFIG);
 242 }
 243
 244 /* Set the current CPU defined by the user. Callers must hold BQL. */
 245 int monitor_set_cpu(Monitor *mon, int cpu_index)
 246 {
 247     CPUState *cpu;
 248
 249     cpu = qemu_get_cpu(cpu_index);
 250     if (cpu == NULL) {
 251         return -1;
 252     }
 253     g_free(mon->mon_cpu_path);
 254     mon->mon_cpu_path = object_get_canonical_path(OBJECT(cpu));
 255     return 0;
 256 }
 257
 258 /* Callers must hold BQL. */
 259 static CPUState *mon_get_cpu_sync(Monitor *mon, bool synchronize)
 260 {
 261     CPUState *cpu = NULL;
 262
 263     if (mon->mon_cpu_path) {
 264         cpu = (CPUState *) object_resolve_path_type(mon->mon_cpu_path,
 265                                                     TYPE_CPU, NULL);
 266         if (!cpu) {
 267             g_free(mon->mon_cpu_path);
 268             mon->mon_cpu_path = NULL;
 269         }
 270     }
 271     if (!mon->mon_cpu_path) {
 272         if (!first_cpu) {
 273             return NULL;
 274         }
 275         monitor_set_cpu(mon, first_cpu->cpu_index);
 276         cpu = first_cpu;
 277     }
 278     assert(cpu != NULL);
 279     if (synchronize) {
 280         cpu_synchronize_state(cpu);
 281     }
 282     return cpu;
 283 }
 284
 285 CPUState *mon_get_cpu(Monitor *mon)
 286 {
 287     return mon_get_cpu_sync(mon, true);
 288 }
 289
 290 CPUArchState *mon_get_cpu_env(Monitor *mon)
 291 {
 292     CPUState *cs = mon_get_cpu(mon);
 293
 294     return cs ? cs->env_ptr : NULL;
 295 }
 296
 297 int monitor_get_cpu_index(Monitor *mon)
 298 {
 299     CPUState *cs = mon_get_cpu_sync(mon, false);
 300
 301     return cs ? cs->cpu_index : UNASSIGNED_CPU_INDEX;
 302 }
 303
 304 static void hmp_info_registers(Monitor *mon, const QDict *qdict)
 305 {
 306     bool all_cpus = qdict_get_try_bool(qdict, "cpustate_all", false);
 307     CPUState *cs;
 308
 309     if (all_cpus) {
 310         CPU_FOREACH(cs) {
 311             monitor_printf(mon, "\nCPU#%d\n", cs->cpu_index);
 312             cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
 313         }
 314     } else {
 315         cs = mon_get_cpu(mon);
 316
 317         if (!cs) {
 318             monitor_printf(mon, "No CPU available\n");
 319             return;
 320         }
 321
 322         cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
 323     }
 324 }
 325
 326 #ifdef CONFIG_TCG
 327 static void hmp_info_jit(Monitor *mon, const QDict *qdict)
 328 {
 329     if (!tcg_enabled()) {
 330         error_report("JIT information is only available with accel=tcg");
 331         return;
 332     }
 333
 334     dump_exec_info();
 335     dump_drift_info();
 336 }
 337
 338 static void hmp_info_opcount(Monitor *mon, const QDict *qdict)
 339 {
 340     dump_opcount_info();
 341 }
 342 #endif
 343
 344 static void hmp_info_sync_profile(Monitor *mon, const QDict *qdict)
 345 {
 346     int64_t max = qdict_get_try_int(qdict, "max", 10);
 347     bool mean = qdict_get_try_bool(qdict, "mean", false);
 348     bool coalesce = !qdict_get_try_bool(qdict, "no_coalesce", false);
 349     enum QSPSortBy sort_by;
 350
 351     sort_by = mean ? QSP_SORT_BY_AVG_WAIT_TIME : QSP_SORT_BY_TOTAL_WAIT_TIME;
 352     qsp_report(max, sort_by, coalesce);
 353 }
 354
 355 static void hmp_info_history(Monitor *mon, const QDict *qdict)
 356 {
 357     MonitorHMP *hmp_mon = container_of(mon, MonitorHMP, common);
 358     int i;
 359     const char *str;
 360
 361     if (!hmp_mon->rs) {
 362         return;
 363     }
 364     i = 0;
 365     for(;;) {
 366         str = readline_get_history(hmp_mon->rs, i);
 367         if (!str) {
 368             break;
 369         }
 370         monitor_printf(mon, "%d: '%s'\n", i, str);
 371         i++;
 372     }
 373 }
 374
 375 static void hmp_info_cpustats(Monitor *mon, const QDict *qdict)
 376 {
 377     CPUState *cs = mon_get_cpu(mon);
 378
 379     if (!cs) {
 380         monitor_printf(mon, "No CPU available\n");
 381         return;
 382     }
 383     cpu_dump_statistics(cs, 0);
 384 }
 385
 386 static void hmp_info_trace_events(Monitor *mon, const QDict *qdict)
 387 {
 388     const char *name = qdict_get_try_str(qdict, "name");
 389     bool has_vcpu = qdict_haskey(qdict, "vcpu");
 390     int vcpu = qdict_get_try_int(qdict, "vcpu", 0);
 391     TraceEventInfoList *events;
 392     TraceEventInfoList *elem;
 393     Error *local_err = NULL;
 394
 395     if (name == NULL) {
 396         name = "*";
 397     }
 398     if (vcpu < 0) {
 399         monitor_printf(mon, "argument vcpu must be positive");
 400         return;
 401     }
 402
 403     events = qmp_trace_event_get_state(name, has_vcpu, vcpu, &local_err);
 404     if (local_err) {
 405         error_report_err(local_err);
 406         return;
 407     }
 408
 409     for (elem = events; elem != NULL; elem = elem->next) {
 410         monitor_printf(mon, "%s : state %u\n",
 411                        elem->value->name,
 412                        elem->value->state == TRACE_EVENT_STATE_ENABLED ? 1 : 0);
 413     }
 414     qapi_free_TraceEventInfoList(events);
 415 }
 416
 417 void qmp_client_migrate_info(const char *protocol, const char *hostname,
 418                              bool has_port, int64_t port,
 419                              bool has_tls_port, int64_t tls_port,
 420                              bool has_cert_subject, const char *cert_subject,
 421                              Error **errp)
 422 {
 423     if (strcmp(protocol, "spice") == 0) {
 424         if (!qemu_using_spice(errp)) {
 425             return;
 426         }
 427
 428         if (!has_port && !has_tls_port) {
 429             error_setg(errp, QERR_MISSING_PARAMETER, "port/tls-port");
 430             return;
 431         }
 432
 433         if (qemu_spice.migrate_info(hostname,
 434                                     has_port ? port : -1,
 435                                     has_tls_port ? tls_port : -1,
 436                                     cert_subject)) {
 437             error_setg(errp, "Could not set up display for migration");
 438             return;
 439         }
 440         return;
 441     }
 442
 443     error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "protocol", "'spice'");
 444 }
 445
 446 static void hmp_logfile(Monitor *mon, const QDict *qdict)
 447 {
 448     Error *err = NULL;
 449
 450     qemu_set_log_filename(qdict_get_str(qdict, "filename"), &err);
 451     if (err) {
 452         error_report_err(err);
 453     }
 454 }
 455
 456 static void hmp_log(Monitor *mon, const QDict *qdict)
 457 {
 458     int mask;
 459     const char *items = qdict_get_str(qdict, "items");
 460
 461     if (!strcmp(items, "none")) {
 462         mask = 0;
 463     } else {
 464         mask = qemu_str_to_log_mask(items);
 465         if (!mask) {
 466             help_cmd(mon, "log");
 467             return;
 468         }
 469     }
 470     qemu_set_log(mask);
 471 }
 472
 473 static void hmp_singlestep(Monitor *mon, const QDict *qdict)
 474 {
 475     const char *option = qdict_get_try_str(qdict, "option");
 476     if (!option || !strcmp(option, "on")) {
 477         singlestep = 1;
 478     } else if (!strcmp(option, "off")) {
 479         singlestep = 0;
 480     } else {
 481         monitor_printf(mon, "unexpected option %s\n", option);
 482     }
 483 }
 484
 485 static void hmp_gdbserver(Monitor *mon, const QDict *qdict)
 486 {
 487     const char *device = qdict_get_try_str(qdict, "device");
 488     if (!device) {
 489         device = "tcp::" DEFAULT_GDBSTUB_PORT;
 490     }
 491
 492     if (gdbserver_start(device) < 0) {
 493         monitor_printf(mon, "Could not open gdbserver on device '%s'\n",
 494                        device);
 495     } else if (strcmp(device, "none") == 0) {
 496         monitor_printf(mon, "Disabled gdbserver\n");
 497     } else {
 498         monitor_printf(mon, "Waiting for gdb connection on device '%s'\n",
 499                        device);
 500     }
 501 }
 502
 503 static void hmp_watchdog_action(Monitor *mon, const QDict *qdict)
 504 {
 505     const char *action = qdict_get_str(qdict, "action");
 506     if (select_watchdog_action(action) == -1) {
 507         monitor_printf(mon, "Unknown watchdog action '%s'\n", action);
 508     }
 509 }
 510
 511 static void monitor_printc(Monitor *mon, int c)
 512 {
 513     monitor_printf(mon, "'");
 514     switch(c) {
 515     case '\'':
 516         monitor_printf(mon, "\\'");
 517         break;
 518     case '\\':
 519         monitor_printf(mon, "\\\\");
 520         break;
 521     case '\n':
 522         monitor_printf(mon, "\\n");
 523         break;
 524     case '\r':
 525         monitor_printf(mon, "\\r");
 526         break;
 527     default:
 528         if (c >= 32 && c <= 126) {
 529             monitor_printf(mon, "%c", c);
 530         } else {
 531             monitor_printf(mon, "\\x%02x", c);
 532         }
 533         break;
 534     }
 535     monitor_printf(mon, "'");
 536 }
 537
 538 static void memory_dump(Monitor *mon, int count, int format, int wsize,
 539                         hwaddr addr, int is_physical)
 540 {
 541     int l, line_size, i, max_digits, len;
 542     uint8_t buf[16];
 543     uint64_t v;
 544     CPUState *cs = mon_get_cpu(mon);
 545
 546     if (!cs && (format == 'i' || !is_physical)) {
 547         monitor_printf(mon, "Can not dump without CPU\n");
 548         return;
 549     }
 550
 551     if (format == 'i') {
 552         monitor_disas(mon, cs, addr, count, is_physical);
 553         return;
 554     }
 555
 556     len = wsize * count;
 557     if (wsize == 1) {
 558         line_size = 8;
 559     } else {
 560         line_size = 16;
 561     }
 562     max_digits = 0;
 563
 564     switch(format) {
 565     case 'o':
 566         max_digits = DIV_ROUND_UP(wsize * 8, 3);
 567         break;
 568     default:
 569     case 'x':
 570         max_digits = (wsize * 8) / 4;
 571         break;
 572     case 'u':
 573     case 'd':
 574         max_digits = DIV_ROUND_UP(wsize * 8 * 10, 33);
 575         break;
 576     case 'c':
 577         wsize = 1;
 578         break;
 579     }
 580
 581     while (len > 0) {
 582         if (is_physical) {
 583             monitor_printf(mon, TARGET_FMT_plx ":", addr);
 584         } else {
 585             monitor_printf(mon, TARGET_FMT_lx ":", (target_ulong)addr);
 586         }
 587         l = len;
 588         if (l > line_size)
 589             l = line_size;
 590         if (is_physical) {
 591             AddressSpace *as = cs ? cs->as : &address_space_memory;
 592             MemTxResult r = address_space_read(as, addr,
 593                                                MEMTXATTRS_UNSPECIFIED, buf, l);
 594             if (r != MEMTX_OK) {
 595                 monitor_printf(mon, " Cannot access memory\n");
 596                 break;
 597             }
 598         } else {
 599             if (cpu_memory_rw_debug(cs, addr, buf, l, 0) < 0) {
 600                 monitor_printf(mon, " Cannot access memory\n");
 601                 break;
 602             }
 603         }
 604         i = 0;
 605         while (i < l) {
 606             switch(wsize) {
 607             default:
 608             case 1:
 609                 v = ldub_p(buf + i);
 610                 break;
 611             case 2:
 612                 v = lduw_p(buf + i);
 613                 break;
 614             case 4:
 615                 v = (uint32_t)ldl_p(buf + i);
 616                 break;
 617             case 8:
 618                 v = ldq_p(buf + i);
 619                 break;
 620             }
 621             monitor_printf(mon, " ");
 622             switch(format) {
 623             case 'o':
 624                 monitor_printf(mon, "%#*" PRIo64, max_digits, v);
 625                 break;
 626             case 'x':
 627                 monitor_printf(mon, "0x%0*" PRIx64, max_digits, v);
 628                 break;
 629             case 'u':
 630                 monitor_printf(mon, "%*" PRIu64, max_digits, v);
 631                 break;
 632             case 'd':
 633                 monitor_printf(mon, "%*" PRId64, max_digits, v);
 634                 break;
 635             case 'c':
 636                 monitor_printc(mon, v);
 637                 break;
 638             }
 639             i += wsize;
 640         }
 641         monitor_printf(mon, "\n");
 642         addr += l;
 643         len -= l;
 644     }
 645 }
 646
 647 static void hmp_memory_dump(Monitor *mon, const QDict *qdict)
 648 {
 649     int count = qdict_get_int(qdict, "count");
 650     int format = qdict_get_int(qdict, "format");
 651     int size = qdict_get_int(qdict, "size");
 652     target_long addr = qdict_get_int(qdict, "addr");
 653
 654     memory_dump(mon, count, format, size, addr, 0);
 655 }
 656
 657 static void hmp_physical_memory_dump(Monitor *mon, const QDict *qdict)
 658 {
 659     int count = qdict_get_int(qdict, "count");
 660     int format = qdict_get_int(qdict, "format");
 661     int size = qdict_get_int(qdict, "size");
 662     hwaddr addr = qdict_get_int(qdict, "addr");
 663
 664     memory_dump(mon, count, format, size, addr, 1);
 665 }
 666
 667 void *gpa2hva(MemoryRegion **p_mr, hwaddr addr, uint64_t size, Error **errp)
 668 {
 669     Int128 gpa_region_size;
 670     MemoryRegionSection mrs = memory_region_find(get_system_memory(),
 671                                                  addr, size);
 672
 673     if (!mrs.mr) {
 674         error_setg(errp, "No memory is mapped at address 0x%" HWADDR_PRIx, addr);
 675         return NULL;
 676     }
 677
 678     if (!memory_region_is_ram(mrs.mr) && !memory_region_is_romd(mrs.mr)) {
 679         error_setg(errp, "Memory at address 0x%" HWADDR_PRIx "is not RAM", addr);
 680         memory_region_unref(mrs.mr);
 681         return NULL;
 682     }
 683
 684     gpa_region_size = int128_make64(size);
 685     if (int128_lt(mrs.size, gpa_region_size)) {
 686         error_setg(errp, "Size of memory region at 0x%" HWADDR_PRIx
 687                    " exceeded.", addr);
 688         memory_region_unref(mrs.mr);
 689         return NULL;
 690     }
 691
 692     *p_mr = mrs.mr;
 693     return qemu_map_ram_ptr(mrs.mr->ram_block, mrs.offset_within_region);
 694 }
 695
 696 static void hmp_gpa2hva(Monitor *mon, const QDict *qdict)
 697 {
 698     hwaddr addr = qdict_get_int(qdict, "addr");
 699     Error *local_err = NULL;
 700     MemoryRegion *mr = NULL;
 701     void *ptr;
 702
 703     ptr = gpa2hva(&mr, addr, 1, &local_err);
 704     if (local_err) {
 705         error_report_err(local_err);
 706         return;
 707     }
 708
 709     monitor_printf(mon, "Host virtual address for 0x%" HWADDR_PRIx
 710                    " (%s) is %p\n",
 711                    addr, mr->name, ptr);
 712
 713     memory_region_unref(mr);
 714 }
 715
 716 static void hmp_gva2gpa(Monitor *mon, const QDict *qdict)
 717 {
 718     target_ulong addr = qdict_get_int(qdict, "addr");
 719     MemTxAttrs attrs;
 720     CPUState *cs = mon_get_cpu(mon);
 721     hwaddr gpa;
 722
 723     if (!cs) {
 724         monitor_printf(mon, "No cpu\n");
 725         return;
 726     }
 727
 728     gpa  = cpu_get_phys_page_attrs_debug(cs, addr & TARGET_PAGE_MASK, &attrs);
 729     if (gpa == -1) {
 730         monitor_printf(mon, "Unmapped\n");
 731     } else {
 732         monitor_printf(mon, "gpa: %#" HWADDR_PRIx "\n",
 733                        gpa + (addr & ~TARGET_PAGE_MASK));
 734     }
 735 }
 736
 737 #ifdef CONFIG_LINUX
 738 static uint64_t vtop(void *ptr, Error **errp)
 739 {
 740     uint64_t pinfo;
 741     uint64_t ret = -1;
 742     uintptr_t addr = (uintptr_t) ptr;
 743     uintptr_t pagesize = qemu_real_host_page_size;
 744     off_t offset = addr / pagesize * sizeof(pinfo);
 745     int fd;
 746
 747     fd = open("/proc/self/pagemap", O_RDONLY);
 748     if (fd == -1) {
 749         error_setg_errno(errp, errno, "Cannot open /proc/self/pagemap");
 750         return -1;
 751     }
 752
 753     /* Force copy-on-write if necessary.  */
 754     qatomic_add((uint8_t *)ptr, 0);
 755
 756     if (pread(fd, &pinfo, sizeof(pinfo), offset) != sizeof(pinfo)) {
 757         error_setg_errno(errp, errno, "Cannot read pagemap");
 758         goto out;
 759     }
 760     if ((pinfo & (1ull << 63)) == 0) {
 761         error_setg(errp, "Page not present");
 762         goto out;
 763     }
 764     ret = ((pinfo & 0x007fffffffffffffull) * pagesize) | (addr & (pagesize - 1));
 765
 766 out:
 767     close(fd);
 768     return ret;
 769 }
 770
 771 static void hmp_gpa2hpa(Monitor *mon, const QDict *qdict)
 772 {
 773     hwaddr addr = qdict_get_int(qdict, "addr");
 774     Error *local_err = NULL;
 775     MemoryRegion *mr = NULL;
 776     void *ptr;
 777     uint64_t physaddr;
 778
 779     ptr = gpa2hva(&mr, addr, 1, &local_err);
 780     if (local_err) {
 781         error_report_err(local_err);
 782         return;
 783     }
 784
 785     physaddr = vtop(ptr, &local_err);
 786     if (local_err) {
 787         error_report_err(local_err);
 788     } else {
 789         monitor_printf(mon, "Host physical address for 0x%" HWADDR_PRIx
 790                        " (%s) is 0x%" PRIx64 "\n",
 791                        addr, mr->name, (uint64_t) physaddr);
 792     }
 793
 794     memory_region_unref(mr);
 795 }
 796 #endif
 797
 798 static void do_print(Monitor *mon, const QDict *qdict)
 799 {
 800     int format = qdict_get_int(qdict, "format");
 801     hwaddr val = qdict_get_int(qdict, "val");
 802
 803     switch(format) {
 804     case 'o':
 805         monitor_printf(mon, "%#" HWADDR_PRIo, val);
 806         break;
 807     case 'x':
 808         monitor_printf(mon, "%#" HWADDR_PRIx, val);
 809         break;
 810     case 'u':
 811         monitor_printf(mon, "%" HWADDR_PRIu, val);
 812         break;
 813     default:
 814     case 'd':
 815         monitor_printf(mon, "%" HWADDR_PRId, val);
 816         break;
 817     case 'c':
 818         monitor_printc(mon, val);
 819         break;
 820     }
 821     monitor_printf(mon, "\n");
 822 }
 823
 824 static void hmp_sum(Monitor *mon, const QDict *qdict)
 825 {
 826     uint32_t addr;
 827     uint16_t sum;
 828     uint32_t start = qdict_get_int(qdict, "start");
 829     uint32_t size = qdict_get_int(qdict, "size");
 830
 831     sum = 0;
 832     for(addr = start; addr < (start + size); addr++) {
 833         uint8_t val = address_space_ldub(&address_space_memory, addr,
 834                                          MEMTXATTRS_UNSPECIFIED, NULL);
 835         /* BSD sum algorithm ('sum' Unix command) */
 836         sum = (sum >> 1) | (sum << 15);
 837         sum += val;
 838     }
 839     monitor_printf(mon, "%05d\n", sum);
 840 }
 841
 842 static int mouse_button_state;
 843
 844 static void hmp_mouse_move(Monitor *mon, const QDict *qdict)
 845 {
 846     int dx, dy, dz, button;
 847     const char *dx_str = qdict_get_str(qdict, "dx_str");
 848     const char *dy_str = qdict_get_str(qdict, "dy_str");
 849     const char *dz_str = qdict_get_try_str(qdict, "dz_str");
 850
 851     dx = strtol(dx_str, NULL, 0);
 852     dy = strtol(dy_str, NULL, 0);
 853     qemu_input_queue_rel(NULL, INPUT_AXIS_X, dx);
 854     qemu_input_queue_rel(NULL, INPUT_AXIS_Y, dy);
 855
 856     if (dz_str) {
 857         dz = strtol(dz_str, NULL, 0);
 858         if (dz != 0) {
 859             button = (dz > 0) ? INPUT_BUTTON_WHEEL_UP : INPUT_BUTTON_WHEEL_DOWN;
 860             qemu_input_queue_btn(NULL, button, true);
 861             qemu_input_event_sync();
 862             qemu_input_queue_btn(NULL, button, false);
 863         }
 864     }
 865     qemu_input_event_sync();
 866 }
 867
 868 static void hmp_mouse_button(Monitor *mon, const QDict *qdict)
 869 {
 870     static uint32_t bmap[INPUT_BUTTON__MAX] = {
 871         [INPUT_BUTTON_LEFT]       = MOUSE_EVENT_LBUTTON,
 872         [INPUT_BUTTON_MIDDLE]     = MOUSE_EVENT_MBUTTON,
 873         [INPUT_BUTTON_RIGHT]      = MOUSE_EVENT_RBUTTON,
 874     };
 875     int button_state = qdict_get_int(qdict, "button_state");
 876
 877     if (mouse_button_state == button_state) {
 878         return;
 879     }
 880     qemu_input_update_buttons(NULL, bmap, mouse_button_state, button_state);
 881     qemu_input_event_sync();
 882     mouse_button_state = button_state;
 883 }
 884
 885 static void hmp_ioport_read(Monitor *mon, const QDict *qdict)
 886 {
 887     int size = qdict_get_int(qdict, "size");
 888     int addr = qdict_get_int(qdict, "addr");
 889     int has_index = qdict_haskey(qdict, "index");
 890     uint32_t val;
 891     int suffix;
 892
 893     if (has_index) {
 894         int index = qdict_get_int(qdict, "index");
 895         cpu_outb(addr & IOPORTS_MASK, index & 0xff);
 896         addr++;
 897     }
 898     addr &= 0xffff;
 899
 900     switch(size) {
 901     default:
 902     case 1:
 903         val = cpu_inb(addr);
 904         suffix = 'b';
 905         break;
 906     case 2:
 907         val = cpu_inw(addr);
 908         suffix = 'w';
 909         break;
 910     case 4:
 911         val = cpu_inl(addr);
 912         suffix = 'l';
 913         break;
 914     }
 915     monitor_printf(mon, "port%c[0x%04x] = 0x%0*x\n",
 916                    suffix, addr, size * 2, val);
 917 }
 918
 919 static void hmp_ioport_write(Monitor *mon, const QDict *qdict)
 920 {
 921     int size = qdict_get_int(qdict, "size");
 922     int addr = qdict_get_int(qdict, "addr");
 923     int val = qdict_get_int(qdict, "val");
 924
 925     addr &= IOPORTS_MASK;
 926
 927     switch (size) {
 928     default:
 929     case 1:
 930         cpu_outb(addr, val);
 931         break;
 932     case 2:
 933         cpu_outw(addr, val);
 934         break;
 935     case 4:
 936         cpu_outl(addr, val);
 937         break;
 938     }
 939 }
 940
 941 static void hmp_boot_set(Monitor *mon, const QDict *qdict)
 942 {
 943     Error *local_err = NULL;
 944     const char *bootdevice = qdict_get_str(qdict, "bootdevice");
 945
 946     qemu_boot_set(bootdevice, &local_err);
 947     if (local_err) {
 948         error_report_err(local_err);
 949     } else {
 950         monitor_printf(mon, "boot device list now set to %s\n", bootdevice);
 951     }
 952 }
 953
 954 static void hmp_info_mtree(Monitor *mon, const QDict *qdict)
 955 {
 956     bool flatview = qdict_get_try_bool(qdict, "flatview", false);
 957     bool dispatch_tree = qdict_get_try_bool(qdict, "dispatch_tree", false);
 958     bool owner = qdict_get_try_bool(qdict, "owner", false);
 959     bool disabled = qdict_get_try_bool(qdict, "disabled", false);
 960
 961     mtree_info(flatview, dispatch_tree, owner, disabled);
 962 }
 963
 964 #ifdef CONFIG_PROFILER
 965
 966 int64_t dev_time;
 967
 968 static void hmp_info_profile(Monitor *mon, const QDict *qdict)
 969 {
 970     static int64_t last_cpu_exec_time;
 971     int64_t cpu_exec_time;
 972     int64_t delta;
 973
 974     cpu_exec_time = tcg_cpu_exec_time();
 975     delta = cpu_exec_time - last_cpu_exec_time;
 976
 977     monitor_printf(mon, "async time  %" PRId64 " (%0.3f)\n",
 978                    dev_time, dev_time / (double)NANOSECONDS_PER_SECOND);
 979     monitor_printf(mon, "qemu time   %" PRId64 " (%0.3f)\n",
 980                    delta, delta / (double)NANOSECONDS_PER_SECOND);
 981     last_cpu_exec_time = cpu_exec_time;
 982     dev_time = 0;
 983 }
 984 #else
 985 static void hmp_info_profile(Monitor *mon, const QDict *qdict)
 986 {
 987     monitor_printf(mon, "Internal profiler not compiled\n");
 988 }
 989 #endif
 990
 991 /* Capture support */
 992 static QLIST_HEAD (capture_list_head, CaptureState) capture_head;
 993
 994 static void hmp_info_capture(Monitor *mon, const QDict *qdict)
 995 {
 996     int i;
 997     CaptureState *s;
 998
 999     for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) {
1000         monitor_printf(mon, "[%d]: ", i);
1001         s->ops.info (s->opaque);
1002     }
1003 }
1004
1005 static void hmp_stopcapture(Monitor *mon, const QDict *qdict)
1006 {
1007     int i;
1008     int n = qdict_get_int(qdict, "n");
1009     CaptureState *s;
1010
1011     for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) {
1012         if (i == n) {
1013             s->ops.destroy (s->opaque);
1014             QLIST_REMOVE (s, entries);
1015             g_free (s);
1016             return;
1017         }
1018     }
1019 }
1020
1021 static void hmp_wavcapture(Monitor *mon, const QDict *qdict)
1022 {
1023     const char *path = qdict_get_str(qdict, "path");
1024     int freq = qdict_get_try_int(qdict, "freq", 44100);
1025     int bits = qdict_get_try_int(qdict, "bits", 16);
1026     int nchannels = qdict_get_try_int(qdict, "nchannels", 2);
1027     const char *audiodev = qdict_get_str(qdict, "audiodev");
1028     CaptureState *s;
1029     AudioState *as = audio_state_by_name(audiodev);
1030
1031     if (!as) {
1032         monitor_printf(mon, "Audiodev '%s' not found\n", audiodev);
1033         return;
1034     }
1035
1036     s = g_malloc0 (sizeof (*s));
1037
1038     if (wav_start_capture(as, s, path, freq, bits, nchannels)) {
1039         monitor_printf(mon, "Failed to add wave capture\n");
1040         g_free (s);
1041         return;
1042     }
1043     QLIST_INSERT_HEAD (&capture_head, s, entries);
1044 }
1045
1046 void qmp_getfd(const char *fdname, Error **errp)
1047 {
1048     Monitor *cur_mon = monitor_cur();
1049     mon_fd_t *monfd;
1050     int fd, tmp_fd;
1051
1052     fd = qemu_chr_fe_get_msgfd(&cur_mon->chr);
1053     if (fd == -1) {
1054         error_setg(errp, "No file descriptor supplied via SCM_RIGHTS");
1055         return;
1056     }
1057
1058     if (qemu_isdigit(fdname[0])) {
1059         close(fd);
1060         error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "fdname",
1061                    "a name not starting with a digit");
1062         return;
1063     }
1064
1065     QEMU_LOCK_GUARD(&cur_mon->mon_lock);
1066     QLIST_FOREACH(monfd, &cur_mon->fds, next) {
1067         if (strcmp(monfd->name, fdname) != 0) {
1068             continue;
1069         }
1070
1071         tmp_fd = monfd->fd;
1072         monfd->fd = fd;
1073         /* Make sure close() is outside critical section */
1074         close(tmp_fd);
1075         return;
1076     }
1077
1078     monfd = g_malloc0(sizeof(mon_fd_t));
1079     monfd->name = g_strdup(fdname);
1080     monfd->fd = fd;
1081
1082     QLIST_INSERT_HEAD(&cur_mon->fds, monfd, next);
1083 }
1084
1085 void qmp_closefd(const char *fdname, Error **errp)
1086 {
1087     Monitor *cur_mon = monitor_cur();
1088     mon_fd_t *monfd;
1089     int tmp_fd;
1090
1091     qemu_mutex_lock(&cur_mon->mon_lock);
1092     QLIST_FOREACH(monfd, &cur_mon->fds, next) {
1093         if (strcmp(monfd->name, fdname) != 0) {
1094             continue;
1095         }
1096
1097         QLIST_REMOVE(monfd, next);
1098         tmp_fd = monfd->fd;
1099         g_free(monfd->name);
1100         g_free(monfd);
1101         qemu_mutex_unlock(&cur_mon->mon_lock);
1102         /* Make sure close() is outside critical section */
1103         close(tmp_fd);
1104         return;
1105     }
1106
1107     qemu_mutex_unlock(&cur_mon->mon_lock);
1108     error_setg(errp, "File descriptor named '%s' not found", fdname);
1109 }
1110
1111 int monitor_get_fd(Monitor *mon, const char *fdname, Error **errp)
1112 {
1113     mon_fd_t *monfd;
1114
1115     QEMU_LOCK_GUARD(&mon->mon_lock);
1116     QLIST_FOREACH(monfd, &mon->fds, next) {
1117         int fd;
1118
1119         if (strcmp(monfd->name, fdname) != 0) {
1120             continue;
1121         }
1122
1123         fd = monfd->fd;
1124
1125         /* caller takes ownership of fd */
1126         QLIST_REMOVE(monfd, next);
1127         g_free(monfd->name);
1128         g_free(monfd);
1129
1130         return fd;
1131     }
1132
1133     error_setg(errp, "File descriptor named '%s' has not been found", fdname);
1134     return -1;
1135 }
1136
1137 static void monitor_fdset_cleanup(MonFdset *mon_fdset)
1138 {
1139     MonFdsetFd *mon_fdset_fd;
1140     MonFdsetFd *mon_fdset_fd_next;
1141
1142     QLIST_FOREACH_SAFE(mon_fdset_fd, &mon_fdset->fds, next, mon_fdset_fd_next) {
1143         if ((mon_fdset_fd->removed ||
1144                 (QLIST_EMPTY(&mon_fdset->dup_fds) && mon_refcount == 0)) &&
1145                 runstate_is_running()) {
1146             close(mon_fdset_fd->fd);
1147             g_free(mon_fdset_fd->opaque);
1148             QLIST_REMOVE(mon_fdset_fd, next);
1149             g_free(mon_fdset_fd);
1150         }
1151     }
1152
1153     if (QLIST_EMPTY(&mon_fdset->fds) && QLIST_EMPTY(&mon_fdset->dup_fds)) {
1154         QLIST_REMOVE(mon_fdset, next);
1155         g_free(mon_fdset);
1156     }
1157 }
1158
1159 void monitor_fdsets_cleanup(void)
1160 {
1161     MonFdset *mon_fdset;
1162     MonFdset *mon_fdset_next;
1163
1164     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1165     QLIST_FOREACH_SAFE(mon_fdset, &mon_fdsets, next, mon_fdset_next) {
1166         monitor_fdset_cleanup(mon_fdset);
1167     }
1168 }
1169
1170 AddfdInfo *qmp_add_fd(bool has_fdset_id, int64_t fdset_id, bool has_opaque,
1171                       const char *opaque, Error **errp)
1172 {
1173     int fd;
1174     Monitor *mon = monitor_cur();
1175     AddfdInfo *fdinfo;
1176
1177     fd = qemu_chr_fe_get_msgfd(&mon->chr);
1178     if (fd == -1) {
1179         error_setg(errp, "No file descriptor supplied via SCM_RIGHTS");
1180         goto error;
1181     }
1182
1183     fdinfo = monitor_fdset_add_fd(fd, has_fdset_id, fdset_id,
1184                                   has_opaque, opaque, errp);
1185     if (fdinfo) {
1186         return fdinfo;
1187     }
1188
1189 error:
1190     if (fd != -1) {
1191         close(fd);
1192     }
1193     return NULL;
1194 }
1195
1196 void qmp_remove_fd(int64_t fdset_id, bool has_fd, int64_t fd, Error **errp)
1197 {
1198     MonFdset *mon_fdset;
1199     MonFdsetFd *mon_fdset_fd;
1200     char fd_str[60];
1201
1202     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1203     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1204         if (mon_fdset->id != fdset_id) {
1205             continue;
1206         }
1207         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1208             if (has_fd) {
1209                 if (mon_fdset_fd->fd != fd) {
1210                     continue;
1211                 }
1212                 mon_fdset_fd->removed = true;
1213                 break;
1214             } else {
1215                 mon_fdset_fd->removed = true;
1216             }
1217         }
1218         if (has_fd && !mon_fdset_fd) {
1219             goto error;
1220         }
1221         monitor_fdset_cleanup(mon_fdset);
1222         return;
1223     }
1224
1225 error:
1226     if (has_fd) {
1227         snprintf(fd_str, sizeof(fd_str), "fdset-id:%" PRId64 ", fd:%" PRId64,
1228                  fdset_id, fd);
1229     } else {
1230         snprintf(fd_str, sizeof(fd_str), "fdset-id:%" PRId64, fdset_id);
1231     }
1232     error_setg(errp, "File descriptor named '%s' not found", fd_str);
1233 }
1234
1235 FdsetInfoList *qmp_query_fdsets(Error **errp)
1236 {
1237     MonFdset *mon_fdset;
1238     MonFdsetFd *mon_fdset_fd;
1239     FdsetInfoList *fdset_list = NULL;
1240
1241     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1242     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1243         FdsetInfo *fdset_info = g_malloc0(sizeof(*fdset_info));
1244
1245         fdset_info->fdset_id = mon_fdset->id;
1246
1247         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1248             FdsetFdInfo *fdsetfd_info;
1249
1250             fdsetfd_info = g_malloc0(sizeof(*fdsetfd_info));
1251             fdsetfd_info->fd = mon_fdset_fd->fd;
1252             if (mon_fdset_fd->opaque) {
1253                 fdsetfd_info->has_opaque = true;
1254                 fdsetfd_info->opaque = g_strdup(mon_fdset_fd->opaque);
1255             } else {
1256                 fdsetfd_info->has_opaque = false;
1257             }
1258
1259             QAPI_LIST_PREPEND(fdset_info->fds, fdsetfd_info);
1260         }
1261
1262         QAPI_LIST_PREPEND(fdset_list, fdset_info);
1263     }
1264
1265     return fdset_list;
1266 }
1267
1268 AddfdInfo *monitor_fdset_add_fd(int fd, bool has_fdset_id, int64_t fdset_id,
1269                                 bool has_opaque, const char *opaque,
1270                                 Error **errp)
1271 {
1272     MonFdset *mon_fdset = NULL;
1273     MonFdsetFd *mon_fdset_fd;
1274     AddfdInfo *fdinfo;
1275
1276     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1277     if (has_fdset_id) {
1278         QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1279             /* Break if match found or match impossible due to ordering by ID */
1280             if (fdset_id <= mon_fdset->id) {
1281                 if (fdset_id < mon_fdset->id) {
1282                     mon_fdset = NULL;
1283                 }
1284                 break;
1285             }
1286         }
1287     }
1288
1289     if (mon_fdset == NULL) {
1290         int64_t fdset_id_prev = -1;
1291         MonFdset *mon_fdset_cur = QLIST_FIRST(&mon_fdsets);
1292
1293         if (has_fdset_id) {
1294             if (fdset_id < 0) {
1295                 error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "fdset-id",
1296                            "a non-negative value");
1297                 return NULL;
1298             }
1299             /* Use specified fdset ID */
1300             QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1301                 mon_fdset_cur = mon_fdset;
1302                 if (fdset_id < mon_fdset_cur->id) {
1303                     break;
1304                 }
1305             }
1306         } else {
1307             /* Use first available fdset ID */
1308             QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1309                 mon_fdset_cur = mon_fdset;
1310                 if (fdset_id_prev == mon_fdset_cur->id - 1) {
1311                     fdset_id_prev = mon_fdset_cur->id;
1312                     continue;
1313                 }
1314                 break;
1315             }
1316         }
1317
1318         mon_fdset = g_malloc0(sizeof(*mon_fdset));
1319         if (has_fdset_id) {
1320             mon_fdset->id = fdset_id;
1321         } else {
1322             mon_fdset->id = fdset_id_prev + 1;
1323         }
1324
1325         /* The fdset list is ordered by fdset ID */
1326         if (!mon_fdset_cur) {
1327             QLIST_INSERT_HEAD(&mon_fdsets, mon_fdset, next);
1328         } else if (mon_fdset->id < mon_fdset_cur->id) {
1329             QLIST_INSERT_BEFORE(mon_fdset_cur, mon_fdset, next);
1330         } else {
1331             QLIST_INSERT_AFTER(mon_fdset_cur, mon_fdset, next);
1332         }
1333     }
1334
1335     mon_fdset_fd = g_malloc0(sizeof(*mon_fdset_fd));
1336     mon_fdset_fd->fd = fd;
1337     mon_fdset_fd->removed = false;
1338     if (has_opaque) {
1339         mon_fdset_fd->opaque = g_strdup(opaque);
1340     }
1341     QLIST_INSERT_HEAD(&mon_fdset->fds, mon_fdset_fd, next);
1342
1343     fdinfo = g_malloc0(sizeof(*fdinfo));
1344     fdinfo->fdset_id = mon_fdset->id;
1345     fdinfo->fd = mon_fdset_fd->fd;
1346
1347     return fdinfo;
1348 }
1349
1350 int monitor_fdset_dup_fd_add(int64_t fdset_id, int flags)
1351 {
1352 #ifdef _WIN32
1353     return -ENOENT;
1354 #else
1355     MonFdset *mon_fdset;
1356
1357     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1358     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1359         MonFdsetFd *mon_fdset_fd;
1360         MonFdsetFd *mon_fdset_fd_dup;
1361         int fd = -1;
1362         int dup_fd;
1363         int mon_fd_flags;
1364
1365         if (mon_fdset->id != fdset_id) {
1366             continue;
1367         }
1368
1369         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1370             mon_fd_flags = fcntl(mon_fdset_fd->fd, F_GETFL);
1371             if (mon_fd_flags == -1) {
1372                 return -1;
1373             }
1374
1375             if ((flags & O_ACCMODE) == (mon_fd_flags & O_ACCMODE)) {
1376                 fd = mon_fdset_fd->fd;
1377                 break;
1378             }
1379         }
1380
1381         if (fd == -1) {
1382             errno = EACCES;
1383             return -1;
1384         }
1385
1386         dup_fd = qemu_dup_flags(fd, flags);
1387         if (dup_fd == -1) {
1388             return -1;
1389         }
1390
1391         mon_fdset_fd_dup = g_malloc0(sizeof(*mon_fdset_fd_dup));
1392         mon_fdset_fd_dup->fd = dup_fd;
1393         QLIST_INSERT_HEAD(&mon_fdset->dup_fds, mon_fdset_fd_dup, next);
1394         return dup_fd;
1395     }
1396
1397     errno = ENOENT;
1398     return -1;
1399 #endif
1400 }
1401
1402 static int64_t monitor_fdset_dup_fd_find_remove(int dup_fd, bool remove)
1403 {
1404     MonFdset *mon_fdset;
1405     MonFdsetFd *mon_fdset_fd_dup;
1406
1407     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1408     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1409         QLIST_FOREACH(mon_fdset_fd_dup, &mon_fdset->dup_fds, next) {
1410             if (mon_fdset_fd_dup->fd == dup_fd) {
1411                 if (remove) {
1412                     QLIST_REMOVE(mon_fdset_fd_dup, next);
1413                     g_free(mon_fdset_fd_dup);
1414                     if (QLIST_EMPTY(&mon_fdset->dup_fds)) {
1415                         monitor_fdset_cleanup(mon_fdset);
1416                     }
1417                     return -1;
1418                 } else {
1419                     return mon_fdset->id;
1420                 }
1421             }
1422         }
1423     }
1424
1425     return -1;
1426 }
1427
1428 int64_t monitor_fdset_dup_fd_find(int dup_fd)
1429 {
1430     return monitor_fdset_dup_fd_find_remove(dup_fd, false);
1431 }
1432
1433 void monitor_fdset_dup_fd_remove(int dup_fd)
1434 {
1435     monitor_fdset_dup_fd_find_remove(dup_fd, true);
1436 }
1437
1438 int monitor_fd_param(Monitor *mon, const char *fdname, Error **errp)
1439 {
1440     int fd;
1441     Error *local_err = NULL;
1442
1443     if (!qemu_isdigit(fdname[0]) && mon) {
1444         fd = monitor_get_fd(mon, fdname, &local_err);
1445     } else {
1446         fd = qemu_parse_fd(fdname);
1447         if (fd == -1) {
1448             error_setg(&local_err, "Invalid file descriptor number '%s'",
1449                        fdname);
1450         }
1451     }
1452     if (local_err) {
1453         error_propagate(errp, local_err);
1454         assert(fd == -1);
1455     } else {
1456         assert(fd != -1);
1457     }
1458
1459     return fd;
1460 }
1461
1462 /* Please update hmp-commands.hx when adding or changing commands */
1463 static HMPCommand hmp_info_cmds[] = {
1464 #include "hmp-commands-info.h"
1465     { NULL, NULL, },
1466 };
1467
1468 /* hmp_cmds and hmp_info_cmds would be sorted at runtime */
1469 HMPCommand hmp_cmds[] = {
1470 #include "hmp-commands.h"
1471     { NULL, NULL, },
1472 };
1473
1474 /*
1475  * Set @pval to the value in the register identified by @name.
1476  * return 0 if OK, -1 if not found
1477  */
1478 int get_monitor_def(Monitor *mon, int64_t *pval, const char *name)
1479 {
1480     const MonitorDef *md = target_monitor_defs();
1481     CPUState *cs = mon_get_cpu(mon);
1482     void *ptr;
1483     uint64_t tmp = 0;
1484     int ret;
1485
1486     if (cs == NULL || md == NULL) {
1487         return -1;
1488     }
1489
1490     for(; md->name != NULL; md++) {
1491         if (hmp_compare_cmd(name, md->name)) {
1492             if (md->get_value) {
1493                 *pval = md->get_value(mon, md, md->offset);
1494             } else {
1495                 CPUArchState *env = mon_get_cpu_env(mon);
1496                 ptr = (uint8_t *)env + md->offset;
1497                 switch(md->type) {
1498                 case MD_I32:
1499                     *pval = *(int32_t *)ptr;
1500                     break;
1501                 case MD_TLONG:
1502                     *pval = *(target_long *)ptr;
1503                     break;
1504                 default:
1505                     *pval = 0;
1506                     break;
1507                 }
1508             }
1509             return 0;
1510         }
1511     }
1512
1513     ret = target_get_monitor_def(cs, name, &tmp);
1514     if (!ret) {
1515         *pval = (target_long) tmp;
1516     }
1517
1518     return ret;
1519 }
1520
1521 static void add_completion_option(ReadLineState *rs, const char *str,
1522                                   const char *option)
1523 {
1524     if (!str || !option) {
1525         return;
1526     }
1527     if (!strncmp(option, str, strlen(str))) {
1528         readline_add_completion(rs, option);
1529     }
1530 }
1531
1532 void chardev_add_completion(ReadLineState *rs, int nb_args, const char *str)
1533 {
1534     size_t len;
1535     ChardevBackendInfoList *list, *start;
1536
1537     if (nb_args != 2) {
1538         return;
1539     }
1540     len = strlen(str);
1541     readline_set_completion_index(rs, len);
1542
1543     start = list = qmp_query_chardev_backends(NULL);
1544     while (list) {
1545         const char *chr_name = list->value->name;
1546
1547         if (!strncmp(chr_name, str, len)) {
1548             readline_add_completion(rs, chr_name);
1549         }
1550         list = list->next;
1551     }
1552     qapi_free_ChardevBackendInfoList(start);
1553 }
1554
1555 void netdev_add_completion(ReadLineState *rs, int nb_args, const char *str)
1556 {
1557     size_t len;
1558     int i;
1559
1560     if (nb_args != 2) {
1561         return;
1562     }
1563     len = strlen(str);
1564     readline_set_completion_index(rs, len);
1565     for (i = 0; i < NET_CLIENT_DRIVER__MAX; i++) {
1566         add_completion_option(rs, str, NetClientDriver_str(i));
1567     }
1568 }
1569
1570 void device_add_completion(ReadLineState *rs, int nb_args, const char *str)
1571 {
1572     GSList *list, *elt;
1573     size_t len;
1574
1575     if (nb_args != 2) {
1576         return;
1577     }
1578
1579     len = strlen(str);
1580     readline_set_completion_index(rs, len);
1581     list = elt = object_class_get_list(TYPE_DEVICE, false);
1582     while (elt) {
1583         const char *name;
1584         DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, elt->data,
1585                                              TYPE_DEVICE);
1586         name = object_class_get_name(OBJECT_CLASS(dc));
1587
1588         if (dc->user_creatable
1589             && !strncmp(name, str, len)) {
1590             readline_add_completion(rs, name);
1591         }
1592         elt = elt->next;
1593     }
1594     g_slist_free(list);
1595 }
1596
1597 void object_add_completion(ReadLineState *rs, int nb_args, const char *str)
1598 {
1599     GSList *list, *elt;
1600     size_t len;
1601
1602     if (nb_args != 2) {
1603         return;
1604     }
1605
1606     len = strlen(str);
1607     readline_set_completion_index(rs, len);
1608     list = elt = object_class_get_list(TYPE_USER_CREATABLE, false);
1609     while (elt) {
1610         const char *name;
1611
1612         name = object_class_get_name(OBJECT_CLASS(elt->data));
1613         if (!strncmp(name, str, len) && strcmp(name, TYPE_USER_CREATABLE)) {
1614             readline_add_completion(rs, name);
1615         }
1616         elt = elt->next;
1617     }
1618     g_slist_free(list);
1619 }
1620
1621 static int qdev_add_hotpluggable_device(Object *obj, void *opaque)
1622 {
1623     GSList **list = opaque;
1624     DeviceState *dev = (DeviceState *)object_dynamic_cast(obj, TYPE_DEVICE);
1625
1626     if (dev == NULL) {
1627         return 0;
1628     }
1629
1630     if (dev->realized && object_property_get_bool(obj, "hotpluggable", NULL)) {
1631         *list = g_slist_append(*list, dev);
1632     }
1633
1634     return 0;
1635 }
1636
1637 static GSList *qdev_build_hotpluggable_device_list(Object *peripheral)
1638 {
1639     GSList *list = NULL;
1640
1641     object_child_foreach(peripheral, qdev_add_hotpluggable_device, &list);
1642
1643     return list;
1644 }
1645
1646 static void peripheral_device_del_completion(ReadLineState *rs,
1647                                              const char *str, size_t len)
1648 {
1649     Object *peripheral = container_get(qdev_get_machine(), "/peripheral");
1650     GSList *list, *item;
1651
1652     list = qdev_build_hotpluggable_device_list(peripheral);
1653     if (!list) {
1654         return;
1655     }
1656
1657     for (item = list; item; item = g_slist_next(item)) {
1658         DeviceState *dev = item->data;
1659
1660         if (dev->id && !strncmp(str, dev->id, len)) {
1661             readline_add_completion(rs, dev->id);
1662         }
1663     }
1664
1665     g_slist_free(list);
1666 }
1667
1668 void chardev_remove_completion(ReadLineState *rs, int nb_args, const char *str)
1669 {
1670     size_t len;
1671     ChardevInfoList *list, *start;
1672
1673     if (nb_args != 2) {
1674         return;
1675     }
1676     len = strlen(str);
1677     readline_set_completion_index(rs, len);
1678
1679     start = list = qmp_query_chardev(NULL);
1680     while (list) {
1681         ChardevInfo *chr = list->value;
1682
1683         if (!strncmp(chr->label, str, len)) {
1684             readline_add_completion(rs, chr->label);
1685         }
1686         list = list->next;
1687     }
1688     qapi_free_ChardevInfoList(start);
1689 }
1690
1691 static void ringbuf_completion(ReadLineState *rs, const char *str)
1692 {
1693     size_t len;
1694     ChardevInfoList *list, *start;
1695
1696     len = strlen(str);
1697     readline_set_completion_index(rs, len);
1698
1699     start = list = qmp_query_chardev(NULL);
1700     while (list) {
1701         ChardevInfo *chr_info = list->value;
1702
1703         if (!strncmp(chr_info->label, str, len)) {
1704             Chardev *chr = qemu_chr_find(chr_info->label);
1705             if (chr && CHARDEV_IS_RINGBUF(chr)) {
1706                 readline_add_completion(rs, chr_info->label);
1707             }
1708         }
1709         list = list->next;
1710     }
1711     qapi_free_ChardevInfoList(start);
1712 }
1713
1714 void ringbuf_write_completion(ReadLineState *rs, int nb_args, const char *str)
1715 {
1716     if (nb_args != 2) {
1717         return;
1718     }
1719     ringbuf_completion(rs, str);
1720 }
1721
1722 void device_del_completion(ReadLineState *rs, int nb_args, const char *str)
1723 {
1724     size_t len;
1725
1726     if (nb_args != 2) {
1727         return;
1728     }
1729
1730     len = strlen(str);
1731     readline_set_completion_index(rs, len);
1732     peripheral_device_del_completion(rs, str, len);
1733 }
1734
1735 void object_del_completion(ReadLineState *rs, int nb_args, const char *str)
1736 {
1737     ObjectPropertyInfoList *list, *start;
1738     size_t len;
1739
1740     if (nb_args != 2) {
1741         return;
1742     }
1743     len = strlen(str);
1744     readline_set_completion_index(rs, len);
1745
1746     start = list = qmp_qom_list("/objects", NULL);
1747     while (list) {
1748         ObjectPropertyInfo *info = list->value;
1749
1750         if (!strncmp(info->type, "child<", 5)
1751             && !strncmp(info->name, str, len)) {
1752             readline_add_completion(rs, info->name);
1753         }
1754         list = list->next;
1755     }
1756     qapi_free_ObjectPropertyInfoList(start);
1757 }
1758
1759 void sendkey_completion(ReadLineState *rs, int nb_args, const char *str)
1760 {
1761     int i;
1762     char *sep;
1763     size_t len;
1764
1765     if (nb_args != 2) {
1766         return;
1767     }
1768     sep = strrchr(str, '-');
1769     if (sep) {
1770         str = sep + 1;
1771     }
1772     len = strlen(str);
1773     readline_set_completion_index(rs, len);
1774     for (i = 0; i < Q_KEY_CODE__MAX; i++) {
1775         if (!strncmp(str, QKeyCode_str(i), len)) {
1776             readline_add_completion(rs, QKeyCode_str(i));
1777         }
1778     }
1779 }
1780
1781 void set_link_completion(ReadLineState *rs, int nb_args, const char *str)
1782 {
1783     size_t len;
1784
1785     len = strlen(str);
1786     readline_set_completion_index(rs, len);
1787     if (nb_args == 2) {
1788         NetClientState *ncs[MAX_QUEUE_NUM];
1789         int count, i;
1790         count = qemu_find_net_clients_except(NULL, ncs,
1791                                              NET_CLIENT_DRIVER_NONE,
1792                                              MAX_QUEUE_NUM);
1793         for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
1794             const char *name = ncs[i]->name;
1795             if (!strncmp(str, name, len)) {
1796                 readline_add_completion(rs, name);
1797             }
1798         }
1799     } else if (nb_args == 3) {
1800         add_completion_option(rs, str, "on");
1801         add_completion_option(rs, str, "off");
1802     }
1803 }
1804
1805 void netdev_del_completion(ReadLineState *rs, int nb_args, const char *str)
1806 {
1807     int len, count, i;
1808     NetClientState *ncs[MAX_QUEUE_NUM];
1809
1810     if (nb_args != 2) {
1811         return;
1812     }
1813
1814     len = strlen(str);
1815     readline_set_completion_index(rs, len);
1816     count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_DRIVER_NIC,
1817                                          MAX_QUEUE_NUM);
1818     for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
1819         const char *name = ncs[i]->name;
1820         if (strncmp(str, name, len)) {
1821             continue;
1822         }
1823         if (ncs[i]->is_netdev) {
1824             readline_add_completion(rs, name);
1825         }
1826     }
1827 }
1828
1829 void info_trace_events_completion(ReadLineState *rs, int nb_args, const char *str)
1830 {
1831     size_t len;
1832
1833     len = strlen(str);
1834     readline_set_completion_index(rs, len);
1835     if (nb_args == 2) {
1836         TraceEventIter iter;
1837         TraceEvent *ev;
1838         char *pattern = g_strdup_printf("%s*", str);
1839         trace_event_iter_init(&iter, pattern);
1840         while ((ev = trace_event_iter_next(&iter)) != NULL) {
1841             readline_add_completion(rs, trace_event_get_name(ev));
1842         }
1843         g_free(pattern);
1844     }
1845 }
1846
1847 void trace_event_completion(ReadLineState *rs, int nb_args, const char *str)
1848 {
1849     size_t len;
1850
1851     len = strlen(str);
1852     readline_set_completion_index(rs, len);
1853     if (nb_args == 2) {
1854         TraceEventIter iter;
1855         TraceEvent *ev;
1856         char *pattern = g_strdup_printf("%s*", str);
1857         trace_event_iter_init(&iter, pattern);
1858         while ((ev = trace_event_iter_next(&iter)) != NULL) {
1859             readline_add_completion(rs, trace_event_get_name(ev));
1860         }
1861         g_free(pattern);
1862     } else if (nb_args == 3) {
1863         add_completion_option(rs, str, "on");
1864         add_completion_option(rs, str, "off");
1865     }
1866 }
1867
1868 void watchdog_action_completion(ReadLineState *rs, int nb_args, const char *str)
1869 {
1870     int i;
1871
1872     if (nb_args != 2) {
1873         return;
1874     }
1875     readline_set_completion_index(rs, strlen(str));
1876     for (i = 0; i < WATCHDOG_ACTION__MAX; i++) {
1877         add_completion_option(rs, str, WatchdogAction_str(i));
1878     }
1879 }
1880
1881 void migrate_set_capability_completion(ReadLineState *rs, int nb_args,
1882                                        const char *str)
1883 {
1884     size_t len;
1885
1886     len = strlen(str);
1887     readline_set_completion_index(rs, len);
1888     if (nb_args == 2) {
1889         int i;
1890         for (i = 0; i < MIGRATION_CAPABILITY__MAX; i++) {
1891             const char *name = MigrationCapability_str(i);
1892             if (!strncmp(str, name, len)) {
1893                 readline_add_completion(rs, name);
1894             }
1895         }
1896     } else if (nb_args == 3) {
1897         add_completion_option(rs, str, "on");
1898         add_completion_option(rs, str, "off");
1899     }
1900 }
1901
1902 void migrate_set_parameter_completion(ReadLineState *rs, int nb_args,
1903                                       const char *str)
1904 {
1905     size_t len;
1906
1907     len = strlen(str);
1908     readline_set_completion_index(rs, len);
1909     if (nb_args == 2) {
1910         int i;
1911         for (i = 0; i < MIGRATION_PARAMETER__MAX; i++) {
1912             const char *name = MigrationParameter_str(i);
1913             if (!strncmp(str, name, len)) {
1914                 readline_add_completion(rs, name);
1915             }
1916         }
1917     }
1918 }
1919
1920 static void vm_completion(ReadLineState *rs, const char *str)
1921 {
1922     size_t len;
1923     BlockDriverState *bs;
1924     BdrvNextIterator it;
1925
1926     len = strlen(str);
1927     readline_set_completion_index(rs, len);
1928
1929     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
1930         SnapshotInfoList *snapshots, *snapshot;
1931         AioContext *ctx = bdrv_get_aio_context(bs);
1932         bool ok = false;
1933
1934         aio_context_acquire(ctx);
1935         if (bdrv_can_snapshot(bs)) {
1936             ok = bdrv_query_snapshot_info_list(bs, &snapshots, NULL) == 0;
1937         }
1938         aio_context_release(ctx);
1939         if (!ok) {
1940             continue;
1941         }
1942
1943         snapshot = snapshots;
1944         while (snapshot) {
1945             char *completion = snapshot->value->name;
1946             if (!strncmp(str, completion, len)) {
1947                 readline_add_completion(rs, completion);
1948             }
1949             completion = snapshot->value->id;
1950             if (!strncmp(str, completion, len)) {
1951                 readline_add_completion(rs, completion);
1952             }
1953             snapshot = snapshot->next;
1954         }
1955         qapi_free_SnapshotInfoList(snapshots);
1956     }
1957
1958 }
1959
1960 void delvm_completion(ReadLineState *rs, int nb_args, const char *str)
1961 {
1962     if (nb_args == 2) {
1963         vm_completion(rs, str);
1964     }
1965 }
1966
1967 void loadvm_completion(ReadLineState *rs, int nb_args, const char *str)
1968 {
1969     if (nb_args == 2) {
1970         vm_completion(rs, str);
1971     }
1972 }
1973
1974 static int
1975 compare_mon_cmd(const void *a, const void *b)
1976 {
1977     return strcmp(((const HMPCommand *)a)->name,
1978             ((const HMPCommand *)b)->name);
1979 }
1980
1981 static void sortcmdlist(void)
1982 {
1983     qsort(hmp_cmds, ARRAY_SIZE(hmp_cmds) - 1,
1984           sizeof(*hmp_cmds),
1985           compare_mon_cmd);
1986     qsort(hmp_info_cmds, ARRAY_SIZE(hmp_info_cmds) - 1,
1987           sizeof(*hmp_info_cmds),
1988           compare_mon_cmd);
1989 }
1990
1991 void monitor_init_globals(void)
1992 {
1993     monitor_init_globals_core();
1994     monitor_init_qmp_commands();
1995     sortcmdlist();
1996     qemu_mutex_init(&mon_fdsets_lock);
1997 }