monitor/misc.c

   1 /*
   2  * QEMU monitor
   3  *
   4  * Copyright (c) 2003-2004 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26 #include "monitor-internal.h"
  27 #include "monitor/qdev.h"
  28 #include "hw/usb.h"
  29 #include "hw/pci/pci.h"
  30 #include "sysemu/watchdog.h"
  31 #include "hw/loader.h"
  32 #include "exec/gdbstub.h"
  33 #include "net/net.h"
  34 #include "net/slirp.h"
  35 #include "ui/qemu-spice.h"
  36 #include "qemu/config-file.h"
  37 #include "qemu/ctype.h"
  38 #include "ui/console.h"
  39 #include "ui/input.h"
  40 #include "audio/audio.h"
  41 #include "disas/disas.h"
  42 #include "sysemu/balloon.h"
  43 #include "qemu/timer.h"
  44 #include "sysemu/hw_accel.h"
  45 #include "sysemu/runstate.h"
  46 #include "authz/list.h"
  47 #include "qapi/util.h"
  48 #include "sysemu/blockdev.h"
  49 #include "sysemu/sysemu.h"
  50 #include "sysemu/tcg.h"
  51 #include "sysemu/tpm.h"
  52 #include "qapi/qmp/qdict.h"
  53 #include "qapi/qmp/qerror.h"
  54 #include "qapi/qmp/qstring.h"
  55 #include "qom/object_interfaces.h"
  56 #include "trace/control.h"
  57 #include "monitor/hmp-target.h"
  58 #include "monitor/hmp.h"
  59 #ifdef CONFIG_TRACE_SIMPLE
  60 #include "trace/simple.h"
  61 #endif
  62 #include "exec/memory.h"
  63 #include "exec/exec-all.h"
  64 #include "qemu/option.h"
  65 #include "qemu/thread.h"
  66 #include "block/qapi.h"
  67 #include "block/block-hmp-cmds.h"
  68 #include "qapi/qapi-commands-char.h"
  69 #include "qapi/qapi-commands-control.h"
  70 #include "qapi/qapi-commands-migration.h"
  71 #include "qapi/qapi-commands-misc.h"
  72 #include "qapi/qapi-commands-qom.h"
  73 #include "qapi/qapi-commands-trace.h"
  74 #include "qapi/qapi-init-commands.h"
  75 #include "qapi/error.h"
  76 #include "qapi/qmp-event.h"
  77 #include "sysemu/cpus.h"
  78 #include "qemu/cutils.h"
  79
  80 #if defined(TARGET_S390X)
  81 #include "hw/s390x/storage-keys.h"
  82 #include "hw/s390x/storage-attributes.h"
  83 #endif
  84
  85 /* file descriptors passed via SCM_RIGHTS */
  86 typedef struct mon_fd_t mon_fd_t;
  87 struct mon_fd_t {
  88     char *name;
  89     int fd;
  90     QLIST_ENTRY(mon_fd_t) next;
  91 };
  92
  93 /* file descriptor associated with a file descriptor set */
  94 typedef struct MonFdsetFd MonFdsetFd;
  95 struct MonFdsetFd {
  96     int fd;
  97     bool removed;
  98     char *opaque;
  99     QLIST_ENTRY(MonFdsetFd) next;
 100 };
 101
 102 /* file descriptor set containing fds passed via SCM_RIGHTS */
 103 typedef struct MonFdset MonFdset;
 104 struct MonFdset {
 105     int64_t id;
 106     QLIST_HEAD(, MonFdsetFd) fds;
 107     QLIST_HEAD(, MonFdsetFd) dup_fds;
 108     QLIST_ENTRY(MonFdset) next;
 109 };
 110
 111 /* Protects mon_fdsets */
 112 static QemuMutex mon_fdsets_lock;
 113 static QLIST_HEAD(, MonFdset) mon_fdsets;
 114
 115 static HMPCommand hmp_info_cmds[];
 116
 117 char *qmp_human_monitor_command(const char *command_line, bool has_cpu_index,
 118                                 int64_t cpu_index, Error **errp)
 119 {
 120     char *output = NULL;
 121     MonitorHMP hmp = {};
 122
 123     monitor_data_init(&hmp.common, false, true, false);
 124
 125     if (has_cpu_index) {
 126         int ret = monitor_set_cpu(&hmp.common, cpu_index);
 127         if (ret < 0) {
 128             error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "cpu-index",
 129                        "a CPU number");
 130             goto out;
 131         }
 132     }
 133
 134     handle_hmp_command(&hmp, command_line);
 135
 136     WITH_QEMU_LOCK_GUARD(&hmp.common.mon_lock) {
 137         output = g_strdup(hmp.common.outbuf->str);
 138     }
 139
 140 out:
 141     monitor_data_destroy(&hmp.common);
 142     return output;
 143 }
 144
 145 /**
 146  * Is @name in the '|' separated list of names @list?
 147  */
 148 int hmp_compare_cmd(const char *name, const char *list)
 149 {
 150     const char *p, *pstart;
 151     int len;
 152     len = strlen(name);
 153     p = list;
 154     for (;;) {
 155         pstart = p;
 156         p = qemu_strchrnul(p, '|');
 157         if ((p - pstart) == len && !memcmp(pstart, name, len)) {
 158             return 1;
 159         }
 160         if (*p == '\0') {
 161             break;
 162         }
 163         p++;
 164     }
 165     return 0;
 166 }
 167
 168 static void do_help_cmd(Monitor *mon, const QDict *qdict)
 169 {
 170     help_cmd(mon, qdict_get_try_str(qdict, "name"));
 171 }
 172
 173 static void hmp_trace_event(Monitor *mon, const QDict *qdict)
 174 {
 175     const char *tp_name = qdict_get_str(qdict, "name");
 176     bool new_state = qdict_get_bool(qdict, "option");
 177     bool has_vcpu = qdict_haskey(qdict, "vcpu");
 178     int vcpu = qdict_get_try_int(qdict, "vcpu", 0);
 179     Error *local_err = NULL;
 180
 181     if (vcpu < 0) {
 182         monitor_printf(mon, "argument vcpu must be positive");
 183         return;
 184     }
 185
 186     qmp_trace_event_set_state(tp_name, new_state, true, true, has_vcpu, vcpu, &local_err);
 187     if (local_err) {
 188         error_report_err(local_err);
 189     }
 190 }
 191
 192 #ifdef CONFIG_TRACE_SIMPLE
 193 static void hmp_trace_file(Monitor *mon, const QDict *qdict)
 194 {
 195     const char *op = qdict_get_try_str(qdict, "op");
 196     const char *arg = qdict_get_try_str(qdict, "arg");
 197
 198     if (!op) {
 199         st_print_trace_file_status();
 200     } else if (!strcmp(op, "on")) {
 201         st_set_trace_file_enabled(true);
 202     } else if (!strcmp(op, "off")) {
 203         st_set_trace_file_enabled(false);
 204     } else if (!strcmp(op, "flush")) {
 205         st_flush_trace_buffer();
 206     } else if (!strcmp(op, "set")) {
 207         if (arg) {
 208             st_set_trace_file(arg);
 209         }
 210     } else {
 211         monitor_printf(mon, "unexpected argument \"%s\"\n", op);
 212         help_cmd(mon, "trace-file");
 213     }
 214 }
 215 #endif
 216
 217 static void hmp_info_help(Monitor *mon, const QDict *qdict)
 218 {
 219     help_cmd(mon, "info");
 220 }
 221
 222 static void monitor_init_qmp_commands(void)
 223 {
 224     /*
 225      * Two command lists:
 226      * - qmp_commands contains all QMP commands
 227      * - qmp_cap_negotiation_commands contains just
 228      *   "qmp_capabilities", to enforce capability negotiation
 229      */
 230
 231     qmp_init_marshal(&qmp_commands);
 232
 233     qmp_register_command(&qmp_commands, "device_add",
 234                          qmp_device_add, 0, 0);
 235
 236     QTAILQ_INIT(&qmp_cap_negotiation_commands);
 237     qmp_register_command(&qmp_cap_negotiation_commands, "qmp_capabilities",
 238                          qmp_marshal_qmp_capabilities,
 239                          QCO_ALLOW_PRECONFIG, 0);
 240 }
 241
 242 /* Set the current CPU defined by the user. Callers must hold BQL. */
 243 int monitor_set_cpu(Monitor *mon, int cpu_index)
 244 {
 245     CPUState *cpu;
 246
 247     cpu = qemu_get_cpu(cpu_index);
 248     if (cpu == NULL) {
 249         return -1;
 250     }
 251     g_free(mon->mon_cpu_path);
 252     mon->mon_cpu_path = object_get_canonical_path(OBJECT(cpu));
 253     return 0;
 254 }
 255
 256 /* Callers must hold BQL. */
 257 static CPUState *mon_get_cpu_sync(Monitor *mon, bool synchronize)
 258 {
 259     CPUState *cpu = NULL;
 260
 261     if (mon->mon_cpu_path) {
 262         cpu = (CPUState *) object_resolve_path_type(mon->mon_cpu_path,
 263                                                     TYPE_CPU, NULL);
 264         if (!cpu) {
 265             g_free(mon->mon_cpu_path);
 266             mon->mon_cpu_path = NULL;
 267         }
 268     }
 269     if (!mon->mon_cpu_path) {
 270         if (!first_cpu) {
 271             return NULL;
 272         }
 273         monitor_set_cpu(mon, first_cpu->cpu_index);
 274         cpu = first_cpu;
 275     }
 276     assert(cpu != NULL);
 277     if (synchronize) {
 278         cpu_synchronize_state(cpu);
 279     }
 280     return cpu;
 281 }
 282
 283 CPUState *mon_get_cpu(Monitor *mon)
 284 {
 285     return mon_get_cpu_sync(mon, true);
 286 }
 287
 288 CPUArchState *mon_get_cpu_env(Monitor *mon)
 289 {
 290     CPUState *cs = mon_get_cpu(mon);
 291
 292     return cs ? cs->env_ptr : NULL;
 293 }
 294
 295 int monitor_get_cpu_index(Monitor *mon)
 296 {
 297     CPUState *cs = mon_get_cpu_sync(mon, false);
 298
 299     return cs ? cs->cpu_index : UNASSIGNED_CPU_INDEX;
 300 }
 301
 302 static void hmp_info_registers(Monitor *mon, const QDict *qdict)
 303 {
 304     bool all_cpus = qdict_get_try_bool(qdict, "cpustate_all", false);
 305     CPUState *cs;
 306
 307     if (all_cpus) {
 308         CPU_FOREACH(cs) {
 309             monitor_printf(mon, "\nCPU#%d\n", cs->cpu_index);
 310             cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
 311         }
 312     } else {
 313         cs = mon_get_cpu(mon);
 314
 315         if (!cs) {
 316             monitor_printf(mon, "No CPU available\n");
 317             return;
 318         }
 319
 320         cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
 321     }
 322 }
 323
 324 static void hmp_info_sync_profile(Monitor *mon, const QDict *qdict)
 325 {
 326     int64_t max = qdict_get_try_int(qdict, "max", 10);
 327     bool mean = qdict_get_try_bool(qdict, "mean", false);
 328     bool coalesce = !qdict_get_try_bool(qdict, "no_coalesce", false);
 329     enum QSPSortBy sort_by;
 330
 331     sort_by = mean ? QSP_SORT_BY_AVG_WAIT_TIME : QSP_SORT_BY_TOTAL_WAIT_TIME;
 332     qsp_report(max, sort_by, coalesce);
 333 }
 334
 335 static void hmp_info_history(Monitor *mon, const QDict *qdict)
 336 {
 337     MonitorHMP *hmp_mon = container_of(mon, MonitorHMP, common);
 338     int i;
 339     const char *str;
 340
 341     if (!hmp_mon->rs) {
 342         return;
 343     }
 344     i = 0;
 345     for(;;) {
 346         str = readline_get_history(hmp_mon->rs, i);
 347         if (!str) {
 348             break;
 349         }
 350         monitor_printf(mon, "%d: '%s'\n", i, str);
 351         i++;
 352     }
 353 }
 354
 355 static void hmp_info_trace_events(Monitor *mon, const QDict *qdict)
 356 {
 357     const char *name = qdict_get_try_str(qdict, "name");
 358     bool has_vcpu = qdict_haskey(qdict, "vcpu");
 359     int vcpu = qdict_get_try_int(qdict, "vcpu", 0);
 360     TraceEventInfoList *events;
 361     TraceEventInfoList *elem;
 362     Error *local_err = NULL;
 363
 364     if (name == NULL) {
 365         name = "*";
 366     }
 367     if (vcpu < 0) {
 368         monitor_printf(mon, "argument vcpu must be positive");
 369         return;
 370     }
 371
 372     events = qmp_trace_event_get_state(name, has_vcpu, vcpu, &local_err);
 373     if (local_err) {
 374         error_report_err(local_err);
 375         return;
 376     }
 377
 378     for (elem = events; elem != NULL; elem = elem->next) {
 379         monitor_printf(mon, "%s : state %u\n",
 380                        elem->value->name,
 381                        elem->value->state == TRACE_EVENT_STATE_ENABLED ? 1 : 0);
 382     }
 383     qapi_free_TraceEventInfoList(events);
 384 }
 385
 386 void qmp_client_migrate_info(const char *protocol, const char *hostname,
 387                              bool has_port, int64_t port,
 388                              bool has_tls_port, int64_t tls_port,
 389                              bool has_cert_subject, const char *cert_subject,
 390                              Error **errp)
 391 {
 392     if (strcmp(protocol, "spice") == 0) {
 393         if (!qemu_using_spice(errp)) {
 394             return;
 395         }
 396
 397         if (!has_port && !has_tls_port) {
 398             error_setg(errp, QERR_MISSING_PARAMETER, "port/tls-port");
 399             return;
 400         }
 401
 402         if (qemu_spice.migrate_info(hostname,
 403                                     has_port ? port : -1,
 404                                     has_tls_port ? tls_port : -1,
 405                                     cert_subject)) {
 406             error_setg(errp, "Could not set up display for migration");
 407             return;
 408         }
 409         return;
 410     }
 411
 412     error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "protocol", "'spice'");
 413 }
 414
 415 static void hmp_logfile(Monitor *mon, const QDict *qdict)
 416 {
 417     Error *err = NULL;
 418
 419     qemu_set_log_filename(qdict_get_str(qdict, "filename"), &err);
 420     if (err) {
 421         error_report_err(err);
 422     }
 423 }
 424
 425 static void hmp_log(Monitor *mon, const QDict *qdict)
 426 {
 427     int mask;
 428     const char *items = qdict_get_str(qdict, "items");
 429
 430     if (!strcmp(items, "none")) {
 431         mask = 0;
 432     } else {
 433         mask = qemu_str_to_log_mask(items);
 434         if (!mask) {
 435             help_cmd(mon, "log");
 436             return;
 437         }
 438     }
 439     qemu_set_log(mask);
 440 }
 441
 442 static void hmp_singlestep(Monitor *mon, const QDict *qdict)
 443 {
 444     const char *option = qdict_get_try_str(qdict, "option");
 445     if (!option || !strcmp(option, "on")) {
 446         singlestep = 1;
 447     } else if (!strcmp(option, "off")) {
 448         singlestep = 0;
 449     } else {
 450         monitor_printf(mon, "unexpected option %s\n", option);
 451     }
 452 }
 453
 454 static void hmp_gdbserver(Monitor *mon, const QDict *qdict)
 455 {
 456     const char *device = qdict_get_try_str(qdict, "device");
 457     if (!device) {
 458         device = "tcp::" DEFAULT_GDBSTUB_PORT;
 459     }
 460
 461     if (gdbserver_start(device) < 0) {
 462         monitor_printf(mon, "Could not open gdbserver on device '%s'\n",
 463                        device);
 464     } else if (strcmp(device, "none") == 0) {
 465         monitor_printf(mon, "Disabled gdbserver\n");
 466     } else {
 467         monitor_printf(mon, "Waiting for gdb connection on device '%s'\n",
 468                        device);
 469     }
 470 }
 471
 472 static void hmp_watchdog_action(Monitor *mon, const QDict *qdict)
 473 {
 474     const char *action = qdict_get_str(qdict, "action");
 475     if (select_watchdog_action(action) == -1) {
 476         monitor_printf(mon, "Unknown watchdog action '%s'\n", action);
 477     }
 478 }
 479
 480 static void monitor_printc(Monitor *mon, int c)
 481 {
 482     monitor_printf(mon, "'");
 483     switch(c) {
 484     case '\'':
 485         monitor_printf(mon, "\\'");
 486         break;
 487     case '\\':
 488         monitor_printf(mon, "\\\\");
 489         break;
 490     case '\n':
 491         monitor_printf(mon, "\\n");
 492         break;
 493     case '\r':
 494         monitor_printf(mon, "\\r");
 495         break;
 496     default:
 497         if (c >= 32 && c <= 126) {
 498             monitor_printf(mon, "%c", c);
 499         } else {
 500             monitor_printf(mon, "\\x%02x", c);
 501         }
 502         break;
 503     }
 504     monitor_printf(mon, "'");
 505 }
 506
 507 static void memory_dump(Monitor *mon, int count, int format, int wsize,
 508                         hwaddr addr, int is_physical)
 509 {
 510     int l, line_size, i, max_digits, len;
 511     uint8_t buf[16];
 512     uint64_t v;
 513     CPUState *cs = mon_get_cpu(mon);
 514
 515     if (!cs && (format == 'i' || !is_physical)) {
 516         monitor_printf(mon, "Can not dump without CPU\n");
 517         return;
 518     }
 519
 520     if (format == 'i') {
 521         monitor_disas(mon, cs, addr, count, is_physical);
 522         return;
 523     }
 524
 525     len = wsize * count;
 526     if (wsize == 1) {
 527         line_size = 8;
 528     } else {
 529         line_size = 16;
 530     }
 531     max_digits = 0;
 532
 533     switch(format) {
 534     case 'o':
 535         max_digits = DIV_ROUND_UP(wsize * 8, 3);
 536         break;
 537     default:
 538     case 'x':
 539         max_digits = (wsize * 8) / 4;
 540         break;
 541     case 'u':
 542     case 'd':
 543         max_digits = DIV_ROUND_UP(wsize * 8 * 10, 33);
 544         break;
 545     case 'c':
 546         wsize = 1;
 547         break;
 548     }
 549
 550     while (len > 0) {
 551         if (is_physical) {
 552             monitor_printf(mon, TARGET_FMT_plx ":", addr);
 553         } else {
 554             monitor_printf(mon, TARGET_FMT_lx ":", (target_ulong)addr);
 555         }
 556         l = len;
 557         if (l > line_size)
 558             l = line_size;
 559         if (is_physical) {
 560             AddressSpace *as = cs ? cs->as : &address_space_memory;
 561             MemTxResult r = address_space_read(as, addr,
 562                                                MEMTXATTRS_UNSPECIFIED, buf, l);
 563             if (r != MEMTX_OK) {
 564                 monitor_printf(mon, " Cannot access memory\n");
 565                 break;
 566             }
 567         } else {
 568             if (cpu_memory_rw_debug(cs, addr, buf, l, 0) < 0) {
 569                 monitor_printf(mon, " Cannot access memory\n");
 570                 break;
 571             }
 572         }
 573         i = 0;
 574         while (i < l) {
 575             switch(wsize) {
 576             default:
 577             case 1:
 578                 v = ldub_p(buf + i);
 579                 break;
 580             case 2:
 581                 v = lduw_p(buf + i);
 582                 break;
 583             case 4:
 584                 v = (uint32_t)ldl_p(buf + i);
 585                 break;
 586             case 8:
 587                 v = ldq_p(buf + i);
 588                 break;
 589             }
 590             monitor_printf(mon, " ");
 591             switch(format) {
 592             case 'o':
 593                 monitor_printf(mon, "%#*" PRIo64, max_digits, v);
 594                 break;
 595             case 'x':
 596                 monitor_printf(mon, "0x%0*" PRIx64, max_digits, v);
 597                 break;
 598             case 'u':
 599                 monitor_printf(mon, "%*" PRIu64, max_digits, v);
 600                 break;
 601             case 'd':
 602                 monitor_printf(mon, "%*" PRId64, max_digits, v);
 603                 break;
 604             case 'c':
 605                 monitor_printc(mon, v);
 606                 break;
 607             }
 608             i += wsize;
 609         }
 610         monitor_printf(mon, "\n");
 611         addr += l;
 612         len -= l;
 613     }
 614 }
 615
 616 static void hmp_memory_dump(Monitor *mon, const QDict *qdict)
 617 {
 618     int count = qdict_get_int(qdict, "count");
 619     int format = qdict_get_int(qdict, "format");
 620     int size = qdict_get_int(qdict, "size");
 621     target_long addr = qdict_get_int(qdict, "addr");
 622
 623     memory_dump(mon, count, format, size, addr, 0);
 624 }
 625
 626 static void hmp_physical_memory_dump(Monitor *mon, const QDict *qdict)
 627 {
 628     int count = qdict_get_int(qdict, "count");
 629     int format = qdict_get_int(qdict, "format");
 630     int size = qdict_get_int(qdict, "size");
 631     hwaddr addr = qdict_get_int(qdict, "addr");
 632
 633     memory_dump(mon, count, format, size, addr, 1);
 634 }
 635
 636 void *gpa2hva(MemoryRegion **p_mr, hwaddr addr, uint64_t size, Error **errp)
 637 {
 638     Int128 gpa_region_size;
 639     MemoryRegionSection mrs = memory_region_find(get_system_memory(),
 640                                                  addr, size);
 641
 642     if (!mrs.mr) {
 643         error_setg(errp, "No memory is mapped at address 0x%" HWADDR_PRIx, addr);
 644         return NULL;
 645     }
 646
 647     if (!memory_region_is_ram(mrs.mr) && !memory_region_is_romd(mrs.mr)) {
 648         error_setg(errp, "Memory at address 0x%" HWADDR_PRIx "is not RAM", addr);
 649         memory_region_unref(mrs.mr);
 650         return NULL;
 651     }
 652
 653     gpa_region_size = int128_make64(size);
 654     if (int128_lt(mrs.size, gpa_region_size)) {
 655         error_setg(errp, "Size of memory region at 0x%" HWADDR_PRIx
 656                    " exceeded.", addr);
 657         memory_region_unref(mrs.mr);
 658         return NULL;
 659     }
 660
 661     *p_mr = mrs.mr;
 662     return qemu_map_ram_ptr(mrs.mr->ram_block, mrs.offset_within_region);
 663 }
 664
 665 static void hmp_gpa2hva(Monitor *mon, const QDict *qdict)
 666 {
 667     hwaddr addr = qdict_get_int(qdict, "addr");
 668     Error *local_err = NULL;
 669     MemoryRegion *mr = NULL;
 670     void *ptr;
 671
 672     ptr = gpa2hva(&mr, addr, 1, &local_err);
 673     if (local_err) {
 674         error_report_err(local_err);
 675         return;
 676     }
 677
 678     monitor_printf(mon, "Host virtual address for 0x%" HWADDR_PRIx
 679                    " (%s) is %p\n",
 680                    addr, mr->name, ptr);
 681
 682     memory_region_unref(mr);
 683 }
 684
 685 static void hmp_gva2gpa(Monitor *mon, const QDict *qdict)
 686 {
 687     target_ulong addr = qdict_get_int(qdict, "addr");
 688     MemTxAttrs attrs;
 689     CPUState *cs = mon_get_cpu(mon);
 690     hwaddr gpa;
 691
 692     if (!cs) {
 693         monitor_printf(mon, "No cpu\n");
 694         return;
 695     }
 696
 697     gpa  = cpu_get_phys_page_attrs_debug(cs, addr & TARGET_PAGE_MASK, &attrs);
 698     if (gpa == -1) {
 699         monitor_printf(mon, "Unmapped\n");
 700     } else {
 701         monitor_printf(mon, "gpa: %#" HWADDR_PRIx "\n",
 702                        gpa + (addr & ~TARGET_PAGE_MASK));
 703     }
 704 }
 705
 706 #ifdef CONFIG_LINUX
 707 static uint64_t vtop(void *ptr, Error **errp)
 708 {
 709     uint64_t pinfo;
 710     uint64_t ret = -1;
 711     uintptr_t addr = (uintptr_t) ptr;
 712     uintptr_t pagesize = qemu_real_host_page_size;
 713     off_t offset = addr / pagesize * sizeof(pinfo);
 714     int fd;
 715
 716     fd = open("/proc/self/pagemap", O_RDONLY);
 717     if (fd == -1) {
 718         error_setg_errno(errp, errno, "Cannot open /proc/self/pagemap");
 719         return -1;
 720     }
 721
 722     /* Force copy-on-write if necessary.  */
 723     qatomic_add((uint8_t *)ptr, 0);
 724
 725     if (pread(fd, &pinfo, sizeof(pinfo), offset) != sizeof(pinfo)) {
 726         error_setg_errno(errp, errno, "Cannot read pagemap");
 727         goto out;
 728     }
 729     if ((pinfo & (1ull << 63)) == 0) {
 730         error_setg(errp, "Page not present");
 731         goto out;
 732     }
 733     ret = ((pinfo & 0x007fffffffffffffull) * pagesize) | (addr & (pagesize - 1));
 734
 735 out:
 736     close(fd);
 737     return ret;
 738 }
 739
 740 static void hmp_gpa2hpa(Monitor *mon, const QDict *qdict)
 741 {
 742     hwaddr addr = qdict_get_int(qdict, "addr");
 743     Error *local_err = NULL;
 744     MemoryRegion *mr = NULL;
 745     void *ptr;
 746     uint64_t physaddr;
 747
 748     ptr = gpa2hva(&mr, addr, 1, &local_err);
 749     if (local_err) {
 750         error_report_err(local_err);
 751         return;
 752     }
 753
 754     physaddr = vtop(ptr, &local_err);
 755     if (local_err) {
 756         error_report_err(local_err);
 757     } else {
 758         monitor_printf(mon, "Host physical address for 0x%" HWADDR_PRIx
 759                        " (%s) is 0x%" PRIx64 "\n",
 760                        addr, mr->name, (uint64_t) physaddr);
 761     }
 762
 763     memory_region_unref(mr);
 764 }
 765 #endif
 766
 767 static void do_print(Monitor *mon, const QDict *qdict)
 768 {
 769     int format = qdict_get_int(qdict, "format");
 770     hwaddr val = qdict_get_int(qdict, "val");
 771
 772     switch(format) {
 773     case 'o':
 774         monitor_printf(mon, "%#" HWADDR_PRIo, val);
 775         break;
 776     case 'x':
 777         monitor_printf(mon, "%#" HWADDR_PRIx, val);
 778         break;
 779     case 'u':
 780         monitor_printf(mon, "%" HWADDR_PRIu, val);
 781         break;
 782     default:
 783     case 'd':
 784         monitor_printf(mon, "%" HWADDR_PRId, val);
 785         break;
 786     case 'c':
 787         monitor_printc(mon, val);
 788         break;
 789     }
 790     monitor_printf(mon, "\n");
 791 }
 792
 793 static void hmp_sum(Monitor *mon, const QDict *qdict)
 794 {
 795     uint32_t addr;
 796     uint16_t sum;
 797     uint32_t start = qdict_get_int(qdict, "start");
 798     uint32_t size = qdict_get_int(qdict, "size");
 799
 800     sum = 0;
 801     for(addr = start; addr < (start + size); addr++) {
 802         uint8_t val = address_space_ldub(&address_space_memory, addr,
 803                                          MEMTXATTRS_UNSPECIFIED, NULL);
 804         /* BSD sum algorithm ('sum' Unix command) */
 805         sum = (sum >> 1) | (sum << 15);
 806         sum += val;
 807     }
 808     monitor_printf(mon, "%05d\n", sum);
 809 }
 810
 811 static int mouse_button_state;
 812
 813 static void hmp_mouse_move(Monitor *mon, const QDict *qdict)
 814 {
 815     int dx, dy, dz, button;
 816     const char *dx_str = qdict_get_str(qdict, "dx_str");
 817     const char *dy_str = qdict_get_str(qdict, "dy_str");
 818     const char *dz_str = qdict_get_try_str(qdict, "dz_str");
 819
 820     dx = strtol(dx_str, NULL, 0);
 821     dy = strtol(dy_str, NULL, 0);
 822     qemu_input_queue_rel(NULL, INPUT_AXIS_X, dx);
 823     qemu_input_queue_rel(NULL, INPUT_AXIS_Y, dy);
 824
 825     if (dz_str) {
 826         dz = strtol(dz_str, NULL, 0);
 827         if (dz != 0) {
 828             button = (dz > 0) ? INPUT_BUTTON_WHEEL_UP : INPUT_BUTTON_WHEEL_DOWN;
 829             qemu_input_queue_btn(NULL, button, true);
 830             qemu_input_event_sync();
 831             qemu_input_queue_btn(NULL, button, false);
 832         }
 833     }
 834     qemu_input_event_sync();
 835 }
 836
 837 static void hmp_mouse_button(Monitor *mon, const QDict *qdict)
 838 {
 839     static uint32_t bmap[INPUT_BUTTON__MAX] = {
 840         [INPUT_BUTTON_LEFT]       = MOUSE_EVENT_LBUTTON,
 841         [INPUT_BUTTON_MIDDLE]     = MOUSE_EVENT_MBUTTON,
 842         [INPUT_BUTTON_RIGHT]      = MOUSE_EVENT_RBUTTON,
 843     };
 844     int button_state = qdict_get_int(qdict, "button_state");
 845
 846     if (mouse_button_state == button_state) {
 847         return;
 848     }
 849     qemu_input_update_buttons(NULL, bmap, mouse_button_state, button_state);
 850     qemu_input_event_sync();
 851     mouse_button_state = button_state;
 852 }
 853
 854 static void hmp_ioport_read(Monitor *mon, const QDict *qdict)
 855 {
 856     int size = qdict_get_int(qdict, "size");
 857     int addr = qdict_get_int(qdict, "addr");
 858     int has_index = qdict_haskey(qdict, "index");
 859     uint32_t val;
 860     int suffix;
 861
 862     if (has_index) {
 863         int index = qdict_get_int(qdict, "index");
 864         cpu_outb(addr & IOPORTS_MASK, index & 0xff);
 865         addr++;
 866     }
 867     addr &= 0xffff;
 868
 869     switch(size) {
 870     default:
 871     case 1:
 872         val = cpu_inb(addr);
 873         suffix = 'b';
 874         break;
 875     case 2:
 876         val = cpu_inw(addr);
 877         suffix = 'w';
 878         break;
 879     case 4:
 880         val = cpu_inl(addr);
 881         suffix = 'l';
 882         break;
 883     }
 884     monitor_printf(mon, "port%c[0x%04x] = 0x%0*x\n",
 885                    suffix, addr, size * 2, val);
 886 }
 887
 888 static void hmp_ioport_write(Monitor *mon, const QDict *qdict)
 889 {
 890     int size = qdict_get_int(qdict, "size");
 891     int addr = qdict_get_int(qdict, "addr");
 892     int val = qdict_get_int(qdict, "val");
 893
 894     addr &= IOPORTS_MASK;
 895
 896     switch (size) {
 897     default:
 898     case 1:
 899         cpu_outb(addr, val);
 900         break;
 901     case 2:
 902         cpu_outw(addr, val);
 903         break;
 904     case 4:
 905         cpu_outl(addr, val);
 906         break;
 907     }
 908 }
 909
 910 static void hmp_boot_set(Monitor *mon, const QDict *qdict)
 911 {
 912     Error *local_err = NULL;
 913     const char *bootdevice = qdict_get_str(qdict, "bootdevice");
 914
 915     qemu_boot_set(bootdevice, &local_err);
 916     if (local_err) {
 917         error_report_err(local_err);
 918     } else {
 919         monitor_printf(mon, "boot device list now set to %s\n", bootdevice);
 920     }
 921 }
 922
 923 static void hmp_info_mtree(Monitor *mon, const QDict *qdict)
 924 {
 925     bool flatview = qdict_get_try_bool(qdict, "flatview", false);
 926     bool dispatch_tree = qdict_get_try_bool(qdict, "dispatch_tree", false);
 927     bool owner = qdict_get_try_bool(qdict, "owner", false);
 928     bool disabled = qdict_get_try_bool(qdict, "disabled", false);
 929
 930     mtree_info(flatview, dispatch_tree, owner, disabled);
 931 }
 932
 933 #ifdef CONFIG_PROFILER
 934
 935 int64_t dev_time;
 936
 937 static void hmp_info_profile(Monitor *mon, const QDict *qdict)
 938 {
 939     static int64_t last_cpu_exec_time;
 940     int64_t cpu_exec_time;
 941     int64_t delta;
 942
 943     cpu_exec_time = tcg_cpu_exec_time();
 944     delta = cpu_exec_time - last_cpu_exec_time;
 945
 946     monitor_printf(mon, "async time  %" PRId64 " (%0.3f)\n",
 947                    dev_time, dev_time / (double)NANOSECONDS_PER_SECOND);
 948     monitor_printf(mon, "qemu time   %" PRId64 " (%0.3f)\n",
 949                    delta, delta / (double)NANOSECONDS_PER_SECOND);
 950     last_cpu_exec_time = cpu_exec_time;
 951     dev_time = 0;
 952 }
 953 #else
 954 static void hmp_info_profile(Monitor *mon, const QDict *qdict)
 955 {
 956     monitor_printf(mon, "Internal profiler not compiled\n");
 957 }
 958 #endif
 959
 960 /* Capture support */
 961 static QLIST_HEAD (capture_list_head, CaptureState) capture_head;
 962
 963 static void hmp_info_capture(Monitor *mon, const QDict *qdict)
 964 {
 965     int i;
 966     CaptureState *s;
 967
 968     for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) {
 969         monitor_printf(mon, "[%d]: ", i);
 970         s->ops.info (s->opaque);
 971     }
 972 }
 973
 974 static void hmp_stopcapture(Monitor *mon, const QDict *qdict)
 975 {
 976     int i;
 977     int n = qdict_get_int(qdict, "n");
 978     CaptureState *s;
 979
 980     for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) {
 981         if (i == n) {
 982             s->ops.destroy (s->opaque);
 983             QLIST_REMOVE (s, entries);
 984             g_free (s);
 985             return;
 986         }
 987     }
 988 }
 989
 990 static void hmp_wavcapture(Monitor *mon, const QDict *qdict)
 991 {
 992     const char *path = qdict_get_str(qdict, "path");
 993     int freq = qdict_get_try_int(qdict, "freq", 44100);
 994     int bits = qdict_get_try_int(qdict, "bits", 16);
 995     int nchannels = qdict_get_try_int(qdict, "nchannels", 2);
 996     const char *audiodev = qdict_get_str(qdict, "audiodev");
 997     CaptureState *s;
 998     AudioState *as = audio_state_by_name(audiodev);
 999
1000     if (!as) {
1001         monitor_printf(mon, "Audiodev '%s' not found\n", audiodev);
1002         return;
1003     }
1004
1005     s = g_malloc0 (sizeof (*s));
1006
1007     if (wav_start_capture(as, s, path, freq, bits, nchannels)) {
1008         monitor_printf(mon, "Failed to add wave capture\n");
1009         g_free (s);
1010         return;
1011     }
1012     QLIST_INSERT_HEAD (&capture_head, s, entries);
1013 }
1014
1015 void qmp_getfd(const char *fdname, Error **errp)
1016 {
1017     Monitor *cur_mon = monitor_cur();
1018     mon_fd_t *monfd;
1019     int fd, tmp_fd;
1020
1021     fd = qemu_chr_fe_get_msgfd(&cur_mon->chr);
1022     if (fd == -1) {
1023         error_setg(errp, "No file descriptor supplied via SCM_RIGHTS");
1024         return;
1025     }
1026
1027     if (qemu_isdigit(fdname[0])) {
1028         close(fd);
1029         error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "fdname",
1030                    "a name not starting with a digit");
1031         return;
1032     }
1033
1034     QEMU_LOCK_GUARD(&cur_mon->mon_lock);
1035     QLIST_FOREACH(monfd, &cur_mon->fds, next) {
1036         if (strcmp(monfd->name, fdname) != 0) {
1037             continue;
1038         }
1039
1040         tmp_fd = monfd->fd;
1041         monfd->fd = fd;
1042         /* Make sure close() is outside critical section */
1043         close(tmp_fd);
1044         return;
1045     }
1046
1047     monfd = g_malloc0(sizeof(mon_fd_t));
1048     monfd->name = g_strdup(fdname);
1049     monfd->fd = fd;
1050
1051     QLIST_INSERT_HEAD(&cur_mon->fds, monfd, next);
1052 }
1053
1054 void qmp_closefd(const char *fdname, Error **errp)
1055 {
1056     Monitor *cur_mon = monitor_cur();
1057     mon_fd_t *monfd;
1058     int tmp_fd;
1059
1060     qemu_mutex_lock(&cur_mon->mon_lock);
1061     QLIST_FOREACH(monfd, &cur_mon->fds, next) {
1062         if (strcmp(monfd->name, fdname) != 0) {
1063             continue;
1064         }
1065
1066         QLIST_REMOVE(monfd, next);
1067         tmp_fd = monfd->fd;
1068         g_free(monfd->name);
1069         g_free(monfd);
1070         qemu_mutex_unlock(&cur_mon->mon_lock);
1071         /* Make sure close() is outside critical section */
1072         close(tmp_fd);
1073         return;
1074     }
1075
1076     qemu_mutex_unlock(&cur_mon->mon_lock);
1077     error_setg(errp, "File descriptor named '%s' not found", fdname);
1078 }
1079
1080 int monitor_get_fd(Monitor *mon, const char *fdname, Error **errp)
1081 {
1082     mon_fd_t *monfd;
1083
1084     QEMU_LOCK_GUARD(&mon->mon_lock);
1085     QLIST_FOREACH(monfd, &mon->fds, next) {
1086         int fd;
1087
1088         if (strcmp(monfd->name, fdname) != 0) {
1089             continue;
1090         }
1091
1092         fd = monfd->fd;
1093
1094         /* caller takes ownership of fd */
1095         QLIST_REMOVE(monfd, next);
1096         g_free(monfd->name);
1097         g_free(monfd);
1098
1099         return fd;
1100     }
1101
1102     error_setg(errp, "File descriptor named '%s' has not been found", fdname);
1103     return -1;
1104 }
1105
1106 static void monitor_fdset_cleanup(MonFdset *mon_fdset)
1107 {
1108     MonFdsetFd *mon_fdset_fd;
1109     MonFdsetFd *mon_fdset_fd_next;
1110
1111     QLIST_FOREACH_SAFE(mon_fdset_fd, &mon_fdset->fds, next, mon_fdset_fd_next) {
1112         if ((mon_fdset_fd->removed ||
1113                 (QLIST_EMPTY(&mon_fdset->dup_fds) && mon_refcount == 0)) &&
1114                 runstate_is_running()) {
1115             close(mon_fdset_fd->fd);
1116             g_free(mon_fdset_fd->opaque);
1117             QLIST_REMOVE(mon_fdset_fd, next);
1118             g_free(mon_fdset_fd);
1119         }
1120     }
1121
1122     if (QLIST_EMPTY(&mon_fdset->fds) && QLIST_EMPTY(&mon_fdset->dup_fds)) {
1123         QLIST_REMOVE(mon_fdset, next);
1124         g_free(mon_fdset);
1125     }
1126 }
1127
1128 void monitor_fdsets_cleanup(void)
1129 {
1130     MonFdset *mon_fdset;
1131     MonFdset *mon_fdset_next;
1132
1133     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1134     QLIST_FOREACH_SAFE(mon_fdset, &mon_fdsets, next, mon_fdset_next) {
1135         monitor_fdset_cleanup(mon_fdset);
1136     }
1137 }
1138
1139 AddfdInfo *qmp_add_fd(bool has_fdset_id, int64_t fdset_id, bool has_opaque,
1140                       const char *opaque, Error **errp)
1141 {
1142     int fd;
1143     Monitor *mon = monitor_cur();
1144     AddfdInfo *fdinfo;
1145
1146     fd = qemu_chr_fe_get_msgfd(&mon->chr);
1147     if (fd == -1) {
1148         error_setg(errp, "No file descriptor supplied via SCM_RIGHTS");
1149         goto error;
1150     }
1151
1152     fdinfo = monitor_fdset_add_fd(fd, has_fdset_id, fdset_id,
1153                                   has_opaque, opaque, errp);
1154     if (fdinfo) {
1155         return fdinfo;
1156     }
1157
1158 error:
1159     if (fd != -1) {
1160         close(fd);
1161     }
1162     return NULL;
1163 }
1164
1165 void qmp_remove_fd(int64_t fdset_id, bool has_fd, int64_t fd, Error **errp)
1166 {
1167     MonFdset *mon_fdset;
1168     MonFdsetFd *mon_fdset_fd;
1169     char fd_str[60];
1170
1171     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1172     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1173         if (mon_fdset->id != fdset_id) {
1174             continue;
1175         }
1176         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1177             if (has_fd) {
1178                 if (mon_fdset_fd->fd != fd) {
1179                     continue;
1180                 }
1181                 mon_fdset_fd->removed = true;
1182                 break;
1183             } else {
1184                 mon_fdset_fd->removed = true;
1185             }
1186         }
1187         if (has_fd && !mon_fdset_fd) {
1188             goto error;
1189         }
1190         monitor_fdset_cleanup(mon_fdset);
1191         return;
1192     }
1193
1194 error:
1195     if (has_fd) {
1196         snprintf(fd_str, sizeof(fd_str), "fdset-id:%" PRId64 ", fd:%" PRId64,
1197                  fdset_id, fd);
1198     } else {
1199         snprintf(fd_str, sizeof(fd_str), "fdset-id:%" PRId64, fdset_id);
1200     }
1201     error_setg(errp, "File descriptor named '%s' not found", fd_str);
1202 }
1203
1204 FdsetInfoList *qmp_query_fdsets(Error **errp)
1205 {
1206     MonFdset *mon_fdset;
1207     MonFdsetFd *mon_fdset_fd;
1208     FdsetInfoList *fdset_list = NULL;
1209
1210     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1211     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1212         FdsetInfo *fdset_info = g_malloc0(sizeof(*fdset_info));
1213
1214         fdset_info->fdset_id = mon_fdset->id;
1215
1216         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1217             FdsetFdInfo *fdsetfd_info;
1218
1219             fdsetfd_info = g_malloc0(sizeof(*fdsetfd_info));
1220             fdsetfd_info->fd = mon_fdset_fd->fd;
1221             if (mon_fdset_fd->opaque) {
1222                 fdsetfd_info->has_opaque = true;
1223                 fdsetfd_info->opaque = g_strdup(mon_fdset_fd->opaque);
1224             } else {
1225                 fdsetfd_info->has_opaque = false;
1226             }
1227
1228             QAPI_LIST_PREPEND(fdset_info->fds, fdsetfd_info);
1229         }
1230
1231         QAPI_LIST_PREPEND(fdset_list, fdset_info);
1232     }
1233
1234     return fdset_list;
1235 }
1236
1237 AddfdInfo *monitor_fdset_add_fd(int fd, bool has_fdset_id, int64_t fdset_id,
1238                                 bool has_opaque, const char *opaque,
1239                                 Error **errp)
1240 {
1241     MonFdset *mon_fdset = NULL;
1242     MonFdsetFd *mon_fdset_fd;
1243     AddfdInfo *fdinfo;
1244
1245     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1246     if (has_fdset_id) {
1247         QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1248             /* Break if match found or match impossible due to ordering by ID */
1249             if (fdset_id <= mon_fdset->id) {
1250                 if (fdset_id < mon_fdset->id) {
1251                     mon_fdset = NULL;
1252                 }
1253                 break;
1254             }
1255         }
1256     }
1257
1258     if (mon_fdset == NULL) {
1259         int64_t fdset_id_prev = -1;
1260         MonFdset *mon_fdset_cur = QLIST_FIRST(&mon_fdsets);
1261
1262         if (has_fdset_id) {
1263             if (fdset_id < 0) {
1264                 error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "fdset-id",
1265                            "a non-negative value");
1266                 return NULL;
1267             }
1268             /* Use specified fdset ID */
1269             QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1270                 mon_fdset_cur = mon_fdset;
1271                 if (fdset_id < mon_fdset_cur->id) {
1272                     break;
1273                 }
1274             }
1275         } else {
1276             /* Use first available fdset ID */
1277             QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1278                 mon_fdset_cur = mon_fdset;
1279                 if (fdset_id_prev == mon_fdset_cur->id - 1) {
1280                     fdset_id_prev = mon_fdset_cur->id;
1281                     continue;
1282                 }
1283                 break;
1284             }
1285         }
1286
1287         mon_fdset = g_malloc0(sizeof(*mon_fdset));
1288         if (has_fdset_id) {
1289             mon_fdset->id = fdset_id;
1290         } else {
1291             mon_fdset->id = fdset_id_prev + 1;
1292         }
1293
1294         /* The fdset list is ordered by fdset ID */
1295         if (!mon_fdset_cur) {
1296             QLIST_INSERT_HEAD(&mon_fdsets, mon_fdset, next);
1297         } else if (mon_fdset->id < mon_fdset_cur->id) {
1298             QLIST_INSERT_BEFORE(mon_fdset_cur, mon_fdset, next);
1299         } else {
1300             QLIST_INSERT_AFTER(mon_fdset_cur, mon_fdset, next);
1301         }
1302     }
1303
1304     mon_fdset_fd = g_malloc0(sizeof(*mon_fdset_fd));
1305     mon_fdset_fd->fd = fd;
1306     mon_fdset_fd->removed = false;
1307     if (has_opaque) {
1308         mon_fdset_fd->opaque = g_strdup(opaque);
1309     }
1310     QLIST_INSERT_HEAD(&mon_fdset->fds, mon_fdset_fd, next);
1311
1312     fdinfo = g_malloc0(sizeof(*fdinfo));
1313     fdinfo->fdset_id = mon_fdset->id;
1314     fdinfo->fd = mon_fdset_fd->fd;
1315
1316     return fdinfo;
1317 }
1318
1319 int monitor_fdset_dup_fd_add(int64_t fdset_id, int flags)
1320 {
1321 #ifdef _WIN32
1322     return -ENOENT;
1323 #else
1324     MonFdset *mon_fdset;
1325
1326     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1327     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1328         MonFdsetFd *mon_fdset_fd;
1329         MonFdsetFd *mon_fdset_fd_dup;
1330         int fd = -1;
1331         int dup_fd;
1332         int mon_fd_flags;
1333
1334         if (mon_fdset->id != fdset_id) {
1335             continue;
1336         }
1337
1338         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1339             mon_fd_flags = fcntl(mon_fdset_fd->fd, F_GETFL);
1340             if (mon_fd_flags == -1) {
1341                 return -1;
1342             }
1343
1344             if ((flags & O_ACCMODE) == (mon_fd_flags & O_ACCMODE)) {
1345                 fd = mon_fdset_fd->fd;
1346                 break;
1347             }
1348         }
1349
1350         if (fd == -1) {
1351             errno = EACCES;
1352             return -1;
1353         }
1354
1355         dup_fd = qemu_dup_flags(fd, flags);
1356         if (dup_fd == -1) {
1357             return -1;
1358         }
1359
1360         mon_fdset_fd_dup = g_malloc0(sizeof(*mon_fdset_fd_dup));
1361         mon_fdset_fd_dup->fd = dup_fd;
1362         QLIST_INSERT_HEAD(&mon_fdset->dup_fds, mon_fdset_fd_dup, next);
1363         return dup_fd;
1364     }
1365
1366     errno = ENOENT;
1367     return -1;
1368 #endif
1369 }
1370
1371 static int64_t monitor_fdset_dup_fd_find_remove(int dup_fd, bool remove)
1372 {
1373     MonFdset *mon_fdset;
1374     MonFdsetFd *mon_fdset_fd_dup;
1375
1376     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1377     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1378         QLIST_FOREACH(mon_fdset_fd_dup, &mon_fdset->dup_fds, next) {
1379             if (mon_fdset_fd_dup->fd == dup_fd) {
1380                 if (remove) {
1381                     QLIST_REMOVE(mon_fdset_fd_dup, next);
1382                     g_free(mon_fdset_fd_dup);
1383                     if (QLIST_EMPTY(&mon_fdset->dup_fds)) {
1384                         monitor_fdset_cleanup(mon_fdset);
1385                     }
1386                     return -1;
1387                 } else {
1388                     return mon_fdset->id;
1389                 }
1390             }
1391         }
1392     }
1393
1394     return -1;
1395 }
1396
1397 int64_t monitor_fdset_dup_fd_find(int dup_fd)
1398 {
1399     return monitor_fdset_dup_fd_find_remove(dup_fd, false);
1400 }
1401
1402 void monitor_fdset_dup_fd_remove(int dup_fd)
1403 {
1404     monitor_fdset_dup_fd_find_remove(dup_fd, true);
1405 }
1406
1407 int monitor_fd_param(Monitor *mon, const char *fdname, Error **errp)
1408 {
1409     int fd;
1410     Error *local_err = NULL;
1411
1412     if (!qemu_isdigit(fdname[0]) && mon) {
1413         fd = monitor_get_fd(mon, fdname, &local_err);
1414     } else {
1415         fd = qemu_parse_fd(fdname);
1416         if (fd == -1) {
1417             error_setg(&local_err, "Invalid file descriptor number '%s'",
1418                        fdname);
1419         }
1420     }
1421     if (local_err) {
1422         error_propagate(errp, local_err);
1423         assert(fd == -1);
1424     } else {
1425         assert(fd != -1);
1426     }
1427
1428     return fd;
1429 }
1430
1431 /* Please update hmp-commands.hx when adding or changing commands */
1432 static HMPCommand hmp_info_cmds[] = {
1433 #include "hmp-commands-info.h"
1434     { NULL, NULL, },
1435 };
1436
1437 /* hmp_cmds and hmp_info_cmds would be sorted at runtime */
1438 HMPCommand hmp_cmds[] = {
1439 #include "hmp-commands.h"
1440     { NULL, NULL, },
1441 };
1442
1443 /*
1444  * Set @pval to the value in the register identified by @name.
1445  * return 0 if OK, -1 if not found
1446  */
1447 int get_monitor_def(Monitor *mon, int64_t *pval, const char *name)
1448 {
1449     const MonitorDef *md = target_monitor_defs();
1450     CPUState *cs = mon_get_cpu(mon);
1451     void *ptr;
1452     uint64_t tmp = 0;
1453     int ret;
1454
1455     if (cs == NULL || md == NULL) {
1456         return -1;
1457     }
1458
1459     for(; md->name != NULL; md++) {
1460         if (hmp_compare_cmd(name, md->name)) {
1461             if (md->get_value) {
1462                 *pval = md->get_value(mon, md, md->offset);
1463             } else {
1464                 CPUArchState *env = mon_get_cpu_env(mon);
1465                 ptr = (uint8_t *)env + md->offset;
1466                 switch(md->type) {
1467                 case MD_I32:
1468                     *pval = *(int32_t *)ptr;
1469                     break;
1470                 case MD_TLONG:
1471                     *pval = *(target_long *)ptr;
1472                     break;
1473                 default:
1474                     *pval = 0;
1475                     break;
1476                 }
1477             }
1478             return 0;
1479         }
1480     }
1481
1482     ret = target_get_monitor_def(cs, name, &tmp);
1483     if (!ret) {
1484         *pval = (target_long) tmp;
1485     }
1486
1487     return ret;
1488 }
1489
1490 static void add_completion_option(ReadLineState *rs, const char *str,
1491                                   const char *option)
1492 {
1493     if (!str || !option) {
1494         return;
1495     }
1496     if (!strncmp(option, str, strlen(str))) {
1497         readline_add_completion(rs, option);
1498     }
1499 }
1500
1501 void chardev_add_completion(ReadLineState *rs, int nb_args, const char *str)
1502 {
1503     size_t len;
1504     ChardevBackendInfoList *list, *start;
1505
1506     if (nb_args != 2) {
1507         return;
1508     }
1509     len = strlen(str);
1510     readline_set_completion_index(rs, len);
1511
1512     start = list = qmp_query_chardev_backends(NULL);
1513     while (list) {
1514         const char *chr_name = list->value->name;
1515
1516         if (!strncmp(chr_name, str, len)) {
1517             readline_add_completion(rs, chr_name);
1518         }
1519         list = list->next;
1520     }
1521     qapi_free_ChardevBackendInfoList(start);
1522 }
1523
1524 void netdev_add_completion(ReadLineState *rs, int nb_args, const char *str)
1525 {
1526     size_t len;
1527     int i;
1528
1529     if (nb_args != 2) {
1530         return;
1531     }
1532     len = strlen(str);
1533     readline_set_completion_index(rs, len);
1534     for (i = 0; i < NET_CLIENT_DRIVER__MAX; i++) {
1535         add_completion_option(rs, str, NetClientDriver_str(i));
1536     }
1537 }
1538
1539 void device_add_completion(ReadLineState *rs, int nb_args, const char *str)
1540 {
1541     GSList *list, *elt;
1542     size_t len;
1543
1544     if (nb_args != 2) {
1545         return;
1546     }
1547
1548     len = strlen(str);
1549     readline_set_completion_index(rs, len);
1550     list = elt = object_class_get_list(TYPE_DEVICE, false);
1551     while (elt) {
1552         const char *name;
1553         DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, elt->data,
1554                                              TYPE_DEVICE);
1555         name = object_class_get_name(OBJECT_CLASS(dc));
1556
1557         if (dc->user_creatable
1558             && !strncmp(name, str, len)) {
1559             readline_add_completion(rs, name);
1560         }
1561         elt = elt->next;
1562     }
1563     g_slist_free(list);
1564 }
1565
1566 void object_add_completion(ReadLineState *rs, int nb_args, const char *str)
1567 {
1568     GSList *list, *elt;
1569     size_t len;
1570
1571     if (nb_args != 2) {
1572         return;
1573     }
1574
1575     len = strlen(str);
1576     readline_set_completion_index(rs, len);
1577     list = elt = object_class_get_list(TYPE_USER_CREATABLE, false);
1578     while (elt) {
1579         const char *name;
1580
1581         name = object_class_get_name(OBJECT_CLASS(elt->data));
1582         if (!strncmp(name, str, len) && strcmp(name, TYPE_USER_CREATABLE)) {
1583             readline_add_completion(rs, name);
1584         }
1585         elt = elt->next;
1586     }
1587     g_slist_free(list);
1588 }
1589
1590 static int qdev_add_hotpluggable_device(Object *obj, void *opaque)
1591 {
1592     GSList **list = opaque;
1593     DeviceState *dev = (DeviceState *)object_dynamic_cast(obj, TYPE_DEVICE);
1594
1595     if (dev == NULL) {
1596         return 0;
1597     }
1598
1599     if (dev->realized && object_property_get_bool(obj, "hotpluggable", NULL)) {
1600         *list = g_slist_append(*list, dev);
1601     }
1602
1603     return 0;
1604 }
1605
1606 static GSList *qdev_build_hotpluggable_device_list(Object *peripheral)
1607 {
1608     GSList *list = NULL;
1609
1610     object_child_foreach(peripheral, qdev_add_hotpluggable_device, &list);
1611
1612     return list;
1613 }
1614
1615 static void peripheral_device_del_completion(ReadLineState *rs,
1616                                              const char *str, size_t len)
1617 {
1618     Object *peripheral = container_get(qdev_get_machine(), "/peripheral");
1619     GSList *list, *item;
1620
1621     list = qdev_build_hotpluggable_device_list(peripheral);
1622     if (!list) {
1623         return;
1624     }
1625
1626     for (item = list; item; item = g_slist_next(item)) {
1627         DeviceState *dev = item->data;
1628
1629         if (dev->id && !strncmp(str, dev->id, len)) {
1630             readline_add_completion(rs, dev->id);
1631         }
1632     }
1633
1634     g_slist_free(list);
1635 }
1636
1637 void chardev_remove_completion(ReadLineState *rs, int nb_args, const char *str)
1638 {
1639     size_t len;
1640     ChardevInfoList *list, *start;
1641
1642     if (nb_args != 2) {
1643         return;
1644     }
1645     len = strlen(str);
1646     readline_set_completion_index(rs, len);
1647
1648     start = list = qmp_query_chardev(NULL);
1649     while (list) {
1650         ChardevInfo *chr = list->value;
1651
1652         if (!strncmp(chr->label, str, len)) {
1653             readline_add_completion(rs, chr->label);
1654         }
1655         list = list->next;
1656     }
1657     qapi_free_ChardevInfoList(start);
1658 }
1659
1660 static void ringbuf_completion(ReadLineState *rs, const char *str)
1661 {
1662     size_t len;
1663     ChardevInfoList *list, *start;
1664
1665     len = strlen(str);
1666     readline_set_completion_index(rs, len);
1667
1668     start = list = qmp_query_chardev(NULL);
1669     while (list) {
1670         ChardevInfo *chr_info = list->value;
1671
1672         if (!strncmp(chr_info->label, str, len)) {
1673             Chardev *chr = qemu_chr_find(chr_info->label);
1674             if (chr && CHARDEV_IS_RINGBUF(chr)) {
1675                 readline_add_completion(rs, chr_info->label);
1676             }
1677         }
1678         list = list->next;
1679     }
1680     qapi_free_ChardevInfoList(start);
1681 }
1682
1683 void ringbuf_write_completion(ReadLineState *rs, int nb_args, const char *str)
1684 {
1685     if (nb_args != 2) {
1686         return;
1687     }
1688     ringbuf_completion(rs, str);
1689 }
1690
1691 void device_del_completion(ReadLineState *rs, int nb_args, const char *str)
1692 {
1693     size_t len;
1694
1695     if (nb_args != 2) {
1696         return;
1697     }
1698
1699     len = strlen(str);
1700     readline_set_completion_index(rs, len);
1701     peripheral_device_del_completion(rs, str, len);
1702 }
1703
1704 void object_del_completion(ReadLineState *rs, int nb_args, const char *str)
1705 {
1706     ObjectPropertyInfoList *list, *start;
1707     size_t len;
1708
1709     if (nb_args != 2) {
1710         return;
1711     }
1712     len = strlen(str);
1713     readline_set_completion_index(rs, len);
1714
1715     start = list = qmp_qom_list("/objects", NULL);
1716     while (list) {
1717         ObjectPropertyInfo *info = list->value;
1718
1719         if (!strncmp(info->type, "child<", 5)
1720             && !strncmp(info->name, str, len)) {
1721             readline_add_completion(rs, info->name);
1722         }
1723         list = list->next;
1724     }
1725     qapi_free_ObjectPropertyInfoList(start);
1726 }
1727
1728 void sendkey_completion(ReadLineState *rs, int nb_args, const char *str)
1729 {
1730     int i;
1731     char *sep;
1732     size_t len;
1733
1734     if (nb_args != 2) {
1735         return;
1736     }
1737     sep = strrchr(str, '-');
1738     if (sep) {
1739         str = sep + 1;
1740     }
1741     len = strlen(str);
1742     readline_set_completion_index(rs, len);
1743     for (i = 0; i < Q_KEY_CODE__MAX; i++) {
1744         if (!strncmp(str, QKeyCode_str(i), len)) {
1745             readline_add_completion(rs, QKeyCode_str(i));
1746         }
1747     }
1748 }
1749
1750 void set_link_completion(ReadLineState *rs, int nb_args, const char *str)
1751 {
1752     size_t len;
1753
1754     len = strlen(str);
1755     readline_set_completion_index(rs, len);
1756     if (nb_args == 2) {
1757         NetClientState *ncs[MAX_QUEUE_NUM];
1758         int count, i;
1759         count = qemu_find_net_clients_except(NULL, ncs,
1760                                              NET_CLIENT_DRIVER_NONE,
1761                                              MAX_QUEUE_NUM);
1762         for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
1763             const char *name = ncs[i]->name;
1764             if (!strncmp(str, name, len)) {
1765                 readline_add_completion(rs, name);
1766             }
1767         }
1768     } else if (nb_args == 3) {
1769         add_completion_option(rs, str, "on");
1770         add_completion_option(rs, str, "off");
1771     }
1772 }
1773
1774 void netdev_del_completion(ReadLineState *rs, int nb_args, const char *str)
1775 {
1776     int len, count, i;
1777     NetClientState *ncs[MAX_QUEUE_NUM];
1778
1779     if (nb_args != 2) {
1780         return;
1781     }
1782
1783     len = strlen(str);
1784     readline_set_completion_index(rs, len);
1785     count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_DRIVER_NIC,
1786                                          MAX_QUEUE_NUM);
1787     for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
1788         const char *name = ncs[i]->name;
1789         if (strncmp(str, name, len)) {
1790             continue;
1791         }
1792         if (ncs[i]->is_netdev) {
1793             readline_add_completion(rs, name);
1794         }
1795     }
1796 }
1797
1798 void info_trace_events_completion(ReadLineState *rs, int nb_args, const char *str)
1799 {
1800     size_t len;
1801
1802     len = strlen(str);
1803     readline_set_completion_index(rs, len);
1804     if (nb_args == 2) {
1805         TraceEventIter iter;
1806         TraceEvent *ev;
1807         char *pattern = g_strdup_printf("%s*", str);
1808         trace_event_iter_init_pattern(&iter, pattern);
1809         while ((ev = trace_event_iter_next(&iter)) != NULL) {
1810             readline_add_completion(rs, trace_event_get_name(ev));
1811         }
1812         g_free(pattern);
1813     }
1814 }
1815
1816 void trace_event_completion(ReadLineState *rs, int nb_args, const char *str)
1817 {
1818     size_t len;
1819
1820     len = strlen(str);
1821     readline_set_completion_index(rs, len);
1822     if (nb_args == 2) {
1823         TraceEventIter iter;
1824         TraceEvent *ev;
1825         char *pattern = g_strdup_printf("%s*", str);
1826         trace_event_iter_init_pattern(&iter, pattern);
1827         while ((ev = trace_event_iter_next(&iter)) != NULL) {
1828             readline_add_completion(rs, trace_event_get_name(ev));
1829         }
1830         g_free(pattern);
1831     } else if (nb_args == 3) {
1832         add_completion_option(rs, str, "on");
1833         add_completion_option(rs, str, "off");
1834     }
1835 }
1836
1837 void watchdog_action_completion(ReadLineState *rs, int nb_args, const char *str)
1838 {
1839     int i;
1840
1841     if (nb_args != 2) {
1842         return;
1843     }
1844     readline_set_completion_index(rs, strlen(str));
1845     for (i = 0; i < WATCHDOG_ACTION__MAX; i++) {
1846         add_completion_option(rs, str, WatchdogAction_str(i));
1847     }
1848 }
1849
1850 void migrate_set_capability_completion(ReadLineState *rs, int nb_args,
1851                                        const char *str)
1852 {
1853     size_t len;
1854
1855     len = strlen(str);
1856     readline_set_completion_index(rs, len);
1857     if (nb_args == 2) {
1858         int i;
1859         for (i = 0; i < MIGRATION_CAPABILITY__MAX; i++) {
1860             const char *name = MigrationCapability_str(i);
1861             if (!strncmp(str, name, len)) {
1862                 readline_add_completion(rs, name);
1863             }
1864         }
1865     } else if (nb_args == 3) {
1866         add_completion_option(rs, str, "on");
1867         add_completion_option(rs, str, "off");
1868     }
1869 }
1870
1871 void migrate_set_parameter_completion(ReadLineState *rs, int nb_args,
1872                                       const char *str)
1873 {
1874     size_t len;
1875
1876     len = strlen(str);
1877     readline_set_completion_index(rs, len);
1878     if (nb_args == 2) {
1879         int i;
1880         for (i = 0; i < MIGRATION_PARAMETER__MAX; i++) {
1881             const char *name = MigrationParameter_str(i);
1882             if (!strncmp(str, name, len)) {
1883                 readline_add_completion(rs, name);
1884             }
1885         }
1886     }
1887 }
1888
1889 static void vm_completion(ReadLineState *rs, const char *str)
1890 {
1891     size_t len;
1892     BlockDriverState *bs;
1893     BdrvNextIterator it;
1894
1895     len = strlen(str);
1896     readline_set_completion_index(rs, len);
1897
1898     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
1899         SnapshotInfoList *snapshots, *snapshot;
1900         AioContext *ctx = bdrv_get_aio_context(bs);
1901         bool ok = false;
1902
1903         aio_context_acquire(ctx);
1904         if (bdrv_can_snapshot(bs)) {
1905             ok = bdrv_query_snapshot_info_list(bs, &snapshots, NULL) == 0;
1906         }
1907         aio_context_release(ctx);
1908         if (!ok) {
1909             continue;
1910         }
1911
1912         snapshot = snapshots;
1913         while (snapshot) {
1914             char *completion = snapshot->value->name;
1915             if (!strncmp(str, completion, len)) {
1916                 readline_add_completion(rs, completion);
1917             }
1918             completion = snapshot->value->id;
1919             if (!strncmp(str, completion, len)) {
1920                 readline_add_completion(rs, completion);
1921             }
1922             snapshot = snapshot->next;
1923         }
1924         qapi_free_SnapshotInfoList(snapshots);
1925     }
1926
1927 }
1928
1929 void delvm_completion(ReadLineState *rs, int nb_args, const char *str)
1930 {
1931     if (nb_args == 2) {
1932         vm_completion(rs, str);
1933     }
1934 }
1935
1936 void loadvm_completion(ReadLineState *rs, int nb_args, const char *str)
1937 {
1938     if (nb_args == 2) {
1939         vm_completion(rs, str);
1940     }
1941 }
1942
1943 static int
1944 compare_mon_cmd(const void *a, const void *b)
1945 {
1946     return strcmp(((const HMPCommand *)a)->name,
1947             ((const HMPCommand *)b)->name);
1948 }
1949
1950 static void sortcmdlist(void)
1951 {
1952     qsort(hmp_cmds, ARRAY_SIZE(hmp_cmds) - 1,
1953           sizeof(*hmp_cmds),
1954           compare_mon_cmd);
1955     qsort(hmp_info_cmds, ARRAY_SIZE(hmp_info_cmds) - 1,
1956           sizeof(*hmp_info_cmds),
1957           compare_mon_cmd);
1958 }
1959
1960 void monitor_register_hmp(const char *name, bool info,
1961                           void (*cmd)(Monitor *mon, const QDict *qdict))
1962 {
1963     HMPCommand *table = info ? hmp_info_cmds : hmp_cmds;
1964
1965     while (table->name != NULL) {
1966         if (strcmp(table->name, name) == 0) {
1967             g_assert(table->cmd == NULL);
1968             table->cmd = cmd;
1969             return;
1970         }
1971         table++;
1972     }
1973     g_assert_not_reached();
1974 }
1975
1976 void monitor_init_globals(void)
1977 {
1978     monitor_init_globals_core();
1979     monitor_init_qmp_commands();
1980     sortcmdlist();
1981     qemu_mutex_init(&mon_fdsets_lock);
1982 }