monitor/misc.c

   1 /*
   2  * QEMU monitor
   3  *
   4  * Copyright (c) 2003-2004 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26 #include "monitor-internal.h"
  27 #include "cpu.h"
  28 #include "monitor/qdev.h"
  29 #include "hw/usb.h"
  30 #include "hw/pci/pci.h"
  31 #include "sysemu/watchdog.h"
  32 #include "hw/loader.h"
  33 #include "exec/gdbstub.h"
  34 #include "net/net.h"
  35 #include "net/slirp.h"
  36 #include "chardev/char-mux.h"
  37 #include "ui/qemu-spice.h"
  38 #include "qemu/config-file.h"
  39 #include "qemu/ctype.h"
  40 #include "ui/console.h"
  41 #include "ui/input.h"
  42 #include "audio/audio.h"
  43 #include "disas/disas.h"
  44 #include "sysemu/balloon.h"
  45 #include "qemu/timer.h"
  46 #include "sysemu/hw_accel.h"
  47 #include "sysemu/runstate.h"
  48 #include "authz/list.h"
  49 #include "qapi/util.h"
  50 #include "sysemu/blockdev.h"
  51 #include "sysemu/sysemu.h"
  52 #include "sysemu/tcg.h"
  53 #include "sysemu/tpm.h"
  54 #include "qapi/qmp/qdict.h"
  55 #include "qapi/qmp/qerror.h"
  56 #include "qapi/qmp/qstring.h"
  57 #include "qom/object_interfaces.h"
  58 #include "trace/control.h"
  59 #include "monitor/hmp-target.h"
  60 #include "monitor/hmp.h"
  61 #ifdef CONFIG_TRACE_SIMPLE
  62 #include "trace/simple.h"
  63 #endif
  64 #include "exec/memory.h"
  65 #include "exec/exec-all.h"
  66 #include "qemu/option.h"
  67 #include "qemu/thread.h"
  68 #include "block/qapi.h"
  69 #include "qapi/qapi-commands.h"
  70 #include "qapi/qapi-emit-events.h"
  71 #include "qapi/error.h"
  72 #include "qapi/qmp-event.h"
  73 #include "qapi/qapi-introspect.h"
  74 #include "sysemu/cpus.h"
  75 #include "qemu/cutils.h"
  76 #include "tcg/tcg.h"
  77
  78 #if defined(TARGET_S390X)
  79 #include "hw/s390x/storage-keys.h"
  80 #include "hw/s390x/storage-attributes.h"
  81 #endif
  82
  83 /* file descriptors passed via SCM_RIGHTS */
  84 typedef struct mon_fd_t mon_fd_t;
  85 struct mon_fd_t {
  86     char *name;
  87     int fd;
  88     QLIST_ENTRY(mon_fd_t) next;
  89 };
  90
  91 /* file descriptor associated with a file descriptor set */
  92 typedef struct MonFdsetFd MonFdsetFd;
  93 struct MonFdsetFd {
  94     int fd;
  95     bool removed;
  96     char *opaque;
  97     QLIST_ENTRY(MonFdsetFd) next;
  98 };
  99
 100 /* file descriptor set containing fds passed via SCM_RIGHTS */
 101 typedef struct MonFdset MonFdset;
 102 struct MonFdset {
 103     int64_t id;
 104     QLIST_HEAD(, MonFdsetFd) fds;
 105     QLIST_HEAD(, MonFdsetFd) dup_fds;
 106     QLIST_ENTRY(MonFdset) next;
 107 };
 108
 109 /* QMP checker flags */
 110 #define QMP_ACCEPT_UNKNOWNS 1
 111
 112 /* Protects mon_fdsets */
 113 static QemuMutex mon_fdsets_lock;
 114 static QLIST_HEAD(, MonFdset) mon_fdsets;
 115
 116 static HMPCommand hmp_info_cmds[];
 117
 118 char *qmp_human_monitor_command(const char *command_line, bool has_cpu_index,
 119                                 int64_t cpu_index, Error **errp)
 120 {
 121     char *output = NULL;
 122     Monitor *old_mon;
 123     MonitorHMP hmp = {};
 124
 125     monitor_data_init(&hmp.common, false, true, false);
 126
 127     old_mon = cur_mon;
 128     cur_mon = &hmp.common;
 129
 130     if (has_cpu_index) {
 131         int ret = monitor_set_cpu(cpu_index);
 132         if (ret < 0) {
 133             cur_mon = old_mon;
 134             error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "cpu-index",
 135                        "a CPU number");
 136             goto out;
 137         }
 138     }
 139
 140     handle_hmp_command(&hmp, command_line);
 141     cur_mon = old_mon;
 142
 143     qemu_mutex_lock(&hmp.common.mon_lock);
 144     if (qstring_get_length(hmp.common.outbuf) > 0) {
 145         output = g_strdup(qstring_get_str(hmp.common.outbuf));
 146     } else {
 147         output = g_strdup("");
 148     }
 149     qemu_mutex_unlock(&hmp.common.mon_lock);
 150
 151 out:
 152     monitor_data_destroy(&hmp.common);
 153     return output;
 154 }
 155
 156 /**
 157  * Is @name in the '|' separated list of names @list?
 158  */
 159 int hmp_compare_cmd(const char *name, const char *list)
 160 {
 161     const char *p, *pstart;
 162     int len;
 163     len = strlen(name);
 164     p = list;
 165     for (;;) {
 166         pstart = p;
 167         p = qemu_strchrnul(p, '|');
 168         if ((p - pstart) == len && !memcmp(pstart, name, len)) {
 169             return 1;
 170         }
 171         if (*p == '\0') {
 172             break;
 173         }
 174         p++;
 175     }
 176     return 0;
 177 }
 178
 179 static void do_help_cmd(Monitor *mon, const QDict *qdict)
 180 {
 181     help_cmd(mon, qdict_get_try_str(qdict, "name"));
 182 }
 183
 184 static void hmp_trace_event(Monitor *mon, const QDict *qdict)
 185 {
 186     const char *tp_name = qdict_get_str(qdict, "name");
 187     bool new_state = qdict_get_bool(qdict, "option");
 188     bool has_vcpu = qdict_haskey(qdict, "vcpu");
 189     int vcpu = qdict_get_try_int(qdict, "vcpu", 0);
 190     Error *local_err = NULL;
 191
 192     if (vcpu < 0) {
 193         monitor_printf(mon, "argument vcpu must be positive");
 194         return;
 195     }
 196
 197     qmp_trace_event_set_state(tp_name, new_state, true, true, has_vcpu, vcpu, &local_err);
 198     if (local_err) {
 199         error_report_err(local_err);
 200     }
 201 }
 202
 203 #ifdef CONFIG_TRACE_SIMPLE
 204 static void hmp_trace_file(Monitor *mon, const QDict *qdict)
 205 {
 206     const char *op = qdict_get_try_str(qdict, "op");
 207     const char *arg = qdict_get_try_str(qdict, "arg");
 208
 209     if (!op) {
 210         st_print_trace_file_status();
 211     } else if (!strcmp(op, "on")) {
 212         st_set_trace_file_enabled(true);
 213     } else if (!strcmp(op, "off")) {
 214         st_set_trace_file_enabled(false);
 215     } else if (!strcmp(op, "flush")) {
 216         st_flush_trace_buffer();
 217     } else if (!strcmp(op, "set")) {
 218         if (arg) {
 219             st_set_trace_file(arg);
 220         }
 221     } else {
 222         monitor_printf(mon, "unexpected argument \"%s\"\n", op);
 223         help_cmd(mon, "trace-file");
 224     }
 225 }
 226 #endif
 227
 228 static void hmp_info_help(Monitor *mon, const QDict *qdict)
 229 {
 230     help_cmd(mon, "info");
 231 }
 232
 233 static void query_commands_cb(QmpCommand *cmd, void *opaque)
 234 {
 235     CommandInfoList *info, **list = opaque;
 236
 237     if (!cmd->enabled) {
 238         return;
 239     }
 240
 241     info = g_malloc0(sizeof(*info));
 242     info->value = g_malloc0(sizeof(*info->value));
 243     info->value->name = g_strdup(cmd->name);
 244     info->next = *list;
 245     *list = info;
 246 }
 247
 248 CommandInfoList *qmp_query_commands(Error **errp)
 249 {
 250     CommandInfoList *list = NULL;
 251     MonitorQMP *mon;
 252
 253     assert(monitor_is_qmp(cur_mon));
 254     mon = container_of(cur_mon, MonitorQMP, common);
 255
 256     qmp_for_each_command(mon->commands, query_commands_cb, &list);
 257
 258     return list;
 259 }
 260
 261 EventInfoList *qmp_query_events(Error **errp)
 262 {
 263     /*
 264      * TODO This deprecated command is the only user of
 265      * QAPIEvent_str() and QAPIEvent_lookup[].  When the command goes,
 266      * they should go, too.
 267      */
 268     EventInfoList *info, *ev_list = NULL;
 269     QAPIEvent e;
 270
 271     for (e = 0 ; e < QAPI_EVENT__MAX ; e++) {
 272         const char *event_name = QAPIEvent_str(e);
 273         assert(event_name != NULL);
 274         info = g_malloc0(sizeof(*info));
 275         info->value = g_malloc0(sizeof(*info->value));
 276         info->value->name = g_strdup(event_name);
 277
 278         info->next = ev_list;
 279         ev_list = info;
 280     }
 281
 282     return ev_list;
 283 }
 284
 285 /*
 286  * Minor hack: generated marshalling suppressed for this command
 287  * ('gen': false in the schema) so we can parse the JSON string
 288  * directly into QObject instead of first parsing it with
 289  * visit_type_SchemaInfoList() into a SchemaInfoList, then marshal it
 290  * to QObject with generated output marshallers, every time.  Instead,
 291  * we do it in test-qobject-input-visitor.c, just to make sure
 292  * qapi-gen.py's output actually conforms to the schema.
 293  */
 294 static void qmp_query_qmp_schema(QDict *qdict, QObject **ret_data,
 295                                  Error **errp)
 296 {
 297     *ret_data = qobject_from_qlit(&qmp_schema_qlit);
 298 }
 299
 300 static void monitor_init_qmp_commands(void)
 301 {
 302     /*
 303      * Two command lists:
 304      * - qmp_commands contains all QMP commands
 305      * - qmp_cap_negotiation_commands contains just
 306      *   "qmp_capabilities", to enforce capability negotiation
 307      */
 308
 309     qmp_init_marshal(&qmp_commands);
 310
 311     qmp_register_command(&qmp_commands, "query-qmp-schema",
 312                          qmp_query_qmp_schema, QCO_ALLOW_PRECONFIG);
 313     qmp_register_command(&qmp_commands, "device_add", qmp_device_add,
 314                          QCO_NO_OPTIONS);
 315     qmp_register_command(&qmp_commands, "netdev_add", qmp_netdev_add,
 316                          QCO_NO_OPTIONS);
 317
 318     QTAILQ_INIT(&qmp_cap_negotiation_commands);
 319     qmp_register_command(&qmp_cap_negotiation_commands, "qmp_capabilities",
 320                          qmp_marshal_qmp_capabilities, QCO_ALLOW_PRECONFIG);
 321 }
 322
 323 /*
 324  * Accept QMP capabilities in @list for @mon.
 325  * On success, set mon->qmp.capab[], and return true.
 326  * On error, set @errp, and return false.
 327  */
 328 static bool qmp_caps_accept(MonitorQMP *mon, QMPCapabilityList *list,
 329                             Error **errp)
 330 {
 331     GString *unavailable = NULL;
 332     bool capab[QMP_CAPABILITY__MAX];
 333
 334     memset(capab, 0, sizeof(capab));
 335
 336     for (; list; list = list->next) {
 337         if (!mon->capab_offered[list->value]) {
 338             if (!unavailable) {
 339                 unavailable = g_string_new(QMPCapability_str(list->value));
 340             } else {
 341                 g_string_append_printf(unavailable, ", %s",
 342                                       QMPCapability_str(list->value));
 343             }
 344         }
 345         capab[list->value] = true;
 346     }
 347
 348     if (unavailable) {
 349         error_setg(errp, "Capability %s not available", unavailable->str);
 350         g_string_free(unavailable, true);
 351         return false;
 352     }
 353
 354     memcpy(mon->capab, capab, sizeof(capab));
 355     return true;
 356 }
 357
 358 void qmp_qmp_capabilities(bool has_enable, QMPCapabilityList *enable,
 359                           Error **errp)
 360 {
 361     MonitorQMP *mon;
 362
 363     assert(monitor_is_qmp(cur_mon));
 364     mon = container_of(cur_mon, MonitorQMP, common);
 365
 366     if (mon->commands == &qmp_commands) {
 367         error_set(errp, ERROR_CLASS_COMMAND_NOT_FOUND,
 368                   "Capabilities negotiation is already complete, command "
 369                   "ignored");
 370         return;
 371     }
 372
 373     if (!qmp_caps_accept(mon, enable, errp)) {
 374         return;
 375     }
 376
 377     mon->commands = &qmp_commands;
 378 }
 379
 380 /* Set the current CPU defined by the user. Callers must hold BQL. */
 381 int monitor_set_cpu(int cpu_index)
 382 {
 383     CPUState *cpu;
 384
 385     cpu = qemu_get_cpu(cpu_index);
 386     if (cpu == NULL) {
 387         return -1;
 388     }
 389     g_free(cur_mon->mon_cpu_path);
 390     cur_mon->mon_cpu_path = object_get_canonical_path(OBJECT(cpu));
 391     return 0;
 392 }
 393
 394 /* Callers must hold BQL. */
 395 static CPUState *mon_get_cpu_sync(bool synchronize)
 396 {
 397     CPUState *cpu = NULL;
 398
 399     if (cur_mon->mon_cpu_path) {
 400         cpu = (CPUState *) object_resolve_path_type(cur_mon->mon_cpu_path,
 401                                                     TYPE_CPU, NULL);
 402         if (!cpu) {
 403             g_free(cur_mon->mon_cpu_path);
 404             cur_mon->mon_cpu_path = NULL;
 405         }
 406     }
 407     if (!cur_mon->mon_cpu_path) {
 408         if (!first_cpu) {
 409             return NULL;
 410         }
 411         monitor_set_cpu(first_cpu->cpu_index);
 412         cpu = first_cpu;
 413     }
 414     assert(cpu != NULL);
 415     if (synchronize) {
 416         cpu_synchronize_state(cpu);
 417     }
 418     return cpu;
 419 }
 420
 421 CPUState *mon_get_cpu(void)
 422 {
 423     return mon_get_cpu_sync(true);
 424 }
 425
 426 CPUArchState *mon_get_cpu_env(void)
 427 {
 428     CPUState *cs = mon_get_cpu();
 429
 430     return cs ? cs->env_ptr : NULL;
 431 }
 432
 433 int monitor_get_cpu_index(void)
 434 {
 435     CPUState *cs = mon_get_cpu_sync(false);
 436
 437     return cs ? cs->cpu_index : UNASSIGNED_CPU_INDEX;
 438 }
 439
 440 static void hmp_info_registers(Monitor *mon, const QDict *qdict)
 441 {
 442     bool all_cpus = qdict_get_try_bool(qdict, "cpustate_all", false);
 443     CPUState *cs;
 444
 445     if (all_cpus) {
 446         CPU_FOREACH(cs) {
 447             monitor_printf(mon, "\nCPU#%d\n", cs->cpu_index);
 448             cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
 449         }
 450     } else {
 451         cs = mon_get_cpu();
 452
 453         if (!cs) {
 454             monitor_printf(mon, "No CPU available\n");
 455             return;
 456         }
 457
 458         cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
 459     }
 460 }
 461
 462 #ifdef CONFIG_TCG
 463 static void hmp_info_jit(Monitor *mon, const QDict *qdict)
 464 {
 465     if (!tcg_enabled()) {
 466         error_report("JIT information is only available with accel=tcg");
 467         return;
 468     }
 469
 470     dump_exec_info();
 471     dump_drift_info();
 472 }
 473
 474 static void hmp_info_opcount(Monitor *mon, const QDict *qdict)
 475 {
 476     dump_opcount_info();
 477 }
 478 #endif
 479
 480 static void hmp_info_sync_profile(Monitor *mon, const QDict *qdict)
 481 {
 482     int64_t max = qdict_get_try_int(qdict, "max", 10);
 483     bool mean = qdict_get_try_bool(qdict, "mean", false);
 484     bool coalesce = !qdict_get_try_bool(qdict, "no_coalesce", false);
 485     enum QSPSortBy sort_by;
 486
 487     sort_by = mean ? QSP_SORT_BY_AVG_WAIT_TIME : QSP_SORT_BY_TOTAL_WAIT_TIME;
 488     qsp_report(max, sort_by, coalesce);
 489 }
 490
 491 static void hmp_info_history(Monitor *mon, const QDict *qdict)
 492 {
 493     MonitorHMP *hmp_mon = container_of(mon, MonitorHMP, common);
 494     int i;
 495     const char *str;
 496
 497     if (!hmp_mon->rs) {
 498         return;
 499     }
 500     i = 0;
 501     for(;;) {
 502         str = readline_get_history(hmp_mon->rs, i);
 503         if (!str) {
 504             break;
 505         }
 506         monitor_printf(mon, "%d: '%s'\n", i, str);
 507         i++;
 508     }
 509 }
 510
 511 static void hmp_info_cpustats(Monitor *mon, const QDict *qdict)
 512 {
 513     CPUState *cs = mon_get_cpu();
 514
 515     if (!cs) {
 516         monitor_printf(mon, "No CPU available\n");
 517         return;
 518     }
 519     cpu_dump_statistics(cs, 0);
 520 }
 521
 522 static void hmp_info_trace_events(Monitor *mon, const QDict *qdict)
 523 {
 524     const char *name = qdict_get_try_str(qdict, "name");
 525     bool has_vcpu = qdict_haskey(qdict, "vcpu");
 526     int vcpu = qdict_get_try_int(qdict, "vcpu", 0);
 527     TraceEventInfoList *events;
 528     TraceEventInfoList *elem;
 529     Error *local_err = NULL;
 530
 531     if (name == NULL) {
 532         name = "*";
 533     }
 534     if (vcpu < 0) {
 535         monitor_printf(mon, "argument vcpu must be positive");
 536         return;
 537     }
 538
 539     events = qmp_trace_event_get_state(name, has_vcpu, vcpu, &local_err);
 540     if (local_err) {
 541         error_report_err(local_err);
 542         return;
 543     }
 544
 545     for (elem = events; elem != NULL; elem = elem->next) {
 546         monitor_printf(mon, "%s : state %u\n",
 547                        elem->value->name,
 548                        elem->value->state == TRACE_EVENT_STATE_ENABLED ? 1 : 0);
 549     }
 550     qapi_free_TraceEventInfoList(events);
 551 }
 552
 553 void qmp_client_migrate_info(const char *protocol, const char *hostname,
 554                              bool has_port, int64_t port,
 555                              bool has_tls_port, int64_t tls_port,
 556                              bool has_cert_subject, const char *cert_subject,
 557                              Error **errp)
 558 {
 559     if (strcmp(protocol, "spice") == 0) {
 560         if (!qemu_using_spice(errp)) {
 561             return;
 562         }
 563
 564         if (!has_port && !has_tls_port) {
 565             error_setg(errp, QERR_MISSING_PARAMETER, "port/tls-port");
 566             return;
 567         }
 568
 569         if (qemu_spice_migrate_info(hostname,
 570                                     has_port ? port : -1,
 571                                     has_tls_port ? tls_port : -1,
 572                                     cert_subject)) {
 573             error_setg(errp, QERR_UNDEFINED_ERROR);
 574             return;
 575         }
 576         return;
 577     }
 578
 579     error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "protocol", "spice");
 580 }
 581
 582 static void hmp_logfile(Monitor *mon, const QDict *qdict)
 583 {
 584     Error *err = NULL;
 585
 586     qemu_set_log_filename(qdict_get_str(qdict, "filename"), &err);
 587     if (err) {
 588         error_report_err(err);
 589     }
 590 }
 591
 592 static void hmp_log(Monitor *mon, const QDict *qdict)
 593 {
 594     int mask;
 595     const char *items = qdict_get_str(qdict, "items");
 596
 597     if (!strcmp(items, "none")) {
 598         mask = 0;
 599     } else {
 600         mask = qemu_str_to_log_mask(items);
 601         if (!mask) {
 602             help_cmd(mon, "log");
 603             return;
 604         }
 605     }
 606     qemu_set_log(mask);
 607 }
 608
 609 static void hmp_singlestep(Monitor *mon, const QDict *qdict)
 610 {
 611     const char *option = qdict_get_try_str(qdict, "option");
 612     if (!option || !strcmp(option, "on")) {
 613         singlestep = 1;
 614     } else if (!strcmp(option, "off")) {
 615         singlestep = 0;
 616     } else {
 617         monitor_printf(mon, "unexpected option %s\n", option);
 618     }
 619 }
 620
 621 static void hmp_gdbserver(Monitor *mon, const QDict *qdict)
 622 {
 623     const char *device = qdict_get_try_str(qdict, "device");
 624     if (!device)
 625         device = "tcp::" DEFAULT_GDBSTUB_PORT;
 626     if (gdbserver_start(device) < 0) {
 627         monitor_printf(mon, "Could not open gdbserver on device '%s'\n",
 628                        device);
 629     } else if (strcmp(device, "none") == 0) {
 630         monitor_printf(mon, "Disabled gdbserver\n");
 631     } else {
 632         monitor_printf(mon, "Waiting for gdb connection on device '%s'\n",
 633                        device);
 634     }
 635 }
 636
 637 static void hmp_watchdog_action(Monitor *mon, const QDict *qdict)
 638 {
 639     const char *action = qdict_get_str(qdict, "action");
 640     if (select_watchdog_action(action) == -1) {
 641         monitor_printf(mon, "Unknown watchdog action '%s'\n", action);
 642     }
 643 }
 644
 645 static void monitor_printc(Monitor *mon, int c)
 646 {
 647     monitor_printf(mon, "'");
 648     switch(c) {
 649     case '\'':
 650         monitor_printf(mon, "\\'");
 651         break;
 652     case '\\':
 653         monitor_printf(mon, "\\\\");
 654         break;
 655     case '\n':
 656         monitor_printf(mon, "\\n");
 657         break;
 658     case '\r':
 659         monitor_printf(mon, "\\r");
 660         break;
 661     default:
 662         if (c >= 32 && c <= 126) {
 663             monitor_printf(mon, "%c", c);
 664         } else {
 665             monitor_printf(mon, "\\x%02x", c);
 666         }
 667         break;
 668     }
 669     monitor_printf(mon, "'");
 670 }
 671
 672 static void memory_dump(Monitor *mon, int count, int format, int wsize,
 673                         hwaddr addr, int is_physical)
 674 {
 675     int l, line_size, i, max_digits, len;
 676     uint8_t buf[16];
 677     uint64_t v;
 678     CPUState *cs = mon_get_cpu();
 679
 680     if (!cs && (format == 'i' || !is_physical)) {
 681         monitor_printf(mon, "Can not dump without CPU\n");
 682         return;
 683     }
 684
 685     if (format == 'i') {
 686         monitor_disas(mon, cs, addr, count, is_physical);
 687         return;
 688     }
 689
 690     len = wsize * count;
 691     if (wsize == 1)
 692         line_size = 8;
 693     else
 694         line_size = 16;
 695     max_digits = 0;
 696
 697     switch(format) {
 698     case 'o':
 699         max_digits = DIV_ROUND_UP(wsize * 8, 3);
 700         break;
 701     default:
 702     case 'x':
 703         max_digits = (wsize * 8) / 4;
 704         break;
 705     case 'u':
 706     case 'd':
 707         max_digits = DIV_ROUND_UP(wsize * 8 * 10, 33);
 708         break;
 709     case 'c':
 710         wsize = 1;
 711         break;
 712     }
 713
 714     while (len > 0) {
 715         if (is_physical)
 716             monitor_printf(mon, TARGET_FMT_plx ":", addr);
 717         else
 718             monitor_printf(mon, TARGET_FMT_lx ":", (target_ulong)addr);
 719         l = len;
 720         if (l > line_size)
 721             l = line_size;
 722         if (is_physical) {
 723             AddressSpace *as = cs ? cs->as : &address_space_memory;
 724             MemTxResult r = address_space_read(as, addr,
 725                                                MEMTXATTRS_UNSPECIFIED, buf, l);
 726             if (r != MEMTX_OK) {
 727                 monitor_printf(mon, " Cannot access memory\n");
 728                 break;
 729             }
 730         } else {
 731             if (cpu_memory_rw_debug(cs, addr, buf, l, 0) < 0) {
 732                 monitor_printf(mon, " Cannot access memory\n");
 733                 break;
 734             }
 735         }
 736         i = 0;
 737         while (i < l) {
 738             switch(wsize) {
 739             default:
 740             case 1:
 741                 v = ldub_p(buf + i);
 742                 break;
 743             case 2:
 744                 v = lduw_p(buf + i);
 745                 break;
 746             case 4:
 747                 v = (uint32_t)ldl_p(buf + i);
 748                 break;
 749             case 8:
 750                 v = ldq_p(buf + i);
 751                 break;
 752             }
 753             monitor_printf(mon, " ");
 754             switch(format) {
 755             case 'o':
 756                 monitor_printf(mon, "%#*" PRIo64, max_digits, v);
 757                 break;
 758             case 'x':
 759                 monitor_printf(mon, "0x%0*" PRIx64, max_digits, v);
 760                 break;
 761             case 'u':
 762                 monitor_printf(mon, "%*" PRIu64, max_digits, v);
 763                 break;
 764             case 'd':
 765                 monitor_printf(mon, "%*" PRId64, max_digits, v);
 766                 break;
 767             case 'c':
 768                 monitor_printc(mon, v);
 769                 break;
 770             }
 771             i += wsize;
 772         }
 773         monitor_printf(mon, "\n");
 774         addr += l;
 775         len -= l;
 776     }
 777 }
 778
 779 static void hmp_memory_dump(Monitor *mon, const QDict *qdict)
 780 {
 781     int count = qdict_get_int(qdict, "count");
 782     int format = qdict_get_int(qdict, "format");
 783     int size = qdict_get_int(qdict, "size");
 784     target_long addr = qdict_get_int(qdict, "addr");
 785
 786     memory_dump(mon, count, format, size, addr, 0);
 787 }
 788
 789 static void hmp_physical_memory_dump(Monitor *mon, const QDict *qdict)
 790 {
 791     int count = qdict_get_int(qdict, "count");
 792     int format = qdict_get_int(qdict, "format");
 793     int size = qdict_get_int(qdict, "size");
 794     hwaddr addr = qdict_get_int(qdict, "addr");
 795
 796     memory_dump(mon, count, format, size, addr, 1);
 797 }
 798
 799 static void *gpa2hva(MemoryRegion **p_mr, hwaddr addr, Error **errp)
 800 {
 801     MemoryRegionSection mrs = memory_region_find(get_system_memory(),
 802                                                  addr, 1);
 803
 804     if (!mrs.mr) {
 805         error_setg(errp, "No memory is mapped at address 0x%" HWADDR_PRIx, addr);
 806         return NULL;
 807     }
 808
 809     if (!memory_region_is_ram(mrs.mr) && !memory_region_is_romd(mrs.mr)) {
 810         error_setg(errp, "Memory at address 0x%" HWADDR_PRIx "is not RAM", addr);
 811         memory_region_unref(mrs.mr);
 812         return NULL;
 813     }
 814
 815     *p_mr = mrs.mr;
 816     return qemu_map_ram_ptr(mrs.mr->ram_block, mrs.offset_within_region);
 817 }
 818
 819 static void hmp_gpa2hva(Monitor *mon, const QDict *qdict)
 820 {
 821     hwaddr addr = qdict_get_int(qdict, "addr");
 822     Error *local_err = NULL;
 823     MemoryRegion *mr = NULL;
 824     void *ptr;
 825
 826     ptr = gpa2hva(&mr, addr, &local_err);
 827     if (local_err) {
 828         error_report_err(local_err);
 829         return;
 830     }
 831
 832     monitor_printf(mon, "Host virtual address for 0x%" HWADDR_PRIx
 833                    " (%s) is %p\n",
 834                    addr, mr->name, ptr);
 835
 836     memory_region_unref(mr);
 837 }
 838
 839 static void hmp_gva2gpa(Monitor *mon, const QDict *qdict)
 840 {
 841     target_ulong addr = qdict_get_int(qdict, "addr");
 842     MemTxAttrs attrs;
 843     CPUState *cs = mon_get_cpu();
 844     hwaddr gpa;
 845
 846     if (!cs) {
 847         monitor_printf(mon, "No cpu\n");
 848         return;
 849     }
 850
 851     gpa  = cpu_get_phys_page_attrs_debug(cs, addr & TARGET_PAGE_MASK, &attrs);
 852     if (gpa == -1) {
 853         monitor_printf(mon, "Unmapped\n");
 854     } else {
 855         monitor_printf(mon, "gpa: %#" HWADDR_PRIx "\n",
 856                        gpa + (addr & ~TARGET_PAGE_MASK));
 857     }
 858 }
 859
 860 #ifdef CONFIG_LINUX
 861 static uint64_t vtop(void *ptr, Error **errp)
 862 {
 863     uint64_t pinfo;
 864     uint64_t ret = -1;
 865     uintptr_t addr = (uintptr_t) ptr;
 866     uintptr_t pagesize = qemu_real_host_page_size;
 867     off_t offset = addr / pagesize * sizeof(pinfo);
 868     int fd;
 869
 870     fd = open("/proc/self/pagemap", O_RDONLY);
 871     if (fd == -1) {
 872         error_setg_errno(errp, errno, "Cannot open /proc/self/pagemap");
 873         return -1;
 874     }
 875
 876     /* Force copy-on-write if necessary.  */
 877     atomic_add((uint8_t *)ptr, 0);
 878
 879     if (pread(fd, &pinfo, sizeof(pinfo), offset) != sizeof(pinfo)) {
 880         error_setg_errno(errp, errno, "Cannot read pagemap");
 881         goto out;
 882     }
 883     if ((pinfo & (1ull << 63)) == 0) {
 884         error_setg(errp, "Page not present");
 885         goto out;
 886     }
 887     ret = ((pinfo & 0x007fffffffffffffull) * pagesize) | (addr & (pagesize - 1));
 888
 889 out:
 890     close(fd);
 891     return ret;
 892 }
 893
 894 static void hmp_gpa2hpa(Monitor *mon, const QDict *qdict)
 895 {
 896     hwaddr addr = qdict_get_int(qdict, "addr");
 897     Error *local_err = NULL;
 898     MemoryRegion *mr = NULL;
 899     void *ptr;
 900     uint64_t physaddr;
 901
 902     ptr = gpa2hva(&mr, addr, &local_err);
 903     if (local_err) {
 904         error_report_err(local_err);
 905         return;
 906     }
 907
 908     physaddr = vtop(ptr, &local_err);
 909     if (local_err) {
 910         error_report_err(local_err);
 911     } else {
 912         monitor_printf(mon, "Host physical address for 0x%" HWADDR_PRIx
 913                        " (%s) is 0x%" PRIx64 "\n",
 914                        addr, mr->name, (uint64_t) physaddr);
 915     }
 916
 917     memory_region_unref(mr);
 918 }
 919 #endif
 920
 921 static void do_print(Monitor *mon, const QDict *qdict)
 922 {
 923     int format = qdict_get_int(qdict, "format");
 924     hwaddr val = qdict_get_int(qdict, "val");
 925
 926     switch(format) {
 927     case 'o':
 928         monitor_printf(mon, "%#" HWADDR_PRIo, val);
 929         break;
 930     case 'x':
 931         monitor_printf(mon, "%#" HWADDR_PRIx, val);
 932         break;
 933     case 'u':
 934         monitor_printf(mon, "%" HWADDR_PRIu, val);
 935         break;
 936     default:
 937     case 'd':
 938         monitor_printf(mon, "%" HWADDR_PRId, val);
 939         break;
 940     case 'c':
 941         monitor_printc(mon, val);
 942         break;
 943     }
 944     monitor_printf(mon, "\n");
 945 }
 946
 947 static void hmp_sum(Monitor *mon, const QDict *qdict)
 948 {
 949     uint32_t addr;
 950     uint16_t sum;
 951     uint32_t start = qdict_get_int(qdict, "start");
 952     uint32_t size = qdict_get_int(qdict, "size");
 953
 954     sum = 0;
 955     for(addr = start; addr < (start + size); addr++) {
 956         uint8_t val = address_space_ldub(&address_space_memory, addr,
 957                                          MEMTXATTRS_UNSPECIFIED, NULL);
 958         /* BSD sum algorithm ('sum' Unix command) */
 959         sum = (sum >> 1) | (sum << 15);
 960         sum += val;
 961     }
 962     monitor_printf(mon, "%05d\n", sum);
 963 }
 964
 965 static int mouse_button_state;
 966
 967 static void hmp_mouse_move(Monitor *mon, const QDict *qdict)
 968 {
 969     int dx, dy, dz, button;
 970     const char *dx_str = qdict_get_str(qdict, "dx_str");
 971     const char *dy_str = qdict_get_str(qdict, "dy_str");
 972     const char *dz_str = qdict_get_try_str(qdict, "dz_str");
 973
 974     dx = strtol(dx_str, NULL, 0);
 975     dy = strtol(dy_str, NULL, 0);
 976     qemu_input_queue_rel(NULL, INPUT_AXIS_X, dx);
 977     qemu_input_queue_rel(NULL, INPUT_AXIS_Y, dy);
 978
 979     if (dz_str) {
 980         dz = strtol(dz_str, NULL, 0);
 981         if (dz != 0) {
 982             button = (dz > 0) ? INPUT_BUTTON_WHEEL_UP : INPUT_BUTTON_WHEEL_DOWN;
 983             qemu_input_queue_btn(NULL, button, true);
 984             qemu_input_event_sync();
 985             qemu_input_queue_btn(NULL, button, false);
 986         }
 987     }
 988     qemu_input_event_sync();
 989 }
 990
 991 static void hmp_mouse_button(Monitor *mon, const QDict *qdict)
 992 {
 993     static uint32_t bmap[INPUT_BUTTON__MAX] = {
 994         [INPUT_BUTTON_LEFT]       = MOUSE_EVENT_LBUTTON,
 995         [INPUT_BUTTON_MIDDLE]     = MOUSE_EVENT_MBUTTON,
 996         [INPUT_BUTTON_RIGHT]      = MOUSE_EVENT_RBUTTON,
 997     };
 998     int button_state = qdict_get_int(qdict, "button_state");
 999
1000     if (mouse_button_state == button_state) {
1001         return;
1002     }
1003     qemu_input_update_buttons(NULL, bmap, mouse_button_state, button_state);
1004     qemu_input_event_sync();
1005     mouse_button_state = button_state;
1006 }
1007
1008 static void hmp_ioport_read(Monitor *mon, const QDict *qdict)
1009 {
1010     int size = qdict_get_int(qdict, "size");
1011     int addr = qdict_get_int(qdict, "addr");
1012     int has_index = qdict_haskey(qdict, "index");
1013     uint32_t val;
1014     int suffix;
1015
1016     if (has_index) {
1017         int index = qdict_get_int(qdict, "index");
1018         cpu_outb(addr & IOPORTS_MASK, index & 0xff);
1019         addr++;
1020     }
1021     addr &= 0xffff;
1022
1023     switch(size) {
1024     default:
1025     case 1:
1026         val = cpu_inb(addr);
1027         suffix = 'b';
1028         break;
1029     case 2:
1030         val = cpu_inw(addr);
1031         suffix = 'w';
1032         break;
1033     case 4:
1034         val = cpu_inl(addr);
1035         suffix = 'l';
1036         break;
1037     }
1038     monitor_printf(mon, "port%c[0x%04x] = %#0*x\n",
1039                    suffix, addr, size * 2, val);
1040 }
1041
1042 static void hmp_ioport_write(Monitor *mon, const QDict *qdict)
1043 {
1044     int size = qdict_get_int(qdict, "size");
1045     int addr = qdict_get_int(qdict, "addr");
1046     int val = qdict_get_int(qdict, "val");
1047
1048     addr &= IOPORTS_MASK;
1049
1050     switch (size) {
1051     default:
1052     case 1:
1053         cpu_outb(addr, val);
1054         break;
1055     case 2:
1056         cpu_outw(addr, val);
1057         break;
1058     case 4:
1059         cpu_outl(addr, val);
1060         break;
1061     }
1062 }
1063
1064 static void hmp_boot_set(Monitor *mon, const QDict *qdict)
1065 {
1066     Error *local_err = NULL;
1067     const char *bootdevice = qdict_get_str(qdict, "bootdevice");
1068
1069     qemu_boot_set(bootdevice, &local_err);
1070     if (local_err) {
1071         error_report_err(local_err);
1072     } else {
1073         monitor_printf(mon, "boot device list now set to %s\n", bootdevice);
1074     }
1075 }
1076
1077 static void hmp_info_mtree(Monitor *mon, const QDict *qdict)
1078 {
1079     bool flatview = qdict_get_try_bool(qdict, "flatview", false);
1080     bool dispatch_tree = qdict_get_try_bool(qdict, "dispatch_tree", false);
1081     bool owner = qdict_get_try_bool(qdict, "owner", false);
1082
1083     mtree_info(flatview, dispatch_tree, owner);
1084 }
1085
1086 #ifdef CONFIG_PROFILER
1087
1088 int64_t dev_time;
1089
1090 static void hmp_info_profile(Monitor *mon, const QDict *qdict)
1091 {
1092     static int64_t last_cpu_exec_time;
1093     int64_t cpu_exec_time;
1094     int64_t delta;
1095
1096     cpu_exec_time = tcg_cpu_exec_time();
1097     delta = cpu_exec_time - last_cpu_exec_time;
1098
1099     monitor_printf(mon, "async time  %" PRId64 " (%0.3f)\n",
1100                    dev_time, dev_time / (double)NANOSECONDS_PER_SECOND);
1101     monitor_printf(mon, "qemu time   %" PRId64 " (%0.3f)\n",
1102                    delta, delta / (double)NANOSECONDS_PER_SECOND);
1103     last_cpu_exec_time = cpu_exec_time;
1104     dev_time = 0;
1105 }
1106 #else
1107 static void hmp_info_profile(Monitor *mon, const QDict *qdict)
1108 {
1109     monitor_printf(mon, "Internal profiler not compiled\n");
1110 }
1111 #endif
1112
1113 /* Capture support */
1114 static QLIST_HEAD (capture_list_head, CaptureState) capture_head;
1115
1116 static void hmp_info_capture(Monitor *mon, const QDict *qdict)
1117 {
1118     int i;
1119     CaptureState *s;
1120
1121     for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) {
1122         monitor_printf(mon, "[%d]: ", i);
1123         s->ops.info (s->opaque);
1124     }
1125 }
1126
1127 static void hmp_stopcapture(Monitor *mon, const QDict *qdict)
1128 {
1129     int i;
1130     int n = qdict_get_int(qdict, "n");
1131     CaptureState *s;
1132
1133     for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) {
1134         if (i == n) {
1135             s->ops.destroy (s->opaque);
1136             QLIST_REMOVE (s, entries);
1137             g_free (s);
1138             return;
1139         }
1140     }
1141 }
1142
1143 static void hmp_wavcapture(Monitor *mon, const QDict *qdict)
1144 {
1145     const char *path = qdict_get_str(qdict, "path");
1146     int freq = qdict_get_try_int(qdict, "freq", 44100);
1147     int bits = qdict_get_try_int(qdict, "bits", 16);
1148     int nchannels = qdict_get_try_int(qdict, "nchannels", 2);
1149     const char *audiodev = qdict_get_str(qdict, "audiodev");
1150     CaptureState *s;
1151     AudioState *as = audio_state_by_name(audiodev);
1152
1153     if (!as) {
1154         monitor_printf(mon, "Audiodev '%s' not found\n", audiodev);
1155         return;
1156     }
1157
1158     s = g_malloc0 (sizeof (*s));
1159
1160     if (wav_start_capture(as, s, path, freq, bits, nchannels)) {
1161         monitor_printf(mon, "Failed to add wave capture\n");
1162         g_free (s);
1163         return;
1164     }
1165     QLIST_INSERT_HEAD (&capture_head, s, entries);
1166 }
1167
1168 static QAuthZList *find_auth(Monitor *mon, const char *name)
1169 {
1170     Object *obj;
1171     Object *container;
1172
1173     container = object_get_objects_root();
1174     obj = object_resolve_path_component(container, name);
1175     if (!obj) {
1176         monitor_printf(mon, "acl: unknown list '%s'\n", name);
1177         return NULL;
1178     }
1179
1180     return QAUTHZ_LIST(obj);
1181 }
1182
1183 static bool warn_acl;
1184 static void hmp_warn_acl(void)
1185 {
1186     if (warn_acl) {
1187         return;
1188     }
1189     error_report("The acl_show, acl_reset, acl_policy, acl_add, acl_remove "
1190                  "commands are deprecated with no replacement. Authorization "
1191                  "for VNC should be performed using the pluggable QAuthZ "
1192                  "objects");
1193     warn_acl = true;
1194 }
1195
1196 static void hmp_acl_show(Monitor *mon, const QDict *qdict)
1197 {
1198     const char *aclname = qdict_get_str(qdict, "aclname");
1199     QAuthZList *auth = find_auth(mon, aclname);
1200     QAuthZListRuleList *rules;
1201     size_t i = 0;
1202
1203     hmp_warn_acl();
1204
1205     if (!auth) {
1206         return;
1207     }
1208
1209     monitor_printf(mon, "policy: %s\n",
1210                    QAuthZListPolicy_str(auth->policy));
1211
1212     rules = auth->rules;
1213     while (rules) {
1214         QAuthZListRule *rule = rules->value;
1215         i++;
1216         monitor_printf(mon, "%zu: %s %s\n", i,
1217                        QAuthZListPolicy_str(rule->policy),
1218                        rule->match);
1219         rules = rules->next;
1220     }
1221 }
1222
1223 static void hmp_acl_reset(Monitor *mon, const QDict *qdict)
1224 {
1225     const char *aclname = qdict_get_str(qdict, "aclname");
1226     QAuthZList *auth = find_auth(mon, aclname);
1227
1228     hmp_warn_acl();
1229
1230     if (!auth) {
1231         return;
1232     }
1233
1234     auth->policy = QAUTHZ_LIST_POLICY_DENY;
1235     qapi_free_QAuthZListRuleList(auth->rules);
1236     auth->rules = NULL;
1237     monitor_printf(mon, "acl: removed all rules\n");
1238 }
1239
1240 static void hmp_acl_policy(Monitor *mon, const QDict *qdict)
1241 {
1242     const char *aclname = qdict_get_str(qdict, "aclname");
1243     const char *policy = qdict_get_str(qdict, "policy");
1244     QAuthZList *auth = find_auth(mon, aclname);
1245     int val;
1246     Error *err = NULL;
1247
1248     hmp_warn_acl();
1249
1250     if (!auth) {
1251         return;
1252     }
1253
1254     val = qapi_enum_parse(&QAuthZListPolicy_lookup,
1255                           policy,
1256                           QAUTHZ_LIST_POLICY_DENY,
1257                           &err);
1258     if (err) {
1259         error_free(err);
1260         monitor_printf(mon, "acl: unknown policy '%s', "
1261                        "expected 'deny' or 'allow'\n", policy);
1262     } else {
1263         auth->policy = val;
1264         if (auth->policy == QAUTHZ_LIST_POLICY_ALLOW) {
1265             monitor_printf(mon, "acl: policy set to 'allow'\n");
1266         } else {
1267             monitor_printf(mon, "acl: policy set to 'deny'\n");
1268         }
1269     }
1270 }
1271
1272 static QAuthZListFormat hmp_acl_get_format(const char *match)
1273 {
1274     if (strchr(match, '*')) {
1275         return QAUTHZ_LIST_FORMAT_GLOB;
1276     } else {
1277         return QAUTHZ_LIST_FORMAT_EXACT;
1278     }
1279 }
1280
1281 static void hmp_acl_add(Monitor *mon, const QDict *qdict)
1282 {
1283     const char *aclname = qdict_get_str(qdict, "aclname");
1284     const char *match = qdict_get_str(qdict, "match");
1285     const char *policystr = qdict_get_str(qdict, "policy");
1286     int has_index = qdict_haskey(qdict, "index");
1287     int index = qdict_get_try_int(qdict, "index", -1);
1288     QAuthZList *auth = find_auth(mon, aclname);
1289     Error *err = NULL;
1290     QAuthZListPolicy policy;
1291     QAuthZListFormat format;
1292     size_t i = 0;
1293
1294     hmp_warn_acl();
1295
1296     if (!auth) {
1297         return;
1298     }
1299
1300     policy = qapi_enum_parse(&QAuthZListPolicy_lookup,
1301                              policystr,
1302                              QAUTHZ_LIST_POLICY_DENY,
1303                              &err);
1304     if (err) {
1305         error_free(err);
1306         monitor_printf(mon, "acl: unknown policy '%s', "
1307                        "expected 'deny' or 'allow'\n", policystr);
1308         return;
1309     }
1310
1311     format = hmp_acl_get_format(match);
1312
1313     if (has_index && index == 0) {
1314         monitor_printf(mon, "acl: unable to add acl entry\n");
1315         return;
1316     }
1317
1318     if (has_index) {
1319         i = qauthz_list_insert_rule(auth, match, policy,
1320                                     format, index - 1, &err);
1321     } else {
1322         i = qauthz_list_append_rule(auth, match, policy,
1323                                     format, &err);
1324     }
1325     if (err) {
1326         monitor_printf(mon, "acl: unable to add rule: %s",
1327                        error_get_pretty(err));
1328         error_free(err);
1329     } else {
1330         monitor_printf(mon, "acl: added rule at position %zu\n", i + 1);
1331     }
1332 }
1333
1334 static void hmp_acl_remove(Monitor *mon, const QDict *qdict)
1335 {
1336     const char *aclname = qdict_get_str(qdict, "aclname");
1337     const char *match = qdict_get_str(qdict, "match");
1338     QAuthZList *auth = find_auth(mon, aclname);
1339     ssize_t i = 0;
1340
1341     hmp_warn_acl();
1342
1343     if (!auth) {
1344         return;
1345     }
1346
1347     i = qauthz_list_delete_rule(auth, match);
1348     if (i >= 0) {
1349         monitor_printf(mon, "acl: removed rule at position %zu\n", i + 1);
1350     } else {
1351         monitor_printf(mon, "acl: no matching acl entry\n");
1352     }
1353 }
1354
1355 void qmp_getfd(const char *fdname, Error **errp)
1356 {
1357     mon_fd_t *monfd;
1358     int fd, tmp_fd;
1359
1360     fd = qemu_chr_fe_get_msgfd(&cur_mon->chr);
1361     if (fd == -1) {
1362         error_setg(errp, QERR_FD_NOT_SUPPLIED);
1363         return;
1364     }
1365
1366     if (qemu_isdigit(fdname[0])) {
1367         close(fd);
1368         error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "fdname",
1369                    "a name not starting with a digit");
1370         return;
1371     }
1372
1373     qemu_mutex_lock(&cur_mon->mon_lock);
1374     QLIST_FOREACH(monfd, &cur_mon->fds, next) {
1375         if (strcmp(monfd->name, fdname) != 0) {
1376             continue;
1377         }
1378
1379         tmp_fd = monfd->fd;
1380         monfd->fd = fd;
1381         qemu_mutex_unlock(&cur_mon->mon_lock);
1382         /* Make sure close() is outside critical section */
1383         close(tmp_fd);
1384         return;
1385     }
1386
1387     monfd = g_malloc0(sizeof(mon_fd_t));
1388     monfd->name = g_strdup(fdname);
1389     monfd->fd = fd;
1390
1391     QLIST_INSERT_HEAD(&cur_mon->fds, monfd, next);
1392     qemu_mutex_unlock(&cur_mon->mon_lock);
1393 }
1394
1395 void qmp_closefd(const char *fdname, Error **errp)
1396 {
1397     mon_fd_t *monfd;
1398     int tmp_fd;
1399
1400     qemu_mutex_lock(&cur_mon->mon_lock);
1401     QLIST_FOREACH(monfd, &cur_mon->fds, next) {
1402         if (strcmp(monfd->name, fdname) != 0) {
1403             continue;
1404         }
1405
1406         QLIST_REMOVE(monfd, next);
1407         tmp_fd = monfd->fd;
1408         g_free(monfd->name);
1409         g_free(monfd);
1410         qemu_mutex_unlock(&cur_mon->mon_lock);
1411         /* Make sure close() is outside critical section */
1412         close(tmp_fd);
1413         return;
1414     }
1415
1416     qemu_mutex_unlock(&cur_mon->mon_lock);
1417     error_setg(errp, QERR_FD_NOT_FOUND, fdname);
1418 }
1419
1420 int monitor_get_fd(Monitor *mon, const char *fdname, Error **errp)
1421 {
1422     mon_fd_t *monfd;
1423
1424     qemu_mutex_lock(&mon->mon_lock);
1425     QLIST_FOREACH(monfd, &mon->fds, next) {
1426         int fd;
1427
1428         if (strcmp(monfd->name, fdname) != 0) {
1429             continue;
1430         }
1431
1432         fd = monfd->fd;
1433
1434         /* caller takes ownership of fd */
1435         QLIST_REMOVE(monfd, next);
1436         g_free(monfd->name);
1437         g_free(monfd);
1438         qemu_mutex_unlock(&mon->mon_lock);
1439
1440         return fd;
1441     }
1442
1443     qemu_mutex_unlock(&mon->mon_lock);
1444     error_setg(errp, "File descriptor named '%s' has not been found", fdname);
1445     return -1;
1446 }
1447
1448 static void monitor_fdset_cleanup(MonFdset *mon_fdset)
1449 {
1450     MonFdsetFd *mon_fdset_fd;
1451     MonFdsetFd *mon_fdset_fd_next;
1452
1453     QLIST_FOREACH_SAFE(mon_fdset_fd, &mon_fdset->fds, next, mon_fdset_fd_next) {
1454         if ((mon_fdset_fd->removed ||
1455                 (QLIST_EMPTY(&mon_fdset->dup_fds) && mon_refcount == 0)) &&
1456                 runstate_is_running()) {
1457             close(mon_fdset_fd->fd);
1458             g_free(mon_fdset_fd->opaque);
1459             QLIST_REMOVE(mon_fdset_fd, next);
1460             g_free(mon_fdset_fd);
1461         }
1462     }
1463
1464     if (QLIST_EMPTY(&mon_fdset->fds) && QLIST_EMPTY(&mon_fdset->dup_fds)) {
1465         QLIST_REMOVE(mon_fdset, next);
1466         g_free(mon_fdset);
1467     }
1468 }
1469
1470 void monitor_fdsets_cleanup(void)
1471 {
1472     MonFdset *mon_fdset;
1473     MonFdset *mon_fdset_next;
1474
1475     qemu_mutex_lock(&mon_fdsets_lock);
1476     QLIST_FOREACH_SAFE(mon_fdset, &mon_fdsets, next, mon_fdset_next) {
1477         monitor_fdset_cleanup(mon_fdset);
1478     }
1479     qemu_mutex_unlock(&mon_fdsets_lock);
1480 }
1481
1482 AddfdInfo *qmp_add_fd(bool has_fdset_id, int64_t fdset_id, bool has_opaque,
1483                       const char *opaque, Error **errp)
1484 {
1485     int fd;
1486     Monitor *mon = cur_mon;
1487     AddfdInfo *fdinfo;
1488
1489     fd = qemu_chr_fe_get_msgfd(&mon->chr);
1490     if (fd == -1) {
1491         error_setg(errp, QERR_FD_NOT_SUPPLIED);
1492         goto error;
1493     }
1494
1495     fdinfo = monitor_fdset_add_fd(fd, has_fdset_id, fdset_id,
1496                                   has_opaque, opaque, errp);
1497     if (fdinfo) {
1498         return fdinfo;
1499     }
1500
1501 error:
1502     if (fd != -1) {
1503         close(fd);
1504     }
1505     return NULL;
1506 }
1507
1508 void qmp_remove_fd(int64_t fdset_id, bool has_fd, int64_t fd, Error **errp)
1509 {
1510     MonFdset *mon_fdset;
1511     MonFdsetFd *mon_fdset_fd;
1512     char fd_str[60];
1513
1514     qemu_mutex_lock(&mon_fdsets_lock);
1515     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1516         if (mon_fdset->id != fdset_id) {
1517             continue;
1518         }
1519         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1520             if (has_fd) {
1521                 if (mon_fdset_fd->fd != fd) {
1522                     continue;
1523                 }
1524                 mon_fdset_fd->removed = true;
1525                 break;
1526             } else {
1527                 mon_fdset_fd->removed = true;
1528             }
1529         }
1530         if (has_fd && !mon_fdset_fd) {
1531             goto error;
1532         }
1533         monitor_fdset_cleanup(mon_fdset);
1534         qemu_mutex_unlock(&mon_fdsets_lock);
1535         return;
1536     }
1537
1538 error:
1539     qemu_mutex_unlock(&mon_fdsets_lock);
1540     if (has_fd) {
1541         snprintf(fd_str, sizeof(fd_str), "fdset-id:%" PRId64 ", fd:%" PRId64,
1542                  fdset_id, fd);
1543     } else {
1544         snprintf(fd_str, sizeof(fd_str), "fdset-id:%" PRId64, fdset_id);
1545     }
1546     error_setg(errp, QERR_FD_NOT_FOUND, fd_str);
1547 }
1548
1549 FdsetInfoList *qmp_query_fdsets(Error **errp)
1550 {
1551     MonFdset *mon_fdset;
1552     MonFdsetFd *mon_fdset_fd;
1553     FdsetInfoList *fdset_list = NULL;
1554
1555     qemu_mutex_lock(&mon_fdsets_lock);
1556     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1557         FdsetInfoList *fdset_info = g_malloc0(sizeof(*fdset_info));
1558         FdsetFdInfoList *fdsetfd_list = NULL;
1559
1560         fdset_info->value = g_malloc0(sizeof(*fdset_info->value));
1561         fdset_info->value->fdset_id = mon_fdset->id;
1562
1563         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1564             FdsetFdInfoList *fdsetfd_info;
1565
1566             fdsetfd_info = g_malloc0(sizeof(*fdsetfd_info));
1567             fdsetfd_info->value = g_malloc0(sizeof(*fdsetfd_info->value));
1568             fdsetfd_info->value->fd = mon_fdset_fd->fd;
1569             if (mon_fdset_fd->opaque) {
1570                 fdsetfd_info->value->has_opaque = true;
1571                 fdsetfd_info->value->opaque = g_strdup(mon_fdset_fd->opaque);
1572             } else {
1573                 fdsetfd_info->value->has_opaque = false;
1574             }
1575
1576             fdsetfd_info->next = fdsetfd_list;
1577             fdsetfd_list = fdsetfd_info;
1578         }
1579
1580         fdset_info->value->fds = fdsetfd_list;
1581
1582         fdset_info->next = fdset_list;
1583         fdset_list = fdset_info;
1584     }
1585     qemu_mutex_unlock(&mon_fdsets_lock);
1586
1587     return fdset_list;
1588 }
1589
1590 AddfdInfo *monitor_fdset_add_fd(int fd, bool has_fdset_id, int64_t fdset_id,
1591                                 bool has_opaque, const char *opaque,
1592                                 Error **errp)
1593 {
1594     MonFdset *mon_fdset = NULL;
1595     MonFdsetFd *mon_fdset_fd;
1596     AddfdInfo *fdinfo;
1597
1598     qemu_mutex_lock(&mon_fdsets_lock);
1599     if (has_fdset_id) {
1600         QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1601             /* Break if match found or match impossible due to ordering by ID */
1602             if (fdset_id <= mon_fdset->id) {
1603                 if (fdset_id < mon_fdset->id) {
1604                     mon_fdset = NULL;
1605                 }
1606                 break;
1607             }
1608         }
1609     }
1610
1611     if (mon_fdset == NULL) {
1612         int64_t fdset_id_prev = -1;
1613         MonFdset *mon_fdset_cur = QLIST_FIRST(&mon_fdsets);
1614
1615         if (has_fdset_id) {
1616             if (fdset_id < 0) {
1617                 error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "fdset-id",
1618                            "a non-negative value");
1619                 qemu_mutex_unlock(&mon_fdsets_lock);
1620                 return NULL;
1621             }
1622             /* Use specified fdset ID */
1623             QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1624                 mon_fdset_cur = mon_fdset;
1625                 if (fdset_id < mon_fdset_cur->id) {
1626                     break;
1627                 }
1628             }
1629         } else {
1630             /* Use first available fdset ID */
1631             QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1632                 mon_fdset_cur = mon_fdset;
1633                 if (fdset_id_prev == mon_fdset_cur->id - 1) {
1634                     fdset_id_prev = mon_fdset_cur->id;
1635                     continue;
1636                 }
1637                 break;
1638             }
1639         }
1640
1641         mon_fdset = g_malloc0(sizeof(*mon_fdset));
1642         if (has_fdset_id) {
1643             mon_fdset->id = fdset_id;
1644         } else {
1645             mon_fdset->id = fdset_id_prev + 1;
1646         }
1647
1648         /* The fdset list is ordered by fdset ID */
1649         if (!mon_fdset_cur) {
1650             QLIST_INSERT_HEAD(&mon_fdsets, mon_fdset, next);
1651         } else if (mon_fdset->id < mon_fdset_cur->id) {
1652             QLIST_INSERT_BEFORE(mon_fdset_cur, mon_fdset, next);
1653         } else {
1654             QLIST_INSERT_AFTER(mon_fdset_cur, mon_fdset, next);
1655         }
1656     }
1657
1658     mon_fdset_fd = g_malloc0(sizeof(*mon_fdset_fd));
1659     mon_fdset_fd->fd = fd;
1660     mon_fdset_fd->removed = false;
1661     if (has_opaque) {
1662         mon_fdset_fd->opaque = g_strdup(opaque);
1663     }
1664     QLIST_INSERT_HEAD(&mon_fdset->fds, mon_fdset_fd, next);
1665
1666     fdinfo = g_malloc0(sizeof(*fdinfo));
1667     fdinfo->fdset_id = mon_fdset->id;
1668     fdinfo->fd = mon_fdset_fd->fd;
1669
1670     qemu_mutex_unlock(&mon_fdsets_lock);
1671     return fdinfo;
1672 }
1673
1674 int monitor_fdset_get_fd(int64_t fdset_id, int flags)
1675 {
1676 #ifdef _WIN32
1677     return -ENOENT;
1678 #else
1679     MonFdset *mon_fdset;
1680     MonFdsetFd *mon_fdset_fd;
1681     int mon_fd_flags;
1682     int ret;
1683
1684     qemu_mutex_lock(&mon_fdsets_lock);
1685     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1686         if (mon_fdset->id != fdset_id) {
1687             continue;
1688         }
1689         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1690             mon_fd_flags = fcntl(mon_fdset_fd->fd, F_GETFL);
1691             if (mon_fd_flags == -1) {
1692                 ret = -errno;
1693                 goto out;
1694             }
1695
1696             if ((flags & O_ACCMODE) == (mon_fd_flags & O_ACCMODE)) {
1697                 ret = mon_fdset_fd->fd;
1698                 goto out;
1699             }
1700         }
1701         ret = -EACCES;
1702         goto out;
1703     }
1704     ret = -ENOENT;
1705
1706 out:
1707     qemu_mutex_unlock(&mon_fdsets_lock);
1708     return ret;
1709 #endif
1710 }
1711
1712 int monitor_fdset_dup_fd_add(int64_t fdset_id, int dup_fd)
1713 {
1714     MonFdset *mon_fdset;
1715     MonFdsetFd *mon_fdset_fd_dup;
1716
1717     qemu_mutex_lock(&mon_fdsets_lock);
1718     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1719         if (mon_fdset->id != fdset_id) {
1720             continue;
1721         }
1722         QLIST_FOREACH(mon_fdset_fd_dup, &mon_fdset->dup_fds, next) {
1723             if (mon_fdset_fd_dup->fd == dup_fd) {
1724                 goto err;
1725             }
1726         }
1727         mon_fdset_fd_dup = g_malloc0(sizeof(*mon_fdset_fd_dup));
1728         mon_fdset_fd_dup->fd = dup_fd;
1729         QLIST_INSERT_HEAD(&mon_fdset->dup_fds, mon_fdset_fd_dup, next);
1730         qemu_mutex_unlock(&mon_fdsets_lock);
1731         return 0;
1732     }
1733
1734 err:
1735     qemu_mutex_unlock(&mon_fdsets_lock);
1736     return -1;
1737 }
1738
1739 static int64_t monitor_fdset_dup_fd_find_remove(int dup_fd, bool remove)
1740 {
1741     MonFdset *mon_fdset;
1742     MonFdsetFd *mon_fdset_fd_dup;
1743
1744     qemu_mutex_lock(&mon_fdsets_lock);
1745     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1746         QLIST_FOREACH(mon_fdset_fd_dup, &mon_fdset->dup_fds, next) {
1747             if (mon_fdset_fd_dup->fd == dup_fd) {
1748                 if (remove) {
1749                     QLIST_REMOVE(mon_fdset_fd_dup, next);
1750                     if (QLIST_EMPTY(&mon_fdset->dup_fds)) {
1751                         monitor_fdset_cleanup(mon_fdset);
1752                     }
1753                     goto err;
1754                 } else {
1755                     qemu_mutex_unlock(&mon_fdsets_lock);
1756                     return mon_fdset->id;
1757                 }
1758             }
1759         }
1760     }
1761
1762 err:
1763     qemu_mutex_unlock(&mon_fdsets_lock);
1764     return -1;
1765 }
1766
1767 int64_t monitor_fdset_dup_fd_find(int dup_fd)
1768 {
1769     return monitor_fdset_dup_fd_find_remove(dup_fd, false);
1770 }
1771
1772 void monitor_fdset_dup_fd_remove(int dup_fd)
1773 {
1774     monitor_fdset_dup_fd_find_remove(dup_fd, true);
1775 }
1776
1777 int monitor_fd_param(Monitor *mon, const char *fdname, Error **errp)
1778 {
1779     int fd;
1780     Error *local_err = NULL;
1781
1782     if (!qemu_isdigit(fdname[0]) && mon) {
1783         fd = monitor_get_fd(mon, fdname, &local_err);
1784     } else {
1785         fd = qemu_parse_fd(fdname);
1786         if (fd == -1) {
1787             error_setg(&local_err, "Invalid file descriptor number '%s'",
1788                        fdname);
1789         }
1790     }
1791     if (local_err) {
1792         error_propagate(errp, local_err);
1793         assert(fd == -1);
1794     } else {
1795         assert(fd != -1);
1796     }
1797
1798     return fd;
1799 }
1800
1801 /* Please update hmp-commands.hx when adding or changing commands */
1802 static HMPCommand hmp_info_cmds[] = {
1803 #include "hmp-commands-info.h"
1804     { NULL, NULL, },
1805 };
1806
1807 /* hmp_cmds and hmp_info_cmds would be sorted at runtime */
1808 HMPCommand hmp_cmds[] = {
1809 #include "hmp-commands.h"
1810     { NULL, NULL, },
1811 };
1812
1813 /*
1814  * Set @pval to the value in the register identified by @name.
1815  * return 0 if OK, -1 if not found
1816  */
1817 int get_monitor_def(int64_t *pval, const char *name)
1818 {
1819     const MonitorDef *md = target_monitor_defs();
1820     CPUState *cs = mon_get_cpu();
1821     void *ptr;
1822     uint64_t tmp = 0;
1823     int ret;
1824
1825     if (cs == NULL || md == NULL) {
1826         return -1;
1827     }
1828
1829     for(; md->name != NULL; md++) {
1830         if (hmp_compare_cmd(name, md->name)) {
1831             if (md->get_value) {
1832                 *pval = md->get_value(md, md->offset);
1833             } else {
1834                 CPUArchState *env = mon_get_cpu_env();
1835                 ptr = (uint8_t *)env + md->offset;
1836                 switch(md->type) {
1837                 case MD_I32:
1838                     *pval = *(int32_t *)ptr;
1839                     break;
1840                 case MD_TLONG:
1841                     *pval = *(target_long *)ptr;
1842                     break;
1843                 default:
1844                     *pval = 0;
1845                     break;
1846                 }
1847             }
1848             return 0;
1849         }
1850     }
1851
1852     ret = target_get_monitor_def(cs, name, &tmp);
1853     if (!ret) {
1854         *pval = (target_long) tmp;
1855     }
1856
1857     return ret;
1858 }
1859
1860 static void add_completion_option(ReadLineState *rs, const char *str,
1861                                   const char *option)
1862 {
1863     if (!str || !option) {
1864         return;
1865     }
1866     if (!strncmp(option, str, strlen(str))) {
1867         readline_add_completion(rs, option);
1868     }
1869 }
1870
1871 void chardev_add_completion(ReadLineState *rs, int nb_args, const char *str)
1872 {
1873     size_t len;
1874     ChardevBackendInfoList *list, *start;
1875
1876     if (nb_args != 2) {
1877         return;
1878     }
1879     len = strlen(str);
1880     readline_set_completion_index(rs, len);
1881
1882     start = list = qmp_query_chardev_backends(NULL);
1883     while (list) {
1884         const char *chr_name = list->value->name;
1885
1886         if (!strncmp(chr_name, str, len)) {
1887             readline_add_completion(rs, chr_name);
1888         }
1889         list = list->next;
1890     }
1891     qapi_free_ChardevBackendInfoList(start);
1892 }
1893
1894 void netdev_add_completion(ReadLineState *rs, int nb_args, const char *str)
1895 {
1896     size_t len;
1897     int i;
1898
1899     if (nb_args != 2) {
1900         return;
1901     }
1902     len = strlen(str);
1903     readline_set_completion_index(rs, len);
1904     for (i = 0; i < NET_CLIENT_DRIVER__MAX; i++) {
1905         add_completion_option(rs, str, NetClientDriver_str(i));
1906     }
1907 }
1908
1909 void device_add_completion(ReadLineState *rs, int nb_args, const char *str)
1910 {
1911     GSList *list, *elt;
1912     size_t len;
1913
1914     if (nb_args != 2) {
1915         return;
1916     }
1917
1918     len = strlen(str);
1919     readline_set_completion_index(rs, len);
1920     list = elt = object_class_get_list(TYPE_DEVICE, false);
1921     while (elt) {
1922         const char *name;
1923         DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, elt->data,
1924                                              TYPE_DEVICE);
1925         name = object_class_get_name(OBJECT_CLASS(dc));
1926
1927         if (dc->user_creatable
1928             && !strncmp(name, str, len)) {
1929             readline_add_completion(rs, name);
1930         }
1931         elt = elt->next;
1932     }
1933     g_slist_free(list);
1934 }
1935
1936 void object_add_completion(ReadLineState *rs, int nb_args, const char *str)
1937 {
1938     GSList *list, *elt;
1939     size_t len;
1940
1941     if (nb_args != 2) {
1942         return;
1943     }
1944
1945     len = strlen(str);
1946     readline_set_completion_index(rs, len);
1947     list = elt = object_class_get_list(TYPE_USER_CREATABLE, false);
1948     while (elt) {
1949         const char *name;
1950
1951         name = object_class_get_name(OBJECT_CLASS(elt->data));
1952         if (!strncmp(name, str, len) && strcmp(name, TYPE_USER_CREATABLE)) {
1953             readline_add_completion(rs, name);
1954         }
1955         elt = elt->next;
1956     }
1957     g_slist_free(list);
1958 }
1959
1960 static void peripheral_device_del_completion(ReadLineState *rs,
1961                                              const char *str, size_t len)
1962 {
1963     Object *peripheral = container_get(qdev_get_machine(), "/peripheral");
1964     GSList *list, *item;
1965
1966     list = qdev_build_hotpluggable_device_list(peripheral);
1967     if (!list) {
1968         return;
1969     }
1970
1971     for (item = list; item; item = g_slist_next(item)) {
1972         DeviceState *dev = item->data;
1973
1974         if (dev->id && !strncmp(str, dev->id, len)) {
1975             readline_add_completion(rs, dev->id);
1976         }
1977     }
1978
1979     g_slist_free(list);
1980 }
1981
1982 void chardev_remove_completion(ReadLineState *rs, int nb_args, const char *str)
1983 {
1984     size_t len;
1985     ChardevInfoList *list, *start;
1986
1987     if (nb_args != 2) {
1988         return;
1989     }
1990     len = strlen(str);
1991     readline_set_completion_index(rs, len);
1992
1993     start = list = qmp_query_chardev(NULL);
1994     while (list) {
1995         ChardevInfo *chr = list->value;
1996
1997         if (!strncmp(chr->label, str, len)) {
1998             readline_add_completion(rs, chr->label);
1999         }
2000         list = list->next;
2001     }
2002     qapi_free_ChardevInfoList(start);
2003 }
2004
2005 static void ringbuf_completion(ReadLineState *rs, const char *str)
2006 {
2007     size_t len;
2008     ChardevInfoList *list, *start;
2009
2010     len = strlen(str);
2011     readline_set_completion_index(rs, len);
2012
2013     start = list = qmp_query_chardev(NULL);
2014     while (list) {
2015         ChardevInfo *chr_info = list->value;
2016
2017         if (!strncmp(chr_info->label, str, len)) {
2018             Chardev *chr = qemu_chr_find(chr_info->label);
2019             if (chr && CHARDEV_IS_RINGBUF(chr)) {
2020                 readline_add_completion(rs, chr_info->label);
2021             }
2022         }
2023         list = list->next;
2024     }
2025     qapi_free_ChardevInfoList(start);
2026 }
2027
2028 void ringbuf_write_completion(ReadLineState *rs, int nb_args, const char *str)
2029 {
2030     if (nb_args != 2) {
2031         return;
2032     }
2033     ringbuf_completion(rs, str);
2034 }
2035
2036 void device_del_completion(ReadLineState *rs, int nb_args, const char *str)
2037 {
2038     size_t len;
2039
2040     if (nb_args != 2) {
2041         return;
2042     }
2043
2044     len = strlen(str);
2045     readline_set_completion_index(rs, len);
2046     peripheral_device_del_completion(rs, str, len);
2047 }
2048
2049 void object_del_completion(ReadLineState *rs, int nb_args, const char *str)
2050 {
2051     ObjectPropertyInfoList *list, *start;
2052     size_t len;
2053
2054     if (nb_args != 2) {
2055         return;
2056     }
2057     len = strlen(str);
2058     readline_set_completion_index(rs, len);
2059
2060     start = list = qmp_qom_list("/objects", NULL);
2061     while (list) {
2062         ObjectPropertyInfo *info = list->value;
2063
2064         if (!strncmp(info->type, "child<", 5)
2065             && !strncmp(info->name, str, len)) {
2066             readline_add_completion(rs, info->name);
2067         }
2068         list = list->next;
2069     }
2070     qapi_free_ObjectPropertyInfoList(start);
2071 }
2072
2073 void sendkey_completion(ReadLineState *rs, int nb_args, const char *str)
2074 {
2075     int i;
2076     char *sep;
2077     size_t len;
2078
2079     if (nb_args != 2) {
2080         return;
2081     }
2082     sep = strrchr(str, '-');
2083     if (sep) {
2084         str = sep + 1;
2085     }
2086     len = strlen(str);
2087     readline_set_completion_index(rs, len);
2088     for (i = 0; i < Q_KEY_CODE__MAX; i++) {
2089         if (!strncmp(str, QKeyCode_str(i), len)) {
2090             readline_add_completion(rs, QKeyCode_str(i));
2091         }
2092     }
2093 }
2094
2095 void set_link_completion(ReadLineState *rs, int nb_args, const char *str)
2096 {
2097     size_t len;
2098
2099     len = strlen(str);
2100     readline_set_completion_index(rs, len);
2101     if (nb_args == 2) {
2102         NetClientState *ncs[MAX_QUEUE_NUM];
2103         int count, i;
2104         count = qemu_find_net_clients_except(NULL, ncs,
2105                                              NET_CLIENT_DRIVER_NONE,
2106                                              MAX_QUEUE_NUM);
2107         for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
2108             const char *name = ncs[i]->name;
2109             if (!strncmp(str, name, len)) {
2110                 readline_add_completion(rs, name);
2111             }
2112         }
2113     } else if (nb_args == 3) {
2114         add_completion_option(rs, str, "on");
2115         add_completion_option(rs, str, "off");
2116     }
2117 }
2118
2119 void netdev_del_completion(ReadLineState *rs, int nb_args, const char *str)
2120 {
2121     int len, count, i;
2122     NetClientState *ncs[MAX_QUEUE_NUM];
2123
2124     if (nb_args != 2) {
2125         return;
2126     }
2127
2128     len = strlen(str);
2129     readline_set_completion_index(rs, len);
2130     count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_DRIVER_NIC,
2131                                          MAX_QUEUE_NUM);
2132     for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
2133         QemuOpts *opts;
2134         const char *name = ncs[i]->name;
2135         if (strncmp(str, name, len)) {
2136             continue;
2137         }
2138         opts = qemu_opts_find(qemu_find_opts_err("netdev", NULL), name);
2139         if (opts) {
2140             readline_add_completion(rs, name);
2141         }
2142     }
2143 }
2144
2145 void info_trace_events_completion(ReadLineState *rs, int nb_args, const char *str)
2146 {
2147     size_t len;
2148
2149     len = strlen(str);
2150     readline_set_completion_index(rs, len);
2151     if (nb_args == 2) {
2152         TraceEventIter iter;
2153         TraceEvent *ev;
2154         char *pattern = g_strdup_printf("%s*", str);
2155         trace_event_iter_init(&iter, pattern);
2156         while ((ev = trace_event_iter_next(&iter)) != NULL) {
2157             readline_add_completion(rs, trace_event_get_name(ev));
2158         }
2159         g_free(pattern);
2160     }
2161 }
2162
2163 void trace_event_completion(ReadLineState *rs, int nb_args, const char *str)
2164 {
2165     size_t len;
2166
2167     len = strlen(str);
2168     readline_set_completion_index(rs, len);
2169     if (nb_args == 2) {
2170         TraceEventIter iter;
2171         TraceEvent *ev;
2172         char *pattern = g_strdup_printf("%s*", str);
2173         trace_event_iter_init(&iter, pattern);
2174         while ((ev = trace_event_iter_next(&iter)) != NULL) {
2175             readline_add_completion(rs, trace_event_get_name(ev));
2176         }
2177         g_free(pattern);
2178     } else if (nb_args == 3) {
2179         add_completion_option(rs, str, "on");
2180         add_completion_option(rs, str, "off");
2181     }
2182 }
2183
2184 void watchdog_action_completion(ReadLineState *rs, int nb_args, const char *str)
2185 {
2186     int i;
2187
2188     if (nb_args != 2) {
2189         return;
2190     }
2191     readline_set_completion_index(rs, strlen(str));
2192     for (i = 0; i < WATCHDOG_ACTION__MAX; i++) {
2193         add_completion_option(rs, str, WatchdogAction_str(i));
2194     }
2195 }
2196
2197 void migrate_set_capability_completion(ReadLineState *rs, int nb_args,
2198                                        const char *str)
2199 {
2200     size_t len;
2201
2202     len = strlen(str);
2203     readline_set_completion_index(rs, len);
2204     if (nb_args == 2) {
2205         int i;
2206         for (i = 0; i < MIGRATION_CAPABILITY__MAX; i++) {
2207             const char *name = MigrationCapability_str(i);
2208             if (!strncmp(str, name, len)) {
2209                 readline_add_completion(rs, name);
2210             }
2211         }
2212     } else if (nb_args == 3) {
2213         add_completion_option(rs, str, "on");
2214         add_completion_option(rs, str, "off");
2215     }
2216 }
2217
2218 void migrate_set_parameter_completion(ReadLineState *rs, int nb_args,
2219                                       const char *str)
2220 {
2221     size_t len;
2222
2223     len = strlen(str);
2224     readline_set_completion_index(rs, len);
2225     if (nb_args == 2) {
2226         int i;
2227         for (i = 0; i < MIGRATION_PARAMETER__MAX; i++) {
2228             const char *name = MigrationParameter_str(i);
2229             if (!strncmp(str, name, len)) {
2230                 readline_add_completion(rs, name);
2231             }
2232         }
2233     }
2234 }
2235
2236 static void vm_completion(ReadLineState *rs, const char *str)
2237 {
2238     size_t len;
2239     BlockDriverState *bs;
2240     BdrvNextIterator it;
2241
2242     len = strlen(str);
2243     readline_set_completion_index(rs, len);
2244
2245     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
2246         SnapshotInfoList *snapshots, *snapshot;
2247         AioContext *ctx = bdrv_get_aio_context(bs);
2248         bool ok = false;
2249
2250         aio_context_acquire(ctx);
2251         if (bdrv_can_snapshot(bs)) {
2252             ok = bdrv_query_snapshot_info_list(bs, &snapshots, NULL) == 0;
2253         }
2254         aio_context_release(ctx);
2255         if (!ok) {
2256             continue;
2257         }
2258
2259         snapshot = snapshots;
2260         while (snapshot) {
2261             char *completion = snapshot->value->name;
2262             if (!strncmp(str, completion, len)) {
2263                 readline_add_completion(rs, completion);
2264             }
2265             completion = snapshot->value->id;
2266             if (!strncmp(str, completion, len)) {
2267                 readline_add_completion(rs, completion);
2268             }
2269             snapshot = snapshot->next;
2270         }
2271         qapi_free_SnapshotInfoList(snapshots);
2272     }
2273
2274 }
2275
2276 void delvm_completion(ReadLineState *rs, int nb_args, const char *str)
2277 {
2278     if (nb_args == 2) {
2279         vm_completion(rs, str);
2280     }
2281 }
2282
2283 void loadvm_completion(ReadLineState *rs, int nb_args, const char *str)
2284 {
2285     if (nb_args == 2) {
2286         vm_completion(rs, str);
2287     }
2288 }
2289
2290 static int
2291 compare_mon_cmd(const void *a, const void *b)
2292 {
2293     return strcmp(((const HMPCommand *)a)->name,
2294             ((const HMPCommand *)b)->name);
2295 }
2296
2297 static void sortcmdlist(void)
2298 {
2299     qsort(hmp_cmds, ARRAY_SIZE(hmp_cmds) - 1,
2300           sizeof(*hmp_cmds),
2301           compare_mon_cmd);
2302     qsort(hmp_info_cmds, ARRAY_SIZE(hmp_info_cmds) - 1,
2303           sizeof(*hmp_info_cmds),
2304           compare_mon_cmd);
2305 }
2306
2307 void monitor_init_globals(void)
2308 {
2309     monitor_init_globals_core();
2310     monitor_init_qmp_commands();
2311     sortcmdlist();
2312     qemu_mutex_init(&mon_fdsets_lock);
2313 }