monitor/misc.c

   1 /*
   2  * QEMU monitor
   3  *
   4  * Copyright (c) 2003-2004 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26 #include "monitor-internal.h"
  27 #include "monitor/qdev.h"
  28 #include "hw/usb.h"
  29 #include "hw/pci/pci.h"
  30 #include "sysemu/watchdog.h"
  31 #include "hw/loader.h"
  32 #include "exec/gdbstub.h"
  33 #include "net/net.h"
  34 #include "net/slirp.h"
  35 #include "ui/qemu-spice.h"
  36 #include "qemu/config-file.h"
  37 #include "qemu/ctype.h"
  38 #include "ui/console.h"
  39 #include "ui/input.h"
  40 #include "audio/audio.h"
  41 #include "disas/disas.h"
  42 #include "sysemu/balloon.h"
  43 #include "qemu/timer.h"
  44 #include "sysemu/hw_accel.h"
  45 #include "sysemu/runstate.h"
  46 #include "authz/list.h"
  47 #include "qapi/util.h"
  48 #include "sysemu/blockdev.h"
  49 #include "sysemu/sysemu.h"
  50 #include "sysemu/tcg.h"
  51 #include "sysemu/tpm.h"
  52 #include "qapi/qmp/qdict.h"
  53 #include "qapi/qmp/qerror.h"
  54 #include "qapi/qmp/qstring.h"
  55 #include "qom/object_interfaces.h"
  56 #include "trace/control.h"
  57 #include "monitor/hmp-target.h"
  58 #include "monitor/hmp.h"
  59 #ifdef CONFIG_TRACE_SIMPLE
  60 #include "trace/simple.h"
  61 #endif
  62 #include "exec/memory.h"
  63 #include "exec/exec-all.h"
  64 #include "qemu/option.h"
  65 #include "qemu/thread.h"
  66 #include "block/qapi.h"
  67 #include "block/block-hmp-cmds.h"
  68 #include "qapi/qapi-commands-char.h"
  69 #include "qapi/qapi-commands-control.h"
  70 #include "qapi/qapi-commands-migration.h"
  71 #include "qapi/qapi-commands-misc.h"
  72 #include "qapi/qapi-commands-qom.h"
  73 #include "qapi/qapi-commands-trace.h"
  74 #include "qapi/qapi-init-commands.h"
  75 #include "qapi/error.h"
  76 #include "qapi/qmp-event.h"
  77 #include "sysemu/cpus.h"
  78 #include "qemu/cutils.h"
  79
  80 #if defined(TARGET_S390X)
  81 #include "hw/s390x/storage-keys.h"
  82 #include "hw/s390x/storage-attributes.h"
  83 #endif
  84
  85 /* file descriptors passed via SCM_RIGHTS */
  86 typedef struct mon_fd_t mon_fd_t;
  87 struct mon_fd_t {
  88     char *name;
  89     int fd;
  90     QLIST_ENTRY(mon_fd_t) next;
  91 };
  92
  93 /* file descriptor associated with a file descriptor set */
  94 typedef struct MonFdsetFd MonFdsetFd;
  95 struct MonFdsetFd {
  96     int fd;
  97     bool removed;
  98     char *opaque;
  99     QLIST_ENTRY(MonFdsetFd) next;
 100 };
 101
 102 /* file descriptor set containing fds passed via SCM_RIGHTS */
 103 typedef struct MonFdset MonFdset;
 104 struct MonFdset {
 105     int64_t id;
 106     QLIST_HEAD(, MonFdsetFd) fds;
 107     QLIST_HEAD(, MonFdsetFd) dup_fds;
 108     QLIST_ENTRY(MonFdset) next;
 109 };
 110
 111 /* Protects mon_fdsets */
 112 static QemuMutex mon_fdsets_lock;
 113 static QLIST_HEAD(, MonFdset) mon_fdsets;
 114
 115 static HMPCommand hmp_info_cmds[];
 116
 117 char *qmp_human_monitor_command(const char *command_line, bool has_cpu_index,
 118                                 int64_t cpu_index, Error **errp)
 119 {
 120     char *output = NULL;
 121     MonitorHMP hmp = {};
 122
 123     monitor_data_init(&hmp.common, false, true, false);
 124
 125     if (has_cpu_index) {
 126         int ret = monitor_set_cpu(&hmp.common, cpu_index);
 127         if (ret < 0) {
 128             error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "cpu-index",
 129                        "a CPU number");
 130             goto out;
 131         }
 132     }
 133
 134     handle_hmp_command(&hmp, command_line);
 135
 136     WITH_QEMU_LOCK_GUARD(&hmp.common.mon_lock) {
 137         output = g_strdup(hmp.common.outbuf->str);
 138     }
 139
 140 out:
 141     monitor_data_destroy(&hmp.common);
 142     return output;
 143 }
 144
 145 /**
 146  * Is @name in the '|' separated list of names @list?
 147  */
 148 int hmp_compare_cmd(const char *name, const char *list)
 149 {
 150     const char *p, *pstart;
 151     int len;
 152     len = strlen(name);
 153     p = list;
 154     for (;;) {
 155         pstart = p;
 156         p = qemu_strchrnul(p, '|');
 157         if ((p - pstart) == len && !memcmp(pstart, name, len)) {
 158             return 1;
 159         }
 160         if (*p == '\0') {
 161             break;
 162         }
 163         p++;
 164     }
 165     return 0;
 166 }
 167
 168 static void do_help_cmd(Monitor *mon, const QDict *qdict)
 169 {
 170     help_cmd(mon, qdict_get_try_str(qdict, "name"));
 171 }
 172
 173 static void hmp_trace_event(Monitor *mon, const QDict *qdict)
 174 {
 175     const char *tp_name = qdict_get_str(qdict, "name");
 176     bool new_state = qdict_get_bool(qdict, "option");
 177     bool has_vcpu = qdict_haskey(qdict, "vcpu");
 178     int vcpu = qdict_get_try_int(qdict, "vcpu", 0);
 179     Error *local_err = NULL;
 180
 181     if (vcpu < 0) {
 182         monitor_printf(mon, "argument vcpu must be positive");
 183         return;
 184     }
 185
 186     qmp_trace_event_set_state(tp_name, new_state, true, true, has_vcpu, vcpu, &local_err);
 187     if (local_err) {
 188         error_report_err(local_err);
 189     }
 190 }
 191
 192 #ifdef CONFIG_TRACE_SIMPLE
 193 static void hmp_trace_file(Monitor *mon, const QDict *qdict)
 194 {
 195     const char *op = qdict_get_try_str(qdict, "op");
 196     const char *arg = qdict_get_try_str(qdict, "arg");
 197
 198     if (!op) {
 199         st_print_trace_file_status();
 200     } else if (!strcmp(op, "on")) {
 201         st_set_trace_file_enabled(true);
 202     } else if (!strcmp(op, "off")) {
 203         st_set_trace_file_enabled(false);
 204     } else if (!strcmp(op, "flush")) {
 205         st_flush_trace_buffer();
 206     } else if (!strcmp(op, "set")) {
 207         if (arg) {
 208             st_set_trace_file(arg);
 209         }
 210     } else {
 211         monitor_printf(mon, "unexpected argument \"%s\"\n", op);
 212         help_cmd(mon, "trace-file");
 213     }
 214 }
 215 #endif
 216
 217 static void hmp_info_help(Monitor *mon, const QDict *qdict)
 218 {
 219     help_cmd(mon, "info");
 220 }
 221
 222 static void monitor_init_qmp_commands(void)
 223 {
 224     /*
 225      * Two command lists:
 226      * - qmp_commands contains all QMP commands
 227      * - qmp_cap_negotiation_commands contains just
 228      *   "qmp_capabilities", to enforce capability negotiation
 229      */
 230
 231     qmp_init_marshal(&qmp_commands);
 232
 233     qmp_register_command(&qmp_commands, "device_add", qmp_device_add,
 234                          QCO_NO_OPTIONS);
 235
 236     QTAILQ_INIT(&qmp_cap_negotiation_commands);
 237     qmp_register_command(&qmp_cap_negotiation_commands, "qmp_capabilities",
 238                          qmp_marshal_qmp_capabilities, QCO_ALLOW_PRECONFIG);
 239 }
 240
 241 /* Set the current CPU defined by the user. Callers must hold BQL. */
 242 int monitor_set_cpu(Monitor *mon, int cpu_index)
 243 {
 244     CPUState *cpu;
 245
 246     cpu = qemu_get_cpu(cpu_index);
 247     if (cpu == NULL) {
 248         return -1;
 249     }
 250     g_free(mon->mon_cpu_path);
 251     mon->mon_cpu_path = object_get_canonical_path(OBJECT(cpu));
 252     return 0;
 253 }
 254
 255 /* Callers must hold BQL. */
 256 static CPUState *mon_get_cpu_sync(Monitor *mon, bool synchronize)
 257 {
 258     CPUState *cpu = NULL;
 259
 260     if (mon->mon_cpu_path) {
 261         cpu = (CPUState *) object_resolve_path_type(mon->mon_cpu_path,
 262                                                     TYPE_CPU, NULL);
 263         if (!cpu) {
 264             g_free(mon->mon_cpu_path);
 265             mon->mon_cpu_path = NULL;
 266         }
 267     }
 268     if (!mon->mon_cpu_path) {
 269         if (!first_cpu) {
 270             return NULL;
 271         }
 272         monitor_set_cpu(mon, first_cpu->cpu_index);
 273         cpu = first_cpu;
 274     }
 275     assert(cpu != NULL);
 276     if (synchronize) {
 277         cpu_synchronize_state(cpu);
 278     }
 279     return cpu;
 280 }
 281
 282 CPUState *mon_get_cpu(Monitor *mon)
 283 {
 284     return mon_get_cpu_sync(mon, true);
 285 }
 286
 287 CPUArchState *mon_get_cpu_env(Monitor *mon)
 288 {
 289     CPUState *cs = mon_get_cpu(mon);
 290
 291     return cs ? cs->env_ptr : NULL;
 292 }
 293
 294 int monitor_get_cpu_index(Monitor *mon)
 295 {
 296     CPUState *cs = mon_get_cpu_sync(mon, false);
 297
 298     return cs ? cs->cpu_index : UNASSIGNED_CPU_INDEX;
 299 }
 300
 301 static void hmp_info_registers(Monitor *mon, const QDict *qdict)
 302 {
 303     bool all_cpus = qdict_get_try_bool(qdict, "cpustate_all", false);
 304     CPUState *cs;
 305
 306     if (all_cpus) {
 307         CPU_FOREACH(cs) {
 308             monitor_printf(mon, "\nCPU#%d\n", cs->cpu_index);
 309             cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
 310         }
 311     } else {
 312         cs = mon_get_cpu(mon);
 313
 314         if (!cs) {
 315             monitor_printf(mon, "No CPU available\n");
 316             return;
 317         }
 318
 319         cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
 320     }
 321 }
 322
 323 static void hmp_info_sync_profile(Monitor *mon, const QDict *qdict)
 324 {
 325     int64_t max = qdict_get_try_int(qdict, "max", 10);
 326     bool mean = qdict_get_try_bool(qdict, "mean", false);
 327     bool coalesce = !qdict_get_try_bool(qdict, "no_coalesce", false);
 328     enum QSPSortBy sort_by;
 329
 330     sort_by = mean ? QSP_SORT_BY_AVG_WAIT_TIME : QSP_SORT_BY_TOTAL_WAIT_TIME;
 331     qsp_report(max, sort_by, coalesce);
 332 }
 333
 334 static void hmp_info_history(Monitor *mon, const QDict *qdict)
 335 {
 336     MonitorHMP *hmp_mon = container_of(mon, MonitorHMP, common);
 337     int i;
 338     const char *str;
 339
 340     if (!hmp_mon->rs) {
 341         return;
 342     }
 343     i = 0;
 344     for(;;) {
 345         str = readline_get_history(hmp_mon->rs, i);
 346         if (!str) {
 347             break;
 348         }
 349         monitor_printf(mon, "%d: '%s'\n", i, str);
 350         i++;
 351     }
 352 }
 353
 354 static void hmp_info_trace_events(Monitor *mon, const QDict *qdict)
 355 {
 356     const char *name = qdict_get_try_str(qdict, "name");
 357     bool has_vcpu = qdict_haskey(qdict, "vcpu");
 358     int vcpu = qdict_get_try_int(qdict, "vcpu", 0);
 359     TraceEventInfoList *events;
 360     TraceEventInfoList *elem;
 361     Error *local_err = NULL;
 362
 363     if (name == NULL) {
 364         name = "*";
 365     }
 366     if (vcpu < 0) {
 367         monitor_printf(mon, "argument vcpu must be positive");
 368         return;
 369     }
 370
 371     events = qmp_trace_event_get_state(name, has_vcpu, vcpu, &local_err);
 372     if (local_err) {
 373         error_report_err(local_err);
 374         return;
 375     }
 376
 377     for (elem = events; elem != NULL; elem = elem->next) {
 378         monitor_printf(mon, "%s : state %u\n",
 379                        elem->value->name,
 380                        elem->value->state == TRACE_EVENT_STATE_ENABLED ? 1 : 0);
 381     }
 382     qapi_free_TraceEventInfoList(events);
 383 }
 384
 385 void qmp_client_migrate_info(const char *protocol, const char *hostname,
 386                              bool has_port, int64_t port,
 387                              bool has_tls_port, int64_t tls_port,
 388                              bool has_cert_subject, const char *cert_subject,
 389                              Error **errp)
 390 {
 391     if (strcmp(protocol, "spice") == 0) {
 392         if (!qemu_using_spice(errp)) {
 393             return;
 394         }
 395
 396         if (!has_port && !has_tls_port) {
 397             error_setg(errp, QERR_MISSING_PARAMETER, "port/tls-port");
 398             return;
 399         }
 400
 401         if (qemu_spice.migrate_info(hostname,
 402                                     has_port ? port : -1,
 403                                     has_tls_port ? tls_port : -1,
 404                                     cert_subject)) {
 405             error_setg(errp, "Could not set up display for migration");
 406             return;
 407         }
 408         return;
 409     }
 410
 411     error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "protocol", "'spice'");
 412 }
 413
 414 static void hmp_logfile(Monitor *mon, const QDict *qdict)
 415 {
 416     Error *err = NULL;
 417
 418     qemu_set_log_filename(qdict_get_str(qdict, "filename"), &err);
 419     if (err) {
 420         error_report_err(err);
 421     }
 422 }
 423
 424 static void hmp_log(Monitor *mon, const QDict *qdict)
 425 {
 426     int mask;
 427     const char *items = qdict_get_str(qdict, "items");
 428
 429     if (!strcmp(items, "none")) {
 430         mask = 0;
 431     } else {
 432         mask = qemu_str_to_log_mask(items);
 433         if (!mask) {
 434             help_cmd(mon, "log");
 435             return;
 436         }
 437     }
 438     qemu_set_log(mask);
 439 }
 440
 441 static void hmp_singlestep(Monitor *mon, const QDict *qdict)
 442 {
 443     const char *option = qdict_get_try_str(qdict, "option");
 444     if (!option || !strcmp(option, "on")) {
 445         singlestep = 1;
 446     } else if (!strcmp(option, "off")) {
 447         singlestep = 0;
 448     } else {
 449         monitor_printf(mon, "unexpected option %s\n", option);
 450     }
 451 }
 452
 453 static void hmp_gdbserver(Monitor *mon, const QDict *qdict)
 454 {
 455     const char *device = qdict_get_try_str(qdict, "device");
 456     if (!device) {
 457         device = "tcp::" DEFAULT_GDBSTUB_PORT;
 458     }
 459
 460     if (gdbserver_start(device) < 0) {
 461         monitor_printf(mon, "Could not open gdbserver on device '%s'\n",
 462                        device);
 463     } else if (strcmp(device, "none") == 0) {
 464         monitor_printf(mon, "Disabled gdbserver\n");
 465     } else {
 466         monitor_printf(mon, "Waiting for gdb connection on device '%s'\n",
 467                        device);
 468     }
 469 }
 470
 471 static void hmp_watchdog_action(Monitor *mon, const QDict *qdict)
 472 {
 473     const char *action = qdict_get_str(qdict, "action");
 474     if (select_watchdog_action(action) == -1) {
 475         monitor_printf(mon, "Unknown watchdog action '%s'\n", action);
 476     }
 477 }
 478
 479 static void monitor_printc(Monitor *mon, int c)
 480 {
 481     monitor_printf(mon, "'");
 482     switch(c) {
 483     case '\'':
 484         monitor_printf(mon, "\\'");
 485         break;
 486     case '\\':
 487         monitor_printf(mon, "\\\\");
 488         break;
 489     case '\n':
 490         monitor_printf(mon, "\\n");
 491         break;
 492     case '\r':
 493         monitor_printf(mon, "\\r");
 494         break;
 495     default:
 496         if (c >= 32 && c <= 126) {
 497             monitor_printf(mon, "%c", c);
 498         } else {
 499             monitor_printf(mon, "\\x%02x", c);
 500         }
 501         break;
 502     }
 503     monitor_printf(mon, "'");
 504 }
 505
 506 static void memory_dump(Monitor *mon, int count, int format, int wsize,
 507                         hwaddr addr, int is_physical)
 508 {
 509     int l, line_size, i, max_digits, len;
 510     uint8_t buf[16];
 511     uint64_t v;
 512     CPUState *cs = mon_get_cpu(mon);
 513
 514     if (!cs && (format == 'i' || !is_physical)) {
 515         monitor_printf(mon, "Can not dump without CPU\n");
 516         return;
 517     }
 518
 519     if (format == 'i') {
 520         monitor_disas(mon, cs, addr, count, is_physical);
 521         return;
 522     }
 523
 524     len = wsize * count;
 525     if (wsize == 1) {
 526         line_size = 8;
 527     } else {
 528         line_size = 16;
 529     }
 530     max_digits = 0;
 531
 532     switch(format) {
 533     case 'o':
 534         max_digits = DIV_ROUND_UP(wsize * 8, 3);
 535         break;
 536     default:
 537     case 'x':
 538         max_digits = (wsize * 8) / 4;
 539         break;
 540     case 'u':
 541     case 'd':
 542         max_digits = DIV_ROUND_UP(wsize * 8 * 10, 33);
 543         break;
 544     case 'c':
 545         wsize = 1;
 546         break;
 547     }
 548
 549     while (len > 0) {
 550         if (is_physical) {
 551             monitor_printf(mon, TARGET_FMT_plx ":", addr);
 552         } else {
 553             monitor_printf(mon, TARGET_FMT_lx ":", (target_ulong)addr);
 554         }
 555         l = len;
 556         if (l > line_size)
 557             l = line_size;
 558         if (is_physical) {
 559             AddressSpace *as = cs ? cs->as : &address_space_memory;
 560             MemTxResult r = address_space_read(as, addr,
 561                                                MEMTXATTRS_UNSPECIFIED, buf, l);
 562             if (r != MEMTX_OK) {
 563                 monitor_printf(mon, " Cannot access memory\n");
 564                 break;
 565             }
 566         } else {
 567             if (cpu_memory_rw_debug(cs, addr, buf, l, 0) < 0) {
 568                 monitor_printf(mon, " Cannot access memory\n");
 569                 break;
 570             }
 571         }
 572         i = 0;
 573         while (i < l) {
 574             switch(wsize) {
 575             default:
 576             case 1:
 577                 v = ldub_p(buf + i);
 578                 break;
 579             case 2:
 580                 v = lduw_p(buf + i);
 581                 break;
 582             case 4:
 583                 v = (uint32_t)ldl_p(buf + i);
 584                 break;
 585             case 8:
 586                 v = ldq_p(buf + i);
 587                 break;
 588             }
 589             monitor_printf(mon, " ");
 590             switch(format) {
 591             case 'o':
 592                 monitor_printf(mon, "%#*" PRIo64, max_digits, v);
 593                 break;
 594             case 'x':
 595                 monitor_printf(mon, "0x%0*" PRIx64, max_digits, v);
 596                 break;
 597             case 'u':
 598                 monitor_printf(mon, "%*" PRIu64, max_digits, v);
 599                 break;
 600             case 'd':
 601                 monitor_printf(mon, "%*" PRId64, max_digits, v);
 602                 break;
 603             case 'c':
 604                 monitor_printc(mon, v);
 605                 break;
 606             }
 607             i += wsize;
 608         }
 609         monitor_printf(mon, "\n");
 610         addr += l;
 611         len -= l;
 612     }
 613 }
 614
 615 static void hmp_memory_dump(Monitor *mon, const QDict *qdict)
 616 {
 617     int count = qdict_get_int(qdict, "count");
 618     int format = qdict_get_int(qdict, "format");
 619     int size = qdict_get_int(qdict, "size");
 620     target_long addr = qdict_get_int(qdict, "addr");
 621
 622     memory_dump(mon, count, format, size, addr, 0);
 623 }
 624
 625 static void hmp_physical_memory_dump(Monitor *mon, const QDict *qdict)
 626 {
 627     int count = qdict_get_int(qdict, "count");
 628     int format = qdict_get_int(qdict, "format");
 629     int size = qdict_get_int(qdict, "size");
 630     hwaddr addr = qdict_get_int(qdict, "addr");
 631
 632     memory_dump(mon, count, format, size, addr, 1);
 633 }
 634
 635 void *gpa2hva(MemoryRegion **p_mr, hwaddr addr, uint64_t size, Error **errp)
 636 {
 637     Int128 gpa_region_size;
 638     MemoryRegionSection mrs = memory_region_find(get_system_memory(),
 639                                                  addr, size);
 640
 641     if (!mrs.mr) {
 642         error_setg(errp, "No memory is mapped at address 0x%" HWADDR_PRIx, addr);
 643         return NULL;
 644     }
 645
 646     if (!memory_region_is_ram(mrs.mr) && !memory_region_is_romd(mrs.mr)) {
 647         error_setg(errp, "Memory at address 0x%" HWADDR_PRIx "is not RAM", addr);
 648         memory_region_unref(mrs.mr);
 649         return NULL;
 650     }
 651
 652     gpa_region_size = int128_make64(size);
 653     if (int128_lt(mrs.size, gpa_region_size)) {
 654         error_setg(errp, "Size of memory region at 0x%" HWADDR_PRIx
 655                    " exceeded.", addr);
 656         memory_region_unref(mrs.mr);
 657         return NULL;
 658     }
 659
 660     *p_mr = mrs.mr;
 661     return qemu_map_ram_ptr(mrs.mr->ram_block, mrs.offset_within_region);
 662 }
 663
 664 static void hmp_gpa2hva(Monitor *mon, const QDict *qdict)
 665 {
 666     hwaddr addr = qdict_get_int(qdict, "addr");
 667     Error *local_err = NULL;
 668     MemoryRegion *mr = NULL;
 669     void *ptr;
 670
 671     ptr = gpa2hva(&mr, addr, 1, &local_err);
 672     if (local_err) {
 673         error_report_err(local_err);
 674         return;
 675     }
 676
 677     monitor_printf(mon, "Host virtual address for 0x%" HWADDR_PRIx
 678                    " (%s) is %p\n",
 679                    addr, mr->name, ptr);
 680
 681     memory_region_unref(mr);
 682 }
 683
 684 static void hmp_gva2gpa(Monitor *mon, const QDict *qdict)
 685 {
 686     target_ulong addr = qdict_get_int(qdict, "addr");
 687     MemTxAttrs attrs;
 688     CPUState *cs = mon_get_cpu(mon);
 689     hwaddr gpa;
 690
 691     if (!cs) {
 692         monitor_printf(mon, "No cpu\n");
 693         return;
 694     }
 695
 696     gpa  = cpu_get_phys_page_attrs_debug(cs, addr & TARGET_PAGE_MASK, &attrs);
 697     if (gpa == -1) {
 698         monitor_printf(mon, "Unmapped\n");
 699     } else {
 700         monitor_printf(mon, "gpa: %#" HWADDR_PRIx "\n",
 701                        gpa + (addr & ~TARGET_PAGE_MASK));
 702     }
 703 }
 704
 705 #ifdef CONFIG_LINUX
 706 static uint64_t vtop(void *ptr, Error **errp)
 707 {
 708     uint64_t pinfo;
 709     uint64_t ret = -1;
 710     uintptr_t addr = (uintptr_t) ptr;
 711     uintptr_t pagesize = qemu_real_host_page_size;
 712     off_t offset = addr / pagesize * sizeof(pinfo);
 713     int fd;
 714
 715     fd = open("/proc/self/pagemap", O_RDONLY);
 716     if (fd == -1) {
 717         error_setg_errno(errp, errno, "Cannot open /proc/self/pagemap");
 718         return -1;
 719     }
 720
 721     /* Force copy-on-write if necessary.  */
 722     qatomic_add((uint8_t *)ptr, 0);
 723
 724     if (pread(fd, &pinfo, sizeof(pinfo), offset) != sizeof(pinfo)) {
 725         error_setg_errno(errp, errno, "Cannot read pagemap");
 726         goto out;
 727     }
 728     if ((pinfo & (1ull << 63)) == 0) {
 729         error_setg(errp, "Page not present");
 730         goto out;
 731     }
 732     ret = ((pinfo & 0x007fffffffffffffull) * pagesize) | (addr & (pagesize - 1));
 733
 734 out:
 735     close(fd);
 736     return ret;
 737 }
 738
 739 static void hmp_gpa2hpa(Monitor *mon, const QDict *qdict)
 740 {
 741     hwaddr addr = qdict_get_int(qdict, "addr");
 742     Error *local_err = NULL;
 743     MemoryRegion *mr = NULL;
 744     void *ptr;
 745     uint64_t physaddr;
 746
 747     ptr = gpa2hva(&mr, addr, 1, &local_err);
 748     if (local_err) {
 749         error_report_err(local_err);
 750         return;
 751     }
 752
 753     physaddr = vtop(ptr, &local_err);
 754     if (local_err) {
 755         error_report_err(local_err);
 756     } else {
 757         monitor_printf(mon, "Host physical address for 0x%" HWADDR_PRIx
 758                        " (%s) is 0x%" PRIx64 "\n",
 759                        addr, mr->name, (uint64_t) physaddr);
 760     }
 761
 762     memory_region_unref(mr);
 763 }
 764 #endif
 765
 766 static void do_print(Monitor *mon, const QDict *qdict)
 767 {
 768     int format = qdict_get_int(qdict, "format");
 769     hwaddr val = qdict_get_int(qdict, "val");
 770
 771     switch(format) {
 772     case 'o':
 773         monitor_printf(mon, "%#" HWADDR_PRIo, val);
 774         break;
 775     case 'x':
 776         monitor_printf(mon, "%#" HWADDR_PRIx, val);
 777         break;
 778     case 'u':
 779         monitor_printf(mon, "%" HWADDR_PRIu, val);
 780         break;
 781     default:
 782     case 'd':
 783         monitor_printf(mon, "%" HWADDR_PRId, val);
 784         break;
 785     case 'c':
 786         monitor_printc(mon, val);
 787         break;
 788     }
 789     monitor_printf(mon, "\n");
 790 }
 791
 792 static void hmp_sum(Monitor *mon, const QDict *qdict)
 793 {
 794     uint32_t addr;
 795     uint16_t sum;
 796     uint32_t start = qdict_get_int(qdict, "start");
 797     uint32_t size = qdict_get_int(qdict, "size");
 798
 799     sum = 0;
 800     for(addr = start; addr < (start + size); addr++) {
 801         uint8_t val = address_space_ldub(&address_space_memory, addr,
 802                                          MEMTXATTRS_UNSPECIFIED, NULL);
 803         /* BSD sum algorithm ('sum' Unix command) */
 804         sum = (sum >> 1) | (sum << 15);
 805         sum += val;
 806     }
 807     monitor_printf(mon, "%05d\n", sum);
 808 }
 809
 810 static int mouse_button_state;
 811
 812 static void hmp_mouse_move(Monitor *mon, const QDict *qdict)
 813 {
 814     int dx, dy, dz, button;
 815     const char *dx_str = qdict_get_str(qdict, "dx_str");
 816     const char *dy_str = qdict_get_str(qdict, "dy_str");
 817     const char *dz_str = qdict_get_try_str(qdict, "dz_str");
 818
 819     dx = strtol(dx_str, NULL, 0);
 820     dy = strtol(dy_str, NULL, 0);
 821     qemu_input_queue_rel(NULL, INPUT_AXIS_X, dx);
 822     qemu_input_queue_rel(NULL, INPUT_AXIS_Y, dy);
 823
 824     if (dz_str) {
 825         dz = strtol(dz_str, NULL, 0);
 826         if (dz != 0) {
 827             button = (dz > 0) ? INPUT_BUTTON_WHEEL_UP : INPUT_BUTTON_WHEEL_DOWN;
 828             qemu_input_queue_btn(NULL, button, true);
 829             qemu_input_event_sync();
 830             qemu_input_queue_btn(NULL, button, false);
 831         }
 832     }
 833     qemu_input_event_sync();
 834 }
 835
 836 static void hmp_mouse_button(Monitor *mon, const QDict *qdict)
 837 {
 838     static uint32_t bmap[INPUT_BUTTON__MAX] = {
 839         [INPUT_BUTTON_LEFT]       = MOUSE_EVENT_LBUTTON,
 840         [INPUT_BUTTON_MIDDLE]     = MOUSE_EVENT_MBUTTON,
 841         [INPUT_BUTTON_RIGHT]      = MOUSE_EVENT_RBUTTON,
 842     };
 843     int button_state = qdict_get_int(qdict, "button_state");
 844
 845     if (mouse_button_state == button_state) {
 846         return;
 847     }
 848     qemu_input_update_buttons(NULL, bmap, mouse_button_state, button_state);
 849     qemu_input_event_sync();
 850     mouse_button_state = button_state;
 851 }
 852
 853 static void hmp_ioport_read(Monitor *mon, const QDict *qdict)
 854 {
 855     int size = qdict_get_int(qdict, "size");
 856     int addr = qdict_get_int(qdict, "addr");
 857     int has_index = qdict_haskey(qdict, "index");
 858     uint32_t val;
 859     int suffix;
 860
 861     if (has_index) {
 862         int index = qdict_get_int(qdict, "index");
 863         cpu_outb(addr & IOPORTS_MASK, index & 0xff);
 864         addr++;
 865     }
 866     addr &= 0xffff;
 867
 868     switch(size) {
 869     default:
 870     case 1:
 871         val = cpu_inb(addr);
 872         suffix = 'b';
 873         break;
 874     case 2:
 875         val = cpu_inw(addr);
 876         suffix = 'w';
 877         break;
 878     case 4:
 879         val = cpu_inl(addr);
 880         suffix = 'l';
 881         break;
 882     }
 883     monitor_printf(mon, "port%c[0x%04x] = 0x%0*x\n",
 884                    suffix, addr, size * 2, val);
 885 }
 886
 887 static void hmp_ioport_write(Monitor *mon, const QDict *qdict)
 888 {
 889     int size = qdict_get_int(qdict, "size");
 890     int addr = qdict_get_int(qdict, "addr");
 891     int val = qdict_get_int(qdict, "val");
 892
 893     addr &= IOPORTS_MASK;
 894
 895     switch (size) {
 896     default:
 897     case 1:
 898         cpu_outb(addr, val);
 899         break;
 900     case 2:
 901         cpu_outw(addr, val);
 902         break;
 903     case 4:
 904         cpu_outl(addr, val);
 905         break;
 906     }
 907 }
 908
 909 static void hmp_boot_set(Monitor *mon, const QDict *qdict)
 910 {
 911     Error *local_err = NULL;
 912     const char *bootdevice = qdict_get_str(qdict, "bootdevice");
 913
 914     qemu_boot_set(bootdevice, &local_err);
 915     if (local_err) {
 916         error_report_err(local_err);
 917     } else {
 918         monitor_printf(mon, "boot device list now set to %s\n", bootdevice);
 919     }
 920 }
 921
 922 static void hmp_info_mtree(Monitor *mon, const QDict *qdict)
 923 {
 924     bool flatview = qdict_get_try_bool(qdict, "flatview", false);
 925     bool dispatch_tree = qdict_get_try_bool(qdict, "dispatch_tree", false);
 926     bool owner = qdict_get_try_bool(qdict, "owner", false);
 927     bool disabled = qdict_get_try_bool(qdict, "disabled", false);
 928
 929     mtree_info(flatview, dispatch_tree, owner, disabled);
 930 }
 931
 932 #ifdef CONFIG_PROFILER
 933
 934 int64_t dev_time;
 935
 936 static void hmp_info_profile(Monitor *mon, const QDict *qdict)
 937 {
 938     static int64_t last_cpu_exec_time;
 939     int64_t cpu_exec_time;
 940     int64_t delta;
 941
 942     cpu_exec_time = tcg_cpu_exec_time();
 943     delta = cpu_exec_time - last_cpu_exec_time;
 944
 945     monitor_printf(mon, "async time  %" PRId64 " (%0.3f)\n",
 946                    dev_time, dev_time / (double)NANOSECONDS_PER_SECOND);
 947     monitor_printf(mon, "qemu time   %" PRId64 " (%0.3f)\n",
 948                    delta, delta / (double)NANOSECONDS_PER_SECOND);
 949     last_cpu_exec_time = cpu_exec_time;
 950     dev_time = 0;
 951 }
 952 #else
 953 static void hmp_info_profile(Monitor *mon, const QDict *qdict)
 954 {
 955     monitor_printf(mon, "Internal profiler not compiled\n");
 956 }
 957 #endif
 958
 959 /* Capture support */
 960 static QLIST_HEAD (capture_list_head, CaptureState) capture_head;
 961
 962 static void hmp_info_capture(Monitor *mon, const QDict *qdict)
 963 {
 964     int i;
 965     CaptureState *s;
 966
 967     for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) {
 968         monitor_printf(mon, "[%d]: ", i);
 969         s->ops.info (s->opaque);
 970     }
 971 }
 972
 973 static void hmp_stopcapture(Monitor *mon, const QDict *qdict)
 974 {
 975     int i;
 976     int n = qdict_get_int(qdict, "n");
 977     CaptureState *s;
 978
 979     for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) {
 980         if (i == n) {
 981             s->ops.destroy (s->opaque);
 982             QLIST_REMOVE (s, entries);
 983             g_free (s);
 984             return;
 985         }
 986     }
 987 }
 988
 989 static void hmp_wavcapture(Monitor *mon, const QDict *qdict)
 990 {
 991     const char *path = qdict_get_str(qdict, "path");
 992     int freq = qdict_get_try_int(qdict, "freq", 44100);
 993     int bits = qdict_get_try_int(qdict, "bits", 16);
 994     int nchannels = qdict_get_try_int(qdict, "nchannels", 2);
 995     const char *audiodev = qdict_get_str(qdict, "audiodev");
 996     CaptureState *s;
 997     AudioState *as = audio_state_by_name(audiodev);
 998
 999     if (!as) {
1000         monitor_printf(mon, "Audiodev '%s' not found\n", audiodev);
1001         return;
1002     }
1003
1004     s = g_malloc0 (sizeof (*s));
1005
1006     if (wav_start_capture(as, s, path, freq, bits, nchannels)) {
1007         monitor_printf(mon, "Failed to add wave capture\n");
1008         g_free (s);
1009         return;
1010     }
1011     QLIST_INSERT_HEAD (&capture_head, s, entries);
1012 }
1013
1014 void qmp_getfd(const char *fdname, Error **errp)
1015 {
1016     Monitor *cur_mon = monitor_cur();
1017     mon_fd_t *monfd;
1018     int fd, tmp_fd;
1019
1020     fd = qemu_chr_fe_get_msgfd(&cur_mon->chr);
1021     if (fd == -1) {
1022         error_setg(errp, "No file descriptor supplied via SCM_RIGHTS");
1023         return;
1024     }
1025
1026     if (qemu_isdigit(fdname[0])) {
1027         close(fd);
1028         error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "fdname",
1029                    "a name not starting with a digit");
1030         return;
1031     }
1032
1033     QEMU_LOCK_GUARD(&cur_mon->mon_lock);
1034     QLIST_FOREACH(monfd, &cur_mon->fds, next) {
1035         if (strcmp(monfd->name, fdname) != 0) {
1036             continue;
1037         }
1038
1039         tmp_fd = monfd->fd;
1040         monfd->fd = fd;
1041         /* Make sure close() is outside critical section */
1042         close(tmp_fd);
1043         return;
1044     }
1045
1046     monfd = g_malloc0(sizeof(mon_fd_t));
1047     monfd->name = g_strdup(fdname);
1048     monfd->fd = fd;
1049
1050     QLIST_INSERT_HEAD(&cur_mon->fds, monfd, next);
1051 }
1052
1053 void qmp_closefd(const char *fdname, Error **errp)
1054 {
1055     Monitor *cur_mon = monitor_cur();
1056     mon_fd_t *monfd;
1057     int tmp_fd;
1058
1059     qemu_mutex_lock(&cur_mon->mon_lock);
1060     QLIST_FOREACH(monfd, &cur_mon->fds, next) {
1061         if (strcmp(monfd->name, fdname) != 0) {
1062             continue;
1063         }
1064
1065         QLIST_REMOVE(monfd, next);
1066         tmp_fd = monfd->fd;
1067         g_free(monfd->name);
1068         g_free(monfd);
1069         qemu_mutex_unlock(&cur_mon->mon_lock);
1070         /* Make sure close() is outside critical section */
1071         close(tmp_fd);
1072         return;
1073     }
1074
1075     qemu_mutex_unlock(&cur_mon->mon_lock);
1076     error_setg(errp, "File descriptor named '%s' not found", fdname);
1077 }
1078
1079 int monitor_get_fd(Monitor *mon, const char *fdname, Error **errp)
1080 {
1081     mon_fd_t *monfd;
1082
1083     QEMU_LOCK_GUARD(&mon->mon_lock);
1084     QLIST_FOREACH(monfd, &mon->fds, next) {
1085         int fd;
1086
1087         if (strcmp(monfd->name, fdname) != 0) {
1088             continue;
1089         }
1090
1091         fd = monfd->fd;
1092
1093         /* caller takes ownership of fd */
1094         QLIST_REMOVE(monfd, next);
1095         g_free(monfd->name);
1096         g_free(monfd);
1097
1098         return fd;
1099     }
1100
1101     error_setg(errp, "File descriptor named '%s' has not been found", fdname);
1102     return -1;
1103 }
1104
1105 static void monitor_fdset_cleanup(MonFdset *mon_fdset)
1106 {
1107     MonFdsetFd *mon_fdset_fd;
1108     MonFdsetFd *mon_fdset_fd_next;
1109
1110     QLIST_FOREACH_SAFE(mon_fdset_fd, &mon_fdset->fds, next, mon_fdset_fd_next) {
1111         if ((mon_fdset_fd->removed ||
1112                 (QLIST_EMPTY(&mon_fdset->dup_fds) && mon_refcount == 0)) &&
1113                 runstate_is_running()) {
1114             close(mon_fdset_fd->fd);
1115             g_free(mon_fdset_fd->opaque);
1116             QLIST_REMOVE(mon_fdset_fd, next);
1117             g_free(mon_fdset_fd);
1118         }
1119     }
1120
1121     if (QLIST_EMPTY(&mon_fdset->fds) && QLIST_EMPTY(&mon_fdset->dup_fds)) {
1122         QLIST_REMOVE(mon_fdset, next);
1123         g_free(mon_fdset);
1124     }
1125 }
1126
1127 void monitor_fdsets_cleanup(void)
1128 {
1129     MonFdset *mon_fdset;
1130     MonFdset *mon_fdset_next;
1131
1132     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1133     QLIST_FOREACH_SAFE(mon_fdset, &mon_fdsets, next, mon_fdset_next) {
1134         monitor_fdset_cleanup(mon_fdset);
1135     }
1136 }
1137
1138 AddfdInfo *qmp_add_fd(bool has_fdset_id, int64_t fdset_id, bool has_opaque,
1139                       const char *opaque, Error **errp)
1140 {
1141     int fd;
1142     Monitor *mon = monitor_cur();
1143     AddfdInfo *fdinfo;
1144
1145     fd = qemu_chr_fe_get_msgfd(&mon->chr);
1146     if (fd == -1) {
1147         error_setg(errp, "No file descriptor supplied via SCM_RIGHTS");
1148         goto error;
1149     }
1150
1151     fdinfo = monitor_fdset_add_fd(fd, has_fdset_id, fdset_id,
1152                                   has_opaque, opaque, errp);
1153     if (fdinfo) {
1154         return fdinfo;
1155     }
1156
1157 error:
1158     if (fd != -1) {
1159         close(fd);
1160     }
1161     return NULL;
1162 }
1163
1164 void qmp_remove_fd(int64_t fdset_id, bool has_fd, int64_t fd, Error **errp)
1165 {
1166     MonFdset *mon_fdset;
1167     MonFdsetFd *mon_fdset_fd;
1168     char fd_str[60];
1169
1170     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1171     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1172         if (mon_fdset->id != fdset_id) {
1173             continue;
1174         }
1175         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1176             if (has_fd) {
1177                 if (mon_fdset_fd->fd != fd) {
1178                     continue;
1179                 }
1180                 mon_fdset_fd->removed = true;
1181                 break;
1182             } else {
1183                 mon_fdset_fd->removed = true;
1184             }
1185         }
1186         if (has_fd && !mon_fdset_fd) {
1187             goto error;
1188         }
1189         monitor_fdset_cleanup(mon_fdset);
1190         return;
1191     }
1192
1193 error:
1194     if (has_fd) {
1195         snprintf(fd_str, sizeof(fd_str), "fdset-id:%" PRId64 ", fd:%" PRId64,
1196                  fdset_id, fd);
1197     } else {
1198         snprintf(fd_str, sizeof(fd_str), "fdset-id:%" PRId64, fdset_id);
1199     }
1200     error_setg(errp, "File descriptor named '%s' not found", fd_str);
1201 }
1202
1203 FdsetInfoList *qmp_query_fdsets(Error **errp)
1204 {
1205     MonFdset *mon_fdset;
1206     MonFdsetFd *mon_fdset_fd;
1207     FdsetInfoList *fdset_list = NULL;
1208
1209     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1210     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1211         FdsetInfo *fdset_info = g_malloc0(sizeof(*fdset_info));
1212
1213         fdset_info->fdset_id = mon_fdset->id;
1214
1215         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1216             FdsetFdInfo *fdsetfd_info;
1217
1218             fdsetfd_info = g_malloc0(sizeof(*fdsetfd_info));
1219             fdsetfd_info->fd = mon_fdset_fd->fd;
1220             if (mon_fdset_fd->opaque) {
1221                 fdsetfd_info->has_opaque = true;
1222                 fdsetfd_info->opaque = g_strdup(mon_fdset_fd->opaque);
1223             } else {
1224                 fdsetfd_info->has_opaque = false;
1225             }
1226
1227             QAPI_LIST_PREPEND(fdset_info->fds, fdsetfd_info);
1228         }
1229
1230         QAPI_LIST_PREPEND(fdset_list, fdset_info);
1231     }
1232
1233     return fdset_list;
1234 }
1235
1236 AddfdInfo *monitor_fdset_add_fd(int fd, bool has_fdset_id, int64_t fdset_id,
1237                                 bool has_opaque, const char *opaque,
1238                                 Error **errp)
1239 {
1240     MonFdset *mon_fdset = NULL;
1241     MonFdsetFd *mon_fdset_fd;
1242     AddfdInfo *fdinfo;
1243
1244     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1245     if (has_fdset_id) {
1246         QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1247             /* Break if match found or match impossible due to ordering by ID */
1248             if (fdset_id <= mon_fdset->id) {
1249                 if (fdset_id < mon_fdset->id) {
1250                     mon_fdset = NULL;
1251                 }
1252                 break;
1253             }
1254         }
1255     }
1256
1257     if (mon_fdset == NULL) {
1258         int64_t fdset_id_prev = -1;
1259         MonFdset *mon_fdset_cur = QLIST_FIRST(&mon_fdsets);
1260
1261         if (has_fdset_id) {
1262             if (fdset_id < 0) {
1263                 error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "fdset-id",
1264                            "a non-negative value");
1265                 return NULL;
1266             }
1267             /* Use specified fdset ID */
1268             QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1269                 mon_fdset_cur = mon_fdset;
1270                 if (fdset_id < mon_fdset_cur->id) {
1271                     break;
1272                 }
1273             }
1274         } else {
1275             /* Use first available fdset ID */
1276             QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1277                 mon_fdset_cur = mon_fdset;
1278                 if (fdset_id_prev == mon_fdset_cur->id - 1) {
1279                     fdset_id_prev = mon_fdset_cur->id;
1280                     continue;
1281                 }
1282                 break;
1283             }
1284         }
1285
1286         mon_fdset = g_malloc0(sizeof(*mon_fdset));
1287         if (has_fdset_id) {
1288             mon_fdset->id = fdset_id;
1289         } else {
1290             mon_fdset->id = fdset_id_prev + 1;
1291         }
1292
1293         /* The fdset list is ordered by fdset ID */
1294         if (!mon_fdset_cur) {
1295             QLIST_INSERT_HEAD(&mon_fdsets, mon_fdset, next);
1296         } else if (mon_fdset->id < mon_fdset_cur->id) {
1297             QLIST_INSERT_BEFORE(mon_fdset_cur, mon_fdset, next);
1298         } else {
1299             QLIST_INSERT_AFTER(mon_fdset_cur, mon_fdset, next);
1300         }
1301     }
1302
1303     mon_fdset_fd = g_malloc0(sizeof(*mon_fdset_fd));
1304     mon_fdset_fd->fd = fd;
1305     mon_fdset_fd->removed = false;
1306     if (has_opaque) {
1307         mon_fdset_fd->opaque = g_strdup(opaque);
1308     }
1309     QLIST_INSERT_HEAD(&mon_fdset->fds, mon_fdset_fd, next);
1310
1311     fdinfo = g_malloc0(sizeof(*fdinfo));
1312     fdinfo->fdset_id = mon_fdset->id;
1313     fdinfo->fd = mon_fdset_fd->fd;
1314
1315     return fdinfo;
1316 }
1317
1318 int monitor_fdset_dup_fd_add(int64_t fdset_id, int flags)
1319 {
1320 #ifdef _WIN32
1321     return -ENOENT;
1322 #else
1323     MonFdset *mon_fdset;
1324
1325     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1326     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1327         MonFdsetFd *mon_fdset_fd;
1328         MonFdsetFd *mon_fdset_fd_dup;
1329         int fd = -1;
1330         int dup_fd;
1331         int mon_fd_flags;
1332
1333         if (mon_fdset->id != fdset_id) {
1334             continue;
1335         }
1336
1337         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1338             mon_fd_flags = fcntl(mon_fdset_fd->fd, F_GETFL);
1339             if (mon_fd_flags == -1) {
1340                 return -1;
1341             }
1342
1343             if ((flags & O_ACCMODE) == (mon_fd_flags & O_ACCMODE)) {
1344                 fd = mon_fdset_fd->fd;
1345                 break;
1346             }
1347         }
1348
1349         if (fd == -1) {
1350             errno = EACCES;
1351             return -1;
1352         }
1353
1354         dup_fd = qemu_dup_flags(fd, flags);
1355         if (dup_fd == -1) {
1356             return -1;
1357         }
1358
1359         mon_fdset_fd_dup = g_malloc0(sizeof(*mon_fdset_fd_dup));
1360         mon_fdset_fd_dup->fd = dup_fd;
1361         QLIST_INSERT_HEAD(&mon_fdset->dup_fds, mon_fdset_fd_dup, next);
1362         return dup_fd;
1363     }
1364
1365     errno = ENOENT;
1366     return -1;
1367 #endif
1368 }
1369
1370 static int64_t monitor_fdset_dup_fd_find_remove(int dup_fd, bool remove)
1371 {
1372     MonFdset *mon_fdset;
1373     MonFdsetFd *mon_fdset_fd_dup;
1374
1375     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1376     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1377         QLIST_FOREACH(mon_fdset_fd_dup, &mon_fdset->dup_fds, next) {
1378             if (mon_fdset_fd_dup->fd == dup_fd) {
1379                 if (remove) {
1380                     QLIST_REMOVE(mon_fdset_fd_dup, next);
1381                     g_free(mon_fdset_fd_dup);
1382                     if (QLIST_EMPTY(&mon_fdset->dup_fds)) {
1383                         monitor_fdset_cleanup(mon_fdset);
1384                     }
1385                     return -1;
1386                 } else {
1387                     return mon_fdset->id;
1388                 }
1389             }
1390         }
1391     }
1392
1393     return -1;
1394 }
1395
1396 int64_t monitor_fdset_dup_fd_find(int dup_fd)
1397 {
1398     return monitor_fdset_dup_fd_find_remove(dup_fd, false);
1399 }
1400
1401 void monitor_fdset_dup_fd_remove(int dup_fd)
1402 {
1403     monitor_fdset_dup_fd_find_remove(dup_fd, true);
1404 }
1405
1406 int monitor_fd_param(Monitor *mon, const char *fdname, Error **errp)
1407 {
1408     int fd;
1409     Error *local_err = NULL;
1410
1411     if (!qemu_isdigit(fdname[0]) && mon) {
1412         fd = monitor_get_fd(mon, fdname, &local_err);
1413     } else {
1414         fd = qemu_parse_fd(fdname);
1415         if (fd == -1) {
1416             error_setg(&local_err, "Invalid file descriptor number '%s'",
1417                        fdname);
1418         }
1419     }
1420     if (local_err) {
1421         error_propagate(errp, local_err);
1422         assert(fd == -1);
1423     } else {
1424         assert(fd != -1);
1425     }
1426
1427     return fd;
1428 }
1429
1430 /* Please update hmp-commands.hx when adding or changing commands */
1431 static HMPCommand hmp_info_cmds[] = {
1432 #include "hmp-commands-info.h"
1433     { NULL, NULL, },
1434 };
1435
1436 /* hmp_cmds and hmp_info_cmds would be sorted at runtime */
1437 HMPCommand hmp_cmds[] = {
1438 #include "hmp-commands.h"
1439     { NULL, NULL, },
1440 };
1441
1442 /*
1443  * Set @pval to the value in the register identified by @name.
1444  * return 0 if OK, -1 if not found
1445  */
1446 int get_monitor_def(Monitor *mon, int64_t *pval, const char *name)
1447 {
1448     const MonitorDef *md = target_monitor_defs();
1449     CPUState *cs = mon_get_cpu(mon);
1450     void *ptr;
1451     uint64_t tmp = 0;
1452     int ret;
1453
1454     if (cs == NULL || md == NULL) {
1455         return -1;
1456     }
1457
1458     for(; md->name != NULL; md++) {
1459         if (hmp_compare_cmd(name, md->name)) {
1460             if (md->get_value) {
1461                 *pval = md->get_value(mon, md, md->offset);
1462             } else {
1463                 CPUArchState *env = mon_get_cpu_env(mon);
1464                 ptr = (uint8_t *)env + md->offset;
1465                 switch(md->type) {
1466                 case MD_I32:
1467                     *pval = *(int32_t *)ptr;
1468                     break;
1469                 case MD_TLONG:
1470                     *pval = *(target_long *)ptr;
1471                     break;
1472                 default:
1473                     *pval = 0;
1474                     break;
1475                 }
1476             }
1477             return 0;
1478         }
1479     }
1480
1481     ret = target_get_monitor_def(cs, name, &tmp);
1482     if (!ret) {
1483         *pval = (target_long) tmp;
1484     }
1485
1486     return ret;
1487 }
1488
1489 static void add_completion_option(ReadLineState *rs, const char *str,
1490                                   const char *option)
1491 {
1492     if (!str || !option) {
1493         return;
1494     }
1495     if (!strncmp(option, str, strlen(str))) {
1496         readline_add_completion(rs, option);
1497     }
1498 }
1499
1500 void chardev_add_completion(ReadLineState *rs, int nb_args, const char *str)
1501 {
1502     size_t len;
1503     ChardevBackendInfoList *list, *start;
1504
1505     if (nb_args != 2) {
1506         return;
1507     }
1508     len = strlen(str);
1509     readline_set_completion_index(rs, len);
1510
1511     start = list = qmp_query_chardev_backends(NULL);
1512     while (list) {
1513         const char *chr_name = list->value->name;
1514
1515         if (!strncmp(chr_name, str, len)) {
1516             readline_add_completion(rs, chr_name);
1517         }
1518         list = list->next;
1519     }
1520     qapi_free_ChardevBackendInfoList(start);
1521 }
1522
1523 void netdev_add_completion(ReadLineState *rs, int nb_args, const char *str)
1524 {
1525     size_t len;
1526     int i;
1527
1528     if (nb_args != 2) {
1529         return;
1530     }
1531     len = strlen(str);
1532     readline_set_completion_index(rs, len);
1533     for (i = 0; i < NET_CLIENT_DRIVER__MAX; i++) {
1534         add_completion_option(rs, str, NetClientDriver_str(i));
1535     }
1536 }
1537
1538 void device_add_completion(ReadLineState *rs, int nb_args, const char *str)
1539 {
1540     GSList *list, *elt;
1541     size_t len;
1542
1543     if (nb_args != 2) {
1544         return;
1545     }
1546
1547     len = strlen(str);
1548     readline_set_completion_index(rs, len);
1549     list = elt = object_class_get_list(TYPE_DEVICE, false);
1550     while (elt) {
1551         const char *name;
1552         DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, elt->data,
1553                                              TYPE_DEVICE);
1554         name = object_class_get_name(OBJECT_CLASS(dc));
1555
1556         if (dc->user_creatable
1557             && !strncmp(name, str, len)) {
1558             readline_add_completion(rs, name);
1559         }
1560         elt = elt->next;
1561     }
1562     g_slist_free(list);
1563 }
1564
1565 void object_add_completion(ReadLineState *rs, int nb_args, const char *str)
1566 {
1567     GSList *list, *elt;
1568     size_t len;
1569
1570     if (nb_args != 2) {
1571         return;
1572     }
1573
1574     len = strlen(str);
1575     readline_set_completion_index(rs, len);
1576     list = elt = object_class_get_list(TYPE_USER_CREATABLE, false);
1577     while (elt) {
1578         const char *name;
1579
1580         name = object_class_get_name(OBJECT_CLASS(elt->data));
1581         if (!strncmp(name, str, len) && strcmp(name, TYPE_USER_CREATABLE)) {
1582             readline_add_completion(rs, name);
1583         }
1584         elt = elt->next;
1585     }
1586     g_slist_free(list);
1587 }
1588
1589 static int qdev_add_hotpluggable_device(Object *obj, void *opaque)
1590 {
1591     GSList **list = opaque;
1592     DeviceState *dev = (DeviceState *)object_dynamic_cast(obj, TYPE_DEVICE);
1593
1594     if (dev == NULL) {
1595         return 0;
1596     }
1597
1598     if (dev->realized && object_property_get_bool(obj, "hotpluggable", NULL)) {
1599         *list = g_slist_append(*list, dev);
1600     }
1601
1602     return 0;
1603 }
1604
1605 static GSList *qdev_build_hotpluggable_device_list(Object *peripheral)
1606 {
1607     GSList *list = NULL;
1608
1609     object_child_foreach(peripheral, qdev_add_hotpluggable_device, &list);
1610
1611     return list;
1612 }
1613
1614 static void peripheral_device_del_completion(ReadLineState *rs,
1615                                              const char *str, size_t len)
1616 {
1617     Object *peripheral = container_get(qdev_get_machine(), "/peripheral");
1618     GSList *list, *item;
1619
1620     list = qdev_build_hotpluggable_device_list(peripheral);
1621     if (!list) {
1622         return;
1623     }
1624
1625     for (item = list; item; item = g_slist_next(item)) {
1626         DeviceState *dev = item->data;
1627
1628         if (dev->id && !strncmp(str, dev->id, len)) {
1629             readline_add_completion(rs, dev->id);
1630         }
1631     }
1632
1633     g_slist_free(list);
1634 }
1635
1636 void chardev_remove_completion(ReadLineState *rs, int nb_args, const char *str)
1637 {
1638     size_t len;
1639     ChardevInfoList *list, *start;
1640
1641     if (nb_args != 2) {
1642         return;
1643     }
1644     len = strlen(str);
1645     readline_set_completion_index(rs, len);
1646
1647     start = list = qmp_query_chardev(NULL);
1648     while (list) {
1649         ChardevInfo *chr = list->value;
1650
1651         if (!strncmp(chr->label, str, len)) {
1652             readline_add_completion(rs, chr->label);
1653         }
1654         list = list->next;
1655     }
1656     qapi_free_ChardevInfoList(start);
1657 }
1658
1659 static void ringbuf_completion(ReadLineState *rs, const char *str)
1660 {
1661     size_t len;
1662     ChardevInfoList *list, *start;
1663
1664     len = strlen(str);
1665     readline_set_completion_index(rs, len);
1666
1667     start = list = qmp_query_chardev(NULL);
1668     while (list) {
1669         ChardevInfo *chr_info = list->value;
1670
1671         if (!strncmp(chr_info->label, str, len)) {
1672             Chardev *chr = qemu_chr_find(chr_info->label);
1673             if (chr && CHARDEV_IS_RINGBUF(chr)) {
1674                 readline_add_completion(rs, chr_info->label);
1675             }
1676         }
1677         list = list->next;
1678     }
1679     qapi_free_ChardevInfoList(start);
1680 }
1681
1682 void ringbuf_write_completion(ReadLineState *rs, int nb_args, const char *str)
1683 {
1684     if (nb_args != 2) {
1685         return;
1686     }
1687     ringbuf_completion(rs, str);
1688 }
1689
1690 void device_del_completion(ReadLineState *rs, int nb_args, const char *str)
1691 {
1692     size_t len;
1693
1694     if (nb_args != 2) {
1695         return;
1696     }
1697
1698     len = strlen(str);
1699     readline_set_completion_index(rs, len);
1700     peripheral_device_del_completion(rs, str, len);
1701 }
1702
1703 void object_del_completion(ReadLineState *rs, int nb_args, const char *str)
1704 {
1705     ObjectPropertyInfoList *list, *start;
1706     size_t len;
1707
1708     if (nb_args != 2) {
1709         return;
1710     }
1711     len = strlen(str);
1712     readline_set_completion_index(rs, len);
1713
1714     start = list = qmp_qom_list("/objects", NULL);
1715     while (list) {
1716         ObjectPropertyInfo *info = list->value;
1717
1718         if (!strncmp(info->type, "child<", 5)
1719             && !strncmp(info->name, str, len)) {
1720             readline_add_completion(rs, info->name);
1721         }
1722         list = list->next;
1723     }
1724     qapi_free_ObjectPropertyInfoList(start);
1725 }
1726
1727 void sendkey_completion(ReadLineState *rs, int nb_args, const char *str)
1728 {
1729     int i;
1730     char *sep;
1731     size_t len;
1732
1733     if (nb_args != 2) {
1734         return;
1735     }
1736     sep = strrchr(str, '-');
1737     if (sep) {
1738         str = sep + 1;
1739     }
1740     len = strlen(str);
1741     readline_set_completion_index(rs, len);
1742     for (i = 0; i < Q_KEY_CODE__MAX; i++) {
1743         if (!strncmp(str, QKeyCode_str(i), len)) {
1744             readline_add_completion(rs, QKeyCode_str(i));
1745         }
1746     }
1747 }
1748
1749 void set_link_completion(ReadLineState *rs, int nb_args, const char *str)
1750 {
1751     size_t len;
1752
1753     len = strlen(str);
1754     readline_set_completion_index(rs, len);
1755     if (nb_args == 2) {
1756         NetClientState *ncs[MAX_QUEUE_NUM];
1757         int count, i;
1758         count = qemu_find_net_clients_except(NULL, ncs,
1759                                              NET_CLIENT_DRIVER_NONE,
1760                                              MAX_QUEUE_NUM);
1761         for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
1762             const char *name = ncs[i]->name;
1763             if (!strncmp(str, name, len)) {
1764                 readline_add_completion(rs, name);
1765             }
1766         }
1767     } else if (nb_args == 3) {
1768         add_completion_option(rs, str, "on");
1769         add_completion_option(rs, str, "off");
1770     }
1771 }
1772
1773 void netdev_del_completion(ReadLineState *rs, int nb_args, const char *str)
1774 {
1775     int len, count, i;
1776     NetClientState *ncs[MAX_QUEUE_NUM];
1777
1778     if (nb_args != 2) {
1779         return;
1780     }
1781
1782     len = strlen(str);
1783     readline_set_completion_index(rs, len);
1784     count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_DRIVER_NIC,
1785                                          MAX_QUEUE_NUM);
1786     for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
1787         const char *name = ncs[i]->name;
1788         if (strncmp(str, name, len)) {
1789             continue;
1790         }
1791         if (ncs[i]->is_netdev) {
1792             readline_add_completion(rs, name);
1793         }
1794     }
1795 }
1796
1797 void info_trace_events_completion(ReadLineState *rs, int nb_args, const char *str)
1798 {
1799     size_t len;
1800
1801     len = strlen(str);
1802     readline_set_completion_index(rs, len);
1803     if (nb_args == 2) {
1804         TraceEventIter iter;
1805         TraceEvent *ev;
1806         char *pattern = g_strdup_printf("%s*", str);
1807         trace_event_iter_init_pattern(&iter, pattern);
1808         while ((ev = trace_event_iter_next(&iter)) != NULL) {
1809             readline_add_completion(rs, trace_event_get_name(ev));
1810         }
1811         g_free(pattern);
1812     }
1813 }
1814
1815 void trace_event_completion(ReadLineState *rs, int nb_args, const char *str)
1816 {
1817     size_t len;
1818
1819     len = strlen(str);
1820     readline_set_completion_index(rs, len);
1821     if (nb_args == 2) {
1822         TraceEventIter iter;
1823         TraceEvent *ev;
1824         char *pattern = g_strdup_printf("%s*", str);
1825         trace_event_iter_init_pattern(&iter, pattern);
1826         while ((ev = trace_event_iter_next(&iter)) != NULL) {
1827             readline_add_completion(rs, trace_event_get_name(ev));
1828         }
1829         g_free(pattern);
1830     } else if (nb_args == 3) {
1831         add_completion_option(rs, str, "on");
1832         add_completion_option(rs, str, "off");
1833     }
1834 }
1835
1836 void watchdog_action_completion(ReadLineState *rs, int nb_args, const char *str)
1837 {
1838     int i;
1839
1840     if (nb_args != 2) {
1841         return;
1842     }
1843     readline_set_completion_index(rs, strlen(str));
1844     for (i = 0; i < WATCHDOG_ACTION__MAX; i++) {
1845         add_completion_option(rs, str, WatchdogAction_str(i));
1846     }
1847 }
1848
1849 void migrate_set_capability_completion(ReadLineState *rs, int nb_args,
1850                                        const char *str)
1851 {
1852     size_t len;
1853
1854     len = strlen(str);
1855     readline_set_completion_index(rs, len);
1856     if (nb_args == 2) {
1857         int i;
1858         for (i = 0; i < MIGRATION_CAPABILITY__MAX; i++) {
1859             const char *name = MigrationCapability_str(i);
1860             if (!strncmp(str, name, len)) {
1861                 readline_add_completion(rs, name);
1862             }
1863         }
1864     } else if (nb_args == 3) {
1865         add_completion_option(rs, str, "on");
1866         add_completion_option(rs, str, "off");
1867     }
1868 }
1869
1870 void migrate_set_parameter_completion(ReadLineState *rs, int nb_args,
1871                                       const char *str)
1872 {
1873     size_t len;
1874
1875     len = strlen(str);
1876     readline_set_completion_index(rs, len);
1877     if (nb_args == 2) {
1878         int i;
1879         for (i = 0; i < MIGRATION_PARAMETER__MAX; i++) {
1880             const char *name = MigrationParameter_str(i);
1881             if (!strncmp(str, name, len)) {
1882                 readline_add_completion(rs, name);
1883             }
1884         }
1885     }
1886 }
1887
1888 static void vm_completion(ReadLineState *rs, const char *str)
1889 {
1890     size_t len;
1891     BlockDriverState *bs;
1892     BdrvNextIterator it;
1893
1894     len = strlen(str);
1895     readline_set_completion_index(rs, len);
1896
1897     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
1898         SnapshotInfoList *snapshots, *snapshot;
1899         AioContext *ctx = bdrv_get_aio_context(bs);
1900         bool ok = false;
1901
1902         aio_context_acquire(ctx);
1903         if (bdrv_can_snapshot(bs)) {
1904             ok = bdrv_query_snapshot_info_list(bs, &snapshots, NULL) == 0;
1905         }
1906         aio_context_release(ctx);
1907         if (!ok) {
1908             continue;
1909         }
1910
1911         snapshot = snapshots;
1912         while (snapshot) {
1913             char *completion = snapshot->value->name;
1914             if (!strncmp(str, completion, len)) {
1915                 readline_add_completion(rs, completion);
1916             }
1917             completion = snapshot->value->id;
1918             if (!strncmp(str, completion, len)) {
1919                 readline_add_completion(rs, completion);
1920             }
1921             snapshot = snapshot->next;
1922         }
1923         qapi_free_SnapshotInfoList(snapshots);
1924     }
1925
1926 }
1927
1928 void delvm_completion(ReadLineState *rs, int nb_args, const char *str)
1929 {
1930     if (nb_args == 2) {
1931         vm_completion(rs, str);
1932     }
1933 }
1934
1935 void loadvm_completion(ReadLineState *rs, int nb_args, const char *str)
1936 {
1937     if (nb_args == 2) {
1938         vm_completion(rs, str);
1939     }
1940 }
1941
1942 static int
1943 compare_mon_cmd(const void *a, const void *b)
1944 {
1945     return strcmp(((const HMPCommand *)a)->name,
1946             ((const HMPCommand *)b)->name);
1947 }
1948
1949 static void sortcmdlist(void)
1950 {
1951     qsort(hmp_cmds, ARRAY_SIZE(hmp_cmds) - 1,
1952           sizeof(*hmp_cmds),
1953           compare_mon_cmd);
1954     qsort(hmp_info_cmds, ARRAY_SIZE(hmp_info_cmds) - 1,
1955           sizeof(*hmp_info_cmds),
1956           compare_mon_cmd);
1957 }
1958
1959 void monitor_register_hmp(const char *name, bool info,
1960                           void (*cmd)(Monitor *mon, const QDict *qdict))
1961 {
1962     HMPCommand *table = info ? hmp_info_cmds : hmp_cmds;
1963
1964     while (table->name != NULL) {
1965         if (strcmp(table->name, name) == 0) {
1966             g_assert(table->cmd == NULL);
1967             table->cmd = cmd;
1968             return;
1969         }
1970         table++;
1971     }
1972     g_assert_not_reached();
1973 }
1974
1975 void monitor_init_globals(void)
1976 {
1977     monitor_init_globals_core();
1978     monitor_init_qmp_commands();
1979     sortcmdlist();
1980     qemu_mutex_init(&mon_fdsets_lock);
1981 }