1 QEMU Machine Protocol Specification
6 Copyright (C) 2009-2016 Red Hat, Inc.
8 This work is licensed under the terms of the GNU GPL, version 2 or
9 later. See the COPYING file in the top-level directory.
14 This document specifies the QEMU Machine Protocol (QMP), a JSON-based
15 protocol which is available for applications to operate QEMU at the
16 machine-level. It is also in use by the QEMU Guest Agent (QGA), which
17 is available for host applications to interact with the guest
20 2. Protocol Specification
21 =========================
23 This section details the protocol format. For the purpose of this
24 document, "Server" is either QEMU or the QEMU Guest Agent, and
25 "Client" is any application communicating with it via QMP.
27 JSON data structures, when mentioned in this document, are always in the
30 json-DATA-STRUCTURE-NAME
32 Where DATA-STRUCTURE-NAME is any valid JSON data structure, as defined
35 http://www.ietf.org/rfc/rfc8259.txt
37 The server expects its input to be encoded in UTF-8, and sends its
38 output encoded in ASCII.
40 For convenience, json-object members mentioned in this document will
41 be in a certain order. However, in real protocol usage they can be in
42 ANY order, thus no particular order should be assumed. On the other
43 hand, use of json-array elements presumes that preserving order is
44 important unless specifically documented otherwise. Repeating a key
45 within a json-object gives unpredictable results.
47 Also for convenience, the server will accept an extension of
48 'single-quoted' strings in place of the usual "double-quoted"
49 json-string, and both input forms of strings understand an additional
50 escape sequence of "\'" for a single quote. The server will only use
51 double quoting on output.
53 2.1 General Definitions
54 -----------------------
56 2.1.1 All interactions transmitted by the Server are json-objects, always
59 2.1.2 All json-objects members are mandatory when not specified otherwise
64 Right when connected the Server will issue a greeting message, which signals
65 that the connection has been successfully established and that the Server is
66 ready for capabilities negotiation (for more information refer to section
67 '4. Capabilities Negotiation').
69 The greeting message format is:
71 { "QMP": { "version": json-object, "capabilities": json-array } }
75 - The "version" member contains the Server's version information (the format
76 is the same of the query-version command)
77 - The "capabilities" member specify the availability of features beyond the
78 baseline specification; the order of elements in this array has no
79 particular significance.
84 Currently supported capabilities are:
86 - "oob": the QMP server supports "out-of-band" (OOB) command
87 execution, as described in section "2.3.1 Out-of-band execution".
92 The format for command execution is:
94 { "execute": json-string, "arguments": json-object, "id": json-value }
98 { "exec-oob": json-string, "arguments": json-object, "id": json-value }
102 - The "execute" or "exec-oob" member identifies the command to be
103 executed by the server. The latter requests out-of-band execution.
104 - The "arguments" member is used to pass any arguments required for the
105 execution of the command, it is optional when no arguments are
106 required. Each command documents what contents will be considered
107 valid when handling the json-argument
108 - The "id" member is a transaction identification associated with the
109 command execution, it is optional and will be part of the response
110 if provided. The "id" member can be any json-value. A json-number
111 incremented for each successive command works fine.
113 The actual commands are documented in the QEMU QMP reference manual
114 docs/interop/qemu-qmp-ref.{7,html,info,pdf,txt}.
116 2.3.1 Out-of-band execution
117 ---------------------------
119 The server normally reads, executes and responds to one command after
120 the other. The client therefore receives command responses in issue
123 With out-of-band execution enabled via capability negotiation (section
124 4.), the server reads and queues commands as they arrive. It executes
125 commands from the queue one after the other. Commands executed
126 out-of-band jump the queue: the command get executed right away,
127 possibly overtaking prior in-band commands. The client may therefore
128 receive such a command's response before responses from prior in-band
131 To be able to match responses back to their commands, the client needs
132 to pass "id" with out-of-band commands. Passing it with all commands
133 is recommended for clients that accept capability "oob".
135 If the client sends in-band commands faster than the server can
136 execute them, the server will stop reading requests until the request
137 queue length is reduced to an acceptable range.
139 To ensure commands to be executed out-of-band get read and executed,
140 the client should have at most eight in-band commands in flight.
142 Only a few commands support out-of-band execution. The ones that do
143 have "allow-oob": true in output of query-qmp-schema.
145 2.4 Commands Responses
146 ----------------------
148 There are two possible responses which the Server will issue as the result
149 of a command execution: success or error.
151 As long as the commands were issued with a proper "id" field, then the
152 same "id" field will be attached in the corresponding response message
153 so that requests and responses can match. Clients should drop all the
154 responses that have an unknown "id" field.
159 The format of a success response is:
161 { "return": json-value, "id": json-value }
165 - The "return" member contains the data returned by the command, which
166 is defined on a per-command basis (usually a json-object or
167 json-array of json-objects, but sometimes a json-number, json-string,
168 or json-array of json-strings); it is an empty json-object if the
169 command does not return data
170 - The "id" member contains the transaction identification associated
171 with the command execution if issued by the Client
176 The format of an error response is:
178 { "error": { "class": json-string, "desc": json-string }, "id": json-value }
182 - The "class" member contains the error class name (eg. "GenericError")
183 - The "desc" member is a human-readable error message. Clients should
184 not attempt to parse this message.
185 - The "id" member contains the transaction identification associated with
186 the command execution if issued by the Client
188 NOTE: Some errors can occur before the Server is able to read the "id" member,
189 in these cases the "id" member will not be part of the error response, even
190 if provided by the client.
192 2.5 Asynchronous events
193 -----------------------
195 As a result of state changes, the Server may send messages unilaterally
196 to the Client at any time, when not in the middle of any other
197 response. They are called "asynchronous events".
199 The format of asynchronous events is:
201 { "event": json-string, "data": json-object,
202 "timestamp": { "seconds": json-number, "microseconds": json-number } }
206 - The "event" member contains the event's name
207 - The "data" member contains event specific data, which is defined in a
208 per-event basis, it is optional
209 - The "timestamp" member contains the exact time of when the event
210 occurred in the Server. It is a fixed json-object with time in
211 seconds and microseconds relative to the Unix Epoch (1 Jan 1970); if
212 there is a failure to retrieve host time, both members of the
213 timestamp will be set to -1.
215 The actual asynchronous events are documented in the QEMU QMP
216 reference manual docs/interop/qemu-qmp-ref.{7,html,info,pdf,txt}.
218 Some events are rate-limited to at most one per second. If additional
219 "similar" events arrive within one second, all but the last one are
220 dropped, and the last one is delayed. "Similar" normally means same
223 2.6 Forcing the JSON parser into known-good state
224 -------------------------------------------------
226 Incomplete or invalid input can leave the server's JSON parser in a
227 state where it can't parse additional commands. To get it back into
228 known-good state, the client should provoke a lexical error.
230 The cleanest way to do that is sending an ASCII control character
231 other than '\t' (horizontal tab), '\r' (carriage return), or '\n' (new
234 Sadly, older versions of QEMU can fail to flag this as an error. If a
235 client needs to deal with them, it should send a 0xFF byte.
237 2.7 QGA Synchronization
238 -----------------------
240 When a client connects to QGA over a transport lacking proper
241 connection semantics such as virtio-serial, QGA may have read partial
242 input from a previous client. The client needs to force QGA's parser
243 into known-good state using the previous section's technique.
244 Moreover, the client may receive output a previous client didn't read.
245 To help with skipping that output, QGA provides the
246 'guest-sync-delimited' command. Refer to its documentation for
253 This section provides some examples of real QMP usage, in all of them
254 "C" stands for "Client" and "S" stands for "Server".
259 S: { "QMP": {"version": {"qemu": {"micro": 0, "minor": 0, "major": 3},
260 "package": "v3.0.0"}, "capabilities": ["oob"] } }
262 3.2 Capabilities negotiation
263 ----------------------------
265 C: { "execute": "qmp_capabilities", "arguments": { "enable": ["oob"] } }
268 3.3 Simple 'stop' execution
269 ---------------------------
271 C: { "execute": "stop" }
277 C: { "execute": "query-kvm", "id": "example" }
278 S: { "return": { "enabled": true, "present": true }, "id": "example"}
284 S: { "error": { "class": "GenericError", "desc": "Invalid JSON syntax" } }
289 S: { "timestamp": { "seconds": 1258551470, "microseconds": 802384 },
290 "event": "POWERDOWN" }
292 3.7 Out-of-band execution
293 -------------------------
295 C: { "exec-oob": "migrate-pause", "id": 42 }
297 "error": { "class": "GenericError",
298 "desc": "migrate-pause is currently only supported during postcopy-active state" } }
301 4. Capabilities Negotiation
302 ===========================
304 When a Client successfully establishes a connection, the Server is in
305 Capabilities Negotiation mode.
307 In this mode only the qmp_capabilities command is allowed to run, all
308 other commands will return the CommandNotFound error. Asynchronous
309 messages are not delivered either.
311 Clients should use the qmp_capabilities command to enable capabilities
312 advertised in the Server's greeting (section '2.2 Server Greeting') they
315 When the qmp_capabilities command is issued, and if it does not return an
316 error, the Server enters in Command mode where capabilities changes take
317 effect, all commands (except qmp_capabilities) are allowed and asynchronous
318 messages are delivered.
320 5 Compatibility Considerations
321 ==============================
323 All protocol changes or new features which modify the protocol format in an
324 incompatible way are disabled by default and will be advertised by the
325 capabilities array (section '2.2 Server Greeting'). Thus, Clients can check
326 that array and enable the capabilities they support.
328 The QMP Server performs a type check on the arguments to a command. It
329 generates an error if a value does not have the expected type for its
330 key, or if it does not understand a key that the Client included. The
331 strictness of the Server catches wrong assumptions of Clients about
332 the Server's schema. Clients can assume that, when such validation
333 errors occur, they will be reported before the command generated any
336 However, Clients must not assume any particular:
338 - Length of json-arrays
339 - Size of json-objects; in particular, future versions of QEMU may add
340 new keys and Clients should be able to ignore them.
341 - Order of json-object members or json-array elements
342 - Amount of errors generated by a command, that is, new errors can be added
343 to any existing command in newer versions of the Server
345 Any command or member name beginning with "x-" is deemed experimental,
346 and may be withdrawn or changed in an incompatible manner in a future
349 Of course, the Server does guarantee to send valid JSON. But apart from
350 this, a Client should be "conservative in what they send, and liberal in
353 6. Downstream extension of QMP
354 ==============================
356 We recommend that downstream consumers of QEMU do *not* modify QMP.
357 Management tools should be able to support both upstream and downstream
358 versions of QMP without special logic, and downstream extensions are
359 inherently at odds with that.
361 However, we recognize that it is sometimes impossible for downstreams to
362 avoid modifying QMP. Both upstream and downstream need to take care to
363 preserve long-term compatibility and interoperability.
365 To help with that, QMP reserves JSON object member names beginning with
366 '__' (double underscore) for downstream use ("downstream names"). This
367 means upstream will never use any downstream names for its commands,
368 arguments, errors, asynchronous events, and so forth.
370 Any new names downstream wishes to add must begin with '__'. To
371 ensure compatibility with other downstreams, it is strongly
372 recommended that you prefix your downstream names with '__RFQDN_' where
373 RFQDN is a valid, reverse fully qualified domain name which you
374 control. For example, a qemu-kvm specific monitor command would be:
376 (qemu) __org.linux-kvm_enable_irqchip
378 Downstream must not change the server greeting (section 2.2) other than
379 to offer additional capabilities. But see below for why even that is
382 Section '5 Compatibility Considerations' applies to downstream as well
383 as to upstream, obviously. It follows that downstream must behave
384 exactly like upstream for any input not containing members with
385 downstream names ("downstream members"), except it may add members
386 with downstream names to its output.
388 Thus, a client should not be able to distinguish downstream from
389 upstream as long as it doesn't send input with downstream members, and
390 properly ignores any downstream members in the output it receives.
392 Advice on downstream modifications:
394 1. Introducing new commands is okay. If you want to extend an existing
395 command, consider introducing a new one with the new behaviour
398 2. Introducing new asynchronous messages is okay. If you want to extend
399 an existing message, consider adding a new one instead.
401 3. Introducing new errors for use in new commands is okay. Adding new
402 errors to existing commands counts as extension, so 1. applies.
404 4. New capabilities are strongly discouraged. Capabilities are for
405 evolving the basic protocol, and multiple diverging basic protocol
406 dialects are most undesirable.