monitor/misc.c

   1 /*
   2  * QEMU monitor
   3  *
   4  * Copyright (c) 2003-2004 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26 #include "monitor-internal.h"
  27 #include "monitor/qdev.h"
  28 #include "hw/usb.h"
  29 #include "hw/pci/pci.h"
  30 #include "sysemu/watchdog.h"
  31 #include "hw/loader.h"
  32 #include "exec/gdbstub.h"
  33 #include "net/net.h"
  34 #include "net/slirp.h"
  35 #include "ui/qemu-spice.h"
  36 #include "qemu/config-file.h"
  37 #include "qemu/ctype.h"
  38 #include "ui/console.h"
  39 #include "ui/input.h"
  40 #include "audio/audio.h"
  41 #include "disas/disas.h"
  42 #include "sysemu/balloon.h"
  43 #include "qemu/timer.h"
  44 #include "qemu/log.h"
  45 #include "sysemu/hw_accel.h"
  46 #include "sysemu/runstate.h"
  47 #include "authz/list.h"
  48 #include "qapi/util.h"
  49 #include "sysemu/blockdev.h"
  50 #include "sysemu/sysemu.h"
  51 #include "sysemu/tpm.h"
  52 #include "qapi/qmp/qdict.h"
  53 #include "qapi/qmp/qerror.h"
  54 #include "qapi/qmp/qstring.h"
  55 #include "qom/object_interfaces.h"
  56 #include "trace/control.h"
  57 #include "monitor/hmp-target.h"
  58 #include "monitor/hmp.h"
  59 #ifdef CONFIG_TRACE_SIMPLE
  60 #include "trace/simple.h"
  61 #endif
  62 #include "exec/memory.h"
  63 #include "exec/exec-all.h"
  64 #include "qemu/option.h"
  65 #include "qemu/thread.h"
  66 #include "block/qapi.h"
  67 #include "block/block-hmp-cmds.h"
  68 #include "qapi/qapi-commands-char.h"
  69 #include "qapi/qapi-commands-control.h"
  70 #include "qapi/qapi-commands-migration.h"
  71 #include "qapi/qapi-commands-misc.h"
  72 #include "qapi/qapi-commands-qom.h"
  73 #include "qapi/qapi-commands-run-state.h"
  74 #include "qapi/qapi-commands-trace.h"
  75 #include "qapi/qapi-commands-machine.h"
  76 #include "qapi/qapi-init-commands.h"
  77 #include "qapi/error.h"
  78 #include "qapi/qmp-event.h"
  79 #include "sysemu/cpus.h"
  80 #include "qemu/cutils.h"
  81
  82 #if defined(TARGET_S390X)
  83 #include "hw/s390x/storage-keys.h"
  84 #include "hw/s390x/storage-attributes.h"
  85 #endif
  86
  87 /* file descriptors passed via SCM_RIGHTS */
  88 typedef struct mon_fd_t mon_fd_t;
  89 struct mon_fd_t {
  90     char *name;
  91     int fd;
  92     QLIST_ENTRY(mon_fd_t) next;
  93 };
  94
  95 /* file descriptor associated with a file descriptor set */
  96 typedef struct MonFdsetFd MonFdsetFd;
  97 struct MonFdsetFd {
  98     int fd;
  99     bool removed;
 100     char *opaque;
 101     QLIST_ENTRY(MonFdsetFd) next;
 102 };
 103
 104 /* file descriptor set containing fds passed via SCM_RIGHTS */
 105 typedef struct MonFdset MonFdset;
 106 struct MonFdset {
 107     int64_t id;
 108     QLIST_HEAD(, MonFdsetFd) fds;
 109     QLIST_HEAD(, MonFdsetFd) dup_fds;
 110     QLIST_ENTRY(MonFdset) next;
 111 };
 112
 113 /* Protects mon_fdsets */
 114 static QemuMutex mon_fdsets_lock;
 115 static QLIST_HEAD(, MonFdset) mon_fdsets;
 116
 117 static HMPCommand hmp_info_cmds[];
 118
 119 char *qmp_human_monitor_command(const char *command_line, bool has_cpu_index,
 120                                 int64_t cpu_index, Error **errp)
 121 {
 122     char *output = NULL;
 123     MonitorHMP hmp = {};
 124
 125     monitor_data_init(&hmp.common, false, true, false);
 126
 127     if (has_cpu_index) {
 128         int ret = monitor_set_cpu(&hmp.common, cpu_index);
 129         if (ret < 0) {
 130             error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "cpu-index",
 131                        "a CPU number");
 132             goto out;
 133         }
 134     }
 135
 136     handle_hmp_command(&hmp, command_line);
 137
 138     WITH_QEMU_LOCK_GUARD(&hmp.common.mon_lock) {
 139         output = g_strdup(hmp.common.outbuf->str);
 140     }
 141
 142 out:
 143     monitor_data_destroy(&hmp.common);
 144     return output;
 145 }
 146
 147 /**
 148  * Is @name in the '|' separated list of names @list?
 149  */
 150 int hmp_compare_cmd(const char *name, const char *list)
 151 {
 152     const char *p, *pstart;
 153     int len;
 154     len = strlen(name);
 155     p = list;
 156     for (;;) {
 157         pstart = p;
 158         p = qemu_strchrnul(p, '|');
 159         if ((p - pstart) == len && !memcmp(pstart, name, len)) {
 160             return 1;
 161         }
 162         if (*p == '\0') {
 163             break;
 164         }
 165         p++;
 166     }
 167     return 0;
 168 }
 169
 170 static void do_help_cmd(Monitor *mon, const QDict *qdict)
 171 {
 172     help_cmd(mon, qdict_get_try_str(qdict, "name"));
 173 }
 174
 175 static void hmp_trace_event(Monitor *mon, const QDict *qdict)
 176 {
 177     const char *tp_name = qdict_get_str(qdict, "name");
 178     bool new_state = qdict_get_bool(qdict, "option");
 179     bool has_vcpu = qdict_haskey(qdict, "vcpu");
 180     int vcpu = qdict_get_try_int(qdict, "vcpu", 0);
 181     Error *local_err = NULL;
 182
 183     if (vcpu < 0) {
 184         monitor_printf(mon, "argument vcpu must be positive");
 185         return;
 186     }
 187
 188     qmp_trace_event_set_state(tp_name, new_state, true, true, has_vcpu, vcpu, &local_err);
 189     if (local_err) {
 190         error_report_err(local_err);
 191     }
 192 }
 193
 194 #ifdef CONFIG_TRACE_SIMPLE
 195 static void hmp_trace_file(Monitor *mon, const QDict *qdict)
 196 {
 197     const char *op = qdict_get_try_str(qdict, "op");
 198     const char *arg = qdict_get_try_str(qdict, "arg");
 199
 200     if (!op) {
 201         st_print_trace_file_status();
 202     } else if (!strcmp(op, "on")) {
 203         st_set_trace_file_enabled(true);
 204     } else if (!strcmp(op, "off")) {
 205         st_set_trace_file_enabled(false);
 206     } else if (!strcmp(op, "flush")) {
 207         st_flush_trace_buffer();
 208     } else if (!strcmp(op, "set")) {
 209         if (arg) {
 210             st_set_trace_file(arg);
 211         }
 212     } else {
 213         monitor_printf(mon, "unexpected argument \"%s\"\n", op);
 214         help_cmd(mon, "trace-file");
 215     }
 216 }
 217 #endif
 218
 219 static void hmp_info_help(Monitor *mon, const QDict *qdict)
 220 {
 221     help_cmd(mon, "info");
 222 }
 223
 224 static void monitor_init_qmp_commands(void)
 225 {
 226     /*
 227      * Two command lists:
 228      * - qmp_commands contains all QMP commands
 229      * - qmp_cap_negotiation_commands contains just
 230      *   "qmp_capabilities", to enforce capability negotiation
 231      */
 232
 233     qmp_init_marshal(&qmp_commands);
 234
 235     qmp_register_command(&qmp_commands, "device_add",
 236                          qmp_device_add, 0, 0);
 237
 238     QTAILQ_INIT(&qmp_cap_negotiation_commands);
 239     qmp_register_command(&qmp_cap_negotiation_commands, "qmp_capabilities",
 240                          qmp_marshal_qmp_capabilities,
 241                          QCO_ALLOW_PRECONFIG, 0);
 242 }
 243
 244 /* Set the current CPU defined by the user. Callers must hold BQL. */
 245 int monitor_set_cpu(Monitor *mon, int cpu_index)
 246 {
 247     CPUState *cpu;
 248
 249     cpu = qemu_get_cpu(cpu_index);
 250     if (cpu == NULL) {
 251         return -1;
 252     }
 253     g_free(mon->mon_cpu_path);
 254     mon->mon_cpu_path = object_get_canonical_path(OBJECT(cpu));
 255     return 0;
 256 }
 257
 258 /* Callers must hold BQL. */
 259 static CPUState *mon_get_cpu_sync(Monitor *mon, bool synchronize)
 260 {
 261     CPUState *cpu = NULL;
 262
 263     if (mon->mon_cpu_path) {
 264         cpu = (CPUState *) object_resolve_path_type(mon->mon_cpu_path,
 265                                                     TYPE_CPU, NULL);
 266         if (!cpu) {
 267             g_free(mon->mon_cpu_path);
 268             mon->mon_cpu_path = NULL;
 269         }
 270     }
 271     if (!mon->mon_cpu_path) {
 272         if (!first_cpu) {
 273             return NULL;
 274         }
 275         monitor_set_cpu(mon, first_cpu->cpu_index);
 276         cpu = first_cpu;
 277     }
 278     assert(cpu != NULL);
 279     if (synchronize) {
 280         cpu_synchronize_state(cpu);
 281     }
 282     return cpu;
 283 }
 284
 285 CPUState *mon_get_cpu(Monitor *mon)
 286 {
 287     return mon_get_cpu_sync(mon, true);
 288 }
 289
 290 CPUArchState *mon_get_cpu_env(Monitor *mon)
 291 {
 292     CPUState *cs = mon_get_cpu(mon);
 293
 294     return cs ? cs->env_ptr : NULL;
 295 }
 296
 297 int monitor_get_cpu_index(Monitor *mon)
 298 {
 299     CPUState *cs = mon_get_cpu_sync(mon, false);
 300
 301     return cs ? cs->cpu_index : UNASSIGNED_CPU_INDEX;
 302 }
 303
 304 static void hmp_info_registers(Monitor *mon, const QDict *qdict)
 305 {
 306     bool all_cpus = qdict_get_try_bool(qdict, "cpustate_all", false);
 307     CPUState *cs;
 308
 309     if (all_cpus) {
 310         CPU_FOREACH(cs) {
 311             monitor_printf(mon, "\nCPU#%d\n", cs->cpu_index);
 312             cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
 313         }
 314     } else {
 315         cs = mon_get_cpu(mon);
 316
 317         if (!cs) {
 318             monitor_printf(mon, "No CPU available\n");
 319             return;
 320         }
 321
 322         cpu_dump_state(cs, NULL, CPU_DUMP_FPU);
 323     }
 324 }
 325
 326 static void hmp_info_sync_profile(Monitor *mon, const QDict *qdict)
 327 {
 328     int64_t max = qdict_get_try_int(qdict, "max", 10);
 329     bool mean = qdict_get_try_bool(qdict, "mean", false);
 330     bool coalesce = !qdict_get_try_bool(qdict, "no_coalesce", false);
 331     enum QSPSortBy sort_by;
 332
 333     sort_by = mean ? QSP_SORT_BY_AVG_WAIT_TIME : QSP_SORT_BY_TOTAL_WAIT_TIME;
 334     qsp_report(max, sort_by, coalesce);
 335 }
 336
 337 static void hmp_info_history(Monitor *mon, const QDict *qdict)
 338 {
 339     MonitorHMP *hmp_mon = container_of(mon, MonitorHMP, common);
 340     int i;
 341     const char *str;
 342
 343     if (!hmp_mon->rs) {
 344         return;
 345     }
 346     i = 0;
 347     for(;;) {
 348         str = readline_get_history(hmp_mon->rs, i);
 349         if (!str) {
 350             break;
 351         }
 352         monitor_printf(mon, "%d: '%s'\n", i, str);
 353         i++;
 354     }
 355 }
 356
 357 static void hmp_info_trace_events(Monitor *mon, const QDict *qdict)
 358 {
 359     const char *name = qdict_get_try_str(qdict, "name");
 360     bool has_vcpu = qdict_haskey(qdict, "vcpu");
 361     int vcpu = qdict_get_try_int(qdict, "vcpu", 0);
 362     TraceEventInfoList *events;
 363     TraceEventInfoList *elem;
 364     Error *local_err = NULL;
 365
 366     if (name == NULL) {
 367         name = "*";
 368     }
 369     if (vcpu < 0) {
 370         monitor_printf(mon, "argument vcpu must be positive");
 371         return;
 372     }
 373
 374     events = qmp_trace_event_get_state(name, has_vcpu, vcpu, &local_err);
 375     if (local_err) {
 376         error_report_err(local_err);
 377         return;
 378     }
 379
 380     for (elem = events; elem != NULL; elem = elem->next) {
 381         monitor_printf(mon, "%s : state %u\n",
 382                        elem->value->name,
 383                        elem->value->state == TRACE_EVENT_STATE_ENABLED ? 1 : 0);
 384     }
 385     qapi_free_TraceEventInfoList(events);
 386 }
 387
 388 void qmp_client_migrate_info(const char *protocol, const char *hostname,
 389                              bool has_port, int64_t port,
 390                              bool has_tls_port, int64_t tls_port,
 391                              bool has_cert_subject, const char *cert_subject,
 392                              Error **errp)
 393 {
 394     if (strcmp(protocol, "spice") == 0) {
 395         if (!qemu_using_spice(errp)) {
 396             return;
 397         }
 398
 399         if (!has_port && !has_tls_port) {
 400             error_setg(errp, QERR_MISSING_PARAMETER, "port/tls-port");
 401             return;
 402         }
 403
 404         if (qemu_spice.migrate_info(hostname,
 405                                     has_port ? port : -1,
 406                                     has_tls_port ? tls_port : -1,
 407                                     cert_subject)) {
 408             error_setg(errp, "Could not set up display for migration");
 409             return;
 410         }
 411         return;
 412     }
 413
 414     error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "protocol", "'spice'");
 415 }
 416
 417 static void hmp_logfile(Monitor *mon, const QDict *qdict)
 418 {
 419     Error *err = NULL;
 420
 421     if (!qemu_set_log_filename(qdict_get_str(qdict, "filename"), &err)) {
 422         error_report_err(err);
 423     }
 424 }
 425
 426 static void hmp_log(Monitor *mon, const QDict *qdict)
 427 {
 428     int mask;
 429     const char *items = qdict_get_str(qdict, "items");
 430     Error *err = NULL;
 431
 432     if (!strcmp(items, "none")) {
 433         mask = 0;
 434     } else {
 435         mask = qemu_str_to_log_mask(items);
 436         if (!mask) {
 437             help_cmd(mon, "log");
 438             return;
 439         }
 440     }
 441
 442     if (!qemu_set_log(mask, &err)) {
 443         error_report_err(err);
 444     }
 445 }
 446
 447 static void hmp_singlestep(Monitor *mon, const QDict *qdict)
 448 {
 449     const char *option = qdict_get_try_str(qdict, "option");
 450     if (!option || !strcmp(option, "on")) {
 451         singlestep = 1;
 452     } else if (!strcmp(option, "off")) {
 453         singlestep = 0;
 454     } else {
 455         monitor_printf(mon, "unexpected option %s\n", option);
 456     }
 457 }
 458
 459 static void hmp_gdbserver(Monitor *mon, const QDict *qdict)
 460 {
 461     const char *device = qdict_get_try_str(qdict, "device");
 462     if (!device) {
 463         device = "tcp::" DEFAULT_GDBSTUB_PORT;
 464     }
 465
 466     if (gdbserver_start(device) < 0) {
 467         monitor_printf(mon, "Could not open gdbserver on device '%s'\n",
 468                        device);
 469     } else if (strcmp(device, "none") == 0) {
 470         monitor_printf(mon, "Disabled gdbserver\n");
 471     } else {
 472         monitor_printf(mon, "Waiting for gdb connection on device '%s'\n",
 473                        device);
 474     }
 475 }
 476
 477 static void hmp_watchdog_action(Monitor *mon, const QDict *qdict)
 478 {
 479     Error *err = NULL;
 480     WatchdogAction action;
 481     char *qapi_value;
 482
 483     qapi_value = g_ascii_strdown(qdict_get_str(qdict, "action"), -1);
 484     action = qapi_enum_parse(&WatchdogAction_lookup, qapi_value, -1, &err);
 485     g_free(qapi_value);
 486     if (err) {
 487         hmp_handle_error(mon, err);
 488         return;
 489     }
 490     qmp_watchdog_set_action(action, &error_abort);
 491 }
 492
 493 static void monitor_printc(Monitor *mon, int c)
 494 {
 495     monitor_printf(mon, "'");
 496     switch(c) {
 497     case '\'':
 498         monitor_printf(mon, "\\'");
 499         break;
 500     case '\\':
 501         monitor_printf(mon, "\\\\");
 502         break;
 503     case '\n':
 504         monitor_printf(mon, "\\n");
 505         break;
 506     case '\r':
 507         monitor_printf(mon, "\\r");
 508         break;
 509     default:
 510         if (c >= 32 && c <= 126) {
 511             monitor_printf(mon, "%c", c);
 512         } else {
 513             monitor_printf(mon, "\\x%02x", c);
 514         }
 515         break;
 516     }
 517     monitor_printf(mon, "'");
 518 }
 519
 520 static void memory_dump(Monitor *mon, int count, int format, int wsize,
 521                         hwaddr addr, int is_physical)
 522 {
 523     int l, line_size, i, max_digits, len;
 524     uint8_t buf[16];
 525     uint64_t v;
 526     CPUState *cs = mon_get_cpu(mon);
 527
 528     if (!cs && (format == 'i' || !is_physical)) {
 529         monitor_printf(mon, "Can not dump without CPU\n");
 530         return;
 531     }
 532
 533     if (format == 'i') {
 534         monitor_disas(mon, cs, addr, count, is_physical);
 535         return;
 536     }
 537
 538     len = wsize * count;
 539     if (wsize == 1) {
 540         line_size = 8;
 541     } else {
 542         line_size = 16;
 543     }
 544     max_digits = 0;
 545
 546     switch(format) {
 547     case 'o':
 548         max_digits = DIV_ROUND_UP(wsize * 8, 3);
 549         break;
 550     default:
 551     case 'x':
 552         max_digits = (wsize * 8) / 4;
 553         break;
 554     case 'u':
 555     case 'd':
 556         max_digits = DIV_ROUND_UP(wsize * 8 * 10, 33);
 557         break;
 558     case 'c':
 559         wsize = 1;
 560         break;
 561     }
 562
 563     while (len > 0) {
 564         if (is_physical) {
 565             monitor_printf(mon, TARGET_FMT_plx ":", addr);
 566         } else {
 567             monitor_printf(mon, TARGET_FMT_lx ":", (target_ulong)addr);
 568         }
 569         l = len;
 570         if (l > line_size)
 571             l = line_size;
 572         if (is_physical) {
 573             AddressSpace *as = cs ? cs->as : &address_space_memory;
 574             MemTxResult r = address_space_read(as, addr,
 575                                                MEMTXATTRS_UNSPECIFIED, buf, l);
 576             if (r != MEMTX_OK) {
 577                 monitor_printf(mon, " Cannot access memory\n");
 578                 break;
 579             }
 580         } else {
 581             if (cpu_memory_rw_debug(cs, addr, buf, l, 0) < 0) {
 582                 monitor_printf(mon, " Cannot access memory\n");
 583                 break;
 584             }
 585         }
 586         i = 0;
 587         while (i < l) {
 588             switch(wsize) {
 589             default:
 590             case 1:
 591                 v = ldub_p(buf + i);
 592                 break;
 593             case 2:
 594                 v = lduw_p(buf + i);
 595                 break;
 596             case 4:
 597                 v = (uint32_t)ldl_p(buf + i);
 598                 break;
 599             case 8:
 600                 v = ldq_p(buf + i);
 601                 break;
 602             }
 603             monitor_printf(mon, " ");
 604             switch(format) {
 605             case 'o':
 606                 monitor_printf(mon, "%#*" PRIo64, max_digits, v);
 607                 break;
 608             case 'x':
 609                 monitor_printf(mon, "0x%0*" PRIx64, max_digits, v);
 610                 break;
 611             case 'u':
 612                 monitor_printf(mon, "%*" PRIu64, max_digits, v);
 613                 break;
 614             case 'd':
 615                 monitor_printf(mon, "%*" PRId64, max_digits, v);
 616                 break;
 617             case 'c':
 618                 monitor_printc(mon, v);
 619                 break;
 620             }
 621             i += wsize;
 622         }
 623         monitor_printf(mon, "\n");
 624         addr += l;
 625         len -= l;
 626     }
 627 }
 628
 629 static void hmp_memory_dump(Monitor *mon, const QDict *qdict)
 630 {
 631     int count = qdict_get_int(qdict, "count");
 632     int format = qdict_get_int(qdict, "format");
 633     int size = qdict_get_int(qdict, "size");
 634     target_long addr = qdict_get_int(qdict, "addr");
 635
 636     memory_dump(mon, count, format, size, addr, 0);
 637 }
 638
 639 static void hmp_physical_memory_dump(Monitor *mon, const QDict *qdict)
 640 {
 641     int count = qdict_get_int(qdict, "count");
 642     int format = qdict_get_int(qdict, "format");
 643     int size = qdict_get_int(qdict, "size");
 644     hwaddr addr = qdict_get_int(qdict, "addr");
 645
 646     memory_dump(mon, count, format, size, addr, 1);
 647 }
 648
 649 void *gpa2hva(MemoryRegion **p_mr, hwaddr addr, uint64_t size, Error **errp)
 650 {
 651     Int128 gpa_region_size;
 652     MemoryRegionSection mrs = memory_region_find(get_system_memory(),
 653                                                  addr, size);
 654
 655     if (!mrs.mr) {
 656         error_setg(errp, "No memory is mapped at address 0x%" HWADDR_PRIx, addr);
 657         return NULL;
 658     }
 659
 660     if (!memory_region_is_ram(mrs.mr) && !memory_region_is_romd(mrs.mr)) {
 661         error_setg(errp, "Memory at address 0x%" HWADDR_PRIx "is not RAM", addr);
 662         memory_region_unref(mrs.mr);
 663         return NULL;
 664     }
 665
 666     gpa_region_size = int128_make64(size);
 667     if (int128_lt(mrs.size, gpa_region_size)) {
 668         error_setg(errp, "Size of memory region at 0x%" HWADDR_PRIx
 669                    " exceeded.", addr);
 670         memory_region_unref(mrs.mr);
 671         return NULL;
 672     }
 673
 674     *p_mr = mrs.mr;
 675     return qemu_map_ram_ptr(mrs.mr->ram_block, mrs.offset_within_region);
 676 }
 677
 678 static void hmp_gpa2hva(Monitor *mon, const QDict *qdict)
 679 {
 680     hwaddr addr = qdict_get_int(qdict, "addr");
 681     Error *local_err = NULL;
 682     MemoryRegion *mr = NULL;
 683     void *ptr;
 684
 685     ptr = gpa2hva(&mr, addr, 1, &local_err);
 686     if (local_err) {
 687         error_report_err(local_err);
 688         return;
 689     }
 690
 691     monitor_printf(mon, "Host virtual address for 0x%" HWADDR_PRIx
 692                    " (%s) is %p\n",
 693                    addr, mr->name, ptr);
 694
 695     memory_region_unref(mr);
 696 }
 697
 698 static void hmp_gva2gpa(Monitor *mon, const QDict *qdict)
 699 {
 700     target_ulong addr = qdict_get_int(qdict, "addr");
 701     MemTxAttrs attrs;
 702     CPUState *cs = mon_get_cpu(mon);
 703     hwaddr gpa;
 704
 705     if (!cs) {
 706         monitor_printf(mon, "No cpu\n");
 707         return;
 708     }
 709
 710     gpa  = cpu_get_phys_page_attrs_debug(cs, addr & TARGET_PAGE_MASK, &attrs);
 711     if (gpa == -1) {
 712         monitor_printf(mon, "Unmapped\n");
 713     } else {
 714         monitor_printf(mon, "gpa: %#" HWADDR_PRIx "\n",
 715                        gpa + (addr & ~TARGET_PAGE_MASK));
 716     }
 717 }
 718
 719 #ifdef CONFIG_LINUX
 720 static uint64_t vtop(void *ptr, Error **errp)
 721 {
 722     uint64_t pinfo;
 723     uint64_t ret = -1;
 724     uintptr_t addr = (uintptr_t) ptr;
 725     uintptr_t pagesize = qemu_real_host_page_size();
 726     off_t offset = addr / pagesize * sizeof(pinfo);
 727     int fd;
 728
 729     fd = open("/proc/self/pagemap", O_RDONLY);
 730     if (fd == -1) {
 731         error_setg_errno(errp, errno, "Cannot open /proc/self/pagemap");
 732         return -1;
 733     }
 734
 735     /* Force copy-on-write if necessary.  */
 736     qatomic_add((uint8_t *)ptr, 0);
 737
 738     if (pread(fd, &pinfo, sizeof(pinfo), offset) != sizeof(pinfo)) {
 739         error_setg_errno(errp, errno, "Cannot read pagemap");
 740         goto out;
 741     }
 742     if ((pinfo & (1ull << 63)) == 0) {
 743         error_setg(errp, "Page not present");
 744         goto out;
 745     }
 746     ret = ((pinfo & 0x007fffffffffffffull) * pagesize) | (addr & (pagesize - 1));
 747
 748 out:
 749     close(fd);
 750     return ret;
 751 }
 752
 753 static void hmp_gpa2hpa(Monitor *mon, const QDict *qdict)
 754 {
 755     hwaddr addr = qdict_get_int(qdict, "addr");
 756     Error *local_err = NULL;
 757     MemoryRegion *mr = NULL;
 758     void *ptr;
 759     uint64_t physaddr;
 760
 761     ptr = gpa2hva(&mr, addr, 1, &local_err);
 762     if (local_err) {
 763         error_report_err(local_err);
 764         return;
 765     }
 766
 767     physaddr = vtop(ptr, &local_err);
 768     if (local_err) {
 769         error_report_err(local_err);
 770     } else {
 771         monitor_printf(mon, "Host physical address for 0x%" HWADDR_PRIx
 772                        " (%s) is 0x%" PRIx64 "\n",
 773                        addr, mr->name, (uint64_t) physaddr);
 774     }
 775
 776     memory_region_unref(mr);
 777 }
 778 #endif
 779
 780 static void do_print(Monitor *mon, const QDict *qdict)
 781 {
 782     int format = qdict_get_int(qdict, "format");
 783     hwaddr val = qdict_get_int(qdict, "val");
 784
 785     switch(format) {
 786     case 'o':
 787         monitor_printf(mon, "%#" HWADDR_PRIo, val);
 788         break;
 789     case 'x':
 790         monitor_printf(mon, "%#" HWADDR_PRIx, val);
 791         break;
 792     case 'u':
 793         monitor_printf(mon, "%" HWADDR_PRIu, val);
 794         break;
 795     default:
 796     case 'd':
 797         monitor_printf(mon, "%" HWADDR_PRId, val);
 798         break;
 799     case 'c':
 800         monitor_printc(mon, val);
 801         break;
 802     }
 803     monitor_printf(mon, "\n");
 804 }
 805
 806 static void hmp_sum(Monitor *mon, const QDict *qdict)
 807 {
 808     uint32_t addr;
 809     uint16_t sum;
 810     uint32_t start = qdict_get_int(qdict, "start");
 811     uint32_t size = qdict_get_int(qdict, "size");
 812
 813     sum = 0;
 814     for(addr = start; addr < (start + size); addr++) {
 815         uint8_t val = address_space_ldub(&address_space_memory, addr,
 816                                          MEMTXATTRS_UNSPECIFIED, NULL);
 817         /* BSD sum algorithm ('sum' Unix command) */
 818         sum = (sum >> 1) | (sum << 15);
 819         sum += val;
 820     }
 821     monitor_printf(mon, "%05d\n", sum);
 822 }
 823
 824 static int mouse_button_state;
 825
 826 static void hmp_mouse_move(Monitor *mon, const QDict *qdict)
 827 {
 828     int dx, dy, dz, button;
 829     const char *dx_str = qdict_get_str(qdict, "dx_str");
 830     const char *dy_str = qdict_get_str(qdict, "dy_str");
 831     const char *dz_str = qdict_get_try_str(qdict, "dz_str");
 832
 833     dx = strtol(dx_str, NULL, 0);
 834     dy = strtol(dy_str, NULL, 0);
 835     qemu_input_queue_rel(NULL, INPUT_AXIS_X, dx);
 836     qemu_input_queue_rel(NULL, INPUT_AXIS_Y, dy);
 837
 838     if (dz_str) {
 839         dz = strtol(dz_str, NULL, 0);
 840         if (dz != 0) {
 841             button = (dz > 0) ? INPUT_BUTTON_WHEEL_UP : INPUT_BUTTON_WHEEL_DOWN;
 842             qemu_input_queue_btn(NULL, button, true);
 843             qemu_input_event_sync();
 844             qemu_input_queue_btn(NULL, button, false);
 845         }
 846     }
 847     qemu_input_event_sync();
 848 }
 849
 850 static void hmp_mouse_button(Monitor *mon, const QDict *qdict)
 851 {
 852     static uint32_t bmap[INPUT_BUTTON__MAX] = {
 853         [INPUT_BUTTON_LEFT]       = MOUSE_EVENT_LBUTTON,
 854         [INPUT_BUTTON_MIDDLE]     = MOUSE_EVENT_MBUTTON,
 855         [INPUT_BUTTON_RIGHT]      = MOUSE_EVENT_RBUTTON,
 856     };
 857     int button_state = qdict_get_int(qdict, "button_state");
 858
 859     if (mouse_button_state == button_state) {
 860         return;
 861     }
 862     qemu_input_update_buttons(NULL, bmap, mouse_button_state, button_state);
 863     qemu_input_event_sync();
 864     mouse_button_state = button_state;
 865 }
 866
 867 static void hmp_ioport_read(Monitor *mon, const QDict *qdict)
 868 {
 869     int size = qdict_get_int(qdict, "size");
 870     int addr = qdict_get_int(qdict, "addr");
 871     int has_index = qdict_haskey(qdict, "index");
 872     uint32_t val;
 873     int suffix;
 874
 875     if (has_index) {
 876         int index = qdict_get_int(qdict, "index");
 877         cpu_outb(addr & IOPORTS_MASK, index & 0xff);
 878         addr++;
 879     }
 880     addr &= 0xffff;
 881
 882     switch(size) {
 883     default:
 884     case 1:
 885         val = cpu_inb(addr);
 886         suffix = 'b';
 887         break;
 888     case 2:
 889         val = cpu_inw(addr);
 890         suffix = 'w';
 891         break;
 892     case 4:
 893         val = cpu_inl(addr);
 894         suffix = 'l';
 895         break;
 896     }
 897     monitor_printf(mon, "port%c[0x%04x] = 0x%0*x\n",
 898                    suffix, addr, size * 2, val);
 899 }
 900
 901 static void hmp_ioport_write(Monitor *mon, const QDict *qdict)
 902 {
 903     int size = qdict_get_int(qdict, "size");
 904     int addr = qdict_get_int(qdict, "addr");
 905     int val = qdict_get_int(qdict, "val");
 906
 907     addr &= IOPORTS_MASK;
 908
 909     switch (size) {
 910     default:
 911     case 1:
 912         cpu_outb(addr, val);
 913         break;
 914     case 2:
 915         cpu_outw(addr, val);
 916         break;
 917     case 4:
 918         cpu_outl(addr, val);
 919         break;
 920     }
 921 }
 922
 923 static void hmp_boot_set(Monitor *mon, const QDict *qdict)
 924 {
 925     Error *local_err = NULL;
 926     const char *bootdevice = qdict_get_str(qdict, "bootdevice");
 927
 928     qemu_boot_set(bootdevice, &local_err);
 929     if (local_err) {
 930         error_report_err(local_err);
 931     } else {
 932         monitor_printf(mon, "boot device list now set to %s\n", bootdevice);
 933     }
 934 }
 935
 936 static void hmp_info_mtree(Monitor *mon, const QDict *qdict)
 937 {
 938     bool flatview = qdict_get_try_bool(qdict, "flatview", false);
 939     bool dispatch_tree = qdict_get_try_bool(qdict, "dispatch_tree", false);
 940     bool owner = qdict_get_try_bool(qdict, "owner", false);
 941     bool disabled = qdict_get_try_bool(qdict, "disabled", false);
 942
 943     mtree_info(flatview, dispatch_tree, owner, disabled);
 944 }
 945
 946 /* Capture support */
 947 static QLIST_HEAD (capture_list_head, CaptureState) capture_head;
 948
 949 static void hmp_info_capture(Monitor *mon, const QDict *qdict)
 950 {
 951     int i;
 952     CaptureState *s;
 953
 954     for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) {
 955         monitor_printf(mon, "[%d]: ", i);
 956         s->ops.info (s->opaque);
 957     }
 958 }
 959
 960 static void hmp_stopcapture(Monitor *mon, const QDict *qdict)
 961 {
 962     int i;
 963     int n = qdict_get_int(qdict, "n");
 964     CaptureState *s;
 965
 966     for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) {
 967         if (i == n) {
 968             s->ops.destroy (s->opaque);
 969             QLIST_REMOVE (s, entries);
 970             g_free (s);
 971             return;
 972         }
 973     }
 974 }
 975
 976 static void hmp_wavcapture(Monitor *mon, const QDict *qdict)
 977 {
 978     const char *path = qdict_get_str(qdict, "path");
 979     int freq = qdict_get_try_int(qdict, "freq", 44100);
 980     int bits = qdict_get_try_int(qdict, "bits", 16);
 981     int nchannels = qdict_get_try_int(qdict, "nchannels", 2);
 982     const char *audiodev = qdict_get_str(qdict, "audiodev");
 983     CaptureState *s;
 984     AudioState *as = audio_state_by_name(audiodev);
 985
 986     if (!as) {
 987         monitor_printf(mon, "Audiodev '%s' not found\n", audiodev);
 988         return;
 989     }
 990
 991     s = g_malloc0 (sizeof (*s));
 992
 993     if (wav_start_capture(as, s, path, freq, bits, nchannels)) {
 994         monitor_printf(mon, "Failed to add wave capture\n");
 995         g_free (s);
 996         return;
 997     }
 998     QLIST_INSERT_HEAD (&capture_head, s, entries);
 999 }
1000
1001 void qmp_getfd(const char *fdname, Error **errp)
1002 {
1003     Monitor *cur_mon = monitor_cur();
1004     mon_fd_t *monfd;
1005     int fd, tmp_fd;
1006
1007     fd = qemu_chr_fe_get_msgfd(&cur_mon->chr);
1008     if (fd == -1) {
1009         error_setg(errp, "No file descriptor supplied via SCM_RIGHTS");
1010         return;
1011     }
1012
1013     if (qemu_isdigit(fdname[0])) {
1014         close(fd);
1015         error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "fdname",
1016                    "a name not starting with a digit");
1017         return;
1018     }
1019
1020     QEMU_LOCK_GUARD(&cur_mon->mon_lock);
1021     QLIST_FOREACH(monfd, &cur_mon->fds, next) {
1022         if (strcmp(monfd->name, fdname) != 0) {
1023             continue;
1024         }
1025
1026         tmp_fd = monfd->fd;
1027         monfd->fd = fd;
1028         /* Make sure close() is outside critical section */
1029         close(tmp_fd);
1030         return;
1031     }
1032
1033     monfd = g_new0(mon_fd_t, 1);
1034     monfd->name = g_strdup(fdname);
1035     monfd->fd = fd;
1036
1037     QLIST_INSERT_HEAD(&cur_mon->fds, monfd, next);
1038 }
1039
1040 void qmp_closefd(const char *fdname, Error **errp)
1041 {
1042     Monitor *cur_mon = monitor_cur();
1043     mon_fd_t *monfd;
1044     int tmp_fd;
1045
1046     qemu_mutex_lock(&cur_mon->mon_lock);
1047     QLIST_FOREACH(monfd, &cur_mon->fds, next) {
1048         if (strcmp(monfd->name, fdname) != 0) {
1049             continue;
1050         }
1051
1052         QLIST_REMOVE(monfd, next);
1053         tmp_fd = monfd->fd;
1054         g_free(monfd->name);
1055         g_free(monfd);
1056         qemu_mutex_unlock(&cur_mon->mon_lock);
1057         /* Make sure close() is outside critical section */
1058         close(tmp_fd);
1059         return;
1060     }
1061
1062     qemu_mutex_unlock(&cur_mon->mon_lock);
1063     error_setg(errp, "File descriptor named '%s' not found", fdname);
1064 }
1065
1066 int monitor_get_fd(Monitor *mon, const char *fdname, Error **errp)
1067 {
1068     mon_fd_t *monfd;
1069
1070     QEMU_LOCK_GUARD(&mon->mon_lock);
1071     QLIST_FOREACH(monfd, &mon->fds, next) {
1072         int fd;
1073
1074         if (strcmp(monfd->name, fdname) != 0) {
1075             continue;
1076         }
1077
1078         fd = monfd->fd;
1079
1080         /* caller takes ownership of fd */
1081         QLIST_REMOVE(monfd, next);
1082         g_free(monfd->name);
1083         g_free(monfd);
1084
1085         return fd;
1086     }
1087
1088     error_setg(errp, "File descriptor named '%s' has not been found", fdname);
1089     return -1;
1090 }
1091
1092 static void monitor_fdset_cleanup(MonFdset *mon_fdset)
1093 {
1094     MonFdsetFd *mon_fdset_fd;
1095     MonFdsetFd *mon_fdset_fd_next;
1096
1097     QLIST_FOREACH_SAFE(mon_fdset_fd, &mon_fdset->fds, next, mon_fdset_fd_next) {
1098         if ((mon_fdset_fd->removed ||
1099                 (QLIST_EMPTY(&mon_fdset->dup_fds) && mon_refcount == 0)) &&
1100                 runstate_is_running()) {
1101             close(mon_fdset_fd->fd);
1102             g_free(mon_fdset_fd->opaque);
1103             QLIST_REMOVE(mon_fdset_fd, next);
1104             g_free(mon_fdset_fd);
1105         }
1106     }
1107
1108     if (QLIST_EMPTY(&mon_fdset->fds) && QLIST_EMPTY(&mon_fdset->dup_fds)) {
1109         QLIST_REMOVE(mon_fdset, next);
1110         g_free(mon_fdset);
1111     }
1112 }
1113
1114 void monitor_fdsets_cleanup(void)
1115 {
1116     MonFdset *mon_fdset;
1117     MonFdset *mon_fdset_next;
1118
1119     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1120     QLIST_FOREACH_SAFE(mon_fdset, &mon_fdsets, next, mon_fdset_next) {
1121         monitor_fdset_cleanup(mon_fdset);
1122     }
1123 }
1124
1125 AddfdInfo *qmp_add_fd(bool has_fdset_id, int64_t fdset_id, bool has_opaque,
1126                       const char *opaque, Error **errp)
1127 {
1128     int fd;
1129     Monitor *mon = monitor_cur();
1130     AddfdInfo *fdinfo;
1131
1132     fd = qemu_chr_fe_get_msgfd(&mon->chr);
1133     if (fd == -1) {
1134         error_setg(errp, "No file descriptor supplied via SCM_RIGHTS");
1135         goto error;
1136     }
1137
1138     fdinfo = monitor_fdset_add_fd(fd, has_fdset_id, fdset_id,
1139                                   has_opaque, opaque, errp);
1140     if (fdinfo) {
1141         return fdinfo;
1142     }
1143
1144 error:
1145     if (fd != -1) {
1146         close(fd);
1147     }
1148     return NULL;
1149 }
1150
1151 void qmp_remove_fd(int64_t fdset_id, bool has_fd, int64_t fd, Error **errp)
1152 {
1153     MonFdset *mon_fdset;
1154     MonFdsetFd *mon_fdset_fd;
1155     char fd_str[60];
1156
1157     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1158     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1159         if (mon_fdset->id != fdset_id) {
1160             continue;
1161         }
1162         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1163             if (has_fd) {
1164                 if (mon_fdset_fd->fd != fd) {
1165                     continue;
1166                 }
1167                 mon_fdset_fd->removed = true;
1168                 break;
1169             } else {
1170                 mon_fdset_fd->removed = true;
1171             }
1172         }
1173         if (has_fd && !mon_fdset_fd) {
1174             goto error;
1175         }
1176         monitor_fdset_cleanup(mon_fdset);
1177         return;
1178     }
1179
1180 error:
1181     if (has_fd) {
1182         snprintf(fd_str, sizeof(fd_str), "fdset-id:%" PRId64 ", fd:%" PRId64,
1183                  fdset_id, fd);
1184     } else {
1185         snprintf(fd_str, sizeof(fd_str), "fdset-id:%" PRId64, fdset_id);
1186     }
1187     error_setg(errp, "File descriptor named '%s' not found", fd_str);
1188 }
1189
1190 FdsetInfoList *qmp_query_fdsets(Error **errp)
1191 {
1192     MonFdset *mon_fdset;
1193     MonFdsetFd *mon_fdset_fd;
1194     FdsetInfoList *fdset_list = NULL;
1195
1196     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1197     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1198         FdsetInfo *fdset_info = g_malloc0(sizeof(*fdset_info));
1199
1200         fdset_info->fdset_id = mon_fdset->id;
1201
1202         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1203             FdsetFdInfo *fdsetfd_info;
1204
1205             fdsetfd_info = g_malloc0(sizeof(*fdsetfd_info));
1206             fdsetfd_info->fd = mon_fdset_fd->fd;
1207             if (mon_fdset_fd->opaque) {
1208                 fdsetfd_info->has_opaque = true;
1209                 fdsetfd_info->opaque = g_strdup(mon_fdset_fd->opaque);
1210             } else {
1211                 fdsetfd_info->has_opaque = false;
1212             }
1213
1214             QAPI_LIST_PREPEND(fdset_info->fds, fdsetfd_info);
1215         }
1216
1217         QAPI_LIST_PREPEND(fdset_list, fdset_info);
1218     }
1219
1220     return fdset_list;
1221 }
1222
1223 AddfdInfo *monitor_fdset_add_fd(int fd, bool has_fdset_id, int64_t fdset_id,
1224                                 bool has_opaque, const char *opaque,
1225                                 Error **errp)
1226 {
1227     MonFdset *mon_fdset = NULL;
1228     MonFdsetFd *mon_fdset_fd;
1229     AddfdInfo *fdinfo;
1230
1231     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1232     if (has_fdset_id) {
1233         QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1234             /* Break if match found or match impossible due to ordering by ID */
1235             if (fdset_id <= mon_fdset->id) {
1236                 if (fdset_id < mon_fdset->id) {
1237                     mon_fdset = NULL;
1238                 }
1239                 break;
1240             }
1241         }
1242     }
1243
1244     if (mon_fdset == NULL) {
1245         int64_t fdset_id_prev = -1;
1246         MonFdset *mon_fdset_cur = QLIST_FIRST(&mon_fdsets);
1247
1248         if (has_fdset_id) {
1249             if (fdset_id < 0) {
1250                 error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "fdset-id",
1251                            "a non-negative value");
1252                 return NULL;
1253             }
1254             /* Use specified fdset ID */
1255             QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1256                 mon_fdset_cur = mon_fdset;
1257                 if (fdset_id < mon_fdset_cur->id) {
1258                     break;
1259                 }
1260             }
1261         } else {
1262             /* Use first available fdset ID */
1263             QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1264                 mon_fdset_cur = mon_fdset;
1265                 if (fdset_id_prev == mon_fdset_cur->id - 1) {
1266                     fdset_id_prev = mon_fdset_cur->id;
1267                     continue;
1268                 }
1269                 break;
1270             }
1271         }
1272
1273         mon_fdset = g_malloc0(sizeof(*mon_fdset));
1274         if (has_fdset_id) {
1275             mon_fdset->id = fdset_id;
1276         } else {
1277             mon_fdset->id = fdset_id_prev + 1;
1278         }
1279
1280         /* The fdset list is ordered by fdset ID */
1281         if (!mon_fdset_cur) {
1282             QLIST_INSERT_HEAD(&mon_fdsets, mon_fdset, next);
1283         } else if (mon_fdset->id < mon_fdset_cur->id) {
1284             QLIST_INSERT_BEFORE(mon_fdset_cur, mon_fdset, next);
1285         } else {
1286             QLIST_INSERT_AFTER(mon_fdset_cur, mon_fdset, next);
1287         }
1288     }
1289
1290     mon_fdset_fd = g_malloc0(sizeof(*mon_fdset_fd));
1291     mon_fdset_fd->fd = fd;
1292     mon_fdset_fd->removed = false;
1293     if (has_opaque) {
1294         mon_fdset_fd->opaque = g_strdup(opaque);
1295     }
1296     QLIST_INSERT_HEAD(&mon_fdset->fds, mon_fdset_fd, next);
1297
1298     fdinfo = g_malloc0(sizeof(*fdinfo));
1299     fdinfo->fdset_id = mon_fdset->id;
1300     fdinfo->fd = mon_fdset_fd->fd;
1301
1302     return fdinfo;
1303 }
1304
1305 int monitor_fdset_dup_fd_add(int64_t fdset_id, int flags)
1306 {
1307 #ifdef _WIN32
1308     return -ENOENT;
1309 #else
1310     MonFdset *mon_fdset;
1311
1312     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1313     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1314         MonFdsetFd *mon_fdset_fd;
1315         MonFdsetFd *mon_fdset_fd_dup;
1316         int fd = -1;
1317         int dup_fd;
1318         int mon_fd_flags;
1319
1320         if (mon_fdset->id != fdset_id) {
1321             continue;
1322         }
1323
1324         QLIST_FOREACH(mon_fdset_fd, &mon_fdset->fds, next) {
1325             mon_fd_flags = fcntl(mon_fdset_fd->fd, F_GETFL);
1326             if (mon_fd_flags == -1) {
1327                 return -1;
1328             }
1329
1330             if ((flags & O_ACCMODE) == (mon_fd_flags & O_ACCMODE)) {
1331                 fd = mon_fdset_fd->fd;
1332                 break;
1333             }
1334         }
1335
1336         if (fd == -1) {
1337             errno = EACCES;
1338             return -1;
1339         }
1340
1341         dup_fd = qemu_dup_flags(fd, flags);
1342         if (dup_fd == -1) {
1343             return -1;
1344         }
1345
1346         mon_fdset_fd_dup = g_malloc0(sizeof(*mon_fdset_fd_dup));
1347         mon_fdset_fd_dup->fd = dup_fd;
1348         QLIST_INSERT_HEAD(&mon_fdset->dup_fds, mon_fdset_fd_dup, next);
1349         return dup_fd;
1350     }
1351
1352     errno = ENOENT;
1353     return -1;
1354 #endif
1355 }
1356
1357 static int64_t monitor_fdset_dup_fd_find_remove(int dup_fd, bool remove)
1358 {
1359     MonFdset *mon_fdset;
1360     MonFdsetFd *mon_fdset_fd_dup;
1361
1362     QEMU_LOCK_GUARD(&mon_fdsets_lock);
1363     QLIST_FOREACH(mon_fdset, &mon_fdsets, next) {
1364         QLIST_FOREACH(mon_fdset_fd_dup, &mon_fdset->dup_fds, next) {
1365             if (mon_fdset_fd_dup->fd == dup_fd) {
1366                 if (remove) {
1367                     QLIST_REMOVE(mon_fdset_fd_dup, next);
1368                     g_free(mon_fdset_fd_dup);
1369                     if (QLIST_EMPTY(&mon_fdset->dup_fds)) {
1370                         monitor_fdset_cleanup(mon_fdset);
1371                     }
1372                     return -1;
1373                 } else {
1374                     return mon_fdset->id;
1375                 }
1376             }
1377         }
1378     }
1379
1380     return -1;
1381 }
1382
1383 int64_t monitor_fdset_dup_fd_find(int dup_fd)
1384 {
1385     return monitor_fdset_dup_fd_find_remove(dup_fd, false);
1386 }
1387
1388 void monitor_fdset_dup_fd_remove(int dup_fd)
1389 {
1390     monitor_fdset_dup_fd_find_remove(dup_fd, true);
1391 }
1392
1393 int monitor_fd_param(Monitor *mon, const char *fdname, Error **errp)
1394 {
1395     int fd;
1396     Error *local_err = NULL;
1397
1398     if (!qemu_isdigit(fdname[0]) && mon) {
1399         fd = monitor_get_fd(mon, fdname, &local_err);
1400     } else {
1401         fd = qemu_parse_fd(fdname);
1402         if (fd == -1) {
1403             error_setg(&local_err, "Invalid file descriptor number '%s'",
1404                        fdname);
1405         }
1406     }
1407     if (local_err) {
1408         error_propagate(errp, local_err);
1409         assert(fd == -1);
1410     } else {
1411         assert(fd != -1);
1412     }
1413
1414     return fd;
1415 }
1416
1417 /* Please update hmp-commands.hx when adding or changing commands */
1418 static HMPCommand hmp_info_cmds[] = {
1419 #include "hmp-commands-info.h"
1420     { NULL, NULL, },
1421 };
1422
1423 /* hmp_cmds and hmp_info_cmds would be sorted at runtime */
1424 HMPCommand hmp_cmds[] = {
1425 #include "hmp-commands.h"
1426     { NULL, NULL, },
1427 };
1428
1429 /*
1430  * Set @pval to the value in the register identified by @name.
1431  * return 0 if OK, -1 if not found
1432  */
1433 int get_monitor_def(Monitor *mon, int64_t *pval, const char *name)
1434 {
1435     const MonitorDef *md = target_monitor_defs();
1436     CPUState *cs = mon_get_cpu(mon);
1437     void *ptr;
1438     uint64_t tmp = 0;
1439     int ret;
1440
1441     if (cs == NULL || md == NULL) {
1442         return -1;
1443     }
1444
1445     for(; md->name != NULL; md++) {
1446         if (hmp_compare_cmd(name, md->name)) {
1447             if (md->get_value) {
1448                 *pval = md->get_value(mon, md, md->offset);
1449             } else {
1450                 CPUArchState *env = mon_get_cpu_env(mon);
1451                 ptr = (uint8_t *)env + md->offset;
1452                 switch(md->type) {
1453                 case MD_I32:
1454                     *pval = *(int32_t *)ptr;
1455                     break;
1456                 case MD_TLONG:
1457                     *pval = *(target_long *)ptr;
1458                     break;
1459                 default:
1460                     *pval = 0;
1461                     break;
1462                 }
1463             }
1464             return 0;
1465         }
1466     }
1467
1468     ret = target_get_monitor_def(cs, name, &tmp);
1469     if (!ret) {
1470         *pval = (target_long) tmp;
1471     }
1472
1473     return ret;
1474 }
1475
1476 static void add_completion_option(ReadLineState *rs, const char *str,
1477                                   const char *option)
1478 {
1479     if (!str || !option) {
1480         return;
1481     }
1482     if (!strncmp(option, str, strlen(str))) {
1483         readline_add_completion(rs, option);
1484     }
1485 }
1486
1487 void chardev_add_completion(ReadLineState *rs, int nb_args, const char *str)
1488 {
1489     size_t len;
1490     ChardevBackendInfoList *list, *start;
1491
1492     if (nb_args != 2) {
1493         return;
1494     }
1495     len = strlen(str);
1496     readline_set_completion_index(rs, len);
1497
1498     start = list = qmp_query_chardev_backends(NULL);
1499     while (list) {
1500         const char *chr_name = list->value->name;
1501
1502         if (!strncmp(chr_name, str, len)) {
1503             readline_add_completion(rs, chr_name);
1504         }
1505         list = list->next;
1506     }
1507     qapi_free_ChardevBackendInfoList(start);
1508 }
1509
1510 void netdev_add_completion(ReadLineState *rs, int nb_args, const char *str)
1511 {
1512     size_t len;
1513     int i;
1514
1515     if (nb_args != 2) {
1516         return;
1517     }
1518     len = strlen(str);
1519     readline_set_completion_index(rs, len);
1520     for (i = 0; i < NET_CLIENT_DRIVER__MAX; i++) {
1521         add_completion_option(rs, str, NetClientDriver_str(i));
1522     }
1523 }
1524
1525 void device_add_completion(ReadLineState *rs, int nb_args, const char *str)
1526 {
1527     GSList *list, *elt;
1528     size_t len;
1529
1530     if (nb_args != 2) {
1531         return;
1532     }
1533
1534     len = strlen(str);
1535     readline_set_completion_index(rs, len);
1536     list = elt = object_class_get_list(TYPE_DEVICE, false);
1537     while (elt) {
1538         const char *name;
1539         DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, elt->data,
1540                                              TYPE_DEVICE);
1541         name = object_class_get_name(OBJECT_CLASS(dc));
1542
1543         if (dc->user_creatable
1544             && !strncmp(name, str, len)) {
1545             readline_add_completion(rs, name);
1546         }
1547         elt = elt->next;
1548     }
1549     g_slist_free(list);
1550 }
1551
1552 void object_add_completion(ReadLineState *rs, int nb_args, const char *str)
1553 {
1554     GSList *list, *elt;
1555     size_t len;
1556
1557     if (nb_args != 2) {
1558         return;
1559     }
1560
1561     len = strlen(str);
1562     readline_set_completion_index(rs, len);
1563     list = elt = object_class_get_list(TYPE_USER_CREATABLE, false);
1564     while (elt) {
1565         const char *name;
1566
1567         name = object_class_get_name(OBJECT_CLASS(elt->data));
1568         if (!strncmp(name, str, len) && strcmp(name, TYPE_USER_CREATABLE)) {
1569             readline_add_completion(rs, name);
1570         }
1571         elt = elt->next;
1572     }
1573     g_slist_free(list);
1574 }
1575
1576 static int qdev_add_hotpluggable_device(Object *obj, void *opaque)
1577 {
1578     GSList **list = opaque;
1579     DeviceState *dev = (DeviceState *)object_dynamic_cast(obj, TYPE_DEVICE);
1580
1581     if (dev == NULL) {
1582         return 0;
1583     }
1584
1585     if (dev->realized && object_property_get_bool(obj, "hotpluggable", NULL)) {
1586         *list = g_slist_append(*list, dev);
1587     }
1588
1589     return 0;
1590 }
1591
1592 static GSList *qdev_build_hotpluggable_device_list(Object *peripheral)
1593 {
1594     GSList *list = NULL;
1595
1596     object_child_foreach(peripheral, qdev_add_hotpluggable_device, &list);
1597
1598     return list;
1599 }
1600
1601 static void peripheral_device_del_completion(ReadLineState *rs,
1602                                              const char *str, size_t len)
1603 {
1604     Object *peripheral = container_get(qdev_get_machine(), "/peripheral");
1605     GSList *list, *item;
1606
1607     list = qdev_build_hotpluggable_device_list(peripheral);
1608     if (!list) {
1609         return;
1610     }
1611
1612     for (item = list; item; item = g_slist_next(item)) {
1613         DeviceState *dev = item->data;
1614
1615         if (dev->id && !strncmp(str, dev->id, len)) {
1616             readline_add_completion(rs, dev->id);
1617         }
1618     }
1619
1620     g_slist_free(list);
1621 }
1622
1623 void chardev_remove_completion(ReadLineState *rs, int nb_args, const char *str)
1624 {
1625     size_t len;
1626     ChardevInfoList *list, *start;
1627
1628     if (nb_args != 2) {
1629         return;
1630     }
1631     len = strlen(str);
1632     readline_set_completion_index(rs, len);
1633
1634     start = list = qmp_query_chardev(NULL);
1635     while (list) {
1636         ChardevInfo *chr = list->value;
1637
1638         if (!strncmp(chr->label, str, len)) {
1639             readline_add_completion(rs, chr->label);
1640         }
1641         list = list->next;
1642     }
1643     qapi_free_ChardevInfoList(start);
1644 }
1645
1646 static void ringbuf_completion(ReadLineState *rs, const char *str)
1647 {
1648     size_t len;
1649     ChardevInfoList *list, *start;
1650
1651     len = strlen(str);
1652     readline_set_completion_index(rs, len);
1653
1654     start = list = qmp_query_chardev(NULL);
1655     while (list) {
1656         ChardevInfo *chr_info = list->value;
1657
1658         if (!strncmp(chr_info->label, str, len)) {
1659             Chardev *chr = qemu_chr_find(chr_info->label);
1660             if (chr && CHARDEV_IS_RINGBUF(chr)) {
1661                 readline_add_completion(rs, chr_info->label);
1662             }
1663         }
1664         list = list->next;
1665     }
1666     qapi_free_ChardevInfoList(start);
1667 }
1668
1669 void ringbuf_write_completion(ReadLineState *rs, int nb_args, const char *str)
1670 {
1671     if (nb_args != 2) {
1672         return;
1673     }
1674     ringbuf_completion(rs, str);
1675 }
1676
1677 void device_del_completion(ReadLineState *rs, int nb_args, const char *str)
1678 {
1679     size_t len;
1680
1681     if (nb_args != 2) {
1682         return;
1683     }
1684
1685     len = strlen(str);
1686     readline_set_completion_index(rs, len);
1687     peripheral_device_del_completion(rs, str, len);
1688 }
1689
1690 void object_del_completion(ReadLineState *rs, int nb_args, const char *str)
1691 {
1692     ObjectPropertyInfoList *list, *start;
1693     size_t len;
1694
1695     if (nb_args != 2) {
1696         return;
1697     }
1698     len = strlen(str);
1699     readline_set_completion_index(rs, len);
1700
1701     start = list = qmp_qom_list("/objects", NULL);
1702     while (list) {
1703         ObjectPropertyInfo *info = list->value;
1704
1705         if (!strncmp(info->type, "child<", 5)
1706             && !strncmp(info->name, str, len)) {
1707             readline_add_completion(rs, info->name);
1708         }
1709         list = list->next;
1710     }
1711     qapi_free_ObjectPropertyInfoList(start);
1712 }
1713
1714 void sendkey_completion(ReadLineState *rs, int nb_args, const char *str)
1715 {
1716     int i;
1717     char *sep;
1718     size_t len;
1719
1720     if (nb_args != 2) {
1721         return;
1722     }
1723     sep = strrchr(str, '-');
1724     if (sep) {
1725         str = sep + 1;
1726     }
1727     len = strlen(str);
1728     readline_set_completion_index(rs, len);
1729     for (i = 0; i < Q_KEY_CODE__MAX; i++) {
1730         if (!strncmp(str, QKeyCode_str(i), len)) {
1731             readline_add_completion(rs, QKeyCode_str(i));
1732         }
1733     }
1734 }
1735
1736 void set_link_completion(ReadLineState *rs, int nb_args, const char *str)
1737 {
1738     size_t len;
1739
1740     len = strlen(str);
1741     readline_set_completion_index(rs, len);
1742     if (nb_args == 2) {
1743         NetClientState *ncs[MAX_QUEUE_NUM];
1744         int count, i;
1745         count = qemu_find_net_clients_except(NULL, ncs,
1746                                              NET_CLIENT_DRIVER_NONE,
1747                                              MAX_QUEUE_NUM);
1748         for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
1749             const char *name = ncs[i]->name;
1750             if (!strncmp(str, name, len)) {
1751                 readline_add_completion(rs, name);
1752             }
1753         }
1754     } else if (nb_args == 3) {
1755         add_completion_option(rs, str, "on");
1756         add_completion_option(rs, str, "off");
1757     }
1758 }
1759
1760 void netdev_del_completion(ReadLineState *rs, int nb_args, const char *str)
1761 {
1762     int len, count, i;
1763     NetClientState *ncs[MAX_QUEUE_NUM];
1764
1765     if (nb_args != 2) {
1766         return;
1767     }
1768
1769     len = strlen(str);
1770     readline_set_completion_index(rs, len);
1771     count = qemu_find_net_clients_except(NULL, ncs, NET_CLIENT_DRIVER_NIC,
1772                                          MAX_QUEUE_NUM);
1773     for (i = 0; i < MIN(count, MAX_QUEUE_NUM); i++) {
1774         const char *name = ncs[i]->name;
1775         if (strncmp(str, name, len)) {
1776             continue;
1777         }
1778         if (ncs[i]->is_netdev) {
1779             readline_add_completion(rs, name);
1780         }
1781     }
1782 }
1783
1784 void info_trace_events_completion(ReadLineState *rs, int nb_args, const char *str)
1785 {
1786     size_t len;
1787
1788     len = strlen(str);
1789     readline_set_completion_index(rs, len);
1790     if (nb_args == 2) {
1791         TraceEventIter iter;
1792         TraceEvent *ev;
1793         char *pattern = g_strdup_printf("%s*", str);
1794         trace_event_iter_init_pattern(&iter, pattern);
1795         while ((ev = trace_event_iter_next(&iter)) != NULL) {
1796             readline_add_completion(rs, trace_event_get_name(ev));
1797         }
1798         g_free(pattern);
1799     }
1800 }
1801
1802 void trace_event_completion(ReadLineState *rs, int nb_args, const char *str)
1803 {
1804     size_t len;
1805
1806     len = strlen(str);
1807     readline_set_completion_index(rs, len);
1808     if (nb_args == 2) {
1809         TraceEventIter iter;
1810         TraceEvent *ev;
1811         char *pattern = g_strdup_printf("%s*", str);
1812         trace_event_iter_init_pattern(&iter, pattern);
1813         while ((ev = trace_event_iter_next(&iter)) != NULL) {
1814             readline_add_completion(rs, trace_event_get_name(ev));
1815         }
1816         g_free(pattern);
1817     } else if (nb_args == 3) {
1818         add_completion_option(rs, str, "on");
1819         add_completion_option(rs, str, "off");
1820     }
1821 }
1822
1823 void watchdog_action_completion(ReadLineState *rs, int nb_args, const char *str)
1824 {
1825     int i;
1826
1827     if (nb_args != 2) {
1828         return;
1829     }
1830     readline_set_completion_index(rs, strlen(str));
1831     for (i = 0; i < WATCHDOG_ACTION__MAX; i++) {
1832         add_completion_option(rs, str, WatchdogAction_str(i));
1833     }
1834 }
1835
1836 void migrate_set_capability_completion(ReadLineState *rs, int nb_args,
1837                                        const char *str)
1838 {
1839     size_t len;
1840
1841     len = strlen(str);
1842     readline_set_completion_index(rs, len);
1843     if (nb_args == 2) {
1844         int i;
1845         for (i = 0; i < MIGRATION_CAPABILITY__MAX; i++) {
1846             const char *name = MigrationCapability_str(i);
1847             if (!strncmp(str, name, len)) {
1848                 readline_add_completion(rs, name);
1849             }
1850         }
1851     } else if (nb_args == 3) {
1852         add_completion_option(rs, str, "on");
1853         add_completion_option(rs, str, "off");
1854     }
1855 }
1856
1857 void migrate_set_parameter_completion(ReadLineState *rs, int nb_args,
1858                                       const char *str)
1859 {
1860     size_t len;
1861
1862     len = strlen(str);
1863     readline_set_completion_index(rs, len);
1864     if (nb_args == 2) {
1865         int i;
1866         for (i = 0; i < MIGRATION_PARAMETER__MAX; i++) {
1867             const char *name = MigrationParameter_str(i);
1868             if (!strncmp(str, name, len)) {
1869                 readline_add_completion(rs, name);
1870             }
1871         }
1872     }
1873 }
1874
1875 static void vm_completion(ReadLineState *rs, const char *str)
1876 {
1877     size_t len;
1878     BlockDriverState *bs;
1879     BdrvNextIterator it;
1880
1881     len = strlen(str);
1882     readline_set_completion_index(rs, len);
1883
1884     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
1885         SnapshotInfoList *snapshots, *snapshot;
1886         AioContext *ctx = bdrv_get_aio_context(bs);
1887         bool ok = false;
1888
1889         aio_context_acquire(ctx);
1890         if (bdrv_can_snapshot(bs)) {
1891             ok = bdrv_query_snapshot_info_list(bs, &snapshots, NULL) == 0;
1892         }
1893         aio_context_release(ctx);
1894         if (!ok) {
1895             continue;
1896         }
1897
1898         snapshot = snapshots;
1899         while (snapshot) {
1900             char *completion = snapshot->value->name;
1901             if (!strncmp(str, completion, len)) {
1902                 readline_add_completion(rs, completion);
1903             }
1904             completion = snapshot->value->id;
1905             if (!strncmp(str, completion, len)) {
1906                 readline_add_completion(rs, completion);
1907             }
1908             snapshot = snapshot->next;
1909         }
1910         qapi_free_SnapshotInfoList(snapshots);
1911     }
1912
1913 }
1914
1915 void delvm_completion(ReadLineState *rs, int nb_args, const char *str)
1916 {
1917     if (nb_args == 2) {
1918         vm_completion(rs, str);
1919     }
1920 }
1921
1922 void loadvm_completion(ReadLineState *rs, int nb_args, const char *str)
1923 {
1924     if (nb_args == 2) {
1925         vm_completion(rs, str);
1926     }
1927 }
1928
1929 static int
1930 compare_mon_cmd(const void *a, const void *b)
1931 {
1932     return strcmp(((const HMPCommand *)a)->name,
1933             ((const HMPCommand *)b)->name);
1934 }
1935
1936 static void sortcmdlist(void)
1937 {
1938     qsort(hmp_cmds, ARRAY_SIZE(hmp_cmds) - 1,
1939           sizeof(*hmp_cmds),
1940           compare_mon_cmd);
1941     qsort(hmp_info_cmds, ARRAY_SIZE(hmp_info_cmds) - 1,
1942           sizeof(*hmp_info_cmds),
1943           compare_mon_cmd);
1944 }
1945
1946 void monitor_register_hmp(const char *name, bool info,
1947                           void (*cmd)(Monitor *mon, const QDict *qdict))
1948 {
1949     HMPCommand *table = info ? hmp_info_cmds : hmp_cmds;
1950
1951     while (table->name != NULL) {
1952         if (strcmp(table->name, name) == 0) {
1953             g_assert(table->cmd == NULL && table->cmd_info_hrt == NULL);
1954             table->cmd = cmd;
1955             return;
1956         }
1957         table++;
1958     }
1959     g_assert_not_reached();
1960 }
1961
1962 void monitor_register_hmp_info_hrt(const char *name,
1963                                    HumanReadableText *(*handler)(Error **errp))
1964 {
1965     HMPCommand *table = hmp_info_cmds;
1966
1967     while (table->name != NULL) {
1968         if (strcmp(table->name, name) == 0) {
1969             g_assert(table->cmd == NULL && table->cmd_info_hrt == NULL);
1970             table->cmd_info_hrt = handler;
1971             return;
1972         }
1973         table++;
1974     }
1975     g_assert_not_reached();
1976 }
1977
1978 void monitor_init_globals(void)
1979 {
1980     monitor_init_globals_core();
1981     monitor_init_qmp_commands();
1982     sortcmdlist();
1983     qemu_mutex_init(&mon_fdsets_lock);
1984 }