xref: /openbmc/qemu/hmp-commands.hx (revision 4c4465ff)
1HXCOMM Use DEFHEADING() to define headings in both help text and rST.
2HXCOMM Text between SRST and ERST is copied to the rST version and
3HXCOMM discarded from C version.
4HXCOMM DEF(command, args, callback, arg_string, help) is used to construct
5HXCOMM monitor commands
6HXCOMM HXCOMM can be used for comments, discarded from both rST and C.
7
8
9    {
10        .name       = "help|?",
11        .args_type  = "name:S?",
12        .params     = "[cmd]",
13        .help       = "show the help",
14        .cmd        = do_help_cmd,
15        .flags      = "p",
16    },
17
18SRST
19``help`` or ``?`` [*cmd*]
20  Show the help for all commands or just for command *cmd*.
21ERST
22
23    {
24        .name       = "commit",
25        .args_type  = "device:B",
26        .params     = "device|all",
27        .help       = "commit changes to the disk images (if -snapshot is used) or backing files",
28        .cmd        = hmp_commit,
29    },
30
31SRST
32``commit``
33  Commit changes to the disk images (if -snapshot is used) or backing files.
34  If the backing file is smaller than the snapshot, then the backing file
35  will be resized to be the same size as the snapshot.  If the snapshot is
36  smaller than the backing file, the backing file will not be truncated.
37  If you want the backing file to match the size of the smaller snapshot,
38  you can safely truncate it yourself once the commit operation successfully
39  completes.
40ERST
41
42    {
43        .name       = "quit|q",
44        .args_type  = "",
45        .params     = "",
46        .help       = "quit the emulator",
47        .cmd        = hmp_quit,
48        .flags      = "p",
49    },
50
51SRST
52``quit`` or ``q``
53  Quit the emulator.
54ERST
55
56    {
57        .name       = "exit_preconfig",
58        .args_type  = "",
59        .params     = "",
60        .help       = "exit the preconfig state",
61        .cmd        = hmp_exit_preconfig,
62        .flags      = "p",
63    },
64
65SRST
66``exit_preconfig``
67  This command makes QEMU exit the preconfig state and proceed with
68  VM initialization using configuration data provided on the command line
69  and via the QMP monitor during the preconfig state. The command is only
70  available during the preconfig state (i.e. when the --preconfig command
71  line option was in use).
72ERST
73
74    {
75        .name       = "block_resize",
76        .args_type  = "device:B,size:o",
77        .params     = "device size",
78        .help       = "resize a block image",
79        .cmd        = hmp_block_resize,
80        .coroutine  = true,
81    },
82
83SRST
84``block_resize``
85  Resize a block image while a guest is running.  Usually requires guest
86  action to see the updated size.  Resize to a lower size is supported,
87  but should be used with extreme caution.  Note that this command only
88  resizes image files, it can not resize block devices like LVM volumes.
89ERST
90
91    {
92        .name       = "block_stream",
93        .args_type  = "device:B,speed:o?,base:s?",
94        .params     = "device [speed [base]]",
95        .help       = "copy data from a backing file into a block device",
96        .cmd        = hmp_block_stream,
97    },
98
99SRST
100``block_stream``
101  Copy data from a backing file into a block device.
102ERST
103
104    {
105        .name       = "block_job_set_speed",
106        .args_type  = "device:B,speed:o",
107        .params     = "device speed",
108        .help       = "set maximum speed for a background block operation",
109        .cmd        = hmp_block_job_set_speed,
110    },
111
112SRST
113``block_job_set_speed``
114  Set maximum speed for a background block operation.
115ERST
116
117    {
118        .name       = "block_job_cancel",
119        .args_type  = "force:-f,device:B",
120        .params     = "[-f] device",
121        .help       = "stop an active background block operation (use -f"
122                      "\n\t\t\t if you want to abort the operation immediately"
123                      "\n\t\t\t instead of keep running until data is in sync)",
124        .cmd        = hmp_block_job_cancel,
125    },
126
127SRST
128``block_job_cancel``
129  Stop an active background block operation (streaming, mirroring).
130ERST
131
132    {
133        .name       = "block_job_complete",
134        .args_type  = "device:B",
135        .params     = "device",
136        .help       = "stop an active background block operation",
137        .cmd        = hmp_block_job_complete,
138    },
139
140SRST
141``block_job_complete``
142  Manually trigger completion of an active background block operation.
143  For mirroring, this will switch the device to the destination path.
144ERST
145
146    {
147        .name       = "block_job_pause",
148        .args_type  = "device:B",
149        .params     = "device",
150        .help       = "pause an active background block operation",
151        .cmd        = hmp_block_job_pause,
152    },
153
154SRST
155``block_job_pause``
156  Pause an active block streaming operation.
157ERST
158
159    {
160        .name       = "block_job_resume",
161        .args_type  = "device:B",
162        .params     = "device",
163        .help       = "resume a paused background block operation",
164        .cmd        = hmp_block_job_resume,
165    },
166
167SRST
168``block_job_resume``
169  Resume a paused block streaming operation.
170ERST
171
172    {
173        .name       = "eject",
174        .args_type  = "force:-f,device:B",
175        .params     = "[-f] device",
176        .help       = "eject a removable medium (use -f to force it)",
177        .cmd        = hmp_eject,
178    },
179
180SRST
181``eject [-f]`` *device*
182  Eject a removable medium (use -f to force it).
183ERST
184
185    {
186        .name       = "drive_del",
187        .args_type  = "id:B",
188        .params     = "device",
189        .help       = "remove host block device",
190        .cmd        = hmp_drive_del,
191    },
192
193SRST
194``drive_del`` *device*
195  Remove host block device.  The result is that guest generated IO is no longer
196  submitted against the host device underlying the disk.  Once a drive has
197  been deleted, the QEMU Block layer returns -EIO which results in IO
198  errors in the guest for applications that are reading/writing to the device.
199  These errors are always reported to the guest, regardless of the drive's error
200  actions (drive options rerror, werror).
201ERST
202
203    {
204        .name       = "change",
205        .args_type  = "device:B,target:F,arg:s?,read-only-mode:s?",
206        .params     = "device filename [format [read-only-mode]]",
207        .help       = "change a removable medium, optional format",
208        .cmd        = hmp_change,
209    },
210
211SRST
212``change`` *device* *setting*
213  Change the configuration of a device.
214
215  ``change`` *diskdevice* *filename* [*format* [*read-only-mode*]]
216    Change the medium for a removable disk device to point to *filename*. eg::
217
218      (qemu) change ide1-cd0 /path/to/some.iso
219
220    *format* is optional.
221
222    *read-only-mode* may be used to change the read-only status of the device.
223    It accepts the following values:
224
225    retain
226      Retains the current status; this is the default.
227
228    read-only
229      Makes the device read-only.
230
231    read-write
232      Makes the device writable.
233
234  ``change vnc`` *display*,\ *options*
235    Change the configuration of the VNC server. The valid syntax for *display*
236    and *options* are described at :ref:`sec_005finvocation`. eg::
237
238      (qemu) change vnc localhost:1
239
240  ``change vnc password`` [*password*]
241
242    Change the password associated with the VNC server. If the new password
243    is not supplied, the monitor will prompt for it to be entered. VNC
244    passwords are only significant up to 8 letters. eg::
245
246      (qemu) change vnc password
247      Password: ********
248
249ERST
250
251    {
252        .name       = "screendump",
253        .args_type  = "filename:F,device:s?,head:i?",
254        .params     = "filename [device [head]]",
255        .help       = "save screen from head 'head' of display device 'device' "
256                      "into PPM image 'filename'",
257        .cmd        = hmp_screendump,
258        .coroutine  = true,
259    },
260
261SRST
262``screendump`` *filename*
263  Save screen into PPM image *filename*.
264ERST
265
266    {
267        .name       = "logfile",
268        .args_type  = "filename:F",
269        .params     = "filename",
270        .help       = "output logs to 'filename'",
271        .cmd        = hmp_logfile,
272    },
273
274SRST
275``logfile`` *filename*
276  Output logs to *filename*.
277ERST
278
279    {
280        .name       = "trace-event",
281        .args_type  = "name:s,option:b,vcpu:i?",
282        .params     = "name on|off [vcpu]",
283        .help       = "changes status of a specific trace event "
284                      "(vcpu: vCPU to set, default is all)",
285        .cmd = hmp_trace_event,
286        .command_completion = trace_event_completion,
287    },
288
289SRST
290``trace-event``
291  changes status of a trace event
292ERST
293
294#if defined(CONFIG_TRACE_SIMPLE)
295    {
296        .name       = "trace-file",
297        .args_type  = "op:s?,arg:F?",
298        .params     = "on|off|flush|set [arg]",
299        .help       = "open, close, or flush trace file, or set a new file name",
300        .cmd        = hmp_trace_file,
301    },
302
303SRST
304``trace-file on|off|flush``
305  Open, close, or flush the trace file.  If no argument is given, the
306  status of the trace file is displayed.
307ERST
308#endif
309
310    {
311        .name       = "log",
312        .args_type  = "items:s",
313        .params     = "item1[,...]",
314        .help       = "activate logging of the specified items",
315        .cmd        = hmp_log,
316    },
317
318SRST
319``log`` *item1*\ [,...]
320  Activate logging of the specified items.
321ERST
322
323    {
324        .name       = "savevm",
325        .args_type  = "name:s?",
326        .params     = "tag",
327        .help       = "save a VM snapshot. If no tag is provided, a new snapshot is created",
328        .cmd        = hmp_savevm,
329    },
330
331SRST
332``savevm`` *tag*
333  Create a snapshot of the whole virtual machine. If *tag* is
334  provided, it is used as human readable identifier. If there is already
335  a snapshot with the same tag, it is replaced. More info at
336  :ref:`vm_005fsnapshots`.
337
338  Since 4.0, savevm stopped allowing the snapshot id to be set, accepting
339  only *tag* as parameter.
340ERST
341
342    {
343        .name       = "loadvm",
344        .args_type  = "name:s",
345        .params     = "tag",
346        .help       = "restore a VM snapshot from its tag",
347        .cmd        = hmp_loadvm,
348        .command_completion = loadvm_completion,
349    },
350
351SRST
352``loadvm`` *tag*
353  Set the whole virtual machine to the snapshot identified by the tag
354  *tag*.
355
356  Since 4.0, loadvm stopped accepting snapshot id as parameter.
357ERST
358
359    {
360        .name       = "delvm",
361        .args_type  = "name:s",
362        .params     = "tag",
363        .help       = "delete a VM snapshot from its tag",
364        .cmd        = hmp_delvm,
365        .command_completion = delvm_completion,
366    },
367
368SRST
369``delvm`` *tag*
370  Delete the snapshot identified by *tag*.
371
372  Since 4.0, delvm stopped deleting snapshots by snapshot id, accepting
373  only *tag* as parameter.
374ERST
375
376    {
377        .name       = "singlestep",
378        .args_type  = "option:s?",
379        .params     = "[on|off]",
380        .help       = "run emulation in singlestep mode or switch to normal mode",
381        .cmd        = hmp_singlestep,
382    },
383
384SRST
385``singlestep [off]``
386  Run the emulation in single step mode.
387  If called with option off, the emulation returns to normal mode.
388ERST
389
390    {
391        .name       = "stop",
392        .args_type  = "",
393        .params     = "",
394        .help       = "stop emulation",
395        .cmd        = hmp_stop,
396    },
397
398SRST
399``stop``
400  Stop emulation.
401ERST
402
403    {
404        .name       = "cont|c",
405        .args_type  = "",
406        .params     = "",
407        .help       = "resume emulation",
408        .cmd        = hmp_cont,
409    },
410
411SRST
412``cont`` or ``c``
413  Resume emulation.
414ERST
415
416    {
417        .name       = "system_wakeup",
418        .args_type  = "",
419        .params     = "",
420        .help       = "wakeup guest from suspend",
421        .cmd        = hmp_system_wakeup,
422    },
423
424SRST
425``system_wakeup``
426  Wakeup guest from suspend.
427ERST
428
429    {
430        .name       = "gdbserver",
431        .args_type  = "device:s?",
432        .params     = "[device]",
433        .help       = "start gdbserver on given device (default 'tcp::1234'), stop with 'none'",
434        .cmd        = hmp_gdbserver,
435    },
436
437SRST
438``gdbserver`` [*port*]
439  Start gdbserver session (default *port*\=1234)
440ERST
441
442    {
443        .name       = "x",
444        .args_type  = "fmt:/,addr:l",
445        .params     = "/fmt addr",
446        .help       = "virtual memory dump starting at 'addr'",
447        .cmd        = hmp_memory_dump,
448    },
449
450SRST
451``x/``\ *fmt* *addr*
452  Virtual memory dump starting at *addr*.
453ERST
454
455    {
456        .name       = "xp",
457        .args_type  = "fmt:/,addr:l",
458        .params     = "/fmt addr",
459        .help       = "physical memory dump starting at 'addr'",
460        .cmd        = hmp_physical_memory_dump,
461    },
462
463SRST
464``xp /``\ *fmt* *addr*
465  Physical memory dump starting at *addr*.
466
467  *fmt* is a format which tells the command how to format the
468  data. Its syntax is: ``/{count}{format}{size}``
469
470  *count*
471    is the number of items to be dumped.
472  *format*
473    can be x (hex), d (signed decimal), u (unsigned decimal), o (octal),
474    c (char) or i (asm instruction).
475  *size*
476    can be b (8 bits), h (16 bits), w (32 bits) or g (64 bits). On x86,
477    ``h`` or ``w`` can be specified with the ``i`` format to
478    respectively select 16 or 32 bit code instruction size.
479
480  Examples:
481
482  Dump 10 instructions at the current instruction pointer::
483
484    (qemu) x/10i $eip
485    0x90107063:  ret
486    0x90107064:  sti
487    0x90107065:  lea    0x0(%esi,1),%esi
488    0x90107069:  lea    0x0(%edi,1),%edi
489    0x90107070:  ret
490    0x90107071:  jmp    0x90107080
491    0x90107073:  nop
492    0x90107074:  nop
493    0x90107075:  nop
494    0x90107076:  nop
495
496  Dump 80 16 bit values at the start of the video memory::
497
498    (qemu) xp/80hx 0xb8000
499    0x000b8000: 0x0b50 0x0b6c 0x0b65 0x0b78 0x0b38 0x0b36 0x0b2f 0x0b42
500    0x000b8010: 0x0b6f 0x0b63 0x0b68 0x0b73 0x0b20 0x0b56 0x0b47 0x0b41
501    0x000b8020: 0x0b42 0x0b69 0x0b6f 0x0b73 0x0b20 0x0b63 0x0b75 0x0b72
502    0x000b8030: 0x0b72 0x0b65 0x0b6e 0x0b74 0x0b2d 0x0b63 0x0b76 0x0b73
503    0x000b8040: 0x0b20 0x0b30 0x0b35 0x0b20 0x0b4e 0x0b6f 0x0b76 0x0b20
504    0x000b8050: 0x0b32 0x0b30 0x0b30 0x0b33 0x0720 0x0720 0x0720 0x0720
505    0x000b8060: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
506    0x000b8070: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
507    0x000b8080: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
508    0x000b8090: 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720 0x0720
509
510ERST
511
512    {
513        .name       = "gpa2hva",
514        .args_type  = "addr:l",
515        .params     = "addr",
516        .help       = "print the host virtual address corresponding to a guest physical address",
517        .cmd        = hmp_gpa2hva,
518    },
519
520SRST
521``gpa2hva`` *addr*
522  Print the host virtual address at which the guest's physical address *addr*
523  is mapped.
524ERST
525
526#ifdef CONFIG_LINUX
527    {
528        .name       = "gpa2hpa",
529        .args_type  = "addr:l",
530        .params     = "addr",
531        .help       = "print the host physical address corresponding to a guest physical address",
532        .cmd        = hmp_gpa2hpa,
533    },
534#endif
535
536SRST
537``gpa2hpa`` *addr*
538  Print the host physical address at which the guest's physical address *addr*
539  is mapped.
540ERST
541
542    {
543        .name       = "gva2gpa",
544        .args_type  = "addr:l",
545        .params     = "addr",
546        .help       = "print the guest physical address corresponding to a guest virtual address",
547        .cmd        = hmp_gva2gpa,
548    },
549
550SRST
551``gva2gpa`` *addr*
552  Print the guest physical address at which the guest's virtual address *addr*
553  is mapped based on the mapping for the current CPU.
554ERST
555
556    {
557        .name       = "print|p",
558        .args_type  = "fmt:/,val:l",
559        .params     = "/fmt expr",
560        .help       = "print expression value (use $reg for CPU register access)",
561        .cmd        = do_print,
562    },
563
564SRST
565``print`` or ``p/``\ *fmt* *expr*
566  Print expression value. Only the *format* part of *fmt* is
567  used.
568ERST
569
570    {
571        .name       = "i",
572        .args_type  = "fmt:/,addr:i,index:i.",
573        .params     = "/fmt addr",
574        .help       = "I/O port read",
575        .cmd        = hmp_ioport_read,
576    },
577
578SRST
579``i/``\ *fmt* *addr* [.\ *index*\ ]
580  Read I/O port.
581ERST
582
583    {
584        .name       = "o",
585        .args_type  = "fmt:/,addr:i,val:i",
586        .params     = "/fmt addr value",
587        .help       = "I/O port write",
588        .cmd        = hmp_ioport_write,
589    },
590
591SRST
592``o/``\ *fmt* *addr* *val*
593  Write to I/O port.
594ERST
595
596    {
597        .name       = "sendkey",
598        .args_type  = "keys:s,hold-time:i?",
599        .params     = "keys [hold_ms]",
600        .help       = "send keys to the VM (e.g. 'sendkey ctrl-alt-f1', default hold time=100 ms)",
601        .cmd        = hmp_sendkey,
602        .command_completion = sendkey_completion,
603    },
604
605SRST
606``sendkey`` *keys*
607  Send *keys* to the guest. *keys* could be the name of the
608  key or the raw value in hexadecimal format. Use ``-`` to press
609  several keys simultaneously. Example::
610
611    sendkey ctrl-alt-f1
612
613  This command is useful to send keys that your graphical user interface
614  intercepts at low level, such as ``ctrl-alt-f1`` in X Window.
615ERST
616    {
617        .name       = "sync-profile",
618        .args_type  = "op:s?",
619        .params     = "[on|off|reset]",
620        .help       = "enable, disable or reset synchronization profiling. "
621                      "With no arguments, prints whether profiling is on or off.",
622        .cmd        = hmp_sync_profile,
623    },
624
625SRST
626``sync-profile [on|off|reset]``
627  Enable, disable or reset synchronization profiling. With no arguments, prints
628  whether profiling is on or off.
629ERST
630
631    {
632        .name       = "system_reset",
633        .args_type  = "",
634        .params     = "",
635        .help       = "reset the system",
636        .cmd        = hmp_system_reset,
637    },
638
639SRST
640``system_reset``
641  Reset the system.
642ERST
643
644    {
645        .name       = "system_powerdown",
646        .args_type  = "",
647        .params     = "",
648        .help       = "send system power down event",
649        .cmd        = hmp_system_powerdown,
650    },
651
652SRST
653``system_powerdown``
654  Power down the system (if supported).
655ERST
656
657    {
658        .name       = "sum",
659        .args_type  = "start:i,size:i",
660        .params     = "addr size",
661        .help       = "compute the checksum of a memory region",
662        .cmd        = hmp_sum,
663    },
664
665SRST
666``sum`` *addr* *size*
667  Compute the checksum of a memory region.
668ERST
669
670    {
671        .name       = "device_add",
672        .args_type  = "device:O",
673        .params     = "driver[,prop=value][,...]",
674        .help       = "add device, like -device on the command line",
675        .cmd        = hmp_device_add,
676        .command_completion = device_add_completion,
677    },
678
679SRST
680``device_add`` *config*
681  Add device.
682ERST
683
684    {
685        .name       = "device_del",
686        .args_type  = "id:s",
687        .params     = "device",
688        .help       = "remove device",
689        .cmd        = hmp_device_del,
690        .command_completion = device_del_completion,
691    },
692
693SRST
694``device_del`` *id*
695  Remove device *id*. *id* may be a short ID
696  or a QOM object path.
697ERST
698
699    {
700        .name       = "cpu",
701        .args_type  = "index:i",
702        .params     = "index",
703        .help       = "set the default CPU",
704        .cmd        = hmp_cpu,
705    },
706
707SRST
708``cpu`` *index*
709  Set the default CPU.
710ERST
711
712    {
713        .name       = "mouse_move",
714        .args_type  = "dx_str:s,dy_str:s,dz_str:s?",
715        .params     = "dx dy [dz]",
716        .help       = "send mouse move events",
717        .cmd        = hmp_mouse_move,
718    },
719
720SRST
721``mouse_move`` *dx* *dy* [*dz*]
722  Move the active mouse to the specified coordinates *dx* *dy*
723  with optional scroll axis *dz*.
724ERST
725
726    {
727        .name       = "mouse_button",
728        .args_type  = "button_state:i",
729        .params     = "state",
730        .help       = "change mouse button state (1=L, 2=M, 4=R)",
731        .cmd        = hmp_mouse_button,
732    },
733
734SRST
735``mouse_button`` *val*
736  Change the active mouse button state *val* (1=L, 2=M, 4=R).
737ERST
738
739    {
740        .name       = "mouse_set",
741        .args_type  = "index:i",
742        .params     = "index",
743        .help       = "set which mouse device receives events",
744        .cmd        = hmp_mouse_set,
745    },
746
747SRST
748``mouse_set`` *index*
749  Set which mouse device receives events at given *index*, index
750  can be obtained with::
751
752    info mice
753
754ERST
755
756    {
757        .name       = "wavcapture",
758        .args_type  = "path:F,audiodev:s,freq:i?,bits:i?,nchannels:i?",
759        .params     = "path audiodev [frequency [bits [channels]]]",
760        .help       = "capture audio to a wave file (default frequency=44100 bits=16 channels=2)",
761        .cmd        = hmp_wavcapture,
762    },
763SRST
764``wavcapture`` *filename* *audiodev* [*frequency* [*bits* [*channels*]]]
765  Capture audio into *filename* from *audiodev*, using sample rate
766  *frequency* bits per sample *bits* and number of channels
767  *channels*.
768
769  Defaults:
770
771  - Sample rate = 44100 Hz - CD quality
772  - Bits = 16
773  - Number of channels = 2 - Stereo
774ERST
775
776    {
777        .name       = "stopcapture",
778        .args_type  = "n:i",
779        .params     = "capture index",
780        .help       = "stop capture",
781        .cmd        = hmp_stopcapture,
782    },
783SRST
784``stopcapture`` *index*
785  Stop capture with a given *index*, index can be obtained with::
786
787    info capture
788
789ERST
790
791    {
792        .name       = "memsave",
793        .args_type  = "val:l,size:i,filename:s",
794        .params     = "addr size file",
795        .help       = "save to disk virtual memory dump starting at 'addr' of size 'size'",
796        .cmd        = hmp_memsave,
797    },
798
799SRST
800``memsave`` *addr* *size* *file*
801  save to disk virtual memory dump starting at *addr* of size *size*.
802ERST
803
804    {
805        .name       = "pmemsave",
806        .args_type  = "val:l,size:i,filename:s",
807        .params     = "addr size file",
808        .help       = "save to disk physical memory dump starting at 'addr' of size 'size'",
809        .cmd        = hmp_pmemsave,
810    },
811
812SRST
813``pmemsave`` *addr* *size* *file*
814  save to disk physical memory dump starting at *addr* of size *size*.
815ERST
816
817    {
818        .name       = "boot_set",
819        .args_type  = "bootdevice:s",
820        .params     = "bootdevice",
821        .help       = "define new values for the boot device list",
822        .cmd        = hmp_boot_set,
823    },
824
825SRST
826``boot_set`` *bootdevicelist*
827  Define new values for the boot device list. Those values will override
828  the values specified on the command line through the ``-boot`` option.
829
830  The values that can be specified here depend on the machine type, but are
831  the same that can be specified in the ``-boot`` command line option.
832ERST
833
834    {
835        .name       = "nmi",
836        .args_type  = "",
837        .params     = "",
838        .help       = "inject an NMI",
839        .cmd        = hmp_nmi,
840    },
841SRST
842``nmi`` *cpu*
843  Inject an NMI on the default CPU (x86/s390) or all CPUs (ppc64).
844ERST
845
846    {
847        .name       = "ringbuf_write",
848        .args_type  = "device:s,data:s",
849        .params     = "device data",
850        .help       = "Write to a ring buffer character device",
851        .cmd        = hmp_ringbuf_write,
852        .command_completion = ringbuf_write_completion,
853    },
854
855SRST
856``ringbuf_write`` *device* *data*
857  Write *data* to ring buffer character device *device*.
858  *data* must be a UTF-8 string.
859ERST
860
861    {
862        .name       = "ringbuf_read",
863        .args_type  = "device:s,size:i",
864        .params     = "device size",
865        .help       = "Read from a ring buffer character device",
866        .cmd        = hmp_ringbuf_read,
867        .command_completion = ringbuf_write_completion,
868    },
869
870SRST
871``ringbuf_read`` *device*
872  Read and print up to *size* bytes from ring buffer character
873  device *device*.
874  Certain non-printable characters are printed ``\uXXXX``, where ``XXXX`` is the
875  character code in hexadecimal.  Character ``\`` is printed ``\\``.
876  Bug: can screw up when the buffer contains invalid UTF-8 sequences,
877  NUL characters, after the ring buffer lost data, and when reading
878  stops because the size limit is reached.
879ERST
880
881    {
882        .name       = "announce_self",
883        .args_type  = "interfaces:s?,id:s?",
884        .params     = "[interfaces] [id]",
885        .help       = "Trigger GARP/RARP announcements",
886        .cmd        = hmp_announce_self,
887    },
888
889SRST
890``announce_self``
891  Trigger a round of GARP/RARP broadcasts; this is useful for explicitly
892  updating the network infrastructure after a reconfiguration or some forms
893  of migration. The timings of the round are set by the migration announce
894  parameters. An optional comma separated *interfaces* list restricts the
895  announce to the named set of interfaces. An optional *id* can be used to
896  start a separate announce timer and to change the parameters of it later.
897ERST
898
899    {
900        .name       = "migrate",
901        .args_type  = "detach:-d,blk:-b,inc:-i,resume:-r,uri:s",
902        .params     = "[-d] [-b] [-i] [-r] uri",
903        .help       = "migrate to URI (using -d to not wait for completion)"
904		      "\n\t\t\t -b for migration without shared storage with"
905		      " full copy of disk\n\t\t\t -i for migration without "
906		      "shared storage with incremental copy of disk "
907		      "(base image shared between src and destination)"
908                      "\n\t\t\t -r to resume a paused migration",
909        .cmd        = hmp_migrate,
910    },
911
912
913SRST
914``migrate [-d] [-b] [-i]`` *uri*
915  Migrate to *uri* (using -d to not wait for completion).
916
917  ``-b``
918    for migration with full copy of disk
919  ``-i``
920    for migration with incremental copy of disk (base image is shared)
921ERST
922
923    {
924        .name       = "migrate_cancel",
925        .args_type  = "",
926        .params     = "",
927        .help       = "cancel the current VM migration",
928        .cmd        = hmp_migrate_cancel,
929    },
930
931SRST
932``migrate_cancel``
933  Cancel the current VM migration.
934ERST
935
936    {
937        .name       = "migrate_continue",
938        .args_type  = "state:s",
939        .params     = "state",
940        .help       = "Continue migration from the given paused state",
941        .cmd        = hmp_migrate_continue,
942    },
943SRST
944``migrate_continue`` *state*
945  Continue migration from the paused state *state*
946ERST
947
948    {
949        .name       = "migrate_incoming",
950        .args_type  = "uri:s",
951        .params     = "uri",
952        .help       = "Continue an incoming migration from an -incoming defer",
953        .cmd        = hmp_migrate_incoming,
954    },
955
956SRST
957``migrate_incoming`` *uri*
958  Continue an incoming migration using the *uri* (that has the same syntax
959  as the ``-incoming`` option).
960ERST
961
962    {
963        .name       = "migrate_recover",
964        .args_type  = "uri:s",
965        .params     = "uri",
966        .help       = "Continue a paused incoming postcopy migration",
967        .cmd        = hmp_migrate_recover,
968    },
969
970SRST
971``migrate_recover`` *uri*
972  Continue a paused incoming postcopy migration using the *uri*.
973ERST
974
975    {
976        .name       = "migrate_pause",
977        .args_type  = "",
978        .params     = "",
979        .help       = "Pause an ongoing migration (postcopy-only)",
980        .cmd        = hmp_migrate_pause,
981    },
982
983SRST
984``migrate_pause``
985  Pause an ongoing migration.  Currently it only supports postcopy.
986ERST
987
988    {
989        .name       = "migrate_set_cache_size",
990        .args_type  = "value:o",
991        .params     = "value",
992        .help       = "set cache size (in bytes) for XBZRLE migrations,"
993                      "the cache size will be rounded down to the nearest "
994                      "power of 2.\n"
995                      "The cache size affects the number of cache misses."
996                      "In case of a high cache miss ratio you need to increase"
997                      " the cache size",
998        .cmd        = hmp_migrate_set_cache_size,
999    },
1000
1001SRST
1002``migrate_set_cache_size`` *value*
1003  Set cache size to *value* (in bytes) for xbzrle migrations.
1004ERST
1005
1006    {
1007        .name       = "migrate_set_speed",
1008        .args_type  = "value:o",
1009        .params     = "value",
1010        .help       = "set maximum speed (in bytes) for migrations. "
1011	"Defaults to MB if no size suffix is specified, ie. B/K/M/G/T",
1012        .cmd        = hmp_migrate_set_speed,
1013    },
1014
1015SRST
1016``migrate_set_speed`` *value*
1017  Set maximum speed to *value* (in bytes) for migrations.
1018ERST
1019
1020    {
1021        .name       = "migrate_set_downtime",
1022        .args_type  = "value:T",
1023        .params     = "value",
1024        .help       = "set maximum tolerated downtime (in seconds) for migrations",
1025        .cmd        = hmp_migrate_set_downtime,
1026    },
1027
1028SRST
1029``migrate_set_downtime`` *second*
1030  Set maximum tolerated downtime (in seconds) for migration.
1031ERST
1032
1033    {
1034        .name       = "migrate_set_capability",
1035        .args_type  = "capability:s,state:b",
1036        .params     = "capability state",
1037        .help       = "Enable/Disable the usage of a capability for migration",
1038        .cmd        = hmp_migrate_set_capability,
1039        .command_completion = migrate_set_capability_completion,
1040    },
1041
1042SRST
1043``migrate_set_capability`` *capability* *state*
1044  Enable/Disable the usage of a capability *capability* for migration.
1045ERST
1046
1047    {
1048        .name       = "migrate_set_parameter",
1049        .args_type  = "parameter:s,value:s",
1050        .params     = "parameter value",
1051        .help       = "Set the parameter for migration",
1052        .cmd        = hmp_migrate_set_parameter,
1053        .command_completion = migrate_set_parameter_completion,
1054    },
1055
1056SRST
1057``migrate_set_parameter`` *parameter* *value*
1058  Set the parameter *parameter* for migration.
1059ERST
1060
1061    {
1062        .name       = "migrate_start_postcopy",
1063        .args_type  = "",
1064        .params     = "",
1065        .help       = "Followup to a migration command to switch the migration"
1066                      " to postcopy mode. The postcopy-ram capability must "
1067                      "be set on both source and destination before the "
1068                      "original migration command .",
1069        .cmd        = hmp_migrate_start_postcopy,
1070    },
1071
1072SRST
1073``migrate_start_postcopy``
1074  Switch in-progress migration to postcopy mode. Ignored after the end of
1075  migration (or once already in postcopy).
1076ERST
1077
1078    {
1079        .name       = "x_colo_lost_heartbeat",
1080        .args_type  = "",
1081        .params     = "",
1082        .help       = "Tell COLO that heartbeat is lost,\n\t\t\t"
1083                      "a failover or takeover is needed.",
1084        .cmd = hmp_x_colo_lost_heartbeat,
1085    },
1086
1087SRST
1088``x_colo_lost_heartbeat``
1089  Tell COLO that heartbeat is lost, a failover or takeover is needed.
1090ERST
1091
1092    {
1093        .name       = "client_migrate_info",
1094        .args_type  = "protocol:s,hostname:s,port:i?,tls-port:i?,cert-subject:s?",
1095        .params     = "protocol hostname port tls-port cert-subject",
1096        .help       = "set migration information for remote display",
1097        .cmd        = hmp_client_migrate_info,
1098    },
1099
1100SRST
1101``client_migrate_info`` *protocol* *hostname* *port* *tls-port* *cert-subject*
1102  Set migration information for remote display.  This makes the server
1103  ask the client to automatically reconnect using the new parameters
1104  once migration finished successfully.  Only implemented for SPICE.
1105ERST
1106
1107    {
1108        .name       = "dump-guest-memory",
1109        .args_type  = "paging:-p,detach:-d,windmp:-w,zlib:-z,lzo:-l,snappy:-s,filename:F,begin:l?,length:l?",
1110        .params     = "[-p] [-d] [-z|-l|-s|-w] filename [begin length]",
1111        .help       = "dump guest memory into file 'filename'.\n\t\t\t"
1112                      "-p: do paging to get guest's memory mapping.\n\t\t\t"
1113                      "-d: return immediately (do not wait for completion).\n\t\t\t"
1114                      "-z: dump in kdump-compressed format, with zlib compression.\n\t\t\t"
1115                      "-l: dump in kdump-compressed format, with lzo compression.\n\t\t\t"
1116                      "-s: dump in kdump-compressed format, with snappy compression.\n\t\t\t"
1117                      "-w: dump in Windows crashdump format (can be used instead of ELF-dump converting),\n\t\t\t"
1118                      "    for Windows x64 guests with vmcoreinfo driver only.\n\t\t\t"
1119                      "begin: the starting physical address.\n\t\t\t"
1120                      "length: the memory size, in bytes.",
1121        .cmd        = hmp_dump_guest_memory,
1122    },
1123
1124SRST
1125``dump-guest-memory [-p]`` *filename* *begin* *length*
1126  \
1127``dump-guest-memory [-z|-l|-s|-w]`` *filename*
1128  Dump guest memory to *protocol*. The file can be processed with crash or
1129  gdb. Without ``-z|-l|-s|-w``, the dump format is ELF.
1130
1131  ``-p``
1132    do paging to get guest's memory mapping.
1133  ``-z``
1134    dump in kdump-compressed format, with zlib compression.
1135  ``-l``
1136    dump in kdump-compressed format, with lzo compression.
1137  ``-s``
1138    dump in kdump-compressed format, with snappy compression.
1139  ``-w``
1140    dump in Windows crashdump format (can be used instead of ELF-dump converting),
1141    for Windows x64 guests with vmcoreinfo driver only
1142  *filename*
1143    dump file name.
1144  *begin*
1145    the starting physical address. It's optional, and should be
1146    specified together with *length*.
1147  *length*
1148    the memory size, in bytes. It's optional, and should be specified
1149    together with *begin*.
1150
1151ERST
1152
1153#if defined(TARGET_S390X)
1154    {
1155        .name       = "dump-skeys",
1156        .args_type  = "filename:F",
1157        .params     = "",
1158        .help       = "Save guest storage keys into file 'filename'.\n",
1159        .cmd        = hmp_dump_skeys,
1160    },
1161#endif
1162
1163SRST
1164``dump-skeys`` *filename*
1165  Save guest storage keys to a file.
1166ERST
1167
1168#if defined(TARGET_S390X)
1169    {
1170        .name       = "migration_mode",
1171        .args_type  = "mode:i",
1172        .params     = "mode",
1173        .help       = "Enables or disables migration mode\n",
1174        .cmd        = hmp_migrationmode,
1175    },
1176#endif
1177
1178SRST
1179``migration_mode`` *mode*
1180  Enables or disables migration mode.
1181ERST
1182
1183    {
1184        .name       = "snapshot_blkdev",
1185        .args_type  = "reuse:-n,device:B,snapshot-file:s?,format:s?",
1186        .params     = "[-n] device [new-image-file] [format]",
1187        .help       = "initiates a live snapshot\n\t\t\t"
1188                      "of device. If a new image file is specified, the\n\t\t\t"
1189                      "new image file will become the new root image.\n\t\t\t"
1190                      "If format is specified, the snapshot file will\n\t\t\t"
1191                      "be created in that format.\n\t\t\t"
1192                      "The default format is qcow2.  The -n flag requests QEMU\n\t\t\t"
1193                      "to reuse the image found in new-image-file, instead of\n\t\t\t"
1194                      "recreating it from scratch.",
1195        .cmd        = hmp_snapshot_blkdev,
1196    },
1197
1198SRST
1199``snapshot_blkdev``
1200  Snapshot device, using snapshot file as target if provided
1201ERST
1202
1203    {
1204        .name       = "snapshot_blkdev_internal",
1205        .args_type  = "device:B,name:s",
1206        .params     = "device name",
1207        .help       = "take an internal snapshot of device.\n\t\t\t"
1208                      "The format of the image used by device must\n\t\t\t"
1209                      "support it, such as qcow2.\n\t\t\t",
1210        .cmd        = hmp_snapshot_blkdev_internal,
1211    },
1212
1213SRST
1214``snapshot_blkdev_internal``
1215  Take an internal snapshot on device if it support
1216ERST
1217
1218    {
1219        .name       = "snapshot_delete_blkdev_internal",
1220        .args_type  = "device:B,name:s,id:s?",
1221        .params     = "device name [id]",
1222        .help       = "delete an internal snapshot of device.\n\t\t\t"
1223                      "If id is specified, qemu will try delete\n\t\t\t"
1224                      "the snapshot matching both id and name.\n\t\t\t"
1225                      "The format of the image used by device must\n\t\t\t"
1226                      "support it, such as qcow2.\n\t\t\t",
1227        .cmd        = hmp_snapshot_delete_blkdev_internal,
1228    },
1229
1230SRST
1231``snapshot_delete_blkdev_internal``
1232  Delete an internal snapshot on device if it support
1233ERST
1234
1235    {
1236        .name       = "drive_mirror",
1237        .args_type  = "reuse:-n,full:-f,device:B,target:s,format:s?",
1238        .params     = "[-n] [-f] device target [format]",
1239        .help       = "initiates live storage\n\t\t\t"
1240                      "migration for a device. The device's contents are\n\t\t\t"
1241                      "copied to the new image file, including data that\n\t\t\t"
1242                      "is written after the command is started.\n\t\t\t"
1243                      "The -n flag requests QEMU to reuse the image found\n\t\t\t"
1244                      "in new-image-file, instead of recreating it from scratch.\n\t\t\t"
1245                      "The -f flag requests QEMU to copy the whole disk,\n\t\t\t"
1246                      "so that the result does not need a backing file.\n\t\t\t",
1247        .cmd        = hmp_drive_mirror,
1248    },
1249SRST
1250``drive_mirror``
1251  Start mirroring a block device's writes to a new destination,
1252  using the specified target.
1253ERST
1254
1255    {
1256        .name       = "drive_backup",
1257        .args_type  = "reuse:-n,full:-f,compress:-c,device:B,target:s,format:s?",
1258        .params     = "[-n] [-f] [-c] device target [format]",
1259        .help       = "initiates a point-in-time\n\t\t\t"
1260                      "copy for a device. The device's contents are\n\t\t\t"
1261                      "copied to the new image file, excluding data that\n\t\t\t"
1262                      "is written after the command is started.\n\t\t\t"
1263                      "The -n flag requests QEMU to reuse the image found\n\t\t\t"
1264                      "in new-image-file, instead of recreating it from scratch.\n\t\t\t"
1265                      "The -f flag requests QEMU to copy the whole disk,\n\t\t\t"
1266                      "so that the result does not need a backing file.\n\t\t\t"
1267                      "The -c flag requests QEMU to compress backup data\n\t\t\t"
1268                      "(if the target format supports it).\n\t\t\t",
1269        .cmd        = hmp_drive_backup,
1270    },
1271SRST
1272``drive_backup``
1273  Start a point-in-time copy of a block device to a specified target.
1274ERST
1275
1276    {
1277        .name       = "drive_add",
1278        .args_type  = "node:-n,pci_addr:s,opts:s",
1279        .params     = "[-n] [[<domain>:]<bus>:]<slot>\n"
1280                      "[file=file][,if=type][,bus=n]\n"
1281                      "[,unit=m][,media=d][,index=i]\n"
1282                      "[,snapshot=on|off][,cache=on|off]\n"
1283                      "[,readonly=on|off][,copy-on-read=on|off]",
1284        .help       = "add drive to PCI storage controller",
1285        .cmd        = hmp_drive_add,
1286    },
1287
1288SRST
1289``drive_add``
1290  Add drive to PCI storage controller.
1291ERST
1292
1293    {
1294        .name       = "pcie_aer_inject_error",
1295        .args_type  = "advisory_non_fatal:-a,correctable:-c,"
1296	              "id:s,error_status:s,"
1297	              "header0:i?,header1:i?,header2:i?,header3:i?,"
1298	              "prefix0:i?,prefix1:i?,prefix2:i?,prefix3:i?",
1299        .params     = "[-a] [-c] id "
1300                      "<error_status> [<tlp header> [<tlp header prefix>]]",
1301        .help       = "inject pcie aer error\n\t\t\t"
1302	              " -a for advisory non fatal error\n\t\t\t"
1303	              " -c for correctable error\n\t\t\t"
1304                      "<id> = qdev device id\n\t\t\t"
1305                      "<error_status> = error string or 32bit\n\t\t\t"
1306                      "<tlp header> = 32bit x 4\n\t\t\t"
1307                      "<tlp header prefix> = 32bit x 4",
1308        .cmd        = hmp_pcie_aer_inject_error,
1309    },
1310
1311SRST
1312``pcie_aer_inject_error``
1313  Inject PCIe AER error
1314ERST
1315
1316    {
1317        .name       = "netdev_add",
1318        .args_type  = "netdev:O",
1319        .params     = "[user|tap|socket|vde|bridge|hubport|netmap|vhost-user],id=str[,prop=value][,...]",
1320        .help       = "add host network device",
1321        .cmd        = hmp_netdev_add,
1322        .command_completion = netdev_add_completion,
1323    },
1324
1325SRST
1326``netdev_add``
1327  Add host network device.
1328ERST
1329
1330    {
1331        .name       = "netdev_del",
1332        .args_type  = "id:s",
1333        .params     = "id",
1334        .help       = "remove host network device",
1335        .cmd        = hmp_netdev_del,
1336        .command_completion = netdev_del_completion,
1337    },
1338
1339SRST
1340``netdev_del``
1341  Remove host network device.
1342ERST
1343
1344    {
1345        .name       = "object_add",
1346        .args_type  = "object:O",
1347        .params     = "[qom-type=]type,id=str[,prop=value][,...]",
1348        .help       = "create QOM object",
1349        .cmd        = hmp_object_add,
1350        .command_completion = object_add_completion,
1351    },
1352
1353SRST
1354``object_add``
1355  Create QOM object.
1356ERST
1357
1358    {
1359        .name       = "object_del",
1360        .args_type  = "id:s",
1361        .params     = "id",
1362        .help       = "destroy QOM object",
1363        .cmd        = hmp_object_del,
1364        .command_completion = object_del_completion,
1365    },
1366
1367SRST
1368``object_del``
1369  Destroy QOM object.
1370ERST
1371
1372#ifdef CONFIG_SLIRP
1373    {
1374        .name       = "hostfwd_add",
1375        .args_type  = "arg1:s,arg2:s?",
1376        .params     = "[netdev_id] [tcp|udp]:[hostaddr]:hostport-[guestaddr]:guestport",
1377        .help       = "redirect TCP or UDP connections from host to guest (requires -net user)",
1378        .cmd        = hmp_hostfwd_add,
1379    },
1380#endif
1381SRST
1382``hostfwd_add``
1383  Redirect TCP or UDP connections from host to guest (requires -net user).
1384ERST
1385
1386#ifdef CONFIG_SLIRP
1387    {
1388        .name       = "hostfwd_remove",
1389        .args_type  = "arg1:s,arg2:s?",
1390        .params     = "[netdev_id] [tcp|udp]:[hostaddr]:hostport",
1391        .help       = "remove host-to-guest TCP or UDP redirection",
1392        .cmd        = hmp_hostfwd_remove,
1393    },
1394
1395#endif
1396SRST
1397``hostfwd_remove``
1398  Remove host-to-guest TCP or UDP redirection.
1399ERST
1400
1401    {
1402        .name       = "balloon",
1403        .args_type  = "value:M",
1404        .params     = "target",
1405        .help       = "request VM to change its memory allocation (in MB)",
1406        .cmd        = hmp_balloon,
1407    },
1408
1409SRST
1410``balloon`` *value*
1411  Request VM to change its memory allocation to *value* (in MB).
1412ERST
1413
1414    {
1415        .name       = "set_link",
1416        .args_type  = "name:s,up:b",
1417        .params     = "name on|off",
1418        .help       = "change the link status of a network adapter",
1419        .cmd        = hmp_set_link,
1420        .command_completion = set_link_completion,
1421    },
1422
1423SRST
1424``set_link`` *name* ``[on|off]``
1425  Switch link *name* on (i.e. up) or off (i.e. down).
1426ERST
1427
1428    {
1429        .name       = "watchdog_action",
1430        .args_type  = "action:s",
1431        .params     = "[reset|shutdown|poweroff|pause|debug|none]",
1432        .help       = "change watchdog action",
1433        .cmd        = hmp_watchdog_action,
1434        .command_completion = watchdog_action_completion,
1435    },
1436
1437SRST
1438``watchdog_action``
1439  Change watchdog action.
1440ERST
1441
1442    {
1443        .name       = "acl_show",
1444        .args_type  = "aclname:s",
1445        .params     = "aclname",
1446        .help       = "list rules in the access control list",
1447        .cmd        = hmp_acl_show,
1448    },
1449
1450SRST
1451``acl_show`` *aclname*
1452  List all the matching rules in the access control list, and the default
1453  policy. There are currently two named access control lists,
1454  *vnc.x509dname* and *vnc.username* matching on the x509 client
1455  certificate distinguished name, and SASL username respectively.
1456ERST
1457
1458    {
1459        .name       = "acl_policy",
1460        .args_type  = "aclname:s,policy:s",
1461        .params     = "aclname allow|deny",
1462        .help       = "set default access control list policy",
1463        .cmd        = hmp_acl_policy,
1464    },
1465
1466SRST
1467``acl_policy`` *aclname* ``allow|deny``
1468  Set the default access control list policy, used in the event that
1469  none of the explicit rules match. The default policy at startup is
1470  always ``deny``.
1471ERST
1472
1473    {
1474        .name       = "acl_add",
1475        .args_type  = "aclname:s,match:s,policy:s,index:i?",
1476        .params     = "aclname match allow|deny [index]",
1477        .help       = "add a match rule to the access control list",
1478        .cmd        = hmp_acl_add,
1479    },
1480
1481SRST
1482``acl_add`` *aclname* *match* ``allow|deny`` [*index*]
1483  Add a match rule to the access control list, allowing or denying access.
1484  The match will normally be an exact username or x509 distinguished name,
1485  but can optionally include wildcard globs. eg ``*@EXAMPLE.COM`` to
1486  allow all users in the ``EXAMPLE.COM`` kerberos realm. The match will
1487  normally be appended to the end of the ACL, but can be inserted
1488  earlier in the list if the optional *index* parameter is supplied.
1489ERST
1490
1491    {
1492        .name       = "acl_remove",
1493        .args_type  = "aclname:s,match:s",
1494        .params     = "aclname match",
1495        .help       = "remove a match rule from the access control list",
1496        .cmd        = hmp_acl_remove,
1497    },
1498
1499SRST
1500``acl_remove`` *aclname* *match*
1501  Remove the specified match rule from the access control list.
1502ERST
1503
1504    {
1505        .name       = "acl_reset",
1506        .args_type  = "aclname:s",
1507        .params     = "aclname",
1508        .help       = "reset the access control list",
1509        .cmd        = hmp_acl_reset,
1510    },
1511
1512SRST
1513``acl_reset`` *aclname*
1514  Remove all matches from the access control list, and set the default
1515  policy back to ``deny``.
1516ERST
1517
1518    {
1519        .name       = "nbd_server_start",
1520        .args_type  = "all:-a,writable:-w,uri:s",
1521        .params     = "nbd_server_start [-a] [-w] host:port",
1522        .help       = "serve block devices on the given host and port",
1523        .cmd        = hmp_nbd_server_start,
1524    },
1525SRST
1526``nbd_server_start`` *host*:*port*
1527  Start an NBD server on the given host and/or port.  If the ``-a``
1528  option is included, all of the virtual machine's block devices that
1529  have an inserted media on them are automatically exported; in this case,
1530  the ``-w`` option makes the devices writable too.
1531ERST
1532
1533    {
1534        .name       = "nbd_server_add",
1535        .args_type  = "writable:-w,device:B,name:s?",
1536        .params     = "nbd_server_add [-w] device [name]",
1537        .help       = "export a block device via NBD",
1538        .cmd        = hmp_nbd_server_add,
1539    },
1540SRST
1541``nbd_server_add`` *device* [ *name* ]
1542  Export a block device through QEMU's NBD server, which must be started
1543  beforehand with ``nbd_server_start``.  The ``-w`` option makes the
1544  exported device writable too.  The export name is controlled by *name*,
1545  defaulting to *device*.
1546ERST
1547
1548    {
1549        .name       = "nbd_server_remove",
1550        .args_type  = "force:-f,name:s",
1551        .params     = "nbd_server_remove [-f] name",
1552        .help       = "remove an export previously exposed via NBD",
1553        .cmd        = hmp_nbd_server_remove,
1554    },
1555SRST
1556``nbd_server_remove [-f]`` *name*
1557  Stop exporting a block device through QEMU's NBD server, which was
1558  previously started with ``nbd_server_add``.  The ``-f``
1559  option forces the server to drop the export immediately even if
1560  clients are connected; otherwise the command fails unless there are no
1561  clients.
1562ERST
1563
1564    {
1565        .name       = "nbd_server_stop",
1566        .args_type  = "",
1567        .params     = "nbd_server_stop",
1568        .help       = "stop serving block devices using the NBD protocol",
1569        .cmd        = hmp_nbd_server_stop,
1570    },
1571SRST
1572``nbd_server_stop``
1573  Stop the QEMU embedded NBD server.
1574ERST
1575
1576
1577#if defined(TARGET_I386)
1578
1579    {
1580        .name       = "mce",
1581        .args_type  = "broadcast:-b,cpu_index:i,bank:i,status:l,mcg_status:l,addr:l,misc:l",
1582        .params     = "[-b] cpu bank status mcgstatus addr misc",
1583        .help       = "inject a MCE on the given CPU [and broadcast to other CPUs with -b option]",
1584        .cmd        = hmp_mce,
1585    },
1586
1587#endif
1588SRST
1589``mce`` *cpu* *bank* *status* *mcgstatus* *addr* *misc*
1590  Inject an MCE on the given CPU (x86 only).
1591ERST
1592
1593    {
1594        .name       = "getfd",
1595        .args_type  = "fdname:s",
1596        .params     = "getfd name",
1597        .help       = "receive a file descriptor via SCM rights and assign it a name",
1598        .cmd        = hmp_getfd,
1599    },
1600
1601SRST
1602``getfd`` *fdname*
1603  If a file descriptor is passed alongside this command using the SCM_RIGHTS
1604  mechanism on unix sockets, it is stored using the name *fdname* for
1605  later use by other monitor commands.
1606ERST
1607
1608    {
1609        .name       = "closefd",
1610        .args_type  = "fdname:s",
1611        .params     = "closefd name",
1612        .help       = "close a file descriptor previously passed via SCM rights",
1613        .cmd        = hmp_closefd,
1614    },
1615
1616SRST
1617``closefd`` *fdname*
1618  Close the file descriptor previously assigned to *fdname* using the
1619  ``getfd`` command. This is only needed if the file descriptor was never
1620  used by another monitor command.
1621ERST
1622
1623    {
1624        .name       = "block_passwd",
1625        .args_type  = "device:B,password:s",
1626        .params     = "block_passwd device password",
1627        .help       = "set the password of encrypted block devices",
1628        .cmd        = hmp_block_passwd,
1629    },
1630
1631SRST
1632``block_passwd`` *device* *password*
1633  Set the encrypted device *device* password to *password*
1634
1635  This command is now obsolete and will always return an error since 2.10
1636ERST
1637
1638    {
1639        .name       = "block_set_io_throttle",
1640        .args_type  = "device:B,bps:l,bps_rd:l,bps_wr:l,iops:l,iops_rd:l,iops_wr:l",
1641        .params     = "device bps bps_rd bps_wr iops iops_rd iops_wr",
1642        .help       = "change I/O throttle limits for a block drive",
1643        .cmd        = hmp_block_set_io_throttle,
1644    },
1645
1646SRST
1647``block_set_io_throttle`` *device* *bps* *bps_rd* *bps_wr* *iops* *iops_rd* *iops_wr*
1648  Change I/O throttle limits for a block drive to
1649  *bps* *bps_rd* *bps_wr* *iops* *iops_rd* *iops_wr*.
1650  *device* can be a block device name, a qdev ID or a QOM path.
1651ERST
1652
1653    {
1654        .name       = "set_password",
1655        .args_type  = "protocol:s,password:s,connected:s?",
1656        .params     = "protocol password action-if-connected",
1657        .help       = "set spice/vnc password",
1658        .cmd        = hmp_set_password,
1659    },
1660
1661SRST
1662``set_password [ vnc | spice ] password [ action-if-connected ]``
1663  Change spice/vnc password.  Use zero to make the password stay valid
1664  forever.  *action-if-connected* specifies what should happen in
1665  case a connection is established: *fail* makes the password change
1666  fail.  *disconnect* changes the password and disconnects the
1667  client.  *keep* changes the password and keeps the connection up.
1668  *keep* is the default.
1669ERST
1670
1671    {
1672        .name       = "expire_password",
1673        .args_type  = "protocol:s,time:s",
1674        .params     = "protocol time",
1675        .help       = "set spice/vnc password expire-time",
1676        .cmd        = hmp_expire_password,
1677    },
1678
1679SRST
1680``expire_password [ vnc | spice ]`` *expire-time*
1681  Specify when a password for spice/vnc becomes
1682  invalid. *expire-time* accepts:
1683
1684  ``now``
1685    Invalidate password instantly.
1686  ``never``
1687    Password stays valid forever.
1688  ``+``\ *nsec*
1689    Password stays valid for *nsec* seconds starting now.
1690  *nsec*
1691    Password is invalidated at the given time.  *nsec* are the seconds
1692    passed since 1970, i.e. unix epoch.
1693
1694ERST
1695
1696    {
1697        .name       = "chardev-add",
1698        .args_type  = "args:s",
1699        .params     = "args",
1700        .help       = "add chardev",
1701        .cmd        = hmp_chardev_add,
1702        .command_completion = chardev_add_completion,
1703    },
1704
1705SRST
1706``chardev-add`` *args*
1707  chardev-add accepts the same parameters as the -chardev command line switch.
1708ERST
1709
1710    {
1711        .name       = "chardev-change",
1712        .args_type  = "id:s,args:s",
1713        .params     = "id args",
1714        .help       = "change chardev",
1715        .cmd        = hmp_chardev_change,
1716    },
1717
1718SRST
1719``chardev-change`` *args*
1720  chardev-change accepts existing chardev *id* and then the same arguments
1721  as the -chardev command line switch (except for "id").
1722ERST
1723
1724    {
1725        .name       = "chardev-remove",
1726        .args_type  = "id:s",
1727        .params     = "id",
1728        .help       = "remove chardev",
1729        .cmd        = hmp_chardev_remove,
1730        .command_completion = chardev_remove_completion,
1731    },
1732
1733SRST
1734``chardev-remove`` *id*
1735  Removes the chardev *id*.
1736ERST
1737
1738    {
1739        .name       = "chardev-send-break",
1740        .args_type  = "id:s",
1741        .params     = "id",
1742        .help       = "send a break on chardev",
1743        .cmd        = hmp_chardev_send_break,
1744        .command_completion = chardev_remove_completion,
1745    },
1746
1747SRST
1748``chardev-send-break`` *id*
1749  Send a break on the chardev *id*.
1750ERST
1751
1752    {
1753        .name       = "qemu-io",
1754        .args_type  = "qdev:-d,device:B,command:s",
1755        .params     = "[-d] [device] \"[command]\"",
1756        .help       = "run a qemu-io command on a block device\n\t\t\t"
1757                      "-d: [device] is a device ID rather than a "
1758                      "drive ID or node name",
1759        .cmd        = hmp_qemu_io,
1760    },
1761
1762SRST
1763``qemu-io`` *device* *command*
1764  Executes a qemu-io command on the given block device.
1765ERST
1766
1767    {
1768        .name       = "qom-list",
1769        .args_type  = "path:s?",
1770        .params     = "path",
1771        .help       = "list QOM properties",
1772        .cmd        = hmp_qom_list,
1773        .flags      = "p",
1774    },
1775
1776SRST
1777``qom-list`` [*path*]
1778  Print QOM properties of object at location *path*
1779ERST
1780
1781    {
1782        .name       = "qom-get",
1783        .args_type  = "path:s,property:s",
1784        .params     = "path property",
1785        .help       = "print QOM property",
1786        .cmd        = hmp_qom_get,
1787        .flags      = "p",
1788    },
1789
1790SRST
1791``qom-get`` *path* *property*
1792  Print QOM property *property* of object at location *path*
1793ERST
1794
1795    {
1796        .name       = "qom-set",
1797        .args_type  = "json:-j,path:s,property:s,value:S",
1798        .params     = "[-j] path property value",
1799        .help       = "set QOM property.\n\t\t\t"
1800                      "-j: the value is specified in json format.",
1801        .cmd        = hmp_qom_set,
1802        .flags      = "p",
1803    },
1804
1805SRST
1806``qom-set`` *path* *property* *value*
1807  Set QOM property *property* of object at location *path* to value *value*
1808ERST
1809
1810    {
1811        .name       = "replay_break",
1812        .args_type  = "icount:i",
1813        .params     = "icount",
1814        .help       = "set breakpoint at the specified instruction count",
1815        .cmd        = hmp_replay_break,
1816    },
1817
1818SRST
1819``replay_break`` *icount*
1820  Set replay breakpoint at instruction count *icount*.
1821  Execution stops when the specified instruction is reached.
1822  There can be at most one breakpoint. When breakpoint is set, any prior
1823  one is removed.  The breakpoint may be set only in replay mode and only
1824  "in the future", i.e. at instruction counts greater than the current one.
1825  The current instruction count can be observed with ``info replay``.
1826ERST
1827
1828    {
1829        .name       = "replay_delete_break",
1830        .args_type  = "",
1831        .params     = "",
1832        .help       = "remove replay breakpoint",
1833        .cmd        = hmp_replay_delete_break,
1834    },
1835
1836SRST
1837``replay_delete_break``
1838  Remove replay breakpoint which was previously set with ``replay_break``.
1839  The command is ignored when there are no replay breakpoints.
1840ERST
1841
1842    {
1843        .name       = "replay_seek",
1844        .args_type  = "icount:i",
1845        .params     = "icount",
1846        .help       = "replay execution to the specified instruction count",
1847        .cmd        = hmp_replay_seek,
1848    },
1849
1850SRST
1851``replay_seek`` *icount*
1852  Automatically proceed to the instruction count *icount*, when
1853  replaying the execution. The command automatically loads nearest
1854  snapshot and replays the execution to find the desired instruction.
1855  When there is no preceding snapshot or the execution is not replayed,
1856  then the command fails.
1857  *icount* for the reference may be observed with ``info replay`` command.
1858ERST
1859
1860    {
1861        .name       = "info",
1862        .args_type  = "item:s?",
1863        .params     = "[subcommand]",
1864        .help       = "show various information about the system state",
1865        .cmd        = hmp_info_help,
1866        .sub_table  = hmp_info_cmds,
1867        .flags      = "p",
1868    },
1869
1870