monitor: no need to save need_resume

[qemu.git] / monitor.c

diff --git a/monitor.c b/monitor.c
index 3a0ea0c6026328acaa57fd62b065139b3cf0f4f3..cf3b629cf7be489bfb68e13596dcf55d6d689bd0 100644 (file)
--- a/monitor.c
+++ b/monitor.c
@@ -58,7 +58,6 @@
 #include "qapi/qmp/qnum.h"
 #include "qapi/qmp/qstring.h"
 #include "qapi/qmp/qjson.h"
 #include "qapi/qmp/qnum.h"
 #include "qapi/qmp/qstring.h"
 #include "qapi/qmp/qjson.h"

-#include "qapi/qmp/json-streamer.h"

 #include "qapi/qmp/json-parser.h"
 #include "qapi/qmp/qlist.h"
 #include "qom/object_interfaces.h"
 #include "qapi/qmp/json-parser.h"
 #include "qapi/qmp/qlist.h"
 #include "qom/object_interfaces.h"


@@ -169,20 +168,20 @@ typedef struct {
     JSONMessageParser parser;
     /*
      * When a client connects, we're in capabilities negotiation mode.
     JSONMessageParser parser;
     /*
      * When a client connects, we're in capabilities negotiation mode.

-     * When command qmp_capabilities succeeds, we go into command
-     * mode.
+     * @commands is &qmp_cap_negotiation_commands then.  When command
+     * qmp_capabilities succeeds, we go into command mode, and
+     * @command becomes &qmp_commands.

      */
     QmpCommandList *commands;
      */
     QmpCommandList *commands;

-    bool qmp_caps[QMP_CAPABILITY__MAX];
+    bool capab_offered[QMP_CAPABILITY__MAX]; /* capabilities offered */
+    bool capab[QMP_CAPABILITY__MAX];         /* offered and accepted */

     /*
     /*

-     * Protects qmp request/response queue.  Please take monitor_lock
-     * first when used together.
+     * Protects qmp request/response queue.
+     * Take monitor_lock first when you need both.

      */
     QemuMutex qmp_queue_lock;
     /* Input queue that holds all the parsed QMP requests */
     GQueue *qmp_requests;
      */
     QemuMutex qmp_queue_lock;
     /* Input queue that holds all the parsed QMP requests */
     GQueue *qmp_requests;

-    /* Output queue contains all the QMP responses in order */
-    GQueue *qmp_responses;

 } MonitorQMP;
 
 /*
 } MonitorQMP;
 
 /*


@@ -207,11 +206,11 @@ struct Monitor {
     int flags;
     int suspend_cnt;            /* Needs to be accessed atomically */
     bool skip_flush;
     int flags;
     int suspend_cnt;            /* Needs to be accessed atomically */
     bool skip_flush;

-    bool use_io_thr;
+    bool use_io_thread;

 
     /*
      * State used only in the thread "owning" the monitor.
 
     /*
      * State used only in the thread "owning" the monitor.

-     * If @use_io_thr, this is mon_global.mon_iothread.
+     * If @use_io_thread, this is @mon_iothread.

      * Else, it's the main thread.
      * These members can be safely accessed without locks.
      */
      * Else, it's the main thread.
      * These members can be safely accessed without locks.
      */


@@ -231,7 +230,7 @@ struct Monitor {
     QemuMutex mon_lock;
 
     /*
     QemuMutex mon_lock;
 
     /*

-     * Fields that are protected by the per-monitor lock.
+     * Members that are protected by the per-monitor lock

      */
     QLIST_HEAD(, mon_fd_t) fds;
     QString *outbuf;
      */
     QLIST_HEAD(, mon_fd_t) fds;
     QString *outbuf;


@@ -240,28 +239,23 @@ struct Monitor {
     int mux_out;
 };
 
     int mux_out;
 };
 

-/* Let's add monitor global variables to this struct. */
-static struct {
-    IOThread *mon_iothread;
-    /* Bottom half to dispatch the requests received from IO thread */
-    QEMUBH *qmp_dispatcher_bh;
-    /* Bottom half to deliver the responses back to clients */
-    QEMUBH *qmp_respond_bh;
-} mon_global;
+/* Shared monitor I/O thread */
+IOThread *mon_iothread;
+
+/* Bottom half to dispatch the requests received from I/O thread */
+QEMUBH *qmp_dispatcher_bh;

 
 struct QMPRequest {
     /* Owner of the request */
     Monitor *mon;
     /* "id" field of the request */
     QObject *id;
 
 struct QMPRequest {
     /* Owner of the request */
     Monitor *mon;
     /* "id" field of the request */
     QObject *id;

-    /* Request object to be handled */
-    QObject *req;

     /*
     /*

-     * Whether we need to resume the monitor afterward.  This flag is
-     * used to emulate the old QMP server behavior that the current
-     * command must be completed before execution of the next one.
+     * Request object to be handled or Error to be reported
+     * (exactly one of them is non-null)

      */
      */

-    bool need_resume;
+    QObject *req;
+    Error *err;

 };
 typedef struct QMPRequest QMPRequest;
 
 };
 typedef struct QMPRequest QMPRequest;
 


@@ -284,7 +278,7 @@ static mon_cmd_t info_cmds[];
 
 QmpCommandList qmp_commands, qmp_cap_negotiation_commands;
 
 
 QmpCommandList qmp_commands, qmp_cap_negotiation_commands;
 

-Monitor *cur_mon;
+__thread Monitor *cur_mon;

 
 static void monitor_command_cb(void *opaque, const char *cmdline,
                                void *readline_opaque);
 
 static void monitor_command_cb(void *opaque, const char *cmdline,
                                void *readline_opaque);


@@ -298,9 +292,9 @@ static inline bool monitor_is_qmp(const Monitor *mon)
 }
 
 /**
 }
 
 /**

- * Whether @mon is using readline?  Note: not all HMP monitors use
- * readline, e.g., gdbserver has a non-interactive HMP monitor, so
- * readline is not used there.
+ * Is @mon is using readline?
+ * Note: not all HMP monitors use readline, e.g., gdbserver has a
+ * non-interactive HMP monitor, so readline is not used there.

  */
 static inline bool monitor_uses_readline(const Monitor *mon)
 {
  */
 static inline bool monitor_uses_readline(const Monitor *mon)
 {


@@ -314,14 +308,12 @@ static inline bool monitor_is_hmp_non_interactive(const Monitor *mon)
 
 /*
  * Return the clock to use for recording an event's time.
 
 /*
  * Return the clock to use for recording an event's time.

+ * It's QEMU_CLOCK_REALTIME, except for qtests it's
+ * QEMU_CLOCK_VIRTUAL, to support testing rate limits.

  * Beware: result is invalid before configure_accelerator().
  */
 static inline QEMUClockType monitor_get_event_clock(void)
 {
  * Beware: result is invalid before configure_accelerator().
  */
 static inline QEMUClockType monitor_get_event_clock(void)
 {

-    /*
-     * This allows us to perform tests on the monitor queues to verify
-     * that the rate limits are enforced.
-     */

     return qtest_enabled() ? QEMU_CLOCK_VIRTUAL : QEMU_CLOCK_REALTIME;
 }
 
     return qtest_enabled() ? QEMU_CLOCK_VIRTUAL : QEMU_CLOCK_REALTIME;
 }
 


@@ -360,10 +352,11 @@ static void qmp_request_free(QMPRequest *req)
 {
     qobject_unref(req->id);
     qobject_unref(req->req);
 {
     qobject_unref(req->id);
     qobject_unref(req->req);

+    error_free(req->err);

     g_free(req);
 }
 
     g_free(req);
 }
 

-/* Must with the mon->qmp.qmp_queue_lock held */
+/* Caller must hold mon->qmp.qmp_queue_lock */

 static void monitor_qmp_cleanup_req_queue_locked(Monitor *mon)
 {
     while (!g_queue_is_empty(mon->qmp.qmp_requests)) {
 static void monitor_qmp_cleanup_req_queue_locked(Monitor *mon)
 {
     while (!g_queue_is_empty(mon->qmp.qmp_requests)) {


@@ -371,19 +364,10 @@ static void monitor_qmp_cleanup_req_queue_locked(Monitor *mon)
     }
 }
 
     }
 }
 

-/* Must with the mon->qmp.qmp_queue_lock held */
-static void monitor_qmp_cleanup_resp_queue_locked(Monitor *mon)
-{
-    while (!g_queue_is_empty(mon->qmp.qmp_responses)) {
-        qobject_unref((QObject *)g_queue_pop_head(mon->qmp.qmp_responses));
-    }
-}
-

 static void monitor_qmp_cleanup_queues(Monitor *mon)
 {
     qemu_mutex_lock(&mon->qmp.qmp_queue_lock);
     monitor_qmp_cleanup_req_queue_locked(mon);
 static void monitor_qmp_cleanup_queues(Monitor *mon)
 {
     qemu_mutex_lock(&mon->qmp.qmp_queue_lock);
     monitor_qmp_cleanup_req_queue_locked(mon);

-    monitor_qmp_cleanup_resp_queue_locked(mon);

     qemu_mutex_unlock(&mon->qmp.qmp_queue_lock);
 }
 
     qemu_mutex_unlock(&mon->qmp.qmp_queue_lock);
 }
 


@@ -402,7 +386,7 @@ static gboolean monitor_unblocked(GIOChannel *chan, GIOCondition cond,
     return FALSE;
 }
 
     return FALSE;
 }
 

-/* Called with mon->mon_lock held.  */
+/* Caller must hold mon->mon_lock */

 static void monitor_flush_locked(Monitor *mon)
 {
     int rc;
 static void monitor_flush_locked(Monitor *mon)
 {
     int rc;


@@ -499,9 +483,9 @@ int monitor_fprintf(FILE *stream, const char *fmt, ...)
     return 0;
 }
 
     return 0;
 }
 

-static void monitor_json_emitter_raw(Monitor *mon,
-                                     QObject *data)
+static void qmp_send_response(Monitor *mon, const QDict *rsp)

 {
 {

+    const QObject *data = QOBJECT(rsp);

     QString *json;
 
     json = mon->flags & MONITOR_USE_PRETTY ? qobject_to_json_pretty(data) :
     QString *json;
 
     json = mon->flags & MONITOR_USE_PRETTY ? qobject_to_json_pretty(data) :


@@ -514,87 +498,6 @@ static void monitor_json_emitter_raw(Monitor *mon,
     qobject_unref(json);
 }
 
     qobject_unref(json);
 }
 

-static void monitor_json_emitter(Monitor *mon, QObject *data)
-{
-    if (mon->use_io_thr) {
-        /*
-         * If using IO thread, we need to queue the item so that IO
-         * thread will do the rest for us.  Take refcount so that
-         * caller won't free the data (which will be finally freed in
-         * responder thread).
-         */
-        qemu_mutex_lock(&mon->qmp.qmp_queue_lock);
-        g_queue_push_tail(mon->qmp.qmp_responses, qobject_ref(data));
-        qemu_mutex_unlock(&mon->qmp.qmp_queue_lock);
-        qemu_bh_schedule(mon_global.qmp_respond_bh);
-    } else {
-        /*
-         * If not using monitor IO thread, then we are in main thread.
-         * Do the emission right away.
-         */
-        monitor_json_emitter_raw(mon, data);
-    }
-}
-
-struct QMPResponse {
-    Monitor *mon;
-    QObject *data;
-};
-typedef struct QMPResponse QMPResponse;
-
-static QObject *monitor_qmp_response_pop_one(Monitor *mon)
-{
-    QObject *data;
-
-    qemu_mutex_lock(&mon->qmp.qmp_queue_lock);
-    data = g_queue_pop_head(mon->qmp.qmp_responses);
-    qemu_mutex_unlock(&mon->qmp.qmp_queue_lock);
-
-    return data;
-}
-
-static void monitor_qmp_response_flush(Monitor *mon)
-{
-    QObject *data;
-
-    while ((data = monitor_qmp_response_pop_one(mon))) {
-        monitor_json_emitter_raw(mon, data);
-        qobject_unref(data);
-    }
-}
-
-/*
- * Pop a QMPResponse from any monitor's response queue into @response.
- * Return false if all the queues are empty; else true.
- */
-static bool monitor_qmp_response_pop_any(QMPResponse *response)
-{
-    Monitor *mon;
-    QObject *data = NULL;
-
-    qemu_mutex_lock(&monitor_lock);
-    QTAILQ_FOREACH(mon, &mon_list, entry) {
-        data = monitor_qmp_response_pop_one(mon);
-        if (data) {
-            response->mon = mon;
-            response->data = data;
-            break;
-        }
-    }
-    qemu_mutex_unlock(&monitor_lock);
-    return data != NULL;
-}
-
-static void monitor_qmp_bh_responder(void *opaque)
-{
-    QMPResponse response;
-
-    while (monitor_qmp_response_pop_any(&response)) {
-        monitor_json_emitter_raw(response.mon, response.data);
-        qobject_unref(response.data);
-    }
-}
-

 static MonitorQAPIEventConf monitor_qapi_event_conf[QAPI_EVENT__MAX] = {
     /* Limit guest-triggerable events to 1 per second */
     [QAPI_EVENT_RTC_CHANGE]        = { 1000 * SCALE_MS },
 static MonitorQAPIEventConf monitor_qapi_event_conf[QAPI_EVENT__MAX] = {
     /* Limit guest-triggerable events to 1 per second */
     [QAPI_EVENT_RTC_CHANGE]        = { 1000 * SCALE_MS },


@@ -606,8 +509,9 @@ static MonitorQAPIEventConf monitor_qapi_event_conf[QAPI_EVENT__MAX] = {
 };
 
 /*
 };
 
 /*

- * Emits the event to every monitor instance, @event is only used for trace
- * Called with monitor_lock held.
+ * Broadcast an event to all monitors.
+ * @qdict is the event object.  Its member "event" must match @event.
+ * Caller must hold monitor_lock.

  */
 static void monitor_qapi_event_emit(QAPIEvent event, QDict *qdict)
 {
  */
 static void monitor_qapi_event_emit(QAPIEvent event, QDict *qdict)
 {


@@ -617,7 +521,7 @@ static void monitor_qapi_event_emit(QAPIEvent event, QDict *qdict)
     QTAILQ_FOREACH(mon, &mon_list, entry) {
         if (monitor_is_qmp(mon)
             && mon->qmp.commands != &qmp_cap_negotiation_commands) {
     QTAILQ_FOREACH(mon, &mon_list, entry) {
         if (monitor_is_qmp(mon)
             && mon->qmp.commands != &qmp_cap_negotiation_commands) {

-            monitor_json_emitter(mon, QOBJECT(qdict));
+            qmp_send_response(mon, qdict);

         }
     }
 }
         }
     }
 }


@@ -629,7 +533,7 @@ static void monitor_qapi_event_handler(void *opaque);
  * applying any rate limiting if required.
  */
 static void
  * applying any rate limiting if required.
  */
 static void

-monitor_qapi_event_queue(QAPIEvent event, QDict *qdict, Error **errp)
+monitor_qapi_event_queue_no_reenter(QAPIEvent event, QDict *qdict)

 {
     MonitorQAPIEventConf *evconf;
     MonitorQAPIEventState *evstate;
 {
     MonitorQAPIEventConf *evconf;
     MonitorQAPIEventState *evstate;


@@ -684,6 +588,48 @@ monitor_qapi_event_queue(QAPIEvent event, QDict *qdict, Error **errp)
     qemu_mutex_unlock(&monitor_lock);
 }
 
     qemu_mutex_unlock(&monitor_lock);
 }
 

+static void
+monitor_qapi_event_queue(QAPIEvent event, QDict *qdict, Error **errp)
+{
+    /*
+     * monitor_qapi_event_queue_no_reenter() is not reentrant: it
+     * would deadlock on monitor_lock.  Work around by queueing
+     * events in thread-local storage.
+     * TODO: remove this, make it re-enter safe.
+     */
+    typedef struct MonitorQapiEvent {
+        QAPIEvent event;
+        QDict *qdict;
+        QSIMPLEQ_ENTRY(MonitorQapiEvent) entry;
+    } MonitorQapiEvent;
+    static __thread QSIMPLEQ_HEAD(, MonitorQapiEvent) event_queue;
+    static __thread bool reentered;
+    MonitorQapiEvent *ev;
+
+    if (!reentered) {
+        QSIMPLEQ_INIT(&event_queue);
+    }
+
+    ev = g_new(MonitorQapiEvent, 1);
+    ev->qdict = qobject_ref(qdict);
+    ev->event = event;
+    QSIMPLEQ_INSERT_TAIL(&event_queue, ev, entry);
+    if (reentered) {
+        return;
+    }
+
+    reentered = true;
+
+    while ((ev = QSIMPLEQ_FIRST(&event_queue)) != NULL) {
+        QSIMPLEQ_REMOVE_HEAD(&event_queue, entry);
+        monitor_qapi_event_queue_no_reenter(ev->event, ev->qdict);
+        qobject_unref(ev->qdict);
+        g_free(ev);
+    }
+
+    reentered = false;
+}
+

 /*
  * This function runs evconf->rate ns after sending a throttled
  * event.
 /*
  * This function runs evconf->rate ns after sending a throttled
  * event.


@@ -762,7 +708,7 @@ static void monitor_qapi_event_init(void)
 static void handle_hmp_command(Monitor *mon, const char *cmdline);
 
 static void monitor_data_init(Monitor *mon, bool skip_flush,
 static void handle_hmp_command(Monitor *mon, const char *cmdline);
 
 static void monitor_data_init(Monitor *mon, bool skip_flush,

-                              bool use_io_thr)
+                              bool use_io_thread)

 {
     memset(mon, 0, sizeof(Monitor));
     qemu_mutex_init(&mon->mon_lock);
 {
     memset(mon, 0, sizeof(Monitor));
     qemu_mutex_init(&mon->mon_lock);


@@ -771,9 +717,8 @@ static void monitor_data_init(Monitor *mon, bool skip_flush,
     /* Use *mon_cmds by default. */
     mon->cmd_table = mon_cmds;
     mon->skip_flush = skip_flush;
     /* Use *mon_cmds by default. */
     mon->cmd_table = mon_cmds;
     mon->skip_flush = skip_flush;

-    mon->use_io_thr = use_io_thr;
+    mon->use_io_thread = use_io_thread;

     mon->qmp.qmp_requests = g_queue_new();
     mon->qmp.qmp_requests = g_queue_new();

-    mon->qmp.qmp_responses = g_queue_new();

 }
 
 static void monitor_data_destroy(Monitor *mon)
 }
 
 static void monitor_data_destroy(Monitor *mon)


@@ -788,9 +733,7 @@ static void monitor_data_destroy(Monitor *mon)
     qemu_mutex_destroy(&mon->mon_lock);
     qemu_mutex_destroy(&mon->qmp.qmp_queue_lock);
     monitor_qmp_cleanup_req_queue_locked(mon);
     qemu_mutex_destroy(&mon->mon_lock);
     qemu_mutex_destroy(&mon->qmp.qmp_queue_lock);
     monitor_qmp_cleanup_req_queue_locked(mon);

-    monitor_qmp_cleanup_resp_queue_locked(mon);

     g_queue_free(mon->qmp.qmp_requests);
     g_queue_free(mon->qmp.qmp_requests);

-    g_queue_free(mon->qmp.qmp_responses);

 }
 
 char *qmp_human_monitor_command(const char *command_line, bool has_cpu_index,
 }
 
 char *qmp_human_monitor_command(const char *command_line, bool has_cpu_index,


@@ -976,8 +919,7 @@ static int parse_cmdline(const char *cmdline,
 }
 
 /*
 }
 
 /*

- * Returns true if the command can be executed in preconfig mode
- * i.e. it has the 'p' flag.
+ * Can command @cmd be executed in preconfig state?

  */
 static bool cmd_can_preconfig(const mon_cmd_t *cmd)
 {
  */
 static bool cmd_can_preconfig(const mon_cmd_t *cmd)
 {


@@ -1191,9 +1133,6 @@ static void qmp_query_qmp_schema(QDict *qdict, QObject **ret_data,
  */
 static void qmp_unregister_commands_hack(void)
 {
  */
 static void qmp_unregister_commands_hack(void)
 {

-#ifndef CONFIG_SPICE
-    qmp_unregister_command(&qmp_commands, "query-spice");
-#endif

 #ifndef CONFIG_REPLICATION
     qmp_unregister_command(&qmp_commands, "xen-set-replication");
     qmp_unregister_command(&qmp_commands, "query-xen-replication-status");
 #ifndef CONFIG_REPLICATION
     qmp_unregister_command(&qmp_commands, "xen-set-replication");
     qmp_unregister_command(&qmp_commands, "query-xen-replication-status");


@@ -1249,96 +1188,56 @@ static void monitor_init_qmp_commands(void)
                          qmp_marshal_qmp_capabilities, QCO_ALLOW_PRECONFIG);
 }
 
                          qmp_marshal_qmp_capabilities, QCO_ALLOW_PRECONFIG);
 }
 

-static bool qmp_cap_enabled(Monitor *mon, QMPCapability cap)
-{
-    return mon->qmp.qmp_caps[cap];
-}
-

 static bool qmp_oob_enabled(Monitor *mon)
 {
 static bool qmp_oob_enabled(Monitor *mon)
 {

-    return qmp_cap_enabled(mon, QMP_CAPABILITY_OOB);
-}
-
-static void qmp_caps_check(Monitor *mon, QMPCapabilityList *list,
-                           Error **errp)
-{
-    for (; list; list = list->next) {
-        assert(list->value < QMP_CAPABILITY__MAX);
-        switch (list->value) {
-        case QMP_CAPABILITY_OOB:
-            if (!mon->use_io_thr) {
-                /*
-                 * Out-Of-Band only works with monitors that are
-                 * running on dedicated IOThread.
-                 */
-                error_setg(errp, "This monitor does not support "
-                           "Out-Of-Band (OOB)");
-                return;
-            }
-            break;
-        default:
-            break;
-        }
-    }
+    return mon->qmp.capab[QMP_CAPABILITY_OOB];

 }
 
 }
 

-/* This function should only be called after capabilities are checked. */
-static void qmp_caps_apply(Monitor *mon, QMPCapabilityList *list)
+static void monitor_qmp_caps_reset(Monitor *mon)

 {
 {

-    for (; list; list = list->next) {
-        mon->qmp.qmp_caps[list->value] = true;
-    }
+    memset(mon->qmp.capab_offered, 0, sizeof(mon->qmp.capab_offered));
+    memset(mon->qmp.capab, 0, sizeof(mon->qmp.capab));
+    mon->qmp.capab_offered[QMP_CAPABILITY_OOB] = mon->use_io_thread;

 }
 
 /*
 }
 
 /*

- * Return true if check successful, or false otherwise.  When false is
- * returned, detailed error will be in errp if provided.
+ * Accept QMP capabilities in @list for @mon.
+ * On success, set mon->qmp.capab[], and return true.
+ * On error, set @errp, and return false.

  */
  */

-static bool qmp_cmd_oob_check(Monitor *mon, QDict *req, Error **errp)
+static bool qmp_caps_accept(Monitor *mon, QMPCapabilityList *list,
+                            Error **errp)

 {
 {

-    const char *command;
-    QmpCommand *cmd;
+    GString *unavailable = NULL;
+    bool capab[QMP_CAPABILITY__MAX];

 
 

-    command = qdict_get_try_str(req, "execute");
-    if (!command) {
-        error_setg(errp, "Command field 'execute' missing");
-        return false;
-    }
+    memset(capab, 0, sizeof(capab));

 
 

-    cmd = qmp_find_command(mon->qmp.commands, command);
-    if (!cmd) {
-        if (mon->qmp.commands == &qmp_cap_negotiation_commands) {
-            error_set(errp, ERROR_CLASS_COMMAND_NOT_FOUND,
-                      "Expecting capabilities negotiation "
-                      "with 'qmp_capabilities'");
-        } else {
-            error_set(errp, ERROR_CLASS_COMMAND_NOT_FOUND,
-                      "The command %s has not been found", command);
+    for (; list; list = list->next) {
+        if (!mon->qmp.capab_offered[list->value]) {
+            if (!unavailable) {
+                unavailable = g_string_new(QMPCapability_str(list->value));
+            } else {
+                g_string_append_printf(unavailable, ", %s",
+                                      QMPCapability_str(list->value));
+            }

         }
         }

-        return false;
+        capab[list->value] = true;

     }
 
     }
 

-    if (qmp_is_oob(req)) {
-        if (!qmp_oob_enabled(mon)) {
-            error_setg(errp, "Please enable Out-Of-Band first "
-                       "for the session during capabilities negotiation");
-            return false;
-        }
-        if (!(cmd->options & QCO_ALLOW_OOB)) {
-            error_setg(errp, "The command %s does not support OOB",
-                       command);
-            return false;
-        }
+    if (unavailable) {
+        error_setg(errp, "Capability %s not available", unavailable->str);
+        g_string_free(unavailable, true);
+        return false;

     }
 
     }
 

+    memcpy(mon->qmp.capab, capab, sizeof(capab));

     return true;
 }
 
 void qmp_qmp_capabilities(bool has_enable, QMPCapabilityList *enable,
                           Error **errp)
 {
     return true;
 }
 
 void qmp_qmp_capabilities(bool has_enable, QMPCapabilityList *enable,
                           Error **errp)
 {

-    Error *local_err = NULL;
-

     if (cur_mon->qmp.commands == &qmp_commands) {
         error_set(errp, ERROR_CLASS_COMMAND_NOT_FOUND,
                   "Capabilities negotiation is already complete, command "
     if (cur_mon->qmp.commands == &qmp_commands) {
         error_set(errp, ERROR_CLASS_COMMAND_NOT_FOUND,
                   "Capabilities negotiation is already complete, command "


@@ -1346,19 +1245,8 @@ void qmp_qmp_capabilities(bool has_enable, QMPCapabilityList *enable,
         return;
     }
 
         return;
     }
 

-    /* Enable QMP capabilities provided by the client if applicable. */
-    if (has_enable) {
-        qmp_caps_check(cur_mon, enable, &local_err);
-        if (local_err) {
-            /*
-             * Failed check on any of the capabilities will fail the
-             * entire command (and thus not apply any of the other
-             * capabilities that were also requested).
-             */
-            error_propagate(errp, local_err);
-            return;
-        }
-        qmp_caps_apply(cur_mon, enable);
+    if (!qmp_caps_accept(cur_mon, enable, errp)) {
+        return;

     }
 
     cur_mon->qmp.commands = &qmp_commands;
     }
 
     cur_mon->qmp.commands = &qmp_commands;


@@ -1463,6 +1351,17 @@ static void hmp_info_opcount(Monitor *mon, const QDict *qdict)
 }
 #endif
 
 }
 #endif
 

+static void hmp_info_sync_profile(Monitor *mon, const QDict *qdict)
+{
+    int64_t max = qdict_get_try_int(qdict, "max", 10);
+    bool mean = qdict_get_try_bool(qdict, "mean", false);
+    bool coalesce = !qdict_get_try_bool(qdict, "no_coalesce", false);
+    enum QSPSortBy sort_by;
+
+    sort_by = mean ? QSP_SORT_BY_AVG_WAIT_TIME : QSP_SORT_BY_TOTAL_WAIT_TIME;
+    qsp_report((FILE *)mon, monitor_fprintf, max, sort_by, coalesce);
+}
+

 static void hmp_info_history(Monitor *mon, const QDict *qdict)
 {
     int i;
 static void hmp_info_history(Monitor *mon, const QDict *qdict)
 {
     int i;


@@ -2267,7 +2166,7 @@ void qmp_getfd(const char *fdname, Error **errp)
         tmp_fd = monfd->fd;
         monfd->fd = fd;
         qemu_mutex_unlock(&cur_mon->mon_lock);
         tmp_fd = monfd->fd;
         monfd->fd = fd;
         qemu_mutex_unlock(&cur_mon->mon_lock);

-        /* Make sure close() is out of critical section */
+        /* Make sure close() is outside critical section */

         close(tmp_fd);
         return;
     }
         close(tmp_fd);
         return;
     }


@@ -2296,7 +2195,7 @@ void qmp_closefd(const char *fdname, Error **errp)
         g_free(monfd->name);
         g_free(monfd);
         qemu_mutex_unlock(&cur_mon->mon_lock);
         g_free(monfd->name);
         g_free(monfd);
         qemu_mutex_unlock(&cur_mon->mon_lock);

-        /* Make sure close() is out of critical section */
+        /* Make sure close() is outside critical section */

         close(tmp_fd);
         return;
     }
         close(tmp_fd);
         return;
     }


@@ -4140,78 +4039,53 @@ static int monitor_can_read(void *opaque)
 }
 
 /*
 }
 
 /*

- * 1. This function takes ownership of rsp, err, and id.
- * 2. rsp, err, and id may be NULL.
- * 3. If err != NULL then rsp must be NULL.
+ * Emit QMP response @rsp with ID @id to @mon.
+ * Null @rsp can only happen for commands with QCO_NO_SUCCESS_RESP.
+ * Nothing is emitted then.

  */
  */

-static void monitor_qmp_respond(Monitor *mon, QObject *rsp,
-                                Error *err, QObject *id)
+static void monitor_qmp_respond(Monitor *mon, QDict *rsp, QObject *id)

 {
 {

-    QDict *qdict = NULL;
-
-    if (err) {
-        assert(!rsp);
-        qdict = qdict_new();
-        qdict_put_obj(qdict, "error", qmp_build_error_object(err));
-        error_free(err);
-        rsp = QOBJECT(qdict);
-    }
-

     if (rsp) {
         if (id) {
     if (rsp) {
         if (id) {

-            qdict_put_obj(qobject_to(QDict, rsp), "id", qobject_ref(id));
+            qdict_put_obj(rsp, "id", qobject_ref(id));

         }
 
         }
 

-        monitor_json_emitter(mon, rsp);
+        qmp_send_response(mon, rsp);

     }
     }

-
-    qobject_unref(id);
-    qobject_unref(rsp);

 }
 
 }
 

-/*
- * Dispatch one single QMP request. The function will free the req_obj
- * and objects inside it before return.
- */
-static void monitor_qmp_dispatch_one(QMPRequest *req_obj)
+static void monitor_qmp_dispatch(Monitor *mon, QObject *req, QObject *id)

 {
 {

-    Monitor *mon, *old_mon;
-    QObject *req, *rsp = NULL, *id;
-    bool need_resume;
-
-    req = req_obj->req;
-    mon = req_obj->mon;
-    id = req_obj->id;
-    need_resume = req_obj->need_resume;
-
-    g_free(req_obj);
-
-    if (trace_event_get_state_backends(TRACE_HANDLE_QMP_COMMAND)) {
-        QString *req_json = qobject_to_json(req);
-        trace_handle_qmp_command(mon, qstring_get_str(req_json));
-        qobject_unref(req_json);
-    }
+    Monitor *old_mon;
+    QDict *rsp;
+    QDict *error;

 
     old_mon = cur_mon;
     cur_mon = mon;
 
 
     old_mon = cur_mon;
     cur_mon = mon;
 

-    rsp = qmp_dispatch(mon->qmp.commands, req);
+    rsp = qmp_dispatch(mon->qmp.commands, req, qmp_oob_enabled(mon));

 
     cur_mon = old_mon;
 
 
     cur_mon = old_mon;
 

-    /* Respond if necessary */
-    monitor_qmp_respond(mon, rsp, NULL, id);
-
-    /* This pairs with the monitor_suspend() in handle_qmp_command(). */
-    if (need_resume) {
-        monitor_resume(mon);
+    if (mon->qmp.commands == &qmp_cap_negotiation_commands) {
+        error = qdict_get_qdict(rsp, "error");
+        if (error
+            && !g_strcmp0(qdict_get_try_str(error, "class"),
+                    QapiErrorClass_str(ERROR_CLASS_COMMAND_NOT_FOUND))) {
+            /* Provide a more useful error message */
+            qdict_del(error, "desc");
+            qdict_put_str(error, "desc", "Expecting capabilities negotiation"
+                          " with 'qmp_capabilities'");
+        }

     }
 
     }
 

-    qobject_unref(req);
+    monitor_qmp_respond(mon, rsp, id);
+    qobject_unref(rsp);

 }
 
 /*
 }
 
 /*

- * Pop one QMP request from monitor queues, return NULL if not found.
+ * Pop a QMP request from a monitor request queue.
+ * Return the request, or NULL all request queues are empty.

  * We are using round-robin fashion to pop the request, to avoid
  * processing commands only on a very busy monitor.  To achieve that,
  * when we process one request on a specific monitor, we put that
  * We are using round-robin fashion to pop the request, to avoid
  * processing commands only on a very busy monitor.  To achieve that,
  * when we process one request on a specific monitor, we put that


@@ -4250,70 +4124,74 @@ static QMPRequest *monitor_qmp_requests_pop_any(void)
 static void monitor_qmp_bh_dispatcher(void *data)
 {
     QMPRequest *req_obj = monitor_qmp_requests_pop_any();
 static void monitor_qmp_bh_dispatcher(void *data)
 {
     QMPRequest *req_obj = monitor_qmp_requests_pop_any();

+    QDict *rsp;
+    bool need_resume;

 
 

-    if (req_obj) {
+    if (!req_obj) {
+        return;
+    }
+
+    /*  qmp_oob_enabled() might change after "qmp_capabilities" */
+    need_resume = !qmp_oob_enabled(req_obj->mon);
+    if (req_obj->req) {

         trace_monitor_qmp_cmd_in_band(qobject_get_try_str(req_obj->id) ?: "");
         trace_monitor_qmp_cmd_in_band(qobject_get_try_str(req_obj->id) ?: "");

-        monitor_qmp_dispatch_one(req_obj);
-        /* Reschedule instead of looping so the main loop stays responsive */
-        qemu_bh_schedule(mon_global.qmp_dispatcher_bh);
+        monitor_qmp_dispatch(req_obj->mon, req_obj->req, req_obj->id);
+    } else {
+        assert(req_obj->err);
+        rsp = qmp_error_response(req_obj->err);
+        req_obj->err = NULL;
+        monitor_qmp_respond(req_obj->mon, rsp, NULL);
+        qobject_unref(rsp);
+    }
+
+    if (need_resume) {
+        /* Pairs with the monitor_suspend() in handle_qmp_command() */
+        monitor_resume(req_obj->mon);

     }
     }

+    qmp_request_free(req_obj);
+
+    /* Reschedule instead of looping so the main loop stays responsive */
+    qemu_bh_schedule(qmp_dispatcher_bh);

 }
 
 #define  QMP_REQ_QUEUE_LEN_MAX  (8)
 
 }
 
 #define  QMP_REQ_QUEUE_LEN_MAX  (8)
 

-static void handle_qmp_command(JSONMessageParser *parser, GQueue *tokens)
+static void handle_qmp_command(void *opaque, QObject *req, Error *err)

 {
 {

-    QObject *req, *id = NULL;
-    QDict *qdict = NULL;
-    MonitorQMP *mon_qmp = container_of(parser, MonitorQMP, parser);
-    Monitor *mon = container_of(mon_qmp, Monitor, qmp);
-    Error *err = NULL;
+    Monitor *mon = opaque;
+    QObject *id = NULL;
+    QDict *qdict;

     QMPRequest *req_obj;
 
     QMPRequest *req_obj;
 

-    req = json_parser_parse_err(tokens, NULL, &err);
-    if (!req && !err) {
-        /* json_parser_parse_err() sucks: can fail without setting @err */
-        error_setg(&err, QERR_JSON_PARSING);
-    }
-    if (err) {
-        goto err;
-    }
+    assert(!req != !err);

 
 

-    /* Check against the request in general layout */
-    qdict = qmp_dispatch_check_obj(req, &err);
-    if (!qdict) {
-        goto err;
-    }
+    qdict = qobject_to(QDict, req);
+    if (qdict) {
+        id = qobject_ref(qdict_get(qdict, "id"));
+        qdict_del(qdict, "id");
+    } /* else will fail qmp_dispatch() */

 
 

-    /* Check against OOB specific */
-    if (!qmp_cmd_oob_check(mon, qdict, &err)) {
-        goto err;
+    if (req && trace_event_get_state_backends(TRACE_HANDLE_QMP_COMMAND)) {
+        QString *req_json = qobject_to_json(req);
+        trace_handle_qmp_command(mon, qstring_get_str(req_json));
+        qobject_unref(req_json);

     }
 
     }
 

-    id = qdict_get(qdict, "id");
-
-    /* When OOB is enabled, the "id" field is mandatory. */
-    if (qmp_oob_enabled(mon) && !id) {
-        error_setg(&err, "Out-Of-Band capability requires that "
-                   "every command contains an 'id' field");
-        goto err;
+    if (qdict && qmp_is_oob(qdict)) {
+        /* OOB commands are executed immediately */
+        trace_monitor_qmp_cmd_out_of_band(qobject_get_try_str(id)
+                                          ?: "");
+        monitor_qmp_dispatch(mon, req, id);
+        qobject_unref(req);
+        qobject_unref(id);
+        return;

     }
 
     req_obj = g_new0(QMPRequest, 1);
     req_obj->mon = mon;
     }
 
     req_obj = g_new0(QMPRequest, 1);
     req_obj->mon = mon;

-    req_obj->id = qobject_ref(id);
+    req_obj->id = id;

     req_obj->req = req;
     req_obj->req = req;

-    req_obj->need_resume = false;
-
-    qdict_del(qdict, "id");
-
-    if (qmp_is_oob(qdict)) {
-        /* Out-Of-Band (OOB) requests are executed directly in parser. */
-        trace_monitor_qmp_cmd_out_of_band(qobject_get_try_str(req_obj->id)
-                                          ?: "");
-        monitor_qmp_dispatch_one(req_obj);
-        return;
-    }
+    req_obj->err = err;

 
     /* Protect qmp_requests and fetching its length. */
     qemu_mutex_lock(&mon->qmp.qmp_queue_lock);
 
     /* Protect qmp_requests and fetching its length. */
     qemu_mutex_lock(&mon->qmp.qmp_queue_lock);


@@ -4326,11 +4204,16 @@ static void handle_qmp_command(JSONMessageParser *parser, GQueue *tokens)
      */
     if (!qmp_oob_enabled(mon)) {
         monitor_suspend(mon);
      */
     if (!qmp_oob_enabled(mon)) {
         monitor_suspend(mon);

-        req_obj->need_resume = true;

     } else {
         /* Drop the request if queue is full. */
         if (mon->qmp.qmp_requests->length >= QMP_REQ_QUEUE_LEN_MAX) {
             qemu_mutex_unlock(&mon->qmp.qmp_queue_lock);
     } else {
         /* Drop the request if queue is full. */
         if (mon->qmp.qmp_requests->length >= QMP_REQ_QUEUE_LEN_MAX) {
             qemu_mutex_unlock(&mon->qmp.qmp_queue_lock);

+            /*
+             * FIXME @id's scope is just @mon, and broadcasting it is
+             * wrong.  If another monitor's client has a command with
+             * the same ID in flight, the event will incorrectly claim
+             * that command was dropped.
+             */

             qapi_event_send_command_dropped(id,
                                             COMMAND_DROP_REASON_QUEUE_FULL,
                                             &error_abort);
             qapi_event_send_command_dropped(id,
                                             COMMAND_DROP_REASON_QUEUE_FULL,
                                             &error_abort);


@@ -4348,12 +4231,7 @@ static void handle_qmp_command(JSONMessageParser *parser, GQueue *tokens)
     qemu_mutex_unlock(&mon->qmp.qmp_queue_lock);
 
     /* Kick the dispatcher routine */
     qemu_mutex_unlock(&mon->qmp.qmp_queue_lock);
 
     /* Kick the dispatcher routine */

-    qemu_bh_schedule(mon_global.qmp_dispatcher_bh);
-    return;
-
-err:
-    monitor_qmp_respond(mon, NULL, err, NULL);
-    qobject_unref(req);
+    qemu_bh_schedule(qmp_dispatcher_bh);

 }
 
 static void monitor_qmp_read(void *opaque, const uint8_t *buf, int size)
 }
 
 static void monitor_qmp_read(void *opaque, const uint8_t *buf, int size)


@@ -4403,10 +4281,10 @@ int monitor_suspend(Monitor *mon)
 
     if (monitor_is_qmp(mon)) {
         /*
 
     if (monitor_is_qmp(mon)) {
         /*

-         * Kick iothread to make sure this takes effect.  It'll be
+         * Kick I/O thread to make sure this takes effect.  It'll be

          * evaluated again in prepare() of the watch object.
          */
          * evaluated again in prepare() of the watch object.
          */

-        aio_notify(iothread_get_aio_context(mon_global.mon_iothread));
+        aio_notify(iothread_get_aio_context(mon_iothread));

     }
 
     trace_monitor_suspend(mon, 1);
     }
 
     trace_monitor_suspend(mon, 1);


@@ -4422,21 +4300,22 @@ void monitor_resume(Monitor *mon)
     if (atomic_dec_fetch(&mon->suspend_cnt) == 0) {
         if (monitor_is_qmp(mon)) {
             /*
     if (atomic_dec_fetch(&mon->suspend_cnt) == 0) {
         if (monitor_is_qmp(mon)) {
             /*

-             * For QMP monitors that are running in IOThread, let's
-             * kick the thread in case it's sleeping.
+             * For QMP monitors that are running in the I/O thread,
+             * let's kick the thread in case it's sleeping.

              */
              */

-            if (mon->use_io_thr) {
-                aio_notify(iothread_get_aio_context(mon_global.mon_iothread));
+            if (mon->use_io_thread) {
+                aio_notify(iothread_get_aio_context(mon_iothread));

             }
         } else {
             assert(mon->rs);
             readline_show_prompt(mon->rs);
         }
             }
         } else {
             assert(mon->rs);
             readline_show_prompt(mon->rs);
         }

+        qemu_chr_fe_accept_input(&mon->chr);

     }
     trace_monitor_suspend(mon, -1);
 }
 
     }
     trace_monitor_suspend(mon, -1);
 }
 

-static QObject *get_qmp_greeting(Monitor *mon)
+static QDict *qmp_greeting(Monitor *mon)

 {
     QList *cap_list = qlist_new();
     QObject *ver = NULL;
 {
     QList *cap_list = qlist_new();
     QObject *ver = NULL;


@@ -4445,33 +4324,27 @@ static QObject *get_qmp_greeting(Monitor *mon)
     qmp_marshal_query_version(NULL, &ver, NULL);
 
     for (cap = 0; cap < QMP_CAPABILITY__MAX; cap++) {
     qmp_marshal_query_version(NULL, &ver, NULL);
 
     for (cap = 0; cap < QMP_CAPABILITY__MAX; cap++) {

-        if (!mon->use_io_thr && cap == QMP_CAPABILITY_OOB) {
-            /* Monitors that are not using IOThread won't support OOB */
-            continue;
+        if (mon->qmp.capab_offered[cap]) {
+            qlist_append_str(cap_list, QMPCapability_str(cap));

         }
         }

-        qlist_append_str(cap_list, QMPCapability_str(cap));

     }
 
     }
 

-    return qobject_from_jsonf("{'QMP': {'version': %p, 'capabilities': %p}}",
-                              ver, cap_list);
-}
-
-static void monitor_qmp_caps_reset(Monitor *mon)
-{
-    memset(mon->qmp.qmp_caps, 0, sizeof(mon->qmp.qmp_caps));
+    return qdict_from_jsonf_nofail(
+        "{'QMP': {'version': %p, 'capabilities': %p}}",
+        ver, cap_list);

 }
 
 static void monitor_qmp_event(void *opaque, int event)
 {
 }
 
 static void monitor_qmp_event(void *opaque, int event)
 {

-    QObject *data;
+    QDict *data;

     Monitor *mon = opaque;
 
     switch (event) {
     case CHR_EVENT_OPENED:
         mon->qmp.commands = &qmp_cap_negotiation_commands;
         monitor_qmp_caps_reset(mon);
     Monitor *mon = opaque;
 
     switch (event) {
     case CHR_EVENT_OPENED:
         mon->qmp.commands = &qmp_cap_negotiation_commands;
         monitor_qmp_caps_reset(mon);

-        data = get_qmp_greeting(mon);
-        monitor_json_emitter(mon, data);
+        data = qmp_greeting(mon);
+        qmp_send_response(mon, data);

         qobject_unref(data);
         mon_refcount++;
         break;
         qobject_unref(data);
         mon_refcount++;
         break;


@@ -4482,10 +4355,10 @@ static void monitor_qmp_event(void *opaque, int event)
          * stdio, it's possible that stdout is still open when stdin
          * is closed.
          */
          * stdio, it's possible that stdout is still open when stdin
          * is closed.
          */

-        monitor_qmp_response_flush(mon);

         monitor_qmp_cleanup_queues(mon);
         json_message_parser_destroy(&mon->qmp.parser);
         monitor_qmp_cleanup_queues(mon);
         json_message_parser_destroy(&mon->qmp.parser);

-        json_message_parser_init(&mon->qmp.parser, handle_qmp_command);
+        json_message_parser_init(&mon->qmp.parser, handle_qmp_command,
+                                 mon, NULL);

         mon_refcount--;
         monitor_fdsets_cleanup();
         break;
         mon_refcount--;
         monitor_fdsets_cleanup();
         break;


@@ -4564,36 +4437,26 @@ static void sortcmdlist(void)
 
 static GMainContext *monitor_get_io_context(void)
 {
 
 static GMainContext *monitor_get_io_context(void)
 {

-    return iothread_get_g_main_context(mon_global.mon_iothread);
+    return iothread_get_g_main_context(mon_iothread);

 }
 
 static AioContext *monitor_get_aio_context(void)
 {
 }
 
 static AioContext *monitor_get_aio_context(void)
 {

-    return iothread_get_aio_context(mon_global.mon_iothread);
+    return iothread_get_aio_context(mon_iothread);

 }
 
 static void monitor_iothread_init(void)
 {
 }
 
 static void monitor_iothread_init(void)
 {

-    mon_global.mon_iothread = iothread_create("mon_iothread",
-                                              &error_abort);
+    mon_iothread = iothread_create("mon_iothread", &error_abort);

 
     /*
 
     /*

-     * This MUST be on main loop thread since we have commands that
-     * have assumption to be run on main loop thread.  It would be
-     * nice that one day we can remove this assumption in the future.
+     * The dispatcher BH must run in the main loop thread, since we
+     * have commands assuming that context.  It would be nice to get
+     * rid of those assumptions.

      */
      */

-    mon_global.qmp_dispatcher_bh = aio_bh_new(iohandler_get_aio_context(),
-                                              monitor_qmp_bh_dispatcher,
-                                              NULL);
-
-    /*
-     * Unlike the dispatcher BH, this must be run on the monitor IO
-     * thread, so that monitors that are using IO thread will make
-     * sure read/write operations are all done on the IO thread.
-     */
-    mon_global.qmp_respond_bh = aio_bh_new(monitor_get_aio_context(),
-                                           monitor_qmp_bh_responder,
-                                           NULL);
+    qmp_dispatcher_bh = aio_bh_new(iohandler_get_aio_context(),
+                                   monitor_qmp_bh_dispatcher,
+                                   NULL);

 }
 
 void monitor_init_globals(void)
 }
 
 void monitor_init_globals(void)


@@ -4658,19 +4521,9 @@ static void monitor_qmp_setup_handlers_bh(void *opaque)
     Monitor *mon = opaque;
     GMainContext *context;
 
     Monitor *mon = opaque;
     GMainContext *context;
 

-    if (mon->use_io_thr) {
-        /*
-         * When use_io_thr is set, we use the global shared dedicated
-         * IO thread for this monitor to handle input/output.
-         */
-        context = monitor_get_io_context();
-        /* We should have inited globals before reaching here. */
-        assert(context);
-    } else {
-        /* The default main loop, which is the main thread */
-        context = NULL;
-    }
-
+    assert(mon->use_io_thread);
+    context = monitor_get_io_context();
+    assert(context);

     qemu_chr_fe_set_handlers(&mon->chr, monitor_can_read, monitor_qmp_read,
                              monitor_qmp_event, NULL, mon, context, true);
     monitor_list_append(mon);
     qemu_chr_fe_set_handlers(&mon->chr, monitor_can_read, monitor_qmp_read,
                              monitor_qmp_event, NULL, mon, context, true);
     monitor_list_append(mon);


@@ -4684,12 +4537,12 @@ void monitor_init(Chardev *chr, int flags)
 
     if (use_oob) {
         if (CHARDEV_IS_MUX(chr)) {
 
     if (use_oob) {
         if (CHARDEV_IS_MUX(chr)) {

-            error_report("Monitor Out-Of-Band is not supported with "
+            error_report("Monitor out-of-band is not supported with "

                          "MUX typed chardev backend");
             exit(1);
         }
         if (use_readline) {
                          "MUX typed chardev backend");
             exit(1);
         }
         if (use_readline) {

-            error_report("Monitor Out-Of-band is only supported by QMP");
+            error_report("Monitor out-of-band is only supported by QMP");

             exit(1);
         }
     }
             exit(1);
         }
     }


@@ -4708,8 +4561,9 @@ void monitor_init(Chardev *chr, int flags)
 
     if (monitor_is_qmp(mon)) {
         qemu_chr_fe_set_echo(&mon->chr, true);
 
     if (monitor_is_qmp(mon)) {
         qemu_chr_fe_set_echo(&mon->chr, true);

-        json_message_parser_init(&mon->qmp.parser, handle_qmp_command);
-        if (mon->use_io_thr) {
+        json_message_parser_init(&mon->qmp.parser, handle_qmp_command,
+                                 mon, NULL);
+        if (mon->use_io_thread) {

             /*
              * Make sure the old iowatch is gone.  It's possible when
              * e.g. the chardev is in client mode, with wait=on.
             /*
              * Make sure the old iowatch is gone.  It's possible when
              * e.g. the chardev is in client mode, with wait=on.


@@ -4717,15 +4571,12 @@ void monitor_init(Chardev *chr, int flags)
             remove_fd_in_watch(chr);
             /*
              * We can't call qemu_chr_fe_set_handlers() directly here
             remove_fd_in_watch(chr);
             /*
              * We can't call qemu_chr_fe_set_handlers() directly here

-             * since during the procedure the chardev will be active
-             * and running in monitor iothread, while we'll still do
-             * something before returning from it, which is a possible
-             * race too.  To avoid that, we just create a BH to setup
-             * the handlers.
+             * since chardev might be running in the monitor I/O
+             * thread.  Schedule a bottom half.

              */
             aio_bh_schedule_oneshot(monitor_get_aio_context(),
                                     monitor_qmp_setup_handlers_bh, mon);
              */
             aio_bh_schedule_oneshot(monitor_get_aio_context(),
                                     monitor_qmp_setup_handlers_bh, mon);

-            /* We'll add this to mon_list in the BH when setup done */
+            /* The bottom half will add @mon to @mon_list */

             return;
         } else {
             qemu_chr_fe_set_handlers(&mon->chr, monitor_can_read,
             return;
         } else {
             qemu_chr_fe_set_handlers(&mon->chr, monitor_can_read,


@@ -4745,22 +4596,14 @@ void monitor_cleanup(void)
     Monitor *mon, *next;
 
     /*
     Monitor *mon, *next;
 
     /*

-     * We need to explicitly stop the iothread (but not destroy it),
-     * cleanup the monitor resources, then destroy the iothread since
+     * We need to explicitly stop the I/O thread (but not destroy it),
+     * clean up the monitor resources, then destroy the I/O thread since

      * we need to unregister from chardev below in
      * monitor_data_destroy(), and chardev is not thread-safe yet
      */
      * we need to unregister from chardev below in
      * monitor_data_destroy(), and chardev is not thread-safe yet
      */

-    iothread_stop(mon_global.mon_iothread);
-
-    /*
-     * After we have IOThread to send responses, it's possible that
-     * when we stop the IOThread there are still replies queued in the
-     * responder queue.  Flush all of them.  Note that even after this
-     * flush it's still possible that out buffer is not flushed.
-     * It'll be done in below monitor_flush() as the last resort.
-     */
-    monitor_qmp_bh_responder(NULL);
+    iothread_stop(mon_iothread);

 
 

+    /* Flush output buffers and destroy monitors */

     qemu_mutex_lock(&monitor_lock);
     QTAILQ_FOREACH_SAFE(mon, &mon_list, entry, next) {
         QTAILQ_REMOVE(&mon_list, mon, entry);
     qemu_mutex_lock(&monitor_lock);
     QTAILQ_FOREACH_SAFE(mon, &mon_list, entry, next) {
         QTAILQ_REMOVE(&mon_list, mon, entry);


@@ -4770,14 +4613,12 @@ void monitor_cleanup(void)
     }
     qemu_mutex_unlock(&monitor_lock);
 
     }
     qemu_mutex_unlock(&monitor_lock);
 

-    /* QEMUBHs needs to be deleted before destroying the IOThread. */
-    qemu_bh_delete(mon_global.qmp_dispatcher_bh);
-    mon_global.qmp_dispatcher_bh = NULL;
-    qemu_bh_delete(mon_global.qmp_respond_bh);
-    mon_global.qmp_respond_bh = NULL;
+    /* QEMUBHs needs to be deleted before destroying the I/O thread */
+    qemu_bh_delete(qmp_dispatcher_bh);
+    qmp_dispatcher_bh = NULL;

 
 

-    iothread_destroy(mon_global.mon_iothread);
-    mon_global.mon_iothread = NULL;
+    iothread_destroy(mon_iothread);
+    mon_iothread = NULL;

 }
 
 QemuOptsList qemu_mon_opts = {
 }
 
 QemuOptsList qemu_mon_opts = {