Add an 'id' field to struct Monitor. The id field stores the monitor
identifier from MonitorOptions which was previously parsed but
discarded.

Auto-generate a unique id ("mon0", "mon1", ...) for QMP monitors
created via CLI without an explicit id, so that every QMP monitor is
addressable by monitor-remove and always appears with an id in
query-monitors output.

Extend monitor_init_qmp() to accept an id parameter so it is set
before the monitor is added to mon_list.

For iothread monitors, move monitor_list_append() from the setup BH to
the caller so monitor_find_by_id() can detect duplicates immediately.
Without this, two concurrent monitor-add calls could both pass the
duplicate check before either BH runs.  This means the monitor is now
visible in mon_list before its chardev handlers are set up, which was
not the case before.  This is safe because the request queue is still
empty (no chardev handlers means no monitor_qmp_read(), so the
dispatcher finds nothing to dispatch) and event broadcast is handled
below.

This requires initializing mon->commands = &qmp_cap_negotiation_commands
before monitor_list_append().  Without it, commands is NULL (from
g_new0) and monitor_qapi_event_emit() would not skip the monitor during
event broadcast -- its check is specifically for the
qmp_cap_negotiation_commands pointer, so a NULL falls through to
qmp_send_response() on an uninitialized monitor.  CHR_EVENT_OPENED sets
commands to the same value again later.

Add monitor_find_by_id() to look up monitors by identifier.  The lookup
takes monitor_lock to serialize with the I/O thread BH that modifies
mon_list, but releases it before returning.  The caller must hold the
BQL to ensure the returned pointer remains valid since only BQL holders
can destroy monitors.

Free the id string in monitor_data_destroy().

Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
 include/monitor/monitor.h  |  3 ++-
 monitor/monitor-internal.h |  4 +++-
 monitor/monitor.c          | 21 ++++++++++++++++++++-
 monitor/qmp.c              | 15 ++++++++++++---
 4 files changed, 37 insertions(+), 6 deletions(-)

diff --git a/include/monitor/monitor.h b/include/monitor/monitor.h
index 296690e1f1..a4e6aaa97f 100644
--- a/include/monitor/monitor.h
+++ b/include/monitor/monitor.h
@@ -19,7 +19,8 @@ bool monitor_cur_is_qmp(void);
 
 void monitor_init_globals(void);
 void monitor_init_globals_core(void);
-void monitor_init_qmp(Chardev *chr, bool pretty, Error **errp);
+void monitor_init_qmp(Chardev *chr, bool pretty, const char *id,
+                      Error **errp);
 void monitor_init_hmp(Chardev *chr, bool use_readline, Error **errp);
 int monitor_init(MonitorOptions *opts, bool allow_hmp, Error **errp);
 int monitor_init_opts(QemuOpts *opts, Error **errp);
diff --git a/monitor/monitor-internal.h b/monitor/monitor-internal.h
index feca111ae3..24d3b1900e 100644
--- a/monitor/monitor-internal.h
+++ b/monitor/monitor-internal.h
@@ -98,7 +98,7 @@ struct Monitor {
     bool is_qmp;
     bool skip_flush;
     bool use_io_thread;
-
+    char *id;
     char *mon_cpu_path;
     QTAILQ_ENTRY(Monitor) entry;
 
@@ -181,6 +181,8 @@ void monitor_data_destroy_qmp(MonitorQMP *mon);
 void coroutine_fn monitor_qmp_dispatcher_co(void *data);
 void qmp_dispatcher_co_wake(void);
 
+Monitor *monitor_find_by_id(const char *id);
+
 int get_monitor_def(Monitor *mon, int64_t *pval, const char *name);
 void handle_hmp_command(MonitorHMP *mon, const char *cmdline);
 int hmp_compare_cmd(const char *name, const char *list);
diff --git a/monitor/monitor.c b/monitor/monitor.c
index 00b93ed612..10a32150e9 100644
--- a/monitor/monitor.c
+++ b/monitor/monitor.c
@@ -622,6 +622,7 @@ void monitor_data_init(Monitor *mon, bool is_qmp, bool skip_flush,
 
 void monitor_data_destroy(Monitor *mon)
 {
+    g_free(mon->id);
     g_free(mon->mon_cpu_path);
     qemu_chr_fe_deinit(&mon->chr, false);
     if (monitor_is_qmp(mon)) {
@@ -633,6 +634,24 @@ void monitor_data_destroy(Monitor *mon)
     qemu_mutex_destroy(&mon->mon_lock);
 }
 
+/*
+ * Look up a monitor by its id.  The monitor_lock is released before
+ * returning, so the caller must hold the BQL to ensure the returned
+ * pointer remains valid (only BQL holders can destroy monitors).
+ */
+Monitor *monitor_find_by_id(const char *id)
+{
+    Monitor *mon;
+
+    QEMU_LOCK_GUARD(&monitor_lock);
+    QTAILQ_FOREACH(mon, &mon_list, entry) {
+        if (mon->id && strcmp(mon->id, id) == 0) {
+            return mon;
+        }
+    }
+    return NULL;
+}
+
 void monitor_cleanup(void)
 {
     /*
@@ -732,7 +751,7 @@ int monitor_init(MonitorOptions *opts, bool allow_hmp, Error **errp)
 
     switch (opts->mode) {
     case MONITOR_MODE_CONTROL:
-        monitor_init_qmp(chr, opts->pretty, errp);
+        monitor_init_qmp(chr, opts->pretty, opts->id, errp);
         break;
     case MONITOR_MODE_READLINE:
         if (!allow_hmp) {
diff --git a/monitor/qmp.c b/monitor/qmp.c
index 687019811f..bba69a3a40 100644
--- a/monitor/qmp.c
+++ b/monitor/qmp.c
@@ -510,10 +510,10 @@ static void monitor_qmp_setup_handlers_bh(void *opaque)
     qemu_chr_fe_set_handlers(&mon->common.chr, monitor_can_read,
                              monitor_qmp_read, monitor_qmp_event,
                              NULL, &mon->common, context, true);
-    monitor_list_append(&mon->common);
 }
 
-void monitor_init_qmp(Chardev *chr, bool pretty, Error **errp)
+void monitor_init_qmp(Chardev *chr, bool pretty, const char *id,
+                      Error **errp)
 {
     MonitorQMP *mon = g_new0(MonitorQMP, 1);
 
@@ -527,12 +527,20 @@ void monitor_init_qmp(Chardev *chr, bool pretty, Error **errp)
     monitor_data_init(&mon->common, true, false,
                       qemu_chr_has_feature(chr, QEMU_CHAR_FEATURE_GCONTEXT));
 
+    if (id) {
+        mon->common.id = g_strdup(id);
+    } else {
+        static unsigned int qmp_monitor_id_counter;
+        mon->common.id = g_strdup_printf("mon%u", qmp_monitor_id_counter++);
+    }
     mon->pretty = pretty;
 
     qemu_mutex_init(&mon->qmp_queue_lock);
     mon->qmp_requests = g_queue_new();
 
     json_message_parser_init(&mon->parser, handle_qmp_command, mon, NULL);
+    /* Prevent event broadcast to an uninitialized monitor. */
+    mon->commands = &qmp_cap_negotiation_commands;
     if (mon->common.use_io_thread) {
         /*
          * Make sure the old iowatch is gone.  It's possible when
@@ -551,7 +559,8 @@ void monitor_init_qmp(Chardev *chr, bool pretty, Error **errp)
          */
         aio_bh_schedule_oneshot(iothread_get_aio_context(mon_iothread),
                                 monitor_qmp_setup_handlers_bh, mon);
-        /* The bottom half will add @mon to @mon_list */
+        /* Synchronous insert for immediate duplicate detection. */
+        monitor_list_append(&mon->common);
     } else {
         qemu_chr_fe_set_handlers(&mon->common.chr, monitor_can_read,
                                  monitor_qmp_read, monitor_qmp_event,

-- 
2.47.3