migration/savevm.c

   1 /*
   2  * QEMU System Emulator
   3  *
   4  * Copyright (c) 2003-2008 Fabrice Bellard
   5  * Copyright (c) 2009-2015 Red Hat Inc
   6  *
   7  * Authors:
   8  *  Juan Quintela <[email protected]>
   9  *
  10  * Permission is hereby granted, free of charge, to any person obtaining a copy
  11  * of this software and associated documentation files (the "Software"), to deal
  12  * in the Software without restriction, including without limitation the rights
  13  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  14  * copies of the Software, and to permit persons to whom the Software is
  15  * furnished to do so, subject to the following conditions:
  16  *
  17  * The above copyright notice and this permission notice shall be included in
  18  * all copies or substantial portions of the Software.
  19  *
  20  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  21  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  23  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  24  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  25  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  26  * THE SOFTWARE.
  27  */
  28
  29 #include "qemu/osdep.h"
  30 #include "cpu.h"
  31 #include "hw/boards.h"
  32 #include "hw/hw.h"
  33 #include "hw/qdev.h"
  34 #include "hw/xen/xen.h"
  35 #include "net/net.h"
  36 #include "monitor/monitor.h"
  37 #include "sysemu/sysemu.h"
  38 #include "qemu/timer.h"
  39 #include "audio/audio.h"
  40 #include "migration/migration.h"
  41 #include "migration/postcopy-ram.h"
  42 #include "qapi/qmp/qerror.h"
  43 #include "qemu/error-report.h"
  44 #include "qemu/sockets.h"
  45 #include "qemu/queue.h"
  46 #include "sysemu/cpus.h"
  47 #include "exec/memory.h"
  48 #include "qmp-commands.h"
  49 #include "trace.h"
  50 #include "qemu/bitops.h"
  51 #include "qemu/iov.h"
  52 #include "block/snapshot.h"
  53 #include "block/qapi.h"
  54 #include "qemu/cutils.h"
  55 #include "io/channel-buffer.h"
  56 #include "io/channel-file.h"
  57
  58 #ifndef ETH_P_RARP
  59 #define ETH_P_RARP 0x8035
  60 #endif
  61 #define ARP_HTYPE_ETH 0x0001
  62 #define ARP_PTYPE_IP 0x0800
  63 #define ARP_OP_REQUEST_REV 0x3
  64
  65 const unsigned int postcopy_ram_discard_version = 0;
  66
  67 static bool skip_section_footers;
  68
  69 static struct mig_cmd_args {
  70     ssize_t     len; /* -1 = variable */
  71     const char *name;
  72 } mig_cmd_args[] = {
  73     [MIG_CMD_INVALID]          = { .len = -1, .name = "INVALID" },
  74     [MIG_CMD_OPEN_RETURN_PATH] = { .len =  0, .name = "OPEN_RETURN_PATH" },
  75     [MIG_CMD_PING]             = { .len = sizeof(uint32_t), .name = "PING" },
  76     [MIG_CMD_POSTCOPY_ADVISE]  = { .len = 16, .name = "POSTCOPY_ADVISE" },
  77     [MIG_CMD_POSTCOPY_LISTEN]  = { .len =  0, .name = "POSTCOPY_LISTEN" },
  78     [MIG_CMD_POSTCOPY_RUN]     = { .len =  0, .name = "POSTCOPY_RUN" },
  79     [MIG_CMD_POSTCOPY_RAM_DISCARD] = {
  80                                    .len = -1, .name = "POSTCOPY_RAM_DISCARD" },
  81     [MIG_CMD_PACKAGED]         = { .len =  4, .name = "PACKAGED" },
  82     [MIG_CMD_MAX]              = { .len = -1, .name = "MAX" },
  83 };
  84
  85 static int announce_self_create(uint8_t *buf,
  86                                 uint8_t *mac_addr)
  87 {
  88     /* Ethernet header. */
  89     memset(buf, 0xff, 6);         /* destination MAC addr */
  90     memcpy(buf + 6, mac_addr, 6); /* source MAC addr */
  91     *(uint16_t *)(buf + 12) = htons(ETH_P_RARP); /* ethertype */
  92
  93     /* RARP header. */
  94     *(uint16_t *)(buf + 14) = htons(ARP_HTYPE_ETH); /* hardware addr space */
  95     *(uint16_t *)(buf + 16) = htons(ARP_PTYPE_IP); /* protocol addr space */
  96     *(buf + 18) = 6; /* hardware addr length (ethernet) */
  97     *(buf + 19) = 4; /* protocol addr length (IPv4) */
  98     *(uint16_t *)(buf + 20) = htons(ARP_OP_REQUEST_REV); /* opcode */
  99     memcpy(buf + 22, mac_addr, 6); /* source hw addr */
 100     memset(buf + 28, 0x00, 4);     /* source protocol addr */
 101     memcpy(buf + 32, mac_addr, 6); /* target hw addr */
 102     memset(buf + 38, 0x00, 4);     /* target protocol addr */
 103
 104     /* Padding to get up to 60 bytes (ethernet min packet size, minus FCS). */
 105     memset(buf + 42, 0x00, 18);
 106
 107     return 60; /* len (FCS will be added by hardware) */
 108 }
 109
 110 static void qemu_announce_self_iter(NICState *nic, void *opaque)
 111 {
 112     uint8_t buf[60];
 113     int len;
 114
 115     trace_qemu_announce_self_iter(qemu_ether_ntoa(&nic->conf->macaddr));
 116     len = announce_self_create(buf, nic->conf->macaddr.a);
 117
 118     qemu_send_packet_raw(qemu_get_queue(nic), buf, len);
 119 }
 120
 121
 122 static void qemu_announce_self_once(void *opaque)
 123 {
 124     static int count = SELF_ANNOUNCE_ROUNDS;
 125     QEMUTimer *timer = *(QEMUTimer **)opaque;
 126
 127     qemu_foreach_nic(qemu_announce_self_iter, NULL);
 128
 129     if (--count) {
 130         /* delay 50ms, 150ms, 250ms, ... */
 131         timer_mod(timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) +
 132                   self_announce_delay(count));
 133     } else {
 134             timer_del(timer);
 135             timer_free(timer);
 136     }
 137 }
 138
 139 void qemu_announce_self(void)
 140 {
 141     static QEMUTimer *timer;
 142     timer = timer_new_ms(QEMU_CLOCK_REALTIME, qemu_announce_self_once, &timer);
 143     qemu_announce_self_once(&timer);
 144 }
 145
 146 /***********************************************************/
 147 /* savevm/loadvm support */
 148
 149 static ssize_t block_writev_buffer(void *opaque, struct iovec *iov, int iovcnt,
 150                                    int64_t pos)
 151 {
 152     int ret;
 153     QEMUIOVector qiov;
 154
 155     qemu_iovec_init_external(&qiov, iov, iovcnt);
 156     ret = bdrv_writev_vmstate(opaque, &qiov, pos);
 157     if (ret < 0) {
 158         return ret;
 159     }
 160
 161     return qiov.size;
 162 }
 163
 164 static ssize_t block_get_buffer(void *opaque, uint8_t *buf, int64_t pos,
 165                                 size_t size)
 166 {
 167     return bdrv_load_vmstate(opaque, buf, pos, size);
 168 }
 169
 170 static int bdrv_fclose(void *opaque)
 171 {
 172     return bdrv_flush(opaque);
 173 }
 174
 175 static const QEMUFileOps bdrv_read_ops = {
 176     .get_buffer = block_get_buffer,
 177     .close =      bdrv_fclose
 178 };
 179
 180 static const QEMUFileOps bdrv_write_ops = {
 181     .writev_buffer  = block_writev_buffer,
 182     .close          = bdrv_fclose
 183 };
 184
 185 static QEMUFile *qemu_fopen_bdrv(BlockDriverState *bs, int is_writable)
 186 {
 187     if (is_writable) {
 188         return qemu_fopen_ops(bs, &bdrv_write_ops);
 189     }
 190     return qemu_fopen_ops(bs, &bdrv_read_ops);
 191 }
 192
 193
 194 /* QEMUFile timer support.
 195  * Not in qemu-file.c to not add qemu-timer.c as dependency to qemu-file.c
 196  */
 197
 198 void timer_put(QEMUFile *f, QEMUTimer *ts)
 199 {
 200     uint64_t expire_time;
 201
 202     expire_time = timer_expire_time_ns(ts);
 203     qemu_put_be64(f, expire_time);
 204 }
 205
 206 void timer_get(QEMUFile *f, QEMUTimer *ts)
 207 {
 208     uint64_t expire_time;
 209
 210     expire_time = qemu_get_be64(f);
 211     if (expire_time != -1) {
 212         timer_mod_ns(ts, expire_time);
 213     } else {
 214         timer_del(ts);
 215     }
 216 }
 217
 218
 219 /* VMState timer support.
 220  * Not in vmstate.c to not add qemu-timer.c as dependency to vmstate.c
 221  */
 222
 223 static int get_timer(QEMUFile *f, void *pv, size_t size, VMStateField *field)
 224 {
 225     QEMUTimer *v = pv;
 226     timer_get(f, v);
 227     return 0;
 228 }
 229
 230 static int put_timer(QEMUFile *f, void *pv, size_t size, VMStateField *field,
 231                      QJSON *vmdesc)
 232 {
 233     QEMUTimer *v = pv;
 234     timer_put(f, v);
 235
 236     return 0;
 237 }
 238
 239 const VMStateInfo vmstate_info_timer = {
 240     .name = "timer",
 241     .get  = get_timer,
 242     .put  = put_timer,
 243 };
 244
 245
 246 typedef struct CompatEntry {
 247     char idstr[256];
 248     int instance_id;
 249 } CompatEntry;
 250
 251 typedef struct SaveStateEntry {
 252     QTAILQ_ENTRY(SaveStateEntry) entry;
 253     char idstr[256];
 254     int instance_id;
 255     int alias_id;
 256     int version_id;
 257     int section_id;
 258     SaveVMHandlers *ops;
 259     const VMStateDescription *vmsd;
 260     void *opaque;
 261     CompatEntry *compat;
 262     int is_ram;
 263 } SaveStateEntry;
 264
 265 typedef struct SaveState {
 266     QTAILQ_HEAD(, SaveStateEntry) handlers;
 267     int global_section_id;
 268     bool skip_configuration;
 269     uint32_t len;
 270     const char *name;
 271     uint32_t target_page_bits;
 272 } SaveState;
 273
 274 static SaveState savevm_state = {
 275     .handlers = QTAILQ_HEAD_INITIALIZER(savevm_state.handlers),
 276     .global_section_id = 0,
 277     .skip_configuration = false,
 278 };
 279
 280 void savevm_skip_configuration(void)
 281 {
 282     savevm_state.skip_configuration = true;
 283 }
 284
 285
 286 static void configuration_pre_save(void *opaque)
 287 {
 288     SaveState *state = opaque;
 289     const char *current_name = MACHINE_GET_CLASS(current_machine)->name;
 290
 291     state->len = strlen(current_name);
 292     state->name = current_name;
 293     state->target_page_bits = TARGET_PAGE_BITS;
 294 }
 295
 296 static int configuration_pre_load(void *opaque)
 297 {
 298     SaveState *state = opaque;
 299
 300     /* If there is no target-page-bits subsection it means the source
 301      * predates the variable-target-page-bits support and is using the
 302      * minimum possible value for this CPU.
 303      */
 304     state->target_page_bits = TARGET_PAGE_BITS_MIN;
 305     return 0;
 306 }
 307
 308 static int configuration_post_load(void *opaque, int version_id)
 309 {
 310     SaveState *state = opaque;
 311     const char *current_name = MACHINE_GET_CLASS(current_machine)->name;
 312
 313     if (strncmp(state->name, current_name, state->len) != 0) {
 314         error_report("Machine type received is '%.*s' and local is '%s'",
 315                      (int) state->len, state->name, current_name);
 316         return -EINVAL;
 317     }
 318
 319     if (state->target_page_bits != TARGET_PAGE_BITS) {
 320         error_report("Received TARGET_PAGE_BITS is %d but local is %d",
 321                      state->target_page_bits, TARGET_PAGE_BITS);
 322         return -EINVAL;
 323     }
 324
 325     return 0;
 326 }
 327
 328 /* The target-page-bits subsection is present only if the
 329  * target page size is not the same as the default (ie the
 330  * minimum page size for a variable-page-size guest CPU).
 331  * If it is present then it contains the actual target page
 332  * bits for the machine, and migration will fail if the
 333  * two ends don't agree about it.
 334  */
 335 static bool vmstate_target_page_bits_needed(void *opaque)
 336 {
 337     return TARGET_PAGE_BITS > TARGET_PAGE_BITS_MIN;
 338 }
 339
 340 static const VMStateDescription vmstate_target_page_bits = {
 341     .name = "configuration/target-page-bits",
 342     .version_id = 1,
 343     .minimum_version_id = 1,
 344     .needed = vmstate_target_page_bits_needed,
 345     .fields = (VMStateField[]) {
 346         VMSTATE_UINT32(target_page_bits, SaveState),
 347         VMSTATE_END_OF_LIST()
 348     }
 349 };
 350
 351 static const VMStateDescription vmstate_configuration = {
 352     .name = "configuration",
 353     .version_id = 1,
 354     .pre_load = configuration_pre_load,
 355     .post_load = configuration_post_load,
 356     .pre_save = configuration_pre_save,
 357     .fields = (VMStateField[]) {
 358         VMSTATE_UINT32(len, SaveState),
 359         VMSTATE_VBUFFER_ALLOC_UINT32(name, SaveState, 0, NULL, len),
 360         VMSTATE_END_OF_LIST()
 361     },
 362     .subsections = (const VMStateDescription*[]) {
 363         &vmstate_target_page_bits,
 364         NULL
 365     }
 366 };
 367
 368 static void dump_vmstate_vmsd(FILE *out_file,
 369                               const VMStateDescription *vmsd, int indent,
 370                               bool is_subsection);
 371
 372 static void dump_vmstate_vmsf(FILE *out_file, const VMStateField *field,
 373                               int indent)
 374 {
 375     fprintf(out_file, "%*s{\n", indent, "");
 376     indent += 2;
 377     fprintf(out_file, "%*s\"field\": \"%s\",\n", indent, "", field->name);
 378     fprintf(out_file, "%*s\"version_id\": %d,\n", indent, "",
 379             field->version_id);
 380     fprintf(out_file, "%*s\"field_exists\": %s,\n", indent, "",
 381             field->field_exists ? "true" : "false");
 382     fprintf(out_file, "%*s\"size\": %zu", indent, "", field->size);
 383     if (field->vmsd != NULL) {
 384         fprintf(out_file, ",\n");
 385         dump_vmstate_vmsd(out_file, field->vmsd, indent, false);
 386     }
 387     fprintf(out_file, "\n%*s}", indent - 2, "");
 388 }
 389
 390 static void dump_vmstate_vmss(FILE *out_file,
 391                               const VMStateDescription **subsection,
 392                               int indent)
 393 {
 394     if (*subsection != NULL) {
 395         dump_vmstate_vmsd(out_file, *subsection, indent, true);
 396     }
 397 }
 398
 399 static void dump_vmstate_vmsd(FILE *out_file,
 400                               const VMStateDescription *vmsd, int indent,
 401                               bool is_subsection)
 402 {
 403     if (is_subsection) {
 404         fprintf(out_file, "%*s{\n", indent, "");
 405     } else {
 406         fprintf(out_file, "%*s\"%s\": {\n", indent, "", "Description");
 407     }
 408     indent += 2;
 409     fprintf(out_file, "%*s\"name\": \"%s\",\n", indent, "", vmsd->name);
 410     fprintf(out_file, "%*s\"version_id\": %d,\n", indent, "",
 411             vmsd->version_id);
 412     fprintf(out_file, "%*s\"minimum_version_id\": %d", indent, "",
 413             vmsd->minimum_version_id);
 414     if (vmsd->fields != NULL) {
 415         const VMStateField *field = vmsd->fields;
 416         bool first;
 417
 418         fprintf(out_file, ",\n%*s\"Fields\": [\n", indent, "");
 419         first = true;
 420         while (field->name != NULL) {
 421             if (field->flags & VMS_MUST_EXIST) {
 422                 /* Ignore VMSTATE_VALIDATE bits; these don't get migrated */
 423                 field++;
 424                 continue;
 425             }
 426             if (!first) {
 427                 fprintf(out_file, ",\n");
 428             }
 429             dump_vmstate_vmsf(out_file, field, indent + 2);
 430             field++;
 431             first = false;
 432         }
 433         fprintf(out_file, "\n%*s]", indent, "");
 434     }
 435     if (vmsd->subsections != NULL) {
 436         const VMStateDescription **subsection = vmsd->subsections;
 437         bool first;
 438
 439         fprintf(out_file, ",\n%*s\"Subsections\": [\n", indent, "");
 440         first = true;
 441         while (*subsection != NULL) {
 442             if (!first) {
 443                 fprintf(out_file, ",\n");
 444             }
 445             dump_vmstate_vmss(out_file, subsection, indent + 2);
 446             subsection++;
 447             first = false;
 448         }
 449         fprintf(out_file, "\n%*s]", indent, "");
 450     }
 451     fprintf(out_file, "\n%*s}", indent - 2, "");
 452 }
 453
 454 static void dump_machine_type(FILE *out_file)
 455 {
 456     MachineClass *mc;
 457
 458     mc = MACHINE_GET_CLASS(current_machine);
 459
 460     fprintf(out_file, "  \"vmschkmachine\": {\n");
 461     fprintf(out_file, "    \"Name\": \"%s\"\n", mc->name);
 462     fprintf(out_file, "  },\n");
 463 }
 464
 465 void dump_vmstate_json_to_file(FILE *out_file)
 466 {
 467     GSList *list, *elt;
 468     bool first;
 469
 470     fprintf(out_file, "{\n");
 471     dump_machine_type(out_file);
 472
 473     first = true;
 474     list = object_class_get_list(TYPE_DEVICE, true);
 475     for (elt = list; elt; elt = elt->next) {
 476         DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, elt->data,
 477                                              TYPE_DEVICE);
 478         const char *name;
 479         int indent = 2;
 480
 481         if (!dc->vmsd) {
 482             continue;
 483         }
 484
 485         if (!first) {
 486             fprintf(out_file, ",\n");
 487         }
 488         name = object_class_get_name(OBJECT_CLASS(dc));
 489         fprintf(out_file, "%*s\"%s\": {\n", indent, "", name);
 490         indent += 2;
 491         fprintf(out_file, "%*s\"Name\": \"%s\",\n", indent, "", name);
 492         fprintf(out_file, "%*s\"version_id\": %d,\n", indent, "",
 493                 dc->vmsd->version_id);
 494         fprintf(out_file, "%*s\"minimum_version_id\": %d,\n", indent, "",
 495                 dc->vmsd->minimum_version_id);
 496
 497         dump_vmstate_vmsd(out_file, dc->vmsd, indent, false);
 498
 499         fprintf(out_file, "\n%*s}", indent - 2, "");
 500         first = false;
 501     }
 502     fprintf(out_file, "\n}\n");
 503     fclose(out_file);
 504 }
 505
 506 static int calculate_new_instance_id(const char *idstr)
 507 {
 508     SaveStateEntry *se;
 509     int instance_id = 0;
 510
 511     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
 512         if (strcmp(idstr, se->idstr) == 0
 513             && instance_id <= se->instance_id) {
 514             instance_id = se->instance_id + 1;
 515         }
 516     }
 517     return instance_id;
 518 }
 519
 520 static int calculate_compat_instance_id(const char *idstr)
 521 {
 522     SaveStateEntry *se;
 523     int instance_id = 0;
 524
 525     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
 526         if (!se->compat) {
 527             continue;
 528         }
 529
 530         if (strcmp(idstr, se->compat->idstr) == 0
 531             && instance_id <= se->compat->instance_id) {
 532             instance_id = se->compat->instance_id + 1;
 533         }
 534     }
 535     return instance_id;
 536 }
 537
 538 static inline MigrationPriority save_state_priority(SaveStateEntry *se)
 539 {
 540     if (se->vmsd) {
 541         return se->vmsd->priority;
 542     }
 543     return MIG_PRI_DEFAULT;
 544 }
 545
 546 static void savevm_state_handler_insert(SaveStateEntry *nse)
 547 {
 548     MigrationPriority priority = save_state_priority(nse);
 549     SaveStateEntry *se;
 550
 551     assert(priority <= MIG_PRI_MAX);
 552
 553     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
 554         if (save_state_priority(se) < priority) {
 555             break;
 556         }
 557     }
 558
 559     if (se) {
 560         QTAILQ_INSERT_BEFORE(se, nse, entry);
 561     } else {
 562         QTAILQ_INSERT_TAIL(&savevm_state.handlers, nse, entry);
 563     }
 564 }
 565
 566 /* TODO: Individual devices generally have very little idea about the rest
 567    of the system, so instance_id should be removed/replaced.
 568    Meanwhile pass -1 as instance_id if you do not already have a clearly
 569    distinguishing id for all instances of your device class. */
 570 int register_savevm_live(DeviceState *dev,
 571                          const char *idstr,
 572                          int instance_id,
 573                          int version_id,
 574                          SaveVMHandlers *ops,
 575                          void *opaque)
 576 {
 577     SaveStateEntry *se;
 578
 579     se = g_new0(SaveStateEntry, 1);
 580     se->version_id = version_id;
 581     se->section_id = savevm_state.global_section_id++;
 582     se->ops = ops;
 583     se->opaque = opaque;
 584     se->vmsd = NULL;
 585     /* if this is a live_savem then set is_ram */
 586     if (ops->save_live_setup != NULL) {
 587         se->is_ram = 1;
 588     }
 589
 590     if (dev) {
 591         char *id = qdev_get_dev_path(dev);
 592         if (id) {
 593             if (snprintf(se->idstr, sizeof(se->idstr), "%s/", id) >=
 594                 sizeof(se->idstr)) {
 595                 error_report("Path too long for VMState (%s)", id);
 596                 g_free(id);
 597                 g_free(se);
 598
 599                 return -1;
 600             }
 601             g_free(id);
 602
 603             se->compat = g_new0(CompatEntry, 1);
 604             pstrcpy(se->compat->idstr, sizeof(se->compat->idstr), idstr);
 605             se->compat->instance_id = instance_id == -1 ?
 606                          calculate_compat_instance_id(idstr) : instance_id;
 607             instance_id = -1;
 608         }
 609     }
 610     pstrcat(se->idstr, sizeof(se->idstr), idstr);
 611
 612     if (instance_id == -1) {
 613         se->instance_id = calculate_new_instance_id(se->idstr);
 614     } else {
 615         se->instance_id = instance_id;
 616     }
 617     assert(!se->compat || se->instance_id == 0);
 618     savevm_state_handler_insert(se);
 619     return 0;
 620 }
 621
 622 int register_savevm(DeviceState *dev,
 623                     const char *idstr,
 624                     int instance_id,
 625                     int version_id,
 626                     SaveStateHandler *save_state,
 627                     LoadStateHandler *load_state,
 628                     void *opaque)
 629 {
 630     SaveVMHandlers *ops = g_new0(SaveVMHandlers, 1);
 631     ops->save_state = save_state;
 632     ops->load_state = load_state;
 633     return register_savevm_live(dev, idstr, instance_id, version_id,
 634                                 ops, opaque);
 635 }
 636
 637 void unregister_savevm(DeviceState *dev, const char *idstr, void *opaque)
 638 {
 639     SaveStateEntry *se, *new_se;
 640     char id[256] = "";
 641
 642     if (dev) {
 643         char *path = qdev_get_dev_path(dev);
 644         if (path) {
 645             pstrcpy(id, sizeof(id), path);
 646             pstrcat(id, sizeof(id), "/");
 647             g_free(path);
 648         }
 649     }
 650     pstrcat(id, sizeof(id), idstr);
 651
 652     QTAILQ_FOREACH_SAFE(se, &savevm_state.handlers, entry, new_se) {
 653         if (strcmp(se->idstr, id) == 0 && se->opaque == opaque) {
 654             QTAILQ_REMOVE(&savevm_state.handlers, se, entry);
 655             g_free(se->compat);
 656             g_free(se->ops);
 657             g_free(se);
 658         }
 659     }
 660 }
 661
 662 int vmstate_register_with_alias_id(DeviceState *dev, int instance_id,
 663                                    const VMStateDescription *vmsd,
 664                                    void *opaque, int alias_id,
 665                                    int required_for_version,
 666                                    Error **errp)
 667 {
 668     SaveStateEntry *se;
 669
 670     /* If this triggers, alias support can be dropped for the vmsd. */
 671     assert(alias_id == -1 || required_for_version >= vmsd->minimum_version_id);
 672
 673     se = g_new0(SaveStateEntry, 1);
 674     se->version_id = vmsd->version_id;
 675     se->section_id = savevm_state.global_section_id++;
 676     se->opaque = opaque;
 677     se->vmsd = vmsd;
 678     se->alias_id = alias_id;
 679
 680     if (dev) {
 681         char *id = qdev_get_dev_path(dev);
 682         if (id) {
 683             if (snprintf(se->idstr, sizeof(se->idstr), "%s/", id) >=
 684                 sizeof(se->idstr)) {
 685                 error_setg(errp, "Path too long for VMState (%s)", id);
 686                 g_free(id);
 687                 g_free(se);
 688
 689                 return -1;
 690             }
 691             g_free(id);
 692
 693             se->compat = g_new0(CompatEntry, 1);
 694             pstrcpy(se->compat->idstr, sizeof(se->compat->idstr), vmsd->name);
 695             se->compat->instance_id = instance_id == -1 ?
 696                          calculate_compat_instance_id(vmsd->name) : instance_id;
 697             instance_id = -1;
 698         }
 699     }
 700     pstrcat(se->idstr, sizeof(se->idstr), vmsd->name);
 701
 702     if (instance_id == -1) {
 703         se->instance_id = calculate_new_instance_id(se->idstr);
 704     } else {
 705         se->instance_id = instance_id;
 706     }
 707     assert(!se->compat || se->instance_id == 0);
 708     savevm_state_handler_insert(se);
 709     return 0;
 710 }
 711
 712 void vmstate_unregister(DeviceState *dev, const VMStateDescription *vmsd,
 713                         void *opaque)
 714 {
 715     SaveStateEntry *se, *new_se;
 716
 717     QTAILQ_FOREACH_SAFE(se, &savevm_state.handlers, entry, new_se) {
 718         if (se->vmsd == vmsd && se->opaque == opaque) {
 719             QTAILQ_REMOVE(&savevm_state.handlers, se, entry);
 720             g_free(se->compat);
 721             g_free(se);
 722         }
 723     }
 724 }
 725
 726 static int vmstate_load(QEMUFile *f, SaveStateEntry *se, int version_id)
 727 {
 728     trace_vmstate_load(se->idstr, se->vmsd ? se->vmsd->name : "(old)");
 729     if (!se->vmsd) {         /* Old style */
 730         return se->ops->load_state(f, se->opaque, version_id);
 731     }
 732     return vmstate_load_state(f, se->vmsd, se->opaque, version_id);
 733 }
 734
 735 static void vmstate_save_old_style(QEMUFile *f, SaveStateEntry *se, QJSON *vmdesc)
 736 {
 737     int64_t old_offset, size;
 738
 739     old_offset = qemu_ftell_fast(f);
 740     se->ops->save_state(f, se->opaque);
 741     size = qemu_ftell_fast(f) - old_offset;
 742
 743     if (vmdesc) {
 744         json_prop_int(vmdesc, "size", size);
 745         json_start_array(vmdesc, "fields");
 746         json_start_object(vmdesc, NULL);
 747         json_prop_str(vmdesc, "name", "data");
 748         json_prop_int(vmdesc, "size", size);
 749         json_prop_str(vmdesc, "type", "buffer");
 750         json_end_object(vmdesc);
 751         json_end_array(vmdesc);
 752     }
 753 }
 754
 755 static void vmstate_save(QEMUFile *f, SaveStateEntry *se, QJSON *vmdesc)
 756 {
 757     trace_vmstate_save(se->idstr, se->vmsd ? se->vmsd->name : "(old)");
 758     if (!se->vmsd) {
 759         vmstate_save_old_style(f, se, vmdesc);
 760         return;
 761     }
 762     vmstate_save_state(f, se->vmsd, se->opaque, vmdesc);
 763 }
 764
 765 void savevm_skip_section_footers(void)
 766 {
 767     skip_section_footers = true;
 768 }
 769
 770 /*
 771  * Write the header for device section (QEMU_VM_SECTION START/END/PART/FULL)
 772  */
 773 static void save_section_header(QEMUFile *f, SaveStateEntry *se,
 774                                 uint8_t section_type)
 775 {
 776     qemu_put_byte(f, section_type);
 777     qemu_put_be32(f, se->section_id);
 778
 779     if (section_type == QEMU_VM_SECTION_FULL ||
 780         section_type == QEMU_VM_SECTION_START) {
 781         /* ID string */
 782         size_t len = strlen(se->idstr);
 783         qemu_put_byte(f, len);
 784         qemu_put_buffer(f, (uint8_t *)se->idstr, len);
 785
 786         qemu_put_be32(f, se->instance_id);
 787         qemu_put_be32(f, se->version_id);
 788     }
 789 }
 790
 791 /*
 792  * Write a footer onto device sections that catches cases misformatted device
 793  * sections.
 794  */
 795 static void save_section_footer(QEMUFile *f, SaveStateEntry *se)
 796 {
 797     if (!skip_section_footers) {
 798         qemu_put_byte(f, QEMU_VM_SECTION_FOOTER);
 799         qemu_put_be32(f, se->section_id);
 800     }
 801 }
 802
 803 /**
 804  * qemu_savevm_command_send: Send a 'QEMU_VM_COMMAND' type element with the
 805  *                           command and associated data.
 806  *
 807  * @f: File to send command on
 808  * @command: Command type to send
 809  * @len: Length of associated data
 810  * @data: Data associated with command.
 811  */
 812 void qemu_savevm_command_send(QEMUFile *f,
 813                               enum qemu_vm_cmd command,
 814                               uint16_t len,
 815                               uint8_t *data)
 816 {
 817     trace_savevm_command_send(command, len);
 818     qemu_put_byte(f, QEMU_VM_COMMAND);
 819     qemu_put_be16(f, (uint16_t)command);
 820     qemu_put_be16(f, len);
 821     qemu_put_buffer(f, data, len);
 822     qemu_fflush(f);
 823 }
 824
 825 void qemu_savevm_send_ping(QEMUFile *f, uint32_t value)
 826 {
 827     uint32_t buf;
 828
 829     trace_savevm_send_ping(value);
 830     buf = cpu_to_be32(value);
 831     qemu_savevm_command_send(f, MIG_CMD_PING, sizeof(value), (uint8_t *)&buf);
 832 }
 833
 834 void qemu_savevm_send_open_return_path(QEMUFile *f)
 835 {
 836     trace_savevm_send_open_return_path();
 837     qemu_savevm_command_send(f, MIG_CMD_OPEN_RETURN_PATH, 0, NULL);
 838 }
 839
 840 /* We have a buffer of data to send; we don't want that all to be loaded
 841  * by the command itself, so the command contains just the length of the
 842  * extra buffer that we then send straight after it.
 843  * TODO: Must be a better way to organise that
 844  *
 845  * Returns:
 846  *    0 on success
 847  *    -ve on error
 848  */
 849 int qemu_savevm_send_packaged(QEMUFile *f, const uint8_t *buf, size_t len)
 850 {
 851     uint32_t tmp;
 852
 853     if (len > MAX_VM_CMD_PACKAGED_SIZE) {
 854         error_report("%s: Unreasonably large packaged state: %zu",
 855                      __func__, len);
 856         return -1;
 857     }
 858
 859     tmp = cpu_to_be32(len);
 860
 861     trace_qemu_savevm_send_packaged();
 862     qemu_savevm_command_send(f, MIG_CMD_PACKAGED, 4, (uint8_t *)&tmp);
 863
 864     qemu_put_buffer(f, buf, len);
 865
 866     return 0;
 867 }
 868
 869 /* Send prior to any postcopy transfer */
 870 void qemu_savevm_send_postcopy_advise(QEMUFile *f)
 871 {
 872     uint64_t tmp[2];
 873     tmp[0] = cpu_to_be64(ram_pagesize_summary());
 874     tmp[1] = cpu_to_be64(qemu_target_page_size());
 875
 876     trace_qemu_savevm_send_postcopy_advise();
 877     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_ADVISE, 16, (uint8_t *)tmp);
 878 }
 879
 880 /* Sent prior to starting the destination running in postcopy, discard pages
 881  * that have already been sent but redirtied on the source.
 882  * CMD_POSTCOPY_RAM_DISCARD consist of:
 883  *      byte   version (0)
 884  *      byte   Length of name field (not including 0)
 885  *  n x byte   RAM block name
 886  *      byte   0 terminator (just for safety)
 887  *  n x        Byte ranges within the named RAMBlock
 888  *      be64   Start of the range
 889  *      be64   Length
 890  *
 891  *  name:  RAMBlock name that these entries are part of
 892  *  len: Number of page entries
 893  *  start_list: 'len' addresses
 894  *  length_list: 'len' addresses
 895  *
 896  */
 897 void qemu_savevm_send_postcopy_ram_discard(QEMUFile *f, const char *name,
 898                                            uint16_t len,
 899                                            uint64_t *start_list,
 900                                            uint64_t *length_list)
 901 {
 902     uint8_t *buf;
 903     uint16_t tmplen;
 904     uint16_t t;
 905     size_t name_len = strlen(name);
 906
 907     trace_qemu_savevm_send_postcopy_ram_discard(name, len);
 908     assert(name_len < 256);
 909     buf = g_malloc0(1 + 1 + name_len + 1 + (8 + 8) * len);
 910     buf[0] = postcopy_ram_discard_version;
 911     buf[1] = name_len;
 912     memcpy(buf + 2, name, name_len);
 913     tmplen = 2 + name_len;
 914     buf[tmplen++] = '\0';
 915
 916     for (t = 0; t < len; t++) {
 917         stq_be_p(buf + tmplen, start_list[t]);
 918         tmplen += 8;
 919         stq_be_p(buf + tmplen, length_list[t]);
 920         tmplen += 8;
 921     }
 922     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_RAM_DISCARD, tmplen, buf);
 923     g_free(buf);
 924 }
 925
 926 /* Get the destination into a state where it can receive postcopy data. */
 927 void qemu_savevm_send_postcopy_listen(QEMUFile *f)
 928 {
 929     trace_savevm_send_postcopy_listen();
 930     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_LISTEN, 0, NULL);
 931 }
 932
 933 /* Kick the destination into running */
 934 void qemu_savevm_send_postcopy_run(QEMUFile *f)
 935 {
 936     trace_savevm_send_postcopy_run();
 937     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_RUN, 0, NULL);
 938 }
 939
 940 bool qemu_savevm_state_blocked(Error **errp)
 941 {
 942     SaveStateEntry *se;
 943
 944     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
 945         if (se->vmsd && se->vmsd->unmigratable) {
 946             error_setg(errp, "State blocked by non-migratable device '%s'",
 947                        se->idstr);
 948             return true;
 949         }
 950     }
 951     return false;
 952 }
 953
 954 static bool enforce_config_section(void)
 955 {
 956     MachineState *machine = MACHINE(qdev_get_machine());
 957     return machine->enforce_config_section;
 958 }
 959
 960 void qemu_savevm_state_header(QEMUFile *f)
 961 {
 962     trace_savevm_state_header();
 963     qemu_put_be32(f, QEMU_VM_FILE_MAGIC);
 964     qemu_put_be32(f, QEMU_VM_FILE_VERSION);
 965
 966     if (!savevm_state.skip_configuration || enforce_config_section()) {
 967         qemu_put_byte(f, QEMU_VM_CONFIGURATION);
 968         vmstate_save_state(f, &vmstate_configuration, &savevm_state, 0);
 969     }
 970
 971 }
 972
 973 void qemu_savevm_state_begin(QEMUFile *f,
 974                              const MigrationParams *params)
 975 {
 976     SaveStateEntry *se;
 977     int ret;
 978
 979     trace_savevm_state_begin();
 980     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
 981         if (!se->ops || !se->ops->set_params) {
 982             continue;
 983         }
 984         se->ops->set_params(params, se->opaque);
 985     }
 986
 987     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
 988         if (!se->ops || !se->ops->save_live_setup) {
 989             continue;
 990         }
 991         if (se->ops && se->ops->is_active) {
 992             if (!se->ops->is_active(se->opaque)) {
 993                 continue;
 994             }
 995         }
 996         save_section_header(f, se, QEMU_VM_SECTION_START);
 997
 998         ret = se->ops->save_live_setup(f, se->opaque);
 999         save_section_footer(f, se);
1000         if (ret < 0) {
1001             qemu_file_set_error(f, ret);
1002             break;
1003         }
1004     }
1005 }
1006
1007 /*
1008  * this function has three return values:
1009  *   negative: there was one error, and we have -errno.
1010  *   0 : We haven't finished, caller have to go again
1011  *   1 : We have finished, we can go to complete phase
1012  */
1013 int qemu_savevm_state_iterate(QEMUFile *f, bool postcopy)
1014 {
1015     SaveStateEntry *se;
1016     int ret = 1;
1017
1018     trace_savevm_state_iterate();
1019     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1020         if (!se->ops || !se->ops->save_live_iterate) {
1021             continue;
1022         }
1023         if (se->ops && se->ops->is_active) {
1024             if (!se->ops->is_active(se->opaque)) {
1025                 continue;
1026             }
1027         }
1028         /*
1029          * In the postcopy phase, any device that doesn't know how to
1030          * do postcopy should have saved it's state in the _complete
1031          * call that's already run, it might get confused if we call
1032          * iterate afterwards.
1033          */
1034         if (postcopy && !se->ops->save_live_complete_postcopy) {
1035             continue;
1036         }
1037         if (qemu_file_rate_limit(f)) {
1038             return 0;
1039         }
1040         trace_savevm_section_start(se->idstr, se->section_id);
1041
1042         save_section_header(f, se, QEMU_VM_SECTION_PART);
1043
1044         ret = se->ops->save_live_iterate(f, se->opaque);
1045         trace_savevm_section_end(se->idstr, se->section_id, ret);
1046         save_section_footer(f, se);
1047
1048         if (ret < 0) {
1049             qemu_file_set_error(f, ret);
1050         }
1051         if (ret <= 0) {
1052             /* Do not proceed to the next vmstate before this one reported
1053                completion of the current stage. This serializes the migration
1054                and reduces the probability that a faster changing state is
1055                synchronized over and over again. */
1056             break;
1057         }
1058     }
1059     return ret;
1060 }
1061
1062 static bool should_send_vmdesc(void)
1063 {
1064     MachineState *machine = MACHINE(qdev_get_machine());
1065     bool in_postcopy = migration_in_postcopy();
1066     return !machine->suppress_vmdesc && !in_postcopy;
1067 }
1068
1069 /*
1070  * Calls the save_live_complete_postcopy methods
1071  * causing the last few pages to be sent immediately and doing any associated
1072  * cleanup.
1073  * Note postcopy also calls qemu_savevm_state_complete_precopy to complete
1074  * all the other devices, but that happens at the point we switch to postcopy.
1075  */
1076 void qemu_savevm_state_complete_postcopy(QEMUFile *f)
1077 {
1078     SaveStateEntry *se;
1079     int ret;
1080
1081     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1082         if (!se->ops || !se->ops->save_live_complete_postcopy) {
1083             continue;
1084         }
1085         if (se->ops && se->ops->is_active) {
1086             if (!se->ops->is_active(se->opaque)) {
1087                 continue;
1088             }
1089         }
1090         trace_savevm_section_start(se->idstr, se->section_id);
1091         /* Section type */
1092         qemu_put_byte(f, QEMU_VM_SECTION_END);
1093         qemu_put_be32(f, se->section_id);
1094
1095         ret = se->ops->save_live_complete_postcopy(f, se->opaque);
1096         trace_savevm_section_end(se->idstr, se->section_id, ret);
1097         save_section_footer(f, se);
1098         if (ret < 0) {
1099             qemu_file_set_error(f, ret);
1100             return;
1101         }
1102     }
1103
1104     qemu_put_byte(f, QEMU_VM_EOF);
1105     qemu_fflush(f);
1106 }
1107
1108 void qemu_savevm_state_complete_precopy(QEMUFile *f, bool iterable_only)
1109 {
1110     QJSON *vmdesc;
1111     int vmdesc_len;
1112     SaveStateEntry *se;
1113     int ret;
1114     bool in_postcopy = migration_in_postcopy();
1115
1116     trace_savevm_state_complete_precopy();
1117
1118     cpu_synchronize_all_states();
1119
1120     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1121         if (!se->ops ||
1122             (in_postcopy && se->ops->save_live_complete_postcopy) ||
1123             (in_postcopy && !iterable_only) ||
1124             !se->ops->save_live_complete_precopy) {
1125             continue;
1126         }
1127
1128         if (se->ops && se->ops->is_active) {
1129             if (!se->ops->is_active(se->opaque)) {
1130                 continue;
1131             }
1132         }
1133         trace_savevm_section_start(se->idstr, se->section_id);
1134
1135         save_section_header(f, se, QEMU_VM_SECTION_END);
1136
1137         ret = se->ops->save_live_complete_precopy(f, se->opaque);
1138         trace_savevm_section_end(se->idstr, se->section_id, ret);
1139         save_section_footer(f, se);
1140         if (ret < 0) {
1141             qemu_file_set_error(f, ret);
1142             return;
1143         }
1144     }
1145
1146     if (iterable_only) {
1147         return;
1148     }
1149
1150     vmdesc = qjson_new();
1151     json_prop_int(vmdesc, "page_size", TARGET_PAGE_SIZE);
1152     json_start_array(vmdesc, "devices");
1153     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1154
1155         if ((!se->ops || !se->ops->save_state) && !se->vmsd) {
1156             continue;
1157         }
1158         if (se->vmsd && !vmstate_save_needed(se->vmsd, se->opaque)) {
1159             trace_savevm_section_skip(se->idstr, se->section_id);
1160             continue;
1161         }
1162
1163         trace_savevm_section_start(se->idstr, se->section_id);
1164
1165         json_start_object(vmdesc, NULL);
1166         json_prop_str(vmdesc, "name", se->idstr);
1167         json_prop_int(vmdesc, "instance_id", se->instance_id);
1168
1169         save_section_header(f, se, QEMU_VM_SECTION_FULL);
1170         vmstate_save(f, se, vmdesc);
1171         trace_savevm_section_end(se->idstr, se->section_id, 0);
1172         save_section_footer(f, se);
1173
1174         json_end_object(vmdesc);
1175     }
1176
1177     if (!in_postcopy) {
1178         /* Postcopy stream will still be going */
1179         qemu_put_byte(f, QEMU_VM_EOF);
1180     }
1181
1182     json_end_array(vmdesc);
1183     qjson_finish(vmdesc);
1184     vmdesc_len = strlen(qjson_get_str(vmdesc));
1185
1186     if (should_send_vmdesc()) {
1187         qemu_put_byte(f, QEMU_VM_VMDESCRIPTION);
1188         qemu_put_be32(f, vmdesc_len);
1189         qemu_put_buffer(f, (uint8_t *)qjson_get_str(vmdesc), vmdesc_len);
1190     }
1191     qjson_destroy(vmdesc);
1192
1193     qemu_fflush(f);
1194 }
1195
1196 /* Give an estimate of the amount left to be transferred,
1197  * the result is split into the amount for units that can and
1198  * for units that can't do postcopy.
1199  */
1200 void qemu_savevm_state_pending(QEMUFile *f, uint64_t threshold_size,
1201                                uint64_t *res_non_postcopiable,
1202                                uint64_t *res_postcopiable)
1203 {
1204     SaveStateEntry *se;
1205
1206     *res_non_postcopiable = 0;
1207     *res_postcopiable = 0;
1208
1209
1210     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1211         if (!se->ops || !se->ops->save_live_pending) {
1212             continue;
1213         }
1214         if (se->ops && se->ops->is_active) {
1215             if (!se->ops->is_active(se->opaque)) {
1216                 continue;
1217             }
1218         }
1219         se->ops->save_live_pending(f, se->opaque, threshold_size,
1220                                    res_non_postcopiable, res_postcopiable);
1221     }
1222 }
1223
1224 void qemu_savevm_state_cleanup(void)
1225 {
1226     SaveStateEntry *se;
1227
1228     trace_savevm_state_cleanup();
1229     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1230         if (se->ops && se->ops->cleanup) {
1231             se->ops->cleanup(se->opaque);
1232         }
1233     }
1234 }
1235
1236 static int qemu_savevm_state(QEMUFile *f, Error **errp)
1237 {
1238     int ret;
1239     MigrationParams params = {
1240         .blk = 0,
1241         .shared = 0
1242     };
1243     MigrationState *ms = migrate_init(&params);
1244     MigrationStatus status;
1245     ms->to_dst_file = f;
1246
1247     if (migration_is_blocked(errp)) {
1248         ret = -EINVAL;
1249         goto done;
1250     }
1251
1252     qemu_mutex_unlock_iothread();
1253     qemu_savevm_state_header(f);
1254     qemu_savevm_state_begin(f, &params);
1255     qemu_mutex_lock_iothread();
1256
1257     while (qemu_file_get_error(f) == 0) {
1258         if (qemu_savevm_state_iterate(f, false) > 0) {
1259             break;
1260         }
1261     }
1262
1263     ret = qemu_file_get_error(f);
1264     if (ret == 0) {
1265         qemu_savevm_state_complete_precopy(f, false);
1266         ret = qemu_file_get_error(f);
1267     }
1268     qemu_savevm_state_cleanup();
1269     if (ret != 0) {
1270         error_setg_errno(errp, -ret, "Error while writing VM state");
1271     }
1272
1273 done:
1274     if (ret != 0) {
1275         status = MIGRATION_STATUS_FAILED;
1276     } else {
1277         status = MIGRATION_STATUS_COMPLETED;
1278     }
1279     migrate_set_state(&ms->state, MIGRATION_STATUS_SETUP, status);
1280
1281     /* f is outer parameter, it should not stay in global migration state after
1282      * this function finished */
1283     ms->to_dst_file = NULL;
1284
1285     return ret;
1286 }
1287
1288 static int qemu_save_device_state(QEMUFile *f)
1289 {
1290     SaveStateEntry *se;
1291
1292     qemu_put_be32(f, QEMU_VM_FILE_MAGIC);
1293     qemu_put_be32(f, QEMU_VM_FILE_VERSION);
1294
1295     cpu_synchronize_all_states();
1296
1297     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1298         if (se->is_ram) {
1299             continue;
1300         }
1301         if ((!se->ops || !se->ops->save_state) && !se->vmsd) {
1302             continue;
1303         }
1304         if (se->vmsd && !vmstate_save_needed(se->vmsd, se->opaque)) {
1305             continue;
1306         }
1307
1308         save_section_header(f, se, QEMU_VM_SECTION_FULL);
1309
1310         vmstate_save(f, se, NULL);
1311
1312         save_section_footer(f, se);
1313     }
1314
1315     qemu_put_byte(f, QEMU_VM_EOF);
1316
1317     return qemu_file_get_error(f);
1318 }
1319
1320 static SaveStateEntry *find_se(const char *idstr, int instance_id)
1321 {
1322     SaveStateEntry *se;
1323
1324     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1325         if (!strcmp(se->idstr, idstr) &&
1326             (instance_id == se->instance_id ||
1327              instance_id == se->alias_id))
1328             return se;
1329         /* Migrating from an older version? */
1330         if (strstr(se->idstr, idstr) && se->compat) {
1331             if (!strcmp(se->compat->idstr, idstr) &&
1332                 (instance_id == se->compat->instance_id ||
1333                  instance_id == se->alias_id))
1334                 return se;
1335         }
1336     }
1337     return NULL;
1338 }
1339
1340 enum LoadVMExitCodes {
1341     /* Allow a command to quit all layers of nested loadvm loops */
1342     LOADVM_QUIT     =  1,
1343 };
1344
1345 static int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis);
1346
1347 /* ------ incoming postcopy messages ------ */
1348 /* 'advise' arrives before any transfers just to tell us that a postcopy
1349  * *might* happen - it might be skipped if precopy transferred everything
1350  * quickly.
1351  */
1352 static int loadvm_postcopy_handle_advise(MigrationIncomingState *mis)
1353 {
1354     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_ADVISE);
1355     uint64_t remote_pagesize_summary, local_pagesize_summary, remote_tps;
1356
1357     trace_loadvm_postcopy_handle_advise();
1358     if (ps != POSTCOPY_INCOMING_NONE) {
1359         error_report("CMD_POSTCOPY_ADVISE in wrong postcopy state (%d)", ps);
1360         return -1;
1361     }
1362
1363     if (!postcopy_ram_supported_by_host()) {
1364         postcopy_state_set(POSTCOPY_INCOMING_NONE);
1365         return -1;
1366     }
1367
1368     remote_pagesize_summary = qemu_get_be64(mis->from_src_file);
1369     local_pagesize_summary = ram_pagesize_summary();
1370
1371     if (remote_pagesize_summary != local_pagesize_summary)  {
1372         /*
1373          * This detects two potential causes of mismatch:
1374          *   a) A mismatch in host page sizes
1375          *      Some combinations of mismatch are probably possible but it gets
1376          *      a bit more complicated.  In particular we need to place whole
1377          *      host pages on the dest at once, and we need to ensure that we
1378          *      handle dirtying to make sure we never end up sending part of
1379          *      a hostpage on it's own.
1380          *   b) The use of different huge page sizes on source/destination
1381          *      a more fine grain test is performed during RAM block migration
1382          *      but this test here causes a nice early clear failure, and
1383          *      also fails when passed to an older qemu that doesn't
1384          *      do huge pages.
1385          */
1386         error_report("Postcopy needs matching RAM page sizes (s=%" PRIx64
1387                                                              " d=%" PRIx64 ")",
1388                      remote_pagesize_summary, local_pagesize_summary);
1389         return -1;
1390     }
1391
1392     remote_tps = qemu_get_be64(mis->from_src_file);
1393     if (remote_tps != qemu_target_page_size()) {
1394         /*
1395          * Again, some differences could be dealt with, but for now keep it
1396          * simple.
1397          */
1398         error_report("Postcopy needs matching target page sizes (s=%d d=%zd)",
1399                      (int)remote_tps, qemu_target_page_size());
1400         return -1;
1401     }
1402
1403     if (ram_postcopy_incoming_init(mis)) {
1404         return -1;
1405     }
1406
1407     postcopy_state_set(POSTCOPY_INCOMING_ADVISE);
1408
1409     return 0;
1410 }
1411
1412 /* After postcopy we will be told to throw some pages away since they're
1413  * dirty and will have to be demand fetched.  Must happen before CPU is
1414  * started.
1415  * There can be 0..many of these messages, each encoding multiple pages.
1416  */
1417 static int loadvm_postcopy_ram_handle_discard(MigrationIncomingState *mis,
1418                                               uint16_t len)
1419 {
1420     int tmp;
1421     char ramid[256];
1422     PostcopyState ps = postcopy_state_get();
1423
1424     trace_loadvm_postcopy_ram_handle_discard();
1425
1426     switch (ps) {
1427     case POSTCOPY_INCOMING_ADVISE:
1428         /* 1st discard */
1429         tmp = postcopy_ram_prepare_discard(mis);
1430         if (tmp) {
1431             return tmp;
1432         }
1433         break;
1434
1435     case POSTCOPY_INCOMING_DISCARD:
1436         /* Expected state */
1437         break;
1438
1439     default:
1440         error_report("CMD_POSTCOPY_RAM_DISCARD in wrong postcopy state (%d)",
1441                      ps);
1442         return -1;
1443     }
1444     /* We're expecting a
1445      *    Version (0)
1446      *    a RAM ID string (length byte, name, 0 term)
1447      *    then at least 1 16 byte chunk
1448     */
1449     if (len < (1 + 1 + 1 + 1 + 2 * 8)) {
1450         error_report("CMD_POSTCOPY_RAM_DISCARD invalid length (%d)", len);
1451         return -1;
1452     }
1453
1454     tmp = qemu_get_byte(mis->from_src_file);
1455     if (tmp != postcopy_ram_discard_version) {
1456         error_report("CMD_POSTCOPY_RAM_DISCARD invalid version (%d)", tmp);
1457         return -1;
1458     }
1459
1460     if (!qemu_get_counted_string(mis->from_src_file, ramid)) {
1461         error_report("CMD_POSTCOPY_RAM_DISCARD Failed to read RAMBlock ID");
1462         return -1;
1463     }
1464     tmp = qemu_get_byte(mis->from_src_file);
1465     if (tmp != 0) {
1466         error_report("CMD_POSTCOPY_RAM_DISCARD missing nil (%d)", tmp);
1467         return -1;
1468     }
1469
1470     len -= 3 + strlen(ramid);
1471     if (len % 16) {
1472         error_report("CMD_POSTCOPY_RAM_DISCARD invalid length (%d)", len);
1473         return -1;
1474     }
1475     trace_loadvm_postcopy_ram_handle_discard_header(ramid, len);
1476     while (len) {
1477         uint64_t start_addr, block_length;
1478         start_addr = qemu_get_be64(mis->from_src_file);
1479         block_length = qemu_get_be64(mis->from_src_file);
1480
1481         len -= 16;
1482         int ret = ram_discard_range(ramid, start_addr, block_length);
1483         if (ret) {
1484             return ret;
1485         }
1486     }
1487     trace_loadvm_postcopy_ram_handle_discard_end();
1488
1489     return 0;
1490 }
1491
1492 /*
1493  * Triggered by a postcopy_listen command; this thread takes over reading
1494  * the input stream, leaving the main thread free to carry on loading the rest
1495  * of the device state (from RAM).
1496  * (TODO:This could do with being in a postcopy file - but there again it's
1497  * just another input loop, not that postcopy specific)
1498  */
1499 static void *postcopy_ram_listen_thread(void *opaque)
1500 {
1501     QEMUFile *f = opaque;
1502     MigrationIncomingState *mis = migration_incoming_get_current();
1503     int load_res;
1504
1505     migrate_set_state(&mis->state, MIGRATION_STATUS_ACTIVE,
1506                                    MIGRATION_STATUS_POSTCOPY_ACTIVE);
1507     qemu_sem_post(&mis->listen_thread_sem);
1508     trace_postcopy_ram_listen_thread_start();
1509
1510     /*
1511      * Because we're a thread and not a coroutine we can't yield
1512      * in qemu_file, and thus we must be blocking now.
1513      */
1514     qemu_file_set_blocking(f, true);
1515     load_res = qemu_loadvm_state_main(f, mis);
1516     /* And non-blocking again so we don't block in any cleanup */
1517     qemu_file_set_blocking(f, false);
1518
1519     trace_postcopy_ram_listen_thread_exit();
1520     if (load_res < 0) {
1521         error_report("%s: loadvm failed: %d", __func__, load_res);
1522         qemu_file_set_error(f, load_res);
1523         migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
1524                                        MIGRATION_STATUS_FAILED);
1525     } else {
1526         /*
1527          * This looks good, but it's possible that the device loading in the
1528          * main thread hasn't finished yet, and so we might not be in 'RUN'
1529          * state yet; wait for the end of the main thread.
1530          */
1531         qemu_event_wait(&mis->main_thread_load_event);
1532     }
1533     postcopy_ram_incoming_cleanup(mis);
1534
1535     if (load_res < 0) {
1536         /*
1537          * If something went wrong then we have a bad state so exit;
1538          * depending how far we got it might be possible at this point
1539          * to leave the guest running and fire MCEs for pages that never
1540          * arrived as a desperate recovery step.
1541          */
1542         exit(EXIT_FAILURE);
1543     }
1544
1545     migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
1546                                    MIGRATION_STATUS_COMPLETED);
1547     /*
1548      * If everything has worked fine, then the main thread has waited
1549      * for us to start, and we're the last use of the mis.
1550      * (If something broke then qemu will have to exit anyway since it's
1551      * got a bad migration state).
1552      */
1553     migration_incoming_state_destroy();
1554
1555
1556     return NULL;
1557 }
1558
1559 /* After this message we must be able to immediately receive postcopy data */
1560 static int loadvm_postcopy_handle_listen(MigrationIncomingState *mis)
1561 {
1562     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_LISTENING);
1563     trace_loadvm_postcopy_handle_listen();
1564     if (ps != POSTCOPY_INCOMING_ADVISE && ps != POSTCOPY_INCOMING_DISCARD) {
1565         error_report("CMD_POSTCOPY_LISTEN in wrong postcopy state (%d)", ps);
1566         return -1;
1567     }
1568     if (ps == POSTCOPY_INCOMING_ADVISE) {
1569         /*
1570          * A rare case, we entered listen without having to do any discards,
1571          * so do the setup that's normally done at the time of the 1st discard.
1572          */
1573         postcopy_ram_prepare_discard(mis);
1574     }
1575
1576     /*
1577      * Sensitise RAM - can now generate requests for blocks that don't exist
1578      * However, at this point the CPU shouldn't be running, and the IO
1579      * shouldn't be doing anything yet so don't actually expect requests
1580      */
1581     if (postcopy_ram_enable_notify(mis)) {
1582         return -1;
1583     }
1584
1585     if (mis->have_listen_thread) {
1586         error_report("CMD_POSTCOPY_RAM_LISTEN already has a listen thread");
1587         return -1;
1588     }
1589
1590     mis->have_listen_thread = true;
1591     /* Start up the listening thread and wait for it to signal ready */
1592     qemu_sem_init(&mis->listen_thread_sem, 0);
1593     qemu_thread_create(&mis->listen_thread, "postcopy/listen",
1594                        postcopy_ram_listen_thread, mis->from_src_file,
1595                        QEMU_THREAD_DETACHED);
1596     qemu_sem_wait(&mis->listen_thread_sem);
1597     qemu_sem_destroy(&mis->listen_thread_sem);
1598
1599     return 0;
1600 }
1601
1602
1603 typedef struct {
1604     QEMUBH *bh;
1605 } HandleRunBhData;
1606
1607 static void loadvm_postcopy_handle_run_bh(void *opaque)
1608 {
1609     Error *local_err = NULL;
1610     HandleRunBhData *data = opaque;
1611
1612     /* TODO we should move all of this lot into postcopy_ram.c or a shared code
1613      * in migration.c
1614      */
1615     cpu_synchronize_all_post_init();
1616
1617     qemu_announce_self();
1618
1619     /* Make sure all file formats flush their mutable metadata */
1620     bdrv_invalidate_cache_all(&local_err);
1621     if (local_err) {
1622         error_report_err(local_err);
1623     }
1624
1625     /* If we get an error here, just don't restart the VM yet. */
1626     blk_resume_after_migration(&local_err);
1627     if (local_err) {
1628         error_free(local_err);
1629         local_err = NULL;
1630         autostart = false;
1631     }
1632
1633     trace_loadvm_postcopy_handle_run_cpu_sync();
1634     cpu_synchronize_all_post_init();
1635
1636     trace_loadvm_postcopy_handle_run_vmstart();
1637
1638     if (autostart) {
1639         /* Hold onto your hats, starting the CPU */
1640         vm_start();
1641     } else {
1642         /* leave it paused and let management decide when to start the CPU */
1643         runstate_set(RUN_STATE_PAUSED);
1644     }
1645
1646     qemu_bh_delete(data->bh);
1647     g_free(data);
1648 }
1649
1650 /* After all discards we can start running and asking for pages */
1651 static int loadvm_postcopy_handle_run(MigrationIncomingState *mis)
1652 {
1653     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_RUNNING);
1654     HandleRunBhData *data;
1655
1656     trace_loadvm_postcopy_handle_run();
1657     if (ps != POSTCOPY_INCOMING_LISTENING) {
1658         error_report("CMD_POSTCOPY_RUN in wrong postcopy state (%d)", ps);
1659         return -1;
1660     }
1661
1662     data = g_new(HandleRunBhData, 1);
1663     data->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, data);
1664     qemu_bh_schedule(data->bh);
1665
1666     /* We need to finish reading the stream from the package
1667      * and also stop reading anything more from the stream that loaded the
1668      * package (since it's now being read by the listener thread).
1669      * LOADVM_QUIT will quit all the layers of nested loadvm loops.
1670      */
1671     return LOADVM_QUIT;
1672 }
1673
1674 /**
1675  * Immediately following this command is a blob of data containing an embedded
1676  * chunk of migration stream; read it and load it.
1677  *
1678  * @mis: Incoming state
1679  * @length: Length of packaged data to read
1680  *
1681  * Returns: Negative values on error
1682  *
1683  */
1684 static int loadvm_handle_cmd_packaged(MigrationIncomingState *mis)
1685 {
1686     int ret;
1687     size_t length;
1688     QIOChannelBuffer *bioc;
1689
1690     length = qemu_get_be32(mis->from_src_file);
1691     trace_loadvm_handle_cmd_packaged(length);
1692
1693     if (length > MAX_VM_CMD_PACKAGED_SIZE) {
1694         error_report("Unreasonably large packaged state: %zu", length);
1695         return -1;
1696     }
1697
1698     bioc = qio_channel_buffer_new(length);
1699     qio_channel_set_name(QIO_CHANNEL(bioc), "migration-loadvm-buffer");
1700     ret = qemu_get_buffer(mis->from_src_file,
1701                           bioc->data,
1702                           length);
1703     if (ret != length) {
1704         object_unref(OBJECT(bioc));
1705         error_report("CMD_PACKAGED: Buffer receive fail ret=%d length=%zu",
1706                      ret, length);
1707         return (ret < 0) ? ret : -EAGAIN;
1708     }
1709     bioc->usage += length;
1710     trace_loadvm_handle_cmd_packaged_received(ret);
1711
1712     QEMUFile *packf = qemu_fopen_channel_input(QIO_CHANNEL(bioc));
1713
1714     ret = qemu_loadvm_state_main(packf, mis);
1715     trace_loadvm_handle_cmd_packaged_main(ret);
1716     qemu_fclose(packf);
1717     object_unref(OBJECT(bioc));
1718
1719     return ret;
1720 }
1721
1722 /*
1723  * Process an incoming 'QEMU_VM_COMMAND'
1724  * 0           just a normal return
1725  * LOADVM_QUIT All good, but exit the loop
1726  * <0          Error
1727  */
1728 static int loadvm_process_command(QEMUFile *f)
1729 {
1730     MigrationIncomingState *mis = migration_incoming_get_current();
1731     uint16_t cmd;
1732     uint16_t len;
1733     uint32_t tmp32;
1734
1735     cmd = qemu_get_be16(f);
1736     len = qemu_get_be16(f);
1737
1738     trace_loadvm_process_command(cmd, len);
1739     if (cmd >= MIG_CMD_MAX || cmd == MIG_CMD_INVALID) {
1740         error_report("MIG_CMD 0x%x unknown (len 0x%x)", cmd, len);
1741         return -EINVAL;
1742     }
1743
1744     if (mig_cmd_args[cmd].len != -1 && mig_cmd_args[cmd].len != len) {
1745         error_report("%s received with bad length - expecting %zu, got %d",
1746                      mig_cmd_args[cmd].name,
1747                      (size_t)mig_cmd_args[cmd].len, len);
1748         return -ERANGE;
1749     }
1750
1751     switch (cmd) {
1752     case MIG_CMD_OPEN_RETURN_PATH:
1753         if (mis->to_src_file) {
1754             error_report("CMD_OPEN_RETURN_PATH called when RP already open");
1755             /* Not really a problem, so don't give up */
1756             return 0;
1757         }
1758         mis->to_src_file = qemu_file_get_return_path(f);
1759         if (!mis->to_src_file) {
1760             error_report("CMD_OPEN_RETURN_PATH failed");
1761             return -1;
1762         }
1763         break;
1764
1765     case MIG_CMD_PING:
1766         tmp32 = qemu_get_be32(f);
1767         trace_loadvm_process_command_ping(tmp32);
1768         if (!mis->to_src_file) {
1769             error_report("CMD_PING (0x%x) received with no return path",
1770                          tmp32);
1771             return -1;
1772         }
1773         migrate_send_rp_pong(mis, tmp32);
1774         break;
1775
1776     case MIG_CMD_PACKAGED:
1777         return loadvm_handle_cmd_packaged(mis);
1778
1779     case MIG_CMD_POSTCOPY_ADVISE:
1780         return loadvm_postcopy_handle_advise(mis);
1781
1782     case MIG_CMD_POSTCOPY_LISTEN:
1783         return loadvm_postcopy_handle_listen(mis);
1784
1785     case MIG_CMD_POSTCOPY_RUN:
1786         return loadvm_postcopy_handle_run(mis);
1787
1788     case MIG_CMD_POSTCOPY_RAM_DISCARD:
1789         return loadvm_postcopy_ram_handle_discard(mis, len);
1790     }
1791
1792     return 0;
1793 }
1794
1795 struct LoadStateEntry {
1796     QLIST_ENTRY(LoadStateEntry) entry;
1797     SaveStateEntry *se;
1798     int section_id;
1799     int version_id;
1800 };
1801
1802 /*
1803  * Read a footer off the wire and check that it matches the expected section
1804  *
1805  * Returns: true if the footer was good
1806  *          false if there is a problem (and calls error_report to say why)
1807  */
1808 static bool check_section_footer(QEMUFile *f, LoadStateEntry *le)
1809 {
1810     uint8_t read_mark;
1811     uint32_t read_section_id;
1812
1813     if (skip_section_footers) {
1814         /* No footer to check */
1815         return true;
1816     }
1817
1818     read_mark = qemu_get_byte(f);
1819
1820     if (read_mark != QEMU_VM_SECTION_FOOTER) {
1821         error_report("Missing section footer for %s", le->se->idstr);
1822         return false;
1823     }
1824
1825     read_section_id = qemu_get_be32(f);
1826     if (read_section_id != le->section_id) {
1827         error_report("Mismatched section id in footer for %s -"
1828                      " read 0x%x expected 0x%x",
1829                      le->se->idstr, read_section_id, le->section_id);
1830         return false;
1831     }
1832
1833     /* All good */
1834     return true;
1835 }
1836
1837 void loadvm_free_handlers(MigrationIncomingState *mis)
1838 {
1839     LoadStateEntry *le, *new_le;
1840
1841     QLIST_FOREACH_SAFE(le, &mis->loadvm_handlers, entry, new_le) {
1842         QLIST_REMOVE(le, entry);
1843         g_free(le);
1844     }
1845 }
1846
1847 static int
1848 qemu_loadvm_section_start_full(QEMUFile *f, MigrationIncomingState *mis)
1849 {
1850     uint32_t instance_id, version_id, section_id;
1851     SaveStateEntry *se;
1852     LoadStateEntry *le;
1853     char idstr[256];
1854     int ret;
1855
1856     /* Read section start */
1857     section_id = qemu_get_be32(f);
1858     if (!qemu_get_counted_string(f, idstr)) {
1859         error_report("Unable to read ID string for section %u",
1860                      section_id);
1861         return -EINVAL;
1862     }
1863     instance_id = qemu_get_be32(f);
1864     version_id = qemu_get_be32(f);
1865
1866     trace_qemu_loadvm_state_section_startfull(section_id, idstr,
1867             instance_id, version_id);
1868     /* Find savevm section */
1869     se = find_se(idstr, instance_id);
1870     if (se == NULL) {
1871         error_report("Unknown savevm section or instance '%s' %d",
1872                      idstr, instance_id);
1873         return -EINVAL;
1874     }
1875
1876     /* Validate version */
1877     if (version_id > se->version_id) {
1878         error_report("savevm: unsupported version %d for '%s' v%d",
1879                      version_id, idstr, se->version_id);
1880         return -EINVAL;
1881     }
1882
1883     /* Validate if it is a device's state */
1884     if (xen_enabled() && se->is_ram) {
1885         error_report("loadvm: %s RAM loading not allowed on Xen", idstr);
1886         return -EINVAL;
1887     }
1888
1889     /* Add entry */
1890     le = g_malloc0(sizeof(*le));
1891
1892     le->se = se;
1893     le->section_id = section_id;
1894     le->version_id = version_id;
1895     QLIST_INSERT_HEAD(&mis->loadvm_handlers, le, entry);
1896
1897     ret = vmstate_load(f, le->se, le->version_id);
1898     if (ret < 0) {
1899         error_report("error while loading state for instance 0x%x of"
1900                      " device '%s'", instance_id, idstr);
1901         return ret;
1902     }
1903     if (!check_section_footer(f, le)) {
1904         return -EINVAL;
1905     }
1906
1907     return 0;
1908 }
1909
1910 static int
1911 qemu_loadvm_section_part_end(QEMUFile *f, MigrationIncomingState *mis)
1912 {
1913     uint32_t section_id;
1914     LoadStateEntry *le;
1915     int ret;
1916
1917     section_id = qemu_get_be32(f);
1918
1919     trace_qemu_loadvm_state_section_partend(section_id);
1920     QLIST_FOREACH(le, &mis->loadvm_handlers, entry) {
1921         if (le->section_id == section_id) {
1922             break;
1923         }
1924     }
1925     if (le == NULL) {
1926         error_report("Unknown savevm section %d", section_id);
1927         return -EINVAL;
1928     }
1929
1930     ret = vmstate_load(f, le->se, le->version_id);
1931     if (ret < 0) {
1932         error_report("error while loading state section id %d(%s)",
1933                      section_id, le->se->idstr);
1934         return ret;
1935     }
1936     if (!check_section_footer(f, le)) {
1937         return -EINVAL;
1938     }
1939
1940     return 0;
1941 }
1942
1943 static int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis)
1944 {
1945     uint8_t section_type;
1946     int ret = 0;
1947
1948     while ((section_type = qemu_get_byte(f)) != QEMU_VM_EOF) {
1949         ret = 0;
1950         trace_qemu_loadvm_state_section(section_type);
1951         switch (section_type) {
1952         case QEMU_VM_SECTION_START:
1953         case QEMU_VM_SECTION_FULL:
1954             ret = qemu_loadvm_section_start_full(f, mis);
1955             if (ret < 0) {
1956                 goto out;
1957             }
1958             break;
1959         case QEMU_VM_SECTION_PART:
1960         case QEMU_VM_SECTION_END:
1961             ret = qemu_loadvm_section_part_end(f, mis);
1962             if (ret < 0) {
1963                 goto out;
1964             }
1965             break;
1966         case QEMU_VM_COMMAND:
1967             ret = loadvm_process_command(f);
1968             trace_qemu_loadvm_state_section_command(ret);
1969             if ((ret < 0) || (ret & LOADVM_QUIT)) {
1970                 goto out;
1971             }
1972             break;
1973         default:
1974             error_report("Unknown savevm section type %d", section_type);
1975             ret = -EINVAL;
1976             goto out;
1977         }
1978     }
1979
1980 out:
1981     if (ret < 0) {
1982         qemu_file_set_error(f, ret);
1983     }
1984     return ret;
1985 }
1986
1987 int qemu_loadvm_state(QEMUFile *f)
1988 {
1989     MigrationIncomingState *mis = migration_incoming_get_current();
1990     Error *local_err = NULL;
1991     unsigned int v;
1992     int ret;
1993
1994     if (qemu_savevm_state_blocked(&local_err)) {
1995         error_report_err(local_err);
1996         return -EINVAL;
1997     }
1998
1999     v = qemu_get_be32(f);
2000     if (v != QEMU_VM_FILE_MAGIC) {
2001         error_report("Not a migration stream");
2002         return -EINVAL;
2003     }
2004
2005     v = qemu_get_be32(f);
2006     if (v == QEMU_VM_FILE_VERSION_COMPAT) {
2007         error_report("SaveVM v2 format is obsolete and don't work anymore");
2008         return -ENOTSUP;
2009     }
2010     if (v != QEMU_VM_FILE_VERSION) {
2011         error_report("Unsupported migration stream version");
2012         return -ENOTSUP;
2013     }
2014
2015     if (!savevm_state.skip_configuration || enforce_config_section()) {
2016         if (qemu_get_byte(f) != QEMU_VM_CONFIGURATION) {
2017             error_report("Configuration section missing");
2018             return -EINVAL;
2019         }
2020         ret = vmstate_load_state(f, &vmstate_configuration, &savevm_state, 0);
2021
2022         if (ret) {
2023             return ret;
2024         }
2025     }
2026
2027     ret = qemu_loadvm_state_main(f, mis);
2028     qemu_event_set(&mis->main_thread_load_event);
2029
2030     trace_qemu_loadvm_state_post_main(ret);
2031
2032     if (mis->have_listen_thread) {
2033         /* Listen thread still going, can't clean up yet */
2034         return ret;
2035     }
2036
2037     if (ret == 0) {
2038         ret = qemu_file_get_error(f);
2039     }
2040
2041     /*
2042      * Try to read in the VMDESC section as well, so that dumping tools that
2043      * intercept our migration stream have the chance to see it.
2044      */
2045
2046     /* We've got to be careful; if we don't read the data and just shut the fd
2047      * then the sender can error if we close while it's still sending.
2048      * We also mustn't read data that isn't there; some transports (RDMA)
2049      * will stall waiting for that data when the source has already closed.
2050      */
2051     if (ret == 0 && should_send_vmdesc()) {
2052         uint8_t *buf;
2053         uint32_t size;
2054         uint8_t  section_type = qemu_get_byte(f);
2055
2056         if (section_type != QEMU_VM_VMDESCRIPTION) {
2057             error_report("Expected vmdescription section, but got %d",
2058                          section_type);
2059             /*
2060              * It doesn't seem worth failing at this point since
2061              * we apparently have an otherwise valid VM state
2062              */
2063         } else {
2064             buf = g_malloc(0x1000);
2065             size = qemu_get_be32(f);
2066
2067             while (size > 0) {
2068                 uint32_t read_chunk = MIN(size, 0x1000);
2069                 qemu_get_buffer(f, buf, read_chunk);
2070                 size -= read_chunk;
2071             }
2072             g_free(buf);
2073         }
2074     }
2075
2076     cpu_synchronize_all_post_init();
2077
2078     return ret;
2079 }
2080
2081 int save_vmstate(Monitor *mon, const char *name)
2082 {
2083     BlockDriverState *bs, *bs1;
2084     QEMUSnapshotInfo sn1, *sn = &sn1, old_sn1, *old_sn = &old_sn1;
2085     int ret = -1;
2086     QEMUFile *f;
2087     int saved_vm_running;
2088     uint64_t vm_state_size;
2089     qemu_timeval tv;
2090     struct tm tm;
2091     Error *local_err = NULL;
2092     AioContext *aio_context;
2093
2094     if (!bdrv_all_can_snapshot(&bs)) {
2095         monitor_printf(mon, "Device '%s' is writable but does not "
2096                        "support snapshots.\n", bdrv_get_device_name(bs));
2097         return ret;
2098     }
2099
2100     /* Delete old snapshots of the same name */
2101     if (name) {
2102         ret = bdrv_all_delete_snapshot(name, &bs1, &local_err);
2103         if (ret < 0) {
2104             error_reportf_err(local_err,
2105                               "Error while deleting snapshot on device '%s': ",
2106                               bdrv_get_device_name(bs1));
2107             return ret;
2108         }
2109     }
2110
2111     bs = bdrv_all_find_vmstate_bs();
2112     if (bs == NULL) {
2113         monitor_printf(mon, "No block device can accept snapshots\n");
2114         return ret;
2115     }
2116     aio_context = bdrv_get_aio_context(bs);
2117
2118     saved_vm_running = runstate_is_running();
2119
2120     ret = global_state_store();
2121     if (ret) {
2122         monitor_printf(mon, "Error saving global state\n");
2123         return ret;
2124     }
2125     vm_stop(RUN_STATE_SAVE_VM);
2126
2127     aio_context_acquire(aio_context);
2128
2129     memset(sn, 0, sizeof(*sn));
2130
2131     /* fill auxiliary fields */
2132     qemu_gettimeofday(&tv);
2133     sn->date_sec = tv.tv_sec;
2134     sn->date_nsec = tv.tv_usec * 1000;
2135     sn->vm_clock_nsec = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
2136
2137     if (name) {
2138         ret = bdrv_snapshot_find(bs, old_sn, name);
2139         if (ret >= 0) {
2140             pstrcpy(sn->name, sizeof(sn->name), old_sn->name);
2141             pstrcpy(sn->id_str, sizeof(sn->id_str), old_sn->id_str);
2142         } else {
2143             pstrcpy(sn->name, sizeof(sn->name), name);
2144         }
2145     } else {
2146         /* cast below needed for OpenBSD where tv_sec is still 'long' */
2147         localtime_r((const time_t *)&tv.tv_sec, &tm);
2148         strftime(sn->name, sizeof(sn->name), "vm-%Y%m%d%H%M%S", &tm);
2149     }
2150
2151     /* save the VM state */
2152     f = qemu_fopen_bdrv(bs, 1);
2153     if (!f) {
2154         monitor_printf(mon, "Could not open VM state file\n");
2155         goto the_end;
2156     }
2157     ret = qemu_savevm_state(f, &local_err);
2158     vm_state_size = qemu_ftell(f);
2159     qemu_fclose(f);
2160     if (ret < 0) {
2161         error_report_err(local_err);
2162         goto the_end;
2163     }
2164
2165     ret = bdrv_all_create_snapshot(sn, bs, vm_state_size, &bs);
2166     if (ret < 0) {
2167         monitor_printf(mon, "Error while creating snapshot on '%s'\n",
2168                        bdrv_get_device_name(bs));
2169         goto the_end;
2170     }
2171
2172     ret = 0;
2173
2174  the_end:
2175     aio_context_release(aio_context);
2176     if (saved_vm_running) {
2177         vm_start();
2178     }
2179     return ret;
2180 }
2181
2182 void hmp_savevm(Monitor *mon, const QDict *qdict)
2183 {
2184     save_vmstate(mon, qdict_get_try_str(qdict, "name"));
2185 }
2186
2187 void qmp_xen_save_devices_state(const char *filename, Error **errp)
2188 {
2189     QEMUFile *f;
2190     QIOChannelFile *ioc;
2191     int saved_vm_running;
2192     int ret;
2193
2194     saved_vm_running = runstate_is_running();
2195     vm_stop(RUN_STATE_SAVE_VM);
2196     global_state_store_running();
2197
2198     ioc = qio_channel_file_new_path(filename, O_WRONLY | O_CREAT, 0660, errp);
2199     if (!ioc) {
2200         goto the_end;
2201     }
2202     qio_channel_set_name(QIO_CHANNEL(ioc), "migration-xen-save-state");
2203     f = qemu_fopen_channel_output(QIO_CHANNEL(ioc));
2204     ret = qemu_save_device_state(f);
2205     qemu_fclose(f);
2206     if (ret < 0) {
2207         error_setg(errp, QERR_IO_ERROR);
2208     }
2209
2210  the_end:
2211     if (saved_vm_running) {
2212         vm_start();
2213     }
2214 }
2215
2216 void qmp_xen_load_devices_state(const char *filename, Error **errp)
2217 {
2218     QEMUFile *f;
2219     QIOChannelFile *ioc;
2220     int ret;
2221
2222     /* Guest must be paused before loading the device state; the RAM state
2223      * will already have been loaded by xc
2224      */
2225     if (runstate_is_running()) {
2226         error_setg(errp, "Cannot update device state while vm is running");
2227         return;
2228     }
2229     vm_stop(RUN_STATE_RESTORE_VM);
2230
2231     ioc = qio_channel_file_new_path(filename, O_RDONLY | O_BINARY, 0, errp);
2232     if (!ioc) {
2233         return;
2234     }
2235     qio_channel_set_name(QIO_CHANNEL(ioc), "migration-xen-load-state");
2236     f = qemu_fopen_channel_input(QIO_CHANNEL(ioc));
2237
2238     ret = qemu_loadvm_state(f);
2239     qemu_fclose(f);
2240     if (ret < 0) {
2241         error_setg(errp, QERR_IO_ERROR);
2242     }
2243     migration_incoming_state_destroy();
2244 }
2245
2246 int load_vmstate(const char *name)
2247 {
2248     BlockDriverState *bs, *bs_vm_state;
2249     QEMUSnapshotInfo sn;
2250     QEMUFile *f;
2251     int ret;
2252     AioContext *aio_context;
2253     MigrationIncomingState *mis = migration_incoming_get_current();
2254
2255     if (!bdrv_all_can_snapshot(&bs)) {
2256         error_report("Device '%s' is writable but does not support snapshots.",
2257                      bdrv_get_device_name(bs));
2258         return -ENOTSUP;
2259     }
2260     ret = bdrv_all_find_snapshot(name, &bs);
2261     if (ret < 0) {
2262         error_report("Device '%s' does not have the requested snapshot '%s'",
2263                      bdrv_get_device_name(bs), name);
2264         return ret;
2265     }
2266
2267     bs_vm_state = bdrv_all_find_vmstate_bs();
2268     if (!bs_vm_state) {
2269         error_report("No block device supports snapshots");
2270         return -ENOTSUP;
2271     }
2272     aio_context = bdrv_get_aio_context(bs_vm_state);
2273
2274     /* Don't even try to load empty VM states */
2275     aio_context_acquire(aio_context);
2276     ret = bdrv_snapshot_find(bs_vm_state, &sn, name);
2277     aio_context_release(aio_context);
2278     if (ret < 0) {
2279         return ret;
2280     } else if (sn.vm_state_size == 0) {
2281         error_report("This is a disk-only snapshot. Revert to it offline "
2282             "using qemu-img.");
2283         return -EINVAL;
2284     }
2285
2286     /* Flush all IO requests so they don't interfere with the new state.  */
2287     bdrv_drain_all();
2288
2289     ret = bdrv_all_goto_snapshot(name, &bs);
2290     if (ret < 0) {
2291         error_report("Error %d while activating snapshot '%s' on '%s'",
2292                      ret, name, bdrv_get_device_name(bs));
2293         return ret;
2294     }
2295
2296     /* restore the VM state */
2297     f = qemu_fopen_bdrv(bs_vm_state, 0);
2298     if (!f) {
2299         error_report("Could not open VM state file");
2300         return -EINVAL;
2301     }
2302
2303     qemu_system_reset(VMRESET_SILENT);
2304     mis->from_src_file = f;
2305
2306     aio_context_acquire(aio_context);
2307     ret = qemu_loadvm_state(f);
2308     qemu_fclose(f);
2309     aio_context_release(aio_context);
2310
2311     migration_incoming_state_destroy();
2312     if (ret < 0) {
2313         error_report("Error %d while loading VM state", ret);
2314         return ret;
2315     }
2316
2317     return 0;
2318 }
2319
2320 void hmp_delvm(Monitor *mon, const QDict *qdict)
2321 {
2322     BlockDriverState *bs;
2323     Error *err;
2324     const char *name = qdict_get_str(qdict, "name");
2325
2326     if (bdrv_all_delete_snapshot(name, &bs, &err) < 0) {
2327         error_reportf_err(err,
2328                           "Error while deleting snapshot on device '%s': ",
2329                           bdrv_get_device_name(bs));
2330     }
2331 }
2332
2333 void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
2334 {
2335     BlockDriverState *bs, *bs1;
2336     BdrvNextIterator it1;
2337     QEMUSnapshotInfo *sn_tab, *sn;
2338     bool no_snapshot = true;
2339     int nb_sns, i;
2340     int total;
2341     int *global_snapshots;
2342     AioContext *aio_context;
2343
2344     typedef struct SnapshotEntry {
2345         QEMUSnapshotInfo sn;
2346         QTAILQ_ENTRY(SnapshotEntry) next;
2347     } SnapshotEntry;
2348
2349     typedef struct ImageEntry {
2350         const char *imagename;
2351         QTAILQ_ENTRY(ImageEntry) next;
2352         QTAILQ_HEAD(, SnapshotEntry) snapshots;
2353     } ImageEntry;
2354
2355     QTAILQ_HEAD(, ImageEntry) image_list =
2356         QTAILQ_HEAD_INITIALIZER(image_list);
2357
2358     ImageEntry *image_entry, *next_ie;
2359     SnapshotEntry *snapshot_entry;
2360
2361     bs = bdrv_all_find_vmstate_bs();
2362     if (!bs) {
2363         monitor_printf(mon, "No available block device supports snapshots\n");
2364         return;
2365     }
2366     aio_context = bdrv_get_aio_context(bs);
2367
2368     aio_context_acquire(aio_context);
2369     nb_sns = bdrv_snapshot_list(bs, &sn_tab);
2370     aio_context_release(aio_context);
2371
2372     if (nb_sns < 0) {
2373         monitor_printf(mon, "bdrv_snapshot_list: error %d\n", nb_sns);
2374         return;
2375     }
2376
2377     for (bs1 = bdrv_first(&it1); bs1; bs1 = bdrv_next(&it1)) {
2378         int bs1_nb_sns = 0;
2379         ImageEntry *ie;
2380         SnapshotEntry *se;
2381         AioContext *ctx = bdrv_get_aio_context(bs1);
2382
2383         aio_context_acquire(ctx);
2384         if (bdrv_can_snapshot(bs1)) {
2385             sn = NULL;
2386             bs1_nb_sns = bdrv_snapshot_list(bs1, &sn);
2387             if (bs1_nb_sns > 0) {
2388                 no_snapshot = false;
2389                 ie = g_new0(ImageEntry, 1);
2390                 ie->imagename = bdrv_get_device_name(bs1);
2391                 QTAILQ_INIT(&ie->snapshots);
2392                 QTAILQ_INSERT_TAIL(&image_list, ie, next);
2393                 for (i = 0; i < bs1_nb_sns; i++) {
2394                     se = g_new0(SnapshotEntry, 1);
2395                     se->sn = sn[i];
2396                     QTAILQ_INSERT_TAIL(&ie->snapshots, se, next);
2397                 }
2398             }
2399             g_free(sn);
2400         }
2401         aio_context_release(ctx);
2402     }
2403
2404     if (no_snapshot) {
2405         monitor_printf(mon, "There is no snapshot available.\n");
2406         return;
2407     }
2408
2409     global_snapshots = g_new0(int, nb_sns);
2410     total = 0;
2411     for (i = 0; i < nb_sns; i++) {
2412         SnapshotEntry *next_sn;
2413         if (bdrv_all_find_snapshot(sn_tab[i].name, &bs1) == 0) {
2414             global_snapshots[total] = i;
2415             total++;
2416             QTAILQ_FOREACH(image_entry, &image_list, next) {
2417                 QTAILQ_FOREACH_SAFE(snapshot_entry, &image_entry->snapshots,
2418                                     next, next_sn) {
2419                     if (!strcmp(sn_tab[i].name, snapshot_entry->sn.name)) {
2420                         QTAILQ_REMOVE(&image_entry->snapshots, snapshot_entry,
2421                                       next);
2422                         g_free(snapshot_entry);
2423                     }
2424                 }
2425             }
2426         }
2427     }
2428
2429     monitor_printf(mon, "List of snapshots present on all disks:\n");
2430
2431     if (total > 0) {
2432         bdrv_snapshot_dump((fprintf_function)monitor_printf, mon, NULL);
2433         monitor_printf(mon, "\n");
2434         for (i = 0; i < total; i++) {
2435             sn = &sn_tab[global_snapshots[i]];
2436             /* The ID is not guaranteed to be the same on all images, so
2437              * overwrite it.
2438              */
2439             pstrcpy(sn->id_str, sizeof(sn->id_str), "--");
2440             bdrv_snapshot_dump((fprintf_function)monitor_printf, mon, sn);
2441             monitor_printf(mon, "\n");
2442         }
2443     } else {
2444         monitor_printf(mon, "None\n");
2445     }
2446
2447     QTAILQ_FOREACH(image_entry, &image_list, next) {
2448         if (QTAILQ_EMPTY(&image_entry->snapshots)) {
2449             continue;
2450         }
2451         monitor_printf(mon,
2452                        "\nList of partial (non-loadable) snapshots on '%s':\n",
2453                        image_entry->imagename);
2454         bdrv_snapshot_dump((fprintf_function)monitor_printf, mon, NULL);
2455         monitor_printf(mon, "\n");
2456         QTAILQ_FOREACH(snapshot_entry, &image_entry->snapshots, next) {
2457             bdrv_snapshot_dump((fprintf_function)monitor_printf, mon,
2458                                &snapshot_entry->sn);
2459             monitor_printf(mon, "\n");
2460         }
2461     }
2462
2463     QTAILQ_FOREACH_SAFE(image_entry, &image_list, next, next_ie) {
2464         SnapshotEntry *next_sn;
2465         QTAILQ_FOREACH_SAFE(snapshot_entry, &image_entry->snapshots, next,
2466                             next_sn) {
2467             g_free(snapshot_entry);
2468         }
2469         g_free(image_entry);
2470     }
2471     g_free(sn_tab);
2472     g_free(global_snapshots);
2473
2474 }
2475
2476 void vmstate_register_ram(MemoryRegion *mr, DeviceState *dev)
2477 {
2478     qemu_ram_set_idstr(mr->ram_block,
2479                        memory_region_name(mr), dev);
2480 }
2481
2482 void vmstate_unregister_ram(MemoryRegion *mr, DeviceState *dev)
2483 {
2484     qemu_ram_unset_idstr(mr->ram_block);
2485 }
2486
2487 void vmstate_register_ram_global(MemoryRegion *mr)
2488 {
2489     vmstate_register_ram(mr, NULL);
2490 }