migration/savevm.c

   1 /*
   2  * QEMU System Emulator
   3  *
   4  * Copyright (c) 2003-2008 Fabrice Bellard
   5  * Copyright (c) 2009-2015 Red Hat Inc
   6  *
   7  * Authors:
   8  *  Juan Quintela <[email protected]>
   9  *
  10  * Permission is hereby granted, free of charge, to any person obtaining a copy
  11  * of this software and associated documentation files (the "Software"), to deal
  12  * in the Software without restriction, including without limitation the rights
  13  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  14  * copies of the Software, and to permit persons to whom the Software is
  15  * furnished to do so, subject to the following conditions:
  16  *
  17  * The above copyright notice and this permission notice shall be included in
  18  * all copies or substantial portions of the Software.
  19  *
  20  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  21  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  23  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  24  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  25  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  26  * THE SOFTWARE.
  27  */
  28
  29 #include "qemu/osdep.h"
  30 #include "hw/boards.h"
  31 #include "hw/hw.h"
  32 #include "hw/qdev.h"
  33 #include "hw/xen/xen.h"
  34 #include "net/net.h"
  35 #include "sysemu/sysemu.h"
  36 #include "qemu/timer.h"
  37 #include "migration/migration.h"
  38 #include "qemu-file-channel.h"
  39 #include "postcopy-ram.h"
  40 #include "qapi/qmp/qerror.h"
  41 #include "qemu/error-report.h"
  42 #include "qemu/queue.h"
  43 #include "sysemu/cpus.h"
  44 #include "exec/memory.h"
  45 #include "exec/target_page.h"
  46 #include "qmp-commands.h"
  47 #include "trace.h"
  48 #include "qemu/bitops.h"
  49 #include "qemu/iov.h"
  50 #include "block/snapshot.h"
  51 #include "qemu/cutils.h"
  52 #include "io/channel-buffer.h"
  53 #include "io/channel-file.h"
  54
  55 #ifndef ETH_P_RARP
  56 #define ETH_P_RARP 0x8035
  57 #endif
  58 #define ARP_HTYPE_ETH 0x0001
  59 #define ARP_PTYPE_IP 0x0800
  60 #define ARP_OP_REQUEST_REV 0x3
  61
  62 const unsigned int postcopy_ram_discard_version = 0;
  63
  64 static bool skip_section_footers;
  65
  66 static struct mig_cmd_args {
  67     ssize_t     len; /* -1 = variable */
  68     const char *name;
  69 } mig_cmd_args[] = {
  70     [MIG_CMD_INVALID]          = { .len = -1, .name = "INVALID" },
  71     [MIG_CMD_OPEN_RETURN_PATH] = { .len =  0, .name = "OPEN_RETURN_PATH" },
  72     [MIG_CMD_PING]             = { .len = sizeof(uint32_t), .name = "PING" },
  73     [MIG_CMD_POSTCOPY_ADVISE]  = { .len = 16, .name = "POSTCOPY_ADVISE" },
  74     [MIG_CMD_POSTCOPY_LISTEN]  = { .len =  0, .name = "POSTCOPY_LISTEN" },
  75     [MIG_CMD_POSTCOPY_RUN]     = { .len =  0, .name = "POSTCOPY_RUN" },
  76     [MIG_CMD_POSTCOPY_RAM_DISCARD] = {
  77                                    .len = -1, .name = "POSTCOPY_RAM_DISCARD" },
  78     [MIG_CMD_PACKAGED]         = { .len =  4, .name = "PACKAGED" },
  79     [MIG_CMD_MAX]              = { .len = -1, .name = "MAX" },
  80 };
  81
  82 static int announce_self_create(uint8_t *buf,
  83                                 uint8_t *mac_addr)
  84 {
  85     /* Ethernet header. */
  86     memset(buf, 0xff, 6);         /* destination MAC addr */
  87     memcpy(buf + 6, mac_addr, 6); /* source MAC addr */
  88     *(uint16_t *)(buf + 12) = htons(ETH_P_RARP); /* ethertype */
  89
  90     /* RARP header. */
  91     *(uint16_t *)(buf + 14) = htons(ARP_HTYPE_ETH); /* hardware addr space */
  92     *(uint16_t *)(buf + 16) = htons(ARP_PTYPE_IP); /* protocol addr space */
  93     *(buf + 18) = 6; /* hardware addr length (ethernet) */
  94     *(buf + 19) = 4; /* protocol addr length (IPv4) */
  95     *(uint16_t *)(buf + 20) = htons(ARP_OP_REQUEST_REV); /* opcode */
  96     memcpy(buf + 22, mac_addr, 6); /* source hw addr */
  97     memset(buf + 28, 0x00, 4);     /* source protocol addr */
  98     memcpy(buf + 32, mac_addr, 6); /* target hw addr */
  99     memset(buf + 38, 0x00, 4);     /* target protocol addr */
 100
 101     /* Padding to get up to 60 bytes (ethernet min packet size, minus FCS). */
 102     memset(buf + 42, 0x00, 18);
 103
 104     return 60; /* len (FCS will be added by hardware) */
 105 }
 106
 107 static void qemu_announce_self_iter(NICState *nic, void *opaque)
 108 {
 109     uint8_t buf[60];
 110     int len;
 111
 112     trace_qemu_announce_self_iter(qemu_ether_ntoa(&nic->conf->macaddr));
 113     len = announce_self_create(buf, nic->conf->macaddr.a);
 114
 115     qemu_send_packet_raw(qemu_get_queue(nic), buf, len);
 116 }
 117
 118
 119 static void qemu_announce_self_once(void *opaque)
 120 {
 121     static int count = SELF_ANNOUNCE_ROUNDS;
 122     QEMUTimer *timer = *(QEMUTimer **)opaque;
 123
 124     qemu_foreach_nic(qemu_announce_self_iter, NULL);
 125
 126     if (--count) {
 127         /* delay 50ms, 150ms, 250ms, ... */
 128         timer_mod(timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) +
 129                   self_announce_delay(count));
 130     } else {
 131             timer_del(timer);
 132             timer_free(timer);
 133     }
 134 }
 135
 136 void qemu_announce_self(void)
 137 {
 138     static QEMUTimer *timer;
 139     timer = timer_new_ms(QEMU_CLOCK_REALTIME, qemu_announce_self_once, &timer);
 140     qemu_announce_self_once(&timer);
 141 }
 142
 143 /***********************************************************/
 144 /* savevm/loadvm support */
 145
 146 static ssize_t block_writev_buffer(void *opaque, struct iovec *iov, int iovcnt,
 147                                    int64_t pos)
 148 {
 149     int ret;
 150     QEMUIOVector qiov;
 151
 152     qemu_iovec_init_external(&qiov, iov, iovcnt);
 153     ret = bdrv_writev_vmstate(opaque, &qiov, pos);
 154     if (ret < 0) {
 155         return ret;
 156     }
 157
 158     return qiov.size;
 159 }
 160
 161 static ssize_t block_get_buffer(void *opaque, uint8_t *buf, int64_t pos,
 162                                 size_t size)
 163 {
 164     return bdrv_load_vmstate(opaque, buf, pos, size);
 165 }
 166
 167 static int bdrv_fclose(void *opaque)
 168 {
 169     return bdrv_flush(opaque);
 170 }
 171
 172 static const QEMUFileOps bdrv_read_ops = {
 173     .get_buffer = block_get_buffer,
 174     .close =      bdrv_fclose
 175 };
 176
 177 static const QEMUFileOps bdrv_write_ops = {
 178     .writev_buffer  = block_writev_buffer,
 179     .close          = bdrv_fclose
 180 };
 181
 182 static QEMUFile *qemu_fopen_bdrv(BlockDriverState *bs, int is_writable)
 183 {
 184     if (is_writable) {
 185         return qemu_fopen_ops(bs, &bdrv_write_ops);
 186     }
 187     return qemu_fopen_ops(bs, &bdrv_read_ops);
 188 }
 189
 190
 191 /* QEMUFile timer support.
 192  * Not in qemu-file.c to not add qemu-timer.c as dependency to qemu-file.c
 193  */
 194
 195 void timer_put(QEMUFile *f, QEMUTimer *ts)
 196 {
 197     uint64_t expire_time;
 198
 199     expire_time = timer_expire_time_ns(ts);
 200     qemu_put_be64(f, expire_time);
 201 }
 202
 203 void timer_get(QEMUFile *f, QEMUTimer *ts)
 204 {
 205     uint64_t expire_time;
 206
 207     expire_time = qemu_get_be64(f);
 208     if (expire_time != -1) {
 209         timer_mod_ns(ts, expire_time);
 210     } else {
 211         timer_del(ts);
 212     }
 213 }
 214
 215
 216 /* VMState timer support.
 217  * Not in vmstate.c to not add qemu-timer.c as dependency to vmstate.c
 218  */
 219
 220 static int get_timer(QEMUFile *f, void *pv, size_t size, VMStateField *field)
 221 {
 222     QEMUTimer *v = pv;
 223     timer_get(f, v);
 224     return 0;
 225 }
 226
 227 static int put_timer(QEMUFile *f, void *pv, size_t size, VMStateField *field,
 228                      QJSON *vmdesc)
 229 {
 230     QEMUTimer *v = pv;
 231     timer_put(f, v);
 232
 233     return 0;
 234 }
 235
 236 const VMStateInfo vmstate_info_timer = {
 237     .name = "timer",
 238     .get  = get_timer,
 239     .put  = put_timer,
 240 };
 241
 242
 243 typedef struct CompatEntry {
 244     char idstr[256];
 245     int instance_id;
 246 } CompatEntry;
 247
 248 typedef struct SaveStateEntry {
 249     QTAILQ_ENTRY(SaveStateEntry) entry;
 250     char idstr[256];
 251     int instance_id;
 252     int alias_id;
 253     int version_id;
 254     int section_id;
 255     SaveVMHandlers *ops;
 256     const VMStateDescription *vmsd;
 257     void *opaque;
 258     CompatEntry *compat;
 259     int is_ram;
 260 } SaveStateEntry;
 261
 262 typedef struct SaveState {
 263     QTAILQ_HEAD(, SaveStateEntry) handlers;
 264     int global_section_id;
 265     bool skip_configuration;
 266     uint32_t len;
 267     const char *name;
 268     uint32_t target_page_bits;
 269 } SaveState;
 270
 271 static SaveState savevm_state = {
 272     .handlers = QTAILQ_HEAD_INITIALIZER(savevm_state.handlers),
 273     .global_section_id = 0,
 274     .skip_configuration = false,
 275 };
 276
 277 void savevm_skip_configuration(void)
 278 {
 279     savevm_state.skip_configuration = true;
 280 }
 281
 282
 283 static void configuration_pre_save(void *opaque)
 284 {
 285     SaveState *state = opaque;
 286     const char *current_name = MACHINE_GET_CLASS(current_machine)->name;
 287
 288     state->len = strlen(current_name);
 289     state->name = current_name;
 290     state->target_page_bits = qemu_target_page_bits();
 291 }
 292
 293 static int configuration_pre_load(void *opaque)
 294 {
 295     SaveState *state = opaque;
 296
 297     /* If there is no target-page-bits subsection it means the source
 298      * predates the variable-target-page-bits support and is using the
 299      * minimum possible value for this CPU.
 300      */
 301     state->target_page_bits = qemu_target_page_bits_min();
 302     return 0;
 303 }
 304
 305 static int configuration_post_load(void *opaque, int version_id)
 306 {
 307     SaveState *state = opaque;
 308     const char *current_name = MACHINE_GET_CLASS(current_machine)->name;
 309
 310     if (strncmp(state->name, current_name, state->len) != 0) {
 311         error_report("Machine type received is '%.*s' and local is '%s'",
 312                      (int) state->len, state->name, current_name);
 313         return -EINVAL;
 314     }
 315
 316     if (state->target_page_bits != qemu_target_page_bits()) {
 317         error_report("Received TARGET_PAGE_BITS is %d but local is %d",
 318                      state->target_page_bits, qemu_target_page_bits());
 319         return -EINVAL;
 320     }
 321
 322     return 0;
 323 }
 324
 325 /* The target-page-bits subsection is present only if the
 326  * target page size is not the same as the default (ie the
 327  * minimum page size for a variable-page-size guest CPU).
 328  * If it is present then it contains the actual target page
 329  * bits for the machine, and migration will fail if the
 330  * two ends don't agree about it.
 331  */
 332 static bool vmstate_target_page_bits_needed(void *opaque)
 333 {
 334     return qemu_target_page_bits()
 335         > qemu_target_page_bits_min();
 336 }
 337
 338 static const VMStateDescription vmstate_target_page_bits = {
 339     .name = "configuration/target-page-bits",
 340     .version_id = 1,
 341     .minimum_version_id = 1,
 342     .needed = vmstate_target_page_bits_needed,
 343     .fields = (VMStateField[]) {
 344         VMSTATE_UINT32(target_page_bits, SaveState),
 345         VMSTATE_END_OF_LIST()
 346     }
 347 };
 348
 349 static const VMStateDescription vmstate_configuration = {
 350     .name = "configuration",
 351     .version_id = 1,
 352     .pre_load = configuration_pre_load,
 353     .post_load = configuration_post_load,
 354     .pre_save = configuration_pre_save,
 355     .fields = (VMStateField[]) {
 356         VMSTATE_UINT32(len, SaveState),
 357         VMSTATE_VBUFFER_ALLOC_UINT32(name, SaveState, 0, NULL, len),
 358         VMSTATE_END_OF_LIST()
 359     },
 360     .subsections = (const VMStateDescription*[]) {
 361         &vmstate_target_page_bits,
 362         NULL
 363     }
 364 };
 365
 366 static void dump_vmstate_vmsd(FILE *out_file,
 367                               const VMStateDescription *vmsd, int indent,
 368                               bool is_subsection);
 369
 370 static void dump_vmstate_vmsf(FILE *out_file, const VMStateField *field,
 371                               int indent)
 372 {
 373     fprintf(out_file, "%*s{\n", indent, "");
 374     indent += 2;
 375     fprintf(out_file, "%*s\"field\": \"%s\",\n", indent, "", field->name);
 376     fprintf(out_file, "%*s\"version_id\": %d,\n", indent, "",
 377             field->version_id);
 378     fprintf(out_file, "%*s\"field_exists\": %s,\n", indent, "",
 379             field->field_exists ? "true" : "false");
 380     fprintf(out_file, "%*s\"size\": %zu", indent, "", field->size);
 381     if (field->vmsd != NULL) {
 382         fprintf(out_file, ",\n");
 383         dump_vmstate_vmsd(out_file, field->vmsd, indent, false);
 384     }
 385     fprintf(out_file, "\n%*s}", indent - 2, "");
 386 }
 387
 388 static void dump_vmstate_vmss(FILE *out_file,
 389                               const VMStateDescription **subsection,
 390                               int indent)
 391 {
 392     if (*subsection != NULL) {
 393         dump_vmstate_vmsd(out_file, *subsection, indent, true);
 394     }
 395 }
 396
 397 static void dump_vmstate_vmsd(FILE *out_file,
 398                               const VMStateDescription *vmsd, int indent,
 399                               bool is_subsection)
 400 {
 401     if (is_subsection) {
 402         fprintf(out_file, "%*s{\n", indent, "");
 403     } else {
 404         fprintf(out_file, "%*s\"%s\": {\n", indent, "", "Description");
 405     }
 406     indent += 2;
 407     fprintf(out_file, "%*s\"name\": \"%s\",\n", indent, "", vmsd->name);
 408     fprintf(out_file, "%*s\"version_id\": %d,\n", indent, "",
 409             vmsd->version_id);
 410     fprintf(out_file, "%*s\"minimum_version_id\": %d", indent, "",
 411             vmsd->minimum_version_id);
 412     if (vmsd->fields != NULL) {
 413         const VMStateField *field = vmsd->fields;
 414         bool first;
 415
 416         fprintf(out_file, ",\n%*s\"Fields\": [\n", indent, "");
 417         first = true;
 418         while (field->name != NULL) {
 419             if (field->flags & VMS_MUST_EXIST) {
 420                 /* Ignore VMSTATE_VALIDATE bits; these don't get migrated */
 421                 field++;
 422                 continue;
 423             }
 424             if (!first) {
 425                 fprintf(out_file, ",\n");
 426             }
 427             dump_vmstate_vmsf(out_file, field, indent + 2);
 428             field++;
 429             first = false;
 430         }
 431         fprintf(out_file, "\n%*s]", indent, "");
 432     }
 433     if (vmsd->subsections != NULL) {
 434         const VMStateDescription **subsection = vmsd->subsections;
 435         bool first;
 436
 437         fprintf(out_file, ",\n%*s\"Subsections\": [\n", indent, "");
 438         first = true;
 439         while (*subsection != NULL) {
 440             if (!first) {
 441                 fprintf(out_file, ",\n");
 442             }
 443             dump_vmstate_vmss(out_file, subsection, indent + 2);
 444             subsection++;
 445             first = false;
 446         }
 447         fprintf(out_file, "\n%*s]", indent, "");
 448     }
 449     fprintf(out_file, "\n%*s}", indent - 2, "");
 450 }
 451
 452 static void dump_machine_type(FILE *out_file)
 453 {
 454     MachineClass *mc;
 455
 456     mc = MACHINE_GET_CLASS(current_machine);
 457
 458     fprintf(out_file, "  \"vmschkmachine\": {\n");
 459     fprintf(out_file, "    \"Name\": \"%s\"\n", mc->name);
 460     fprintf(out_file, "  },\n");
 461 }
 462
 463 void dump_vmstate_json_to_file(FILE *out_file)
 464 {
 465     GSList *list, *elt;
 466     bool first;
 467
 468     fprintf(out_file, "{\n");
 469     dump_machine_type(out_file);
 470
 471     first = true;
 472     list = object_class_get_list(TYPE_DEVICE, true);
 473     for (elt = list; elt; elt = elt->next) {
 474         DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, elt->data,
 475                                              TYPE_DEVICE);
 476         const char *name;
 477         int indent = 2;
 478
 479         if (!dc->vmsd) {
 480             continue;
 481         }
 482
 483         if (!first) {
 484             fprintf(out_file, ",\n");
 485         }
 486         name = object_class_get_name(OBJECT_CLASS(dc));
 487         fprintf(out_file, "%*s\"%s\": {\n", indent, "", name);
 488         indent += 2;
 489         fprintf(out_file, "%*s\"Name\": \"%s\",\n", indent, "", name);
 490         fprintf(out_file, "%*s\"version_id\": %d,\n", indent, "",
 491                 dc->vmsd->version_id);
 492         fprintf(out_file, "%*s\"minimum_version_id\": %d,\n", indent, "",
 493                 dc->vmsd->minimum_version_id);
 494
 495         dump_vmstate_vmsd(out_file, dc->vmsd, indent, false);
 496
 497         fprintf(out_file, "\n%*s}", indent - 2, "");
 498         first = false;
 499     }
 500     fprintf(out_file, "\n}\n");
 501     fclose(out_file);
 502 }
 503
 504 static int calculate_new_instance_id(const char *idstr)
 505 {
 506     SaveStateEntry *se;
 507     int instance_id = 0;
 508
 509     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
 510         if (strcmp(idstr, se->idstr) == 0
 511             && instance_id <= se->instance_id) {
 512             instance_id = se->instance_id + 1;
 513         }
 514     }
 515     return instance_id;
 516 }
 517
 518 static int calculate_compat_instance_id(const char *idstr)
 519 {
 520     SaveStateEntry *se;
 521     int instance_id = 0;
 522
 523     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
 524         if (!se->compat) {
 525             continue;
 526         }
 527
 528         if (strcmp(idstr, se->compat->idstr) == 0
 529             && instance_id <= se->compat->instance_id) {
 530             instance_id = se->compat->instance_id + 1;
 531         }
 532     }
 533     return instance_id;
 534 }
 535
 536 static inline MigrationPriority save_state_priority(SaveStateEntry *se)
 537 {
 538     if (se->vmsd) {
 539         return se->vmsd->priority;
 540     }
 541     return MIG_PRI_DEFAULT;
 542 }
 543
 544 static void savevm_state_handler_insert(SaveStateEntry *nse)
 545 {
 546     MigrationPriority priority = save_state_priority(nse);
 547     SaveStateEntry *se;
 548
 549     assert(priority <= MIG_PRI_MAX);
 550
 551     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
 552         if (save_state_priority(se) < priority) {
 553             break;
 554         }
 555     }
 556
 557     if (se) {
 558         QTAILQ_INSERT_BEFORE(se, nse, entry);
 559     } else {
 560         QTAILQ_INSERT_TAIL(&savevm_state.handlers, nse, entry);
 561     }
 562 }
 563
 564 /* TODO: Individual devices generally have very little idea about the rest
 565    of the system, so instance_id should be removed/replaced.
 566    Meanwhile pass -1 as instance_id if you do not already have a clearly
 567    distinguishing id for all instances of your device class. */
 568 int register_savevm_live(DeviceState *dev,
 569                          const char *idstr,
 570                          int instance_id,
 571                          int version_id,
 572                          SaveVMHandlers *ops,
 573                          void *opaque)
 574 {
 575     SaveStateEntry *se;
 576
 577     se = g_new0(SaveStateEntry, 1);
 578     se->version_id = version_id;
 579     se->section_id = savevm_state.global_section_id++;
 580     se->ops = ops;
 581     se->opaque = opaque;
 582     se->vmsd = NULL;
 583     /* if this is a live_savem then set is_ram */
 584     if (ops->save_live_setup != NULL) {
 585         se->is_ram = 1;
 586     }
 587
 588     if (dev) {
 589         char *id = qdev_get_dev_path(dev);
 590         if (id) {
 591             if (snprintf(se->idstr, sizeof(se->idstr), "%s/", id) >=
 592                 sizeof(se->idstr)) {
 593                 error_report("Path too long for VMState (%s)", id);
 594                 g_free(id);
 595                 g_free(se);
 596
 597                 return -1;
 598             }
 599             g_free(id);
 600
 601             se->compat = g_new0(CompatEntry, 1);
 602             pstrcpy(se->compat->idstr, sizeof(se->compat->idstr), idstr);
 603             se->compat->instance_id = instance_id == -1 ?
 604                          calculate_compat_instance_id(idstr) : instance_id;
 605             instance_id = -1;
 606         }
 607     }
 608     pstrcat(se->idstr, sizeof(se->idstr), idstr);
 609
 610     if (instance_id == -1) {
 611         se->instance_id = calculate_new_instance_id(se->idstr);
 612     } else {
 613         se->instance_id = instance_id;
 614     }
 615     assert(!se->compat || se->instance_id == 0);
 616     savevm_state_handler_insert(se);
 617     return 0;
 618 }
 619
 620 int register_savevm(DeviceState *dev,
 621                     const char *idstr,
 622                     int instance_id,
 623                     int version_id,
 624                     SaveStateHandler *save_state,
 625                     LoadStateHandler *load_state,
 626                     void *opaque)
 627 {
 628     SaveVMHandlers *ops = g_new0(SaveVMHandlers, 1);
 629     ops->save_state = save_state;
 630     ops->load_state = load_state;
 631     return register_savevm_live(dev, idstr, instance_id, version_id,
 632                                 ops, opaque);
 633 }
 634
 635 void unregister_savevm(DeviceState *dev, const char *idstr, void *opaque)
 636 {
 637     SaveStateEntry *se, *new_se;
 638     char id[256] = "";
 639
 640     if (dev) {
 641         char *path = qdev_get_dev_path(dev);
 642         if (path) {
 643             pstrcpy(id, sizeof(id), path);
 644             pstrcat(id, sizeof(id), "/");
 645             g_free(path);
 646         }
 647     }
 648     pstrcat(id, sizeof(id), idstr);
 649
 650     QTAILQ_FOREACH_SAFE(se, &savevm_state.handlers, entry, new_se) {
 651         if (strcmp(se->idstr, id) == 0 && se->opaque == opaque) {
 652             QTAILQ_REMOVE(&savevm_state.handlers, se, entry);
 653             g_free(se->compat);
 654             g_free(se->ops);
 655             g_free(se);
 656         }
 657     }
 658 }
 659
 660 int vmstate_register_with_alias_id(DeviceState *dev, int instance_id,
 661                                    const VMStateDescription *vmsd,
 662                                    void *opaque, int alias_id,
 663                                    int required_for_version,
 664                                    Error **errp)
 665 {
 666     SaveStateEntry *se;
 667
 668     /* If this triggers, alias support can be dropped for the vmsd. */
 669     assert(alias_id == -1 || required_for_version >= vmsd->minimum_version_id);
 670
 671     se = g_new0(SaveStateEntry, 1);
 672     se->version_id = vmsd->version_id;
 673     se->section_id = savevm_state.global_section_id++;
 674     se->opaque = opaque;
 675     se->vmsd = vmsd;
 676     se->alias_id = alias_id;
 677
 678     if (dev) {
 679         char *id = qdev_get_dev_path(dev);
 680         if (id) {
 681             if (snprintf(se->idstr, sizeof(se->idstr), "%s/", id) >=
 682                 sizeof(se->idstr)) {
 683                 error_setg(errp, "Path too long for VMState (%s)", id);
 684                 g_free(id);
 685                 g_free(se);
 686
 687                 return -1;
 688             }
 689             g_free(id);
 690
 691             se->compat = g_new0(CompatEntry, 1);
 692             pstrcpy(se->compat->idstr, sizeof(se->compat->idstr), vmsd->name);
 693             se->compat->instance_id = instance_id == -1 ?
 694                          calculate_compat_instance_id(vmsd->name) : instance_id;
 695             instance_id = -1;
 696         }
 697     }
 698     pstrcat(se->idstr, sizeof(se->idstr), vmsd->name);
 699
 700     if (instance_id == -1) {
 701         se->instance_id = calculate_new_instance_id(se->idstr);
 702     } else {
 703         se->instance_id = instance_id;
 704     }
 705     assert(!se->compat || se->instance_id == 0);
 706     savevm_state_handler_insert(se);
 707     return 0;
 708 }
 709
 710 void vmstate_unregister(DeviceState *dev, const VMStateDescription *vmsd,
 711                         void *opaque)
 712 {
 713     SaveStateEntry *se, *new_se;
 714
 715     QTAILQ_FOREACH_SAFE(se, &savevm_state.handlers, entry, new_se) {
 716         if (se->vmsd == vmsd && se->opaque == opaque) {
 717             QTAILQ_REMOVE(&savevm_state.handlers, se, entry);
 718             g_free(se->compat);
 719             g_free(se);
 720         }
 721     }
 722 }
 723
 724 static int vmstate_load(QEMUFile *f, SaveStateEntry *se, int version_id)
 725 {
 726     trace_vmstate_load(se->idstr, se->vmsd ? se->vmsd->name : "(old)");
 727     if (!se->vmsd) {         /* Old style */
 728         return se->ops->load_state(f, se->opaque, version_id);
 729     }
 730     return vmstate_load_state(f, se->vmsd, se->opaque, version_id);
 731 }
 732
 733 static void vmstate_save_old_style(QEMUFile *f, SaveStateEntry *se, QJSON *vmdesc)
 734 {
 735     int64_t old_offset, size;
 736
 737     old_offset = qemu_ftell_fast(f);
 738     se->ops->save_state(f, se->opaque);
 739     size = qemu_ftell_fast(f) - old_offset;
 740
 741     if (vmdesc) {
 742         json_prop_int(vmdesc, "size", size);
 743         json_start_array(vmdesc, "fields");
 744         json_start_object(vmdesc, NULL);
 745         json_prop_str(vmdesc, "name", "data");
 746         json_prop_int(vmdesc, "size", size);
 747         json_prop_str(vmdesc, "type", "buffer");
 748         json_end_object(vmdesc);
 749         json_end_array(vmdesc);
 750     }
 751 }
 752
 753 static void vmstate_save(QEMUFile *f, SaveStateEntry *se, QJSON *vmdesc)
 754 {
 755     trace_vmstate_save(se->idstr, se->vmsd ? se->vmsd->name : "(old)");
 756     if (!se->vmsd) {
 757         vmstate_save_old_style(f, se, vmdesc);
 758         return;
 759     }
 760     vmstate_save_state(f, se->vmsd, se->opaque, vmdesc);
 761 }
 762
 763 void savevm_skip_section_footers(void)
 764 {
 765     skip_section_footers = true;
 766 }
 767
 768 /*
 769  * Write the header for device section (QEMU_VM_SECTION START/END/PART/FULL)
 770  */
 771 static void save_section_header(QEMUFile *f, SaveStateEntry *se,
 772                                 uint8_t section_type)
 773 {
 774     qemu_put_byte(f, section_type);
 775     qemu_put_be32(f, se->section_id);
 776
 777     if (section_type == QEMU_VM_SECTION_FULL ||
 778         section_type == QEMU_VM_SECTION_START) {
 779         /* ID string */
 780         size_t len = strlen(se->idstr);
 781         qemu_put_byte(f, len);
 782         qemu_put_buffer(f, (uint8_t *)se->idstr, len);
 783
 784         qemu_put_be32(f, se->instance_id);
 785         qemu_put_be32(f, se->version_id);
 786     }
 787 }
 788
 789 /*
 790  * Write a footer onto device sections that catches cases misformatted device
 791  * sections.
 792  */
 793 static void save_section_footer(QEMUFile *f, SaveStateEntry *se)
 794 {
 795     if (!skip_section_footers) {
 796         qemu_put_byte(f, QEMU_VM_SECTION_FOOTER);
 797         qemu_put_be32(f, se->section_id);
 798     }
 799 }
 800
 801 /**
 802  * qemu_savevm_command_send: Send a 'QEMU_VM_COMMAND' type element with the
 803  *                           command and associated data.
 804  *
 805  * @f: File to send command on
 806  * @command: Command type to send
 807  * @len: Length of associated data
 808  * @data: Data associated with command.
 809  */
 810 void qemu_savevm_command_send(QEMUFile *f,
 811                               enum qemu_vm_cmd command,
 812                               uint16_t len,
 813                               uint8_t *data)
 814 {
 815     trace_savevm_command_send(command, len);
 816     qemu_put_byte(f, QEMU_VM_COMMAND);
 817     qemu_put_be16(f, (uint16_t)command);
 818     qemu_put_be16(f, len);
 819     qemu_put_buffer(f, data, len);
 820     qemu_fflush(f);
 821 }
 822
 823 void qemu_savevm_send_ping(QEMUFile *f, uint32_t value)
 824 {
 825     uint32_t buf;
 826
 827     trace_savevm_send_ping(value);
 828     buf = cpu_to_be32(value);
 829     qemu_savevm_command_send(f, MIG_CMD_PING, sizeof(value), (uint8_t *)&buf);
 830 }
 831
 832 void qemu_savevm_send_open_return_path(QEMUFile *f)
 833 {
 834     trace_savevm_send_open_return_path();
 835     qemu_savevm_command_send(f, MIG_CMD_OPEN_RETURN_PATH, 0, NULL);
 836 }
 837
 838 /* We have a buffer of data to send; we don't want that all to be loaded
 839  * by the command itself, so the command contains just the length of the
 840  * extra buffer that we then send straight after it.
 841  * TODO: Must be a better way to organise that
 842  *
 843  * Returns:
 844  *    0 on success
 845  *    -ve on error
 846  */
 847 int qemu_savevm_send_packaged(QEMUFile *f, const uint8_t *buf, size_t len)
 848 {
 849     uint32_t tmp;
 850
 851     if (len > MAX_VM_CMD_PACKAGED_SIZE) {
 852         error_report("%s: Unreasonably large packaged state: %zu",
 853                      __func__, len);
 854         return -1;
 855     }
 856
 857     tmp = cpu_to_be32(len);
 858
 859     trace_qemu_savevm_send_packaged();
 860     qemu_savevm_command_send(f, MIG_CMD_PACKAGED, 4, (uint8_t *)&tmp);
 861
 862     qemu_put_buffer(f, buf, len);
 863
 864     return 0;
 865 }
 866
 867 /* Send prior to any postcopy transfer */
 868 void qemu_savevm_send_postcopy_advise(QEMUFile *f)
 869 {
 870     uint64_t tmp[2];
 871     tmp[0] = cpu_to_be64(ram_pagesize_summary());
 872     tmp[1] = cpu_to_be64(qemu_target_page_size());
 873
 874     trace_qemu_savevm_send_postcopy_advise();
 875     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_ADVISE, 16, (uint8_t *)tmp);
 876 }
 877
 878 /* Sent prior to starting the destination running in postcopy, discard pages
 879  * that have already been sent but redirtied on the source.
 880  * CMD_POSTCOPY_RAM_DISCARD consist of:
 881  *      byte   version (0)
 882  *      byte   Length of name field (not including 0)
 883  *  n x byte   RAM block name
 884  *      byte   0 terminator (just for safety)
 885  *  n x        Byte ranges within the named RAMBlock
 886  *      be64   Start of the range
 887  *      be64   Length
 888  *
 889  *  name:  RAMBlock name that these entries are part of
 890  *  len: Number of page entries
 891  *  start_list: 'len' addresses
 892  *  length_list: 'len' addresses
 893  *
 894  */
 895 void qemu_savevm_send_postcopy_ram_discard(QEMUFile *f, const char *name,
 896                                            uint16_t len,
 897                                            uint64_t *start_list,
 898                                            uint64_t *length_list)
 899 {
 900     uint8_t *buf;
 901     uint16_t tmplen;
 902     uint16_t t;
 903     size_t name_len = strlen(name);
 904
 905     trace_qemu_savevm_send_postcopy_ram_discard(name, len);
 906     assert(name_len < 256);
 907     buf = g_malloc0(1 + 1 + name_len + 1 + (8 + 8) * len);
 908     buf[0] = postcopy_ram_discard_version;
 909     buf[1] = name_len;
 910     memcpy(buf + 2, name, name_len);
 911     tmplen = 2 + name_len;
 912     buf[tmplen++] = '\0';
 913
 914     for (t = 0; t < len; t++) {
 915         stq_be_p(buf + tmplen, start_list[t]);
 916         tmplen += 8;
 917         stq_be_p(buf + tmplen, length_list[t]);
 918         tmplen += 8;
 919     }
 920     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_RAM_DISCARD, tmplen, buf);
 921     g_free(buf);
 922 }
 923
 924 /* Get the destination into a state where it can receive postcopy data. */
 925 void qemu_savevm_send_postcopy_listen(QEMUFile *f)
 926 {
 927     trace_savevm_send_postcopy_listen();
 928     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_LISTEN, 0, NULL);
 929 }
 930
 931 /* Kick the destination into running */
 932 void qemu_savevm_send_postcopy_run(QEMUFile *f)
 933 {
 934     trace_savevm_send_postcopy_run();
 935     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_RUN, 0, NULL);
 936 }
 937
 938 bool qemu_savevm_state_blocked(Error **errp)
 939 {
 940     SaveStateEntry *se;
 941
 942     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
 943         if (se->vmsd && se->vmsd->unmigratable) {
 944             error_setg(errp, "State blocked by non-migratable device '%s'",
 945                        se->idstr);
 946             return true;
 947         }
 948     }
 949     return false;
 950 }
 951
 952 static bool enforce_config_section(void)
 953 {
 954     MachineState *machine = MACHINE(qdev_get_machine());
 955     return machine->enforce_config_section;
 956 }
 957
 958 void qemu_savevm_state_header(QEMUFile *f)
 959 {
 960     trace_savevm_state_header();
 961     qemu_put_be32(f, QEMU_VM_FILE_MAGIC);
 962     qemu_put_be32(f, QEMU_VM_FILE_VERSION);
 963
 964     if (!savevm_state.skip_configuration || enforce_config_section()) {
 965         qemu_put_byte(f, QEMU_VM_CONFIGURATION);
 966         vmstate_save_state(f, &vmstate_configuration, &savevm_state, 0);
 967     }
 968
 969 }
 970
 971 void qemu_savevm_state_begin(QEMUFile *f)
 972 {
 973     SaveStateEntry *se;
 974     int ret;
 975
 976     trace_savevm_state_begin();
 977     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
 978         if (!se->ops || !se->ops->save_live_setup) {
 979             continue;
 980         }
 981         if (se->ops && se->ops->is_active) {
 982             if (!se->ops->is_active(se->opaque)) {
 983                 continue;
 984             }
 985         }
 986         save_section_header(f, se, QEMU_VM_SECTION_START);
 987
 988         ret = se->ops->save_live_setup(f, se->opaque);
 989         save_section_footer(f, se);
 990         if (ret < 0) {
 991             qemu_file_set_error(f, ret);
 992             break;
 993         }
 994     }
 995 }
 996
 997 /*
 998  * this function has three return values:
 999  *   negative: there was one error, and we have -errno.
1000  *   0 : We haven't finished, caller have to go again
1001  *   1 : We have finished, we can go to complete phase
1002  */
1003 int qemu_savevm_state_iterate(QEMUFile *f, bool postcopy)
1004 {
1005     SaveStateEntry *se;
1006     int ret = 1;
1007
1008     trace_savevm_state_iterate();
1009     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1010         if (!se->ops || !se->ops->save_live_iterate) {
1011             continue;
1012         }
1013         if (se->ops && se->ops->is_active) {
1014             if (!se->ops->is_active(se->opaque)) {
1015                 continue;
1016             }
1017         }
1018         /*
1019          * In the postcopy phase, any device that doesn't know how to
1020          * do postcopy should have saved it's state in the _complete
1021          * call that's already run, it might get confused if we call
1022          * iterate afterwards.
1023          */
1024         if (postcopy && !se->ops->save_live_complete_postcopy) {
1025             continue;
1026         }
1027         if (qemu_file_rate_limit(f)) {
1028             return 0;
1029         }
1030         trace_savevm_section_start(se->idstr, se->section_id);
1031
1032         save_section_header(f, se, QEMU_VM_SECTION_PART);
1033
1034         ret = se->ops->save_live_iterate(f, se->opaque);
1035         trace_savevm_section_end(se->idstr, se->section_id, ret);
1036         save_section_footer(f, se);
1037
1038         if (ret < 0) {
1039             qemu_file_set_error(f, ret);
1040         }
1041         if (ret <= 0) {
1042             /* Do not proceed to the next vmstate before this one reported
1043                completion of the current stage. This serializes the migration
1044                and reduces the probability that a faster changing state is
1045                synchronized over and over again. */
1046             break;
1047         }
1048     }
1049     return ret;
1050 }
1051
1052 static bool should_send_vmdesc(void)
1053 {
1054     MachineState *machine = MACHINE(qdev_get_machine());
1055     bool in_postcopy = migration_in_postcopy();
1056     return !machine->suppress_vmdesc && !in_postcopy;
1057 }
1058
1059 /*
1060  * Calls the save_live_complete_postcopy methods
1061  * causing the last few pages to be sent immediately and doing any associated
1062  * cleanup.
1063  * Note postcopy also calls qemu_savevm_state_complete_precopy to complete
1064  * all the other devices, but that happens at the point we switch to postcopy.
1065  */
1066 void qemu_savevm_state_complete_postcopy(QEMUFile *f)
1067 {
1068     SaveStateEntry *se;
1069     int ret;
1070
1071     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1072         if (!se->ops || !se->ops->save_live_complete_postcopy) {
1073             continue;
1074         }
1075         if (se->ops && se->ops->is_active) {
1076             if (!se->ops->is_active(se->opaque)) {
1077                 continue;
1078             }
1079         }
1080         trace_savevm_section_start(se->idstr, se->section_id);
1081         /* Section type */
1082         qemu_put_byte(f, QEMU_VM_SECTION_END);
1083         qemu_put_be32(f, se->section_id);
1084
1085         ret = se->ops->save_live_complete_postcopy(f, se->opaque);
1086         trace_savevm_section_end(se->idstr, se->section_id, ret);
1087         save_section_footer(f, se);
1088         if (ret < 0) {
1089             qemu_file_set_error(f, ret);
1090             return;
1091         }
1092     }
1093
1094     qemu_put_byte(f, QEMU_VM_EOF);
1095     qemu_fflush(f);
1096 }
1097
1098 void qemu_savevm_state_complete_precopy(QEMUFile *f, bool iterable_only)
1099 {
1100     QJSON *vmdesc;
1101     int vmdesc_len;
1102     SaveStateEntry *se;
1103     int ret;
1104     bool in_postcopy = migration_in_postcopy();
1105
1106     trace_savevm_state_complete_precopy();
1107
1108     cpu_synchronize_all_states();
1109
1110     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1111         if (!se->ops ||
1112             (in_postcopy && se->ops->save_live_complete_postcopy) ||
1113             (in_postcopy && !iterable_only) ||
1114             !se->ops->save_live_complete_precopy) {
1115             continue;
1116         }
1117
1118         if (se->ops && se->ops->is_active) {
1119             if (!se->ops->is_active(se->opaque)) {
1120                 continue;
1121             }
1122         }
1123         trace_savevm_section_start(se->idstr, se->section_id);
1124
1125         save_section_header(f, se, QEMU_VM_SECTION_END);
1126
1127         ret = se->ops->save_live_complete_precopy(f, se->opaque);
1128         trace_savevm_section_end(se->idstr, se->section_id, ret);
1129         save_section_footer(f, se);
1130         if (ret < 0) {
1131             qemu_file_set_error(f, ret);
1132             return;
1133         }
1134     }
1135
1136     if (iterable_only) {
1137         return;
1138     }
1139
1140     vmdesc = qjson_new();
1141     json_prop_int(vmdesc, "page_size", qemu_target_page_size());
1142     json_start_array(vmdesc, "devices");
1143     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1144
1145         if ((!se->ops || !se->ops->save_state) && !se->vmsd) {
1146             continue;
1147         }
1148         if (se->vmsd && !vmstate_save_needed(se->vmsd, se->opaque)) {
1149             trace_savevm_section_skip(se->idstr, se->section_id);
1150             continue;
1151         }
1152
1153         trace_savevm_section_start(se->idstr, se->section_id);
1154
1155         json_start_object(vmdesc, NULL);
1156         json_prop_str(vmdesc, "name", se->idstr);
1157         json_prop_int(vmdesc, "instance_id", se->instance_id);
1158
1159         save_section_header(f, se, QEMU_VM_SECTION_FULL);
1160         vmstate_save(f, se, vmdesc);
1161         trace_savevm_section_end(se->idstr, se->section_id, 0);
1162         save_section_footer(f, se);
1163
1164         json_end_object(vmdesc);
1165     }
1166
1167     if (!in_postcopy) {
1168         /* Postcopy stream will still be going */
1169         qemu_put_byte(f, QEMU_VM_EOF);
1170     }
1171
1172     json_end_array(vmdesc);
1173     qjson_finish(vmdesc);
1174     vmdesc_len = strlen(qjson_get_str(vmdesc));
1175
1176     if (should_send_vmdesc()) {
1177         qemu_put_byte(f, QEMU_VM_VMDESCRIPTION);
1178         qemu_put_be32(f, vmdesc_len);
1179         qemu_put_buffer(f, (uint8_t *)qjson_get_str(vmdesc), vmdesc_len);
1180     }
1181     qjson_destroy(vmdesc);
1182
1183     qemu_fflush(f);
1184 }
1185
1186 /* Give an estimate of the amount left to be transferred,
1187  * the result is split into the amount for units that can and
1188  * for units that can't do postcopy.
1189  */
1190 void qemu_savevm_state_pending(QEMUFile *f, uint64_t threshold_size,
1191                                uint64_t *res_non_postcopiable,
1192                                uint64_t *res_postcopiable)
1193 {
1194     SaveStateEntry *se;
1195
1196     *res_non_postcopiable = 0;
1197     *res_postcopiable = 0;
1198
1199
1200     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1201         if (!se->ops || !se->ops->save_live_pending) {
1202             continue;
1203         }
1204         if (se->ops && se->ops->is_active) {
1205             if (!se->ops->is_active(se->opaque)) {
1206                 continue;
1207             }
1208         }
1209         se->ops->save_live_pending(f, se->opaque, threshold_size,
1210                                    res_non_postcopiable, res_postcopiable);
1211     }
1212 }
1213
1214 void qemu_savevm_state_cleanup(void)
1215 {
1216     SaveStateEntry *se;
1217
1218     trace_savevm_state_cleanup();
1219     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1220         if (se->ops && se->ops->cleanup) {
1221             se->ops->cleanup(se->opaque);
1222         }
1223     }
1224 }
1225
1226 static int qemu_savevm_state(QEMUFile *f, Error **errp)
1227 {
1228     int ret;
1229     MigrationState *ms = migrate_init();
1230     MigrationStatus status;
1231     ms->to_dst_file = f;
1232
1233     if (migration_is_blocked(errp)) {
1234         ret = -EINVAL;
1235         goto done;
1236     }
1237
1238     if (migrate_use_block()) {
1239         error_setg(errp, "Block migration and snapshots are incompatible");
1240         ret = -EINVAL;
1241         goto done;
1242     }
1243
1244     qemu_mutex_unlock_iothread();
1245     qemu_savevm_state_header(f);
1246     qemu_savevm_state_begin(f);
1247     qemu_mutex_lock_iothread();
1248
1249     while (qemu_file_get_error(f) == 0) {
1250         if (qemu_savevm_state_iterate(f, false) > 0) {
1251             break;
1252         }
1253     }
1254
1255     ret = qemu_file_get_error(f);
1256     if (ret == 0) {
1257         qemu_savevm_state_complete_precopy(f, false);
1258         ret = qemu_file_get_error(f);
1259     }
1260     qemu_savevm_state_cleanup();
1261     if (ret != 0) {
1262         error_setg_errno(errp, -ret, "Error while writing VM state");
1263     }
1264
1265 done:
1266     if (ret != 0) {
1267         status = MIGRATION_STATUS_FAILED;
1268     } else {
1269         status = MIGRATION_STATUS_COMPLETED;
1270     }
1271     migrate_set_state(&ms->state, MIGRATION_STATUS_SETUP, status);
1272
1273     /* f is outer parameter, it should not stay in global migration state after
1274      * this function finished */
1275     ms->to_dst_file = NULL;
1276
1277     return ret;
1278 }
1279
1280 static int qemu_save_device_state(QEMUFile *f)
1281 {
1282     SaveStateEntry *se;
1283
1284     qemu_put_be32(f, QEMU_VM_FILE_MAGIC);
1285     qemu_put_be32(f, QEMU_VM_FILE_VERSION);
1286
1287     cpu_synchronize_all_states();
1288
1289     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1290         if (se->is_ram) {
1291             continue;
1292         }
1293         if ((!se->ops || !se->ops->save_state) && !se->vmsd) {
1294             continue;
1295         }
1296         if (se->vmsd && !vmstate_save_needed(se->vmsd, se->opaque)) {
1297             continue;
1298         }
1299
1300         save_section_header(f, se, QEMU_VM_SECTION_FULL);
1301
1302         vmstate_save(f, se, NULL);
1303
1304         save_section_footer(f, se);
1305     }
1306
1307     qemu_put_byte(f, QEMU_VM_EOF);
1308
1309     return qemu_file_get_error(f);
1310 }
1311
1312 static SaveStateEntry *find_se(const char *idstr, int instance_id)
1313 {
1314     SaveStateEntry *se;
1315
1316     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1317         if (!strcmp(se->idstr, idstr) &&
1318             (instance_id == se->instance_id ||
1319              instance_id == se->alias_id))
1320             return se;
1321         /* Migrating from an older version? */
1322         if (strstr(se->idstr, idstr) && se->compat) {
1323             if (!strcmp(se->compat->idstr, idstr) &&
1324                 (instance_id == se->compat->instance_id ||
1325                  instance_id == se->alias_id))
1326                 return se;
1327         }
1328     }
1329     return NULL;
1330 }
1331
1332 enum LoadVMExitCodes {
1333     /* Allow a command to quit all layers of nested loadvm loops */
1334     LOADVM_QUIT     =  1,
1335 };
1336
1337 static int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis);
1338
1339 /* ------ incoming postcopy messages ------ */
1340 /* 'advise' arrives before any transfers just to tell us that a postcopy
1341  * *might* happen - it might be skipped if precopy transferred everything
1342  * quickly.
1343  */
1344 static int loadvm_postcopy_handle_advise(MigrationIncomingState *mis)
1345 {
1346     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_ADVISE);
1347     uint64_t remote_pagesize_summary, local_pagesize_summary, remote_tps;
1348
1349     trace_loadvm_postcopy_handle_advise();
1350     if (ps != POSTCOPY_INCOMING_NONE) {
1351         error_report("CMD_POSTCOPY_ADVISE in wrong postcopy state (%d)", ps);
1352         return -1;
1353     }
1354
1355     if (!postcopy_ram_supported_by_host()) {
1356         postcopy_state_set(POSTCOPY_INCOMING_NONE);
1357         return -1;
1358     }
1359
1360     remote_pagesize_summary = qemu_get_be64(mis->from_src_file);
1361     local_pagesize_summary = ram_pagesize_summary();
1362
1363     if (remote_pagesize_summary != local_pagesize_summary)  {
1364         /*
1365          * This detects two potential causes of mismatch:
1366          *   a) A mismatch in host page sizes
1367          *      Some combinations of mismatch are probably possible but it gets
1368          *      a bit more complicated.  In particular we need to place whole
1369          *      host pages on the dest at once, and we need to ensure that we
1370          *      handle dirtying to make sure we never end up sending part of
1371          *      a hostpage on it's own.
1372          *   b) The use of different huge page sizes on source/destination
1373          *      a more fine grain test is performed during RAM block migration
1374          *      but this test here causes a nice early clear failure, and
1375          *      also fails when passed to an older qemu that doesn't
1376          *      do huge pages.
1377          */
1378         error_report("Postcopy needs matching RAM page sizes (s=%" PRIx64
1379                                                              " d=%" PRIx64 ")",
1380                      remote_pagesize_summary, local_pagesize_summary);
1381         return -1;
1382     }
1383
1384     remote_tps = qemu_get_be64(mis->from_src_file);
1385     if (remote_tps != qemu_target_page_size()) {
1386         /*
1387          * Again, some differences could be dealt with, but for now keep it
1388          * simple.
1389          */
1390         error_report("Postcopy needs matching target page sizes (s=%d d=%zd)",
1391                      (int)remote_tps, qemu_target_page_size());
1392         return -1;
1393     }
1394
1395     if (ram_postcopy_incoming_init(mis)) {
1396         return -1;
1397     }
1398
1399     postcopy_state_set(POSTCOPY_INCOMING_ADVISE);
1400
1401     return 0;
1402 }
1403
1404 /* After postcopy we will be told to throw some pages away since they're
1405  * dirty and will have to be demand fetched.  Must happen before CPU is
1406  * started.
1407  * There can be 0..many of these messages, each encoding multiple pages.
1408  */
1409 static int loadvm_postcopy_ram_handle_discard(MigrationIncomingState *mis,
1410                                               uint16_t len)
1411 {
1412     int tmp;
1413     char ramid[256];
1414     PostcopyState ps = postcopy_state_get();
1415
1416     trace_loadvm_postcopy_ram_handle_discard();
1417
1418     switch (ps) {
1419     case POSTCOPY_INCOMING_ADVISE:
1420         /* 1st discard */
1421         tmp = postcopy_ram_prepare_discard(mis);
1422         if (tmp) {
1423             return tmp;
1424         }
1425         break;
1426
1427     case POSTCOPY_INCOMING_DISCARD:
1428         /* Expected state */
1429         break;
1430
1431     default:
1432         error_report("CMD_POSTCOPY_RAM_DISCARD in wrong postcopy state (%d)",
1433                      ps);
1434         return -1;
1435     }
1436     /* We're expecting a
1437      *    Version (0)
1438      *    a RAM ID string (length byte, name, 0 term)
1439      *    then at least 1 16 byte chunk
1440     */
1441     if (len < (1 + 1 + 1 + 1 + 2 * 8)) {
1442         error_report("CMD_POSTCOPY_RAM_DISCARD invalid length (%d)", len);
1443         return -1;
1444     }
1445
1446     tmp = qemu_get_byte(mis->from_src_file);
1447     if (tmp != postcopy_ram_discard_version) {
1448         error_report("CMD_POSTCOPY_RAM_DISCARD invalid version (%d)", tmp);
1449         return -1;
1450     }
1451
1452     if (!qemu_get_counted_string(mis->from_src_file, ramid)) {
1453         error_report("CMD_POSTCOPY_RAM_DISCARD Failed to read RAMBlock ID");
1454         return -1;
1455     }
1456     tmp = qemu_get_byte(mis->from_src_file);
1457     if (tmp != 0) {
1458         error_report("CMD_POSTCOPY_RAM_DISCARD missing nil (%d)", tmp);
1459         return -1;
1460     }
1461
1462     len -= 3 + strlen(ramid);
1463     if (len % 16) {
1464         error_report("CMD_POSTCOPY_RAM_DISCARD invalid length (%d)", len);
1465         return -1;
1466     }
1467     trace_loadvm_postcopy_ram_handle_discard_header(ramid, len);
1468     while (len) {
1469         uint64_t start_addr, block_length;
1470         start_addr = qemu_get_be64(mis->from_src_file);
1471         block_length = qemu_get_be64(mis->from_src_file);
1472
1473         len -= 16;
1474         int ret = ram_discard_range(ramid, start_addr, block_length);
1475         if (ret) {
1476             return ret;
1477         }
1478     }
1479     trace_loadvm_postcopy_ram_handle_discard_end();
1480
1481     return 0;
1482 }
1483
1484 /*
1485  * Triggered by a postcopy_listen command; this thread takes over reading
1486  * the input stream, leaving the main thread free to carry on loading the rest
1487  * of the device state (from RAM).
1488  * (TODO:This could do with being in a postcopy file - but there again it's
1489  * just another input loop, not that postcopy specific)
1490  */
1491 static void *postcopy_ram_listen_thread(void *opaque)
1492 {
1493     QEMUFile *f = opaque;
1494     MigrationIncomingState *mis = migration_incoming_get_current();
1495     int load_res;
1496
1497     migrate_set_state(&mis->state, MIGRATION_STATUS_ACTIVE,
1498                                    MIGRATION_STATUS_POSTCOPY_ACTIVE);
1499     qemu_sem_post(&mis->listen_thread_sem);
1500     trace_postcopy_ram_listen_thread_start();
1501
1502     /*
1503      * Because we're a thread and not a coroutine we can't yield
1504      * in qemu_file, and thus we must be blocking now.
1505      */
1506     qemu_file_set_blocking(f, true);
1507     load_res = qemu_loadvm_state_main(f, mis);
1508     /* And non-blocking again so we don't block in any cleanup */
1509     qemu_file_set_blocking(f, false);
1510
1511     trace_postcopy_ram_listen_thread_exit();
1512     if (load_res < 0) {
1513         error_report("%s: loadvm failed: %d", __func__, load_res);
1514         qemu_file_set_error(f, load_res);
1515         migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
1516                                        MIGRATION_STATUS_FAILED);
1517     } else {
1518         /*
1519          * This looks good, but it's possible that the device loading in the
1520          * main thread hasn't finished yet, and so we might not be in 'RUN'
1521          * state yet; wait for the end of the main thread.
1522          */
1523         qemu_event_wait(&mis->main_thread_load_event);
1524     }
1525     postcopy_ram_incoming_cleanup(mis);
1526
1527     if (load_res < 0) {
1528         /*
1529          * If something went wrong then we have a bad state so exit;
1530          * depending how far we got it might be possible at this point
1531          * to leave the guest running and fire MCEs for pages that never
1532          * arrived as a desperate recovery step.
1533          */
1534         exit(EXIT_FAILURE);
1535     }
1536
1537     migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
1538                                    MIGRATION_STATUS_COMPLETED);
1539     /*
1540      * If everything has worked fine, then the main thread has waited
1541      * for us to start, and we're the last use of the mis.
1542      * (If something broke then qemu will have to exit anyway since it's
1543      * got a bad migration state).
1544      */
1545     migration_incoming_state_destroy();
1546
1547
1548     return NULL;
1549 }
1550
1551 /* After this message we must be able to immediately receive postcopy data */
1552 static int loadvm_postcopy_handle_listen(MigrationIncomingState *mis)
1553 {
1554     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_LISTENING);
1555     trace_loadvm_postcopy_handle_listen();
1556     if (ps != POSTCOPY_INCOMING_ADVISE && ps != POSTCOPY_INCOMING_DISCARD) {
1557         error_report("CMD_POSTCOPY_LISTEN in wrong postcopy state (%d)", ps);
1558         return -1;
1559     }
1560     if (ps == POSTCOPY_INCOMING_ADVISE) {
1561         /*
1562          * A rare case, we entered listen without having to do any discards,
1563          * so do the setup that's normally done at the time of the 1st discard.
1564          */
1565         postcopy_ram_prepare_discard(mis);
1566     }
1567
1568     /*
1569      * Sensitise RAM - can now generate requests for blocks that don't exist
1570      * However, at this point the CPU shouldn't be running, and the IO
1571      * shouldn't be doing anything yet so don't actually expect requests
1572      */
1573     if (postcopy_ram_enable_notify(mis)) {
1574         return -1;
1575     }
1576
1577     if (mis->have_listen_thread) {
1578         error_report("CMD_POSTCOPY_RAM_LISTEN already has a listen thread");
1579         return -1;
1580     }
1581
1582     mis->have_listen_thread = true;
1583     /* Start up the listening thread and wait for it to signal ready */
1584     qemu_sem_init(&mis->listen_thread_sem, 0);
1585     qemu_thread_create(&mis->listen_thread, "postcopy/listen",
1586                        postcopy_ram_listen_thread, mis->from_src_file,
1587                        QEMU_THREAD_DETACHED);
1588     qemu_sem_wait(&mis->listen_thread_sem);
1589     qemu_sem_destroy(&mis->listen_thread_sem);
1590
1591     return 0;
1592 }
1593
1594
1595 typedef struct {
1596     QEMUBH *bh;
1597 } HandleRunBhData;
1598
1599 static void loadvm_postcopy_handle_run_bh(void *opaque)
1600 {
1601     Error *local_err = NULL;
1602     HandleRunBhData *data = opaque;
1603
1604     /* TODO we should move all of this lot into postcopy_ram.c or a shared code
1605      * in migration.c
1606      */
1607     cpu_synchronize_all_post_init();
1608
1609     qemu_announce_self();
1610
1611     /* Make sure all file formats flush their mutable metadata.
1612      * If we get an error here, just don't restart the VM yet. */
1613     bdrv_invalidate_cache_all(&local_err);
1614     if (local_err) {
1615         error_report_err(local_err);
1616         local_err = NULL;
1617         autostart = false;
1618     }
1619
1620     trace_loadvm_postcopy_handle_run_cpu_sync();
1621     cpu_synchronize_all_post_init();
1622
1623     trace_loadvm_postcopy_handle_run_vmstart();
1624
1625     if (autostart) {
1626         /* Hold onto your hats, starting the CPU */
1627         vm_start();
1628     } else {
1629         /* leave it paused and let management decide when to start the CPU */
1630         runstate_set(RUN_STATE_PAUSED);
1631     }
1632
1633     qemu_bh_delete(data->bh);
1634     g_free(data);
1635 }
1636
1637 /* After all discards we can start running and asking for pages */
1638 static int loadvm_postcopy_handle_run(MigrationIncomingState *mis)
1639 {
1640     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_RUNNING);
1641     HandleRunBhData *data;
1642
1643     trace_loadvm_postcopy_handle_run();
1644     if (ps != POSTCOPY_INCOMING_LISTENING) {
1645         error_report("CMD_POSTCOPY_RUN in wrong postcopy state (%d)", ps);
1646         return -1;
1647     }
1648
1649     data = g_new(HandleRunBhData, 1);
1650     data->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, data);
1651     qemu_bh_schedule(data->bh);
1652
1653     /* We need to finish reading the stream from the package
1654      * and also stop reading anything more from the stream that loaded the
1655      * package (since it's now being read by the listener thread).
1656      * LOADVM_QUIT will quit all the layers of nested loadvm loops.
1657      */
1658     return LOADVM_QUIT;
1659 }
1660
1661 /**
1662  * Immediately following this command is a blob of data containing an embedded
1663  * chunk of migration stream; read it and load it.
1664  *
1665  * @mis: Incoming state
1666  * @length: Length of packaged data to read
1667  *
1668  * Returns: Negative values on error
1669  *
1670  */
1671 static int loadvm_handle_cmd_packaged(MigrationIncomingState *mis)
1672 {
1673     int ret;
1674     size_t length;
1675     QIOChannelBuffer *bioc;
1676
1677     length = qemu_get_be32(mis->from_src_file);
1678     trace_loadvm_handle_cmd_packaged(length);
1679
1680     if (length > MAX_VM_CMD_PACKAGED_SIZE) {
1681         error_report("Unreasonably large packaged state: %zu", length);
1682         return -1;
1683     }
1684
1685     bioc = qio_channel_buffer_new(length);
1686     qio_channel_set_name(QIO_CHANNEL(bioc), "migration-loadvm-buffer");
1687     ret = qemu_get_buffer(mis->from_src_file,
1688                           bioc->data,
1689                           length);
1690     if (ret != length) {
1691         object_unref(OBJECT(bioc));
1692         error_report("CMD_PACKAGED: Buffer receive fail ret=%d length=%zu",
1693                      ret, length);
1694         return (ret < 0) ? ret : -EAGAIN;
1695     }
1696     bioc->usage += length;
1697     trace_loadvm_handle_cmd_packaged_received(ret);
1698
1699     QEMUFile *packf = qemu_fopen_channel_input(QIO_CHANNEL(bioc));
1700
1701     ret = qemu_loadvm_state_main(packf, mis);
1702     trace_loadvm_handle_cmd_packaged_main(ret);
1703     qemu_fclose(packf);
1704     object_unref(OBJECT(bioc));
1705
1706     return ret;
1707 }
1708
1709 /*
1710  * Process an incoming 'QEMU_VM_COMMAND'
1711  * 0           just a normal return
1712  * LOADVM_QUIT All good, but exit the loop
1713  * <0          Error
1714  */
1715 static int loadvm_process_command(QEMUFile *f)
1716 {
1717     MigrationIncomingState *mis = migration_incoming_get_current();
1718     uint16_t cmd;
1719     uint16_t len;
1720     uint32_t tmp32;
1721
1722     cmd = qemu_get_be16(f);
1723     len = qemu_get_be16(f);
1724
1725     trace_loadvm_process_command(cmd, len);
1726     if (cmd >= MIG_CMD_MAX || cmd == MIG_CMD_INVALID) {
1727         error_report("MIG_CMD 0x%x unknown (len 0x%x)", cmd, len);
1728         return -EINVAL;
1729     }
1730
1731     if (mig_cmd_args[cmd].len != -1 && mig_cmd_args[cmd].len != len) {
1732         error_report("%s received with bad length - expecting %zu, got %d",
1733                      mig_cmd_args[cmd].name,
1734                      (size_t)mig_cmd_args[cmd].len, len);
1735         return -ERANGE;
1736     }
1737
1738     switch (cmd) {
1739     case MIG_CMD_OPEN_RETURN_PATH:
1740         if (mis->to_src_file) {
1741             error_report("CMD_OPEN_RETURN_PATH called when RP already open");
1742             /* Not really a problem, so don't give up */
1743             return 0;
1744         }
1745         mis->to_src_file = qemu_file_get_return_path(f);
1746         if (!mis->to_src_file) {
1747             error_report("CMD_OPEN_RETURN_PATH failed");
1748             return -1;
1749         }
1750         break;
1751
1752     case MIG_CMD_PING:
1753         tmp32 = qemu_get_be32(f);
1754         trace_loadvm_process_command_ping(tmp32);
1755         if (!mis->to_src_file) {
1756             error_report("CMD_PING (0x%x) received with no return path",
1757                          tmp32);
1758             return -1;
1759         }
1760         migrate_send_rp_pong(mis, tmp32);
1761         break;
1762
1763     case MIG_CMD_PACKAGED:
1764         return loadvm_handle_cmd_packaged(mis);
1765
1766     case MIG_CMD_POSTCOPY_ADVISE:
1767         return loadvm_postcopy_handle_advise(mis);
1768
1769     case MIG_CMD_POSTCOPY_LISTEN:
1770         return loadvm_postcopy_handle_listen(mis);
1771
1772     case MIG_CMD_POSTCOPY_RUN:
1773         return loadvm_postcopy_handle_run(mis);
1774
1775     case MIG_CMD_POSTCOPY_RAM_DISCARD:
1776         return loadvm_postcopy_ram_handle_discard(mis, len);
1777     }
1778
1779     return 0;
1780 }
1781
1782 struct LoadStateEntry {
1783     QLIST_ENTRY(LoadStateEntry) entry;
1784     SaveStateEntry *se;
1785     int section_id;
1786     int version_id;
1787 };
1788
1789 /*
1790  * Read a footer off the wire and check that it matches the expected section
1791  *
1792  * Returns: true if the footer was good
1793  *          false if there is a problem (and calls error_report to say why)
1794  */
1795 static bool check_section_footer(QEMUFile *f, LoadStateEntry *le)
1796 {
1797     uint8_t read_mark;
1798     uint32_t read_section_id;
1799
1800     if (skip_section_footers) {
1801         /* No footer to check */
1802         return true;
1803     }
1804
1805     read_mark = qemu_get_byte(f);
1806
1807     if (read_mark != QEMU_VM_SECTION_FOOTER) {
1808         error_report("Missing section footer for %s", le->se->idstr);
1809         return false;
1810     }
1811
1812     read_section_id = qemu_get_be32(f);
1813     if (read_section_id != le->section_id) {
1814         error_report("Mismatched section id in footer for %s -"
1815                      " read 0x%x expected 0x%x",
1816                      le->se->idstr, read_section_id, le->section_id);
1817         return false;
1818     }
1819
1820     /* All good */
1821     return true;
1822 }
1823
1824 void loadvm_free_handlers(MigrationIncomingState *mis)
1825 {
1826     LoadStateEntry *le, *new_le;
1827
1828     QLIST_FOREACH_SAFE(le, &mis->loadvm_handlers, entry, new_le) {
1829         QLIST_REMOVE(le, entry);
1830         g_free(le);
1831     }
1832 }
1833
1834 static int
1835 qemu_loadvm_section_start_full(QEMUFile *f, MigrationIncomingState *mis)
1836 {
1837     uint32_t instance_id, version_id, section_id;
1838     SaveStateEntry *se;
1839     LoadStateEntry *le;
1840     char idstr[256];
1841     int ret;
1842
1843     /* Read section start */
1844     section_id = qemu_get_be32(f);
1845     if (!qemu_get_counted_string(f, idstr)) {
1846         error_report("Unable to read ID string for section %u",
1847                      section_id);
1848         return -EINVAL;
1849     }
1850     instance_id = qemu_get_be32(f);
1851     version_id = qemu_get_be32(f);
1852
1853     trace_qemu_loadvm_state_section_startfull(section_id, idstr,
1854             instance_id, version_id);
1855     /* Find savevm section */
1856     se = find_se(idstr, instance_id);
1857     if (se == NULL) {
1858         error_report("Unknown savevm section or instance '%s' %d",
1859                      idstr, instance_id);
1860         return -EINVAL;
1861     }
1862
1863     /* Validate version */
1864     if (version_id > se->version_id) {
1865         error_report("savevm: unsupported version %d for '%s' v%d",
1866                      version_id, idstr, se->version_id);
1867         return -EINVAL;
1868     }
1869
1870     /* Validate if it is a device's state */
1871     if (xen_enabled() && se->is_ram) {
1872         error_report("loadvm: %s RAM loading not allowed on Xen", idstr);
1873         return -EINVAL;
1874     }
1875
1876     /* Add entry */
1877     le = g_malloc0(sizeof(*le));
1878
1879     le->se = se;
1880     le->section_id = section_id;
1881     le->version_id = version_id;
1882     QLIST_INSERT_HEAD(&mis->loadvm_handlers, le, entry);
1883
1884     ret = vmstate_load(f, le->se, le->version_id);
1885     if (ret < 0) {
1886         error_report("error while loading state for instance 0x%x of"
1887                      " device '%s'", instance_id, idstr);
1888         return ret;
1889     }
1890     if (!check_section_footer(f, le)) {
1891         return -EINVAL;
1892     }
1893
1894     return 0;
1895 }
1896
1897 static int
1898 qemu_loadvm_section_part_end(QEMUFile *f, MigrationIncomingState *mis)
1899 {
1900     uint32_t section_id;
1901     LoadStateEntry *le;
1902     int ret;
1903
1904     section_id = qemu_get_be32(f);
1905
1906     trace_qemu_loadvm_state_section_partend(section_id);
1907     QLIST_FOREACH(le, &mis->loadvm_handlers, entry) {
1908         if (le->section_id == section_id) {
1909             break;
1910         }
1911     }
1912     if (le == NULL) {
1913         error_report("Unknown savevm section %d", section_id);
1914         return -EINVAL;
1915     }
1916
1917     ret = vmstate_load(f, le->se, le->version_id);
1918     if (ret < 0) {
1919         error_report("error while loading state section id %d(%s)",
1920                      section_id, le->se->idstr);
1921         return ret;
1922     }
1923     if (!check_section_footer(f, le)) {
1924         return -EINVAL;
1925     }
1926
1927     return 0;
1928 }
1929
1930 static int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis)
1931 {
1932     uint8_t section_type;
1933     int ret = 0;
1934
1935     while ((section_type = qemu_get_byte(f)) != QEMU_VM_EOF) {
1936         ret = 0;
1937         trace_qemu_loadvm_state_section(section_type);
1938         switch (section_type) {
1939         case QEMU_VM_SECTION_START:
1940         case QEMU_VM_SECTION_FULL:
1941             ret = qemu_loadvm_section_start_full(f, mis);
1942             if (ret < 0) {
1943                 goto out;
1944             }
1945             break;
1946         case QEMU_VM_SECTION_PART:
1947         case QEMU_VM_SECTION_END:
1948             ret = qemu_loadvm_section_part_end(f, mis);
1949             if (ret < 0) {
1950                 goto out;
1951             }
1952             break;
1953         case QEMU_VM_COMMAND:
1954             ret = loadvm_process_command(f);
1955             trace_qemu_loadvm_state_section_command(ret);
1956             if ((ret < 0) || (ret & LOADVM_QUIT)) {
1957                 goto out;
1958             }
1959             break;
1960         default:
1961             error_report("Unknown savevm section type %d", section_type);
1962             ret = -EINVAL;
1963             goto out;
1964         }
1965     }
1966
1967 out:
1968     if (ret < 0) {
1969         qemu_file_set_error(f, ret);
1970     }
1971     return ret;
1972 }
1973
1974 int qemu_loadvm_state(QEMUFile *f)
1975 {
1976     MigrationIncomingState *mis = migration_incoming_get_current();
1977     Error *local_err = NULL;
1978     unsigned int v;
1979     int ret;
1980
1981     if (qemu_savevm_state_blocked(&local_err)) {
1982         error_report_err(local_err);
1983         return -EINVAL;
1984     }
1985
1986     v = qemu_get_be32(f);
1987     if (v != QEMU_VM_FILE_MAGIC) {
1988         error_report("Not a migration stream");
1989         return -EINVAL;
1990     }
1991
1992     v = qemu_get_be32(f);
1993     if (v == QEMU_VM_FILE_VERSION_COMPAT) {
1994         error_report("SaveVM v2 format is obsolete and don't work anymore");
1995         return -ENOTSUP;
1996     }
1997     if (v != QEMU_VM_FILE_VERSION) {
1998         error_report("Unsupported migration stream version");
1999         return -ENOTSUP;
2000     }
2001
2002     if (!savevm_state.skip_configuration || enforce_config_section()) {
2003         if (qemu_get_byte(f) != QEMU_VM_CONFIGURATION) {
2004             error_report("Configuration section missing");
2005             return -EINVAL;
2006         }
2007         ret = vmstate_load_state(f, &vmstate_configuration, &savevm_state, 0);
2008
2009         if (ret) {
2010             return ret;
2011         }
2012     }
2013
2014     ret = qemu_loadvm_state_main(f, mis);
2015     qemu_event_set(&mis->main_thread_load_event);
2016
2017     trace_qemu_loadvm_state_post_main(ret);
2018
2019     if (mis->have_listen_thread) {
2020         /* Listen thread still going, can't clean up yet */
2021         return ret;
2022     }
2023
2024     if (ret == 0) {
2025         ret = qemu_file_get_error(f);
2026     }
2027
2028     /*
2029      * Try to read in the VMDESC section as well, so that dumping tools that
2030      * intercept our migration stream have the chance to see it.
2031      */
2032
2033     /* We've got to be careful; if we don't read the data and just shut the fd
2034      * then the sender can error if we close while it's still sending.
2035      * We also mustn't read data that isn't there; some transports (RDMA)
2036      * will stall waiting for that data when the source has already closed.
2037      */
2038     if (ret == 0 && should_send_vmdesc()) {
2039         uint8_t *buf;
2040         uint32_t size;
2041         uint8_t  section_type = qemu_get_byte(f);
2042
2043         if (section_type != QEMU_VM_VMDESCRIPTION) {
2044             error_report("Expected vmdescription section, but got %d",
2045                          section_type);
2046             /*
2047              * It doesn't seem worth failing at this point since
2048              * we apparently have an otherwise valid VM state
2049              */
2050         } else {
2051             buf = g_malloc(0x1000);
2052             size = qemu_get_be32(f);
2053
2054             while (size > 0) {
2055                 uint32_t read_chunk = MIN(size, 0x1000);
2056                 qemu_get_buffer(f, buf, read_chunk);
2057                 size -= read_chunk;
2058             }
2059             g_free(buf);
2060         }
2061     }
2062
2063     cpu_synchronize_all_post_init();
2064
2065     return ret;
2066 }
2067
2068 int save_vmstate(const char *name, Error **errp)
2069 {
2070     BlockDriverState *bs, *bs1;
2071     QEMUSnapshotInfo sn1, *sn = &sn1, old_sn1, *old_sn = &old_sn1;
2072     int ret = -1;
2073     QEMUFile *f;
2074     int saved_vm_running;
2075     uint64_t vm_state_size;
2076     qemu_timeval tv;
2077     struct tm tm;
2078     AioContext *aio_context;
2079
2080     if (!bdrv_all_can_snapshot(&bs)) {
2081         error_setg(errp, "Device '%s' is writable but does not support "
2082                    "snapshots", bdrv_get_device_name(bs));
2083         return ret;
2084     }
2085
2086     /* Delete old snapshots of the same name */
2087     if (name) {
2088         ret = bdrv_all_delete_snapshot(name, &bs1, errp);
2089         if (ret < 0) {
2090             error_prepend(errp, "Error while deleting snapshot on device "
2091                           "'%s': ", bdrv_get_device_name(bs1));
2092             return ret;
2093         }
2094     }
2095
2096     bs = bdrv_all_find_vmstate_bs();
2097     if (bs == NULL) {
2098         error_setg(errp, "No block device can accept snapshots");
2099         return ret;
2100     }
2101     aio_context = bdrv_get_aio_context(bs);
2102
2103     saved_vm_running = runstate_is_running();
2104
2105     ret = global_state_store();
2106     if (ret) {
2107         error_setg(errp, "Error saving global state");
2108         return ret;
2109     }
2110     vm_stop(RUN_STATE_SAVE_VM);
2111
2112     aio_context_acquire(aio_context);
2113
2114     memset(sn, 0, sizeof(*sn));
2115
2116     /* fill auxiliary fields */
2117     qemu_gettimeofday(&tv);
2118     sn->date_sec = tv.tv_sec;
2119     sn->date_nsec = tv.tv_usec * 1000;
2120     sn->vm_clock_nsec = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
2121
2122     if (name) {
2123         ret = bdrv_snapshot_find(bs, old_sn, name);
2124         if (ret >= 0) {
2125             pstrcpy(sn->name, sizeof(sn->name), old_sn->name);
2126             pstrcpy(sn->id_str, sizeof(sn->id_str), old_sn->id_str);
2127         } else {
2128             pstrcpy(sn->name, sizeof(sn->name), name);
2129         }
2130     } else {
2131         /* cast below needed for OpenBSD where tv_sec is still 'long' */
2132         localtime_r((const time_t *)&tv.tv_sec, &tm);
2133         strftime(sn->name, sizeof(sn->name), "vm-%Y%m%d%H%M%S", &tm);
2134     }
2135
2136     /* save the VM state */
2137     f = qemu_fopen_bdrv(bs, 1);
2138     if (!f) {
2139         error_setg(errp, "Could not open VM state file");
2140         goto the_end;
2141     }
2142     ret = qemu_savevm_state(f, errp);
2143     vm_state_size = qemu_ftell(f);
2144     qemu_fclose(f);
2145     if (ret < 0) {
2146         goto the_end;
2147     }
2148
2149     ret = bdrv_all_create_snapshot(sn, bs, vm_state_size, &bs);
2150     if (ret < 0) {
2151         error_setg(errp, "Error while creating snapshot on '%s'",
2152                    bdrv_get_device_name(bs));
2153         goto the_end;
2154     }
2155
2156     ret = 0;
2157
2158  the_end:
2159     aio_context_release(aio_context);
2160     if (saved_vm_running) {
2161         vm_start();
2162     }
2163     return ret;
2164 }
2165
2166 void qmp_xen_save_devices_state(const char *filename, Error **errp)
2167 {
2168     QEMUFile *f;
2169     QIOChannelFile *ioc;
2170     int saved_vm_running;
2171     int ret;
2172
2173     saved_vm_running = runstate_is_running();
2174     vm_stop(RUN_STATE_SAVE_VM);
2175     global_state_store_running();
2176
2177     ioc = qio_channel_file_new_path(filename, O_WRONLY | O_CREAT, 0660, errp);
2178     if (!ioc) {
2179         goto the_end;
2180     }
2181     qio_channel_set_name(QIO_CHANNEL(ioc), "migration-xen-save-state");
2182     f = qemu_fopen_channel_output(QIO_CHANNEL(ioc));
2183     ret = qemu_save_device_state(f);
2184     qemu_fclose(f);
2185     if (ret < 0) {
2186         error_setg(errp, QERR_IO_ERROR);
2187     }
2188
2189  the_end:
2190     if (saved_vm_running) {
2191         vm_start();
2192     }
2193 }
2194
2195 void qmp_xen_load_devices_state(const char *filename, Error **errp)
2196 {
2197     QEMUFile *f;
2198     QIOChannelFile *ioc;
2199     int ret;
2200
2201     /* Guest must be paused before loading the device state; the RAM state
2202      * will already have been loaded by xc
2203      */
2204     if (runstate_is_running()) {
2205         error_setg(errp, "Cannot update device state while vm is running");
2206         return;
2207     }
2208     vm_stop(RUN_STATE_RESTORE_VM);
2209
2210     ioc = qio_channel_file_new_path(filename, O_RDONLY | O_BINARY, 0, errp);
2211     if (!ioc) {
2212         return;
2213     }
2214     qio_channel_set_name(QIO_CHANNEL(ioc), "migration-xen-load-state");
2215     f = qemu_fopen_channel_input(QIO_CHANNEL(ioc));
2216
2217     ret = qemu_loadvm_state(f);
2218     qemu_fclose(f);
2219     if (ret < 0) {
2220         error_setg(errp, QERR_IO_ERROR);
2221     }
2222     migration_incoming_state_destroy();
2223 }
2224
2225 int load_vmstate(const char *name, Error **errp)
2226 {
2227     BlockDriverState *bs, *bs_vm_state;
2228     QEMUSnapshotInfo sn;
2229     QEMUFile *f;
2230     int ret;
2231     AioContext *aio_context;
2232     MigrationIncomingState *mis = migration_incoming_get_current();
2233
2234     if (!bdrv_all_can_snapshot(&bs)) {
2235         error_setg(errp,
2236                    "Device '%s' is writable but does not support snapshots",
2237                    bdrv_get_device_name(bs));
2238         return -ENOTSUP;
2239     }
2240     ret = bdrv_all_find_snapshot(name, &bs);
2241     if (ret < 0) {
2242         error_setg(errp,
2243                    "Device '%s' does not have the requested snapshot '%s'",
2244                    bdrv_get_device_name(bs), name);
2245         return ret;
2246     }
2247
2248     bs_vm_state = bdrv_all_find_vmstate_bs();
2249     if (!bs_vm_state) {
2250         error_setg(errp, "No block device supports snapshots");
2251         return -ENOTSUP;
2252     }
2253     aio_context = bdrv_get_aio_context(bs_vm_state);
2254
2255     /* Don't even try to load empty VM states */
2256     aio_context_acquire(aio_context);
2257     ret = bdrv_snapshot_find(bs_vm_state, &sn, name);
2258     aio_context_release(aio_context);
2259     if (ret < 0) {
2260         return ret;
2261     } else if (sn.vm_state_size == 0) {
2262         error_setg(errp, "This is a disk-only snapshot. Revert to it "
2263                    " offline using qemu-img");
2264         return -EINVAL;
2265     }
2266
2267     /* Flush all IO requests so they don't interfere with the new state.  */
2268     bdrv_drain_all();
2269
2270     ret = bdrv_all_goto_snapshot(name, &bs);
2271     if (ret < 0) {
2272         error_setg(errp, "Error %d while activating snapshot '%s' on '%s'",
2273                      ret, name, bdrv_get_device_name(bs));
2274         return ret;
2275     }
2276
2277     /* restore the VM state */
2278     f = qemu_fopen_bdrv(bs_vm_state, 0);
2279     if (!f) {
2280         error_setg(errp, "Could not open VM state file");
2281         return -EINVAL;
2282     }
2283
2284     qemu_system_reset(SHUTDOWN_CAUSE_NONE);
2285     mis->from_src_file = f;
2286
2287     aio_context_acquire(aio_context);
2288     ret = qemu_loadvm_state(f);
2289     qemu_fclose(f);
2290     aio_context_release(aio_context);
2291
2292     migration_incoming_state_destroy();
2293     if (ret < 0) {
2294         error_setg(errp, "Error %d while loading VM state", ret);
2295         return ret;
2296     }
2297
2298     return 0;
2299 }
2300
2301 void vmstate_register_ram(MemoryRegion *mr, DeviceState *dev)
2302 {
2303     qemu_ram_set_idstr(mr->ram_block,
2304                        memory_region_name(mr), dev);
2305 }
2306
2307 void vmstate_unregister_ram(MemoryRegion *mr, DeviceState *dev)
2308 {
2309     qemu_ram_unset_idstr(mr->ram_block);
2310 }
2311
2312 void vmstate_register_ram_global(MemoryRegion *mr)
2313 {
2314     vmstate_register_ram(mr, NULL);
2315 }
2316
2317 bool vmstate_check_only_migratable(const VMStateDescription *vmsd)
2318 {
2319     /* check needed if --only-migratable is specified */
2320     if (!only_migratable) {
2321         return true;
2322     }
2323
2324     return !(vmsd && vmsd->unmigratable);
2325 }