migration: Accept 'cont' only after successful incoming migration

When a 'cont' is issued on a VM that's just waiting for an incoming
migration, the VM reboots and boots into the guest, possibly corrupting
its storage since it could be shared with another VM running elsewhere.

Ensure that a VM started with '-incoming' is only run when an incoming
migration successfully completes.

A new qerror, QERR_MIGRATION_EXPECTED, is added to signal that 'cont'
failed due to no incoming migration has been attempted yet.

Reported-by: Laine Stump <[email protected]>
Signed-off-by: Amit Shah <[email protected]>
Reviewed-by: Luiz Capitulino <[email protected]>
Signed-off-by: Aurelien Jarno <[email protected]>

diff --git a/migration.c b/migration.c
index 650eb78d2688e063a4bbb58b698098f8872f4c8c..a160462dfa68de92b71683113319c27a09a8bdcc 100644 (file)
--- a/migration.c
+++ b/migration.c
@@ -67,6 +67,8 @@ void process_incoming_migration(QEMUFile *f)
     qemu_announce_self();
     DPRINTF("successfully loaded vm state\n");
 
+    incoming_expected = false;
+
     if (autostart)
         vm_start();
 }

diff --git a/monitor.c b/monitor.c
index 45fd48291a2b67492e7407ccd3a7021f257799ff..5366c36525fd1ea1c80c64c21cb47186c3b144c8 100644 (file)
--- a/monitor.c
+++ b/monitor.c
@@ -1056,6 +1056,10 @@ static int do_cont(Monitor *mon, const QDict *qdict, QObject **ret_data)
 {
     struct bdrv_iterate_context context = { mon, 0 };
 
+    if (incoming_expected) {
+        qerror_report(QERR_MIGRATION_EXPECTED);
+        return -1;
+    }
     bdrv_iterate(encrypted_bdrv_it, &context);
     /* only resume the vm if all keys are set and valid */
     if (!context.err) {

diff --git a/qerror.c b/qerror.c
index 2f6f59061f317a1d0fee11d357e4dc89774f38dd..0af3ab32bd751dd35dbef3cf83c4acae8f2ea098 100644 (file)
--- a/qerror.c
+++ b/qerror.c
@@ -140,6 +140,10 @@ static const QErrorStringTable qerror_table[] = {
         .error_fmt = QERR_KVM_MISSING_CAP,
         .desc      = "Using KVM without %(capability), %(feature) unavailable",
     },
+    {
+        .error_fmt = QERR_MIGRATION_EXPECTED,
+        .desc      = "An incoming migration is expected before this command can be executed",
+    },
     {
         .error_fmt = QERR_MISSING_PARAMETER,
         .desc      = "Parameter '%(name)' is missing",

diff --git a/qerror.h b/qerror.h
index 9ad00b4b82fbe60aea34ef2e81158945ec293fa3..62802ea08f58081a34f7b36a8187b883644a05ac 100644 (file)
--- a/qerror.h
+++ b/qerror.h
@@ -121,6 +121,9 @@ QError *qobject_to_qerror(const QObject *obj);
 #define QERR_KVM_MISSING_CAP \
     "{ 'class': 'KVMMissingCap', 'data': { 'capability': %s, 'feature': %s } }"
 
+#define QERR_MIGRATION_EXPECTED \
+    "{ 'class': 'MigrationExpected', 'data': {} }"
+
 #define QERR_MISSING_PARAMETER \
     "{ 'class': 'MissingParameter', 'data': { 'name': %s } }"
 

diff --git a/sysemu.h b/sysemu.h
index 9c988bb2a3bcaed0a038c17043d7eb0a2bf0df5d..a1f6466ac222b3a884849d5b35a79b06345d5c19 100644 (file)
--- a/sysemu.h
+++ b/sysemu.h
@@ -99,6 +99,7 @@ typedef enum DisplayType
 } DisplayType;
 
 extern int autostart;
+extern int incoming_expected;
 extern int bios_size;
 
 typedef enum {

diff --git a/vl.c b/vl.c
index 140683115b36b04488110f023081b2f2dd3366b0..b3e3676351f4a88af497f77f10d7bc189fc176c5 100644 (file)
--- a/vl.c
+++ b/vl.c
@@ -182,6 +182,7 @@ int nb_nics;
 NICInfo nd_table[MAX_NICS];
 int vm_running;
 int autostart;
+int incoming_expected; /* Started with -incoming and waiting for incoming */
 static int rtc_utc = 1;
 static int rtc_date_offset = -1; /* -1 means no change */
 QEMUClock *rtc_clock;
@@ -2555,6 +2556,7 @@ int main(int argc, char **argv, char **envp)
                 break;
             case QEMU_OPTION_incoming:
                 incoming = optarg;
+                incoming_expected = true;
                 break;
             case QEMU_OPTION_nodefaults:
                 default_serial = 0;