xref: /qemu/migration/savevm.c (revision 46f5ac20)
1 /*
2  * QEMU System Emulator
3  *
4  * Copyright (c) 2003-2008 Fabrice Bellard
5  * Copyright (c) 2009-2015 Red Hat Inc
6  *
7  * Authors:
8  *  Juan Quintela <quintela@redhat.com>
9  *
10  * Permission is hereby granted, free of charge, to any person obtaining a copy
11  * of this software and associated documentation files (the "Software"), to deal
12  * in the Software without restriction, including without limitation the rights
13  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14  * copies of the Software, and to permit persons to whom the Software is
15  * furnished to do so, subject to the following conditions:
16  *
17  * The above copyright notice and this permission notice shall be included in
18  * all copies or substantial portions of the Software.
19  *
20  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26  * THE SOFTWARE.
27  */
28 
29 #include "qemu/osdep.h"
30 #include "cpu.h"
31 #include "hw/boards.h"
32 #include "hw/hw.h"
33 #include "hw/qdev.h"
34 #include "hw/xen/xen.h"
35 #include "net/net.h"
36 #include "sysemu/sysemu.h"
37 #include "qemu/timer.h"
38 #include "migration/migration.h"
39 #include "postcopy-ram.h"
40 #include "qapi/qmp/qerror.h"
41 #include "qemu/error-report.h"
42 #include "qemu/queue.h"
43 #include "sysemu/cpus.h"
44 #include "exec/memory.h"
45 #include "qmp-commands.h"
46 #include "trace.h"
47 #include "qemu/bitops.h"
48 #include "qemu/iov.h"
49 #include "block/snapshot.h"
50 #include "qemu/cutils.h"
51 #include "io/channel-buffer.h"
52 #include "io/channel-file.h"
53 
54 #ifndef ETH_P_RARP
55 #define ETH_P_RARP 0x8035
56 #endif
57 #define ARP_HTYPE_ETH 0x0001
58 #define ARP_PTYPE_IP 0x0800
59 #define ARP_OP_REQUEST_REV 0x3
60 
61 const unsigned int postcopy_ram_discard_version = 0;
62 
63 static bool skip_section_footers;
64 
65 static struct mig_cmd_args {
66     ssize_t     len; /* -1 = variable */
67     const char *name;
68 } mig_cmd_args[] = {
69     [MIG_CMD_INVALID]          = { .len = -1, .name = "INVALID" },
70     [MIG_CMD_OPEN_RETURN_PATH] = { .len =  0, .name = "OPEN_RETURN_PATH" },
71     [MIG_CMD_PING]             = { .len = sizeof(uint32_t), .name = "PING" },
72     [MIG_CMD_POSTCOPY_ADVISE]  = { .len = 16, .name = "POSTCOPY_ADVISE" },
73     [MIG_CMD_POSTCOPY_LISTEN]  = { .len =  0, .name = "POSTCOPY_LISTEN" },
74     [MIG_CMD_POSTCOPY_RUN]     = { .len =  0, .name = "POSTCOPY_RUN" },
75     [MIG_CMD_POSTCOPY_RAM_DISCARD] = {
76                                    .len = -1, .name = "POSTCOPY_RAM_DISCARD" },
77     [MIG_CMD_PACKAGED]         = { .len =  4, .name = "PACKAGED" },
78     [MIG_CMD_MAX]              = { .len = -1, .name = "MAX" },
79 };
80 
81 static int announce_self_create(uint8_t *buf,
82                                 uint8_t *mac_addr)
83 {
84     /* Ethernet header. */
85     memset(buf, 0xff, 6);         /* destination MAC addr */
86     memcpy(buf + 6, mac_addr, 6); /* source MAC addr */
87     *(uint16_t *)(buf + 12) = htons(ETH_P_RARP); /* ethertype */
88 
89     /* RARP header. */
90     *(uint16_t *)(buf + 14) = htons(ARP_HTYPE_ETH); /* hardware addr space */
91     *(uint16_t *)(buf + 16) = htons(ARP_PTYPE_IP); /* protocol addr space */
92     *(buf + 18) = 6; /* hardware addr length (ethernet) */
93     *(buf + 19) = 4; /* protocol addr length (IPv4) */
94     *(uint16_t *)(buf + 20) = htons(ARP_OP_REQUEST_REV); /* opcode */
95     memcpy(buf + 22, mac_addr, 6); /* source hw addr */
96     memset(buf + 28, 0x00, 4);     /* source protocol addr */
97     memcpy(buf + 32, mac_addr, 6); /* target hw addr */
98     memset(buf + 38, 0x00, 4);     /* target protocol addr */
99 
100     /* Padding to get up to 60 bytes (ethernet min packet size, minus FCS). */
101     memset(buf + 42, 0x00, 18);
102 
103     return 60; /* len (FCS will be added by hardware) */
104 }
105 
106 static void qemu_announce_self_iter(NICState *nic, void *opaque)
107 {
108     uint8_t buf[60];
109     int len;
110 
111     trace_qemu_announce_self_iter(qemu_ether_ntoa(&nic->conf->macaddr));
112     len = announce_self_create(buf, nic->conf->macaddr.a);
113 
114     qemu_send_packet_raw(qemu_get_queue(nic), buf, len);
115 }
116 
117 
118 static void qemu_announce_self_once(void *opaque)
119 {
120     static int count = SELF_ANNOUNCE_ROUNDS;
121     QEMUTimer *timer = *(QEMUTimer **)opaque;
122 
123     qemu_foreach_nic(qemu_announce_self_iter, NULL);
124 
125     if (--count) {
126         /* delay 50ms, 150ms, 250ms, ... */
127         timer_mod(timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) +
128                   self_announce_delay(count));
129     } else {
130             timer_del(timer);
131             timer_free(timer);
132     }
133 }
134 
135 void qemu_announce_self(void)
136 {
137     static QEMUTimer *timer;
138     timer = timer_new_ms(QEMU_CLOCK_REALTIME, qemu_announce_self_once, &timer);
139     qemu_announce_self_once(&timer);
140 }
141 
142 /***********************************************************/
143 /* savevm/loadvm support */
144 
145 static ssize_t block_writev_buffer(void *opaque, struct iovec *iov, int iovcnt,
146                                    int64_t pos)
147 {
148     int ret;
149     QEMUIOVector qiov;
150 
151     qemu_iovec_init_external(&qiov, iov, iovcnt);
152     ret = bdrv_writev_vmstate(opaque, &qiov, pos);
153     if (ret < 0) {
154         return ret;
155     }
156 
157     return qiov.size;
158 }
159 
160 static ssize_t block_get_buffer(void *opaque, uint8_t *buf, int64_t pos,
161                                 size_t size)
162 {
163     return bdrv_load_vmstate(opaque, buf, pos, size);
164 }
165 
166 static int bdrv_fclose(void *opaque)
167 {
168     return bdrv_flush(opaque);
169 }
170 
171 static const QEMUFileOps bdrv_read_ops = {
172     .get_buffer = block_get_buffer,
173     .close =      bdrv_fclose
174 };
175 
176 static const QEMUFileOps bdrv_write_ops = {
177     .writev_buffer  = block_writev_buffer,
178     .close          = bdrv_fclose
179 };
180 
181 static QEMUFile *qemu_fopen_bdrv(BlockDriverState *bs, int is_writable)
182 {
183     if (is_writable) {
184         return qemu_fopen_ops(bs, &bdrv_write_ops);
185     }
186     return qemu_fopen_ops(bs, &bdrv_read_ops);
187 }
188 
189 
190 /* QEMUFile timer support.
191  * Not in qemu-file.c to not add qemu-timer.c as dependency to qemu-file.c
192  */
193 
194 void timer_put(QEMUFile *f, QEMUTimer *ts)
195 {
196     uint64_t expire_time;
197 
198     expire_time = timer_expire_time_ns(ts);
199     qemu_put_be64(f, expire_time);
200 }
201 
202 void timer_get(QEMUFile *f, QEMUTimer *ts)
203 {
204     uint64_t expire_time;
205 
206     expire_time = qemu_get_be64(f);
207     if (expire_time != -1) {
208         timer_mod_ns(ts, expire_time);
209     } else {
210         timer_del(ts);
211     }
212 }
213 
214 
215 /* VMState timer support.
216  * Not in vmstate.c to not add qemu-timer.c as dependency to vmstate.c
217  */
218 
219 static int get_timer(QEMUFile *f, void *pv, size_t size, VMStateField *field)
220 {
221     QEMUTimer *v = pv;
222     timer_get(f, v);
223     return 0;
224 }
225 
226 static int put_timer(QEMUFile *f, void *pv, size_t size, VMStateField *field,
227                      QJSON *vmdesc)
228 {
229     QEMUTimer *v = pv;
230     timer_put(f, v);
231 
232     return 0;
233 }
234 
235 const VMStateInfo vmstate_info_timer = {
236     .name = "timer",
237     .get  = get_timer,
238     .put  = put_timer,
239 };
240 
241 
242 typedef struct CompatEntry {
243     char idstr[256];
244     int instance_id;
245 } CompatEntry;
246 
247 typedef struct SaveStateEntry {
248     QTAILQ_ENTRY(SaveStateEntry) entry;
249     char idstr[256];
250     int instance_id;
251     int alias_id;
252     int version_id;
253     int section_id;
254     SaveVMHandlers *ops;
255     const VMStateDescription *vmsd;
256     void *opaque;
257     CompatEntry *compat;
258     int is_ram;
259 } SaveStateEntry;
260 
261 typedef struct SaveState {
262     QTAILQ_HEAD(, SaveStateEntry) handlers;
263     int global_section_id;
264     bool skip_configuration;
265     uint32_t len;
266     const char *name;
267     uint32_t target_page_bits;
268 } SaveState;
269 
270 static SaveState savevm_state = {
271     .handlers = QTAILQ_HEAD_INITIALIZER(savevm_state.handlers),
272     .global_section_id = 0,
273     .skip_configuration = false,
274 };
275 
276 void savevm_skip_configuration(void)
277 {
278     savevm_state.skip_configuration = true;
279 }
280 
281 
282 static void configuration_pre_save(void *opaque)
283 {
284     SaveState *state = opaque;
285     const char *current_name = MACHINE_GET_CLASS(current_machine)->name;
286 
287     state->len = strlen(current_name);
288     state->name = current_name;
289     state->target_page_bits = TARGET_PAGE_BITS;
290 }
291 
292 static int configuration_pre_load(void *opaque)
293 {
294     SaveState *state = opaque;
295 
296     /* If there is no target-page-bits subsection it means the source
297      * predates the variable-target-page-bits support and is using the
298      * minimum possible value for this CPU.
299      */
300     state->target_page_bits = TARGET_PAGE_BITS_MIN;
301     return 0;
302 }
303 
304 static int configuration_post_load(void *opaque, int version_id)
305 {
306     SaveState *state = opaque;
307     const char *current_name = MACHINE_GET_CLASS(current_machine)->name;
308 
309     if (strncmp(state->name, current_name, state->len) != 0) {
310         error_report("Machine type received is '%.*s' and local is '%s'",
311                      (int) state->len, state->name, current_name);
312         return -EINVAL;
313     }
314 
315     if (state->target_page_bits != TARGET_PAGE_BITS) {
316         error_report("Received TARGET_PAGE_BITS is %d but local is %d",
317                      state->target_page_bits, TARGET_PAGE_BITS);
318         return -EINVAL;
319     }
320 
321     return 0;
322 }
323 
324 /* The target-page-bits subsection is present only if the
325  * target page size is not the same as the default (ie the
326  * minimum page size for a variable-page-size guest CPU).
327  * If it is present then it contains the actual target page
328  * bits for the machine, and migration will fail if the
329  * two ends don't agree about it.
330  */
331 static bool vmstate_target_page_bits_needed(void *opaque)
332 {
333     return TARGET_PAGE_BITS > TARGET_PAGE_BITS_MIN;
334 }
335 
336 static const VMStateDescription vmstate_target_page_bits = {
337     .name = "configuration/target-page-bits",
338     .version_id = 1,
339     .minimum_version_id = 1,
340     .needed = vmstate_target_page_bits_needed,
341     .fields = (VMStateField[]) {
342         VMSTATE_UINT32(target_page_bits, SaveState),
343         VMSTATE_END_OF_LIST()
344     }
345 };
346 
347 static const VMStateDescription vmstate_configuration = {
348     .name = "configuration",
349     .version_id = 1,
350     .pre_load = configuration_pre_load,
351     .post_load = configuration_post_load,
352     .pre_save = configuration_pre_save,
353     .fields = (VMStateField[]) {
354         VMSTATE_UINT32(len, SaveState),
355         VMSTATE_VBUFFER_ALLOC_UINT32(name, SaveState, 0, NULL, len),
356         VMSTATE_END_OF_LIST()
357     },
358     .subsections = (const VMStateDescription*[]) {
359         &vmstate_target_page_bits,
360         NULL
361     }
362 };
363 
364 static void dump_vmstate_vmsd(FILE *out_file,
365                               const VMStateDescription *vmsd, int indent,
366                               bool is_subsection);
367 
368 static void dump_vmstate_vmsf(FILE *out_file, const VMStateField *field,
369                               int indent)
370 {
371     fprintf(out_file, "%*s{\n", indent, "");
372     indent += 2;
373     fprintf(out_file, "%*s\"field\": \"%s\",\n", indent, "", field->name);
374     fprintf(out_file, "%*s\"version_id\": %d,\n", indent, "",
375             field->version_id);
376     fprintf(out_file, "%*s\"field_exists\": %s,\n", indent, "",
377             field->field_exists ? "true" : "false");
378     fprintf(out_file, "%*s\"size\": %zu", indent, "", field->size);
379     if (field->vmsd != NULL) {
380         fprintf(out_file, ",\n");
381         dump_vmstate_vmsd(out_file, field->vmsd, indent, false);
382     }
383     fprintf(out_file, "\n%*s}", indent - 2, "");
384 }
385 
386 static void dump_vmstate_vmss(FILE *out_file,
387                               const VMStateDescription **subsection,
388                               int indent)
389 {
390     if (*subsection != NULL) {
391         dump_vmstate_vmsd(out_file, *subsection, indent, true);
392     }
393 }
394 
395 static void dump_vmstate_vmsd(FILE *out_file,
396                               const VMStateDescription *vmsd, int indent,
397                               bool is_subsection)
398 {
399     if (is_subsection) {
400         fprintf(out_file, "%*s{\n", indent, "");
401     } else {
402         fprintf(out_file, "%*s\"%s\": {\n", indent, "", "Description");
403     }
404     indent += 2;
405     fprintf(out_file, "%*s\"name\": \"%s\",\n", indent, "", vmsd->name);
406     fprintf(out_file, "%*s\"version_id\": %d,\n", indent, "",
407             vmsd->version_id);
408     fprintf(out_file, "%*s\"minimum_version_id\": %d", indent, "",
409             vmsd->minimum_version_id);
410     if (vmsd->fields != NULL) {
411         const VMStateField *field = vmsd->fields;
412         bool first;
413 
414         fprintf(out_file, ",\n%*s\"Fields\": [\n", indent, "");
415         first = true;
416         while (field->name != NULL) {
417             if (field->flags & VMS_MUST_EXIST) {
418                 /* Ignore VMSTATE_VALIDATE bits; these don't get migrated */
419                 field++;
420                 continue;
421             }
422             if (!first) {
423                 fprintf(out_file, ",\n");
424             }
425             dump_vmstate_vmsf(out_file, field, indent + 2);
426             field++;
427             first = false;
428         }
429         fprintf(out_file, "\n%*s]", indent, "");
430     }
431     if (vmsd->subsections != NULL) {
432         const VMStateDescription **subsection = vmsd->subsections;
433         bool first;
434 
435         fprintf(out_file, ",\n%*s\"Subsections\": [\n", indent, "");
436         first = true;
437         while (*subsection != NULL) {
438             if (!first) {
439                 fprintf(out_file, ",\n");
440             }
441             dump_vmstate_vmss(out_file, subsection, indent + 2);
442             subsection++;
443             first = false;
444         }
445         fprintf(out_file, "\n%*s]", indent, "");
446     }
447     fprintf(out_file, "\n%*s}", indent - 2, "");
448 }
449 
450 static void dump_machine_type(FILE *out_file)
451 {
452     MachineClass *mc;
453 
454     mc = MACHINE_GET_CLASS(current_machine);
455 
456     fprintf(out_file, "  \"vmschkmachine\": {\n");
457     fprintf(out_file, "    \"Name\": \"%s\"\n", mc->name);
458     fprintf(out_file, "  },\n");
459 }
460 
461 void dump_vmstate_json_to_file(FILE *out_file)
462 {
463     GSList *list, *elt;
464     bool first;
465 
466     fprintf(out_file, "{\n");
467     dump_machine_type(out_file);
468 
469     first = true;
470     list = object_class_get_list(TYPE_DEVICE, true);
471     for (elt = list; elt; elt = elt->next) {
472         DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, elt->data,
473                                              TYPE_DEVICE);
474         const char *name;
475         int indent = 2;
476 
477         if (!dc->vmsd) {
478             continue;
479         }
480 
481         if (!first) {
482             fprintf(out_file, ",\n");
483         }
484         name = object_class_get_name(OBJECT_CLASS(dc));
485         fprintf(out_file, "%*s\"%s\": {\n", indent, "", name);
486         indent += 2;
487         fprintf(out_file, "%*s\"Name\": \"%s\",\n", indent, "", name);
488         fprintf(out_file, "%*s\"version_id\": %d,\n", indent, "",
489                 dc->vmsd->version_id);
490         fprintf(out_file, "%*s\"minimum_version_id\": %d,\n", indent, "",
491                 dc->vmsd->minimum_version_id);
492 
493         dump_vmstate_vmsd(out_file, dc->vmsd, indent, false);
494 
495         fprintf(out_file, "\n%*s}", indent - 2, "");
496         first = false;
497     }
498     fprintf(out_file, "\n}\n");
499     fclose(out_file);
500 }
501 
502 static int calculate_new_instance_id(const char *idstr)
503 {
504     SaveStateEntry *se;
505     int instance_id = 0;
506 
507     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
508         if (strcmp(idstr, se->idstr) == 0
509             && instance_id <= se->instance_id) {
510             instance_id = se->instance_id + 1;
511         }
512     }
513     return instance_id;
514 }
515 
516 static int calculate_compat_instance_id(const char *idstr)
517 {
518     SaveStateEntry *se;
519     int instance_id = 0;
520 
521     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
522         if (!se->compat) {
523             continue;
524         }
525 
526         if (strcmp(idstr, se->compat->idstr) == 0
527             && instance_id <= se->compat->instance_id) {
528             instance_id = se->compat->instance_id + 1;
529         }
530     }
531     return instance_id;
532 }
533 
534 static inline MigrationPriority save_state_priority(SaveStateEntry *se)
535 {
536     if (se->vmsd) {
537         return se->vmsd->priority;
538     }
539     return MIG_PRI_DEFAULT;
540 }
541 
542 static void savevm_state_handler_insert(SaveStateEntry *nse)
543 {
544     MigrationPriority priority = save_state_priority(nse);
545     SaveStateEntry *se;
546 
547     assert(priority <= MIG_PRI_MAX);
548 
549     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
550         if (save_state_priority(se) < priority) {
551             break;
552         }
553     }
554 
555     if (se) {
556         QTAILQ_INSERT_BEFORE(se, nse, entry);
557     } else {
558         QTAILQ_INSERT_TAIL(&savevm_state.handlers, nse, entry);
559     }
560 }
561 
562 /* TODO: Individual devices generally have very little idea about the rest
563    of the system, so instance_id should be removed/replaced.
564    Meanwhile pass -1 as instance_id if you do not already have a clearly
565    distinguishing id for all instances of your device class. */
566 int register_savevm_live(DeviceState *dev,
567                          const char *idstr,
568                          int instance_id,
569                          int version_id,
570                          SaveVMHandlers *ops,
571                          void *opaque)
572 {
573     SaveStateEntry *se;
574 
575     se = g_new0(SaveStateEntry, 1);
576     se->version_id = version_id;
577     se->section_id = savevm_state.global_section_id++;
578     se->ops = ops;
579     se->opaque = opaque;
580     se->vmsd = NULL;
581     /* if this is a live_savem then set is_ram */
582     if (ops->save_live_setup != NULL) {
583         se->is_ram = 1;
584     }
585 
586     if (dev) {
587         char *id = qdev_get_dev_path(dev);
588         if (id) {
589             if (snprintf(se->idstr, sizeof(se->idstr), "%s/", id) >=
590                 sizeof(se->idstr)) {
591                 error_report("Path too long for VMState (%s)", id);
592                 g_free(id);
593                 g_free(se);
594 
595                 return -1;
596             }
597             g_free(id);
598 
599             se->compat = g_new0(CompatEntry, 1);
600             pstrcpy(se->compat->idstr, sizeof(se->compat->idstr), idstr);
601             se->compat->instance_id = instance_id == -1 ?
602                          calculate_compat_instance_id(idstr) : instance_id;
603             instance_id = -1;
604         }
605     }
606     pstrcat(se->idstr, sizeof(se->idstr), idstr);
607 
608     if (instance_id == -1) {
609         se->instance_id = calculate_new_instance_id(se->idstr);
610     } else {
611         se->instance_id = instance_id;
612     }
613     assert(!se->compat || se->instance_id == 0);
614     savevm_state_handler_insert(se);
615     return 0;
616 }
617 
618 int register_savevm(DeviceState *dev,
619                     const char *idstr,
620                     int instance_id,
621                     int version_id,
622                     SaveStateHandler *save_state,
623                     LoadStateHandler *load_state,
624                     void *opaque)
625 {
626     SaveVMHandlers *ops = g_new0(SaveVMHandlers, 1);
627     ops->save_state = save_state;
628     ops->load_state = load_state;
629     return register_savevm_live(dev, idstr, instance_id, version_id,
630                                 ops, opaque);
631 }
632 
633 void unregister_savevm(DeviceState *dev, const char *idstr, void *opaque)
634 {
635     SaveStateEntry *se, *new_se;
636     char id[256] = "";
637 
638     if (dev) {
639         char *path = qdev_get_dev_path(dev);
640         if (path) {
641             pstrcpy(id, sizeof(id), path);
642             pstrcat(id, sizeof(id), "/");
643             g_free(path);
644         }
645     }
646     pstrcat(id, sizeof(id), idstr);
647 
648     QTAILQ_FOREACH_SAFE(se, &savevm_state.handlers, entry, new_se) {
649         if (strcmp(se->idstr, id) == 0 && se->opaque == opaque) {
650             QTAILQ_REMOVE(&savevm_state.handlers, se, entry);
651             g_free(se->compat);
652             g_free(se->ops);
653             g_free(se);
654         }
655     }
656 }
657 
658 int vmstate_register_with_alias_id(DeviceState *dev, int instance_id,
659                                    const VMStateDescription *vmsd,
660                                    void *opaque, int alias_id,
661                                    int required_for_version,
662                                    Error **errp)
663 {
664     SaveStateEntry *se;
665 
666     /* If this triggers, alias support can be dropped for the vmsd. */
667     assert(alias_id == -1 || required_for_version >= vmsd->minimum_version_id);
668 
669     se = g_new0(SaveStateEntry, 1);
670     se->version_id = vmsd->version_id;
671     se->section_id = savevm_state.global_section_id++;
672     se->opaque = opaque;
673     se->vmsd = vmsd;
674     se->alias_id = alias_id;
675 
676     if (dev) {
677         char *id = qdev_get_dev_path(dev);
678         if (id) {
679             if (snprintf(se->idstr, sizeof(se->idstr), "%s/", id) >=
680                 sizeof(se->idstr)) {
681                 error_setg(errp, "Path too long for VMState (%s)", id);
682                 g_free(id);
683                 g_free(se);
684 
685                 return -1;
686             }
687             g_free(id);
688 
689             se->compat = g_new0(CompatEntry, 1);
690             pstrcpy(se->compat->idstr, sizeof(se->compat->idstr), vmsd->name);
691             se->compat->instance_id = instance_id == -1 ?
692                          calculate_compat_instance_id(vmsd->name) : instance_id;
693             instance_id = -1;
694         }
695     }
696     pstrcat(se->idstr, sizeof(se->idstr), vmsd->name);
697 
698     if (instance_id == -1) {
699         se->instance_id = calculate_new_instance_id(se->idstr);
700     } else {
701         se->instance_id = instance_id;
702     }
703     assert(!se->compat || se->instance_id == 0);
704     savevm_state_handler_insert(se);
705     return 0;
706 }
707 
708 void vmstate_unregister(DeviceState *dev, const VMStateDescription *vmsd,
709                         void *opaque)
710 {
711     SaveStateEntry *se, *new_se;
712 
713     QTAILQ_FOREACH_SAFE(se, &savevm_state.handlers, entry, new_se) {
714         if (se->vmsd == vmsd && se->opaque == opaque) {
715             QTAILQ_REMOVE(&savevm_state.handlers, se, entry);
716             g_free(se->compat);
717             g_free(se);
718         }
719     }
720 }
721 
722 static int vmstate_load(QEMUFile *f, SaveStateEntry *se, int version_id)
723 {
724     trace_vmstate_load(se->idstr, se->vmsd ? se->vmsd->name : "(old)");
725     if (!se->vmsd) {         /* Old style */
726         return se->ops->load_state(f, se->opaque, version_id);
727     }
728     return vmstate_load_state(f, se->vmsd, se->opaque, version_id);
729 }
730 
731 static void vmstate_save_old_style(QEMUFile *f, SaveStateEntry *se, QJSON *vmdesc)
732 {
733     int64_t old_offset, size;
734 
735     old_offset = qemu_ftell_fast(f);
736     se->ops->save_state(f, se->opaque);
737     size = qemu_ftell_fast(f) - old_offset;
738 
739     if (vmdesc) {
740         json_prop_int(vmdesc, "size", size);
741         json_start_array(vmdesc, "fields");
742         json_start_object(vmdesc, NULL);
743         json_prop_str(vmdesc, "name", "data");
744         json_prop_int(vmdesc, "size", size);
745         json_prop_str(vmdesc, "type", "buffer");
746         json_end_object(vmdesc);
747         json_end_array(vmdesc);
748     }
749 }
750 
751 static void vmstate_save(QEMUFile *f, SaveStateEntry *se, QJSON *vmdesc)
752 {
753     trace_vmstate_save(se->idstr, se->vmsd ? se->vmsd->name : "(old)");
754     if (!se->vmsd) {
755         vmstate_save_old_style(f, se, vmdesc);
756         return;
757     }
758     vmstate_save_state(f, se->vmsd, se->opaque, vmdesc);
759 }
760 
761 void savevm_skip_section_footers(void)
762 {
763     skip_section_footers = true;
764 }
765 
766 /*
767  * Write the header for device section (QEMU_VM_SECTION START/END/PART/FULL)
768  */
769 static void save_section_header(QEMUFile *f, SaveStateEntry *se,
770                                 uint8_t section_type)
771 {
772     qemu_put_byte(f, section_type);
773     qemu_put_be32(f, se->section_id);
774 
775     if (section_type == QEMU_VM_SECTION_FULL ||
776         section_type == QEMU_VM_SECTION_START) {
777         /* ID string */
778         size_t len = strlen(se->idstr);
779         qemu_put_byte(f, len);
780         qemu_put_buffer(f, (uint8_t *)se->idstr, len);
781 
782         qemu_put_be32(f, se->instance_id);
783         qemu_put_be32(f, se->version_id);
784     }
785 }
786 
787 /*
788  * Write a footer onto device sections that catches cases misformatted device
789  * sections.
790  */
791 static void save_section_footer(QEMUFile *f, SaveStateEntry *se)
792 {
793     if (!skip_section_footers) {
794         qemu_put_byte(f, QEMU_VM_SECTION_FOOTER);
795         qemu_put_be32(f, se->section_id);
796     }
797 }
798 
799 /**
800  * qemu_savevm_command_send: Send a 'QEMU_VM_COMMAND' type element with the
801  *                           command and associated data.
802  *
803  * @f: File to send command on
804  * @command: Command type to send
805  * @len: Length of associated data
806  * @data: Data associated with command.
807  */
808 void qemu_savevm_command_send(QEMUFile *f,
809                               enum qemu_vm_cmd command,
810                               uint16_t len,
811                               uint8_t *data)
812 {
813     trace_savevm_command_send(command, len);
814     qemu_put_byte(f, QEMU_VM_COMMAND);
815     qemu_put_be16(f, (uint16_t)command);
816     qemu_put_be16(f, len);
817     qemu_put_buffer(f, data, len);
818     qemu_fflush(f);
819 }
820 
821 void qemu_savevm_send_ping(QEMUFile *f, uint32_t value)
822 {
823     uint32_t buf;
824 
825     trace_savevm_send_ping(value);
826     buf = cpu_to_be32(value);
827     qemu_savevm_command_send(f, MIG_CMD_PING, sizeof(value), (uint8_t *)&buf);
828 }
829 
830 void qemu_savevm_send_open_return_path(QEMUFile *f)
831 {
832     trace_savevm_send_open_return_path();
833     qemu_savevm_command_send(f, MIG_CMD_OPEN_RETURN_PATH, 0, NULL);
834 }
835 
836 /* We have a buffer of data to send; we don't want that all to be loaded
837  * by the command itself, so the command contains just the length of the
838  * extra buffer that we then send straight after it.
839  * TODO: Must be a better way to organise that
840  *
841  * Returns:
842  *    0 on success
843  *    -ve on error
844  */
845 int qemu_savevm_send_packaged(QEMUFile *f, const uint8_t *buf, size_t len)
846 {
847     uint32_t tmp;
848 
849     if (len > MAX_VM_CMD_PACKAGED_SIZE) {
850         error_report("%s: Unreasonably large packaged state: %zu",
851                      __func__, len);
852         return -1;
853     }
854 
855     tmp = cpu_to_be32(len);
856 
857     trace_qemu_savevm_send_packaged();
858     qemu_savevm_command_send(f, MIG_CMD_PACKAGED, 4, (uint8_t *)&tmp);
859 
860     qemu_put_buffer(f, buf, len);
861 
862     return 0;
863 }
864 
865 /* Send prior to any postcopy transfer */
866 void qemu_savevm_send_postcopy_advise(QEMUFile *f)
867 {
868     uint64_t tmp[2];
869     tmp[0] = cpu_to_be64(ram_pagesize_summary());
870     tmp[1] = cpu_to_be64(qemu_target_page_size());
871 
872     trace_qemu_savevm_send_postcopy_advise();
873     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_ADVISE, 16, (uint8_t *)tmp);
874 }
875 
876 /* Sent prior to starting the destination running in postcopy, discard pages
877  * that have already been sent but redirtied on the source.
878  * CMD_POSTCOPY_RAM_DISCARD consist of:
879  *      byte   version (0)
880  *      byte   Length of name field (not including 0)
881  *  n x byte   RAM block name
882  *      byte   0 terminator (just for safety)
883  *  n x        Byte ranges within the named RAMBlock
884  *      be64   Start of the range
885  *      be64   Length
886  *
887  *  name:  RAMBlock name that these entries are part of
888  *  len: Number of page entries
889  *  start_list: 'len' addresses
890  *  length_list: 'len' addresses
891  *
892  */
893 void qemu_savevm_send_postcopy_ram_discard(QEMUFile *f, const char *name,
894                                            uint16_t len,
895                                            uint64_t *start_list,
896                                            uint64_t *length_list)
897 {
898     uint8_t *buf;
899     uint16_t tmplen;
900     uint16_t t;
901     size_t name_len = strlen(name);
902 
903     trace_qemu_savevm_send_postcopy_ram_discard(name, len);
904     assert(name_len < 256);
905     buf = g_malloc0(1 + 1 + name_len + 1 + (8 + 8) * len);
906     buf[0] = postcopy_ram_discard_version;
907     buf[1] = name_len;
908     memcpy(buf + 2, name, name_len);
909     tmplen = 2 + name_len;
910     buf[tmplen++] = '\0';
911 
912     for (t = 0; t < len; t++) {
913         stq_be_p(buf + tmplen, start_list[t]);
914         tmplen += 8;
915         stq_be_p(buf + tmplen, length_list[t]);
916         tmplen += 8;
917     }
918     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_RAM_DISCARD, tmplen, buf);
919     g_free(buf);
920 }
921 
922 /* Get the destination into a state where it can receive postcopy data. */
923 void qemu_savevm_send_postcopy_listen(QEMUFile *f)
924 {
925     trace_savevm_send_postcopy_listen();
926     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_LISTEN, 0, NULL);
927 }
928 
929 /* Kick the destination into running */
930 void qemu_savevm_send_postcopy_run(QEMUFile *f)
931 {
932     trace_savevm_send_postcopy_run();
933     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_RUN, 0, NULL);
934 }
935 
936 bool qemu_savevm_state_blocked(Error **errp)
937 {
938     SaveStateEntry *se;
939 
940     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
941         if (se->vmsd && se->vmsd->unmigratable) {
942             error_setg(errp, "State blocked by non-migratable device '%s'",
943                        se->idstr);
944             return true;
945         }
946     }
947     return false;
948 }
949 
950 static bool enforce_config_section(void)
951 {
952     MachineState *machine = MACHINE(qdev_get_machine());
953     return machine->enforce_config_section;
954 }
955 
956 void qemu_savevm_state_header(QEMUFile *f)
957 {
958     trace_savevm_state_header();
959     qemu_put_be32(f, QEMU_VM_FILE_MAGIC);
960     qemu_put_be32(f, QEMU_VM_FILE_VERSION);
961 
962     if (!savevm_state.skip_configuration || enforce_config_section()) {
963         qemu_put_byte(f, QEMU_VM_CONFIGURATION);
964         vmstate_save_state(f, &vmstate_configuration, &savevm_state, 0);
965     }
966 
967 }
968 
969 void qemu_savevm_state_begin(QEMUFile *f,
970                              const MigrationParams *params)
971 {
972     SaveStateEntry *se;
973     int ret;
974 
975     trace_savevm_state_begin();
976     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
977         if (!se->ops || !se->ops->set_params) {
978             continue;
979         }
980         se->ops->set_params(params, se->opaque);
981     }
982 
983     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
984         if (!se->ops || !se->ops->save_live_setup) {
985             continue;
986         }
987         if (se->ops && se->ops->is_active) {
988             if (!se->ops->is_active(se->opaque)) {
989                 continue;
990             }
991         }
992         save_section_header(f, se, QEMU_VM_SECTION_START);
993 
994         ret = se->ops->save_live_setup(f, se->opaque);
995         save_section_footer(f, se);
996         if (ret < 0) {
997             qemu_file_set_error(f, ret);
998             break;
999         }
1000     }
1001 }
1002 
1003 /*
1004  * this function has three return values:
1005  *   negative: there was one error, and we have -errno.
1006  *   0 : We haven't finished, caller have to go again
1007  *   1 : We have finished, we can go to complete phase
1008  */
1009 int qemu_savevm_state_iterate(QEMUFile *f, bool postcopy)
1010 {
1011     SaveStateEntry *se;
1012     int ret = 1;
1013 
1014     trace_savevm_state_iterate();
1015     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1016         if (!se->ops || !se->ops->save_live_iterate) {
1017             continue;
1018         }
1019         if (se->ops && se->ops->is_active) {
1020             if (!se->ops->is_active(se->opaque)) {
1021                 continue;
1022             }
1023         }
1024         /*
1025          * In the postcopy phase, any device that doesn't know how to
1026          * do postcopy should have saved it's state in the _complete
1027          * call that's already run, it might get confused if we call
1028          * iterate afterwards.
1029          */
1030         if (postcopy && !se->ops->save_live_complete_postcopy) {
1031             continue;
1032         }
1033         if (qemu_file_rate_limit(f)) {
1034             return 0;
1035         }
1036         trace_savevm_section_start(se->idstr, se->section_id);
1037 
1038         save_section_header(f, se, QEMU_VM_SECTION_PART);
1039 
1040         ret = se->ops->save_live_iterate(f, se->opaque);
1041         trace_savevm_section_end(se->idstr, se->section_id, ret);
1042         save_section_footer(f, se);
1043 
1044         if (ret < 0) {
1045             qemu_file_set_error(f, ret);
1046         }
1047         if (ret <= 0) {
1048             /* Do not proceed to the next vmstate before this one reported
1049                completion of the current stage. This serializes the migration
1050                and reduces the probability that a faster changing state is
1051                synchronized over and over again. */
1052             break;
1053         }
1054     }
1055     return ret;
1056 }
1057 
1058 static bool should_send_vmdesc(void)
1059 {
1060     MachineState *machine = MACHINE(qdev_get_machine());
1061     bool in_postcopy = migration_in_postcopy();
1062     return !machine->suppress_vmdesc && !in_postcopy;
1063 }
1064 
1065 /*
1066  * Calls the save_live_complete_postcopy methods
1067  * causing the last few pages to be sent immediately and doing any associated
1068  * cleanup.
1069  * Note postcopy also calls qemu_savevm_state_complete_precopy to complete
1070  * all the other devices, but that happens at the point we switch to postcopy.
1071  */
1072 void qemu_savevm_state_complete_postcopy(QEMUFile *f)
1073 {
1074     SaveStateEntry *se;
1075     int ret;
1076 
1077     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1078         if (!se->ops || !se->ops->save_live_complete_postcopy) {
1079             continue;
1080         }
1081         if (se->ops && se->ops->is_active) {
1082             if (!se->ops->is_active(se->opaque)) {
1083                 continue;
1084             }
1085         }
1086         trace_savevm_section_start(se->idstr, se->section_id);
1087         /* Section type */
1088         qemu_put_byte(f, QEMU_VM_SECTION_END);
1089         qemu_put_be32(f, se->section_id);
1090 
1091         ret = se->ops->save_live_complete_postcopy(f, se->opaque);
1092         trace_savevm_section_end(se->idstr, se->section_id, ret);
1093         save_section_footer(f, se);
1094         if (ret < 0) {
1095             qemu_file_set_error(f, ret);
1096             return;
1097         }
1098     }
1099 
1100     qemu_put_byte(f, QEMU_VM_EOF);
1101     qemu_fflush(f);
1102 }
1103 
1104 void qemu_savevm_state_complete_precopy(QEMUFile *f, bool iterable_only)
1105 {
1106     QJSON *vmdesc;
1107     int vmdesc_len;
1108     SaveStateEntry *se;
1109     int ret;
1110     bool in_postcopy = migration_in_postcopy();
1111 
1112     trace_savevm_state_complete_precopy();
1113 
1114     cpu_synchronize_all_states();
1115 
1116     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1117         if (!se->ops ||
1118             (in_postcopy && se->ops->save_live_complete_postcopy) ||
1119             (in_postcopy && !iterable_only) ||
1120             !se->ops->save_live_complete_precopy) {
1121             continue;
1122         }
1123 
1124         if (se->ops && se->ops->is_active) {
1125             if (!se->ops->is_active(se->opaque)) {
1126                 continue;
1127             }
1128         }
1129         trace_savevm_section_start(se->idstr, se->section_id);
1130 
1131         save_section_header(f, se, QEMU_VM_SECTION_END);
1132 
1133         ret = se->ops->save_live_complete_precopy(f, se->opaque);
1134         trace_savevm_section_end(se->idstr, se->section_id, ret);
1135         save_section_footer(f, se);
1136         if (ret < 0) {
1137             qemu_file_set_error(f, ret);
1138             return;
1139         }
1140     }
1141 
1142     if (iterable_only) {
1143         return;
1144     }
1145 
1146     vmdesc = qjson_new();
1147     json_prop_int(vmdesc, "page_size", TARGET_PAGE_SIZE);
1148     json_start_array(vmdesc, "devices");
1149     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1150 
1151         if ((!se->ops || !se->ops->save_state) && !se->vmsd) {
1152             continue;
1153         }
1154         if (se->vmsd && !vmstate_save_needed(se->vmsd, se->opaque)) {
1155             trace_savevm_section_skip(se->idstr, se->section_id);
1156             continue;
1157         }
1158 
1159         trace_savevm_section_start(se->idstr, se->section_id);
1160 
1161         json_start_object(vmdesc, NULL);
1162         json_prop_str(vmdesc, "name", se->idstr);
1163         json_prop_int(vmdesc, "instance_id", se->instance_id);
1164 
1165         save_section_header(f, se, QEMU_VM_SECTION_FULL);
1166         vmstate_save(f, se, vmdesc);
1167         trace_savevm_section_end(se->idstr, se->section_id, 0);
1168         save_section_footer(f, se);
1169 
1170         json_end_object(vmdesc);
1171     }
1172 
1173     if (!in_postcopy) {
1174         /* Postcopy stream will still be going */
1175         qemu_put_byte(f, QEMU_VM_EOF);
1176     }
1177 
1178     json_end_array(vmdesc);
1179     qjson_finish(vmdesc);
1180     vmdesc_len = strlen(qjson_get_str(vmdesc));
1181 
1182     if (should_send_vmdesc()) {
1183         qemu_put_byte(f, QEMU_VM_VMDESCRIPTION);
1184         qemu_put_be32(f, vmdesc_len);
1185         qemu_put_buffer(f, (uint8_t *)qjson_get_str(vmdesc), vmdesc_len);
1186     }
1187     qjson_destroy(vmdesc);
1188 
1189     qemu_fflush(f);
1190 }
1191 
1192 /* Give an estimate of the amount left to be transferred,
1193  * the result is split into the amount for units that can and
1194  * for units that can't do postcopy.
1195  */
1196 void qemu_savevm_state_pending(QEMUFile *f, uint64_t threshold_size,
1197                                uint64_t *res_non_postcopiable,
1198                                uint64_t *res_postcopiable)
1199 {
1200     SaveStateEntry *se;
1201 
1202     *res_non_postcopiable = 0;
1203     *res_postcopiable = 0;
1204 
1205 
1206     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1207         if (!se->ops || !se->ops->save_live_pending) {
1208             continue;
1209         }
1210         if (se->ops && se->ops->is_active) {
1211             if (!se->ops->is_active(se->opaque)) {
1212                 continue;
1213             }
1214         }
1215         se->ops->save_live_pending(f, se->opaque, threshold_size,
1216                                    res_non_postcopiable, res_postcopiable);
1217     }
1218 }
1219 
1220 void qemu_savevm_state_cleanup(void)
1221 {
1222     SaveStateEntry *se;
1223 
1224     trace_savevm_state_cleanup();
1225     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1226         if (se->ops && se->ops->cleanup) {
1227             se->ops->cleanup(se->opaque);
1228         }
1229     }
1230 }
1231 
1232 static int qemu_savevm_state(QEMUFile *f, Error **errp)
1233 {
1234     int ret;
1235     MigrationParams params = {
1236         .blk = 0,
1237         .shared = 0
1238     };
1239     MigrationState *ms = migrate_init(&params);
1240     MigrationStatus status;
1241     ms->to_dst_file = f;
1242 
1243     if (migration_is_blocked(errp)) {
1244         ret = -EINVAL;
1245         goto done;
1246     }
1247 
1248     qemu_mutex_unlock_iothread();
1249     qemu_savevm_state_header(f);
1250     qemu_savevm_state_begin(f, &params);
1251     qemu_mutex_lock_iothread();
1252 
1253     while (qemu_file_get_error(f) == 0) {
1254         if (qemu_savevm_state_iterate(f, false) > 0) {
1255             break;
1256         }
1257     }
1258 
1259     ret = qemu_file_get_error(f);
1260     if (ret == 0) {
1261         qemu_savevm_state_complete_precopy(f, false);
1262         ret = qemu_file_get_error(f);
1263     }
1264     qemu_savevm_state_cleanup();
1265     if (ret != 0) {
1266         error_setg_errno(errp, -ret, "Error while writing VM state");
1267     }
1268 
1269 done:
1270     if (ret != 0) {
1271         status = MIGRATION_STATUS_FAILED;
1272     } else {
1273         status = MIGRATION_STATUS_COMPLETED;
1274     }
1275     migrate_set_state(&ms->state, MIGRATION_STATUS_SETUP, status);
1276 
1277     /* f is outer parameter, it should not stay in global migration state after
1278      * this function finished */
1279     ms->to_dst_file = NULL;
1280 
1281     return ret;
1282 }
1283 
1284 static int qemu_save_device_state(QEMUFile *f)
1285 {
1286     SaveStateEntry *se;
1287 
1288     qemu_put_be32(f, QEMU_VM_FILE_MAGIC);
1289     qemu_put_be32(f, QEMU_VM_FILE_VERSION);
1290 
1291     cpu_synchronize_all_states();
1292 
1293     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1294         if (se->is_ram) {
1295             continue;
1296         }
1297         if ((!se->ops || !se->ops->save_state) && !se->vmsd) {
1298             continue;
1299         }
1300         if (se->vmsd && !vmstate_save_needed(se->vmsd, se->opaque)) {
1301             continue;
1302         }
1303 
1304         save_section_header(f, se, QEMU_VM_SECTION_FULL);
1305 
1306         vmstate_save(f, se, NULL);
1307 
1308         save_section_footer(f, se);
1309     }
1310 
1311     qemu_put_byte(f, QEMU_VM_EOF);
1312 
1313     return qemu_file_get_error(f);
1314 }
1315 
1316 static SaveStateEntry *find_se(const char *idstr, int instance_id)
1317 {
1318     SaveStateEntry *se;
1319 
1320     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1321         if (!strcmp(se->idstr, idstr) &&
1322             (instance_id == se->instance_id ||
1323              instance_id == se->alias_id))
1324             return se;
1325         /* Migrating from an older version? */
1326         if (strstr(se->idstr, idstr) && se->compat) {
1327             if (!strcmp(se->compat->idstr, idstr) &&
1328                 (instance_id == se->compat->instance_id ||
1329                  instance_id == se->alias_id))
1330                 return se;
1331         }
1332     }
1333     return NULL;
1334 }
1335 
1336 enum LoadVMExitCodes {
1337     /* Allow a command to quit all layers of nested loadvm loops */
1338     LOADVM_QUIT     =  1,
1339 };
1340 
1341 static int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis);
1342 
1343 /* ------ incoming postcopy messages ------ */
1344 /* 'advise' arrives before any transfers just to tell us that a postcopy
1345  * *might* happen - it might be skipped if precopy transferred everything
1346  * quickly.
1347  */
1348 static int loadvm_postcopy_handle_advise(MigrationIncomingState *mis)
1349 {
1350     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_ADVISE);
1351     uint64_t remote_pagesize_summary, local_pagesize_summary, remote_tps;
1352 
1353     trace_loadvm_postcopy_handle_advise();
1354     if (ps != POSTCOPY_INCOMING_NONE) {
1355         error_report("CMD_POSTCOPY_ADVISE in wrong postcopy state (%d)", ps);
1356         return -1;
1357     }
1358 
1359     if (!postcopy_ram_supported_by_host()) {
1360         postcopy_state_set(POSTCOPY_INCOMING_NONE);
1361         return -1;
1362     }
1363 
1364     remote_pagesize_summary = qemu_get_be64(mis->from_src_file);
1365     local_pagesize_summary = ram_pagesize_summary();
1366 
1367     if (remote_pagesize_summary != local_pagesize_summary)  {
1368         /*
1369          * This detects two potential causes of mismatch:
1370          *   a) A mismatch in host page sizes
1371          *      Some combinations of mismatch are probably possible but it gets
1372          *      a bit more complicated.  In particular we need to place whole
1373          *      host pages on the dest at once, and we need to ensure that we
1374          *      handle dirtying to make sure we never end up sending part of
1375          *      a hostpage on it's own.
1376          *   b) The use of different huge page sizes on source/destination
1377          *      a more fine grain test is performed during RAM block migration
1378          *      but this test here causes a nice early clear failure, and
1379          *      also fails when passed to an older qemu that doesn't
1380          *      do huge pages.
1381          */
1382         error_report("Postcopy needs matching RAM page sizes (s=%" PRIx64
1383                                                              " d=%" PRIx64 ")",
1384                      remote_pagesize_summary, local_pagesize_summary);
1385         return -1;
1386     }
1387 
1388     remote_tps = qemu_get_be64(mis->from_src_file);
1389     if (remote_tps != qemu_target_page_size()) {
1390         /*
1391          * Again, some differences could be dealt with, but for now keep it
1392          * simple.
1393          */
1394         error_report("Postcopy needs matching target page sizes (s=%d d=%zd)",
1395                      (int)remote_tps, qemu_target_page_size());
1396         return -1;
1397     }
1398 
1399     if (ram_postcopy_incoming_init(mis)) {
1400         return -1;
1401     }
1402 
1403     postcopy_state_set(POSTCOPY_INCOMING_ADVISE);
1404 
1405     return 0;
1406 }
1407 
1408 /* After postcopy we will be told to throw some pages away since they're
1409  * dirty and will have to be demand fetched.  Must happen before CPU is
1410  * started.
1411  * There can be 0..many of these messages, each encoding multiple pages.
1412  */
1413 static int loadvm_postcopy_ram_handle_discard(MigrationIncomingState *mis,
1414                                               uint16_t len)
1415 {
1416     int tmp;
1417     char ramid[256];
1418     PostcopyState ps = postcopy_state_get();
1419 
1420     trace_loadvm_postcopy_ram_handle_discard();
1421 
1422     switch (ps) {
1423     case POSTCOPY_INCOMING_ADVISE:
1424         /* 1st discard */
1425         tmp = postcopy_ram_prepare_discard(mis);
1426         if (tmp) {
1427             return tmp;
1428         }
1429         break;
1430 
1431     case POSTCOPY_INCOMING_DISCARD:
1432         /* Expected state */
1433         break;
1434 
1435     default:
1436         error_report("CMD_POSTCOPY_RAM_DISCARD in wrong postcopy state (%d)",
1437                      ps);
1438         return -1;
1439     }
1440     /* We're expecting a
1441      *    Version (0)
1442      *    a RAM ID string (length byte, name, 0 term)
1443      *    then at least 1 16 byte chunk
1444     */
1445     if (len < (1 + 1 + 1 + 1 + 2 * 8)) {
1446         error_report("CMD_POSTCOPY_RAM_DISCARD invalid length (%d)", len);
1447         return -1;
1448     }
1449 
1450     tmp = qemu_get_byte(mis->from_src_file);
1451     if (tmp != postcopy_ram_discard_version) {
1452         error_report("CMD_POSTCOPY_RAM_DISCARD invalid version (%d)", tmp);
1453         return -1;
1454     }
1455 
1456     if (!qemu_get_counted_string(mis->from_src_file, ramid)) {
1457         error_report("CMD_POSTCOPY_RAM_DISCARD Failed to read RAMBlock ID");
1458         return -1;
1459     }
1460     tmp = qemu_get_byte(mis->from_src_file);
1461     if (tmp != 0) {
1462         error_report("CMD_POSTCOPY_RAM_DISCARD missing nil (%d)", tmp);
1463         return -1;
1464     }
1465 
1466     len -= 3 + strlen(ramid);
1467     if (len % 16) {
1468         error_report("CMD_POSTCOPY_RAM_DISCARD invalid length (%d)", len);
1469         return -1;
1470     }
1471     trace_loadvm_postcopy_ram_handle_discard_header(ramid, len);
1472     while (len) {
1473         uint64_t start_addr, block_length;
1474         start_addr = qemu_get_be64(mis->from_src_file);
1475         block_length = qemu_get_be64(mis->from_src_file);
1476 
1477         len -= 16;
1478         int ret = ram_discard_range(ramid, start_addr, block_length);
1479         if (ret) {
1480             return ret;
1481         }
1482     }
1483     trace_loadvm_postcopy_ram_handle_discard_end();
1484 
1485     return 0;
1486 }
1487 
1488 /*
1489  * Triggered by a postcopy_listen command; this thread takes over reading
1490  * the input stream, leaving the main thread free to carry on loading the rest
1491  * of the device state (from RAM).
1492  * (TODO:This could do with being in a postcopy file - but there again it's
1493  * just another input loop, not that postcopy specific)
1494  */
1495 static void *postcopy_ram_listen_thread(void *opaque)
1496 {
1497     QEMUFile *f = opaque;
1498     MigrationIncomingState *mis = migration_incoming_get_current();
1499     int load_res;
1500 
1501     migrate_set_state(&mis->state, MIGRATION_STATUS_ACTIVE,
1502                                    MIGRATION_STATUS_POSTCOPY_ACTIVE);
1503     qemu_sem_post(&mis->listen_thread_sem);
1504     trace_postcopy_ram_listen_thread_start();
1505 
1506     /*
1507      * Because we're a thread and not a coroutine we can't yield
1508      * in qemu_file, and thus we must be blocking now.
1509      */
1510     qemu_file_set_blocking(f, true);
1511     load_res = qemu_loadvm_state_main(f, mis);
1512     /* And non-blocking again so we don't block in any cleanup */
1513     qemu_file_set_blocking(f, false);
1514 
1515     trace_postcopy_ram_listen_thread_exit();
1516     if (load_res < 0) {
1517         error_report("%s: loadvm failed: %d", __func__, load_res);
1518         qemu_file_set_error(f, load_res);
1519         migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
1520                                        MIGRATION_STATUS_FAILED);
1521     } else {
1522         /*
1523          * This looks good, but it's possible that the device loading in the
1524          * main thread hasn't finished yet, and so we might not be in 'RUN'
1525          * state yet; wait for the end of the main thread.
1526          */
1527         qemu_event_wait(&mis->main_thread_load_event);
1528     }
1529     postcopy_ram_incoming_cleanup(mis);
1530 
1531     if (load_res < 0) {
1532         /*
1533          * If something went wrong then we have a bad state so exit;
1534          * depending how far we got it might be possible at this point
1535          * to leave the guest running and fire MCEs for pages that never
1536          * arrived as a desperate recovery step.
1537          */
1538         exit(EXIT_FAILURE);
1539     }
1540 
1541     migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
1542                                    MIGRATION_STATUS_COMPLETED);
1543     /*
1544      * If everything has worked fine, then the main thread has waited
1545      * for us to start, and we're the last use of the mis.
1546      * (If something broke then qemu will have to exit anyway since it's
1547      * got a bad migration state).
1548      */
1549     migration_incoming_state_destroy();
1550 
1551 
1552     return NULL;
1553 }
1554 
1555 /* After this message we must be able to immediately receive postcopy data */
1556 static int loadvm_postcopy_handle_listen(MigrationIncomingState *mis)
1557 {
1558     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_LISTENING);
1559     trace_loadvm_postcopy_handle_listen();
1560     if (ps != POSTCOPY_INCOMING_ADVISE && ps != POSTCOPY_INCOMING_DISCARD) {
1561         error_report("CMD_POSTCOPY_LISTEN in wrong postcopy state (%d)", ps);
1562         return -1;
1563     }
1564     if (ps == POSTCOPY_INCOMING_ADVISE) {
1565         /*
1566          * A rare case, we entered listen without having to do any discards,
1567          * so do the setup that's normally done at the time of the 1st discard.
1568          */
1569         postcopy_ram_prepare_discard(mis);
1570     }
1571 
1572     /*
1573      * Sensitise RAM - can now generate requests for blocks that don't exist
1574      * However, at this point the CPU shouldn't be running, and the IO
1575      * shouldn't be doing anything yet so don't actually expect requests
1576      */
1577     if (postcopy_ram_enable_notify(mis)) {
1578         return -1;
1579     }
1580 
1581     if (mis->have_listen_thread) {
1582         error_report("CMD_POSTCOPY_RAM_LISTEN already has a listen thread");
1583         return -1;
1584     }
1585 
1586     mis->have_listen_thread = true;
1587     /* Start up the listening thread and wait for it to signal ready */
1588     qemu_sem_init(&mis->listen_thread_sem, 0);
1589     qemu_thread_create(&mis->listen_thread, "postcopy/listen",
1590                        postcopy_ram_listen_thread, mis->from_src_file,
1591                        QEMU_THREAD_DETACHED);
1592     qemu_sem_wait(&mis->listen_thread_sem);
1593     qemu_sem_destroy(&mis->listen_thread_sem);
1594 
1595     return 0;
1596 }
1597 
1598 
1599 typedef struct {
1600     QEMUBH *bh;
1601 } HandleRunBhData;
1602 
1603 static void loadvm_postcopy_handle_run_bh(void *opaque)
1604 {
1605     Error *local_err = NULL;
1606     HandleRunBhData *data = opaque;
1607 
1608     /* TODO we should move all of this lot into postcopy_ram.c or a shared code
1609      * in migration.c
1610      */
1611     cpu_synchronize_all_post_init();
1612 
1613     qemu_announce_self();
1614 
1615     /* Make sure all file formats flush their mutable metadata */
1616     bdrv_invalidate_cache_all(&local_err);
1617     if (local_err) {
1618         error_report_err(local_err);
1619     }
1620 
1621     /* If we get an error here, just don't restart the VM yet. */
1622     blk_resume_after_migration(&local_err);
1623     if (local_err) {
1624         error_free(local_err);
1625         local_err = NULL;
1626         autostart = false;
1627     }
1628 
1629     trace_loadvm_postcopy_handle_run_cpu_sync();
1630     cpu_synchronize_all_post_init();
1631 
1632     trace_loadvm_postcopy_handle_run_vmstart();
1633 
1634     if (autostart) {
1635         /* Hold onto your hats, starting the CPU */
1636         vm_start();
1637     } else {
1638         /* leave it paused and let management decide when to start the CPU */
1639         runstate_set(RUN_STATE_PAUSED);
1640     }
1641 
1642     qemu_bh_delete(data->bh);
1643     g_free(data);
1644 }
1645 
1646 /* After all discards we can start running and asking for pages */
1647 static int loadvm_postcopy_handle_run(MigrationIncomingState *mis)
1648 {
1649     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_RUNNING);
1650     HandleRunBhData *data;
1651 
1652     trace_loadvm_postcopy_handle_run();
1653     if (ps != POSTCOPY_INCOMING_LISTENING) {
1654         error_report("CMD_POSTCOPY_RUN in wrong postcopy state (%d)", ps);
1655         return -1;
1656     }
1657 
1658     data = g_new(HandleRunBhData, 1);
1659     data->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, data);
1660     qemu_bh_schedule(data->bh);
1661 
1662     /* We need to finish reading the stream from the package
1663      * and also stop reading anything more from the stream that loaded the
1664      * package (since it's now being read by the listener thread).
1665      * LOADVM_QUIT will quit all the layers of nested loadvm loops.
1666      */
1667     return LOADVM_QUIT;
1668 }
1669 
1670 /**
1671  * Immediately following this command is a blob of data containing an embedded
1672  * chunk of migration stream; read it and load it.
1673  *
1674  * @mis: Incoming state
1675  * @length: Length of packaged data to read
1676  *
1677  * Returns: Negative values on error
1678  *
1679  */
1680 static int loadvm_handle_cmd_packaged(MigrationIncomingState *mis)
1681 {
1682     int ret;
1683     size_t length;
1684     QIOChannelBuffer *bioc;
1685 
1686     length = qemu_get_be32(mis->from_src_file);
1687     trace_loadvm_handle_cmd_packaged(length);
1688 
1689     if (length > MAX_VM_CMD_PACKAGED_SIZE) {
1690         error_report("Unreasonably large packaged state: %zu", length);
1691         return -1;
1692     }
1693 
1694     bioc = qio_channel_buffer_new(length);
1695     qio_channel_set_name(QIO_CHANNEL(bioc), "migration-loadvm-buffer");
1696     ret = qemu_get_buffer(mis->from_src_file,
1697                           bioc->data,
1698                           length);
1699     if (ret != length) {
1700         object_unref(OBJECT(bioc));
1701         error_report("CMD_PACKAGED: Buffer receive fail ret=%d length=%zu",
1702                      ret, length);
1703         return (ret < 0) ? ret : -EAGAIN;
1704     }
1705     bioc->usage += length;
1706     trace_loadvm_handle_cmd_packaged_received(ret);
1707 
1708     QEMUFile *packf = qemu_fopen_channel_input(QIO_CHANNEL(bioc));
1709 
1710     ret = qemu_loadvm_state_main(packf, mis);
1711     trace_loadvm_handle_cmd_packaged_main(ret);
1712     qemu_fclose(packf);
1713     object_unref(OBJECT(bioc));
1714 
1715     return ret;
1716 }
1717 
1718 /*
1719  * Process an incoming 'QEMU_VM_COMMAND'
1720  * 0           just a normal return
1721  * LOADVM_QUIT All good, but exit the loop
1722  * <0          Error
1723  */
1724 static int loadvm_process_command(QEMUFile *f)
1725 {
1726     MigrationIncomingState *mis = migration_incoming_get_current();
1727     uint16_t cmd;
1728     uint16_t len;
1729     uint32_t tmp32;
1730 
1731     cmd = qemu_get_be16(f);
1732     len = qemu_get_be16(f);
1733 
1734     trace_loadvm_process_command(cmd, len);
1735     if (cmd >= MIG_CMD_MAX || cmd == MIG_CMD_INVALID) {
1736         error_report("MIG_CMD 0x%x unknown (len 0x%x)", cmd, len);
1737         return -EINVAL;
1738     }
1739 
1740     if (mig_cmd_args[cmd].len != -1 && mig_cmd_args[cmd].len != len) {
1741         error_report("%s received with bad length - expecting %zu, got %d",
1742                      mig_cmd_args[cmd].name,
1743                      (size_t)mig_cmd_args[cmd].len, len);
1744         return -ERANGE;
1745     }
1746 
1747     switch (cmd) {
1748     case MIG_CMD_OPEN_RETURN_PATH:
1749         if (mis->to_src_file) {
1750             error_report("CMD_OPEN_RETURN_PATH called when RP already open");
1751             /* Not really a problem, so don't give up */
1752             return 0;
1753         }
1754         mis->to_src_file = qemu_file_get_return_path(f);
1755         if (!mis->to_src_file) {
1756             error_report("CMD_OPEN_RETURN_PATH failed");
1757             return -1;
1758         }
1759         break;
1760 
1761     case MIG_CMD_PING:
1762         tmp32 = qemu_get_be32(f);
1763         trace_loadvm_process_command_ping(tmp32);
1764         if (!mis->to_src_file) {
1765             error_report("CMD_PING (0x%x) received with no return path",
1766                          tmp32);
1767             return -1;
1768         }
1769         migrate_send_rp_pong(mis, tmp32);
1770         break;
1771 
1772     case MIG_CMD_PACKAGED:
1773         return loadvm_handle_cmd_packaged(mis);
1774 
1775     case MIG_CMD_POSTCOPY_ADVISE:
1776         return loadvm_postcopy_handle_advise(mis);
1777 
1778     case MIG_CMD_POSTCOPY_LISTEN:
1779         return loadvm_postcopy_handle_listen(mis);
1780 
1781     case MIG_CMD_POSTCOPY_RUN:
1782         return loadvm_postcopy_handle_run(mis);
1783 
1784     case MIG_CMD_POSTCOPY_RAM_DISCARD:
1785         return loadvm_postcopy_ram_handle_discard(mis, len);
1786     }
1787 
1788     return 0;
1789 }
1790 
1791 struct LoadStateEntry {
1792     QLIST_ENTRY(LoadStateEntry) entry;
1793     SaveStateEntry *se;
1794     int section_id;
1795     int version_id;
1796 };
1797 
1798 /*
1799  * Read a footer off the wire and check that it matches the expected section
1800  *
1801  * Returns: true if the footer was good
1802  *          false if there is a problem (and calls error_report to say why)
1803  */
1804 static bool check_section_footer(QEMUFile *f, LoadStateEntry *le)
1805 {
1806     uint8_t read_mark;
1807     uint32_t read_section_id;
1808 
1809     if (skip_section_footers) {
1810         /* No footer to check */
1811         return true;
1812     }
1813 
1814     read_mark = qemu_get_byte(f);
1815 
1816     if (read_mark != QEMU_VM_SECTION_FOOTER) {
1817         error_report("Missing section footer for %s", le->se->idstr);
1818         return false;
1819     }
1820 
1821     read_section_id = qemu_get_be32(f);
1822     if (read_section_id != le->section_id) {
1823         error_report("Mismatched section id in footer for %s -"
1824                      " read 0x%x expected 0x%x",
1825                      le->se->idstr, read_section_id, le->section_id);
1826         return false;
1827     }
1828 
1829     /* All good */
1830     return true;
1831 }
1832 
1833 void loadvm_free_handlers(MigrationIncomingState *mis)
1834 {
1835     LoadStateEntry *le, *new_le;
1836 
1837     QLIST_FOREACH_SAFE(le, &mis->loadvm_handlers, entry, new_le) {
1838         QLIST_REMOVE(le, entry);
1839         g_free(le);
1840     }
1841 }
1842 
1843 static int
1844 qemu_loadvm_section_start_full(QEMUFile *f, MigrationIncomingState *mis)
1845 {
1846     uint32_t instance_id, version_id, section_id;
1847     SaveStateEntry *se;
1848     LoadStateEntry *le;
1849     char idstr[256];
1850     int ret;
1851 
1852     /* Read section start */
1853     section_id = qemu_get_be32(f);
1854     if (!qemu_get_counted_string(f, idstr)) {
1855         error_report("Unable to read ID string for section %u",
1856                      section_id);
1857         return -EINVAL;
1858     }
1859     instance_id = qemu_get_be32(f);
1860     version_id = qemu_get_be32(f);
1861 
1862     trace_qemu_loadvm_state_section_startfull(section_id, idstr,
1863             instance_id, version_id);
1864     /* Find savevm section */
1865     se = find_se(idstr, instance_id);
1866     if (se == NULL) {
1867         error_report("Unknown savevm section or instance '%s' %d",
1868                      idstr, instance_id);
1869         return -EINVAL;
1870     }
1871 
1872     /* Validate version */
1873     if (version_id > se->version_id) {
1874         error_report("savevm: unsupported version %d for '%s' v%d",
1875                      version_id, idstr, se->version_id);
1876         return -EINVAL;
1877     }
1878 
1879     /* Validate if it is a device's state */
1880     if (xen_enabled() && se->is_ram) {
1881         error_report("loadvm: %s RAM loading not allowed on Xen", idstr);
1882         return -EINVAL;
1883     }
1884 
1885     /* Add entry */
1886     le = g_malloc0(sizeof(*le));
1887 
1888     le->se = se;
1889     le->section_id = section_id;
1890     le->version_id = version_id;
1891     QLIST_INSERT_HEAD(&mis->loadvm_handlers, le, entry);
1892 
1893     ret = vmstate_load(f, le->se, le->version_id);
1894     if (ret < 0) {
1895         error_report("error while loading state for instance 0x%x of"
1896                      " device '%s'", instance_id, idstr);
1897         return ret;
1898     }
1899     if (!check_section_footer(f, le)) {
1900         return -EINVAL;
1901     }
1902 
1903     return 0;
1904 }
1905 
1906 static int
1907 qemu_loadvm_section_part_end(QEMUFile *f, MigrationIncomingState *mis)
1908 {
1909     uint32_t section_id;
1910     LoadStateEntry *le;
1911     int ret;
1912 
1913     section_id = qemu_get_be32(f);
1914 
1915     trace_qemu_loadvm_state_section_partend(section_id);
1916     QLIST_FOREACH(le, &mis->loadvm_handlers, entry) {
1917         if (le->section_id == section_id) {
1918             break;
1919         }
1920     }
1921     if (le == NULL) {
1922         error_report("Unknown savevm section %d", section_id);
1923         return -EINVAL;
1924     }
1925 
1926     ret = vmstate_load(f, le->se, le->version_id);
1927     if (ret < 0) {
1928         error_report("error while loading state section id %d(%s)",
1929                      section_id, le->se->idstr);
1930         return ret;
1931     }
1932     if (!check_section_footer(f, le)) {
1933         return -EINVAL;
1934     }
1935 
1936     return 0;
1937 }
1938 
1939 static int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis)
1940 {
1941     uint8_t section_type;
1942     int ret = 0;
1943 
1944     while ((section_type = qemu_get_byte(f)) != QEMU_VM_EOF) {
1945         ret = 0;
1946         trace_qemu_loadvm_state_section(section_type);
1947         switch (section_type) {
1948         case QEMU_VM_SECTION_START:
1949         case QEMU_VM_SECTION_FULL:
1950             ret = qemu_loadvm_section_start_full(f, mis);
1951             if (ret < 0) {
1952                 goto out;
1953             }
1954             break;
1955         case QEMU_VM_SECTION_PART:
1956         case QEMU_VM_SECTION_END:
1957             ret = qemu_loadvm_section_part_end(f, mis);
1958             if (ret < 0) {
1959                 goto out;
1960             }
1961             break;
1962         case QEMU_VM_COMMAND:
1963             ret = loadvm_process_command(f);
1964             trace_qemu_loadvm_state_section_command(ret);
1965             if ((ret < 0) || (ret & LOADVM_QUIT)) {
1966                 goto out;
1967             }
1968             break;
1969         default:
1970             error_report("Unknown savevm section type %d", section_type);
1971             ret = -EINVAL;
1972             goto out;
1973         }
1974     }
1975 
1976 out:
1977     if (ret < 0) {
1978         qemu_file_set_error(f, ret);
1979     }
1980     return ret;
1981 }
1982 
1983 int qemu_loadvm_state(QEMUFile *f)
1984 {
1985     MigrationIncomingState *mis = migration_incoming_get_current();
1986     Error *local_err = NULL;
1987     unsigned int v;
1988     int ret;
1989 
1990     if (qemu_savevm_state_blocked(&local_err)) {
1991         error_report_err(local_err);
1992         return -EINVAL;
1993     }
1994 
1995     v = qemu_get_be32(f);
1996     if (v != QEMU_VM_FILE_MAGIC) {
1997         error_report("Not a migration stream");
1998         return -EINVAL;
1999     }
2000 
2001     v = qemu_get_be32(f);
2002     if (v == QEMU_VM_FILE_VERSION_COMPAT) {
2003         error_report("SaveVM v2 format is obsolete and don't work anymore");
2004         return -ENOTSUP;
2005     }
2006     if (v != QEMU_VM_FILE_VERSION) {
2007         error_report("Unsupported migration stream version");
2008         return -ENOTSUP;
2009     }
2010 
2011     if (!savevm_state.skip_configuration || enforce_config_section()) {
2012         if (qemu_get_byte(f) != QEMU_VM_CONFIGURATION) {
2013             error_report("Configuration section missing");
2014             return -EINVAL;
2015         }
2016         ret = vmstate_load_state(f, &vmstate_configuration, &savevm_state, 0);
2017 
2018         if (ret) {
2019             return ret;
2020         }
2021     }
2022 
2023     ret = qemu_loadvm_state_main(f, mis);
2024     qemu_event_set(&mis->main_thread_load_event);
2025 
2026     trace_qemu_loadvm_state_post_main(ret);
2027 
2028     if (mis->have_listen_thread) {
2029         /* Listen thread still going, can't clean up yet */
2030         return ret;
2031     }
2032 
2033     if (ret == 0) {
2034         ret = qemu_file_get_error(f);
2035     }
2036 
2037     /*
2038      * Try to read in the VMDESC section as well, so that dumping tools that
2039      * intercept our migration stream have the chance to see it.
2040      */
2041 
2042     /* We've got to be careful; if we don't read the data and just shut the fd
2043      * then the sender can error if we close while it's still sending.
2044      * We also mustn't read data that isn't there; some transports (RDMA)
2045      * will stall waiting for that data when the source has already closed.
2046      */
2047     if (ret == 0 && should_send_vmdesc()) {
2048         uint8_t *buf;
2049         uint32_t size;
2050         uint8_t  section_type = qemu_get_byte(f);
2051 
2052         if (section_type != QEMU_VM_VMDESCRIPTION) {
2053             error_report("Expected vmdescription section, but got %d",
2054                          section_type);
2055             /*
2056              * It doesn't seem worth failing at this point since
2057              * we apparently have an otherwise valid VM state
2058              */
2059         } else {
2060             buf = g_malloc(0x1000);
2061             size = qemu_get_be32(f);
2062 
2063             while (size > 0) {
2064                 uint32_t read_chunk = MIN(size, 0x1000);
2065                 qemu_get_buffer(f, buf, read_chunk);
2066                 size -= read_chunk;
2067             }
2068             g_free(buf);
2069         }
2070     }
2071 
2072     cpu_synchronize_all_post_init();
2073 
2074     return ret;
2075 }
2076 
2077 int save_vmstate(const char *name)
2078 {
2079     BlockDriverState *bs, *bs1;
2080     QEMUSnapshotInfo sn1, *sn = &sn1, old_sn1, *old_sn = &old_sn1;
2081     int ret = -1;
2082     QEMUFile *f;
2083     int saved_vm_running;
2084     uint64_t vm_state_size;
2085     qemu_timeval tv;
2086     struct tm tm;
2087     Error *local_err = NULL;
2088     AioContext *aio_context;
2089 
2090     if (!bdrv_all_can_snapshot(&bs)) {
2091         error_report("Device '%s' is writable but does not support snapshots",
2092                      bdrv_get_device_name(bs));
2093         return ret;
2094     }
2095 
2096     /* Delete old snapshots of the same name */
2097     if (name) {
2098         ret = bdrv_all_delete_snapshot(name, &bs1, &local_err);
2099         if (ret < 0) {
2100             error_reportf_err(local_err,
2101                               "Error while deleting snapshot on device '%s': ",
2102                               bdrv_get_device_name(bs1));
2103             return ret;
2104         }
2105     }
2106 
2107     bs = bdrv_all_find_vmstate_bs();
2108     if (bs == NULL) {
2109         error_report("No block device can accept snapshots");
2110         return ret;
2111     }
2112     aio_context = bdrv_get_aio_context(bs);
2113 
2114     saved_vm_running = runstate_is_running();
2115 
2116     ret = global_state_store();
2117     if (ret) {
2118         error_report("Error saving global state");
2119         return ret;
2120     }
2121     vm_stop(RUN_STATE_SAVE_VM);
2122 
2123     aio_context_acquire(aio_context);
2124 
2125     memset(sn, 0, sizeof(*sn));
2126 
2127     /* fill auxiliary fields */
2128     qemu_gettimeofday(&tv);
2129     sn->date_sec = tv.tv_sec;
2130     sn->date_nsec = tv.tv_usec * 1000;
2131     sn->vm_clock_nsec = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
2132 
2133     if (name) {
2134         ret = bdrv_snapshot_find(bs, old_sn, name);
2135         if (ret >= 0) {
2136             pstrcpy(sn->name, sizeof(sn->name), old_sn->name);
2137             pstrcpy(sn->id_str, sizeof(sn->id_str), old_sn->id_str);
2138         } else {
2139             pstrcpy(sn->name, sizeof(sn->name), name);
2140         }
2141     } else {
2142         /* cast below needed for OpenBSD where tv_sec is still 'long' */
2143         localtime_r((const time_t *)&tv.tv_sec, &tm);
2144         strftime(sn->name, sizeof(sn->name), "vm-%Y%m%d%H%M%S", &tm);
2145     }
2146 
2147     /* save the VM state */
2148     f = qemu_fopen_bdrv(bs, 1);
2149     if (!f) {
2150         error_report("Could not open VM state file");
2151         goto the_end;
2152     }
2153     ret = qemu_savevm_state(f, &local_err);
2154     vm_state_size = qemu_ftell(f);
2155     qemu_fclose(f);
2156     if (ret < 0) {
2157         error_report_err(local_err);
2158         goto the_end;
2159     }
2160 
2161     ret = bdrv_all_create_snapshot(sn, bs, vm_state_size, &bs);
2162     if (ret < 0) {
2163         error_report("Error while creating snapshot on '%s'",
2164                      bdrv_get_device_name(bs));
2165         goto the_end;
2166     }
2167 
2168     ret = 0;
2169 
2170  the_end:
2171     aio_context_release(aio_context);
2172     if (saved_vm_running) {
2173         vm_start();
2174     }
2175     return ret;
2176 }
2177 
2178 void qmp_xen_save_devices_state(const char *filename, Error **errp)
2179 {
2180     QEMUFile *f;
2181     QIOChannelFile *ioc;
2182     int saved_vm_running;
2183     int ret;
2184 
2185     saved_vm_running = runstate_is_running();
2186     vm_stop(RUN_STATE_SAVE_VM);
2187     global_state_store_running();
2188 
2189     ioc = qio_channel_file_new_path(filename, O_WRONLY | O_CREAT, 0660, errp);
2190     if (!ioc) {
2191         goto the_end;
2192     }
2193     qio_channel_set_name(QIO_CHANNEL(ioc), "migration-xen-save-state");
2194     f = qemu_fopen_channel_output(QIO_CHANNEL(ioc));
2195     ret = qemu_save_device_state(f);
2196     qemu_fclose(f);
2197     if (ret < 0) {
2198         error_setg(errp, QERR_IO_ERROR);
2199     }
2200 
2201  the_end:
2202     if (saved_vm_running) {
2203         vm_start();
2204     }
2205 }
2206 
2207 void qmp_xen_load_devices_state(const char *filename, Error **errp)
2208 {
2209     QEMUFile *f;
2210     QIOChannelFile *ioc;
2211     int ret;
2212 
2213     /* Guest must be paused before loading the device state; the RAM state
2214      * will already have been loaded by xc
2215      */
2216     if (runstate_is_running()) {
2217         error_setg(errp, "Cannot update device state while vm is running");
2218         return;
2219     }
2220     vm_stop(RUN_STATE_RESTORE_VM);
2221 
2222     ioc = qio_channel_file_new_path(filename, O_RDONLY | O_BINARY, 0, errp);
2223     if (!ioc) {
2224         return;
2225     }
2226     qio_channel_set_name(QIO_CHANNEL(ioc), "migration-xen-load-state");
2227     f = qemu_fopen_channel_input(QIO_CHANNEL(ioc));
2228 
2229     ret = qemu_loadvm_state(f);
2230     qemu_fclose(f);
2231     if (ret < 0) {
2232         error_setg(errp, QERR_IO_ERROR);
2233     }
2234     migration_incoming_state_destroy();
2235 }
2236 
2237 int load_vmstate(const char *name)
2238 {
2239     BlockDriverState *bs, *bs_vm_state;
2240     QEMUSnapshotInfo sn;
2241     QEMUFile *f;
2242     int ret;
2243     AioContext *aio_context;
2244     MigrationIncomingState *mis = migration_incoming_get_current();
2245 
2246     if (!bdrv_all_can_snapshot(&bs)) {
2247         error_report("Device '%s' is writable but does not support snapshots",
2248                      bdrv_get_device_name(bs));
2249         return -ENOTSUP;
2250     }
2251     ret = bdrv_all_find_snapshot(name, &bs);
2252     if (ret < 0) {
2253         error_report("Device '%s' does not have the requested snapshot '%s'",
2254                      bdrv_get_device_name(bs), name);
2255         return ret;
2256     }
2257 
2258     bs_vm_state = bdrv_all_find_vmstate_bs();
2259     if (!bs_vm_state) {
2260         error_report("No block device supports snapshots");
2261         return -ENOTSUP;
2262     }
2263     aio_context = bdrv_get_aio_context(bs_vm_state);
2264 
2265     /* Don't even try to load empty VM states */
2266     aio_context_acquire(aio_context);
2267     ret = bdrv_snapshot_find(bs_vm_state, &sn, name);
2268     aio_context_release(aio_context);
2269     if (ret < 0) {
2270         return ret;
2271     } else if (sn.vm_state_size == 0) {
2272         error_report("This is a disk-only snapshot. Revert to it offline "
2273             "using qemu-img.");
2274         return -EINVAL;
2275     }
2276 
2277     /* Flush all IO requests so they don't interfere with the new state.  */
2278     bdrv_drain_all();
2279 
2280     ret = bdrv_all_goto_snapshot(name, &bs);
2281     if (ret < 0) {
2282         error_report("Error %d while activating snapshot '%s' on '%s'",
2283                      ret, name, bdrv_get_device_name(bs));
2284         return ret;
2285     }
2286 
2287     /* restore the VM state */
2288     f = qemu_fopen_bdrv(bs_vm_state, 0);
2289     if (!f) {
2290         error_report("Could not open VM state file");
2291         return -EINVAL;
2292     }
2293 
2294     qemu_system_reset(VMRESET_SILENT);
2295     mis->from_src_file = f;
2296 
2297     aio_context_acquire(aio_context);
2298     ret = qemu_loadvm_state(f);
2299     qemu_fclose(f);
2300     aio_context_release(aio_context);
2301 
2302     migration_incoming_state_destroy();
2303     if (ret < 0) {
2304         error_report("Error %d while loading VM state", ret);
2305         return ret;
2306     }
2307 
2308     return 0;
2309 }
2310 
2311 void vmstate_register_ram(MemoryRegion *mr, DeviceState *dev)
2312 {
2313     qemu_ram_set_idstr(mr->ram_block,
2314                        memory_region_name(mr), dev);
2315 }
2316 
2317 void vmstate_unregister_ram(MemoryRegion *mr, DeviceState *dev)
2318 {
2319     qemu_ram_unset_idstr(mr->ram_block);
2320 }
2321 
2322 void vmstate_register_ram_global(MemoryRegion *mr)
2323 {
2324     vmstate_register_ram(mr, NULL);
2325 }
2326