xref: /openbmc/qemu/migration/savevm.c (revision 35658f6e)
1 /*
2  * QEMU System Emulator
3  *
4  * Copyright (c) 2003-2008 Fabrice Bellard
5  * Copyright (c) 2009-2015 Red Hat Inc
6  *
7  * Authors:
8  *  Juan Quintela <quintela@redhat.com>
9  *
10  * Permission is hereby granted, free of charge, to any person obtaining a copy
11  * of this software and associated documentation files (the "Software"), to deal
12  * in the Software without restriction, including without limitation the rights
13  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14  * copies of the Software, and to permit persons to whom the Software is
15  * furnished to do so, subject to the following conditions:
16  *
17  * The above copyright notice and this permission notice shall be included in
18  * all copies or substantial portions of the Software.
19  *
20  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26  * THE SOFTWARE.
27  */
28 
29 #include "qemu/osdep.h"
30 #include "cpu.h"
31 #include "hw/boards.h"
32 #include "hw/hw.h"
33 #include "hw/qdev.h"
34 #include "hw/xen/xen.h"
35 #include "net/net.h"
36 #include "monitor/monitor.h"
37 #include "sysemu/sysemu.h"
38 #include "qemu/timer.h"
39 #include "audio/audio.h"
40 #include "migration/migration.h"
41 #include "migration/postcopy-ram.h"
42 #include "qapi/qmp/qerror.h"
43 #include "qemu/error-report.h"
44 #include "qemu/sockets.h"
45 #include "qemu/queue.h"
46 #include "sysemu/cpus.h"
47 #include "exec/memory.h"
48 #include "qmp-commands.h"
49 #include "trace.h"
50 #include "qemu/bitops.h"
51 #include "qemu/iov.h"
52 #include "block/snapshot.h"
53 #include "block/qapi.h"
54 #include "qemu/cutils.h"
55 #include "io/channel-buffer.h"
56 #include "io/channel-file.h"
57 
58 #ifndef ETH_P_RARP
59 #define ETH_P_RARP 0x8035
60 #endif
61 #define ARP_HTYPE_ETH 0x0001
62 #define ARP_PTYPE_IP 0x0800
63 #define ARP_OP_REQUEST_REV 0x3
64 
65 const unsigned int postcopy_ram_discard_version = 0;
66 
67 static bool skip_section_footers;
68 
69 static struct mig_cmd_args {
70     ssize_t     len; /* -1 = variable */
71     const char *name;
72 } mig_cmd_args[] = {
73     [MIG_CMD_INVALID]          = { .len = -1, .name = "INVALID" },
74     [MIG_CMD_OPEN_RETURN_PATH] = { .len =  0, .name = "OPEN_RETURN_PATH" },
75     [MIG_CMD_PING]             = { .len = sizeof(uint32_t), .name = "PING" },
76     [MIG_CMD_POSTCOPY_ADVISE]  = { .len = 16, .name = "POSTCOPY_ADVISE" },
77     [MIG_CMD_POSTCOPY_LISTEN]  = { .len =  0, .name = "POSTCOPY_LISTEN" },
78     [MIG_CMD_POSTCOPY_RUN]     = { .len =  0, .name = "POSTCOPY_RUN" },
79     [MIG_CMD_POSTCOPY_RAM_DISCARD] = {
80                                    .len = -1, .name = "POSTCOPY_RAM_DISCARD" },
81     [MIG_CMD_PACKAGED]         = { .len =  4, .name = "PACKAGED" },
82     [MIG_CMD_MAX]              = { .len = -1, .name = "MAX" },
83 };
84 
85 static int announce_self_create(uint8_t *buf,
86                                 uint8_t *mac_addr)
87 {
88     /* Ethernet header. */
89     memset(buf, 0xff, 6);         /* destination MAC addr */
90     memcpy(buf + 6, mac_addr, 6); /* source MAC addr */
91     *(uint16_t *)(buf + 12) = htons(ETH_P_RARP); /* ethertype */
92 
93     /* RARP header. */
94     *(uint16_t *)(buf + 14) = htons(ARP_HTYPE_ETH); /* hardware addr space */
95     *(uint16_t *)(buf + 16) = htons(ARP_PTYPE_IP); /* protocol addr space */
96     *(buf + 18) = 6; /* hardware addr length (ethernet) */
97     *(buf + 19) = 4; /* protocol addr length (IPv4) */
98     *(uint16_t *)(buf + 20) = htons(ARP_OP_REQUEST_REV); /* opcode */
99     memcpy(buf + 22, mac_addr, 6); /* source hw addr */
100     memset(buf + 28, 0x00, 4);     /* source protocol addr */
101     memcpy(buf + 32, mac_addr, 6); /* target hw addr */
102     memset(buf + 38, 0x00, 4);     /* target protocol addr */
103 
104     /* Padding to get up to 60 bytes (ethernet min packet size, minus FCS). */
105     memset(buf + 42, 0x00, 18);
106 
107     return 60; /* len (FCS will be added by hardware) */
108 }
109 
110 static void qemu_announce_self_iter(NICState *nic, void *opaque)
111 {
112     uint8_t buf[60];
113     int len;
114 
115     trace_qemu_announce_self_iter(qemu_ether_ntoa(&nic->conf->macaddr));
116     len = announce_self_create(buf, nic->conf->macaddr.a);
117 
118     qemu_send_packet_raw(qemu_get_queue(nic), buf, len);
119 }
120 
121 
122 static void qemu_announce_self_once(void *opaque)
123 {
124     static int count = SELF_ANNOUNCE_ROUNDS;
125     QEMUTimer *timer = *(QEMUTimer **)opaque;
126 
127     qemu_foreach_nic(qemu_announce_self_iter, NULL);
128 
129     if (--count) {
130         /* delay 50ms, 150ms, 250ms, ... */
131         timer_mod(timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) +
132                   self_announce_delay(count));
133     } else {
134             timer_del(timer);
135             timer_free(timer);
136     }
137 }
138 
139 void qemu_announce_self(void)
140 {
141     static QEMUTimer *timer;
142     timer = timer_new_ms(QEMU_CLOCK_REALTIME, qemu_announce_self_once, &timer);
143     qemu_announce_self_once(&timer);
144 }
145 
146 /***********************************************************/
147 /* savevm/loadvm support */
148 
149 static ssize_t block_writev_buffer(void *opaque, struct iovec *iov, int iovcnt,
150                                    int64_t pos)
151 {
152     int ret;
153     QEMUIOVector qiov;
154 
155     qemu_iovec_init_external(&qiov, iov, iovcnt);
156     ret = bdrv_writev_vmstate(opaque, &qiov, pos);
157     if (ret < 0) {
158         return ret;
159     }
160 
161     return qiov.size;
162 }
163 
164 static ssize_t block_get_buffer(void *opaque, uint8_t *buf, int64_t pos,
165                                 size_t size)
166 {
167     return bdrv_load_vmstate(opaque, buf, pos, size);
168 }
169 
170 static int bdrv_fclose(void *opaque)
171 {
172     return bdrv_flush(opaque);
173 }
174 
175 static const QEMUFileOps bdrv_read_ops = {
176     .get_buffer = block_get_buffer,
177     .close =      bdrv_fclose
178 };
179 
180 static const QEMUFileOps bdrv_write_ops = {
181     .writev_buffer  = block_writev_buffer,
182     .close          = bdrv_fclose
183 };
184 
185 static QEMUFile *qemu_fopen_bdrv(BlockDriverState *bs, int is_writable)
186 {
187     if (is_writable) {
188         return qemu_fopen_ops(bs, &bdrv_write_ops);
189     }
190     return qemu_fopen_ops(bs, &bdrv_read_ops);
191 }
192 
193 
194 /* QEMUFile timer support.
195  * Not in qemu-file.c to not add qemu-timer.c as dependency to qemu-file.c
196  */
197 
198 void timer_put(QEMUFile *f, QEMUTimer *ts)
199 {
200     uint64_t expire_time;
201 
202     expire_time = timer_expire_time_ns(ts);
203     qemu_put_be64(f, expire_time);
204 }
205 
206 void timer_get(QEMUFile *f, QEMUTimer *ts)
207 {
208     uint64_t expire_time;
209 
210     expire_time = qemu_get_be64(f);
211     if (expire_time != -1) {
212         timer_mod_ns(ts, expire_time);
213     } else {
214         timer_del(ts);
215     }
216 }
217 
218 
219 /* VMState timer support.
220  * Not in vmstate.c to not add qemu-timer.c as dependency to vmstate.c
221  */
222 
223 static int get_timer(QEMUFile *f, void *pv, size_t size)
224 {
225     QEMUTimer *v = pv;
226     timer_get(f, v);
227     return 0;
228 }
229 
230 static void put_timer(QEMUFile *f, void *pv, size_t size)
231 {
232     QEMUTimer *v = pv;
233     timer_put(f, v);
234 }
235 
236 const VMStateInfo vmstate_info_timer = {
237     .name = "timer",
238     .get  = get_timer,
239     .put  = put_timer,
240 };
241 
242 
243 typedef struct CompatEntry {
244     char idstr[256];
245     int instance_id;
246 } CompatEntry;
247 
248 typedef struct SaveStateEntry {
249     QTAILQ_ENTRY(SaveStateEntry) entry;
250     char idstr[256];
251     int instance_id;
252     int alias_id;
253     int version_id;
254     int section_id;
255     SaveVMHandlers *ops;
256     const VMStateDescription *vmsd;
257     void *opaque;
258     CompatEntry *compat;
259     int is_ram;
260 } SaveStateEntry;
261 
262 typedef struct SaveState {
263     QTAILQ_HEAD(, SaveStateEntry) handlers;
264     int global_section_id;
265     bool skip_configuration;
266     uint32_t len;
267     const char *name;
268 } SaveState;
269 
270 static SaveState savevm_state = {
271     .handlers = QTAILQ_HEAD_INITIALIZER(savevm_state.handlers),
272     .global_section_id = 0,
273     .skip_configuration = false,
274 };
275 
276 void savevm_skip_configuration(void)
277 {
278     savevm_state.skip_configuration = true;
279 }
280 
281 
282 static void configuration_pre_save(void *opaque)
283 {
284     SaveState *state = opaque;
285     const char *current_name = MACHINE_GET_CLASS(current_machine)->name;
286 
287     state->len = strlen(current_name);
288     state->name = current_name;
289 }
290 
291 static int configuration_post_load(void *opaque, int version_id)
292 {
293     SaveState *state = opaque;
294     const char *current_name = MACHINE_GET_CLASS(current_machine)->name;
295 
296     if (strncmp(state->name, current_name, state->len) != 0) {
297         error_report("Machine type received is '%.*s' and local is '%s'",
298                      (int) state->len, state->name, current_name);
299         return -EINVAL;
300     }
301     return 0;
302 }
303 
304 static const VMStateDescription vmstate_configuration = {
305     .name = "configuration",
306     .version_id = 1,
307     .post_load = configuration_post_load,
308     .pre_save = configuration_pre_save,
309     .fields = (VMStateField[]) {
310         VMSTATE_UINT32(len, SaveState),
311         VMSTATE_VBUFFER_ALLOC_UINT32(name, SaveState, 0, NULL, 0, len),
312         VMSTATE_END_OF_LIST()
313     },
314 };
315 
316 static void dump_vmstate_vmsd(FILE *out_file,
317                               const VMStateDescription *vmsd, int indent,
318                               bool is_subsection);
319 
320 static void dump_vmstate_vmsf(FILE *out_file, const VMStateField *field,
321                               int indent)
322 {
323     fprintf(out_file, "%*s{\n", indent, "");
324     indent += 2;
325     fprintf(out_file, "%*s\"field\": \"%s\",\n", indent, "", field->name);
326     fprintf(out_file, "%*s\"version_id\": %d,\n", indent, "",
327             field->version_id);
328     fprintf(out_file, "%*s\"field_exists\": %s,\n", indent, "",
329             field->field_exists ? "true" : "false");
330     fprintf(out_file, "%*s\"size\": %zu", indent, "", field->size);
331     if (field->vmsd != NULL) {
332         fprintf(out_file, ",\n");
333         dump_vmstate_vmsd(out_file, field->vmsd, indent, false);
334     }
335     fprintf(out_file, "\n%*s}", indent - 2, "");
336 }
337 
338 static void dump_vmstate_vmss(FILE *out_file,
339                               const VMStateDescription **subsection,
340                               int indent)
341 {
342     if (*subsection != NULL) {
343         dump_vmstate_vmsd(out_file, *subsection, indent, true);
344     }
345 }
346 
347 static void dump_vmstate_vmsd(FILE *out_file,
348                               const VMStateDescription *vmsd, int indent,
349                               bool is_subsection)
350 {
351     if (is_subsection) {
352         fprintf(out_file, "%*s{\n", indent, "");
353     } else {
354         fprintf(out_file, "%*s\"%s\": {\n", indent, "", "Description");
355     }
356     indent += 2;
357     fprintf(out_file, "%*s\"name\": \"%s\",\n", indent, "", vmsd->name);
358     fprintf(out_file, "%*s\"version_id\": %d,\n", indent, "",
359             vmsd->version_id);
360     fprintf(out_file, "%*s\"minimum_version_id\": %d", indent, "",
361             vmsd->minimum_version_id);
362     if (vmsd->fields != NULL) {
363         const VMStateField *field = vmsd->fields;
364         bool first;
365 
366         fprintf(out_file, ",\n%*s\"Fields\": [\n", indent, "");
367         first = true;
368         while (field->name != NULL) {
369             if (field->flags & VMS_MUST_EXIST) {
370                 /* Ignore VMSTATE_VALIDATE bits; these don't get migrated */
371                 field++;
372                 continue;
373             }
374             if (!first) {
375                 fprintf(out_file, ",\n");
376             }
377             dump_vmstate_vmsf(out_file, field, indent + 2);
378             field++;
379             first = false;
380         }
381         fprintf(out_file, "\n%*s]", indent, "");
382     }
383     if (vmsd->subsections != NULL) {
384         const VMStateDescription **subsection = vmsd->subsections;
385         bool first;
386 
387         fprintf(out_file, ",\n%*s\"Subsections\": [\n", indent, "");
388         first = true;
389         while (*subsection != NULL) {
390             if (!first) {
391                 fprintf(out_file, ",\n");
392             }
393             dump_vmstate_vmss(out_file, subsection, indent + 2);
394             subsection++;
395             first = false;
396         }
397         fprintf(out_file, "\n%*s]", indent, "");
398     }
399     fprintf(out_file, "\n%*s}", indent - 2, "");
400 }
401 
402 static void dump_machine_type(FILE *out_file)
403 {
404     MachineClass *mc;
405 
406     mc = MACHINE_GET_CLASS(current_machine);
407 
408     fprintf(out_file, "  \"vmschkmachine\": {\n");
409     fprintf(out_file, "    \"Name\": \"%s\"\n", mc->name);
410     fprintf(out_file, "  },\n");
411 }
412 
413 void dump_vmstate_json_to_file(FILE *out_file)
414 {
415     GSList *list, *elt;
416     bool first;
417 
418     fprintf(out_file, "{\n");
419     dump_machine_type(out_file);
420 
421     first = true;
422     list = object_class_get_list(TYPE_DEVICE, true);
423     for (elt = list; elt; elt = elt->next) {
424         DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, elt->data,
425                                              TYPE_DEVICE);
426         const char *name;
427         int indent = 2;
428 
429         if (!dc->vmsd) {
430             continue;
431         }
432 
433         if (!first) {
434             fprintf(out_file, ",\n");
435         }
436         name = object_class_get_name(OBJECT_CLASS(dc));
437         fprintf(out_file, "%*s\"%s\": {\n", indent, "", name);
438         indent += 2;
439         fprintf(out_file, "%*s\"Name\": \"%s\",\n", indent, "", name);
440         fprintf(out_file, "%*s\"version_id\": %d,\n", indent, "",
441                 dc->vmsd->version_id);
442         fprintf(out_file, "%*s\"minimum_version_id\": %d,\n", indent, "",
443                 dc->vmsd->minimum_version_id);
444 
445         dump_vmstate_vmsd(out_file, dc->vmsd, indent, false);
446 
447         fprintf(out_file, "\n%*s}", indent - 2, "");
448         first = false;
449     }
450     fprintf(out_file, "\n}\n");
451     fclose(out_file);
452 }
453 
454 static int calculate_new_instance_id(const char *idstr)
455 {
456     SaveStateEntry *se;
457     int instance_id = 0;
458 
459     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
460         if (strcmp(idstr, se->idstr) == 0
461             && instance_id <= se->instance_id) {
462             instance_id = se->instance_id + 1;
463         }
464     }
465     return instance_id;
466 }
467 
468 static int calculate_compat_instance_id(const char *idstr)
469 {
470     SaveStateEntry *se;
471     int instance_id = 0;
472 
473     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
474         if (!se->compat) {
475             continue;
476         }
477 
478         if (strcmp(idstr, se->compat->idstr) == 0
479             && instance_id <= se->compat->instance_id) {
480             instance_id = se->compat->instance_id + 1;
481         }
482     }
483     return instance_id;
484 }
485 
486 /* TODO: Individual devices generally have very little idea about the rest
487    of the system, so instance_id should be removed/replaced.
488    Meanwhile pass -1 as instance_id if you do not already have a clearly
489    distinguishing id for all instances of your device class. */
490 int register_savevm_live(DeviceState *dev,
491                          const char *idstr,
492                          int instance_id,
493                          int version_id,
494                          SaveVMHandlers *ops,
495                          void *opaque)
496 {
497     SaveStateEntry *se;
498 
499     se = g_new0(SaveStateEntry, 1);
500     se->version_id = version_id;
501     se->section_id = savevm_state.global_section_id++;
502     se->ops = ops;
503     se->opaque = opaque;
504     se->vmsd = NULL;
505     /* if this is a live_savem then set is_ram */
506     if (ops->save_live_setup != NULL) {
507         se->is_ram = 1;
508     }
509 
510     if (dev) {
511         char *id = qdev_get_dev_path(dev);
512         if (id) {
513             pstrcpy(se->idstr, sizeof(se->idstr), id);
514             pstrcat(se->idstr, sizeof(se->idstr), "/");
515             g_free(id);
516 
517             se->compat = g_new0(CompatEntry, 1);
518             pstrcpy(se->compat->idstr, sizeof(se->compat->idstr), idstr);
519             se->compat->instance_id = instance_id == -1 ?
520                          calculate_compat_instance_id(idstr) : instance_id;
521             instance_id = -1;
522         }
523     }
524     pstrcat(se->idstr, sizeof(se->idstr), idstr);
525 
526     if (instance_id == -1) {
527         se->instance_id = calculate_new_instance_id(se->idstr);
528     } else {
529         se->instance_id = instance_id;
530     }
531     assert(!se->compat || se->instance_id == 0);
532     /* add at the end of list */
533     QTAILQ_INSERT_TAIL(&savevm_state.handlers, se, entry);
534     return 0;
535 }
536 
537 int register_savevm(DeviceState *dev,
538                     const char *idstr,
539                     int instance_id,
540                     int version_id,
541                     SaveStateHandler *save_state,
542                     LoadStateHandler *load_state,
543                     void *opaque)
544 {
545     SaveVMHandlers *ops = g_new0(SaveVMHandlers, 1);
546     ops->save_state = save_state;
547     ops->load_state = load_state;
548     return register_savevm_live(dev, idstr, instance_id, version_id,
549                                 ops, opaque);
550 }
551 
552 void unregister_savevm(DeviceState *dev, const char *idstr, void *opaque)
553 {
554     SaveStateEntry *se, *new_se;
555     char id[256] = "";
556 
557     if (dev) {
558         char *path = qdev_get_dev_path(dev);
559         if (path) {
560             pstrcpy(id, sizeof(id), path);
561             pstrcat(id, sizeof(id), "/");
562             g_free(path);
563         }
564     }
565     pstrcat(id, sizeof(id), idstr);
566 
567     QTAILQ_FOREACH_SAFE(se, &savevm_state.handlers, entry, new_se) {
568         if (strcmp(se->idstr, id) == 0 && se->opaque == opaque) {
569             QTAILQ_REMOVE(&savevm_state.handlers, se, entry);
570             g_free(se->compat);
571             g_free(se->ops);
572             g_free(se);
573         }
574     }
575 }
576 
577 int vmstate_register_with_alias_id(DeviceState *dev, int instance_id,
578                                    const VMStateDescription *vmsd,
579                                    void *opaque, int alias_id,
580                                    int required_for_version)
581 {
582     SaveStateEntry *se;
583 
584     /* If this triggers, alias support can be dropped for the vmsd. */
585     assert(alias_id == -1 || required_for_version >= vmsd->minimum_version_id);
586 
587     se = g_new0(SaveStateEntry, 1);
588     se->version_id = vmsd->version_id;
589     se->section_id = savevm_state.global_section_id++;
590     se->opaque = opaque;
591     se->vmsd = vmsd;
592     se->alias_id = alias_id;
593 
594     if (dev) {
595         char *id = qdev_get_dev_path(dev);
596         if (id) {
597             pstrcpy(se->idstr, sizeof(se->idstr), id);
598             pstrcat(se->idstr, sizeof(se->idstr), "/");
599             g_free(id);
600 
601             se->compat = g_new0(CompatEntry, 1);
602             pstrcpy(se->compat->idstr, sizeof(se->compat->idstr), vmsd->name);
603             se->compat->instance_id = instance_id == -1 ?
604                          calculate_compat_instance_id(vmsd->name) : instance_id;
605             instance_id = -1;
606         }
607     }
608     pstrcat(se->idstr, sizeof(se->idstr), vmsd->name);
609 
610     if (instance_id == -1) {
611         se->instance_id = calculate_new_instance_id(se->idstr);
612     } else {
613         se->instance_id = instance_id;
614     }
615     assert(!se->compat || se->instance_id == 0);
616     /* add at the end of list */
617     QTAILQ_INSERT_TAIL(&savevm_state.handlers, se, entry);
618     return 0;
619 }
620 
621 void vmstate_unregister(DeviceState *dev, const VMStateDescription *vmsd,
622                         void *opaque)
623 {
624     SaveStateEntry *se, *new_se;
625 
626     QTAILQ_FOREACH_SAFE(se, &savevm_state.handlers, entry, new_se) {
627         if (se->vmsd == vmsd && se->opaque == opaque) {
628             QTAILQ_REMOVE(&savevm_state.handlers, se, entry);
629             g_free(se->compat);
630             g_free(se);
631         }
632     }
633 }
634 
635 static int vmstate_load(QEMUFile *f, SaveStateEntry *se, int version_id)
636 {
637     trace_vmstate_load(se->idstr, se->vmsd ? se->vmsd->name : "(old)");
638     if (!se->vmsd) {         /* Old style */
639         return se->ops->load_state(f, se->opaque, version_id);
640     }
641     return vmstate_load_state(f, se->vmsd, se->opaque, version_id);
642 }
643 
644 static void vmstate_save_old_style(QEMUFile *f, SaveStateEntry *se, QJSON *vmdesc)
645 {
646     int64_t old_offset, size;
647 
648     old_offset = qemu_ftell_fast(f);
649     se->ops->save_state(f, se->opaque);
650     size = qemu_ftell_fast(f) - old_offset;
651 
652     if (vmdesc) {
653         json_prop_int(vmdesc, "size", size);
654         json_start_array(vmdesc, "fields");
655         json_start_object(vmdesc, NULL);
656         json_prop_str(vmdesc, "name", "data");
657         json_prop_int(vmdesc, "size", size);
658         json_prop_str(vmdesc, "type", "buffer");
659         json_end_object(vmdesc);
660         json_end_array(vmdesc);
661     }
662 }
663 
664 static void vmstate_save(QEMUFile *f, SaveStateEntry *se, QJSON *vmdesc)
665 {
666     trace_vmstate_save(se->idstr, se->vmsd ? se->vmsd->name : "(old)");
667     if (!se->vmsd) {
668         vmstate_save_old_style(f, se, vmdesc);
669         return;
670     }
671     vmstate_save_state(f, se->vmsd, se->opaque, vmdesc);
672 }
673 
674 void savevm_skip_section_footers(void)
675 {
676     skip_section_footers = true;
677 }
678 
679 /*
680  * Write the header for device section (QEMU_VM_SECTION START/END/PART/FULL)
681  */
682 static void save_section_header(QEMUFile *f, SaveStateEntry *se,
683                                 uint8_t section_type)
684 {
685     qemu_put_byte(f, section_type);
686     qemu_put_be32(f, se->section_id);
687 
688     if (section_type == QEMU_VM_SECTION_FULL ||
689         section_type == QEMU_VM_SECTION_START) {
690         /* ID string */
691         size_t len = strlen(se->idstr);
692         qemu_put_byte(f, len);
693         qemu_put_buffer(f, (uint8_t *)se->idstr, len);
694 
695         qemu_put_be32(f, se->instance_id);
696         qemu_put_be32(f, se->version_id);
697     }
698 }
699 
700 /*
701  * Write a footer onto device sections that catches cases misformatted device
702  * sections.
703  */
704 static void save_section_footer(QEMUFile *f, SaveStateEntry *se)
705 {
706     if (!skip_section_footers) {
707         qemu_put_byte(f, QEMU_VM_SECTION_FOOTER);
708         qemu_put_be32(f, se->section_id);
709     }
710 }
711 
712 /**
713  * qemu_savevm_command_send: Send a 'QEMU_VM_COMMAND' type element with the
714  *                           command and associated data.
715  *
716  * @f: File to send command on
717  * @command: Command type to send
718  * @len: Length of associated data
719  * @data: Data associated with command.
720  */
721 void qemu_savevm_command_send(QEMUFile *f,
722                               enum qemu_vm_cmd command,
723                               uint16_t len,
724                               uint8_t *data)
725 {
726     trace_savevm_command_send(command, len);
727     qemu_put_byte(f, QEMU_VM_COMMAND);
728     qemu_put_be16(f, (uint16_t)command);
729     qemu_put_be16(f, len);
730     qemu_put_buffer(f, data, len);
731     qemu_fflush(f);
732 }
733 
734 void qemu_savevm_send_ping(QEMUFile *f, uint32_t value)
735 {
736     uint32_t buf;
737 
738     trace_savevm_send_ping(value);
739     buf = cpu_to_be32(value);
740     qemu_savevm_command_send(f, MIG_CMD_PING, sizeof(value), (uint8_t *)&buf);
741 }
742 
743 void qemu_savevm_send_open_return_path(QEMUFile *f)
744 {
745     trace_savevm_send_open_return_path();
746     qemu_savevm_command_send(f, MIG_CMD_OPEN_RETURN_PATH, 0, NULL);
747 }
748 
749 /* We have a buffer of data to send; we don't want that all to be loaded
750  * by the command itself, so the command contains just the length of the
751  * extra buffer that we then send straight after it.
752  * TODO: Must be a better way to organise that
753  *
754  * Returns:
755  *    0 on success
756  *    -ve on error
757  */
758 int qemu_savevm_send_packaged(QEMUFile *f, const uint8_t *buf, size_t len)
759 {
760     uint32_t tmp;
761 
762     if (len > MAX_VM_CMD_PACKAGED_SIZE) {
763         error_report("%s: Unreasonably large packaged state: %zu",
764                      __func__, len);
765         return -1;
766     }
767 
768     tmp = cpu_to_be32(len);
769 
770     trace_qemu_savevm_send_packaged();
771     qemu_savevm_command_send(f, MIG_CMD_PACKAGED, 4, (uint8_t *)&tmp);
772 
773     qemu_put_buffer(f, buf, len);
774 
775     return 0;
776 }
777 
778 /* Send prior to any postcopy transfer */
779 void qemu_savevm_send_postcopy_advise(QEMUFile *f)
780 {
781     uint64_t tmp[2];
782     tmp[0] = cpu_to_be64(getpagesize());
783     tmp[1] = cpu_to_be64(1ul << qemu_target_page_bits());
784 
785     trace_qemu_savevm_send_postcopy_advise();
786     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_ADVISE, 16, (uint8_t *)tmp);
787 }
788 
789 /* Sent prior to starting the destination running in postcopy, discard pages
790  * that have already been sent but redirtied on the source.
791  * CMD_POSTCOPY_RAM_DISCARD consist of:
792  *      byte   version (0)
793  *      byte   Length of name field (not including 0)
794  *  n x byte   RAM block name
795  *      byte   0 terminator (just for safety)
796  *  n x        Byte ranges within the named RAMBlock
797  *      be64   Start of the range
798  *      be64   Length
799  *
800  *  name:  RAMBlock name that these entries are part of
801  *  len: Number of page entries
802  *  start_list: 'len' addresses
803  *  length_list: 'len' addresses
804  *
805  */
806 void qemu_savevm_send_postcopy_ram_discard(QEMUFile *f, const char *name,
807                                            uint16_t len,
808                                            uint64_t *start_list,
809                                            uint64_t *length_list)
810 {
811     uint8_t *buf;
812     uint16_t tmplen;
813     uint16_t t;
814     size_t name_len = strlen(name);
815 
816     trace_qemu_savevm_send_postcopy_ram_discard(name, len);
817     assert(name_len < 256);
818     buf = g_malloc0(1 + 1 + name_len + 1 + (8 + 8) * len);
819     buf[0] = postcopy_ram_discard_version;
820     buf[1] = name_len;
821     memcpy(buf + 2, name, name_len);
822     tmplen = 2 + name_len;
823     buf[tmplen++] = '\0';
824 
825     for (t = 0; t < len; t++) {
826         stq_be_p(buf + tmplen, start_list[t]);
827         tmplen += 8;
828         stq_be_p(buf + tmplen, length_list[t]);
829         tmplen += 8;
830     }
831     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_RAM_DISCARD, tmplen, buf);
832     g_free(buf);
833 }
834 
835 /* Get the destination into a state where it can receive postcopy data. */
836 void qemu_savevm_send_postcopy_listen(QEMUFile *f)
837 {
838     trace_savevm_send_postcopy_listen();
839     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_LISTEN, 0, NULL);
840 }
841 
842 /* Kick the destination into running */
843 void qemu_savevm_send_postcopy_run(QEMUFile *f)
844 {
845     trace_savevm_send_postcopy_run();
846     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_RUN, 0, NULL);
847 }
848 
849 bool qemu_savevm_state_blocked(Error **errp)
850 {
851     SaveStateEntry *se;
852 
853     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
854         if (se->vmsd && se->vmsd->unmigratable) {
855             error_setg(errp, "State blocked by non-migratable device '%s'",
856                        se->idstr);
857             return true;
858         }
859     }
860     return false;
861 }
862 
863 static bool enforce_config_section(void)
864 {
865     MachineState *machine = MACHINE(qdev_get_machine());
866     return machine->enforce_config_section;
867 }
868 
869 void qemu_savevm_state_header(QEMUFile *f)
870 {
871     trace_savevm_state_header();
872     qemu_put_be32(f, QEMU_VM_FILE_MAGIC);
873     qemu_put_be32(f, QEMU_VM_FILE_VERSION);
874 
875     if (!savevm_state.skip_configuration || enforce_config_section()) {
876         qemu_put_byte(f, QEMU_VM_CONFIGURATION);
877         vmstate_save_state(f, &vmstate_configuration, &savevm_state, 0);
878     }
879 
880 }
881 
882 void qemu_savevm_state_begin(QEMUFile *f,
883                              const MigrationParams *params)
884 {
885     SaveStateEntry *se;
886     int ret;
887 
888     trace_savevm_state_begin();
889     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
890         if (!se->ops || !se->ops->set_params) {
891             continue;
892         }
893         se->ops->set_params(params, se->opaque);
894     }
895 
896     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
897         if (!se->ops || !se->ops->save_live_setup) {
898             continue;
899         }
900         if (se->ops && se->ops->is_active) {
901             if (!se->ops->is_active(se->opaque)) {
902                 continue;
903             }
904         }
905         save_section_header(f, se, QEMU_VM_SECTION_START);
906 
907         ret = se->ops->save_live_setup(f, se->opaque);
908         save_section_footer(f, se);
909         if (ret < 0) {
910             qemu_file_set_error(f, ret);
911             break;
912         }
913     }
914 }
915 
916 /*
917  * this function has three return values:
918  *   negative: there was one error, and we have -errno.
919  *   0 : We haven't finished, caller have to go again
920  *   1 : We have finished, we can go to complete phase
921  */
922 int qemu_savevm_state_iterate(QEMUFile *f, bool postcopy)
923 {
924     SaveStateEntry *se;
925     int ret = 1;
926 
927     trace_savevm_state_iterate();
928     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
929         if (!se->ops || !se->ops->save_live_iterate) {
930             continue;
931         }
932         if (se->ops && se->ops->is_active) {
933             if (!se->ops->is_active(se->opaque)) {
934                 continue;
935             }
936         }
937         /*
938          * In the postcopy phase, any device that doesn't know how to
939          * do postcopy should have saved it's state in the _complete
940          * call that's already run, it might get confused if we call
941          * iterate afterwards.
942          */
943         if (postcopy && !se->ops->save_live_complete_postcopy) {
944             continue;
945         }
946         if (qemu_file_rate_limit(f)) {
947             return 0;
948         }
949         trace_savevm_section_start(se->idstr, se->section_id);
950 
951         save_section_header(f, se, QEMU_VM_SECTION_PART);
952 
953         ret = se->ops->save_live_iterate(f, se->opaque);
954         trace_savevm_section_end(se->idstr, se->section_id, ret);
955         save_section_footer(f, se);
956 
957         if (ret < 0) {
958             qemu_file_set_error(f, ret);
959         }
960         if (ret <= 0) {
961             /* Do not proceed to the next vmstate before this one reported
962                completion of the current stage. This serializes the migration
963                and reduces the probability that a faster changing state is
964                synchronized over and over again. */
965             break;
966         }
967     }
968     return ret;
969 }
970 
971 static bool should_send_vmdesc(void)
972 {
973     MachineState *machine = MACHINE(qdev_get_machine());
974     bool in_postcopy = migration_in_postcopy(migrate_get_current());
975     return !machine->suppress_vmdesc && !in_postcopy;
976 }
977 
978 /*
979  * Calls the save_live_complete_postcopy methods
980  * causing the last few pages to be sent immediately and doing any associated
981  * cleanup.
982  * Note postcopy also calls qemu_savevm_state_complete_precopy to complete
983  * all the other devices, but that happens at the point we switch to postcopy.
984  */
985 void qemu_savevm_state_complete_postcopy(QEMUFile *f)
986 {
987     SaveStateEntry *se;
988     int ret;
989 
990     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
991         if (!se->ops || !se->ops->save_live_complete_postcopy) {
992             continue;
993         }
994         if (se->ops && se->ops->is_active) {
995             if (!se->ops->is_active(se->opaque)) {
996                 continue;
997             }
998         }
999         trace_savevm_section_start(se->idstr, se->section_id);
1000         /* Section type */
1001         qemu_put_byte(f, QEMU_VM_SECTION_END);
1002         qemu_put_be32(f, se->section_id);
1003 
1004         ret = se->ops->save_live_complete_postcopy(f, se->opaque);
1005         trace_savevm_section_end(se->idstr, se->section_id, ret);
1006         save_section_footer(f, se);
1007         if (ret < 0) {
1008             qemu_file_set_error(f, ret);
1009             return;
1010         }
1011     }
1012 
1013     qemu_put_byte(f, QEMU_VM_EOF);
1014     qemu_fflush(f);
1015 }
1016 
1017 void qemu_savevm_state_complete_precopy(QEMUFile *f, bool iterable_only)
1018 {
1019     QJSON *vmdesc;
1020     int vmdesc_len;
1021     SaveStateEntry *se;
1022     int ret;
1023     bool in_postcopy = migration_in_postcopy(migrate_get_current());
1024 
1025     trace_savevm_state_complete_precopy();
1026 
1027     cpu_synchronize_all_states();
1028 
1029     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1030         if (!se->ops ||
1031             (in_postcopy && se->ops->save_live_complete_postcopy) ||
1032             (in_postcopy && !iterable_only) ||
1033             !se->ops->save_live_complete_precopy) {
1034             continue;
1035         }
1036 
1037         if (se->ops && se->ops->is_active) {
1038             if (!se->ops->is_active(se->opaque)) {
1039                 continue;
1040             }
1041         }
1042         trace_savevm_section_start(se->idstr, se->section_id);
1043 
1044         save_section_header(f, se, QEMU_VM_SECTION_END);
1045 
1046         ret = se->ops->save_live_complete_precopy(f, se->opaque);
1047         trace_savevm_section_end(se->idstr, se->section_id, ret);
1048         save_section_footer(f, se);
1049         if (ret < 0) {
1050             qemu_file_set_error(f, ret);
1051             return;
1052         }
1053     }
1054 
1055     if (iterable_only) {
1056         return;
1057     }
1058 
1059     vmdesc = qjson_new();
1060     json_prop_int(vmdesc, "page_size", TARGET_PAGE_SIZE);
1061     json_start_array(vmdesc, "devices");
1062     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1063 
1064         if ((!se->ops || !se->ops->save_state) && !se->vmsd) {
1065             continue;
1066         }
1067         if (se->vmsd && !vmstate_save_needed(se->vmsd, se->opaque)) {
1068             trace_savevm_section_skip(se->idstr, se->section_id);
1069             continue;
1070         }
1071 
1072         trace_savevm_section_start(se->idstr, se->section_id);
1073 
1074         json_start_object(vmdesc, NULL);
1075         json_prop_str(vmdesc, "name", se->idstr);
1076         json_prop_int(vmdesc, "instance_id", se->instance_id);
1077 
1078         save_section_header(f, se, QEMU_VM_SECTION_FULL);
1079         vmstate_save(f, se, vmdesc);
1080         trace_savevm_section_end(se->idstr, se->section_id, 0);
1081         save_section_footer(f, se);
1082 
1083         json_end_object(vmdesc);
1084     }
1085 
1086     if (!in_postcopy) {
1087         /* Postcopy stream will still be going */
1088         qemu_put_byte(f, QEMU_VM_EOF);
1089     }
1090 
1091     json_end_array(vmdesc);
1092     qjson_finish(vmdesc);
1093     vmdesc_len = strlen(qjson_get_str(vmdesc));
1094 
1095     if (should_send_vmdesc()) {
1096         qemu_put_byte(f, QEMU_VM_VMDESCRIPTION);
1097         qemu_put_be32(f, vmdesc_len);
1098         qemu_put_buffer(f, (uint8_t *)qjson_get_str(vmdesc), vmdesc_len);
1099     }
1100     qjson_destroy(vmdesc);
1101 
1102     qemu_fflush(f);
1103 }
1104 
1105 /* Give an estimate of the amount left to be transferred,
1106  * the result is split into the amount for units that can and
1107  * for units that can't do postcopy.
1108  */
1109 void qemu_savevm_state_pending(QEMUFile *f, uint64_t max_size,
1110                                uint64_t *res_non_postcopiable,
1111                                uint64_t *res_postcopiable)
1112 {
1113     SaveStateEntry *se;
1114 
1115     *res_non_postcopiable = 0;
1116     *res_postcopiable = 0;
1117 
1118 
1119     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1120         if (!se->ops || !se->ops->save_live_pending) {
1121             continue;
1122         }
1123         if (se->ops && se->ops->is_active) {
1124             if (!se->ops->is_active(se->opaque)) {
1125                 continue;
1126             }
1127         }
1128         se->ops->save_live_pending(f, se->opaque, max_size,
1129                                    res_non_postcopiable, res_postcopiable);
1130     }
1131 }
1132 
1133 void qemu_savevm_state_cleanup(void)
1134 {
1135     SaveStateEntry *se;
1136 
1137     trace_savevm_state_cleanup();
1138     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1139         if (se->ops && se->ops->cleanup) {
1140             se->ops->cleanup(se->opaque);
1141         }
1142     }
1143 }
1144 
1145 static int qemu_savevm_state(QEMUFile *f, Error **errp)
1146 {
1147     int ret;
1148     MigrationParams params = {
1149         .blk = 0,
1150         .shared = 0
1151     };
1152     MigrationState *ms = migrate_init(&params);
1153     MigrationStatus status;
1154     ms->to_dst_file = f;
1155 
1156     if (migration_is_blocked(errp)) {
1157         ret = -EINVAL;
1158         goto done;
1159     }
1160 
1161     qemu_mutex_unlock_iothread();
1162     qemu_savevm_state_header(f);
1163     qemu_savevm_state_begin(f, &params);
1164     qemu_mutex_lock_iothread();
1165 
1166     while (qemu_file_get_error(f) == 0) {
1167         if (qemu_savevm_state_iterate(f, false) > 0) {
1168             break;
1169         }
1170     }
1171 
1172     ret = qemu_file_get_error(f);
1173     if (ret == 0) {
1174         qemu_savevm_state_complete_precopy(f, false);
1175         ret = qemu_file_get_error(f);
1176     }
1177     qemu_savevm_state_cleanup();
1178     if (ret != 0) {
1179         error_setg_errno(errp, -ret, "Error while writing VM state");
1180     }
1181 
1182 done:
1183     if (ret != 0) {
1184         status = MIGRATION_STATUS_FAILED;
1185     } else {
1186         status = MIGRATION_STATUS_COMPLETED;
1187     }
1188     migrate_set_state(&ms->state, MIGRATION_STATUS_SETUP, status);
1189     return ret;
1190 }
1191 
1192 static int qemu_save_device_state(QEMUFile *f)
1193 {
1194     SaveStateEntry *se;
1195 
1196     qemu_put_be32(f, QEMU_VM_FILE_MAGIC);
1197     qemu_put_be32(f, QEMU_VM_FILE_VERSION);
1198 
1199     cpu_synchronize_all_states();
1200 
1201     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1202         if (se->is_ram) {
1203             continue;
1204         }
1205         if ((!se->ops || !se->ops->save_state) && !se->vmsd) {
1206             continue;
1207         }
1208         if (se->vmsd && !vmstate_save_needed(se->vmsd, se->opaque)) {
1209             continue;
1210         }
1211 
1212         save_section_header(f, se, QEMU_VM_SECTION_FULL);
1213 
1214         vmstate_save(f, se, NULL);
1215 
1216         save_section_footer(f, se);
1217     }
1218 
1219     qemu_put_byte(f, QEMU_VM_EOF);
1220 
1221     return qemu_file_get_error(f);
1222 }
1223 
1224 static SaveStateEntry *find_se(const char *idstr, int instance_id)
1225 {
1226     SaveStateEntry *se;
1227 
1228     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1229         if (!strcmp(se->idstr, idstr) &&
1230             (instance_id == se->instance_id ||
1231              instance_id == se->alias_id))
1232             return se;
1233         /* Migrating from an older version? */
1234         if (strstr(se->idstr, idstr) && se->compat) {
1235             if (!strcmp(se->compat->idstr, idstr) &&
1236                 (instance_id == se->compat->instance_id ||
1237                  instance_id == se->alias_id))
1238                 return se;
1239         }
1240     }
1241     return NULL;
1242 }
1243 
1244 enum LoadVMExitCodes {
1245     /* Allow a command to quit all layers of nested loadvm loops */
1246     LOADVM_QUIT     =  1,
1247 };
1248 
1249 static int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis);
1250 
1251 /* ------ incoming postcopy messages ------ */
1252 /* 'advise' arrives before any transfers just to tell us that a postcopy
1253  * *might* happen - it might be skipped if precopy transferred everything
1254  * quickly.
1255  */
1256 static int loadvm_postcopy_handle_advise(MigrationIncomingState *mis)
1257 {
1258     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_ADVISE);
1259     uint64_t remote_hps, remote_tps;
1260 
1261     trace_loadvm_postcopy_handle_advise();
1262     if (ps != POSTCOPY_INCOMING_NONE) {
1263         error_report("CMD_POSTCOPY_ADVISE in wrong postcopy state (%d)", ps);
1264         return -1;
1265     }
1266 
1267     if (!postcopy_ram_supported_by_host()) {
1268         return -1;
1269     }
1270 
1271     remote_hps = qemu_get_be64(mis->from_src_file);
1272     if (remote_hps != getpagesize())  {
1273         /*
1274          * Some combinations of mismatch are probably possible but it gets
1275          * a bit more complicated.  In particular we need to place whole
1276          * host pages on the dest at once, and we need to ensure that we
1277          * handle dirtying to make sure we never end up sending part of
1278          * a hostpage on it's own.
1279          */
1280         error_report("Postcopy needs matching host page sizes (s=%d d=%d)",
1281                      (int)remote_hps, getpagesize());
1282         return -1;
1283     }
1284 
1285     remote_tps = qemu_get_be64(mis->from_src_file);
1286     if (remote_tps != (1ul << qemu_target_page_bits())) {
1287         /*
1288          * Again, some differences could be dealt with, but for now keep it
1289          * simple.
1290          */
1291         error_report("Postcopy needs matching target page sizes (s=%d d=%d)",
1292                      (int)remote_tps, 1 << qemu_target_page_bits());
1293         return -1;
1294     }
1295 
1296     if (ram_postcopy_incoming_init(mis)) {
1297         return -1;
1298     }
1299 
1300     postcopy_state_set(POSTCOPY_INCOMING_ADVISE);
1301 
1302     return 0;
1303 }
1304 
1305 /* After postcopy we will be told to throw some pages away since they're
1306  * dirty and will have to be demand fetched.  Must happen before CPU is
1307  * started.
1308  * There can be 0..many of these messages, each encoding multiple pages.
1309  */
1310 static int loadvm_postcopy_ram_handle_discard(MigrationIncomingState *mis,
1311                                               uint16_t len)
1312 {
1313     int tmp;
1314     char ramid[256];
1315     PostcopyState ps = postcopy_state_get();
1316 
1317     trace_loadvm_postcopy_ram_handle_discard();
1318 
1319     switch (ps) {
1320     case POSTCOPY_INCOMING_ADVISE:
1321         /* 1st discard */
1322         tmp = postcopy_ram_prepare_discard(mis);
1323         if (tmp) {
1324             return tmp;
1325         }
1326         break;
1327 
1328     case POSTCOPY_INCOMING_DISCARD:
1329         /* Expected state */
1330         break;
1331 
1332     default:
1333         error_report("CMD_POSTCOPY_RAM_DISCARD in wrong postcopy state (%d)",
1334                      ps);
1335         return -1;
1336     }
1337     /* We're expecting a
1338      *    Version (0)
1339      *    a RAM ID string (length byte, name, 0 term)
1340      *    then at least 1 16 byte chunk
1341     */
1342     if (len < (1 + 1 + 1 + 1 + 2 * 8)) {
1343         error_report("CMD_POSTCOPY_RAM_DISCARD invalid length (%d)", len);
1344         return -1;
1345     }
1346 
1347     tmp = qemu_get_byte(mis->from_src_file);
1348     if (tmp != postcopy_ram_discard_version) {
1349         error_report("CMD_POSTCOPY_RAM_DISCARD invalid version (%d)", tmp);
1350         return -1;
1351     }
1352 
1353     if (!qemu_get_counted_string(mis->from_src_file, ramid)) {
1354         error_report("CMD_POSTCOPY_RAM_DISCARD Failed to read RAMBlock ID");
1355         return -1;
1356     }
1357     tmp = qemu_get_byte(mis->from_src_file);
1358     if (tmp != 0) {
1359         error_report("CMD_POSTCOPY_RAM_DISCARD missing nil (%d)", tmp);
1360         return -1;
1361     }
1362 
1363     len -= 3 + strlen(ramid);
1364     if (len % 16) {
1365         error_report("CMD_POSTCOPY_RAM_DISCARD invalid length (%d)", len);
1366         return -1;
1367     }
1368     trace_loadvm_postcopy_ram_handle_discard_header(ramid, len);
1369     while (len) {
1370         uint64_t start_addr, block_length;
1371         start_addr = qemu_get_be64(mis->from_src_file);
1372         block_length = qemu_get_be64(mis->from_src_file);
1373 
1374         len -= 16;
1375         int ret = ram_discard_range(mis, ramid, start_addr,
1376                                     block_length);
1377         if (ret) {
1378             return ret;
1379         }
1380     }
1381     trace_loadvm_postcopy_ram_handle_discard_end();
1382 
1383     return 0;
1384 }
1385 
1386 /*
1387  * Triggered by a postcopy_listen command; this thread takes over reading
1388  * the input stream, leaving the main thread free to carry on loading the rest
1389  * of the device state (from RAM).
1390  * (TODO:This could do with being in a postcopy file - but there again it's
1391  * just another input loop, not that postcopy specific)
1392  */
1393 static void *postcopy_ram_listen_thread(void *opaque)
1394 {
1395     QEMUFile *f = opaque;
1396     MigrationIncomingState *mis = migration_incoming_get_current();
1397     int load_res;
1398 
1399     migrate_set_state(&mis->state, MIGRATION_STATUS_ACTIVE,
1400                                    MIGRATION_STATUS_POSTCOPY_ACTIVE);
1401     qemu_sem_post(&mis->listen_thread_sem);
1402     trace_postcopy_ram_listen_thread_start();
1403 
1404     /*
1405      * Because we're a thread and not a coroutine we can't yield
1406      * in qemu_file, and thus we must be blocking now.
1407      */
1408     qemu_file_set_blocking(f, true);
1409     load_res = qemu_loadvm_state_main(f, mis);
1410     /* And non-blocking again so we don't block in any cleanup */
1411     qemu_file_set_blocking(f, false);
1412 
1413     trace_postcopy_ram_listen_thread_exit();
1414     if (load_res < 0) {
1415         error_report("%s: loadvm failed: %d", __func__, load_res);
1416         qemu_file_set_error(f, load_res);
1417         migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
1418                                        MIGRATION_STATUS_FAILED);
1419     } else {
1420         /*
1421          * This looks good, but it's possible that the device loading in the
1422          * main thread hasn't finished yet, and so we might not be in 'RUN'
1423          * state yet; wait for the end of the main thread.
1424          */
1425         qemu_event_wait(&mis->main_thread_load_event);
1426     }
1427     postcopy_ram_incoming_cleanup(mis);
1428 
1429     if (load_res < 0) {
1430         /*
1431          * If something went wrong then we have a bad state so exit;
1432          * depending how far we got it might be possible at this point
1433          * to leave the guest running and fire MCEs for pages that never
1434          * arrived as a desperate recovery step.
1435          */
1436         exit(EXIT_FAILURE);
1437     }
1438 
1439     migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
1440                                    MIGRATION_STATUS_COMPLETED);
1441     /*
1442      * If everything has worked fine, then the main thread has waited
1443      * for us to start, and we're the last use of the mis.
1444      * (If something broke then qemu will have to exit anyway since it's
1445      * got a bad migration state).
1446      */
1447     migration_incoming_state_destroy();
1448 
1449 
1450     return NULL;
1451 }
1452 
1453 /* After this message we must be able to immediately receive postcopy data */
1454 static int loadvm_postcopy_handle_listen(MigrationIncomingState *mis)
1455 {
1456     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_LISTENING);
1457     trace_loadvm_postcopy_handle_listen();
1458     if (ps != POSTCOPY_INCOMING_ADVISE && ps != POSTCOPY_INCOMING_DISCARD) {
1459         error_report("CMD_POSTCOPY_LISTEN in wrong postcopy state (%d)", ps);
1460         return -1;
1461     }
1462     if (ps == POSTCOPY_INCOMING_ADVISE) {
1463         /*
1464          * A rare case, we entered listen without having to do any discards,
1465          * so do the setup that's normally done at the time of the 1st discard.
1466          */
1467         postcopy_ram_prepare_discard(mis);
1468     }
1469 
1470     /*
1471      * Sensitise RAM - can now generate requests for blocks that don't exist
1472      * However, at this point the CPU shouldn't be running, and the IO
1473      * shouldn't be doing anything yet so don't actually expect requests
1474      */
1475     if (postcopy_ram_enable_notify(mis)) {
1476         return -1;
1477     }
1478 
1479     if (mis->have_listen_thread) {
1480         error_report("CMD_POSTCOPY_RAM_LISTEN already has a listen thread");
1481         return -1;
1482     }
1483 
1484     mis->have_listen_thread = true;
1485     /* Start up the listening thread and wait for it to signal ready */
1486     qemu_sem_init(&mis->listen_thread_sem, 0);
1487     qemu_thread_create(&mis->listen_thread, "postcopy/listen",
1488                        postcopy_ram_listen_thread, mis->from_src_file,
1489                        QEMU_THREAD_DETACHED);
1490     qemu_sem_wait(&mis->listen_thread_sem);
1491     qemu_sem_destroy(&mis->listen_thread_sem);
1492 
1493     return 0;
1494 }
1495 
1496 
1497 typedef struct {
1498     QEMUBH *bh;
1499 } HandleRunBhData;
1500 
1501 static void loadvm_postcopy_handle_run_bh(void *opaque)
1502 {
1503     Error *local_err = NULL;
1504     HandleRunBhData *data = opaque;
1505 
1506     /* TODO we should move all of this lot into postcopy_ram.c or a shared code
1507      * in migration.c
1508      */
1509     cpu_synchronize_all_post_init();
1510 
1511     qemu_announce_self();
1512 
1513     /* Make sure all file formats flush their mutable metadata */
1514     bdrv_invalidate_cache_all(&local_err);
1515     if (local_err) {
1516         error_report_err(local_err);
1517     }
1518 
1519     trace_loadvm_postcopy_handle_run_cpu_sync();
1520     cpu_synchronize_all_post_init();
1521 
1522     trace_loadvm_postcopy_handle_run_vmstart();
1523 
1524     if (autostart) {
1525         /* Hold onto your hats, starting the CPU */
1526         vm_start();
1527     } else {
1528         /* leave it paused and let management decide when to start the CPU */
1529         runstate_set(RUN_STATE_PAUSED);
1530     }
1531 
1532     qemu_bh_delete(data->bh);
1533     g_free(data);
1534 }
1535 
1536 /* After all discards we can start running and asking for pages */
1537 static int loadvm_postcopy_handle_run(MigrationIncomingState *mis)
1538 {
1539     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_RUNNING);
1540     HandleRunBhData *data;
1541 
1542     trace_loadvm_postcopy_handle_run();
1543     if (ps != POSTCOPY_INCOMING_LISTENING) {
1544         error_report("CMD_POSTCOPY_RUN in wrong postcopy state (%d)", ps);
1545         return -1;
1546     }
1547 
1548     data = g_new(HandleRunBhData, 1);
1549     data->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, data);
1550     qemu_bh_schedule(data->bh);
1551 
1552     /* We need to finish reading the stream from the package
1553      * and also stop reading anything more from the stream that loaded the
1554      * package (since it's now being read by the listener thread).
1555      * LOADVM_QUIT will quit all the layers of nested loadvm loops.
1556      */
1557     return LOADVM_QUIT;
1558 }
1559 
1560 /**
1561  * Immediately following this command is a blob of data containing an embedded
1562  * chunk of migration stream; read it and load it.
1563  *
1564  * @mis: Incoming state
1565  * @length: Length of packaged data to read
1566  *
1567  * Returns: Negative values on error
1568  *
1569  */
1570 static int loadvm_handle_cmd_packaged(MigrationIncomingState *mis)
1571 {
1572     int ret;
1573     size_t length;
1574     QIOChannelBuffer *bioc;
1575 
1576     length = qemu_get_be32(mis->from_src_file);
1577     trace_loadvm_handle_cmd_packaged(length);
1578 
1579     if (length > MAX_VM_CMD_PACKAGED_SIZE) {
1580         error_report("Unreasonably large packaged state: %zu", length);
1581         return -1;
1582     }
1583 
1584     bioc = qio_channel_buffer_new(length);
1585     ret = qemu_get_buffer(mis->from_src_file,
1586                           bioc->data,
1587                           length);
1588     if (ret != length) {
1589         object_unref(OBJECT(bioc));
1590         error_report("CMD_PACKAGED: Buffer receive fail ret=%d length=%zu",
1591                      ret, length);
1592         return (ret < 0) ? ret : -EAGAIN;
1593     }
1594     bioc->usage += length;
1595     trace_loadvm_handle_cmd_packaged_received(ret);
1596 
1597     QEMUFile *packf = qemu_fopen_channel_input(QIO_CHANNEL(bioc));
1598 
1599     ret = qemu_loadvm_state_main(packf, mis);
1600     trace_loadvm_handle_cmd_packaged_main(ret);
1601     qemu_fclose(packf);
1602     object_unref(OBJECT(bioc));
1603 
1604     return ret;
1605 }
1606 
1607 /*
1608  * Process an incoming 'QEMU_VM_COMMAND'
1609  * 0           just a normal return
1610  * LOADVM_QUIT All good, but exit the loop
1611  * <0          Error
1612  */
1613 static int loadvm_process_command(QEMUFile *f)
1614 {
1615     MigrationIncomingState *mis = migration_incoming_get_current();
1616     uint16_t cmd;
1617     uint16_t len;
1618     uint32_t tmp32;
1619 
1620     cmd = qemu_get_be16(f);
1621     len = qemu_get_be16(f);
1622 
1623     trace_loadvm_process_command(cmd, len);
1624     if (cmd >= MIG_CMD_MAX || cmd == MIG_CMD_INVALID) {
1625         error_report("MIG_CMD 0x%x unknown (len 0x%x)", cmd, len);
1626         return -EINVAL;
1627     }
1628 
1629     if (mig_cmd_args[cmd].len != -1 && mig_cmd_args[cmd].len != len) {
1630         error_report("%s received with bad length - expecting %zu, got %d",
1631                      mig_cmd_args[cmd].name,
1632                      (size_t)mig_cmd_args[cmd].len, len);
1633         return -ERANGE;
1634     }
1635 
1636     switch (cmd) {
1637     case MIG_CMD_OPEN_RETURN_PATH:
1638         if (mis->to_src_file) {
1639             error_report("CMD_OPEN_RETURN_PATH called when RP already open");
1640             /* Not really a problem, so don't give up */
1641             return 0;
1642         }
1643         mis->to_src_file = qemu_file_get_return_path(f);
1644         if (!mis->to_src_file) {
1645             error_report("CMD_OPEN_RETURN_PATH failed");
1646             return -1;
1647         }
1648         break;
1649 
1650     case MIG_CMD_PING:
1651         tmp32 = qemu_get_be32(f);
1652         trace_loadvm_process_command_ping(tmp32);
1653         if (!mis->to_src_file) {
1654             error_report("CMD_PING (0x%x) received with no return path",
1655                          tmp32);
1656             return -1;
1657         }
1658         migrate_send_rp_pong(mis, tmp32);
1659         break;
1660 
1661     case MIG_CMD_PACKAGED:
1662         return loadvm_handle_cmd_packaged(mis);
1663 
1664     case MIG_CMD_POSTCOPY_ADVISE:
1665         return loadvm_postcopy_handle_advise(mis);
1666 
1667     case MIG_CMD_POSTCOPY_LISTEN:
1668         return loadvm_postcopy_handle_listen(mis);
1669 
1670     case MIG_CMD_POSTCOPY_RUN:
1671         return loadvm_postcopy_handle_run(mis);
1672 
1673     case MIG_CMD_POSTCOPY_RAM_DISCARD:
1674         return loadvm_postcopy_ram_handle_discard(mis, len);
1675     }
1676 
1677     return 0;
1678 }
1679 
1680 struct LoadStateEntry {
1681     QLIST_ENTRY(LoadStateEntry) entry;
1682     SaveStateEntry *se;
1683     int section_id;
1684     int version_id;
1685 };
1686 
1687 /*
1688  * Read a footer off the wire and check that it matches the expected section
1689  *
1690  * Returns: true if the footer was good
1691  *          false if there is a problem (and calls error_report to say why)
1692  */
1693 static bool check_section_footer(QEMUFile *f, LoadStateEntry *le)
1694 {
1695     uint8_t read_mark;
1696     uint32_t read_section_id;
1697 
1698     if (skip_section_footers) {
1699         /* No footer to check */
1700         return true;
1701     }
1702 
1703     read_mark = qemu_get_byte(f);
1704 
1705     if (read_mark != QEMU_VM_SECTION_FOOTER) {
1706         error_report("Missing section footer for %s", le->se->idstr);
1707         return false;
1708     }
1709 
1710     read_section_id = qemu_get_be32(f);
1711     if (read_section_id != le->section_id) {
1712         error_report("Mismatched section id in footer for %s -"
1713                      " read 0x%x expected 0x%x",
1714                      le->se->idstr, read_section_id, le->section_id);
1715         return false;
1716     }
1717 
1718     /* All good */
1719     return true;
1720 }
1721 
1722 void loadvm_free_handlers(MigrationIncomingState *mis)
1723 {
1724     LoadStateEntry *le, *new_le;
1725 
1726     QLIST_FOREACH_SAFE(le, &mis->loadvm_handlers, entry, new_le) {
1727         QLIST_REMOVE(le, entry);
1728         g_free(le);
1729     }
1730 }
1731 
1732 static int
1733 qemu_loadvm_section_start_full(QEMUFile *f, MigrationIncomingState *mis)
1734 {
1735     uint32_t instance_id, version_id, section_id;
1736     SaveStateEntry *se;
1737     LoadStateEntry *le;
1738     char idstr[256];
1739     int ret;
1740 
1741     /* Read section start */
1742     section_id = qemu_get_be32(f);
1743     if (!qemu_get_counted_string(f, idstr)) {
1744         error_report("Unable to read ID string for section %u",
1745                      section_id);
1746         return -EINVAL;
1747     }
1748     instance_id = qemu_get_be32(f);
1749     version_id = qemu_get_be32(f);
1750 
1751     trace_qemu_loadvm_state_section_startfull(section_id, idstr,
1752             instance_id, version_id);
1753     /* Find savevm section */
1754     se = find_se(idstr, instance_id);
1755     if (se == NULL) {
1756         error_report("Unknown savevm section or instance '%s' %d",
1757                      idstr, instance_id);
1758         return -EINVAL;
1759     }
1760 
1761     /* Validate version */
1762     if (version_id > se->version_id) {
1763         error_report("savevm: unsupported version %d for '%s' v%d",
1764                      version_id, idstr, se->version_id);
1765         return -EINVAL;
1766     }
1767 
1768     /* Validate if it is a device's state */
1769     if (xen_enabled() && se->is_ram) {
1770         error_report("loadvm: %s RAM loading not allowed on Xen", idstr);
1771         return -EINVAL;
1772     }
1773 
1774     /* Add entry */
1775     le = g_malloc0(sizeof(*le));
1776 
1777     le->se = se;
1778     le->section_id = section_id;
1779     le->version_id = version_id;
1780     QLIST_INSERT_HEAD(&mis->loadvm_handlers, le, entry);
1781 
1782     ret = vmstate_load(f, le->se, le->version_id);
1783     if (ret < 0) {
1784         error_report("error while loading state for instance 0x%x of"
1785                      " device '%s'", instance_id, idstr);
1786         return ret;
1787     }
1788     if (!check_section_footer(f, le)) {
1789         return -EINVAL;
1790     }
1791 
1792     return 0;
1793 }
1794 
1795 static int
1796 qemu_loadvm_section_part_end(QEMUFile *f, MigrationIncomingState *mis)
1797 {
1798     uint32_t section_id;
1799     LoadStateEntry *le;
1800     int ret;
1801 
1802     section_id = qemu_get_be32(f);
1803 
1804     trace_qemu_loadvm_state_section_partend(section_id);
1805     QLIST_FOREACH(le, &mis->loadvm_handlers, entry) {
1806         if (le->section_id == section_id) {
1807             break;
1808         }
1809     }
1810     if (le == NULL) {
1811         error_report("Unknown savevm section %d", section_id);
1812         return -EINVAL;
1813     }
1814 
1815     ret = vmstate_load(f, le->se, le->version_id);
1816     if (ret < 0) {
1817         error_report("error while loading state section id %d(%s)",
1818                      section_id, le->se->idstr);
1819         return ret;
1820     }
1821     if (!check_section_footer(f, le)) {
1822         return -EINVAL;
1823     }
1824 
1825     return 0;
1826 }
1827 
1828 static int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis)
1829 {
1830     uint8_t section_type;
1831     int ret;
1832 
1833     while ((section_type = qemu_get_byte(f)) != QEMU_VM_EOF) {
1834 
1835         trace_qemu_loadvm_state_section(section_type);
1836         switch (section_type) {
1837         case QEMU_VM_SECTION_START:
1838         case QEMU_VM_SECTION_FULL:
1839             ret = qemu_loadvm_section_start_full(f, mis);
1840             if (ret < 0) {
1841                 return ret;
1842             }
1843             break;
1844         case QEMU_VM_SECTION_PART:
1845         case QEMU_VM_SECTION_END:
1846             ret = qemu_loadvm_section_part_end(f, mis);
1847             if (ret < 0) {
1848                 return ret;
1849             }
1850             break;
1851         case QEMU_VM_COMMAND:
1852             ret = loadvm_process_command(f);
1853             trace_qemu_loadvm_state_section_command(ret);
1854             if ((ret < 0) || (ret & LOADVM_QUIT)) {
1855                 return ret;
1856             }
1857             break;
1858         default:
1859             error_report("Unknown savevm section type %d", section_type);
1860             return -EINVAL;
1861         }
1862     }
1863 
1864     return 0;
1865 }
1866 
1867 int qemu_loadvm_state(QEMUFile *f)
1868 {
1869     MigrationIncomingState *mis = migration_incoming_get_current();
1870     Error *local_err = NULL;
1871     unsigned int v;
1872     int ret;
1873 
1874     if (qemu_savevm_state_blocked(&local_err)) {
1875         error_report_err(local_err);
1876         return -EINVAL;
1877     }
1878 
1879     v = qemu_get_be32(f);
1880     if (v != QEMU_VM_FILE_MAGIC) {
1881         error_report("Not a migration stream");
1882         return -EINVAL;
1883     }
1884 
1885     v = qemu_get_be32(f);
1886     if (v == QEMU_VM_FILE_VERSION_COMPAT) {
1887         error_report("SaveVM v2 format is obsolete and don't work anymore");
1888         return -ENOTSUP;
1889     }
1890     if (v != QEMU_VM_FILE_VERSION) {
1891         error_report("Unsupported migration stream version");
1892         return -ENOTSUP;
1893     }
1894 
1895     if (!savevm_state.skip_configuration || enforce_config_section()) {
1896         if (qemu_get_byte(f) != QEMU_VM_CONFIGURATION) {
1897             error_report("Configuration section missing");
1898             return -EINVAL;
1899         }
1900         ret = vmstate_load_state(f, &vmstate_configuration, &savevm_state, 0);
1901 
1902         if (ret) {
1903             return ret;
1904         }
1905     }
1906 
1907     ret = qemu_loadvm_state_main(f, mis);
1908     qemu_event_set(&mis->main_thread_load_event);
1909 
1910     trace_qemu_loadvm_state_post_main(ret);
1911 
1912     if (mis->have_listen_thread) {
1913         /* Listen thread still going, can't clean up yet */
1914         return ret;
1915     }
1916 
1917     if (ret == 0) {
1918         ret = qemu_file_get_error(f);
1919     }
1920 
1921     /*
1922      * Try to read in the VMDESC section as well, so that dumping tools that
1923      * intercept our migration stream have the chance to see it.
1924      */
1925 
1926     /* We've got to be careful; if we don't read the data and just shut the fd
1927      * then the sender can error if we close while it's still sending.
1928      * We also mustn't read data that isn't there; some transports (RDMA)
1929      * will stall waiting for that data when the source has already closed.
1930      */
1931     if (ret == 0 && should_send_vmdesc()) {
1932         uint8_t *buf;
1933         uint32_t size;
1934         uint8_t  section_type = qemu_get_byte(f);
1935 
1936         if (section_type != QEMU_VM_VMDESCRIPTION) {
1937             error_report("Expected vmdescription section, but got %d",
1938                          section_type);
1939             /*
1940              * It doesn't seem worth failing at this point since
1941              * we apparently have an otherwise valid VM state
1942              */
1943         } else {
1944             buf = g_malloc(0x1000);
1945             size = qemu_get_be32(f);
1946 
1947             while (size > 0) {
1948                 uint32_t read_chunk = MIN(size, 0x1000);
1949                 qemu_get_buffer(f, buf, read_chunk);
1950                 size -= read_chunk;
1951             }
1952             g_free(buf);
1953         }
1954     }
1955 
1956     cpu_synchronize_all_post_init();
1957 
1958     return ret;
1959 }
1960 
1961 void hmp_savevm(Monitor *mon, const QDict *qdict)
1962 {
1963     BlockDriverState *bs, *bs1;
1964     QEMUSnapshotInfo sn1, *sn = &sn1, old_sn1, *old_sn = &old_sn1;
1965     int ret;
1966     QEMUFile *f;
1967     int saved_vm_running;
1968     uint64_t vm_state_size;
1969     qemu_timeval tv;
1970     struct tm tm;
1971     const char *name = qdict_get_try_str(qdict, "name");
1972     Error *local_err = NULL;
1973     AioContext *aio_context;
1974 
1975     if (!bdrv_all_can_snapshot(&bs)) {
1976         monitor_printf(mon, "Device '%s' is writable but does not "
1977                        "support snapshots.\n", bdrv_get_device_name(bs));
1978         return;
1979     }
1980 
1981     /* Delete old snapshots of the same name */
1982     if (name && bdrv_all_delete_snapshot(name, &bs1, &local_err) < 0) {
1983         error_reportf_err(local_err,
1984                           "Error while deleting snapshot on device '%s': ",
1985                           bdrv_get_device_name(bs1));
1986         return;
1987     }
1988 
1989     bs = bdrv_all_find_vmstate_bs();
1990     if (bs == NULL) {
1991         monitor_printf(mon, "No block device can accept snapshots\n");
1992         return;
1993     }
1994     aio_context = bdrv_get_aio_context(bs);
1995 
1996     saved_vm_running = runstate_is_running();
1997 
1998     ret = global_state_store();
1999     if (ret) {
2000         monitor_printf(mon, "Error saving global state\n");
2001         return;
2002     }
2003     vm_stop(RUN_STATE_SAVE_VM);
2004 
2005     aio_context_acquire(aio_context);
2006 
2007     memset(sn, 0, sizeof(*sn));
2008 
2009     /* fill auxiliary fields */
2010     qemu_gettimeofday(&tv);
2011     sn->date_sec = tv.tv_sec;
2012     sn->date_nsec = tv.tv_usec * 1000;
2013     sn->vm_clock_nsec = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
2014 
2015     if (name) {
2016         ret = bdrv_snapshot_find(bs, old_sn, name);
2017         if (ret >= 0) {
2018             pstrcpy(sn->name, sizeof(sn->name), old_sn->name);
2019             pstrcpy(sn->id_str, sizeof(sn->id_str), old_sn->id_str);
2020         } else {
2021             pstrcpy(sn->name, sizeof(sn->name), name);
2022         }
2023     } else {
2024         /* cast below needed for OpenBSD where tv_sec is still 'long' */
2025         localtime_r((const time_t *)&tv.tv_sec, &tm);
2026         strftime(sn->name, sizeof(sn->name), "vm-%Y%m%d%H%M%S", &tm);
2027     }
2028 
2029     /* save the VM state */
2030     f = qemu_fopen_bdrv(bs, 1);
2031     if (!f) {
2032         monitor_printf(mon, "Could not open VM state file\n");
2033         goto the_end;
2034     }
2035     ret = qemu_savevm_state(f, &local_err);
2036     vm_state_size = qemu_ftell(f);
2037     qemu_fclose(f);
2038     if (ret < 0) {
2039         error_report_err(local_err);
2040         goto the_end;
2041     }
2042 
2043     ret = bdrv_all_create_snapshot(sn, bs, vm_state_size, &bs);
2044     if (ret < 0) {
2045         monitor_printf(mon, "Error while creating snapshot on '%s'\n",
2046                        bdrv_get_device_name(bs));
2047     }
2048 
2049  the_end:
2050     aio_context_release(aio_context);
2051     if (saved_vm_running) {
2052         vm_start();
2053     }
2054 }
2055 
2056 void qmp_xen_save_devices_state(const char *filename, Error **errp)
2057 {
2058     QEMUFile *f;
2059     QIOChannelFile *ioc;
2060     int saved_vm_running;
2061     int ret;
2062 
2063     saved_vm_running = runstate_is_running();
2064     vm_stop(RUN_STATE_SAVE_VM);
2065     global_state_store_running();
2066 
2067     ioc = qio_channel_file_new_path(filename, O_WRONLY | O_CREAT, 0660, errp);
2068     if (!ioc) {
2069         goto the_end;
2070     }
2071     f = qemu_fopen_channel_output(QIO_CHANNEL(ioc));
2072     ret = qemu_save_device_state(f);
2073     qemu_fclose(f);
2074     if (ret < 0) {
2075         error_setg(errp, QERR_IO_ERROR);
2076     }
2077 
2078  the_end:
2079     if (saved_vm_running) {
2080         vm_start();
2081     }
2082 }
2083 
2084 void qmp_xen_load_devices_state(const char *filename, Error **errp)
2085 {
2086     QEMUFile *f;
2087     QIOChannelFile *ioc;
2088     int ret;
2089 
2090     /* Guest must be paused before loading the device state; the RAM state
2091      * will already have been loaded by xc
2092      */
2093     if (runstate_is_running()) {
2094         error_setg(errp, "Cannot update device state while vm is running");
2095         return;
2096     }
2097     vm_stop(RUN_STATE_RESTORE_VM);
2098 
2099     ioc = qio_channel_file_new_path(filename, O_RDONLY | O_BINARY, 0, errp);
2100     if (!ioc) {
2101         return;
2102     }
2103     f = qemu_fopen_channel_input(QIO_CHANNEL(ioc));
2104 
2105     migration_incoming_state_new(f);
2106     ret = qemu_loadvm_state(f);
2107     qemu_fclose(f);
2108     if (ret < 0) {
2109         error_setg(errp, QERR_IO_ERROR);
2110     }
2111     migration_incoming_state_destroy();
2112 }
2113 
2114 int load_vmstate(const char *name)
2115 {
2116     BlockDriverState *bs, *bs_vm_state;
2117     QEMUSnapshotInfo sn;
2118     QEMUFile *f;
2119     int ret;
2120     AioContext *aio_context;
2121 
2122     if (!bdrv_all_can_snapshot(&bs)) {
2123         error_report("Device '%s' is writable but does not support snapshots.",
2124                      bdrv_get_device_name(bs));
2125         return -ENOTSUP;
2126     }
2127     ret = bdrv_all_find_snapshot(name, &bs);
2128     if (ret < 0) {
2129         error_report("Device '%s' does not have the requested snapshot '%s'",
2130                      bdrv_get_device_name(bs), name);
2131         return ret;
2132     }
2133 
2134     bs_vm_state = bdrv_all_find_vmstate_bs();
2135     if (!bs_vm_state) {
2136         error_report("No block device supports snapshots");
2137         return -ENOTSUP;
2138     }
2139     aio_context = bdrv_get_aio_context(bs_vm_state);
2140 
2141     /* Don't even try to load empty VM states */
2142     aio_context_acquire(aio_context);
2143     ret = bdrv_snapshot_find(bs_vm_state, &sn, name);
2144     aio_context_release(aio_context);
2145     if (ret < 0) {
2146         return ret;
2147     } else if (sn.vm_state_size == 0) {
2148         error_report("This is a disk-only snapshot. Revert to it offline "
2149             "using qemu-img.");
2150         return -EINVAL;
2151     }
2152 
2153     /* Flush all IO requests so they don't interfere with the new state.  */
2154     bdrv_drain_all();
2155 
2156     ret = bdrv_all_goto_snapshot(name, &bs);
2157     if (ret < 0) {
2158         error_report("Error %d while activating snapshot '%s' on '%s'",
2159                      ret, name, bdrv_get_device_name(bs));
2160         return ret;
2161     }
2162 
2163     /* restore the VM state */
2164     f = qemu_fopen_bdrv(bs_vm_state, 0);
2165     if (!f) {
2166         error_report("Could not open VM state file");
2167         return -EINVAL;
2168     }
2169 
2170     qemu_system_reset(VMRESET_SILENT);
2171     migration_incoming_state_new(f);
2172 
2173     aio_context_acquire(aio_context);
2174     ret = qemu_loadvm_state(f);
2175     qemu_fclose(f);
2176     aio_context_release(aio_context);
2177 
2178     migration_incoming_state_destroy();
2179     if (ret < 0) {
2180         error_report("Error %d while loading VM state", ret);
2181         return ret;
2182     }
2183 
2184     return 0;
2185 }
2186 
2187 void hmp_delvm(Monitor *mon, const QDict *qdict)
2188 {
2189     BlockDriverState *bs;
2190     Error *err;
2191     const char *name = qdict_get_str(qdict, "name");
2192 
2193     if (bdrv_all_delete_snapshot(name, &bs, &err) < 0) {
2194         error_reportf_err(err,
2195                           "Error while deleting snapshot on device '%s': ",
2196                           bdrv_get_device_name(bs));
2197     }
2198 }
2199 
2200 void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
2201 {
2202     BlockDriverState *bs, *bs1;
2203     QEMUSnapshotInfo *sn_tab, *sn;
2204     int nb_sns, i;
2205     int total;
2206     int *available_snapshots;
2207     AioContext *aio_context;
2208 
2209     bs = bdrv_all_find_vmstate_bs();
2210     if (!bs) {
2211         monitor_printf(mon, "No available block device supports snapshots\n");
2212         return;
2213     }
2214     aio_context = bdrv_get_aio_context(bs);
2215 
2216     aio_context_acquire(aio_context);
2217     nb_sns = bdrv_snapshot_list(bs, &sn_tab);
2218     aio_context_release(aio_context);
2219 
2220     if (nb_sns < 0) {
2221         monitor_printf(mon, "bdrv_snapshot_list: error %d\n", nb_sns);
2222         return;
2223     }
2224 
2225     if (nb_sns == 0) {
2226         monitor_printf(mon, "There is no snapshot available.\n");
2227         return;
2228     }
2229 
2230     available_snapshots = g_new0(int, nb_sns);
2231     total = 0;
2232     for (i = 0; i < nb_sns; i++) {
2233         if (bdrv_all_find_snapshot(sn_tab[i].id_str, &bs1) == 0) {
2234             available_snapshots[total] = i;
2235             total++;
2236         }
2237     }
2238 
2239     if (total > 0) {
2240         bdrv_snapshot_dump((fprintf_function)monitor_printf, mon, NULL);
2241         monitor_printf(mon, "\n");
2242         for (i = 0; i < total; i++) {
2243             sn = &sn_tab[available_snapshots[i]];
2244             bdrv_snapshot_dump((fprintf_function)monitor_printf, mon, sn);
2245             monitor_printf(mon, "\n");
2246         }
2247     } else {
2248         monitor_printf(mon, "There is no suitable snapshot available\n");
2249     }
2250 
2251     g_free(sn_tab);
2252     g_free(available_snapshots);
2253 
2254 }
2255 
2256 void vmstate_register_ram(MemoryRegion *mr, DeviceState *dev)
2257 {
2258     qemu_ram_set_idstr(mr->ram_block,
2259                        memory_region_name(mr), dev);
2260 }
2261 
2262 void vmstate_unregister_ram(MemoryRegion *mr, DeviceState *dev)
2263 {
2264     qemu_ram_unset_idstr(mr->ram_block);
2265 }
2266 
2267 void vmstate_register_ram_global(MemoryRegion *mr)
2268 {
2269     vmstate_register_ram(mr, NULL);
2270 }
2271