xref: /openbmc/qemu/migration/savevm.c (revision fe44dc91)
1 /*
2  * QEMU System Emulator
3  *
4  * Copyright (c) 2003-2008 Fabrice Bellard
5  * Copyright (c) 2009-2015 Red Hat Inc
6  *
7  * Authors:
8  *  Juan Quintela <quintela@redhat.com>
9  *
10  * Permission is hereby granted, free of charge, to any person obtaining a copy
11  * of this software and associated documentation files (the "Software"), to deal
12  * in the Software without restriction, including without limitation the rights
13  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
14  * copies of the Software, and to permit persons to whom the Software is
15  * furnished to do so, subject to the following conditions:
16  *
17  * The above copyright notice and this permission notice shall be included in
18  * all copies or substantial portions of the Software.
19  *
20  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
21  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
23  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
24  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
25  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
26  * THE SOFTWARE.
27  */
28 
29 #include "qemu/osdep.h"
30 #include "cpu.h"
31 #include "hw/boards.h"
32 #include "hw/hw.h"
33 #include "hw/qdev.h"
34 #include "hw/xen/xen.h"
35 #include "net/net.h"
36 #include "monitor/monitor.h"
37 #include "sysemu/sysemu.h"
38 #include "qemu/timer.h"
39 #include "audio/audio.h"
40 #include "migration/migration.h"
41 #include "migration/postcopy-ram.h"
42 #include "qapi/qmp/qerror.h"
43 #include "qemu/error-report.h"
44 #include "qemu/sockets.h"
45 #include "qemu/queue.h"
46 #include "sysemu/cpus.h"
47 #include "exec/memory.h"
48 #include "qmp-commands.h"
49 #include "trace.h"
50 #include "qemu/bitops.h"
51 #include "qemu/iov.h"
52 #include "block/snapshot.h"
53 #include "block/qapi.h"
54 #include "qemu/cutils.h"
55 #include "io/channel-buffer.h"
56 #include "io/channel-file.h"
57 
58 #ifndef ETH_P_RARP
59 #define ETH_P_RARP 0x8035
60 #endif
61 #define ARP_HTYPE_ETH 0x0001
62 #define ARP_PTYPE_IP 0x0800
63 #define ARP_OP_REQUEST_REV 0x3
64 
65 const unsigned int postcopy_ram_discard_version = 0;
66 
67 static bool skip_section_footers;
68 
69 static struct mig_cmd_args {
70     ssize_t     len; /* -1 = variable */
71     const char *name;
72 } mig_cmd_args[] = {
73     [MIG_CMD_INVALID]          = { .len = -1, .name = "INVALID" },
74     [MIG_CMD_OPEN_RETURN_PATH] = { .len =  0, .name = "OPEN_RETURN_PATH" },
75     [MIG_CMD_PING]             = { .len = sizeof(uint32_t), .name = "PING" },
76     [MIG_CMD_POSTCOPY_ADVISE]  = { .len = 16, .name = "POSTCOPY_ADVISE" },
77     [MIG_CMD_POSTCOPY_LISTEN]  = { .len =  0, .name = "POSTCOPY_LISTEN" },
78     [MIG_CMD_POSTCOPY_RUN]     = { .len =  0, .name = "POSTCOPY_RUN" },
79     [MIG_CMD_POSTCOPY_RAM_DISCARD] = {
80                                    .len = -1, .name = "POSTCOPY_RAM_DISCARD" },
81     [MIG_CMD_PACKAGED]         = { .len =  4, .name = "PACKAGED" },
82     [MIG_CMD_MAX]              = { .len = -1, .name = "MAX" },
83 };
84 
85 static int announce_self_create(uint8_t *buf,
86                                 uint8_t *mac_addr)
87 {
88     /* Ethernet header. */
89     memset(buf, 0xff, 6);         /* destination MAC addr */
90     memcpy(buf + 6, mac_addr, 6); /* source MAC addr */
91     *(uint16_t *)(buf + 12) = htons(ETH_P_RARP); /* ethertype */
92 
93     /* RARP header. */
94     *(uint16_t *)(buf + 14) = htons(ARP_HTYPE_ETH); /* hardware addr space */
95     *(uint16_t *)(buf + 16) = htons(ARP_PTYPE_IP); /* protocol addr space */
96     *(buf + 18) = 6; /* hardware addr length (ethernet) */
97     *(buf + 19) = 4; /* protocol addr length (IPv4) */
98     *(uint16_t *)(buf + 20) = htons(ARP_OP_REQUEST_REV); /* opcode */
99     memcpy(buf + 22, mac_addr, 6); /* source hw addr */
100     memset(buf + 28, 0x00, 4);     /* source protocol addr */
101     memcpy(buf + 32, mac_addr, 6); /* target hw addr */
102     memset(buf + 38, 0x00, 4);     /* target protocol addr */
103 
104     /* Padding to get up to 60 bytes (ethernet min packet size, minus FCS). */
105     memset(buf + 42, 0x00, 18);
106 
107     return 60; /* len (FCS will be added by hardware) */
108 }
109 
110 static void qemu_announce_self_iter(NICState *nic, void *opaque)
111 {
112     uint8_t buf[60];
113     int len;
114 
115     trace_qemu_announce_self_iter(qemu_ether_ntoa(&nic->conf->macaddr));
116     len = announce_self_create(buf, nic->conf->macaddr.a);
117 
118     qemu_send_packet_raw(qemu_get_queue(nic), buf, len);
119 }
120 
121 
122 static void qemu_announce_self_once(void *opaque)
123 {
124     static int count = SELF_ANNOUNCE_ROUNDS;
125     QEMUTimer *timer = *(QEMUTimer **)opaque;
126 
127     qemu_foreach_nic(qemu_announce_self_iter, NULL);
128 
129     if (--count) {
130         /* delay 50ms, 150ms, 250ms, ... */
131         timer_mod(timer, qemu_clock_get_ms(QEMU_CLOCK_REALTIME) +
132                   self_announce_delay(count));
133     } else {
134             timer_del(timer);
135             timer_free(timer);
136     }
137 }
138 
139 void qemu_announce_self(void)
140 {
141     static QEMUTimer *timer;
142     timer = timer_new_ms(QEMU_CLOCK_REALTIME, qemu_announce_self_once, &timer);
143     qemu_announce_self_once(&timer);
144 }
145 
146 /***********************************************************/
147 /* savevm/loadvm support */
148 
149 static ssize_t block_writev_buffer(void *opaque, struct iovec *iov, int iovcnt,
150                                    int64_t pos)
151 {
152     int ret;
153     QEMUIOVector qiov;
154 
155     qemu_iovec_init_external(&qiov, iov, iovcnt);
156     ret = bdrv_writev_vmstate(opaque, &qiov, pos);
157     if (ret < 0) {
158         return ret;
159     }
160 
161     return qiov.size;
162 }
163 
164 static ssize_t block_get_buffer(void *opaque, uint8_t *buf, int64_t pos,
165                                 size_t size)
166 {
167     return bdrv_load_vmstate(opaque, buf, pos, size);
168 }
169 
170 static int bdrv_fclose(void *opaque)
171 {
172     return bdrv_flush(opaque);
173 }
174 
175 static const QEMUFileOps bdrv_read_ops = {
176     .get_buffer = block_get_buffer,
177     .close =      bdrv_fclose
178 };
179 
180 static const QEMUFileOps bdrv_write_ops = {
181     .writev_buffer  = block_writev_buffer,
182     .close          = bdrv_fclose
183 };
184 
185 static QEMUFile *qemu_fopen_bdrv(BlockDriverState *bs, int is_writable)
186 {
187     if (is_writable) {
188         return qemu_fopen_ops(bs, &bdrv_write_ops);
189     }
190     return qemu_fopen_ops(bs, &bdrv_read_ops);
191 }
192 
193 
194 /* QEMUFile timer support.
195  * Not in qemu-file.c to not add qemu-timer.c as dependency to qemu-file.c
196  */
197 
198 void timer_put(QEMUFile *f, QEMUTimer *ts)
199 {
200     uint64_t expire_time;
201 
202     expire_time = timer_expire_time_ns(ts);
203     qemu_put_be64(f, expire_time);
204 }
205 
206 void timer_get(QEMUFile *f, QEMUTimer *ts)
207 {
208     uint64_t expire_time;
209 
210     expire_time = qemu_get_be64(f);
211     if (expire_time != -1) {
212         timer_mod_ns(ts, expire_time);
213     } else {
214         timer_del(ts);
215     }
216 }
217 
218 
219 /* VMState timer support.
220  * Not in vmstate.c to not add qemu-timer.c as dependency to vmstate.c
221  */
222 
223 static int get_timer(QEMUFile *f, void *pv, size_t size, VMStateField *field)
224 {
225     QEMUTimer *v = pv;
226     timer_get(f, v);
227     return 0;
228 }
229 
230 static int put_timer(QEMUFile *f, void *pv, size_t size, VMStateField *field,
231                      QJSON *vmdesc)
232 {
233     QEMUTimer *v = pv;
234     timer_put(f, v);
235 
236     return 0;
237 }
238 
239 const VMStateInfo vmstate_info_timer = {
240     .name = "timer",
241     .get  = get_timer,
242     .put  = put_timer,
243 };
244 
245 
246 typedef struct CompatEntry {
247     char idstr[256];
248     int instance_id;
249 } CompatEntry;
250 
251 typedef struct SaveStateEntry {
252     QTAILQ_ENTRY(SaveStateEntry) entry;
253     char idstr[256];
254     int instance_id;
255     int alias_id;
256     int version_id;
257     int section_id;
258     SaveVMHandlers *ops;
259     const VMStateDescription *vmsd;
260     void *opaque;
261     CompatEntry *compat;
262     int is_ram;
263 } SaveStateEntry;
264 
265 typedef struct SaveState {
266     QTAILQ_HEAD(, SaveStateEntry) handlers;
267     int global_section_id;
268     bool skip_configuration;
269     uint32_t len;
270     const char *name;
271     uint32_t target_page_bits;
272 } SaveState;
273 
274 static SaveState savevm_state = {
275     .handlers = QTAILQ_HEAD_INITIALIZER(savevm_state.handlers),
276     .global_section_id = 0,
277     .skip_configuration = false,
278 };
279 
280 void savevm_skip_configuration(void)
281 {
282     savevm_state.skip_configuration = true;
283 }
284 
285 
286 static void configuration_pre_save(void *opaque)
287 {
288     SaveState *state = opaque;
289     const char *current_name = MACHINE_GET_CLASS(current_machine)->name;
290 
291     state->len = strlen(current_name);
292     state->name = current_name;
293     state->target_page_bits = TARGET_PAGE_BITS;
294 }
295 
296 static int configuration_pre_load(void *opaque)
297 {
298     SaveState *state = opaque;
299 
300     /* If there is no target-page-bits subsection it means the source
301      * predates the variable-target-page-bits support and is using the
302      * minimum possible value for this CPU.
303      */
304     state->target_page_bits = TARGET_PAGE_BITS_MIN;
305     return 0;
306 }
307 
308 static int configuration_post_load(void *opaque, int version_id)
309 {
310     SaveState *state = opaque;
311     const char *current_name = MACHINE_GET_CLASS(current_machine)->name;
312 
313     if (strncmp(state->name, current_name, state->len) != 0) {
314         error_report("Machine type received is '%.*s' and local is '%s'",
315                      (int) state->len, state->name, current_name);
316         return -EINVAL;
317     }
318 
319     if (state->target_page_bits != TARGET_PAGE_BITS) {
320         error_report("Received TARGET_PAGE_BITS is %d but local is %d",
321                      state->target_page_bits, TARGET_PAGE_BITS);
322         return -EINVAL;
323     }
324 
325     return 0;
326 }
327 
328 /* The target-page-bits subsection is present only if the
329  * target page size is not the same as the default (ie the
330  * minimum page size for a variable-page-size guest CPU).
331  * If it is present then it contains the actual target page
332  * bits for the machine, and migration will fail if the
333  * two ends don't agree about it.
334  */
335 static bool vmstate_target_page_bits_needed(void *opaque)
336 {
337     return TARGET_PAGE_BITS > TARGET_PAGE_BITS_MIN;
338 }
339 
340 static const VMStateDescription vmstate_target_page_bits = {
341     .name = "configuration/target-page-bits",
342     .version_id = 1,
343     .minimum_version_id = 1,
344     .needed = vmstate_target_page_bits_needed,
345     .fields = (VMStateField[]) {
346         VMSTATE_UINT32(target_page_bits, SaveState),
347         VMSTATE_END_OF_LIST()
348     }
349 };
350 
351 static const VMStateDescription vmstate_configuration = {
352     .name = "configuration",
353     .version_id = 1,
354     .pre_load = configuration_pre_load,
355     .post_load = configuration_post_load,
356     .pre_save = configuration_pre_save,
357     .fields = (VMStateField[]) {
358         VMSTATE_UINT32(len, SaveState),
359         VMSTATE_VBUFFER_ALLOC_UINT32(name, SaveState, 0, NULL, 0, len),
360         VMSTATE_END_OF_LIST()
361     },
362     .subsections = (const VMStateDescription*[]) {
363         &vmstate_target_page_bits,
364         NULL
365     }
366 };
367 
368 static void dump_vmstate_vmsd(FILE *out_file,
369                               const VMStateDescription *vmsd, int indent,
370                               bool is_subsection);
371 
372 static void dump_vmstate_vmsf(FILE *out_file, const VMStateField *field,
373                               int indent)
374 {
375     fprintf(out_file, "%*s{\n", indent, "");
376     indent += 2;
377     fprintf(out_file, "%*s\"field\": \"%s\",\n", indent, "", field->name);
378     fprintf(out_file, "%*s\"version_id\": %d,\n", indent, "",
379             field->version_id);
380     fprintf(out_file, "%*s\"field_exists\": %s,\n", indent, "",
381             field->field_exists ? "true" : "false");
382     fprintf(out_file, "%*s\"size\": %zu", indent, "", field->size);
383     if (field->vmsd != NULL) {
384         fprintf(out_file, ",\n");
385         dump_vmstate_vmsd(out_file, field->vmsd, indent, false);
386     }
387     fprintf(out_file, "\n%*s}", indent - 2, "");
388 }
389 
390 static void dump_vmstate_vmss(FILE *out_file,
391                               const VMStateDescription **subsection,
392                               int indent)
393 {
394     if (*subsection != NULL) {
395         dump_vmstate_vmsd(out_file, *subsection, indent, true);
396     }
397 }
398 
399 static void dump_vmstate_vmsd(FILE *out_file,
400                               const VMStateDescription *vmsd, int indent,
401                               bool is_subsection)
402 {
403     if (is_subsection) {
404         fprintf(out_file, "%*s{\n", indent, "");
405     } else {
406         fprintf(out_file, "%*s\"%s\": {\n", indent, "", "Description");
407     }
408     indent += 2;
409     fprintf(out_file, "%*s\"name\": \"%s\",\n", indent, "", vmsd->name);
410     fprintf(out_file, "%*s\"version_id\": %d,\n", indent, "",
411             vmsd->version_id);
412     fprintf(out_file, "%*s\"minimum_version_id\": %d", indent, "",
413             vmsd->minimum_version_id);
414     if (vmsd->fields != NULL) {
415         const VMStateField *field = vmsd->fields;
416         bool first;
417 
418         fprintf(out_file, ",\n%*s\"Fields\": [\n", indent, "");
419         first = true;
420         while (field->name != NULL) {
421             if (field->flags & VMS_MUST_EXIST) {
422                 /* Ignore VMSTATE_VALIDATE bits; these don't get migrated */
423                 field++;
424                 continue;
425             }
426             if (!first) {
427                 fprintf(out_file, ",\n");
428             }
429             dump_vmstate_vmsf(out_file, field, indent + 2);
430             field++;
431             first = false;
432         }
433         fprintf(out_file, "\n%*s]", indent, "");
434     }
435     if (vmsd->subsections != NULL) {
436         const VMStateDescription **subsection = vmsd->subsections;
437         bool first;
438 
439         fprintf(out_file, ",\n%*s\"Subsections\": [\n", indent, "");
440         first = true;
441         while (*subsection != NULL) {
442             if (!first) {
443                 fprintf(out_file, ",\n");
444             }
445             dump_vmstate_vmss(out_file, subsection, indent + 2);
446             subsection++;
447             first = false;
448         }
449         fprintf(out_file, "\n%*s]", indent, "");
450     }
451     fprintf(out_file, "\n%*s}", indent - 2, "");
452 }
453 
454 static void dump_machine_type(FILE *out_file)
455 {
456     MachineClass *mc;
457 
458     mc = MACHINE_GET_CLASS(current_machine);
459 
460     fprintf(out_file, "  \"vmschkmachine\": {\n");
461     fprintf(out_file, "    \"Name\": \"%s\"\n", mc->name);
462     fprintf(out_file, "  },\n");
463 }
464 
465 void dump_vmstate_json_to_file(FILE *out_file)
466 {
467     GSList *list, *elt;
468     bool first;
469 
470     fprintf(out_file, "{\n");
471     dump_machine_type(out_file);
472 
473     first = true;
474     list = object_class_get_list(TYPE_DEVICE, true);
475     for (elt = list; elt; elt = elt->next) {
476         DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, elt->data,
477                                              TYPE_DEVICE);
478         const char *name;
479         int indent = 2;
480 
481         if (!dc->vmsd) {
482             continue;
483         }
484 
485         if (!first) {
486             fprintf(out_file, ",\n");
487         }
488         name = object_class_get_name(OBJECT_CLASS(dc));
489         fprintf(out_file, "%*s\"%s\": {\n", indent, "", name);
490         indent += 2;
491         fprintf(out_file, "%*s\"Name\": \"%s\",\n", indent, "", name);
492         fprintf(out_file, "%*s\"version_id\": %d,\n", indent, "",
493                 dc->vmsd->version_id);
494         fprintf(out_file, "%*s\"minimum_version_id\": %d,\n", indent, "",
495                 dc->vmsd->minimum_version_id);
496 
497         dump_vmstate_vmsd(out_file, dc->vmsd, indent, false);
498 
499         fprintf(out_file, "\n%*s}", indent - 2, "");
500         first = false;
501     }
502     fprintf(out_file, "\n}\n");
503     fclose(out_file);
504 }
505 
506 static int calculate_new_instance_id(const char *idstr)
507 {
508     SaveStateEntry *se;
509     int instance_id = 0;
510 
511     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
512         if (strcmp(idstr, se->idstr) == 0
513             && instance_id <= se->instance_id) {
514             instance_id = se->instance_id + 1;
515         }
516     }
517     return instance_id;
518 }
519 
520 static int calculate_compat_instance_id(const char *idstr)
521 {
522     SaveStateEntry *se;
523     int instance_id = 0;
524 
525     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
526         if (!se->compat) {
527             continue;
528         }
529 
530         if (strcmp(idstr, se->compat->idstr) == 0
531             && instance_id <= se->compat->instance_id) {
532             instance_id = se->compat->instance_id + 1;
533         }
534     }
535     return instance_id;
536 }
537 
538 static inline MigrationPriority save_state_priority(SaveStateEntry *se)
539 {
540     if (se->vmsd) {
541         return se->vmsd->priority;
542     }
543     return MIG_PRI_DEFAULT;
544 }
545 
546 static void savevm_state_handler_insert(SaveStateEntry *nse)
547 {
548     MigrationPriority priority = save_state_priority(nse);
549     SaveStateEntry *se;
550 
551     assert(priority <= MIG_PRI_MAX);
552 
553     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
554         if (save_state_priority(se) < priority) {
555             break;
556         }
557     }
558 
559     if (se) {
560         QTAILQ_INSERT_BEFORE(se, nse, entry);
561     } else {
562         QTAILQ_INSERT_TAIL(&savevm_state.handlers, nse, entry);
563     }
564 }
565 
566 /* TODO: Individual devices generally have very little idea about the rest
567    of the system, so instance_id should be removed/replaced.
568    Meanwhile pass -1 as instance_id if you do not already have a clearly
569    distinguishing id for all instances of your device class. */
570 int register_savevm_live(DeviceState *dev,
571                          const char *idstr,
572                          int instance_id,
573                          int version_id,
574                          SaveVMHandlers *ops,
575                          void *opaque)
576 {
577     SaveStateEntry *se;
578 
579     se = g_new0(SaveStateEntry, 1);
580     se->version_id = version_id;
581     se->section_id = savevm_state.global_section_id++;
582     se->ops = ops;
583     se->opaque = opaque;
584     se->vmsd = NULL;
585     /* if this is a live_savem then set is_ram */
586     if (ops->save_live_setup != NULL) {
587         se->is_ram = 1;
588     }
589 
590     if (dev) {
591         char *id = qdev_get_dev_path(dev);
592         if (id) {
593             pstrcpy(se->idstr, sizeof(se->idstr), id);
594             pstrcat(se->idstr, sizeof(se->idstr), "/");
595             g_free(id);
596 
597             se->compat = g_new0(CompatEntry, 1);
598             pstrcpy(se->compat->idstr, sizeof(se->compat->idstr), idstr);
599             se->compat->instance_id = instance_id == -1 ?
600                          calculate_compat_instance_id(idstr) : instance_id;
601             instance_id = -1;
602         }
603     }
604     pstrcat(se->idstr, sizeof(se->idstr), idstr);
605 
606     if (instance_id == -1) {
607         se->instance_id = calculate_new_instance_id(se->idstr);
608     } else {
609         se->instance_id = instance_id;
610     }
611     assert(!se->compat || se->instance_id == 0);
612     savevm_state_handler_insert(se);
613     return 0;
614 }
615 
616 int register_savevm(DeviceState *dev,
617                     const char *idstr,
618                     int instance_id,
619                     int version_id,
620                     SaveStateHandler *save_state,
621                     LoadStateHandler *load_state,
622                     void *opaque)
623 {
624     SaveVMHandlers *ops = g_new0(SaveVMHandlers, 1);
625     ops->save_state = save_state;
626     ops->load_state = load_state;
627     return register_savevm_live(dev, idstr, instance_id, version_id,
628                                 ops, opaque);
629 }
630 
631 void unregister_savevm(DeviceState *dev, const char *idstr, void *opaque)
632 {
633     SaveStateEntry *se, *new_se;
634     char id[256] = "";
635 
636     if (dev) {
637         char *path = qdev_get_dev_path(dev);
638         if (path) {
639             pstrcpy(id, sizeof(id), path);
640             pstrcat(id, sizeof(id), "/");
641             g_free(path);
642         }
643     }
644     pstrcat(id, sizeof(id), idstr);
645 
646     QTAILQ_FOREACH_SAFE(se, &savevm_state.handlers, entry, new_se) {
647         if (strcmp(se->idstr, id) == 0 && se->opaque == opaque) {
648             QTAILQ_REMOVE(&savevm_state.handlers, se, entry);
649             g_free(se->compat);
650             g_free(se->ops);
651             g_free(se);
652         }
653     }
654 }
655 
656 int vmstate_register_with_alias_id(DeviceState *dev, int instance_id,
657                                    const VMStateDescription *vmsd,
658                                    void *opaque, int alias_id,
659                                    int required_for_version)
660 {
661     SaveStateEntry *se;
662 
663     /* If this triggers, alias support can be dropped for the vmsd. */
664     assert(alias_id == -1 || required_for_version >= vmsd->minimum_version_id);
665 
666     se = g_new0(SaveStateEntry, 1);
667     se->version_id = vmsd->version_id;
668     se->section_id = savevm_state.global_section_id++;
669     se->opaque = opaque;
670     se->vmsd = vmsd;
671     se->alias_id = alias_id;
672 
673     if (dev) {
674         char *id = qdev_get_dev_path(dev);
675         if (id) {
676             pstrcpy(se->idstr, sizeof(se->idstr), id);
677             pstrcat(se->idstr, sizeof(se->idstr), "/");
678             g_free(id);
679 
680             se->compat = g_new0(CompatEntry, 1);
681             pstrcpy(se->compat->idstr, sizeof(se->compat->idstr), vmsd->name);
682             se->compat->instance_id = instance_id == -1 ?
683                          calculate_compat_instance_id(vmsd->name) : instance_id;
684             instance_id = -1;
685         }
686     }
687     pstrcat(se->idstr, sizeof(se->idstr), vmsd->name);
688 
689     if (instance_id == -1) {
690         se->instance_id = calculate_new_instance_id(se->idstr);
691     } else {
692         se->instance_id = instance_id;
693     }
694     assert(!se->compat || se->instance_id == 0);
695     savevm_state_handler_insert(se);
696     return 0;
697 }
698 
699 void vmstate_unregister(DeviceState *dev, const VMStateDescription *vmsd,
700                         void *opaque)
701 {
702     SaveStateEntry *se, *new_se;
703 
704     QTAILQ_FOREACH_SAFE(se, &savevm_state.handlers, entry, new_se) {
705         if (se->vmsd == vmsd && se->opaque == opaque) {
706             QTAILQ_REMOVE(&savevm_state.handlers, se, entry);
707             g_free(se->compat);
708             g_free(se);
709         }
710     }
711 }
712 
713 static int vmstate_load(QEMUFile *f, SaveStateEntry *se, int version_id)
714 {
715     trace_vmstate_load(se->idstr, se->vmsd ? se->vmsd->name : "(old)");
716     if (!se->vmsd) {         /* Old style */
717         return se->ops->load_state(f, se->opaque, version_id);
718     }
719     return vmstate_load_state(f, se->vmsd, se->opaque, version_id);
720 }
721 
722 static void vmstate_save_old_style(QEMUFile *f, SaveStateEntry *se, QJSON *vmdesc)
723 {
724     int64_t old_offset, size;
725 
726     old_offset = qemu_ftell_fast(f);
727     se->ops->save_state(f, se->opaque);
728     size = qemu_ftell_fast(f) - old_offset;
729 
730     if (vmdesc) {
731         json_prop_int(vmdesc, "size", size);
732         json_start_array(vmdesc, "fields");
733         json_start_object(vmdesc, NULL);
734         json_prop_str(vmdesc, "name", "data");
735         json_prop_int(vmdesc, "size", size);
736         json_prop_str(vmdesc, "type", "buffer");
737         json_end_object(vmdesc);
738         json_end_array(vmdesc);
739     }
740 }
741 
742 static void vmstate_save(QEMUFile *f, SaveStateEntry *se, QJSON *vmdesc)
743 {
744     trace_vmstate_save(se->idstr, se->vmsd ? se->vmsd->name : "(old)");
745     if (!se->vmsd) {
746         vmstate_save_old_style(f, se, vmdesc);
747         return;
748     }
749     vmstate_save_state(f, se->vmsd, se->opaque, vmdesc);
750 }
751 
752 void savevm_skip_section_footers(void)
753 {
754     skip_section_footers = true;
755 }
756 
757 /*
758  * Write the header for device section (QEMU_VM_SECTION START/END/PART/FULL)
759  */
760 static void save_section_header(QEMUFile *f, SaveStateEntry *se,
761                                 uint8_t section_type)
762 {
763     qemu_put_byte(f, section_type);
764     qemu_put_be32(f, se->section_id);
765 
766     if (section_type == QEMU_VM_SECTION_FULL ||
767         section_type == QEMU_VM_SECTION_START) {
768         /* ID string */
769         size_t len = strlen(se->idstr);
770         qemu_put_byte(f, len);
771         qemu_put_buffer(f, (uint8_t *)se->idstr, len);
772 
773         qemu_put_be32(f, se->instance_id);
774         qemu_put_be32(f, se->version_id);
775     }
776 }
777 
778 /*
779  * Write a footer onto device sections that catches cases misformatted device
780  * sections.
781  */
782 static void save_section_footer(QEMUFile *f, SaveStateEntry *se)
783 {
784     if (!skip_section_footers) {
785         qemu_put_byte(f, QEMU_VM_SECTION_FOOTER);
786         qemu_put_be32(f, se->section_id);
787     }
788 }
789 
790 /**
791  * qemu_savevm_command_send: Send a 'QEMU_VM_COMMAND' type element with the
792  *                           command and associated data.
793  *
794  * @f: File to send command on
795  * @command: Command type to send
796  * @len: Length of associated data
797  * @data: Data associated with command.
798  */
799 void qemu_savevm_command_send(QEMUFile *f,
800                               enum qemu_vm_cmd command,
801                               uint16_t len,
802                               uint8_t *data)
803 {
804     trace_savevm_command_send(command, len);
805     qemu_put_byte(f, QEMU_VM_COMMAND);
806     qemu_put_be16(f, (uint16_t)command);
807     qemu_put_be16(f, len);
808     qemu_put_buffer(f, data, len);
809     qemu_fflush(f);
810 }
811 
812 void qemu_savevm_send_ping(QEMUFile *f, uint32_t value)
813 {
814     uint32_t buf;
815 
816     trace_savevm_send_ping(value);
817     buf = cpu_to_be32(value);
818     qemu_savevm_command_send(f, MIG_CMD_PING, sizeof(value), (uint8_t *)&buf);
819 }
820 
821 void qemu_savevm_send_open_return_path(QEMUFile *f)
822 {
823     trace_savevm_send_open_return_path();
824     qemu_savevm_command_send(f, MIG_CMD_OPEN_RETURN_PATH, 0, NULL);
825 }
826 
827 /* We have a buffer of data to send; we don't want that all to be loaded
828  * by the command itself, so the command contains just the length of the
829  * extra buffer that we then send straight after it.
830  * TODO: Must be a better way to organise that
831  *
832  * Returns:
833  *    0 on success
834  *    -ve on error
835  */
836 int qemu_savevm_send_packaged(QEMUFile *f, const uint8_t *buf, size_t len)
837 {
838     uint32_t tmp;
839 
840     if (len > MAX_VM_CMD_PACKAGED_SIZE) {
841         error_report("%s: Unreasonably large packaged state: %zu",
842                      __func__, len);
843         return -1;
844     }
845 
846     tmp = cpu_to_be32(len);
847 
848     trace_qemu_savevm_send_packaged();
849     qemu_savevm_command_send(f, MIG_CMD_PACKAGED, 4, (uint8_t *)&tmp);
850 
851     qemu_put_buffer(f, buf, len);
852 
853     return 0;
854 }
855 
856 /* Send prior to any postcopy transfer */
857 void qemu_savevm_send_postcopy_advise(QEMUFile *f)
858 {
859     uint64_t tmp[2];
860     tmp[0] = cpu_to_be64(getpagesize());
861     tmp[1] = cpu_to_be64(1ul << qemu_target_page_bits());
862 
863     trace_qemu_savevm_send_postcopy_advise();
864     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_ADVISE, 16, (uint8_t *)tmp);
865 }
866 
867 /* Sent prior to starting the destination running in postcopy, discard pages
868  * that have already been sent but redirtied on the source.
869  * CMD_POSTCOPY_RAM_DISCARD consist of:
870  *      byte   version (0)
871  *      byte   Length of name field (not including 0)
872  *  n x byte   RAM block name
873  *      byte   0 terminator (just for safety)
874  *  n x        Byte ranges within the named RAMBlock
875  *      be64   Start of the range
876  *      be64   Length
877  *
878  *  name:  RAMBlock name that these entries are part of
879  *  len: Number of page entries
880  *  start_list: 'len' addresses
881  *  length_list: 'len' addresses
882  *
883  */
884 void qemu_savevm_send_postcopy_ram_discard(QEMUFile *f, const char *name,
885                                            uint16_t len,
886                                            uint64_t *start_list,
887                                            uint64_t *length_list)
888 {
889     uint8_t *buf;
890     uint16_t tmplen;
891     uint16_t t;
892     size_t name_len = strlen(name);
893 
894     trace_qemu_savevm_send_postcopy_ram_discard(name, len);
895     assert(name_len < 256);
896     buf = g_malloc0(1 + 1 + name_len + 1 + (8 + 8) * len);
897     buf[0] = postcopy_ram_discard_version;
898     buf[1] = name_len;
899     memcpy(buf + 2, name, name_len);
900     tmplen = 2 + name_len;
901     buf[tmplen++] = '\0';
902 
903     for (t = 0; t < len; t++) {
904         stq_be_p(buf + tmplen, start_list[t]);
905         tmplen += 8;
906         stq_be_p(buf + tmplen, length_list[t]);
907         tmplen += 8;
908     }
909     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_RAM_DISCARD, tmplen, buf);
910     g_free(buf);
911 }
912 
913 /* Get the destination into a state where it can receive postcopy data. */
914 void qemu_savevm_send_postcopy_listen(QEMUFile *f)
915 {
916     trace_savevm_send_postcopy_listen();
917     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_LISTEN, 0, NULL);
918 }
919 
920 /* Kick the destination into running */
921 void qemu_savevm_send_postcopy_run(QEMUFile *f)
922 {
923     trace_savevm_send_postcopy_run();
924     qemu_savevm_command_send(f, MIG_CMD_POSTCOPY_RUN, 0, NULL);
925 }
926 
927 bool qemu_savevm_state_blocked(Error **errp)
928 {
929     SaveStateEntry *se;
930 
931     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
932         if (se->vmsd && se->vmsd->unmigratable) {
933             error_setg(errp, "State blocked by non-migratable device '%s'",
934                        se->idstr);
935             return true;
936         }
937     }
938     return false;
939 }
940 
941 static bool enforce_config_section(void)
942 {
943     MachineState *machine = MACHINE(qdev_get_machine());
944     return machine->enforce_config_section;
945 }
946 
947 void qemu_savevm_state_header(QEMUFile *f)
948 {
949     trace_savevm_state_header();
950     qemu_put_be32(f, QEMU_VM_FILE_MAGIC);
951     qemu_put_be32(f, QEMU_VM_FILE_VERSION);
952 
953     if (!savevm_state.skip_configuration || enforce_config_section()) {
954         qemu_put_byte(f, QEMU_VM_CONFIGURATION);
955         vmstate_save_state(f, &vmstate_configuration, &savevm_state, 0);
956     }
957 
958 }
959 
960 void qemu_savevm_state_begin(QEMUFile *f,
961                              const MigrationParams *params)
962 {
963     SaveStateEntry *se;
964     int ret;
965 
966     trace_savevm_state_begin();
967     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
968         if (!se->ops || !se->ops->set_params) {
969             continue;
970         }
971         se->ops->set_params(params, se->opaque);
972     }
973 
974     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
975         if (!se->ops || !se->ops->save_live_setup) {
976             continue;
977         }
978         if (se->ops && se->ops->is_active) {
979             if (!se->ops->is_active(se->opaque)) {
980                 continue;
981             }
982         }
983         save_section_header(f, se, QEMU_VM_SECTION_START);
984 
985         ret = se->ops->save_live_setup(f, se->opaque);
986         save_section_footer(f, se);
987         if (ret < 0) {
988             qemu_file_set_error(f, ret);
989             break;
990         }
991     }
992 }
993 
994 /*
995  * this function has three return values:
996  *   negative: there was one error, and we have -errno.
997  *   0 : We haven't finished, caller have to go again
998  *   1 : We have finished, we can go to complete phase
999  */
1000 int qemu_savevm_state_iterate(QEMUFile *f, bool postcopy)
1001 {
1002     SaveStateEntry *se;
1003     int ret = 1;
1004 
1005     trace_savevm_state_iterate();
1006     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1007         if (!se->ops || !se->ops->save_live_iterate) {
1008             continue;
1009         }
1010         if (se->ops && se->ops->is_active) {
1011             if (!se->ops->is_active(se->opaque)) {
1012                 continue;
1013             }
1014         }
1015         /*
1016          * In the postcopy phase, any device that doesn't know how to
1017          * do postcopy should have saved it's state in the _complete
1018          * call that's already run, it might get confused if we call
1019          * iterate afterwards.
1020          */
1021         if (postcopy && !se->ops->save_live_complete_postcopy) {
1022             continue;
1023         }
1024         if (qemu_file_rate_limit(f)) {
1025             return 0;
1026         }
1027         trace_savevm_section_start(se->idstr, se->section_id);
1028 
1029         save_section_header(f, se, QEMU_VM_SECTION_PART);
1030 
1031         ret = se->ops->save_live_iterate(f, se->opaque);
1032         trace_savevm_section_end(se->idstr, se->section_id, ret);
1033         save_section_footer(f, se);
1034 
1035         if (ret < 0) {
1036             qemu_file_set_error(f, ret);
1037         }
1038         if (ret <= 0) {
1039             /* Do not proceed to the next vmstate before this one reported
1040                completion of the current stage. This serializes the migration
1041                and reduces the probability that a faster changing state is
1042                synchronized over and over again. */
1043             break;
1044         }
1045     }
1046     return ret;
1047 }
1048 
1049 static bool should_send_vmdesc(void)
1050 {
1051     MachineState *machine = MACHINE(qdev_get_machine());
1052     bool in_postcopy = migration_in_postcopy(migrate_get_current());
1053     return !machine->suppress_vmdesc && !in_postcopy;
1054 }
1055 
1056 /*
1057  * Calls the save_live_complete_postcopy methods
1058  * causing the last few pages to be sent immediately and doing any associated
1059  * cleanup.
1060  * Note postcopy also calls qemu_savevm_state_complete_precopy to complete
1061  * all the other devices, but that happens at the point we switch to postcopy.
1062  */
1063 void qemu_savevm_state_complete_postcopy(QEMUFile *f)
1064 {
1065     SaveStateEntry *se;
1066     int ret;
1067 
1068     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1069         if (!se->ops || !se->ops->save_live_complete_postcopy) {
1070             continue;
1071         }
1072         if (se->ops && se->ops->is_active) {
1073             if (!se->ops->is_active(se->opaque)) {
1074                 continue;
1075             }
1076         }
1077         trace_savevm_section_start(se->idstr, se->section_id);
1078         /* Section type */
1079         qemu_put_byte(f, QEMU_VM_SECTION_END);
1080         qemu_put_be32(f, se->section_id);
1081 
1082         ret = se->ops->save_live_complete_postcopy(f, se->opaque);
1083         trace_savevm_section_end(se->idstr, se->section_id, ret);
1084         save_section_footer(f, se);
1085         if (ret < 0) {
1086             qemu_file_set_error(f, ret);
1087             return;
1088         }
1089     }
1090 
1091     qemu_put_byte(f, QEMU_VM_EOF);
1092     qemu_fflush(f);
1093 }
1094 
1095 void qemu_savevm_state_complete_precopy(QEMUFile *f, bool iterable_only)
1096 {
1097     QJSON *vmdesc;
1098     int vmdesc_len;
1099     SaveStateEntry *se;
1100     int ret;
1101     bool in_postcopy = migration_in_postcopy(migrate_get_current());
1102 
1103     trace_savevm_state_complete_precopy();
1104 
1105     cpu_synchronize_all_states();
1106 
1107     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1108         if (!se->ops ||
1109             (in_postcopy && se->ops->save_live_complete_postcopy) ||
1110             (in_postcopy && !iterable_only) ||
1111             !se->ops->save_live_complete_precopy) {
1112             continue;
1113         }
1114 
1115         if (se->ops && se->ops->is_active) {
1116             if (!se->ops->is_active(se->opaque)) {
1117                 continue;
1118             }
1119         }
1120         trace_savevm_section_start(se->idstr, se->section_id);
1121 
1122         save_section_header(f, se, QEMU_VM_SECTION_END);
1123 
1124         ret = se->ops->save_live_complete_precopy(f, se->opaque);
1125         trace_savevm_section_end(se->idstr, se->section_id, ret);
1126         save_section_footer(f, se);
1127         if (ret < 0) {
1128             qemu_file_set_error(f, ret);
1129             return;
1130         }
1131     }
1132 
1133     if (iterable_only) {
1134         return;
1135     }
1136 
1137     vmdesc = qjson_new();
1138     json_prop_int(vmdesc, "page_size", TARGET_PAGE_SIZE);
1139     json_start_array(vmdesc, "devices");
1140     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1141 
1142         if ((!se->ops || !se->ops->save_state) && !se->vmsd) {
1143             continue;
1144         }
1145         if (se->vmsd && !vmstate_save_needed(se->vmsd, se->opaque)) {
1146             trace_savevm_section_skip(se->idstr, se->section_id);
1147             continue;
1148         }
1149 
1150         trace_savevm_section_start(se->idstr, se->section_id);
1151 
1152         json_start_object(vmdesc, NULL);
1153         json_prop_str(vmdesc, "name", se->idstr);
1154         json_prop_int(vmdesc, "instance_id", se->instance_id);
1155 
1156         save_section_header(f, se, QEMU_VM_SECTION_FULL);
1157         vmstate_save(f, se, vmdesc);
1158         trace_savevm_section_end(se->idstr, se->section_id, 0);
1159         save_section_footer(f, se);
1160 
1161         json_end_object(vmdesc);
1162     }
1163 
1164     if (!in_postcopy) {
1165         /* Postcopy stream will still be going */
1166         qemu_put_byte(f, QEMU_VM_EOF);
1167     }
1168 
1169     json_end_array(vmdesc);
1170     qjson_finish(vmdesc);
1171     vmdesc_len = strlen(qjson_get_str(vmdesc));
1172 
1173     if (should_send_vmdesc()) {
1174         qemu_put_byte(f, QEMU_VM_VMDESCRIPTION);
1175         qemu_put_be32(f, vmdesc_len);
1176         qemu_put_buffer(f, (uint8_t *)qjson_get_str(vmdesc), vmdesc_len);
1177     }
1178     qjson_destroy(vmdesc);
1179 
1180     qemu_fflush(f);
1181 }
1182 
1183 /* Give an estimate of the amount left to be transferred,
1184  * the result is split into the amount for units that can and
1185  * for units that can't do postcopy.
1186  */
1187 void qemu_savevm_state_pending(QEMUFile *f, uint64_t max_size,
1188                                uint64_t *res_non_postcopiable,
1189                                uint64_t *res_postcopiable)
1190 {
1191     SaveStateEntry *se;
1192 
1193     *res_non_postcopiable = 0;
1194     *res_postcopiable = 0;
1195 
1196 
1197     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1198         if (!se->ops || !se->ops->save_live_pending) {
1199             continue;
1200         }
1201         if (se->ops && se->ops->is_active) {
1202             if (!se->ops->is_active(se->opaque)) {
1203                 continue;
1204             }
1205         }
1206         se->ops->save_live_pending(f, se->opaque, max_size,
1207                                    res_non_postcopiable, res_postcopiable);
1208     }
1209 }
1210 
1211 void qemu_savevm_state_cleanup(void)
1212 {
1213     SaveStateEntry *se;
1214 
1215     trace_savevm_state_cleanup();
1216     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1217         if (se->ops && se->ops->cleanup) {
1218             se->ops->cleanup(se->opaque);
1219         }
1220     }
1221 }
1222 
1223 static int qemu_savevm_state(QEMUFile *f, Error **errp)
1224 {
1225     int ret;
1226     MigrationParams params = {
1227         .blk = 0,
1228         .shared = 0
1229     };
1230     MigrationState *ms = migrate_init(&params);
1231     MigrationStatus status;
1232     ms->to_dst_file = f;
1233 
1234     if (migration_is_blocked(errp)) {
1235         ret = -EINVAL;
1236         goto done;
1237     }
1238 
1239     qemu_mutex_unlock_iothread();
1240     qemu_savevm_state_header(f);
1241     qemu_savevm_state_begin(f, &params);
1242     qemu_mutex_lock_iothread();
1243 
1244     while (qemu_file_get_error(f) == 0) {
1245         if (qemu_savevm_state_iterate(f, false) > 0) {
1246             break;
1247         }
1248     }
1249 
1250     ret = qemu_file_get_error(f);
1251     if (ret == 0) {
1252         qemu_savevm_state_complete_precopy(f, false);
1253         ret = qemu_file_get_error(f);
1254     }
1255     qemu_savevm_state_cleanup();
1256     if (ret != 0) {
1257         error_setg_errno(errp, -ret, "Error while writing VM state");
1258     }
1259 
1260 done:
1261     if (ret != 0) {
1262         status = MIGRATION_STATUS_FAILED;
1263     } else {
1264         status = MIGRATION_STATUS_COMPLETED;
1265     }
1266     migrate_set_state(&ms->state, MIGRATION_STATUS_SETUP, status);
1267     return ret;
1268 }
1269 
1270 static int qemu_save_device_state(QEMUFile *f)
1271 {
1272     SaveStateEntry *se;
1273 
1274     qemu_put_be32(f, QEMU_VM_FILE_MAGIC);
1275     qemu_put_be32(f, QEMU_VM_FILE_VERSION);
1276 
1277     cpu_synchronize_all_states();
1278 
1279     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1280         if (se->is_ram) {
1281             continue;
1282         }
1283         if ((!se->ops || !se->ops->save_state) && !se->vmsd) {
1284             continue;
1285         }
1286         if (se->vmsd && !vmstate_save_needed(se->vmsd, se->opaque)) {
1287             continue;
1288         }
1289 
1290         save_section_header(f, se, QEMU_VM_SECTION_FULL);
1291 
1292         vmstate_save(f, se, NULL);
1293 
1294         save_section_footer(f, se);
1295     }
1296 
1297     qemu_put_byte(f, QEMU_VM_EOF);
1298 
1299     return qemu_file_get_error(f);
1300 }
1301 
1302 static SaveStateEntry *find_se(const char *idstr, int instance_id)
1303 {
1304     SaveStateEntry *se;
1305 
1306     QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
1307         if (!strcmp(se->idstr, idstr) &&
1308             (instance_id == se->instance_id ||
1309              instance_id == se->alias_id))
1310             return se;
1311         /* Migrating from an older version? */
1312         if (strstr(se->idstr, idstr) && se->compat) {
1313             if (!strcmp(se->compat->idstr, idstr) &&
1314                 (instance_id == se->compat->instance_id ||
1315                  instance_id == se->alias_id))
1316                 return se;
1317         }
1318     }
1319     return NULL;
1320 }
1321 
1322 enum LoadVMExitCodes {
1323     /* Allow a command to quit all layers of nested loadvm loops */
1324     LOADVM_QUIT     =  1,
1325 };
1326 
1327 static int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis);
1328 
1329 /* ------ incoming postcopy messages ------ */
1330 /* 'advise' arrives before any transfers just to tell us that a postcopy
1331  * *might* happen - it might be skipped if precopy transferred everything
1332  * quickly.
1333  */
1334 static int loadvm_postcopy_handle_advise(MigrationIncomingState *mis)
1335 {
1336     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_ADVISE);
1337     uint64_t remote_hps, remote_tps;
1338 
1339     trace_loadvm_postcopy_handle_advise();
1340     if (ps != POSTCOPY_INCOMING_NONE) {
1341         error_report("CMD_POSTCOPY_ADVISE in wrong postcopy state (%d)", ps);
1342         return -1;
1343     }
1344 
1345     if (!postcopy_ram_supported_by_host()) {
1346         return -1;
1347     }
1348 
1349     remote_hps = qemu_get_be64(mis->from_src_file);
1350     if (remote_hps != getpagesize())  {
1351         /*
1352          * Some combinations of mismatch are probably possible but it gets
1353          * a bit more complicated.  In particular we need to place whole
1354          * host pages on the dest at once, and we need to ensure that we
1355          * handle dirtying to make sure we never end up sending part of
1356          * a hostpage on it's own.
1357          */
1358         error_report("Postcopy needs matching host page sizes (s=%d d=%d)",
1359                      (int)remote_hps, getpagesize());
1360         return -1;
1361     }
1362 
1363     remote_tps = qemu_get_be64(mis->from_src_file);
1364     if (remote_tps != (1ul << qemu_target_page_bits())) {
1365         /*
1366          * Again, some differences could be dealt with, but for now keep it
1367          * simple.
1368          */
1369         error_report("Postcopy needs matching target page sizes (s=%d d=%d)",
1370                      (int)remote_tps, 1 << qemu_target_page_bits());
1371         return -1;
1372     }
1373 
1374     if (ram_postcopy_incoming_init(mis)) {
1375         return -1;
1376     }
1377 
1378     postcopy_state_set(POSTCOPY_INCOMING_ADVISE);
1379 
1380     return 0;
1381 }
1382 
1383 /* After postcopy we will be told to throw some pages away since they're
1384  * dirty and will have to be demand fetched.  Must happen before CPU is
1385  * started.
1386  * There can be 0..many of these messages, each encoding multiple pages.
1387  */
1388 static int loadvm_postcopy_ram_handle_discard(MigrationIncomingState *mis,
1389                                               uint16_t len)
1390 {
1391     int tmp;
1392     char ramid[256];
1393     PostcopyState ps = postcopy_state_get();
1394 
1395     trace_loadvm_postcopy_ram_handle_discard();
1396 
1397     switch (ps) {
1398     case POSTCOPY_INCOMING_ADVISE:
1399         /* 1st discard */
1400         tmp = postcopy_ram_prepare_discard(mis);
1401         if (tmp) {
1402             return tmp;
1403         }
1404         break;
1405 
1406     case POSTCOPY_INCOMING_DISCARD:
1407         /* Expected state */
1408         break;
1409 
1410     default:
1411         error_report("CMD_POSTCOPY_RAM_DISCARD in wrong postcopy state (%d)",
1412                      ps);
1413         return -1;
1414     }
1415     /* We're expecting a
1416      *    Version (0)
1417      *    a RAM ID string (length byte, name, 0 term)
1418      *    then at least 1 16 byte chunk
1419     */
1420     if (len < (1 + 1 + 1 + 1 + 2 * 8)) {
1421         error_report("CMD_POSTCOPY_RAM_DISCARD invalid length (%d)", len);
1422         return -1;
1423     }
1424 
1425     tmp = qemu_get_byte(mis->from_src_file);
1426     if (tmp != postcopy_ram_discard_version) {
1427         error_report("CMD_POSTCOPY_RAM_DISCARD invalid version (%d)", tmp);
1428         return -1;
1429     }
1430 
1431     if (!qemu_get_counted_string(mis->from_src_file, ramid)) {
1432         error_report("CMD_POSTCOPY_RAM_DISCARD Failed to read RAMBlock ID");
1433         return -1;
1434     }
1435     tmp = qemu_get_byte(mis->from_src_file);
1436     if (tmp != 0) {
1437         error_report("CMD_POSTCOPY_RAM_DISCARD missing nil (%d)", tmp);
1438         return -1;
1439     }
1440 
1441     len -= 3 + strlen(ramid);
1442     if (len % 16) {
1443         error_report("CMD_POSTCOPY_RAM_DISCARD invalid length (%d)", len);
1444         return -1;
1445     }
1446     trace_loadvm_postcopy_ram_handle_discard_header(ramid, len);
1447     while (len) {
1448         uint64_t start_addr, block_length;
1449         start_addr = qemu_get_be64(mis->from_src_file);
1450         block_length = qemu_get_be64(mis->from_src_file);
1451 
1452         len -= 16;
1453         int ret = ram_discard_range(mis, ramid, start_addr,
1454                                     block_length);
1455         if (ret) {
1456             return ret;
1457         }
1458     }
1459     trace_loadvm_postcopy_ram_handle_discard_end();
1460 
1461     return 0;
1462 }
1463 
1464 /*
1465  * Triggered by a postcopy_listen command; this thread takes over reading
1466  * the input stream, leaving the main thread free to carry on loading the rest
1467  * of the device state (from RAM).
1468  * (TODO:This could do with being in a postcopy file - but there again it's
1469  * just another input loop, not that postcopy specific)
1470  */
1471 static void *postcopy_ram_listen_thread(void *opaque)
1472 {
1473     QEMUFile *f = opaque;
1474     MigrationIncomingState *mis = migration_incoming_get_current();
1475     int load_res;
1476 
1477     migrate_set_state(&mis->state, MIGRATION_STATUS_ACTIVE,
1478                                    MIGRATION_STATUS_POSTCOPY_ACTIVE);
1479     qemu_sem_post(&mis->listen_thread_sem);
1480     trace_postcopy_ram_listen_thread_start();
1481 
1482     /*
1483      * Because we're a thread and not a coroutine we can't yield
1484      * in qemu_file, and thus we must be blocking now.
1485      */
1486     qemu_file_set_blocking(f, true);
1487     load_res = qemu_loadvm_state_main(f, mis);
1488     /* And non-blocking again so we don't block in any cleanup */
1489     qemu_file_set_blocking(f, false);
1490 
1491     trace_postcopy_ram_listen_thread_exit();
1492     if (load_res < 0) {
1493         error_report("%s: loadvm failed: %d", __func__, load_res);
1494         qemu_file_set_error(f, load_res);
1495         migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
1496                                        MIGRATION_STATUS_FAILED);
1497     } else {
1498         /*
1499          * This looks good, but it's possible that the device loading in the
1500          * main thread hasn't finished yet, and so we might not be in 'RUN'
1501          * state yet; wait for the end of the main thread.
1502          */
1503         qemu_event_wait(&mis->main_thread_load_event);
1504     }
1505     postcopy_ram_incoming_cleanup(mis);
1506 
1507     if (load_res < 0) {
1508         /*
1509          * If something went wrong then we have a bad state so exit;
1510          * depending how far we got it might be possible at this point
1511          * to leave the guest running and fire MCEs for pages that never
1512          * arrived as a desperate recovery step.
1513          */
1514         exit(EXIT_FAILURE);
1515     }
1516 
1517     migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
1518                                    MIGRATION_STATUS_COMPLETED);
1519     /*
1520      * If everything has worked fine, then the main thread has waited
1521      * for us to start, and we're the last use of the mis.
1522      * (If something broke then qemu will have to exit anyway since it's
1523      * got a bad migration state).
1524      */
1525     migration_incoming_state_destroy();
1526 
1527 
1528     return NULL;
1529 }
1530 
1531 /* After this message we must be able to immediately receive postcopy data */
1532 static int loadvm_postcopy_handle_listen(MigrationIncomingState *mis)
1533 {
1534     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_LISTENING);
1535     trace_loadvm_postcopy_handle_listen();
1536     if (ps != POSTCOPY_INCOMING_ADVISE && ps != POSTCOPY_INCOMING_DISCARD) {
1537         error_report("CMD_POSTCOPY_LISTEN in wrong postcopy state (%d)", ps);
1538         return -1;
1539     }
1540     if (ps == POSTCOPY_INCOMING_ADVISE) {
1541         /*
1542          * A rare case, we entered listen without having to do any discards,
1543          * so do the setup that's normally done at the time of the 1st discard.
1544          */
1545         postcopy_ram_prepare_discard(mis);
1546     }
1547 
1548     /*
1549      * Sensitise RAM - can now generate requests for blocks that don't exist
1550      * However, at this point the CPU shouldn't be running, and the IO
1551      * shouldn't be doing anything yet so don't actually expect requests
1552      */
1553     if (postcopy_ram_enable_notify(mis)) {
1554         return -1;
1555     }
1556 
1557     if (mis->have_listen_thread) {
1558         error_report("CMD_POSTCOPY_RAM_LISTEN already has a listen thread");
1559         return -1;
1560     }
1561 
1562     mis->have_listen_thread = true;
1563     /* Start up the listening thread and wait for it to signal ready */
1564     qemu_sem_init(&mis->listen_thread_sem, 0);
1565     qemu_thread_create(&mis->listen_thread, "postcopy/listen",
1566                        postcopy_ram_listen_thread, mis->from_src_file,
1567                        QEMU_THREAD_DETACHED);
1568     qemu_sem_wait(&mis->listen_thread_sem);
1569     qemu_sem_destroy(&mis->listen_thread_sem);
1570 
1571     return 0;
1572 }
1573 
1574 
1575 typedef struct {
1576     QEMUBH *bh;
1577 } HandleRunBhData;
1578 
1579 static void loadvm_postcopy_handle_run_bh(void *opaque)
1580 {
1581     Error *local_err = NULL;
1582     HandleRunBhData *data = opaque;
1583 
1584     /* TODO we should move all of this lot into postcopy_ram.c or a shared code
1585      * in migration.c
1586      */
1587     cpu_synchronize_all_post_init();
1588 
1589     qemu_announce_self();
1590 
1591     /* Make sure all file formats flush their mutable metadata */
1592     bdrv_invalidate_cache_all(&local_err);
1593     if (local_err) {
1594         error_report_err(local_err);
1595     }
1596 
1597     trace_loadvm_postcopy_handle_run_cpu_sync();
1598     cpu_synchronize_all_post_init();
1599 
1600     trace_loadvm_postcopy_handle_run_vmstart();
1601 
1602     if (autostart) {
1603         /* Hold onto your hats, starting the CPU */
1604         vm_start();
1605     } else {
1606         /* leave it paused and let management decide when to start the CPU */
1607         runstate_set(RUN_STATE_PAUSED);
1608     }
1609 
1610     qemu_bh_delete(data->bh);
1611     g_free(data);
1612 }
1613 
1614 /* After all discards we can start running and asking for pages */
1615 static int loadvm_postcopy_handle_run(MigrationIncomingState *mis)
1616 {
1617     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_RUNNING);
1618     HandleRunBhData *data;
1619 
1620     trace_loadvm_postcopy_handle_run();
1621     if (ps != POSTCOPY_INCOMING_LISTENING) {
1622         error_report("CMD_POSTCOPY_RUN in wrong postcopy state (%d)", ps);
1623         return -1;
1624     }
1625 
1626     data = g_new(HandleRunBhData, 1);
1627     data->bh = qemu_bh_new(loadvm_postcopy_handle_run_bh, data);
1628     qemu_bh_schedule(data->bh);
1629 
1630     /* We need to finish reading the stream from the package
1631      * and also stop reading anything more from the stream that loaded the
1632      * package (since it's now being read by the listener thread).
1633      * LOADVM_QUIT will quit all the layers of nested loadvm loops.
1634      */
1635     return LOADVM_QUIT;
1636 }
1637 
1638 /**
1639  * Immediately following this command is a blob of data containing an embedded
1640  * chunk of migration stream; read it and load it.
1641  *
1642  * @mis: Incoming state
1643  * @length: Length of packaged data to read
1644  *
1645  * Returns: Negative values on error
1646  *
1647  */
1648 static int loadvm_handle_cmd_packaged(MigrationIncomingState *mis)
1649 {
1650     int ret;
1651     size_t length;
1652     QIOChannelBuffer *bioc;
1653 
1654     length = qemu_get_be32(mis->from_src_file);
1655     trace_loadvm_handle_cmd_packaged(length);
1656 
1657     if (length > MAX_VM_CMD_PACKAGED_SIZE) {
1658         error_report("Unreasonably large packaged state: %zu", length);
1659         return -1;
1660     }
1661 
1662     bioc = qio_channel_buffer_new(length);
1663     qio_channel_set_name(QIO_CHANNEL(bioc), "migration-loadvm-buffer");
1664     ret = qemu_get_buffer(mis->from_src_file,
1665                           bioc->data,
1666                           length);
1667     if (ret != length) {
1668         object_unref(OBJECT(bioc));
1669         error_report("CMD_PACKAGED: Buffer receive fail ret=%d length=%zu",
1670                      ret, length);
1671         return (ret < 0) ? ret : -EAGAIN;
1672     }
1673     bioc->usage += length;
1674     trace_loadvm_handle_cmd_packaged_received(ret);
1675 
1676     QEMUFile *packf = qemu_fopen_channel_input(QIO_CHANNEL(bioc));
1677 
1678     ret = qemu_loadvm_state_main(packf, mis);
1679     trace_loadvm_handle_cmd_packaged_main(ret);
1680     qemu_fclose(packf);
1681     object_unref(OBJECT(bioc));
1682 
1683     return ret;
1684 }
1685 
1686 /*
1687  * Process an incoming 'QEMU_VM_COMMAND'
1688  * 0           just a normal return
1689  * LOADVM_QUIT All good, but exit the loop
1690  * <0          Error
1691  */
1692 static int loadvm_process_command(QEMUFile *f)
1693 {
1694     MigrationIncomingState *mis = migration_incoming_get_current();
1695     uint16_t cmd;
1696     uint16_t len;
1697     uint32_t tmp32;
1698 
1699     cmd = qemu_get_be16(f);
1700     len = qemu_get_be16(f);
1701 
1702     trace_loadvm_process_command(cmd, len);
1703     if (cmd >= MIG_CMD_MAX || cmd == MIG_CMD_INVALID) {
1704         error_report("MIG_CMD 0x%x unknown (len 0x%x)", cmd, len);
1705         return -EINVAL;
1706     }
1707 
1708     if (mig_cmd_args[cmd].len != -1 && mig_cmd_args[cmd].len != len) {
1709         error_report("%s received with bad length - expecting %zu, got %d",
1710                      mig_cmd_args[cmd].name,
1711                      (size_t)mig_cmd_args[cmd].len, len);
1712         return -ERANGE;
1713     }
1714 
1715     switch (cmd) {
1716     case MIG_CMD_OPEN_RETURN_PATH:
1717         if (mis->to_src_file) {
1718             error_report("CMD_OPEN_RETURN_PATH called when RP already open");
1719             /* Not really a problem, so don't give up */
1720             return 0;
1721         }
1722         mis->to_src_file = qemu_file_get_return_path(f);
1723         if (!mis->to_src_file) {
1724             error_report("CMD_OPEN_RETURN_PATH failed");
1725             return -1;
1726         }
1727         break;
1728 
1729     case MIG_CMD_PING:
1730         tmp32 = qemu_get_be32(f);
1731         trace_loadvm_process_command_ping(tmp32);
1732         if (!mis->to_src_file) {
1733             error_report("CMD_PING (0x%x) received with no return path",
1734                          tmp32);
1735             return -1;
1736         }
1737         migrate_send_rp_pong(mis, tmp32);
1738         break;
1739 
1740     case MIG_CMD_PACKAGED:
1741         return loadvm_handle_cmd_packaged(mis);
1742 
1743     case MIG_CMD_POSTCOPY_ADVISE:
1744         return loadvm_postcopy_handle_advise(mis);
1745 
1746     case MIG_CMD_POSTCOPY_LISTEN:
1747         return loadvm_postcopy_handle_listen(mis);
1748 
1749     case MIG_CMD_POSTCOPY_RUN:
1750         return loadvm_postcopy_handle_run(mis);
1751 
1752     case MIG_CMD_POSTCOPY_RAM_DISCARD:
1753         return loadvm_postcopy_ram_handle_discard(mis, len);
1754     }
1755 
1756     return 0;
1757 }
1758 
1759 struct LoadStateEntry {
1760     QLIST_ENTRY(LoadStateEntry) entry;
1761     SaveStateEntry *se;
1762     int section_id;
1763     int version_id;
1764 };
1765 
1766 /*
1767  * Read a footer off the wire and check that it matches the expected section
1768  *
1769  * Returns: true if the footer was good
1770  *          false if there is a problem (and calls error_report to say why)
1771  */
1772 static bool check_section_footer(QEMUFile *f, LoadStateEntry *le)
1773 {
1774     uint8_t read_mark;
1775     uint32_t read_section_id;
1776 
1777     if (skip_section_footers) {
1778         /* No footer to check */
1779         return true;
1780     }
1781 
1782     read_mark = qemu_get_byte(f);
1783 
1784     if (read_mark != QEMU_VM_SECTION_FOOTER) {
1785         error_report("Missing section footer for %s", le->se->idstr);
1786         return false;
1787     }
1788 
1789     read_section_id = qemu_get_be32(f);
1790     if (read_section_id != le->section_id) {
1791         error_report("Mismatched section id in footer for %s -"
1792                      " read 0x%x expected 0x%x",
1793                      le->se->idstr, read_section_id, le->section_id);
1794         return false;
1795     }
1796 
1797     /* All good */
1798     return true;
1799 }
1800 
1801 void loadvm_free_handlers(MigrationIncomingState *mis)
1802 {
1803     LoadStateEntry *le, *new_le;
1804 
1805     QLIST_FOREACH_SAFE(le, &mis->loadvm_handlers, entry, new_le) {
1806         QLIST_REMOVE(le, entry);
1807         g_free(le);
1808     }
1809 }
1810 
1811 static int
1812 qemu_loadvm_section_start_full(QEMUFile *f, MigrationIncomingState *mis)
1813 {
1814     uint32_t instance_id, version_id, section_id;
1815     SaveStateEntry *se;
1816     LoadStateEntry *le;
1817     char idstr[256];
1818     int ret;
1819 
1820     /* Read section start */
1821     section_id = qemu_get_be32(f);
1822     if (!qemu_get_counted_string(f, idstr)) {
1823         error_report("Unable to read ID string for section %u",
1824                      section_id);
1825         return -EINVAL;
1826     }
1827     instance_id = qemu_get_be32(f);
1828     version_id = qemu_get_be32(f);
1829 
1830     trace_qemu_loadvm_state_section_startfull(section_id, idstr,
1831             instance_id, version_id);
1832     /* Find savevm section */
1833     se = find_se(idstr, instance_id);
1834     if (se == NULL) {
1835         error_report("Unknown savevm section or instance '%s' %d",
1836                      idstr, instance_id);
1837         return -EINVAL;
1838     }
1839 
1840     /* Validate version */
1841     if (version_id > se->version_id) {
1842         error_report("savevm: unsupported version %d for '%s' v%d",
1843                      version_id, idstr, se->version_id);
1844         return -EINVAL;
1845     }
1846 
1847     /* Validate if it is a device's state */
1848     if (xen_enabled() && se->is_ram) {
1849         error_report("loadvm: %s RAM loading not allowed on Xen", idstr);
1850         return -EINVAL;
1851     }
1852 
1853     /* Add entry */
1854     le = g_malloc0(sizeof(*le));
1855 
1856     le->se = se;
1857     le->section_id = section_id;
1858     le->version_id = version_id;
1859     QLIST_INSERT_HEAD(&mis->loadvm_handlers, le, entry);
1860 
1861     ret = vmstate_load(f, le->se, le->version_id);
1862     if (ret < 0) {
1863         error_report("error while loading state for instance 0x%x of"
1864                      " device '%s'", instance_id, idstr);
1865         return ret;
1866     }
1867     if (!check_section_footer(f, le)) {
1868         return -EINVAL;
1869     }
1870 
1871     return 0;
1872 }
1873 
1874 static int
1875 qemu_loadvm_section_part_end(QEMUFile *f, MigrationIncomingState *mis)
1876 {
1877     uint32_t section_id;
1878     LoadStateEntry *le;
1879     int ret;
1880 
1881     section_id = qemu_get_be32(f);
1882 
1883     trace_qemu_loadvm_state_section_partend(section_id);
1884     QLIST_FOREACH(le, &mis->loadvm_handlers, entry) {
1885         if (le->section_id == section_id) {
1886             break;
1887         }
1888     }
1889     if (le == NULL) {
1890         error_report("Unknown savevm section %d", section_id);
1891         return -EINVAL;
1892     }
1893 
1894     ret = vmstate_load(f, le->se, le->version_id);
1895     if (ret < 0) {
1896         error_report("error while loading state section id %d(%s)",
1897                      section_id, le->se->idstr);
1898         return ret;
1899     }
1900     if (!check_section_footer(f, le)) {
1901         return -EINVAL;
1902     }
1903 
1904     return 0;
1905 }
1906 
1907 static int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis)
1908 {
1909     uint8_t section_type;
1910     int ret = 0;
1911 
1912     while ((section_type = qemu_get_byte(f)) != QEMU_VM_EOF) {
1913         ret = 0;
1914         trace_qemu_loadvm_state_section(section_type);
1915         switch (section_type) {
1916         case QEMU_VM_SECTION_START:
1917         case QEMU_VM_SECTION_FULL:
1918             ret = qemu_loadvm_section_start_full(f, mis);
1919             if (ret < 0) {
1920                 goto out;
1921             }
1922             break;
1923         case QEMU_VM_SECTION_PART:
1924         case QEMU_VM_SECTION_END:
1925             ret = qemu_loadvm_section_part_end(f, mis);
1926             if (ret < 0) {
1927                 goto out;
1928             }
1929             break;
1930         case QEMU_VM_COMMAND:
1931             ret = loadvm_process_command(f);
1932             trace_qemu_loadvm_state_section_command(ret);
1933             if ((ret < 0) || (ret & LOADVM_QUIT)) {
1934                 goto out;
1935             }
1936             break;
1937         default:
1938             error_report("Unknown savevm section type %d", section_type);
1939             ret = -EINVAL;
1940             goto out;
1941         }
1942     }
1943 
1944 out:
1945     if (ret < 0) {
1946         qemu_file_set_error(f, ret);
1947     }
1948     return ret;
1949 }
1950 
1951 int qemu_loadvm_state(QEMUFile *f)
1952 {
1953     MigrationIncomingState *mis = migration_incoming_get_current();
1954     Error *local_err = NULL;
1955     unsigned int v;
1956     int ret;
1957 
1958     if (qemu_savevm_state_blocked(&local_err)) {
1959         error_report_err(local_err);
1960         return -EINVAL;
1961     }
1962 
1963     v = qemu_get_be32(f);
1964     if (v != QEMU_VM_FILE_MAGIC) {
1965         error_report("Not a migration stream");
1966         return -EINVAL;
1967     }
1968 
1969     v = qemu_get_be32(f);
1970     if (v == QEMU_VM_FILE_VERSION_COMPAT) {
1971         error_report("SaveVM v2 format is obsolete and don't work anymore");
1972         return -ENOTSUP;
1973     }
1974     if (v != QEMU_VM_FILE_VERSION) {
1975         error_report("Unsupported migration stream version");
1976         return -ENOTSUP;
1977     }
1978 
1979     if (!savevm_state.skip_configuration || enforce_config_section()) {
1980         if (qemu_get_byte(f) != QEMU_VM_CONFIGURATION) {
1981             error_report("Configuration section missing");
1982             return -EINVAL;
1983         }
1984         ret = vmstate_load_state(f, &vmstate_configuration, &savevm_state, 0);
1985 
1986         if (ret) {
1987             return ret;
1988         }
1989     }
1990 
1991     ret = qemu_loadvm_state_main(f, mis);
1992     qemu_event_set(&mis->main_thread_load_event);
1993 
1994     trace_qemu_loadvm_state_post_main(ret);
1995 
1996     if (mis->have_listen_thread) {
1997         /* Listen thread still going, can't clean up yet */
1998         return ret;
1999     }
2000 
2001     if (ret == 0) {
2002         ret = qemu_file_get_error(f);
2003     }
2004 
2005     /*
2006      * Try to read in the VMDESC section as well, so that dumping tools that
2007      * intercept our migration stream have the chance to see it.
2008      */
2009 
2010     /* We've got to be careful; if we don't read the data and just shut the fd
2011      * then the sender can error if we close while it's still sending.
2012      * We also mustn't read data that isn't there; some transports (RDMA)
2013      * will stall waiting for that data when the source has already closed.
2014      */
2015     if (ret == 0 && should_send_vmdesc()) {
2016         uint8_t *buf;
2017         uint32_t size;
2018         uint8_t  section_type = qemu_get_byte(f);
2019 
2020         if (section_type != QEMU_VM_VMDESCRIPTION) {
2021             error_report("Expected vmdescription section, but got %d",
2022                          section_type);
2023             /*
2024              * It doesn't seem worth failing at this point since
2025              * we apparently have an otherwise valid VM state
2026              */
2027         } else {
2028             buf = g_malloc(0x1000);
2029             size = qemu_get_be32(f);
2030 
2031             while (size > 0) {
2032                 uint32_t read_chunk = MIN(size, 0x1000);
2033                 qemu_get_buffer(f, buf, read_chunk);
2034                 size -= read_chunk;
2035             }
2036             g_free(buf);
2037         }
2038     }
2039 
2040     cpu_synchronize_all_post_init();
2041 
2042     return ret;
2043 }
2044 
2045 void hmp_savevm(Monitor *mon, const QDict *qdict)
2046 {
2047     BlockDriverState *bs, *bs1;
2048     QEMUSnapshotInfo sn1, *sn = &sn1, old_sn1, *old_sn = &old_sn1;
2049     int ret;
2050     QEMUFile *f;
2051     int saved_vm_running;
2052     uint64_t vm_state_size;
2053     qemu_timeval tv;
2054     struct tm tm;
2055     const char *name = qdict_get_try_str(qdict, "name");
2056     Error *local_err = NULL;
2057     AioContext *aio_context;
2058 
2059     if (!bdrv_all_can_snapshot(&bs)) {
2060         monitor_printf(mon, "Device '%s' is writable but does not "
2061                        "support snapshots.\n", bdrv_get_device_name(bs));
2062         return;
2063     }
2064 
2065     /* Delete old snapshots of the same name */
2066     if (name && bdrv_all_delete_snapshot(name, &bs1, &local_err) < 0) {
2067         error_reportf_err(local_err,
2068                           "Error while deleting snapshot on device '%s': ",
2069                           bdrv_get_device_name(bs1));
2070         return;
2071     }
2072 
2073     bs = bdrv_all_find_vmstate_bs();
2074     if (bs == NULL) {
2075         monitor_printf(mon, "No block device can accept snapshots\n");
2076         return;
2077     }
2078     aio_context = bdrv_get_aio_context(bs);
2079 
2080     saved_vm_running = runstate_is_running();
2081 
2082     ret = global_state_store();
2083     if (ret) {
2084         monitor_printf(mon, "Error saving global state\n");
2085         return;
2086     }
2087     vm_stop(RUN_STATE_SAVE_VM);
2088 
2089     aio_context_acquire(aio_context);
2090 
2091     memset(sn, 0, sizeof(*sn));
2092 
2093     /* fill auxiliary fields */
2094     qemu_gettimeofday(&tv);
2095     sn->date_sec = tv.tv_sec;
2096     sn->date_nsec = tv.tv_usec * 1000;
2097     sn->vm_clock_nsec = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
2098 
2099     if (name) {
2100         ret = bdrv_snapshot_find(bs, old_sn, name);
2101         if (ret >= 0) {
2102             pstrcpy(sn->name, sizeof(sn->name), old_sn->name);
2103             pstrcpy(sn->id_str, sizeof(sn->id_str), old_sn->id_str);
2104         } else {
2105             pstrcpy(sn->name, sizeof(sn->name), name);
2106         }
2107     } else {
2108         /* cast below needed for OpenBSD where tv_sec is still 'long' */
2109         localtime_r((const time_t *)&tv.tv_sec, &tm);
2110         strftime(sn->name, sizeof(sn->name), "vm-%Y%m%d%H%M%S", &tm);
2111     }
2112 
2113     /* save the VM state */
2114     f = qemu_fopen_bdrv(bs, 1);
2115     if (!f) {
2116         monitor_printf(mon, "Could not open VM state file\n");
2117         goto the_end;
2118     }
2119     ret = qemu_savevm_state(f, &local_err);
2120     vm_state_size = qemu_ftell(f);
2121     qemu_fclose(f);
2122     if (ret < 0) {
2123         error_report_err(local_err);
2124         goto the_end;
2125     }
2126 
2127     ret = bdrv_all_create_snapshot(sn, bs, vm_state_size, &bs);
2128     if (ret < 0) {
2129         monitor_printf(mon, "Error while creating snapshot on '%s'\n",
2130                        bdrv_get_device_name(bs));
2131     }
2132 
2133  the_end:
2134     aio_context_release(aio_context);
2135     if (saved_vm_running) {
2136         vm_start();
2137     }
2138 }
2139 
2140 void qmp_xen_save_devices_state(const char *filename, Error **errp)
2141 {
2142     QEMUFile *f;
2143     QIOChannelFile *ioc;
2144     int saved_vm_running;
2145     int ret;
2146 
2147     saved_vm_running = runstate_is_running();
2148     vm_stop(RUN_STATE_SAVE_VM);
2149     global_state_store_running();
2150 
2151     ioc = qio_channel_file_new_path(filename, O_WRONLY | O_CREAT, 0660, errp);
2152     if (!ioc) {
2153         goto the_end;
2154     }
2155     qio_channel_set_name(QIO_CHANNEL(ioc), "migration-xen-save-state");
2156     f = qemu_fopen_channel_output(QIO_CHANNEL(ioc));
2157     ret = qemu_save_device_state(f);
2158     qemu_fclose(f);
2159     if (ret < 0) {
2160         error_setg(errp, QERR_IO_ERROR);
2161     }
2162 
2163  the_end:
2164     if (saved_vm_running) {
2165         vm_start();
2166     }
2167 }
2168 
2169 void qmp_xen_load_devices_state(const char *filename, Error **errp)
2170 {
2171     QEMUFile *f;
2172     QIOChannelFile *ioc;
2173     int ret;
2174 
2175     /* Guest must be paused before loading the device state; the RAM state
2176      * will already have been loaded by xc
2177      */
2178     if (runstate_is_running()) {
2179         error_setg(errp, "Cannot update device state while vm is running");
2180         return;
2181     }
2182     vm_stop(RUN_STATE_RESTORE_VM);
2183 
2184     ioc = qio_channel_file_new_path(filename, O_RDONLY | O_BINARY, 0, errp);
2185     if (!ioc) {
2186         return;
2187     }
2188     qio_channel_set_name(QIO_CHANNEL(ioc), "migration-xen-load-state");
2189     f = qemu_fopen_channel_input(QIO_CHANNEL(ioc));
2190 
2191     migration_incoming_state_new(f);
2192     ret = qemu_loadvm_state(f);
2193     qemu_fclose(f);
2194     if (ret < 0) {
2195         error_setg(errp, QERR_IO_ERROR);
2196     }
2197     migration_incoming_state_destroy();
2198 }
2199 
2200 int load_vmstate(const char *name)
2201 {
2202     BlockDriverState *bs, *bs_vm_state;
2203     QEMUSnapshotInfo sn;
2204     QEMUFile *f;
2205     int ret;
2206     AioContext *aio_context;
2207 
2208     if (!bdrv_all_can_snapshot(&bs)) {
2209         error_report("Device '%s' is writable but does not support snapshots.",
2210                      bdrv_get_device_name(bs));
2211         return -ENOTSUP;
2212     }
2213     ret = bdrv_all_find_snapshot(name, &bs);
2214     if (ret < 0) {
2215         error_report("Device '%s' does not have the requested snapshot '%s'",
2216                      bdrv_get_device_name(bs), name);
2217         return ret;
2218     }
2219 
2220     bs_vm_state = bdrv_all_find_vmstate_bs();
2221     if (!bs_vm_state) {
2222         error_report("No block device supports snapshots");
2223         return -ENOTSUP;
2224     }
2225     aio_context = bdrv_get_aio_context(bs_vm_state);
2226 
2227     /* Don't even try to load empty VM states */
2228     aio_context_acquire(aio_context);
2229     ret = bdrv_snapshot_find(bs_vm_state, &sn, name);
2230     aio_context_release(aio_context);
2231     if (ret < 0) {
2232         return ret;
2233     } else if (sn.vm_state_size == 0) {
2234         error_report("This is a disk-only snapshot. Revert to it offline "
2235             "using qemu-img.");
2236         return -EINVAL;
2237     }
2238 
2239     /* Flush all IO requests so they don't interfere with the new state.  */
2240     bdrv_drain_all();
2241 
2242     ret = bdrv_all_goto_snapshot(name, &bs);
2243     if (ret < 0) {
2244         error_report("Error %d while activating snapshot '%s' on '%s'",
2245                      ret, name, bdrv_get_device_name(bs));
2246         return ret;
2247     }
2248 
2249     /* restore the VM state */
2250     f = qemu_fopen_bdrv(bs_vm_state, 0);
2251     if (!f) {
2252         error_report("Could not open VM state file");
2253         return -EINVAL;
2254     }
2255 
2256     qemu_system_reset(VMRESET_SILENT);
2257     migration_incoming_state_new(f);
2258 
2259     aio_context_acquire(aio_context);
2260     ret = qemu_loadvm_state(f);
2261     qemu_fclose(f);
2262     aio_context_release(aio_context);
2263 
2264     migration_incoming_state_destroy();
2265     if (ret < 0) {
2266         error_report("Error %d while loading VM state", ret);
2267         return ret;
2268     }
2269 
2270     return 0;
2271 }
2272 
2273 void hmp_delvm(Monitor *mon, const QDict *qdict)
2274 {
2275     BlockDriverState *bs;
2276     Error *err;
2277     const char *name = qdict_get_str(qdict, "name");
2278 
2279     if (bdrv_all_delete_snapshot(name, &bs, &err) < 0) {
2280         error_reportf_err(err,
2281                           "Error while deleting snapshot on device '%s': ",
2282                           bdrv_get_device_name(bs));
2283     }
2284 }
2285 
2286 void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
2287 {
2288     BlockDriverState *bs, *bs1;
2289     BdrvNextIterator it1;
2290     QEMUSnapshotInfo *sn_tab, *sn;
2291     bool no_snapshot = true;
2292     int nb_sns, i;
2293     int total;
2294     int *global_snapshots;
2295     AioContext *aio_context;
2296 
2297     typedef struct SnapshotEntry {
2298         QEMUSnapshotInfo sn;
2299         QTAILQ_ENTRY(SnapshotEntry) next;
2300     } SnapshotEntry;
2301 
2302     typedef struct ImageEntry {
2303         const char *imagename;
2304         QTAILQ_ENTRY(ImageEntry) next;
2305         QTAILQ_HEAD(, SnapshotEntry) snapshots;
2306     } ImageEntry;
2307 
2308     QTAILQ_HEAD(, ImageEntry) image_list =
2309         QTAILQ_HEAD_INITIALIZER(image_list);
2310 
2311     ImageEntry *image_entry, *next_ie;
2312     SnapshotEntry *snapshot_entry;
2313 
2314     bs = bdrv_all_find_vmstate_bs();
2315     if (!bs) {
2316         monitor_printf(mon, "No available block device supports snapshots\n");
2317         return;
2318     }
2319     aio_context = bdrv_get_aio_context(bs);
2320 
2321     aio_context_acquire(aio_context);
2322     nb_sns = bdrv_snapshot_list(bs, &sn_tab);
2323     aio_context_release(aio_context);
2324 
2325     if (nb_sns < 0) {
2326         monitor_printf(mon, "bdrv_snapshot_list: error %d\n", nb_sns);
2327         return;
2328     }
2329 
2330     for (bs1 = bdrv_first(&it1); bs1; bs1 = bdrv_next(&it1)) {
2331         int bs1_nb_sns = 0;
2332         ImageEntry *ie;
2333         SnapshotEntry *se;
2334         AioContext *ctx = bdrv_get_aio_context(bs1);
2335 
2336         aio_context_acquire(ctx);
2337         if (bdrv_can_snapshot(bs1)) {
2338             sn = NULL;
2339             bs1_nb_sns = bdrv_snapshot_list(bs1, &sn);
2340             if (bs1_nb_sns > 0) {
2341                 no_snapshot = false;
2342                 ie = g_new0(ImageEntry, 1);
2343                 ie->imagename = bdrv_get_device_name(bs1);
2344                 QTAILQ_INIT(&ie->snapshots);
2345                 QTAILQ_INSERT_TAIL(&image_list, ie, next);
2346                 for (i = 0; i < bs1_nb_sns; i++) {
2347                     se = g_new0(SnapshotEntry, 1);
2348                     se->sn = sn[i];
2349                     QTAILQ_INSERT_TAIL(&ie->snapshots, se, next);
2350                 }
2351             }
2352             g_free(sn);
2353         }
2354         aio_context_release(ctx);
2355     }
2356 
2357     if (no_snapshot) {
2358         monitor_printf(mon, "There is no snapshot available.\n");
2359         return;
2360     }
2361 
2362     global_snapshots = g_new0(int, nb_sns);
2363     total = 0;
2364     for (i = 0; i < nb_sns; i++) {
2365         SnapshotEntry *next_sn;
2366         if (bdrv_all_find_snapshot(sn_tab[i].name, &bs1) == 0) {
2367             global_snapshots[total] = i;
2368             total++;
2369             QTAILQ_FOREACH(image_entry, &image_list, next) {
2370                 QTAILQ_FOREACH_SAFE(snapshot_entry, &image_entry->snapshots,
2371                                     next, next_sn) {
2372                     if (!strcmp(sn_tab[i].name, snapshot_entry->sn.name)) {
2373                         QTAILQ_REMOVE(&image_entry->snapshots, snapshot_entry,
2374                                       next);
2375                         g_free(snapshot_entry);
2376                     }
2377                 }
2378             }
2379         }
2380     }
2381 
2382     monitor_printf(mon, "List of snapshots present on all disks:\n");
2383 
2384     if (total > 0) {
2385         bdrv_snapshot_dump((fprintf_function)monitor_printf, mon, NULL);
2386         monitor_printf(mon, "\n");
2387         for (i = 0; i < total; i++) {
2388             sn = &sn_tab[global_snapshots[i]];
2389             /* The ID is not guaranteed to be the same on all images, so
2390              * overwrite it.
2391              */
2392             pstrcpy(sn->id_str, sizeof(sn->id_str), "--");
2393             bdrv_snapshot_dump((fprintf_function)monitor_printf, mon, sn);
2394             monitor_printf(mon, "\n");
2395         }
2396     } else {
2397         monitor_printf(mon, "None\n");
2398     }
2399 
2400     QTAILQ_FOREACH(image_entry, &image_list, next) {
2401         if (QTAILQ_EMPTY(&image_entry->snapshots)) {
2402             continue;
2403         }
2404         monitor_printf(mon,
2405                        "\nList of partial (non-loadable) snapshots on '%s':\n",
2406                        image_entry->imagename);
2407         bdrv_snapshot_dump((fprintf_function)monitor_printf, mon, NULL);
2408         monitor_printf(mon, "\n");
2409         QTAILQ_FOREACH(snapshot_entry, &image_entry->snapshots, next) {
2410             bdrv_snapshot_dump((fprintf_function)monitor_printf, mon,
2411                                &snapshot_entry->sn);
2412             monitor_printf(mon, "\n");
2413         }
2414     }
2415 
2416     QTAILQ_FOREACH_SAFE(image_entry, &image_list, next, next_ie) {
2417         SnapshotEntry *next_sn;
2418         QTAILQ_FOREACH_SAFE(snapshot_entry, &image_entry->snapshots, next,
2419                             next_sn) {
2420             g_free(snapshot_entry);
2421         }
2422         g_free(image_entry);
2423     }
2424     g_free(sn_tab);
2425     g_free(global_snapshots);
2426 
2427 }
2428 
2429 void vmstate_register_ram(MemoryRegion *mr, DeviceState *dev)
2430 {
2431     qemu_ram_set_idstr(mr->ram_block,
2432                        memory_region_name(mr), dev);
2433 }
2434 
2435 void vmstate_unregister_ram(MemoryRegion *mr, DeviceState *dev)
2436 {
2437     qemu_ram_unset_idstr(mr->ram_block);
2438 }
2439 
2440 void vmstate_register_ram_global(MemoryRegion *mr)
2441 {
2442     vmstate_register_ram(mr, NULL);
2443 }
2444