1/*
2 * QEMU System Emulator
3 *
4 * Copyright (c) 2003-2008 Fabrice Bellard
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24#include <unistd.h>
25#include <fcntl.h>
26#include <signal.h>
27#include <time.h>
28#include <errno.h>
29#include <sys/time.h>
30#include <zlib.h>
31
32/* Needed early for CONFIG_BSD etc. */
33#include "config-host.h"
34
35#ifndef _WIN32
36#include <sys/times.h>
37#include <sys/wait.h>
38#include <termios.h>
39#include <sys/mman.h>
40#include <sys/ioctl.h>
41#include <sys/resource.h>
42#include <sys/socket.h>
43#include <netinet/in.h>
44#include <net/if.h>
45#include <arpa/inet.h>
46#include <dirent.h>
47#include <netdb.h>
48#include <sys/select.h>
49#ifdef CONFIG_BSD
50#include <sys/stat.h>
51#if defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || defined(__DragonFly__)
52#include <libutil.h>
53#else
54#include <util.h>
55#endif
56#ifdef __linux__
57#include <pty.h>
58#include <malloc.h>
59#include <linux/rtc.h>
60#endif
61#endif
62#endif
63
64#ifdef _WIN32
65#include <windows.h>
66#include <malloc.h>
67#include <sys/timeb.h>
68#include <mmsystem.h>
69#define getopt_long_only getopt_long
70#define memalign(align, size) malloc(size)
71#endif
72
73#include "qemu-common.h"
74#include "hw/hw.h"
75#include "net.h"
76#include "monitor.h"
77#include "sysemu.h"
78#include "qemu-timer.h"
79#include "qemu-char.h"
80#include "blockdev.h"
81#include "block.h"
82#include "audio/audio.h"
83#include "migration.h"
84#include "qemu_socket.h"
85#include "qemu-queue.h"
86#include "qemu_file.h"
87#include "android/snapshot.h"
88
89
90#define SELF_ANNOUNCE_ROUNDS 5
91
92#ifndef ETH_P_RARP
93#define ETH_P_RARP 0x8035
94#endif
95#define ARP_HTYPE_ETH 0x0001
96#define ARP_PTYPE_IP 0x0800
97#define ARP_OP_REQUEST_REV 0x3
98
99static int announce_self_create(uint8_t *buf,
100				uint8_t *mac_addr)
101{
102    /* Ethernet header. */
103    memset(buf, 0xff, 6);         /* destination MAC addr */
104    memcpy(buf + 6, mac_addr, 6); /* source MAC addr */
105    *(uint16_t *)(buf + 12) = htons(ETH_P_RARP); /* ethertype */
106
107    /* RARP header. */
108    *(uint16_t *)(buf + 14) = htons(ARP_HTYPE_ETH); /* hardware addr space */
109    *(uint16_t *)(buf + 16) = htons(ARP_PTYPE_IP); /* protocol addr space */
110    *(buf + 18) = 6; /* hardware addr length (ethernet) */
111    *(buf + 19) = 4; /* protocol addr length (IPv4) */
112    *(uint16_t *)(buf + 20) = htons(ARP_OP_REQUEST_REV); /* opcode */
113    memcpy(buf + 22, mac_addr, 6); /* source hw addr */
114    memset(buf + 28, 0x00, 4);     /* source protocol addr */
115    memcpy(buf + 32, mac_addr, 6); /* target hw addr */
116    memset(buf + 38, 0x00, 4);     /* target protocol addr */
117
118    /* Padding to get up to 60 bytes (ethernet min packet size, minus FCS). */
119    memset(buf + 42, 0x00, 18);
120
121    return 60; /* len (FCS will be added by hardware) */
122}
123
124static void qemu_announce_self_once(void *opaque)
125{
126    int i, len;
127    VLANState *vlan;
128    VLANClientState *vc;
129    uint8_t buf[256];
130    static int count = SELF_ANNOUNCE_ROUNDS;
131    QEMUTimer *timer = *(QEMUTimer **)opaque;
132
133    for (i = 0; i < MAX_NICS; i++) {
134        if (!nd_table[i].used)
135            continue;
136        len = announce_self_create(buf, nd_table[i].macaddr);
137        vlan = nd_table[i].vlan;
138	for(vc = vlan->first_client; vc != NULL; vc = vc->next) {
139            vc->receive(vc, buf, len);
140        }
141    }
142    if (--count) {
143        /* delay 50ms, 150ms, 250ms, ... */
144        qemu_mod_timer(timer, qemu_get_clock_ms(rt_clock) +
145                       50 + (SELF_ANNOUNCE_ROUNDS - count - 1) * 100);
146    } else {
147	    qemu_del_timer(timer);
148	    qemu_free_timer(timer);
149    }
150}
151
152void qemu_announce_self(void)
153{
154	static QEMUTimer *timer;
155	timer = qemu_new_timer_ms(rt_clock, qemu_announce_self_once, &timer);
156	qemu_announce_self_once(&timer);
157}
158
159/***********************************************************/
160/* savevm/loadvm support */
161
162#define IO_BUF_SIZE 32768
163
164struct QEMUFile {
165    QEMUFilePutBufferFunc *put_buffer;
166    QEMUFileGetBufferFunc *get_buffer;
167    QEMUFileCloseFunc *close;
168    QEMUFileRateLimit *rate_limit;
169    QEMUFileSetRateLimit *set_rate_limit;
170    QEMUFileGetRateLimit *get_rate_limit;
171    void *opaque;
172    int is_write;
173
174    int64_t buf_offset; /* start of buffer when writing, end of buffer
175                           when reading */
176    int buf_index;
177    int buf_size; /* 0 when writing */
178    uint8_t buf[IO_BUF_SIZE];
179
180    int has_error;
181};
182
183typedef struct QEMUFileStdio
184{
185    FILE *stdio_file;
186    QEMUFile *file;
187} QEMUFileStdio;
188
189typedef struct QEMUFileSocket
190{
191    int fd;
192    QEMUFile *file;
193} QEMUFileSocket;
194
195static int socket_get_buffer(void *opaque, uint8_t *buf, int64_t pos, int size)
196{
197    QEMUFileSocket *s = opaque;
198    ssize_t len;
199
200    do {
201        len = recv(s->fd, (void *)buf, size, 0);
202    } while (len == -1 && socket_error() == EINTR);
203
204    if (len == -1)
205        len = -socket_error();
206
207    return len;
208}
209
210static int file_socket_close(void *opaque)
211{
212    QEMUFileSocket *s = opaque;
213    qemu_free(s);
214    return 0;
215}
216
217static int stdio_put_buffer(void *opaque, const uint8_t *buf, int64_t pos, int size)
218{
219    QEMUFileStdio *s = opaque;
220    return fwrite(buf, 1, size, s->stdio_file);
221}
222
223static int stdio_get_buffer(void *opaque, uint8_t *buf, int64_t pos, int size)
224{
225    QEMUFileStdio *s = opaque;
226    FILE *fp = s->stdio_file;
227    int bytes;
228
229    do {
230        clearerr(fp);
231        bytes = fread(buf, 1, size, fp);
232    } while ((bytes == 0) && ferror(fp) && (errno == EINTR));
233    return bytes;
234}
235
236static int stdio_pclose(void *opaque)
237{
238    QEMUFileStdio *s = opaque;
239    int ret;
240    ret = pclose(s->stdio_file);
241    qemu_free(s);
242    return ret;
243}
244
245static int stdio_fclose(void *opaque)
246{
247    QEMUFileStdio *s = opaque;
248    fclose(s->stdio_file);
249    qemu_free(s);
250    return 0;
251}
252
253QEMUFile *qemu_popen(FILE *stdio_file, const char *mode)
254{
255    QEMUFileStdio *s;
256
257    if (stdio_file == NULL || mode == NULL || (mode[0] != 'r' && mode[0] != 'w') || mode[1] != 0) {
258        fprintf(stderr, "qemu_popen: Argument validity check failed\n");
259        return NULL;
260    }
261
262    s = qemu_mallocz(sizeof(QEMUFileStdio));
263
264    s->stdio_file = stdio_file;
265
266    if(mode[0] == 'r') {
267        s->file = qemu_fopen_ops(s, NULL, stdio_get_buffer, stdio_pclose,
268				 NULL, NULL, NULL);
269    } else {
270        s->file = qemu_fopen_ops(s, stdio_put_buffer, NULL, stdio_pclose,
271				 NULL, NULL, NULL);
272    }
273    return s->file;
274}
275
276QEMUFile *qemu_popen_cmd(const char *command, const char *mode)
277{
278    FILE *popen_file;
279
280    popen_file = popen(command, mode);
281    if(popen_file == NULL) {
282        return NULL;
283    }
284
285    return qemu_popen(popen_file, mode);
286}
287
288int qemu_stdio_fd(QEMUFile *f)
289{
290    QEMUFileStdio *p;
291    int fd;
292
293    p = (QEMUFileStdio *)f->opaque;
294    fd = fileno(p->stdio_file);
295
296    return fd;
297}
298
299QEMUFile *qemu_fdopen(int fd, const char *mode)
300{
301    QEMUFileStdio *s;
302
303    if (mode == NULL ||
304	(mode[0] != 'r' && mode[0] != 'w') ||
305	mode[1] != 'b' || mode[2] != 0) {
306        fprintf(stderr, "qemu_fdopen: Argument validity check failed\n");
307        return NULL;
308    }
309
310    s = qemu_mallocz(sizeof(QEMUFileStdio));
311    s->stdio_file = fdopen(fd, mode);
312    if (!s->stdio_file)
313        goto fail;
314
315    if(mode[0] == 'r') {
316        s->file = qemu_fopen_ops(s, NULL, stdio_get_buffer, stdio_fclose,
317				 NULL, NULL, NULL);
318    } else {
319        s->file = qemu_fopen_ops(s, stdio_put_buffer, NULL, stdio_fclose,
320				 NULL, NULL, NULL);
321    }
322    return s->file;
323
324fail:
325    qemu_free(s);
326    return NULL;
327}
328
329QEMUFile *qemu_fopen_socket(int fd)
330{
331    QEMUFileSocket *s = qemu_mallocz(sizeof(QEMUFileSocket));
332
333    s->fd = fd;
334    s->file = qemu_fopen_ops(s, NULL, socket_get_buffer, file_socket_close,
335			     NULL, NULL, NULL);
336    return s->file;
337}
338
339static int file_put_buffer(void *opaque, const uint8_t *buf,
340                            int64_t pos, int size)
341{
342    QEMUFileStdio *s = opaque;
343    fseek(s->stdio_file, pos, SEEK_SET);
344    return fwrite(buf, 1, size, s->stdio_file);
345}
346
347static int file_get_buffer(void *opaque, uint8_t *buf, int64_t pos, int size)
348{
349    QEMUFileStdio *s = opaque;
350    fseek(s->stdio_file, pos, SEEK_SET);
351    return fread(buf, 1, size, s->stdio_file);
352}
353
354QEMUFile *qemu_fopen(const char *filename, const char *mode)
355{
356    QEMUFileStdio *s;
357
358    if (mode == NULL ||
359	(mode[0] != 'r' && mode[0] != 'w') ||
360	mode[1] != 'b' || mode[2] != 0) {
361        fprintf(stderr, "qemu_fopen: Argument validity check failed\n");
362        return NULL;
363    }
364
365    s = qemu_mallocz(sizeof(QEMUFileStdio));
366
367    s->stdio_file = fopen(filename, mode);
368    if (!s->stdio_file)
369        goto fail;
370
371    if(mode[0] == 'w') {
372        s->file = qemu_fopen_ops(s, file_put_buffer, NULL, stdio_fclose,
373				 NULL, NULL, NULL);
374    } else {
375        s->file = qemu_fopen_ops(s, NULL, file_get_buffer, stdio_fclose,
376			       NULL, NULL, NULL);
377    }
378    return s->file;
379fail:
380    qemu_free(s);
381    return NULL;
382}
383
384static int block_put_buffer(void *opaque, const uint8_t *buf,
385                           int64_t pos, int size)
386{
387    bdrv_save_vmstate(opaque, buf, pos, size);
388    return size;
389}
390
391static int block_get_buffer(void *opaque, uint8_t *buf, int64_t pos, int size)
392{
393    return bdrv_load_vmstate(opaque, buf, pos, size);
394}
395
396static int bdrv_fclose(void *opaque)
397{
398    return 0;
399}
400
401static QEMUFile *qemu_fopen_bdrv(BlockDriverState *bs, int is_writable)
402{
403    if (is_writable)
404        return qemu_fopen_ops(bs, block_put_buffer, NULL, bdrv_fclose,
405			      NULL, NULL, NULL);
406    return qemu_fopen_ops(bs, NULL, block_get_buffer, bdrv_fclose, NULL, NULL, NULL);
407}
408
409QEMUFile *qemu_fopen_ops(void *opaque, QEMUFilePutBufferFunc *put_buffer,
410                         QEMUFileGetBufferFunc *get_buffer,
411                         QEMUFileCloseFunc *close,
412                         QEMUFileRateLimit *rate_limit,
413                         QEMUFileSetRateLimit *set_rate_limit,
414                         QEMUFileGetRateLimit *get_rate_limit)
415{
416    QEMUFile *f;
417
418    f = qemu_mallocz(sizeof(QEMUFile));
419
420    f->opaque = opaque;
421    f->put_buffer = put_buffer;
422    f->get_buffer = get_buffer;
423    f->close = close;
424    f->rate_limit = rate_limit;
425    f->set_rate_limit = set_rate_limit;
426    f->get_rate_limit = get_rate_limit;
427    f->is_write = 0;
428
429    return f;
430}
431
432int qemu_file_has_error(QEMUFile *f)
433{
434    return f->has_error;
435}
436
437void qemu_file_set_error(QEMUFile *f)
438{
439    f->has_error = 1;
440}
441
442void qemu_fflush(QEMUFile *f)
443{
444    if (!f->put_buffer)
445        return;
446
447    if (f->is_write && f->buf_index > 0) {
448        int len;
449
450        len = f->put_buffer(f->opaque, f->buf, f->buf_offset, f->buf_index);
451        if (len > 0)
452            f->buf_offset += f->buf_index;
453        else
454            f->has_error = 1;
455        f->buf_index = 0;
456    }
457}
458
459static void qemu_fill_buffer(QEMUFile *f)
460{
461    int len;
462
463    if (!f->get_buffer)
464        return;
465
466    if (f->is_write)
467        abort();
468
469    len = f->get_buffer(f->opaque, f->buf, f->buf_offset, IO_BUF_SIZE);
470    if (len > 0) {
471        f->buf_index = 0;
472        f->buf_size = len;
473        f->buf_offset += len;
474    } else if (len != -EAGAIN)
475        f->has_error = 1;
476}
477
478int qemu_fclose(QEMUFile *f)
479{
480    int ret = 0;
481    qemu_fflush(f);
482    if (f->close)
483        ret = f->close(f->opaque);
484    qemu_free(f);
485    return ret;
486}
487
488void qemu_file_put_notify(QEMUFile *f)
489{
490    f->put_buffer(f->opaque, NULL, 0, 0);
491}
492
493void qemu_put_buffer(QEMUFile *f, const uint8_t *buf, int size)
494{
495    int l;
496
497    if (!f->has_error && f->is_write == 0 && f->buf_index > 0) {
498        fprintf(stderr,
499                "Attempted to write to buffer while read buffer is not empty\n");
500        abort();
501    }
502
503    while (!f->has_error && size > 0) {
504        l = IO_BUF_SIZE - f->buf_index;
505        if (l > size)
506            l = size;
507        memcpy(f->buf + f->buf_index, buf, l);
508        f->is_write = 1;
509        f->buf_index += l;
510        buf += l;
511        size -= l;
512        if (f->buf_index >= IO_BUF_SIZE)
513            qemu_fflush(f);
514    }
515}
516
517void qemu_put_byte(QEMUFile *f, int v)
518{
519    if (!f->has_error && f->is_write == 0 && f->buf_index > 0) {
520        fprintf(stderr,
521                "Attempted to write to buffer while read buffer is not empty\n");
522        abort();
523    }
524
525    f->buf[f->buf_index++] = v;
526    f->is_write = 1;
527    if (f->buf_index >= IO_BUF_SIZE)
528        qemu_fflush(f);
529}
530
531int qemu_get_buffer(QEMUFile *f, uint8_t *buf, int size1)
532{
533    int size, l;
534
535    if (f->is_write)
536        abort();
537
538    size = size1;
539    while (size > 0) {
540        l = f->buf_size - f->buf_index;
541        if (l == 0) {
542            qemu_fill_buffer(f);
543            l = f->buf_size - f->buf_index;
544            if (l == 0)
545                break;
546        }
547        if (l > size)
548            l = size;
549        memcpy(buf, f->buf + f->buf_index, l);
550        f->buf_index += l;
551        buf += l;
552        size -= l;
553    }
554    return size1 - size;
555}
556
557int qemu_get_byte(QEMUFile *f)
558{
559    if (f->is_write)
560        abort();
561
562    if (f->buf_index >= f->buf_size) {
563        qemu_fill_buffer(f);
564        if (f->buf_index >= f->buf_size)
565            return 0;
566    }
567    return f->buf[f->buf_index++];
568}
569
570#ifdef CONFIG_ANDROID
571void qemu_put_string(QEMUFile *f, const char* str)
572{
573    /* We will encode NULL and the empty string in the same way */
574    int  slen;
575    if (str == NULL) {
576        str = "";
577    }
578    slen = strlen(str);
579    qemu_put_be32(f, slen);
580    qemu_put_buffer(f, (const uint8_t*)str, slen);
581}
582
583char* qemu_get_string(QEMUFile *f)
584{
585    int slen = qemu_get_be32(f);
586    char* str;
587    if (slen == 0)
588        return NULL;
589
590    str = qemu_malloc(slen+1);
591    if (qemu_get_buffer(f, (uint8_t*)str, slen) != slen) {
592        qemu_free(str);
593        return NULL;
594    }
595    str[slen] = '\0';
596    return str;
597}
598#endif
599
600
601int64_t qemu_ftell(QEMUFile *f)
602{
603    return f->buf_offset - f->buf_size + f->buf_index;
604}
605
606int64_t qemu_fseek(QEMUFile *f, int64_t pos, int whence)
607{
608    if (whence == SEEK_SET) {
609        /* nothing to do */
610    } else if (whence == SEEK_CUR) {
611        pos += qemu_ftell(f);
612    } else {
613        /* SEEK_END not supported */
614        return -1;
615    }
616    if (f->put_buffer) {
617        qemu_fflush(f);
618        f->buf_offset = pos;
619    } else {
620        f->buf_offset = pos;
621        f->buf_index = 0;
622        f->buf_size = 0;
623    }
624    return pos;
625}
626
627int qemu_file_rate_limit(QEMUFile *f)
628{
629    if (f->rate_limit)
630        return f->rate_limit(f->opaque);
631
632    return 0;
633}
634
635int64_t qemu_file_get_rate_limit(QEMUFile *f)
636{
637    if (f->get_rate_limit)
638        return f->get_rate_limit(f->opaque);
639
640    return 0;
641}
642
643int64_t qemu_file_set_rate_limit(QEMUFile *f, int64_t new_rate)
644{
645    /* any failed or completed migration keeps its state to allow probing of
646     * migration data, but has no associated file anymore */
647    if (f && f->set_rate_limit)
648        return f->set_rate_limit(f->opaque, new_rate);
649
650    return 0;
651}
652
653void qemu_put_be16(QEMUFile *f, unsigned int v)
654{
655    qemu_put_byte(f, v >> 8);
656    qemu_put_byte(f, v);
657}
658
659void qemu_put_be32(QEMUFile *f, unsigned int v)
660{
661    qemu_put_byte(f, v >> 24);
662    qemu_put_byte(f, v >> 16);
663    qemu_put_byte(f, v >> 8);
664    qemu_put_byte(f, v);
665}
666
667void qemu_put_be64(QEMUFile *f, uint64_t v)
668{
669    qemu_put_be32(f, v >> 32);
670    qemu_put_be32(f, v);
671}
672
673unsigned int qemu_get_be16(QEMUFile *f)
674{
675    unsigned int v;
676    v = qemu_get_byte(f) << 8;
677    v |= qemu_get_byte(f);
678    return v;
679}
680
681unsigned int qemu_get_be32(QEMUFile *f)
682{
683    unsigned int v;
684    v = qemu_get_byte(f) << 24;
685    v |= qemu_get_byte(f) << 16;
686    v |= qemu_get_byte(f) << 8;
687    v |= qemu_get_byte(f);
688    return v;
689}
690
691uint64_t qemu_get_be64(QEMUFile *f)
692{
693    uint64_t v;
694    v = (uint64_t)qemu_get_be32(f) << 32;
695    v |= qemu_get_be32(f);
696    return v;
697}
698
699void  qemu_put_struct(QEMUFile*  f, const QField*  fields, const void*  s)
700{
701    const QField*  qf = fields;
702
703    /* Iterate over struct fields */
704    while (qf->type != Q_FIELD_END) {
705        uint8_t*  p = (uint8_t*)s + qf->offset;
706
707        switch (qf->type) {
708            case Q_FIELD_BYTE:
709                qemu_put_byte(f, p[0]);
710                break;
711            case Q_FIELD_INT16:
712                qemu_put_be16(f, ((uint16_t*)p)[0]);
713                break;
714            case Q_FIELD_INT32:
715                qemu_put_be32(f, ((uint32_t*)p)[0]);
716                break;
717            case Q_FIELD_INT64:
718                qemu_put_be64(f, ((uint64_t*)p)[0]);
719                break;
720            case Q_FIELD_BUFFER:
721                if (qf[1].type != Q_FIELD_BUFFER_SIZE ||
722                    qf[2].type != Q_FIELD_BUFFER_SIZE)
723                {
724                    fprintf(stderr, "%s: invalid QFIELD_BUFFER item passed as argument. aborting\n",
725                            __FUNCTION__ );
726                    exit(1);
727                }
728                else
729                {
730                    uint32_t  size = ((uint32_t)qf[1].offset << 16) | (uint32_t)qf[2].offset;
731
732                    qemu_put_buffer(f, p, size);
733                    qf += 2;
734                }
735                break;
736            default:
737                fprintf(stderr, "%s: invalid fields list passed as argument. aborting\n", __FUNCTION__);
738                exit(1);
739        }
740        qf++;
741    }
742}
743
744int   qemu_get_struct(QEMUFile*  f, const QField*  fields, void*  s)
745{
746    const QField*  qf = fields;
747
748    /* Iterate over struct fields */
749    while (qf->type != Q_FIELD_END) {
750        uint8_t*  p = (uint8_t*)s + qf->offset;
751
752        switch (qf->type) {
753            case Q_FIELD_BYTE:
754                p[0] = qemu_get_byte(f);
755                break;
756            case Q_FIELD_INT16:
757                ((uint16_t*)p)[0] = qemu_get_be16(f);
758                break;
759            case Q_FIELD_INT32:
760                ((uint32_t*)p)[0] = qemu_get_be32(f);
761                break;
762            case Q_FIELD_INT64:
763                ((uint64_t*)p)[0] = qemu_get_be64(f);
764                break;
765            case Q_FIELD_BUFFER:
766                if (qf[1].type != Q_FIELD_BUFFER_SIZE ||
767                        qf[2].type != Q_FIELD_BUFFER_SIZE)
768                {
769                    fprintf(stderr, "%s: invalid QFIELD_BUFFER item passed as argument.\n",
770                            __FUNCTION__ );
771                    return -1;
772                }
773                else
774                {
775                    uint32_t  size = ((uint32_t)qf[1].offset << 16) | (uint32_t)qf[2].offset;
776                    int       ret  = qemu_get_buffer(f, p, size);
777
778                    if (ret != size) {
779                        fprintf(stderr, "%s: not enough bytes to load structure\n", __FUNCTION__);
780                        return -1;
781                    }
782                    qf += 2;
783                }
784                break;
785            default:
786                fprintf(stderr, "%s: invalid fields list passed as argument. aborting\n", __FUNCTION__);
787                exit(1);
788        }
789        qf++;
790    }
791    return 0;
792}
793
794/* write a float to file */
795void qemu_put_float(QEMUFile *f, float v)
796{
797    uint8_t *bytes = (uint8_t*) &v;
798    qemu_put_buffer(f, bytes, sizeof(float));
799}
800
801/* read a float from file */
802float qemu_get_float(QEMUFile *f)
803{
804    uint8_t bytes[sizeof(float)];
805    qemu_get_buffer(f, bytes, sizeof(float));
806
807    return *((float*) bytes);
808}
809
810typedef struct SaveStateEntry {
811    char idstr[256];
812    int instance_id;
813    int version_id;
814    int section_id;
815    SaveLiveStateHandler *save_live_state;
816    SaveStateHandler *save_state;
817    LoadStateHandler *load_state;
818    void *opaque;
819    struct SaveStateEntry *next;
820} SaveStateEntry;
821
822static SaveStateEntry *first_se;
823
824/* TODO: Individual devices generally have very little idea about the rest
825   of the system, so instance_id should be removed/replaced.
826   Meanwhile pass -1 as instance_id if you do not already have a clearly
827   distinguishing id for all instances of your device class. */
828int register_savevm_live(const char *idstr,
829                         int instance_id,
830                         int version_id,
831                         SaveLiveStateHandler *save_live_state,
832                         SaveStateHandler *save_state,
833                         LoadStateHandler *load_state,
834                         void *opaque)
835{
836    SaveStateEntry *se, **pse;
837    static int global_section_id;
838
839    se = qemu_malloc(sizeof(SaveStateEntry));
840    pstrcpy(se->idstr, sizeof(se->idstr), idstr);
841    se->instance_id = (instance_id == -1) ? 0 : instance_id;
842    se->version_id = version_id;
843    se->section_id = global_section_id++;
844    se->save_live_state = save_live_state;
845    se->save_state = save_state;
846    se->load_state = load_state;
847    se->opaque = opaque;
848    se->next = NULL;
849
850    /* add at the end of list */
851    pse = &first_se;
852    while (*pse != NULL) {
853        if (instance_id == -1
854                && strcmp(se->idstr, (*pse)->idstr) == 0
855                && se->instance_id <= (*pse)->instance_id)
856            se->instance_id = (*pse)->instance_id + 1;
857        pse = &(*pse)->next;
858    }
859    *pse = se;
860    return 0;
861}
862
863int register_savevm(const char *idstr,
864                    int instance_id,
865                    int version_id,
866                    SaveStateHandler *save_state,
867                    LoadStateHandler *load_state,
868                    void *opaque)
869{
870    return register_savevm_live(idstr, instance_id, version_id,
871                                NULL, save_state, load_state, opaque);
872}
873
874void unregister_savevm(const char *idstr, void *opaque)
875{
876    SaveStateEntry **pse;
877
878    pse = &first_se;
879    while (*pse != NULL) {
880        if (strcmp((*pse)->idstr, idstr) == 0 && (*pse)->opaque == opaque) {
881            SaveStateEntry *next = (*pse)->next;
882            qemu_free(*pse);
883            *pse = next;
884            continue;
885        }
886        pse = &(*pse)->next;
887    }
888}
889
890#define QEMU_VM_FILE_MAGIC           0x5145564d
891#define QEMU_VM_FILE_VERSION_COMPAT  0x00000002
892#define QEMU_VM_FILE_VERSION         0x00000004
893
894#define QEMU_VM_EOF                  0x00
895#define QEMU_VM_SECTION_START        0x01
896#define QEMU_VM_SECTION_PART         0x02
897#define QEMU_VM_SECTION_END          0x03
898#define QEMU_VM_SECTION_FULL         0x04
899
900int qemu_savevm_state_begin(QEMUFile *f)
901{
902    SaveStateEntry *se;
903
904    qemu_put_be32(f, QEMU_VM_FILE_MAGIC);
905    qemu_put_be32(f, QEMU_VM_FILE_VERSION);
906
907    for (se = first_se; se != NULL; se = se->next) {
908        int len;
909
910        if (se->save_live_state == NULL)
911            continue;
912
913        /* Section type */
914        qemu_put_byte(f, QEMU_VM_SECTION_START);
915        qemu_put_be32(f, se->section_id);
916
917        /* ID string */
918        len = strlen(se->idstr);
919        qemu_put_byte(f, len);
920        qemu_put_buffer(f, (uint8_t *)se->idstr, len);
921
922        qemu_put_be32(f, se->instance_id);
923        qemu_put_be32(f, se->version_id);
924
925        se->save_live_state(f, QEMU_VM_SECTION_START, se->opaque);
926    }
927
928    if (qemu_file_has_error(f))
929        return -EIO;
930
931    return 0;
932}
933
934int qemu_savevm_state_iterate(QEMUFile *f)
935{
936    SaveStateEntry *se;
937    int ret = 1;
938
939    for (se = first_se; se != NULL; se = se->next) {
940        if (se->save_live_state == NULL)
941            continue;
942
943        /* Section type */
944        qemu_put_byte(f, QEMU_VM_SECTION_PART);
945        qemu_put_be32(f, se->section_id);
946
947        ret &= !!se->save_live_state(f, QEMU_VM_SECTION_PART, se->opaque);
948    }
949
950    if (ret)
951        return 1;
952
953    if (qemu_file_has_error(f))
954        return -EIO;
955
956    return 0;
957}
958
959int qemu_savevm_state_complete(QEMUFile *f)
960{
961    SaveStateEntry *se;
962
963    for (se = first_se; se != NULL; se = se->next) {
964        if (se->save_live_state == NULL)
965            continue;
966
967        /* Section type */
968        qemu_put_byte(f, QEMU_VM_SECTION_END);
969        qemu_put_be32(f, se->section_id);
970
971        se->save_live_state(f, QEMU_VM_SECTION_END, se->opaque);
972    }
973
974    for(se = first_se; se != NULL; se = se->next) {
975        int len;
976
977        if (se->save_state == NULL)
978            continue;
979
980        /* Section type */
981        qemu_put_byte(f, QEMU_VM_SECTION_FULL);
982        qemu_put_be32(f, se->section_id);
983
984        /* ID string */
985        len = strlen(se->idstr);
986        qemu_put_byte(f, len);
987        qemu_put_buffer(f, (uint8_t *)se->idstr, len);
988
989        qemu_put_be32(f, se->instance_id);
990        qemu_put_be32(f, se->version_id);
991
992        se->save_state(f, se->opaque);
993    }
994
995    qemu_put_byte(f, QEMU_VM_EOF);
996
997    if (qemu_file_has_error(f))
998        return -EIO;
999
1000    return 0;
1001}
1002
1003int qemu_savevm_state(QEMUFile *f)
1004{
1005    int saved_vm_running;
1006    int ret;
1007
1008    saved_vm_running = vm_running;
1009    vm_stop(0);
1010
1011    bdrv_flush_all();
1012
1013    ret = qemu_savevm_state_begin(f);
1014    if (ret < 0)
1015        goto out;
1016
1017    do {
1018        ret = qemu_savevm_state_iterate(f);
1019        if (ret < 0)
1020            goto out;
1021    } while (ret == 0);
1022
1023    ret = qemu_savevm_state_complete(f);
1024
1025out:
1026    if (qemu_file_has_error(f))
1027        ret = -EIO;
1028
1029    if (!ret && saved_vm_running)
1030        vm_start();
1031
1032    return ret;
1033}
1034
1035static SaveStateEntry *find_se(const char *idstr, int instance_id)
1036{
1037    SaveStateEntry *se;
1038
1039    for(se = first_se; se != NULL; se = se->next) {
1040        if (!strcmp(se->idstr, idstr) &&
1041            instance_id == se->instance_id)
1042            return se;
1043    }
1044    return NULL;
1045}
1046
1047typedef struct LoadStateEntry {
1048    SaveStateEntry *se;
1049    int section_id;
1050    int version_id;
1051    struct LoadStateEntry *next;
1052} LoadStateEntry;
1053
1054static int qemu_loadvm_state_v2(QEMUFile *f)
1055{
1056    SaveStateEntry *se;
1057    int len, ret, instance_id, record_len, version_id;
1058    int64_t total_len, end_pos, cur_pos;
1059    char idstr[256];
1060
1061    total_len = qemu_get_be64(f);
1062    end_pos = total_len + qemu_ftell(f);
1063    for(;;) {
1064        if (qemu_ftell(f) >= end_pos)
1065            break;
1066        len = qemu_get_byte(f);
1067        qemu_get_buffer(f, (uint8_t *)idstr, len);
1068        idstr[len] = '\0';
1069        instance_id = qemu_get_be32(f);
1070        version_id = qemu_get_be32(f);
1071        record_len = qemu_get_be32(f);
1072        cur_pos = qemu_ftell(f);
1073        se = find_se(idstr, instance_id);
1074        if (!se) {
1075            fprintf(stderr, "qemu: warning: instance 0x%x of device '%s' not present in current VM\n",
1076                    instance_id, idstr);
1077        } else {
1078            ret = se->load_state(f, se->opaque, version_id);
1079            if (ret < 0) {
1080                fprintf(stderr, "qemu: warning: error while loading state for instance 0x%x of device '%s'\n",
1081                        instance_id, idstr);
1082                return ret;
1083            }
1084        }
1085        /* always seek to exact end of record */
1086        qemu_fseek(f, cur_pos + record_len, SEEK_SET);
1087    }
1088
1089    if (qemu_file_has_error(f))
1090        return -EIO;
1091
1092    return 0;
1093}
1094
1095int qemu_loadvm_state(QEMUFile *f)
1096{
1097    LoadStateEntry *first_le = NULL;
1098    uint8_t section_type;
1099    unsigned int v;
1100    int ret;
1101
1102    v = qemu_get_be32(f);
1103    if (v != QEMU_VM_FILE_MAGIC)
1104        return -EINVAL;
1105
1106    v = qemu_get_be32(f);
1107    if (v == QEMU_VM_FILE_VERSION_COMPAT)
1108        return qemu_loadvm_state_v2(f);
1109    if (v < QEMU_VM_FILE_VERSION) {
1110        fprintf(stderr, "Snapshot format %d is too old for this version of the emulator, please create a new one.\n", v);
1111        return -ENOTSUP;
1112    } else if (v > QEMU_VM_FILE_VERSION) {
1113        fprintf(stderr, "Snapshot format %d is more recent than the emulator, please update your Android SDK Tools.\n", v);
1114        return -ENOTSUP;
1115    }
1116
1117    while ((section_type = qemu_get_byte(f)) != QEMU_VM_EOF) {
1118        uint32_t instance_id, version_id, section_id;
1119        LoadStateEntry *le;
1120        SaveStateEntry *se;
1121        char idstr[257];
1122        int len;
1123
1124        switch (section_type) {
1125        case QEMU_VM_SECTION_START:
1126        case QEMU_VM_SECTION_FULL:
1127            /* Read section start */
1128            section_id = qemu_get_be32(f);
1129            len = qemu_get_byte(f);
1130            qemu_get_buffer(f, (uint8_t *)idstr, len);
1131            idstr[len] = 0;
1132            instance_id = qemu_get_be32(f);
1133            version_id = qemu_get_be32(f);
1134
1135            /* Find savevm section */
1136            se = find_se(idstr, instance_id);
1137            if (se == NULL) {
1138                fprintf(stderr, "Unknown savevm section or instance '%s' %d\n", idstr, instance_id);
1139                ret = -EINVAL;
1140                goto out;
1141            }
1142
1143            /* Validate version */
1144            if (version_id > se->version_id) {
1145                fprintf(stderr, "savevm: unsupported version %d for '%s' v%d\n",
1146                        version_id, idstr, se->version_id);
1147                ret = -EINVAL;
1148                goto out;
1149            }
1150
1151            /* Add entry */
1152            le = qemu_mallocz(sizeof(*le));
1153
1154            le->se = se;
1155            le->section_id = section_id;
1156            le->version_id = version_id;
1157            le->next = first_le;
1158            first_le = le;
1159
1160            if (le->se->load_state(f, le->se->opaque, le->version_id)) {
1161                fprintf(stderr, "savevm: unable to load section %s\n", idstr);
1162                ret = -EINVAL;
1163                goto out;
1164            }
1165            break;
1166        case QEMU_VM_SECTION_PART:
1167        case QEMU_VM_SECTION_END:
1168            section_id = qemu_get_be32(f);
1169
1170            for (le = first_le; le && le->section_id != section_id; le = le->next);
1171            if (le == NULL) {
1172                fprintf(stderr, "Unknown savevm section %d\n", section_id);
1173                ret = -EINVAL;
1174                goto out;
1175            }
1176
1177            le->se->load_state(f, le->se->opaque, le->version_id);
1178            break;
1179        default:
1180            fprintf(stderr, "Unknown savevm section type %d\n", section_type);
1181            ret = -EINVAL;
1182            goto out;
1183        }
1184    }
1185
1186    ret = 0;
1187
1188out:
1189    while (first_le) {
1190        LoadStateEntry *le = first_le;
1191        first_le = first_le->next;
1192        qemu_free(le);
1193    }
1194
1195    if (qemu_file_has_error(f))
1196        ret = -EIO;
1197
1198    return ret;
1199}
1200#if 0
1201static BlockDriverState *get_bs_snapshots(void)
1202{
1203    BlockDriverState *bs;
1204    int i;
1205
1206    if (bs_snapshots)
1207        return bs_snapshots;
1208    for(i = 0; i <= nb_drives; i++) {
1209        bs = drives_table[i].bdrv;
1210        if (bdrv_can_snapshot(bs))
1211            goto ok;
1212    }
1213    return NULL;
1214 ok:
1215    bs_snapshots = bs;
1216    return bs;
1217}
1218#endif
1219static int bdrv_snapshot_find(BlockDriverState *bs, QEMUSnapshotInfo *sn_info,
1220                              const char *name)
1221{
1222    QEMUSnapshotInfo *sn_tab, *sn;
1223    int nb_sns, i, ret;
1224
1225    ret = -ENOENT;
1226    nb_sns = bdrv_snapshot_list(bs, &sn_tab);
1227    if (nb_sns < 0)
1228        return ret;
1229    for(i = 0; i < nb_sns; i++) {
1230        sn = &sn_tab[i];
1231        if (!strcmp(sn->id_str, name) || !strcmp(sn->name, name)) {
1232            *sn_info = *sn;
1233            ret = 0;
1234            break;
1235        }
1236    }
1237    qemu_free(sn_tab);
1238    return ret;
1239}
1240
1241void do_savevm(Monitor *err, const char *name)
1242{
1243    BlockDriverState *bs, *bs1;
1244    QEMUSnapshotInfo sn1, *sn = &sn1, old_sn1, *old_sn = &old_sn1;
1245    int must_delete, ret;
1246    BlockDriverInfo bdi1, *bdi = &bdi1;
1247    QEMUFile *f;
1248    int saved_vm_running;
1249    uint32_t vm_state_size;
1250#ifdef _WIN32
1251    struct _timeb tb;
1252#else
1253    struct timeval tv;
1254#endif
1255
1256    bs = bdrv_snapshots();
1257    if (!bs) {
1258        monitor_printf(err, "No block device can accept snapshots\n");
1259        return;
1260    }
1261
1262    /* ??? Should this occur after vm_stop?  */
1263    qemu_aio_flush();
1264
1265    saved_vm_running = vm_running;
1266    vm_stop(0);
1267
1268    must_delete = 0;
1269    if (name) {
1270        ret = bdrv_snapshot_find(bs, old_sn, name);
1271        if (ret >= 0) {
1272            must_delete = 1;
1273        }
1274    }
1275    memset(sn, 0, sizeof(*sn));
1276    if (must_delete) {
1277        pstrcpy(sn->name, sizeof(sn->name), old_sn->name);
1278        pstrcpy(sn->id_str, sizeof(sn->id_str), old_sn->id_str);
1279    } else {
1280        if (name)
1281            pstrcpy(sn->name, sizeof(sn->name), name);
1282    }
1283
1284    /* fill auxiliary fields */
1285#ifdef _WIN32
1286    _ftime(&tb);
1287    sn->date_sec = tb.time;
1288    sn->date_nsec = tb.millitm * 1000000;
1289#else
1290    gettimeofday(&tv, NULL);
1291    sn->date_sec = tv.tv_sec;
1292    sn->date_nsec = tv.tv_usec * 1000;
1293#endif
1294    sn->vm_clock_nsec = qemu_get_clock_ns(vm_clock);
1295
1296    if (bdrv_get_info(bs, bdi) < 0 || bdi->vm_state_offset <= 0) {
1297        monitor_printf(err, "Device %s does not support VM state snapshots\n",
1298                              bdrv_get_device_name(bs));
1299        goto the_end;
1300    }
1301
1302    /* save the VM state */
1303    f = qemu_fopen_bdrv(bs, 1);
1304    if (!f) {
1305        monitor_printf(err, "Could not open VM state file\n");
1306        goto the_end;
1307    }
1308    ret = qemu_savevm_state(f);
1309    vm_state_size = qemu_ftell(f);
1310    qemu_fclose(f);
1311    if (ret < 0) {
1312        monitor_printf(err, "Error %d while writing VM\n", ret);
1313        goto the_end;
1314    }
1315
1316    /* create the snapshots */
1317
1318    bs1 = NULL;
1319    while ((bs1 = bdrv_next(bs1))) {
1320        if (bdrv_can_snapshot(bs1)) {
1321            if (must_delete) {
1322                ret = bdrv_snapshot_delete(bs1, old_sn->id_str);
1323                if (ret < 0) {
1324                    monitor_printf(err,
1325                                          "Error while deleting snapshot on '%s'\n",
1326                                          bdrv_get_device_name(bs1));
1327                }
1328            }
1329            /* Write VM state size only to the image that contains the state */
1330            sn->vm_state_size = (bs == bs1 ? vm_state_size : 0);
1331            ret = bdrv_snapshot_create(bs1, sn);
1332            if (ret < 0) {
1333                monitor_printf(err, "Error while creating snapshot on '%s'\n",
1334                                      bdrv_get_device_name(bs1));
1335            }
1336        }
1337    }
1338
1339 the_end:
1340    if (saved_vm_running)
1341        vm_start();
1342}
1343
1344void do_loadvm(Monitor *err, const char *name)
1345{
1346    BlockDriverState *bs, *bs1;
1347    BlockDriverInfo bdi1, *bdi = &bdi1;
1348    QEMUSnapshotInfo sn;
1349    QEMUFile *f;
1350    int ret;
1351    int saved_vm_running;
1352
1353    bs = bdrv_snapshots();
1354    if (!bs) {
1355        monitor_printf(err, "No block device supports snapshots\n");
1356        return;
1357    }
1358
1359    /* Flush all IO requests so they don't interfere with the new state.  */
1360    qemu_aio_flush();
1361
1362    saved_vm_running = vm_running;
1363    vm_stop(0);
1364
1365    bs1 = bs;
1366    do {
1367        if (bdrv_can_snapshot(bs1)) {
1368            ret = bdrv_snapshot_goto(bs1, name);
1369            if (ret < 0) {
1370                if (bs != bs1)
1371                    monitor_printf(err, "Warning: ");
1372                switch(ret) {
1373                case -ENOTSUP:
1374                    monitor_printf(err,
1375                                   "Snapshots not supported on device '%s'\n",
1376                                   bdrv_get_device_name(bs1));
1377                    break;
1378                case -ENOENT:
1379                    monitor_printf(err, "Could not find snapshot '%s' on "
1380                                   "device '%s'\n",
1381                                   name, bdrv_get_device_name(bs1));
1382                    break;
1383                default:
1384                    monitor_printf(err, "Error %d while activating snapshot on"
1385                                   " '%s'\n", ret, bdrv_get_device_name(bs1));
1386                    break;
1387                }
1388                /* fatal on snapshot block device */
1389                if (bs == bs1)
1390                    goto the_end;
1391            }
1392        }
1393    } while ((bs1 = bdrv_next(bs)));
1394
1395    if (bdrv_get_info(bs, bdi) < 0 || bdi->vm_state_offset <= 0) {
1396        monitor_printf(err, "Device %s does not support VM state snapshots\n",
1397                       bdrv_get_device_name(bs));
1398        return;
1399    }
1400
1401    /* Don't even try to load empty VM states */
1402    ret = bdrv_snapshot_find(bs, &sn, name);
1403    if ((ret >= 0) && (sn.vm_state_size == 0))
1404        goto the_end;
1405
1406    /* restore the VM state */
1407    f = qemu_fopen_bdrv(bs, 0);
1408    if (!f) {
1409        monitor_printf(err, "Could not open VM state file\n");
1410        goto the_end;
1411    }
1412    ret = qemu_loadvm_state(f);
1413    qemu_fclose(f);
1414    if (ret < 0) {
1415        monitor_printf(err, "Error %d while loading VM state\n", ret);
1416    }
1417 the_end:
1418    if (saved_vm_running)
1419        vm_start();
1420}
1421
1422void do_delvm(Monitor *err, const char *name)
1423{
1424    BlockDriverState *bs, *bs1;
1425    int ret;
1426
1427    bs = bdrv_snapshots();
1428    if (!bs) {
1429        monitor_printf(err, "No block device supports snapshots\n");
1430        return;
1431    }
1432
1433    bs1 = NULL;
1434    while ((bs1 = bdrv_next(bs1))) {
1435        if (bdrv_can_snapshot(bs1)) {
1436            ret = bdrv_snapshot_delete(bs1, name);
1437            if (ret < 0) {
1438                if (ret == -ENOTSUP)
1439                    monitor_printf(err,
1440                                          "Snapshots not supported on device '%s'\n",
1441                                          bdrv_get_device_name(bs1));
1442                else
1443                    monitor_printf(err, "Error %d while deleting snapshot on "
1444                                          "'%s'\n", ret, bdrv_get_device_name(bs1));
1445            }
1446        }
1447    }
1448}
1449
1450void do_info_snapshots(Monitor* out, Monitor* err)
1451{
1452    BlockDriverState *bs, *bs1;
1453    QEMUSnapshotInfo *sn_tab, *sn;
1454    int nb_sns, i;
1455    char buf[256];
1456
1457    bs = bdrv_snapshots();
1458    if (!bs) {
1459        monitor_printf(err, "No available block device supports snapshots\n");
1460        return;
1461    }
1462    monitor_printf(out, "Snapshot devices:");
1463    bs1 = NULL;
1464    while ((bs1 = bdrv_next(bs1))) {
1465        if (bdrv_can_snapshot(bs1)) {
1466            if (bs == bs1)
1467                monitor_printf(out, " %s", bdrv_get_device_name(bs1));
1468        }
1469    }
1470    monitor_printf(out, "\n");
1471
1472    nb_sns = bdrv_snapshot_list(bs, &sn_tab);
1473    if (nb_sns < 0) {
1474        monitor_printf(err, "bdrv_snapshot_list: error %d\n", nb_sns);
1475        return;
1476    }
1477    monitor_printf(out, "Snapshot list (from %s):\n",
1478                   bdrv_get_device_name(bs));
1479    monitor_printf(out, "%s\n", bdrv_snapshot_dump(buf, sizeof(buf), NULL));
1480    for(i = 0; i < nb_sns; i++) {
1481        sn = &sn_tab[i];
1482        monitor_printf(out, "%s\n", bdrv_snapshot_dump(buf, sizeof(buf), sn));
1483    }
1484    qemu_free(sn_tab);
1485}
1486