[Qemu-devel] [RFC PATCH 0/4] Fix subsection ambiguity in the migration format

[Paolo Bonzini <pbonzini@redhat.com>]

With the current migration format, VMS_STRUCTs with subsections
are ambiguous.  The protocol cannot tell whether a 0x5 byte after
the VMS_STRUCT is a subsection or part of the parent data stream.
In the past QEMU assumed it was always a part of a subsection; after
commit eb60260 (savevm: fix corruption in vmstate_subsection_load(),
2011-02-03) the choice depends on whether the VMS_STRUCT has subsections
defined.

Unfortunately, this means that if a destination has no subsections
defined for the struct, it will happily read subsection data into
its own fields.  And if you are "lucky" enough to stumble on a
zero byte at the right time, it will be interpreted as QEMU_VM_EOF
and migration will be interrupted with half-loaded state.

There is no way out of this except defining an incompatible
migration protocol.  Not-so-long-term we should really try to define
one that is not a joke, but the bug is serious so we need a solution
for 0.15.  A sentinel at the end of embedded structs does remove the
ambiguity.

Of course, this can be restricted to new machine models, and this
is what the patch series does.  (And note that only patch 3 is specific
to the short-term solution, everything else is entirely generic).

Untested beyond compilation.

Paolo Bonzini (4):
  add support for machine models to specify their migration format
  add pc-0.14 machine
  savevm: define new unambiguous migration format
  Revert "savevm: fix corruption in vmstate_subsection_load()."

 cpu-common.h  |    3 ---
 qemu-common.h |    2 ++
 hw/boards.h   |    1 +
 hw/pc_piix.c  |   16 +++++++++++++++-
 savevm.c      |   44 +++++++++++++++++++++++++-------------------
 5 files changed, 43 insertions(+), 23 deletions(-)
                                                              50,2          Bot

-- 
1.7.5.2