[PATCH QEMU HCI-8.1 v7 04/35] migration/cpr-exec: require a file or exec migration URI

[Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>]

cpr-exec writes the device state to the migration URI and new QEMU
reads it back after the exec, so the URI must capture the data: a
file, or an exec command that stores it.  Nothing checks that.  With a
socket URI, e.g. a save or a live migration issued while the 'mode'
parameter is left at cpr-exec after a failed qemu-update, QEMU sends a
stream without the guest RAM to the peer, execs the stale cpr-exec
command, and the VM is lost.

Refuse cpr-exec with anything but a file or exec URI, the two types
the CPR documentation allows.  The check covers the incoming URI of
new QEMU too, where the mode is cpr-exec as well.

Fixes: a3eae205c601 ("migration: cpr-exec mode")
Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
---
 docs/devel/migration/CPR.rst | 8 ++++----
 migration/migration.c        | 8 ++++++++
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/docs/devel/migration/CPR.rst b/docs/devel/migration/CPR.rst
index b6178568a85..2f34a6d7c9d 100644
--- a/docs/devel/migration/CPR.rst
+++ b/docs/devel/migration/CPR.rst
@@ -365,10 +365,10 @@ The VM must be started with the ``-machine aux-ram-share=on`` option.
 Outgoing:
   * Set the migration mode parameter to ``cpr-exec``.
   * Set the ``cpr-exec-command`` parameter.
-  * Issue the ``migrate`` command.  It is recommended that the URI be
-    a ``file`` type, but one can use other types such as ``exec``,
-    provided the command captures all the data from the outgoing side,
-    and provides all the data to the incoming side.
+  * Issue the ``migrate`` command.  The URI must be a ``file`` type,
+    or an ``exec`` type, provided the command captures all the data
+    from the outgoing side, and provides all the data to the incoming
+    side.  Other types are refused.
 
 Incoming:
   * You do not need to explicitly start new QEMU.  It is started as
diff --git a/migration/migration.c b/migration/migration.c
index 2f8ef20c036..39f70328fc7 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -258,6 +258,14 @@ migration_channels_and_transport_compatible(MigrationAddress *addr,
         return false;
     }
 
+    if (migrate_mode() == MIG_MODE_CPR_EXEC &&
+        addr->transport != MIGRATION_ADDRESS_TYPE_FILE &&
+        addr->transport != MIGRATION_ADDRESS_TYPE_EXEC) {
+        error_setg(errp,
+                   "cpr-exec mode requires a file or exec migration URI");
+        return false;
+    }
+
     return true;
 }
 

-- 
2.47.1