On Wed, Feb 19, 2020 at 02:39:22AM +0000, Shaju Abraham wrote:
>
>
> On 2/11/20, 7:06 PM, "Daniel P. Berrangé" <berrange@redhat.com> wrote:
>
>     On Tue, Feb 11, 2020 at 10:05:53AM +0100, Martin Kletzander wrote:
>   >  > On Wed, Feb 05, 2020 at 05:32:50PM +0000, Daniel P. Berrangé wrote:
>     > > > On Mon, Feb 03, 2020 at 12:43:32PM +0000, Daniel P. Berrangé wrote:
>     > > > > From: Shaju Abraham <shaju.abraham@nutanix.com>
>     > > > >
>     > > > There are various config paths that a VM uses. The monitor paths and
>     > > > > other lib paths are examples. These paths are tied to the VM name or
>     > > > > UUID. The local migration breaks the assumption that there will be only
>     > > > > one VM with a unique UUID and name. During local migrations there can be
>     > > > > multiple VMs with same name and UUID in the same host. Append the
>     > > > > domain-id field to the path so that there is no duplication of path
>     > > > names.
>     > > >
>     > > >This is the really critical problem with localhost migration.
>     > > >
>     > > >Appending the domain-id looks "simple" but this is a significant
>     > > >behavioural / functional change for applications, and I don't think
>     > > >it can fully solve the problem either.
>     > > >
>     > > >This is changing thue paths used in various places where libvirt
>     > > >internally generates unique paths (eg QMP socket, huge page or
>     > > >file based memory paths, and defaults used for auto-filling
>     > > >device paths (<channel> if not specified).
>     > > >
>     > > >Some of these paths are functionally important to external
>     > > >applications and cannot be changed in this way. eg stuff
>     > > >integrating with QEMU can be expecting certain memory backing
>     > > >file paths, or certain <channel> paths & is liable to break
>     > > >if we change the naming convention.
>     > > >
>     > > >For sake of argument, lets assume we can changing the naming
>     > > >convention without breaking anything...
>     > > >
>     > >
>     > >This was already done in (I would say) most places as they use
>     > >virDomainDefGetShortName() to get a short, unique name of a directory -- it uses
>     > >the domain ID as a prefix.
>     > >
>     > > > This only applies to paths libvirt generates at VM startup.
>     > > >
>     > > >There are plenty of configuration elements in the guest XML
>     > > >that are end user / mgmt app defined, and reference paths in
>     > > >the host OS.
>     > > >
>     > > >For example <graphics>, <serial>, <console>, <channel>,
>     > > >all support UNIX domain sockets and TCP sockets. A UNIX
>     > > >domain socket cannot be listened on by multiple VMs
>     > > >at once. If the UNIX socket is in client mode, we cannot
>     > > >assume the thing QEMU is connecting to allows multiple
>     > > >concurrent connections. eg 2 QEMU's could have their
>     > > ><serial> connected together over a UNIX socket pair.
>     > > >Similarly if automatic TCP port assignment is not used
>     > > >we cannot have multiple QEMU's listening on the same
>     > > >host.
>     > > >
>     > > >One answer is to say that localhost migration is just
>     > > >not supported for such VMs, but I don't find that very
>     > > >convincing because the UNIX domain socket configs
>     > > >affected are in common use.
>     > > >
>     > >
>     > >I would be okay with saying that these either need to be changed in a provided
>     > >destination XML or the migration will probably break.  I do not think it is
>     > >unreasonable to say that if users are trying to shoot themselves, we should not
>     > >spend a ridiculous time just so we can prevent that.  Otherwise we will get to
>     > >the same point as we are now -- there might be a case where a local migration
>     > >would work, but users cannot execute it even if they were very cautious and went
>     > >through all the things that can prevent it from the technical point of view,
>     > >libvirt will still disallow that.
>     
>     >If there are clashing resources, we can't rely on QEMU reporting an
>     >error. For example with a UNIX domain socket, the first thing QEMU
>     >does is unlink(/socket/path), which will blow away the UNIX domain
>     >socket belonging to the original QEMU. As a result if migration
>     >fails, and we rollback, the original QEMU will be broken.
>
>    By appending the id field to the path, we are effectively nullifying this particular
>    concern. Each qemu instance will get its own unique path and monitor. If a migration
>    fails, we can roll back.

No, you've not nullified the problem. This only helps the cases where
libvirt generates the path. This is only a subset of affected cases.
Just one example:

   <graphics type='vnc' socket='/some/path/QEMUGuest1-vnc.sock'>

there are many other parts of the domain XML that accept UNIX socket
paths where the mgmt app picks the socket path. Nothing is validating
this to prevent clashes between the src+dst QEMU on the same host,
meaning on migration rollback, src QEMU is broken.