Re: Buggy interaction of live migration and p2m updates

[Andrew Cooper <andrew.cooper3@citrix.com>]

On 01/12/14 14:38, David Vrabel wrote:
> On 20/11/14 18:28, Andrew Cooper wrote:
>> 1) Freeze the guests p2m during live migrate
>> 2) Deep p2m dirty tracking
>> 3) Eagerly check for p2m structure changes.
>> 4) Request p2m structure change updates from the guest
>> Proposed solution:  A combination of 2, 3 and 4.
> Option 5: don't change anything.  PV guests and toolstacks are
> well-behaved and ensure that p2m updates do not occur during domain save.

We are currently relying on this is true, knowing full well that it
isn't in practice.  Guest balloon drivers will happily balloon if told
to do so by the toolstack at the same point that the domain is going
down for migrate.

Even at the moment, if the toolstack observes the intermediate actions
of a grant being unmapped, the migration will either be aborted, or VM
corruption will occur on the far side.

>
> We have never supported migrating non-cooperative PV guests.

We will never be in the position to migrate a non-cooperative PV domain,
as the final action it needs to do is stuff an MFN in %rdx, to be
replaced on the far side.

>
> I'd be more interested fixing this for HVM guests.

Agreed, and the HVM case is easier to fix.  I am fairly certain the HVM
side can be fixed with a few extra paging_mark_dirty() for p2m updates
in Xen alone. The PV case is however a timebomb waiting to happen.

~Andrew