[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [PATCH 11/23] tools/xenstored: Automatically set dom0_domid and priv_domid


  • To: Jürgen Groß <jgross@xxxxxxxx>, <xen-devel@xxxxxxxxxxxxxxxxxxxx>
  • From: Jason Andryuk <jason.andryuk@xxxxxxx>
  • Date: Mon, 10 Mar 2025 10:32:26 -0400
  • Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=suse.com smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0)
  • Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=z8a8nN3U5REsUOFV2dDFaUPEshc1rekuI8d8M5EUaMs=; b=eZ02uh5bz0KqadR02VXjTzqCxBwHLzRpzFFxlwJatFVWYLLrEwKgYGOi76lTztH3KIgyRgu4ZgxrM6Wm2wWXzgtBdSsfQZVErSNF1e9lJduttxsIO+ACMo1Z5PuI7/vbamdXRSCXTFf05JOkvxzg3j90oeViRdjy17x+8teh8QObgEBFtQSCTwLiXrR0Kc+g0ftxZ4ixmY0yL/ruDYmeLivNYxo5dKCMtEH8FrfhGZ36QYOqZi0Y7vB565E9CzLe/6tRnOYHtbkwH8kuqbqeSyqhb6//x1ua6azTxw8AZlPUkc17te4RLnKgL12xMdj5l9M2En61t1k36wQuF5Ht1w==
  • Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=VzzSP3ZgUyVVTJt+FsjAjB1B0kJvTYNrBKQEp0exk1hkf1frReY43MBRsolaXyBEhwECNelA4cShhFZqb40IOPfh90ngYsmIqPUoy+w8upOOaympvnIenhtV5vSVOtZYiJnnCwFraHnsdCr9eQob61lDd9fkfv3XOQswCFG1+uLlDIc7LYoxumnGn9+CJwxzykx9PaCSkaD21JkSstVMSL0cmLx8TFIiHIJDuanlt7iQGv/YQON4mB/J70ZAgzA782JYuAeZgpiFBUTns2I95hYueNQk/wIoTtrsY+jI8X7HMEAFdlSwfLuEje88wabDjmrl0Km+K0xqrC/f5wUjJQ==
  • Cc: Julien Grall <julien@xxxxxxx>, Anthony PERARD <anthony.perard@xxxxxxxxxx>
  • Delivery-date: Mon, 10 Mar 2025 14:32:39 +0000
  • List-id: Xen developer discussion <xen-devel.lists.xenproject.org>



On 2025-03-08 02:02, Jürgen Groß wrote:
On 06.03.25 23:03, Jason Andryuk wrote:
With split hardware and control domains, each domain should be
privileged with respect to xenstore.  When adding domains to xenstore,
look at their privilege and add them to xenstored as appropriate.
dom0_domid is used for the hardware domain, and priv_domid is used for a
control domain.

Only one of each is allowed for now.

Signed-off-by: Jason Andryuk <jason.andryuk@xxxxxxx>
---
  tools/xenstored/domain.c | 16 ++++++++++++++++
  1 file changed, 16 insertions(+)

diff --git a/tools/xenstored/domain.c b/tools/xenstored/domain.c
index 64c8fd0cc3..f2394cd6e9 100644
--- a/tools/xenstored/domain.c
+++ b/tools/xenstored/domain.c
@@ -795,6 +795,20 @@ static struct domain *find_or_alloc_existing_domain(unsigned int domid)
      return domain;
  }
+static void domain_set_privileged(struct domain *domain)
+{
+    xc_domaininfo_t dominfo;
+
+    if ( !get_domain_info(domain->domid, &dominfo) )
+        return;
+
+    if ( dominfo.flags & XEN_DOMINF_priv )
+        priv_domid = domain->domid;
+
+    if ( dominfo.flags & XEN_DOMINF_hardware )
+        dom0_domid = domain->domid;
+}

Please no use of libxenctrl. I have worked hard to eliminate the usage
in order to enable a xenstore-stubdom being used across Xen versions
(C Xenstore is relying on stable hypercalls only now).

Right.  Yes, nice work on switching to stable hypercalls.

You need to add the needed flags to the rather new stable domctl
XEN_DOMCTL_get_domain_state and to libxenmanage.

Ok.

+
  static int new_domain(struct domain *domain, int port, bool restore)
  {
      int rc;
@@ -831,6 +845,8 @@ static int new_domain(struct domain *domain, int port, bool restore)
      domain->conn->domain = domain;
      domain->conn->id = domain->domid;
+    domain_set_privileged(domain);

The name implies you are changing the domain to be privileged, but this
is done conditionally only.

Maybe name the function domain_apply_privileges()?

I'm thinking domain_apply_capabilities() since they are being referred to as capabilities.

But I'll have to revisit this. To make xenstored "just work" when domid != 0, it should auto-detect its domain id, and that has to be done earlier than this.

Regards,
Jason




 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.