Re: [PATCH v8 3/3] xen/domain: introduce CONFIG_MAX_DOMID

[dmkhn@xxxxxxxxx]

On Wed, May 21, 2025 at 09:31:34AM +0200, Jan Beulich wrote:
> On 21.05.2025 02:00, dmkhn@xxxxxxxxx wrote:
> > --- a/xen/arch/arm/tee/ffa.c
> > +++ b/xen/arch/arm/tee/ffa.c
> > @@ -331,10 +331,9 @@ static int ffa_domain_init(struct domain *d)
> >       * reserved for the hypervisor and we only support secure endpoints 
> > using
> >       * FF-A IDs with BIT 15 set to 1 so make sure those are not used by 
> > Xen.
> >       */
> > -    BUILD_BUG_ON(DOMID_FIRST_RESERVED >= UINT16_MAX);
> 
> Why's this being moved to common code? It certainly may have a purpose here
> (which I'm simply unaware of); I don't see what purpose it has in common
> code.

My understanding having DOMID_FIRST_RESERVED compile-time checks in one place
is good for testability: the check in question also applies to x86.

I will drop that hunk.

> 
> > --- a/xen/common/Kconfig
> > +++ b/xen/common/Kconfig
> > @@ -576,4 +576,11 @@ config BUDDY_ALLOCATOR_SIZE
> >       Amount of memory reserved for the buddy allocator to serve Xen heap,
> >       working alongside the colored one.
> >
> > +config MAX_DOMID
> > +   int "Maximum number of user domains"
> > +   range 1 32752
> > +   default 32752
> > +   help
> > +     Specifies the maximum number of domains a user can create.
> 
> My prior comment remains: The description and help needs to be accurate, in
> order to not cause any confusion. In a true dom0less environment I'm not
> sure the "user" can create any domains (post boot, that is). And when there
> is Dom0 (or late hwdom), the number specified already isn't the number of
> domains one can create (again, post boot, which is how I understand "user
> domains"). If someone picked 1 as the value here, it's unclear to me how
> late hwdom or dom0less would work in the first place.

Do you think something like the following will be more accurate?

    config MAX_DOMID
       int "Maximum number of domains"
       range 1 32752
       default 32752
       help
         Specifies the maximum number of domains: dom0 or late hwdom,
         predefined domains, post-boot domains, excluding Xen system domains
         (domid >= DOMID_FIRST_RESERVED).

> 
> > --- a/xen/include/public/domctl.h
> > +++ b/xen/include/public/domctl.h
> > @@ -36,7 +36,7 @@
> >
> >  /*
> >   * NB. xen_domctl.domain is an IN/OUT parameter for this operation.
> > - * If it is specified as an invalid value (0 or >= DOMID_FIRST_RESERVED),
> > + * If it is specified as an invalid value (0 or >= CONFIG_MAX_DOMID),
> 
> In the public interface I question the relevance of any implementation
> details of the hypervisor.

Ack, will revert.

> 
> Jan
>