Re: [PATCH v2 02/17] xsm/silo: Support hardware & xenstore domains

[Jan Beulich <jbeulich@xxxxxxxx>]

On 16.07.2025 23:14, Jason Andryuk wrote:
> In a disaggregated environment, dom0 is split into Control, Hardware,
> and Xenstore domains, along with domUs.

Here we are with terminology again. In a truly disaggregated env, yet
more (service) domains would come into play. What you mean here is
only coarse disaggregation, as you're trying to get away without using
Flask.

>  The is_control_domain() check
> is not sufficient to handle all these cases.  Add is_priv_domain() to
> support allowing for the various domains.
> 
> The purpose of SILO mode is to prevent domUs from interacting with each
> other.  But dom0 was allowed to communicate with domUs to provide
> services.
> 
> To provide xenstore connections, the Xenstore domain must be allowed to
> connect via grants and event channels.  Xenstore domain must also be
> allowed to connect to Control and Hardware to provide xenstore to them.
> 
> Hardware domain will provide PV devices to domains, so it must be
> allowed to connect to domains.
> 
> That leaves Control.  Xenstore and Hardware would already allow access
> to Control, so it can obtain services that way.  Control should be
> "privileged", which would mean it can make the connections.  But with
> Xenstore and Hardware providing their services to domUs, there may not
> be a reason to allow Control to use grants or event channels with domUs.

"may not be" is too weak for my taste to forbid such.

> This silo check is for grants, event channels and argo.  The dummy
> policy handles other calls, so Hardware is prevented from foreign
> mapping Control's memory with that.

By "foreign mapping" you only mean what would result in p2m_foreign
entries? But grant mapping is okay?

> @@ -29,8 +40,8 @@ static bool silo_mode_dom_check(const struct domain *ldom,
>  {
>      const struct domain *currd = current->domain;
>  
> -    return (is_control_domain(currd) || is_control_domain(ldom) ||
> -            is_control_domain(rdom) || ldom == rdom);
> +    return (is_priv_domain(currd) || is_priv_domain(ldom) ||
> +            is_priv_domain(rdom) || ldom == rdom);
>  }

IOW we're turning by 180°? Interesting ...

Jan