From mboxrd@z Thu Jan  1 00:00:00 1970
From: Ian Campbell <Ian.Campbell@citrix.com>
Subject: Re: (4.5-rc1) Problems using xl migrate
Date: Mon, 24 Nov 2014 14:55:18 +0000
Message-ID: <1416840918.8878.4.camel@citrix.com>
References: <alpine.DEB.2.00.1411221847340.26346@procyon.dur.ac.uk>
	<20141124124143.GA11483@zion.uk.xensource.com>
	<54732F8E.4060507@citrix.com>
	<alpine.GSO.2.00.1411241430180.1328@algedi.dur.ac.uk>
	<547343F4.80509@citrix.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
In-Reply-To: <547343F4.80509@citrix.com>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Andrew Cooper <andrew.cooper3@citrix.com>, Daniel De Graaf <dgdegra@tycho.nsa.gov>
Cc: xen-devel@lists.xen.org, Wei Liu <wei.liu2@citrix.com>, M A Young <m.a.young@durham.ac.uk>
List-Id: xen-devel@lists.xenproject.org

On Mon, 2014-11-24 at 14:43 +0000, Andrew Cooper wrote:
> On 24/11/14 14:32, M A Young wrote:
> > On Mon, 24 Nov 2014, Andrew Cooper wrote:
> >> Is XSM in use?  I can't think of any other reason why that hypercall
> >> would fail with EPERM.
> >
> > XSM is built in (I wanted to allow the option of people using it) but
> > I didn't think it was active.
> 
> I don't believe there is any concept of "available but not active",

I think there is, the "dummy" policy which is loaded when there is no
explicit policy given should behave as if xsm were disabled. AIUI all
the XSM_* and xsm_default_action stuff is supposed to semi automatically
ensure this is the case at compile time. CC-ing Daniel to confirm/deny.

> which probably means that the default policy is missing an entry for
> this hypercall.

That said domctl is XSM_OTHER, which basically means "special one off
handling" I think. But it basically turns into XSM_DM_PRIV for a small
handful of subops and XSM_PRIV for the rest. Since this is a migration
the relevant domain is certainly PRIV I think.

Ian.

> Can you check the hypervisor console around this failure and see whether
> a flask error concerning domctl 72 is reported?
> 
> ~Andrew
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xen.org
> http://lists.xen.org/xen-devel