[PATCH v2] tools/hotplug: Don't ever kill xenstored

[PATCH v2] tools/hotplug: Don't ever kill xenstored

[Ross Lagerwall]

Don't kill xenstored as part of the usual service shutdown process to
prevent hangs on shutdown where the kernel tries to unplug a VIF
after xenstored has exited.

In an ideal case with all guests cooperating, xendomains will have shut
down all guests before xenstored is killed.

However in the uncooperative case, malicious or crashed guests may still
be running after xendomains has exited and this should not block the
shutdown/reboot of dom0.

Xenstored has no state to sync to disk, and never used to be killed in
the sysvinit case; observe the warning in xencommons.  Our testing has
shown regressions caused by the change in behaviour between sysvinit and
systemd when it comes to killing xenstored.

Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
---
KillMode=none is definitely available in at least systemd v208.

Changed in v2: Added justification of change.

 tools/hotplug/Linux/systemd/xenstored.service.in | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tools/hotplug/Linux/systemd/xenstored.service.in b/tools/hotplug/Linux/systemd/xenstored.service.in
index 0f0ac58..a5f836b 100644
--- a/tools/hotplug/Linux/systemd/xenstored.service.in
+++ b/tools/hotplug/Linux/systemd/xenstored.service.in
@@ -8,6 +8,7 @@ ConditionPathExists=/proc/xen/capabilities
 
 [Service]
 Type=notify
+KillMode=none
 Environment=XENSTORED_ARGS=
 Environment=XENSTORED=@XENSTORED@
 EnvironmentFile=-@CONFIG_DIR@/@CONFIG_LEAF_DIR@/xencommons
-- 
2.1.0

Re: [PATCH v2] tools/hotplug: Don't ever kill xenstored

[Wei Liu]

On Tue, Feb 24, 2015 at 08:05:50AM +0000, Ross Lagerwall wrote:
> Don't kill xenstored as part of the usual service shutdown process to
> prevent hangs on shutdown where the kernel tries to unplug a VIF
> after xenstored has exited.
> 
> In an ideal case with all guests cooperating, xendomains will have shut
> down all guests before xenstored is killed.
> 
> However in the uncooperative case, malicious or crashed guests may still
> be running after xendomains has exited and this should not block the
> shutdown/reboot of dom0.
> 
> Xenstored has no state to sync to disk, and never used to be killed in
> the sysvinit case; observe the warning in xencommons.  Our testing has
> shown regressions caused by the change in behaviour between sysvinit and
> systemd when it comes to killing xenstored.
> 
> Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>

Acked-by: Wei Liu <wei.liu2@citrix.com>

> ---
> KillMode=none is definitely available in at least systemd v208.
> 
> Changed in v2: Added justification of change.
> 
>  tools/hotplug/Linux/systemd/xenstored.service.in | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/tools/hotplug/Linux/systemd/xenstored.service.in b/tools/hotplug/Linux/systemd/xenstored.service.in
> index 0f0ac58..a5f836b 100644
> --- a/tools/hotplug/Linux/systemd/xenstored.service.in
> +++ b/tools/hotplug/Linux/systemd/xenstored.service.in
> @@ -8,6 +8,7 @@ ConditionPathExists=/proc/xen/capabilities
>  
>  [Service]
>  Type=notify
> +KillMode=none
>  Environment=XENSTORED_ARGS=
>  Environment=XENSTORED=@XENSTORED@
>  EnvironmentFile=-@CONFIG_DIR@/@CONFIG_LEAF_DIR@/xencommons
> -- 
> 2.1.0

Re: [PATCH v2] tools/hotplug: Don't ever kill xenstored

[Ian Campbell]

On Tue, 2015-02-24 at 11:45 +0000, Wei Liu wrote:
> On Tue, Feb 24, 2015 at 08:05:50AM +0000, Ross Lagerwall wrote:
> > Don't kill xenstored as part of the usual service shutdown process to
> > prevent hangs on shutdown where the kernel tries to unplug a VIF
> > after xenstored has exited.
> > 
> > In an ideal case with all guests cooperating, xendomains will have shut
> > down all guests before xenstored is killed.
> > 
> > However in the uncooperative case, malicious or crashed guests may still
> > be running after xendomains has exited and this should not block the
> > shutdown/reboot of dom0.
> > 
> > Xenstored has no state to sync to disk, and never used to be killed in
> > the sysvinit case; observe the warning in xencommons.  Our testing has
> > shown regressions caused by the change in behaviour between sysvinit and
> > systemd when it comes to killing xenstored.
> > 
> > Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
> 
> Acked-by: Wei Liu <wei.liu2@citrix.com>

Thanks. I added "systemd: " to the subject and applied.

Re: [PATCH v2] tools/hotplug: Don't ever kill xenstored

[Ian Campbell]

On Tue, 2015-02-24 at 11:45 +0000, Wei Liu wrote:
> On Tue, Feb 24, 2015 at 08:05:50AM +0000, Ross Lagerwall wrote:
> > Don't kill xenstored as part of the usual service shutdown process to
> > prevent hangs on shutdown where the kernel tries to unplug a VIF
> > after xenstored has exited.
> > 
> > In an ideal case with all guests cooperating, xendomains will have shut
> > down all guests before xenstored is killed.
> > 
> > However in the uncooperative case, malicious or crashed guests may still
> > be running after xendomains has exited and this should not block the
> > shutdown/reboot of dom0.
> > 
> > Xenstored has no state to sync to disk, and never used to be killed in
> > the sysvinit case; observe the warning in xencommons.  Our testing has
> > shown regressions caused by the change in behaviour between sysvinit and
> > systemd when it comes to killing xenstored.
> > 
> > Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
> 
> Acked-by: Wei Liu <wei.liu2@citrix.com>

Thanks. I added "systemd: " to the subject and applied.