Re: [PATCH 0/7] Optionally add libvchan to stubdom

[Daniel De Graaf <dgdegra@tycho.nsa.gov>]

On 04/26/2013 11:03 AM, Ian Campbell wrote:
> The maintainers for most of this code are Samuel (stubdoms) and Daniel
> (libvchan). I've CCd them both.
>
> I assume this isn't being proposed for 4.3 at this stage?
>
> On Fri, 2013-04-26 at 15:45 +0100, Marek Marczykowski wrote:
>> This patch series enhances stubdomain with libvchan. It is disabled by default,
>> but can be easily enabled in mini-os.cfg when needed.
>> In order to do so, some parts of minios needs to be extended:
>>   - xenstore (to support transactions)
>>   - libxc - to support xc_gntshr
>>
>> This series assumes "libxc: fix xc_gntshr_munmap" already applied.
>>
>> One unsolved problem is implementation of xc_gntshr_share_page_notify. On Linux,
>> there is kernel, which can notify remote in case of server process death. In
>> stubdom there is no such place - if exit() is called anywhere, the whole
>> stubdom is terminated. Also the common case is stubdom destruction (the case
>> for ioemu stubdom - it is destroyed by toolstack at domain shutdown), I don't
>> know if stubdom even support clean shutdown.

This also mirrors the case where the Linux kernel running a libvchan process has
a crash: there is no way for notification to happen in that case.

>> Anyway I can implement some notification (which needs some additional info
>> stored by minios version of gnttab), just for clean libxenvchan_close(). But it
>> is rather rare case.

If it's not already done, the close function should do the byte clear on its own so
that a mini-os application doing a proper teardown (perhaps using atexit to handle
calls to exit()) would notify the other end the same way as a process under Linux.

>> Some workaround can be checking for domain state at client side, but IMHO it
>> isn't the best way (although still used in original Qubes OS vchan version).
>> Any ideas?

The only way to properly handle a domain crash on the other side is to watch for
that - probably via xenstore watches. This all depends on what exactly the vchan
is being used for - a domain crashing may trigger other actions that cause the
vchan client to be notified independent of the vchan's own notifications.

>> Patch 2 is independent - should be also useful for normal Linux case.

I think just this patch may have reason to go in 4.3, especially if you have
something that would see the race condition it fixes.  You'll need to discuss
that more with George, however.

>> Marek Marczykowski (7):
>>    minios: enhance xenstore available for stubdoms
>>    libvchan: create xenstore entries in one transaction
>>    libvchan: remove unnecessary includes
>>    minios: add gnttab_find_grant_of_page
>>    libxc: implement gntshr for minios
>>    stubdom: make libvchan available in stubdom
>>    libvchan: do not use xc_gntshr_share_page_notify in Mini-OS
>>

-- 
Daniel De Graaf
National Security Agency