From: Jason Andryuk <jandryuk@gmail.com>
To: "Marek Marczykowski-Górecki" <marmarek@invisiblethingslab.com>
Cc: Simon Gaiser <simon@invisiblethingslab.com>,
xen-devel <xen-devel@lists.xenproject.org>,
Wei Liu <wei.liu2@citrix.com>,
Ian Jackson <ian.jackson@eu.citrix.com>,
Eric Shelton <eshelton@pobox.com>
Subject: Re: [Xen-devel] [PATCH v4 00/16] Add support for qemu-xen runnning in a Linux-based stubdomain.
Date: Wed, 22 Jan 2020 11:50:33 -0500 [thread overview]
Message-ID: <CAKf6xpuZ6PDY-E9wAs=pkjU60bJOEirqzOQZTS7ahWNiFTAbkA@mail.gmail.com> (raw)
In-Reply-To: <cover.f819645cd9f5cf7a6f692f9661cfb4e670a2cd08.1579055705.git-series.marmarek@invisiblethingslab.com>
On Tue, Jan 14, 2020 at 9:42 PM Marek Marczykowski-Górecki
<marmarek@invisiblethingslab.com> wrote:
<snip>
> Later patches add QMP over libvchan connection support. The actual connection
> is made in a separate process. As discussed on Xen Summit 2019, this allows to
> apply some basic checks and/or filtering (not part of this series), to limit
> libxl exposure for potentially malicious stubdomain.
Thanks for working on this! I think the separate process is nicer.
> The actual stubdomain implementation is here:
>
> https://github.com/marmarek/qubes-vmm-xen-stubdom-linux
> (branch for-upstream, tag for-upstream-v3)
>
> See readme there for build instructions.
> Beware: building on Debian is dangerous, as it require installing "dracut",
> which will remove initramfs-tools. You may end up with broken initrd on
> your host.
Just as an FYI, Marek's use of dracut is mainly for dracut-install to
copy a binary & dependent libraries when generating the initramfs
(https://github.com/marmarek/qubes-vmm-xen-stubdom-linux/blob/master/rootfs/gen).
The initramfs isn't running dracut scripts. Using initramfs-tools
hook-functions:copy_exec() for similar functionality is a possibility.
> 1. There are extra patches for qemu that are necessary to run it in stubdomain.
> While it is desirable to upstream them, I think it can be done after merging
> libxl part. Stubdomain's qemu build will in most cases be separate anyway, to
> limit qemu's dependencies (so the stubdomain size).
A mostly unpatched QEMU works for networking & disk. The exception is
PCI passthrough, which needs some patches. I tested this by removing
patches from Marek's repo, except for the seccomp ones and
disable-nic-option-rom.patch. Without disable-nic-option-rom.patch,
QEMU fails to start with 'failed to find romfile "efi-rtl8139.rom"'
One issue I've noticed is QEMU ~4.1 calls getrandom() during startup.
In a stubdom there is insufficient entropy, so QEMU blocks and stubdom
startup times out. You can avoid getrandom() blocking with
CONFIG_RANDOM_TRUST_CPU or
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=50ee7529ec4500c88f8664560770a7a1b65db72b
or some other way of adding entropy.
Regards,
Jason
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
prev parent reply other threads:[~2020-01-22 16:50 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-15 2:39 [Xen-devel] [PATCH v4 00/16] Add support for qemu-xen runnning in a Linux-based stubdomain Marek Marczykowski-Górecki
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 01/16] Document ioemu MiniOS stubdomain protocol Marek Marczykowski-Górecki
2020-01-20 18:30 ` Jason Andryuk
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 02/16] Document ioemu Linux " Marek Marczykowski-Górecki
2020-01-20 18:54 ` Jason Andryuk
2020-01-21 21:08 ` Marek Marczykowski-Górecki
2020-01-22 14:04 ` Jason Andryuk
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 03/16] libxl: fix qemu-trad cmdline for no sdl/vnc case Marek Marczykowski-Górecki
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 04/16] libxl: Allow running qemu-xen in stubdomain Marek Marczykowski-Górecki
2020-01-20 18:56 ` Jason Andryuk
2020-01-21 21:12 ` Marek Marczykowski-Górecki
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 05/16] libxl: Handle Linux stubdomain specific QEMU options Marek Marczykowski-Górecki
2020-01-20 19:24 ` Jason Andryuk
2020-01-21 21:18 ` Marek Marczykowski-Górecki
2020-01-22 14:25 ` Jason Andryuk
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 06/16] libxl: write qemu arguments into separate xenstore keys Marek Marczykowski-Górecki
2020-01-20 19:36 ` Jason Andryuk
2020-01-21 21:19 ` Marek Marczykowski-Górecki
2020-01-22 14:39 ` Jason Andryuk
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 07/16] xl: add stubdomain related options to xl config parser Marek Marczykowski-Górecki
2020-01-20 19:41 ` Jason Andryuk
2020-01-21 21:22 ` Marek Marczykowski-Górecki
2020-01-22 14:39 ` Jason Andryuk
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 08/16] tools/libvchan: notify server when client is connected Marek Marczykowski-Górecki
2020-01-20 19:44 ` Jason Andryuk
2020-01-21 21:28 ` Marek Marczykowski-Górecki
2020-01-22 14:43 ` Jason Andryuk
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 09/16] libxl: add save/restore support for qemu-xen in stubdomain Marek Marczykowski-Górecki
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 10/16] tools: add missing libxenvchan cflags Marek Marczykowski-Górecki
2020-01-20 19:58 ` Jason Andryuk
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 11/16] tools: add simple vchan-socket-proxy Marek Marczykowski-Górecki
2020-01-15 11:02 ` Jan Beulich
2020-01-16 17:11 ` Marek Marczykowski-Górecki
2020-01-17 8:13 ` Jan Beulich
2020-01-17 18:44 ` Rich Persaud
2020-01-17 18:56 ` Marek Marczykowski-Górecki
2020-01-21 19:43 ` Jason Andryuk
2020-01-21 23:09 ` Marek Marczykowski-Górecki
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 12/16] libxl: use vchan for QMP access with Linux stubdomain Marek Marczykowski-Górecki
2020-01-21 20:17 ` Jason Andryuk
2020-01-21 23:46 ` Marek Marczykowski-Górecki
2020-01-24 14:05 ` Jason Andryuk
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 13/16] Regenerate autotools files Marek Marczykowski-Górecki
2020-01-15 21:57 ` Rich Persaud
2020-01-21 20:56 ` Marek Marczykowski-Górecki
2020-01-21 21:28 ` Rich Persaud
2020-01-22 8:57 ` Lars Kurth
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 14/16] libxl: require qemu in dom0 even if stubdomain is in use Marek Marczykowski-Górecki
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 15/16] libxl: ignore emulated IDE disks beyond the first 4 Marek Marczykowski-Górecki
2020-01-21 20:24 ` Jason Andryuk
2020-01-15 2:39 ` [Xen-devel] [PATCH v4 16/16] libxl: consider also qemu in stubdomain in libxl__dm_active check Marek Marczykowski-Górecki
2020-01-21 20:25 ` Jason Andryuk
2020-01-22 16:50 ` Jason Andryuk [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAKf6xpuZ6PDY-E9wAs=pkjU60bJOEirqzOQZTS7ahWNiFTAbkA@mail.gmail.com' \
--to=jandryuk@gmail.com \
--cc=eshelton@pobox.com \
--cc=ian.jackson@eu.citrix.com \
--cc=marmarek@invisiblethingslab.com \
--cc=simon@invisiblethingslab.com \
--cc=wei.liu2@citrix.com \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).