netdev - Re: vsock CID questions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 25 Feb 2020 12:30:10 +0100
From:   Ján Tomko <jtomko@...hat.com>
To:     ted.h.kim@...cle.com
Cc:     Stefan Hajnoczi <stefanha@...hat.com>, sgarzare@...hat.com,
        netdev@...r.kernel.org,
        Boris Ostrovsky <boris.ostrovsky@...cle.com>
Subject: Re: vsock CID questions

On Fri, Feb 21, 2020 at 11:49:06AM -0800, ted.h.kim@...cle.com wrote:
>Hi Jan,
>
>Thanks for responding - let me see if I am understanding correctly.
>
>
>I think you are saying on migration the process of determining the CID 
>assigned is the same as when you start a domain.
>
><cid auto='yes'> means assignment to the first available value.
>It also seems for auto='yes' that any address='<value>' part of the 
>CID definition is ignored, even as a suggested value.
>(I always get CID 3 when starting auto='yes' and no other domains have 
>started, even if there is an specific address in the definition, e.g. 
>address='12'.)
>
>But if auto='no', either the domain gets the address field value or if 
>the value is already assigned, the domain will fail to start/migrate.
>
>Is that right?
>

Yes.

>
>In cases, where auto='yes', it does not seem that the host/hypervisor 
>can find out what CID value was assigned to a domain. Even parsing the 
>XML only reveals that it was auto-assigned and no specific value can 
>be determined.

The value is not recorded in the inactive XML, but after domain startup,
the address should be visible in the live XML:

   <vsock model="virtio">
     <cid auto="yes" address="3"/>
     <alias name="vsock0"/>
     <address type="pci" domain="0x0000" bus="0x07" slot="0x00" function="0x0"/>
   </vsock>

>
>Is this correct?
>
>If this is the case, I would advocate for a specific API which can 
>lookup the current CID of a domain.

This can already be queried from the XML through virDomainGetXMLDesc:
$ virsh dumpxml libvirt-fedora-31 | xmllint --xpath 'string(//cid/@...ress)' -
3

Jano

>Otherwise the host/hypervisor cannot tell which  auto='yes' domain is 
>on the other end of the connected socket, when there is more than one.
>
>
>Thanks.
>-ted
>
>

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)