Reinstate storage driver domain#7169
Open
MarkSymsCtx wants to merge 2 commits into
Open
Conversation
MarkSymsCtx
requested review from
LunfanZhang,
changlei-li,
cplaursen and
liulinC
July 9, 2026 08:05
Contributor
Author
|
This has completed XenRT BST 246161 with just a transient in-flight issue around new guest templates as well as specific Storage Driver Domain testing. |
psafont
reviewed
Jul 9, 2026
Contributor
|
What's the motivation and context behind this? Does something actually use non-dom0 storage domains? Are there plans for them? I'm wary of adding something that's going to sit unused and untested |
Contributor
Author
The gap was identified while performing feasibility study work for possible future storage implementations. We have (and have had for a good while) various bits of prototype code that use storage driver domain semantics as well as tests that can exercise it in XenRT. We have had more than one storage partner interested at various times about implementing something that would require or benefit from this functionality and sometimes it can just be a useful thing to takes something that is generically available as a Linux appliance and allow it to be used as a storage provider without needing to do a full rebuild of componentry or drivers into XenServer/XCP-ng. |
last-genius
requested changes
Jul 9, 2026
minglumlu
reviewed
Jul 10, 2026
minglumlu
reviewed
Jul 10, 2026
minglumlu
reviewed
Jul 10, 2026
minglumlu
reviewed
Jul 10, 2026
minglumlu
reviewed
Jul 15, 2026
MarkSymsCtx
force-pushed
the
reinstate_storage_driver_domain
branch
from
July 20, 2026 16:12
2a676b3 to
d546b17
Compare
Reinstate the storage driver domain capability removed in xapi-project#7033 (XSA-489 / CVE-2026-23561), which dropped recognition of the PBD.other_config:storage_driver_domain key, as a first-class, RBAC-protected field with the supporting runtime behaviour. - IDL: add a DynamicRO PBD.storage_driver_domain field (Ref VM; null means dom0) and a Pool-Admin-only PBD.set_storage_driver_domain message whose implementation rejects a value that does not reference an existing object (INVALID_VALUE) rather than silently storing an unresolvable ref. - system_domains.ml: resolve storage_driver_domain_of_pbd / _of_vbd / pbd_of_vm from the new field so storage_access.bind starts the driver domain and routes the SR backend RPC to it, as before the key was dropped. - xe CLI: expose storage-driver-domain in pbd_record (settable by VM uuid, null renders as OpaqueRef:NULL). - xapi_xenops.ml: a VM acting as a storage driver domain (i.e. referenced by some PBD's storage_driver_domain field) is created with ssidref 123000 and, unless platformdata already specifies one, max_maptrack_frames = 1024 so Xen permits it to map grant references from the VMs it is serving storage to. Other VMs are unchanged. - Add unit tests (ocaml/tests/test_pbd.ml): default-null, set/clear via Xapi_pbd.set_storage_driver_domain, and invalid-ref rejection. Bumps the datamodel schema version and hash accordingly. Signed-off-by: Mark Syms <mark.syms@citrix.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
MarkSymsCtx
force-pushed
the
reinstate_storage_driver_domain
branch
from
July 21, 2026 08:25
d546b17 to
e3f465a
Compare
last-genius
approved these changes
Jul 22, 2026
| ; `clean_reboot | ||
| ; `hard_reboot | ||
| ; `suspend | ||
| ; `checkpoint |
Contributor
There was a problem hiding this comment.
the commit message still says "checkpoint is unaffected"
A VM acting as a storage driver domain (referenced by one or more PBDs via PBD.storage_driver_domain) backs storage for the guests those PBDs serve. Disrupting or moving it breaks I/O for every VM it serves, so: - While any associated PBD is plugged, refuse clean/hard shutdown, clean/hard reboot, suspend, pause, and checkpoint. - Pin it to the host owning its PBD(s): it may only boot there. - Never allow it to migrate (pool_migrate / migrate_send), even when halted. The lifecycle guards live in Xapi_vm_lifecycle.check_operation_error, so they cover both VM.allowed_operations and the runtime assert_operation_valid used by every lifecycle call. The host pin is enforced in Xapi_vm_helpers.assert_can_boot_here (modelled on the existing control-domain affinity pin), and migration is additionally refused in Xapi_vm_migrate.assert_can_migrate. All blocks report OPERATION_NOT_ALLOWED with a descriptive message. Adds System_domains.pbds_of_vm / is_storage_driver_domain, and unit tests in ocaml/tests/test_pbd.ml. Signed-off-by: Mark Syms <mark.syms@citrix.com> Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
MarkSymsCtx
force-pushed
the
reinstate_storage_driver_domain
branch
from
July 22, 2026 13:46
e3f465a to
32c8ee9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.