Xen users - Aug 2006 - DomU with modules?

Hi,

i''m about to play with Xen to get some experience. Then i''d
like to use
it on some kind of production machine. But i have a very basic question
on how you people out there solve the following:


1. do you always compile seperate kernels for Dom0 and DomU? What''s the
advantage?
2. I would like to compile the kernel for DomU with module support. The
problem is, of course, that the Guest OS does not have access to the
module files which lie in the FS of the Dom0 somewhere. So how can i
easily access the module files from the DomU? (i don''t want to copy
them
to the DomU''s FS - and Xen doesn''t hook into the
moudule-loading
mechanism, to load the files from the Dom0''s FS, does it?)
3. Is there some way to access files of Dom0 within the DomUs? Is there
some other way then NFS to do this?
4. any other tips you have?


Thanks,
  Sven



_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

Hi,
> 1. do you always compile seperate kernels for Dom0 and DomU?
What''s
> the
> advantage?
In theory, domU kernels don''t need many drivers at all, since they  
generally don''t have physical hardware access.  If you compile the  
kernels separately, your domU kernels can be quite small, which  
theoretically gives you a performance advantage.  I don''t know if  
there''s another advantage to the split compiling.

I always compile a single dom0/domU kernel, though; I''m not sure how  
big the benefit is.
> 2. I would like to compile the kernel for DomU with module support.  
> The
> problem is, of course, that the Guest OS does not have access to the
> module files which lie in the FS of the Dom0 somewhere. So how can i
> easily access the module files from the DomU? (i don''t want to
copy
> them
> to the DomU''s FS - and Xen doesn''t hook into the
moudule-loading
> mechanism, to load the files from the Dom0''s FS, does it?)
Xen doesn''t hook into Linux''s module-loading mechanism, at
least not
as far as I know.

Ideally, you do want to put the modules on the domU''s filesystem.  If  
you can''t do that, you could probably use an initrd image of some  
sort, if you only need to load modules at startup.  I''ve never done  
anything unusual with an initrd; I''m sure it could be made to work,  
but I''d have to tinker for a while to figure out how.

If you need to load/unload modules after startup, then you do need  
them on some filesystem that the domU can get at.  If you only need  
to load/unload a few modules, you could put them on the local  
filesystem and the others on an initrd.
> 3. Is there some way to access files of Dom0 within the DomUs? Is  
> there
> some other way then NFS to do this?
NFS seems to be the current standard.  Obviously, any traditional  
network filesystem can in theory be used; just network your domU''s.

A while ago, I read about an attempt to make a Xen-optimized  
filesystem to do exactly what you want.  I don''t know what''s
happened
with this project; maybe someone else on this list knows?
> 4. any other tips you have?
Be prepared to be patient; it works well, but it can have a fair bit  
of setup and debugging time, especially if you''re trying to do  
something unusual (I''ve had many hours of trouble with PCI Forwarding  
of on-motherboard devices and of graphics cards, for example).  Test  
out any new Xen feature before you rely on it for your production  
box; if a feature was just added to xen-unstable, it may well still  
be a bit unstable.

Adam

>
>
> Thanks,
>   Sven
>
> _______________________________________________
> Xen-users mailing list
> Xen-users@lists.xensource.com
> http://lists.xensource.com/xen-users

_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users

Adam Seering wrote:
>> 1. do you always compile seperate kernels for Dom0 and DomU?
What''s the
>> advantage?
> 
> In theory, domU kernels don''t need many drivers at all, since they
> generally don''t have physical hardware access.  If you compile the
> kernels separately, your domU kernels can be quite small, which
> theoretically gives you a performance advantage.  I don''t know if
> there''s another advantage to the split compiling.
A smaller domU kernel means less exploitable code, which is
theoretically a plus for security.

However, if you''re worried about that sort of thing you should really
be
focusing on having SELinux, RSBAC or PaX/GrSecurity in your domUs and dom0.
>> 3. Is there some way to access files of Dom0 within the DomUs? Is there
>> some other way then NFS to do this?
> A while ago, I read about an attempt to make a Xen-optimized filesystem
> to do exactly what you want.
That would be XenFS (http://wiki.xensource.com/xenwiki/XenFS), for
anyone who''s interested.

Cheers

Andrew



_______________________________________________
Xen-users mailing list
Xen-users@lists.xensource.com
http://lists.xensource.com/xen-users