Re: [Xen-devel] can I boot privilleged dom like dom0 via xm create

[Mark Williamson <mark.williamson@xxxxxxxxxxxx>]

> But I have an another quesiton:
> I compared the configuration of xen, xen0 and xenU(the config file are in
> the directory named build-linux-2.6.18-xen/xen0/xenU_x86_32). As my
> expected, xen0 and xenU config the necessary devices they want and xen
> config more things such as more network options and others. But the size of
> the kernels is  below:
> *vmlinux-syms-2.6.18-xen    4080677*
> *vmlinux-syms-2.6.18-xen0  51225377*
> *vmlinux-syms-2.6.18-xenU 28080922*
> why the kernel, vmlinux-syms-2.6.18-xen, is the smallest? I think it may be
> largest.

The -xen0 kernel builds a load of drivers statically into the kernel, which is 
useful mainly for developers.  The -xen kernel builds those drivers as 
modules, which will be loaded later.  This makes the basic size of the kernel 
image smaller, although the modules that are loaded will take up some further 
space.  This approach avoids you wasting memory space on drivers you don't 
need.  The on disk space is probably bigger because the -xen config builds 
lots of drivers.

Cheers,
Mark

>
> Eager for your answering~
> Best wishes !
>
> Ruby Young
>
> On 6/19/08, Mark Williamson <mark.williamson@xxxxxxxxxxxx> wrote:
> > Ruby,
> >
> > Further to what Derek has said, I'd like to point out that what kernel
> > you use
> > never affects the privilege of the guest.
> >
> > All the -xen0 kernel name means is that the kernel /can/ do dom0
> > stuff.  This
> > is as opposed to a -xenU kernel, which has had the dom0 support removed
> > from
> > it.  Removing the dom0 support in a xenU kernel is done /only to make the
> > kernel smaller/.  It doesn't have any effect on security or privilege.
> >
> > Actually, most distributions seem to now supply one -xen kernel that is
> > used
> > both in dom0 and domU.
> >
> > This is because, as Derek mentioned, Xen enforces the privileges of
> > guests itself and doesn't have to trust their kernels.  This is different
> > to how User Mode Linux works, since in that system the kernel itself
> > enforces the virtual machine boundaries.  You can securely run any kernel
> > you want in a domU - even one supplied by the user - because Xen will
> > contain it.
> >
> > Cheers,
> > Mark
> >
> > > At present, there is no way to do this with xm. In the hypervisor,
> > > each struct domain has an is_privileged attribute (which is at present
> > > only set when dom0 is created at boot). You could add a domctl to
> > > control the setting of this bit, and then write a small C program that
> > > uses do_domctl from libxc to set the privilege on a domain.
> > >
> > > However, simply running two privileged domains with parallel sets of
> > > Xen tools is unlikely to work, for example because you will end up
> > > with two instances of XenStore.
> > >
> > > Regards,
> > >
> > > Derek Murray.
> > >
> > > 2008/6/13 ruby young <yangyang@xxxxxxxxxxxxxxx>:
> > > > Hi all,
> > > >     I'm using vmlinuz-2.6.18-xen0 as domU kernel and I boot it via xm
> > > > create. But the kernel didn't panic, it's running but all of xen
> > > > tools can not work. I am surprised at this.
> > > >     Now My question whether I can boot privilleged dom like dom0 via
> > > > xm create ? and how can I do it?
> > > >     I am looking forwards to your suggestions.
> > > >
> > > > Best wishes
> > > >
> > > >                                       Ruby Young
> >
> > -------------------------------------------------------------------------
> >
> > >------------------------------------------------------------------------
> > >--
> > >
> > > >------------------------------------------------ ææ
> > > > åäèçèåååèçæåéäççæççæ
> > > > çè:010-82338059-132
> > > > éä:9907yruby@xxxxxxxxx
> > > > ååïåäåææååéè37ååäèçèåååæäæ Gå1026
> >
> > -------------------------------------------------------------------------
> >
> > > >------- Yang Yang
> > > > Institute of Computer Architecture and System
> > > > BeiHang UniversityïBUAAï
> > > > Tel: (86-10)82338059-132
> > > > Email: 9907yruby@xxxxxxxxx
> > > > Addr: Room 1026,Building G,The New Main Building,37# Xueyuan
> >
> > Rd.,Haidian
> >
> > > > District, Beijing 100083, PRC
> > > > _______________________________________________
> > > > Xen-devel mailing list
> > > > Xen-devel@xxxxxxxxxxxxxxxxxxx
> > > > http://lists.xensource.com/xen-devel
> >
> > --
> > Push Me Pull You - Distributed SCM tool (
> > http://www.cl.cam.ac.uk/~maw48/pmpu/)



-- 
Push Me Pull You - Distributed SCM tool (http://www.cl.cam.ac.uk/~maw48/pmpu/)

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel