wikisrc/ports/xen/howto.mdwn - diff

Return to howto.mdwn CVS log

Up to [NetBSD Developer Wiki] / wikisrc / ports / xen

Diff for /wikisrc/ports/xen/howto.mdwn between versions 1.157 and 1.182

version 1.157, 2018/08/27 16:54:42	version 1.182, 2020/11/15 14:47:55
Line 8 systems which operate in an unprivileged	Line 8 systems which operate in an unprivileged
from the domU systems are forwarded by the Xen hypervisor to the dom0 to be	from the domU systems are forwarded by the Xen hypervisor to the dom0 to be
fulfilled.	fulfilled.

Xen supports different styles of guest:	This HOWTO presumes a basic familiarity with the Xen system
	architecture, with installing NetBSD on amd64 hardware, and with
	installing software from pkgsrc. See also the [Xen
	website](http://www.xenproject.org/).

	[[!toc]]

	# Overview: Versions of Xen, Styles, NetBSD

	The basic concept of Xen is that the hypervisor (xenkernel) runs on
	the hardware, and runs a privileged domain ("dom0") that can access
	disks/networking/etc. One then runs additonal unprivileged domains
	(each a "domU"), presumably to do something useful.

	This HOWTO addresses how to run a NetBSD dom0 (and hence also build
	xen itself). It also addresses how to run domUs in that environment,
	and how to deal with having a domU in a Xen environment run by someone
	else and/or not running NetBSD.

	## Guest Styles

	Xen supports different styles of guests.

[[!table data="""	[[!table data="""
Style of guest \|Supported by NetBSD	Style of guest \|Supported by NetBSD
PV \|Yes (dom0, domU)	PV \|Yes (dom0, domU)
HVM \|Yes (domU)	HVM \|Yes (domU)
PVHVM \|No	PVHVM \|current-only (domU)
PVH \|No	PVH \|current-only (domU, dom0 not yet)
"""]]	"""]]

In Para-Virtualized (PV) mode, the guest OS does not attempt to access	In Para-Virtualized (PV) mode, the guest OS does not attempt to access
hardware directly, but instead makes hypercalls to the hypervisor; PV	hardware directly, but instead makes hypercalls to the hypervisor; PV
guests must be specifically coded for Xen. In HVM mode, no guest	guests must be specifically coded for Xen.
modification is required; however, hardware support is required, such	See [PV](https://wiki.xen.org/wiki/Paravirtualization_(PV\)).
as VT-x on Intel CPUs and SVM on AMD CPUs.
	In HVM mode, no guest modification is required; however, hardware
	support is required, such as VT-x on Intel CPUs and SVM on AMD CPUs.
	The dom0 runs qemu to emulate hardware.

	In PVHVM mode, the guest runs as HVM, but additionally can use PV
	drivers for efficiency.
	See [PV on HVM](https://wiki.xen.org/wiki/PV_on_HVM).

	There have been two PVH modes: original PVH and PVHv2. Original PVH
	was based on PV mode and is no longer relevant at all. PVHv2 is
	basically lightweight HVM with PV drivers. A critical feature of it
	is that qemu is not needed; the hypervisor can do the emulation that
	is required. Thus, a dom0 can be PVHv2.
	The source code uses PVH and config files use pvh; this refers to PVHv2.
	See [PVH(v2)](https://wiki.xenproject.org/wiki/PVH_(v2\)_Domu).

At boot, the dom0 kernel is loaded as a module with Xen as the kernel.
	At system boot, the dom0 kernel is loaded as a module with Xen as the kernel.
The dom0 can start one or more domUs. (Booting is explained in detail	The dom0 can start one or more domUs. (Booting is explained in detail
in the dom0 section.)	in the dom0 section.)

This HOWTO presumes a basic familiarity with the Xen system	## CPU Architecture
architecture, with installing NetBSD on i386/amd64 hardware, and with
installing software from pkgsrc. See also the [Xen	Xen runs on x86_64 hardware (the NetBSD amd64 port).
website](http://www.xenproject.org/).

This HOWTO attempts to address both the case of running a NetBSD dom0	There is a concept of Xen running on ARM, but there are no reports of this working with NetBSD.
on hardware and running domUs under it (NetBSD and other), and also
running NetBSD as a domU in a VPS.

Versions and Support	The dom0 system should be amd64. (Instructions for i386PAE dom0 have been removed from the HOWTO.)
====================
	The domU can be i386PAE or amd64.
	i386PAE at one point was considered as [faster](https://lists.xen.org/archives/html/xen-devel/2012-07/msg00085.html) than amd64.

	## Xen Versions

In NetBSD, Xen is provided in pkgsrc, via matching pairs of packages	In NetBSD, Xen is provided in pkgsrc, via matching pairs of packages
xenkernel and xentools. We will refer only to the kernel versions,	xenkernel and xentools. We will refer only to the kernel versions,
Line 48 matching versions.	Line 86 matching versions.
Versions available in pkgsrc:	Versions available in pkgsrc:

[[!table data="""	[[!table data="""
Xen Version \|Package Name \|Xen CPU Support \|EOL'ed By Upstream	Xen Version \|Package Name \|Xen CPU Support \|xm? \|EOL'ed By Upstream
4.2 \|xenkernel42 \|32bit, 64bit \|Yes	4.11 \|xenkernel411 \|x86_64 \| \|No
4.5 \|xenkernel45 \|64bit \|Yes	4.13 \|xenkernel413 \|x86_64 \| \|No
4.6 \|xenkernel46 \|64bit \|Partially
4.8 \|xenkernel48 \|64bit \|No
4.11 \|xenkernel411 \|64bit \|No
"""]]	"""]]

See also the [Xen Security Advisory page](http://xenbits.xen.org/xsa/).	See also the [Xen Security Advisory page](http://xenbits.xen.org/xsa/).
Line 66 dom0 \|No	Line 101 dom0 \|No
domU \|Yes	domU \|Yes
"""]]	"""]]

Note: NetBSD support is called XEN3. However, it does support Xen 4,	Note: NetBSD support is called XEN3. However, it does support Xen 4,
because the hypercall interface has remained identical.	because the hypercall interface has remained identical.

Architecture	Older Xen had a python-based management tool called xm, now replaced
------------	by xl.

Xen itself runs on x86_64 hardware.

The dom0 system, plus each domU, can be either i386PAE or amd64.
i386 without PAE is not supported.

The standard approach is to use NetBSD/amd64 for the dom0.

To use an i386PAE dom0, one must build or obtain a 64bit Xen kernel and	# Creating a dom0
install it on the system.

For domUs, i386PAE is considered as	In order to install a NetBSD as a dom0, one must first install a normal
[faster](https://lists.xen.org/archives/html/xen-devel/2012-07/msg00085.html)	NetBSD system, and then pivot the install to a dom0 install by changing
than amd64.	the kernel and boot configuration.

NetBSD as a dom0
================

NetBSD can be used as a dom0 and works very well. The following
sections address installation, updating NetBSD, and updating Xen.

Note that it doesn't make sense to talk about installing a dom0 OS
without also installing Xen itself. We first address installing
NetBSD, which is not yet a dom0, and then adding Xen, pivoting the
NetBSD install to a dom0 install by just changing the kernel and boot
configuration.

In 2018-05, trouble booting a dom0 was reported with 256M of RAM: with	In 2018-05, trouble booting a dom0 was reported with 256M of RAM: with
512M it worked reliably. This does not make sense, but if you see	512M it worked reliably. This does not make sense, but if you see
"not ELF" after Xen boots, try increasing dom0 RAM.	"not ELF" after Xen boots, try increasing dom0 RAM.

Styles of dom0 operation	## Installation of NetBSD
------------------------

There are two basic ways to use Xen. The traditional method is for
the dom0 to do absolutely nothing other than providing support to some
number of domUs. Such a system was probably installed for the sole
purpose of hosting domUs, and sits in a server room on a UPS.

The other way is to put Xen under a normal-usage computer, so that the
dom0 is what the computer would have been without Xen, perhaps a
desktop or laptop. Then, one can run domUs at will.

Installation of NetBSD
----------------------

[Install NetBSD/amd64](/guide/inst/)	[Install NetBSD/amd64](/guide/inst/)
just as you would if you were not using Xen.	just as you would if you were not using Xen.

Installation of Xen	## Installation of Xen
-------------------

We will consider that you chose to use Xen 4.8, with NetBSD/amd64 as	We will consider that you chose to use Xen 4.13, with NetBSD/amd64 as
dom0. In the dom0, install xenkernel48 and xentools48 from pkgsrc.	dom0. In the dom0, install xenkernel48 and xentools48 from pkgsrc.
Ensure that your packages are recent.

Once this is done, install the Xen kernel itself:	Once this is done, install the Xen kernel itself:

Line 133 Once this is done, install the Xen kerne	Line 133 Once this is done, install the Xen kerne
# cp /usr/pkg/xen48-kernel/xen.gz /	# cp /usr/pkg/xen48-kernel/xen.gz /
"""]]	"""]]

Then, place a NetBSD XEN3_DOM0 kernel in the `/` directory, copied from	Then, place a NetBSD XEN3_DOM0 kernel in the `/` directory. Such kernel
`releasedir/amd64/binary/kernel/netbsd-XEN3_DOM0.gz` of a NetBSD build.	can either be compiled manually, or downloaded from the NetBSD FTP, for
	example at:

	[[!template id=programlisting text="""
	ftp.netbsd.org/pub/NetBSD/NetBSD-8.0/amd64/binary/kernel/netbsd-XEN3_DOM0.gz
	"""]]

Add a line to /boot.cfg to boot Xen:	Add a line to /boot.cfg to boot Xen:

Line 142 Add a line to /boot.cfg to boot Xen:	Line 147 Add a line to /boot.cfg to boot Xen:
menu=Xen:load /netbsd-XEN3_DOM0.gz console=pc;multiboot /xen.gz dom0_mem=512M	menu=Xen:load /netbsd-XEN3_DOM0.gz console=pc;multiboot /xen.gz dom0_mem=512M
"""]]	"""]]

which specifies that the dom0 should have 512MB of ram, leaving the rest	This specifies that the dom0 should have 512MB of ram, leaving the rest
to be allocated for domUs. To use a serial console, use	to be allocated for domUs. To use a serial console, use:

[[!template id=filecontent name="/boot.cfg" text="""	[[!template id=filecontent name="/boot.cfg" text="""
menu=Xen:load /netbsd-XEN3_DOM0.gz;multiboot /xen.gz dom0_mem=512M console=com1 com1=9600,8n1	menu=Xen:load /netbsd-XEN3_DOM0.gz;multiboot /xen.gz dom0_mem=512M console=com1 com1=9600,8n1
Line 158 itself uses (in this case, the serial po	Line 163 itself uses (in this case, the serial po

In an attempt to add performance, one can also add `dom0_max_vcpus=1 dom0_vcpus_pin`,	In an attempt to add performance, one can also add `dom0_max_vcpus=1 dom0_vcpus_pin`,
to force only one vcpu to be provided (since NetBSD dom0 can't use	to force only one vcpu to be provided (since NetBSD dom0 can't use
more) and to pin that vcpu to a physical CPU.	more) and to pin that vcpu to a physical CPU. Xen has
	[many boot options](http://xenbits.xenproject.org/docs/4.13-testing/misc/xen-command-line.html),
Xen has [many boot
options](http://xenbits.xenproject.org/docs/4.5-testing/misc/xen-command-line.html),
and other than dom0 memory and max_vcpus, they are generally not	and other than dom0 memory and max_vcpus, they are generally not
necessary.	necessary.

Now, reboot so that you are running a DOM0 kernel under Xen, rather	Copy the boot scripts into `/etc/rc.d`:
than GENERIC without Xen.

Configuring Xen
---------------

Now, you have a system that will boot Xen and the dom0 kernel, but not
do anything else special. Make sure that you have rebooted into Xen.
There will be no domUs, and none can be started because you still have
to configure the dom0 daemons.

Since Xen 4.2, the tool which should be used is `xl`.	[[!template id=programlisting text="""
	# cp /usr/pkg/share/examples/rc.d/xen* /etc/rc.d/
	"""]]

For 4.1 and up, you should enable `xencommons`:	Enable `xencommons`:

[[!template id=filecontent name="/etc/rc.conf" text="""	[[!template id=filecontent name="/etc/rc.conf" text="""
xencommons=YES	xencommons=YES
"""]]	"""]]

Not enabling xencommons will result in a hang; it is necessary to hit `^C` on	Now, reboot so that you are running a DOM0 kernel under Xen, rather
the console to let the machine finish booting:	than GENERIC without Xen.

TODO: Recommend for/against xen-watchdog.	TODO: Recommend for/against xen-watchdog.

After you have configured the daemons and either started them (in the	Once the reboot is done, use `xl` to inspect Xen's boot messages,
order given) or rebooted, use `xl` to inspect Xen's boot messages,
available resources, and running domains. For example:	available resources, and running domains. For example:

[[!template id=programlisting text="""	[[!template id=programlisting text="""
Line 217 make this work, one should not expect to	Line 212 make this work, one should not expect to
(and thus xencommons). There is currently no reason to expect that	(and thus xencommons). There is currently no reason to expect that
this will get fixed any time soon.	this will get fixed any time soon.

anita (for testing NetBSD)	## anita (for testing NetBSD)
--------------------------

With the setup so far (assuming 4.8/xl), one should be able to run	With the setup so far, one should be able to run
anita (see pkgsrc/misc/py-anita) to test NetBSD releases, by doing (as	anita (see pkgsrc/misc/py-anita) to test NetBSD releases, by doing (as
root, because anita must create a domU):	root, because anita must create a domU):

Line 228 root, because anita must create a domU):	Line 222 root, because anita must create a domU):
anita --vmm=xl test file:///usr/obj/i386/	anita --vmm=xl test file:///usr/obj/i386/
"""]]	"""]]

Xen-specific NetBSD issues	## Xen-specific NetBSD issues
--------------------------

There are (at least) two additional things different about NetBSD as a	There are (at least) two additional things different about NetBSD as a
dom0 kernel compared to hardware.	dom0 kernel compared to hardware.
Line 243 options as GENERIC. While it is debatab	Line 236 options as GENERIC. While it is debatab
bug, users should be aware of this and can simply add missing config	bug, users should be aware of this and can simply add missing config
items if desired.	items if desired.

Updating NetBSD in a dom0	## Updating NetBSD in a dom0
-------------------------

This is just like updating NetBSD on bare hardware, assuming the new	This is just like updating NetBSD on bare hardware, assuming the new
version supports the version of Xen you are running. Generally, one	version supports the version of Xen you are running. Generally, one
Line 254 and adjusts `/etc`.	Line 246 and adjusts `/etc`.
Note that one must update both the non-Xen kernel typically used for	Note that one must update both the non-Xen kernel typically used for
rescue purposes and the DOM0 kernel used with Xen.	rescue purposes and the DOM0 kernel used with Xen.

Converting from grub to /boot	## Converting from grub to /boot
-----------------------------

These instructions were used to convert a system from	These instructions were used to convert a system from
grub to /boot. The system was originally installed in February of	grub to /boot. The system was originally installed in February of
Line 285 default=1	Line 276 default=1
timeout=30	timeout=30
"""]]	"""]]

Upgrading Xen versions	## Upgrading Xen versions
---------------------

Minor version upgrades are trivial. Just rebuild/replace the	Minor version upgrades are trivial. Just rebuild/replace the
xenkernel version and copy the new xen.gz to `/` (where `/boot.cfg`	xenkernel version and copy the new xen.gz to `/` (where `/boot.cfg`
references it), and reboot.	references it), and reboot.

Unprivileged domains (domU)	#Unprivileged domains (domU)
===========================

This section describes general concepts about domUs. It does not	This section describes general concepts about domUs. It does not
address specific domU operating systems or how to install them. The	address specific domU operating systems or how to install them. The
Line 308 mediated by Xen, and configured in the d	Line 297 mediated by Xen, and configured in the d
Entropy in domUs can be an issue; physical disks and network are on	Entropy in domUs can be an issue; physical disks and network are on
the dom0. NetBSD's /dev/random system works, but is often challenged.	the dom0. NetBSD's /dev/random system works, but is often challenged.

Config files	## Config files
------------

There is no good order to present config files and the concepts
surrounding what is being configured. We first show an example config
file, and then in the various sections give details.

See /usr/pkg/share/examples/xen/xmexample*,	See /usr/pkg/share/examples/xen/xlexample*
for a large number of well-commented examples, mostly for running	for a small number of well-commented examples, mostly for running
GNU/Linux.	GNU/Linux.

The following is an example minimal domain configuration file. The domU	The following is an example minimal domain configuration file. The domU
Line 340 are stored in files and Xen attaches the	Line 324 are stored in files and Xen attaches the
dom0 on domain creation. The system treats xbd0 as the boot device	dom0 on domain creation. The system treats xbd0 as the boot device
without needing explicit configuration.	without needing explicit configuration.

By default, `xl` looks for domain config files in `/usr/pkg/etc/xen`. Note	By convention, domain config files are kept in `/usr/pkg/etc/xen`. Note
that "xl create" takes the name of a config file, while other commands	that "xl create" takes the name of a config file, while other commands
take the name of a domain.	take the name of a domain.

Examples of commands:	Examples of commands:

[[!template id=programlisting text="""	[[!template id=programlisting text="""
xl create foo	xl create /usr/pkg/etc/xen/foo
xl console foo	xl console domU-id
xl create -c foo	xl create -c /usr/pkg/etc/xen/foo
xl shutdown foo	xl shutdown domU-id
xl list	xl list
"""]]	"""]]

Line 359 equivalent to pushing the power button;	Line 343 equivalent to pushing the power button;
power-press event and do a clean shutdown. Shutting down the dom0	power-press event and do a clean shutdown. Shutting down the dom0
will trigger controlled shutdowns of all configured domUs.	will trigger controlled shutdowns of all configured domUs.

domU kernels	## CPU and memory
------------

On a physical computer, the BIOS reads sector 0, and a chain of boot
loaders finds and loads a kernel. Normally this comes from the root
file system. With Xen domUs, the process is totally different. The
normal path is for the domU kernel to be a file in the dom0's
file system. At the request of the dom0, Xen loads that kernel into a
new domU instance and starts execution. domU kernels can be anyplace.

Note that loading the domU kernel from the dom0 implies that boot
blocks, /boot, /boot.cfg, and so on are all ignored in the domU.
See the VPS section near the end for discussion of alternate ways to
obtain domU kernels.

CPU and memory	A domain is provided with some number of vcpus, up to the number
--------------

A domain is provided with some number of vcpus, less than the number
of CPUs seen by the hypervisor. For a domU, it is controlled	of CPUs seen by the hypervisor. For a domU, it is controlled
from the config file by the "vcpus = N" directive.	from the config file by the "vcpus = N" directive.

Line 389 than the available memory.	Line 357 than the available memory.
Xen also provides a "balloon" driver, which can be used to let domains	Xen also provides a "balloon" driver, which can be used to let domains
use more memory temporarily.	use more memory temporarily.

Virtual disks	## Virtual disks
-------------
	In domU config files, the disks are defined as a sequence of 3-tuples:

With the file/vnd style, typically one creates a directory,	* The first element is "method:/path/to/disk". Common methods are
e.g. /u0/xen, on a disk large enough to hold virtual disks for all	"file:" for a file-backed vnd, and "phy:" for something that is already
domUs. Then, for each domU disk, one writes zeros to a file that then	a device, such as an LVM logical volume.
serves to hold the virtual disk's bits; a suggested name is foo-xbd0
for the first virtual disk for the domU called foo. Writing zeros to	* The second element is an artifact of how virtual disks are passed to
the file serves two purposes. One is that preallocating the contents	Linux, and a source of confusion with NetBSD Xen usage. Linux domUs
improves performance. The other is that vnd on sparse files has	are given a device name to associate with the disk, and values like
failed to work. TODO: give working/notworking NetBSD versions for	"hda1" or "sda1" are common. In a NetBSD domU, the first disk appears
sparse vnd and gnats reference. Note that the use of file/vnd for Xen	as xbd0, the second as xbd1, and so on. However, xl demands a
is not really different than creating a file-backed virtual disk for	second argument. The name given is converted to a major/minor by
some other purpose, except that xentools handles the vnconfig	calling stat(2) on the name in /dev and this is passed to the domU.
commands. To create an empty 4G virtual disk, simply do	In the general case, the dom0 and domU can be different operating
	systems, and it is an unwarranted assumption that they have consistent
dd if=/dev/zero of=foo-xbd0 bs=1m count=4096	numbering in /dev, or even that the dom0 OS has a /dev. With NetBSD
	as both dom0 and domU, using values of 0x0 for the first disk and 0x1
Do not use qemu-img-xen, because this will create sparse file. There	for the second works fine and avoids this issue. For a GNU/Linux
have been recent (2015) reports of sparse vnd(4) devices causing	guest, one can create /dev/hda1 in /dev, or to pass 0x301 for
lockups, but there is apparently no PR.	/dev/hda1.

With the lvm style, one creates logical devices. They are then used
similarly to vnds. TODO: Add an example with lvm.

In domU config files, the disks are defined as a sequence of 3-tuples.
The first element is "method:/path/to/disk". Common methods are
"file:" for file-backed vnd. and "phy:" for something that is already
a (TODO: character or block) device.

The second element is an artifact of how virtual disks are passed to
Linux, and a source of confusion with NetBSD Xen usage. Linux domUs
are given a device name to associate with the disk, and values like
"hda1" or "sda1" are common. In a NetBSD domU, the first disk appears
as xbd0, the second as xbd1, and so on. However, xm/xl demand a
second argument. The name given is converted to a major/minor by
calling stat(2) on the name in /dev and this is passed to the domU.
In the general case, the dom0 and domU can be different operating
systems, and it is an unwarranted assumption that they have consistent
numbering in /dev, or even that the dom0 OS has a /dev. With NetBSD
as both dom0 and domU, using values of 0x0 for the first disk and 0x1
for the second works fine and avoids this issue. For a GNU/Linux
guest, one can create /dev/hda1 in /dev, or to pass 0x301 for
/dev/hda1.

The third element is "w" for writable disks, and "r" for read-only	* The third element is "w" for writable disks, and "r" for read-only
disks.	disks.

	Example:
	[[!template id=filecontent name="/usr/pkg/etc/xen/foo" text="""
	disk = [ 'file:/n0/xen/foo-wd0,0x0,w' ]
	"""]]

Note that NetBSD by default creates only vnd[0123]. If you need more	Note that NetBSD by default creates only vnd[0123]. If you need more
than 4 total virtual disks at a time, run e.g. "./MAKEDEV vnd4" in the	than 4 total virtual disks at a time, run e.g. "./MAKEDEV vnd4" in the
Line 449 Virtual Networking	Line 400 Virtual Networking

Xen provides virtual Ethernets, each of which connects the dom0 and a	Xen provides virtual Ethernets, each of which connects the dom0 and a
domU. For each virtual network, there is an interface "xvifN.M" in	domU. For each virtual network, there is an interface "xvifN.M" in
the dom0, and in domU index N, a matching interface xennetM (NetBSD	the dom0, and a matching interface xennetM (NetBSD name) in domU index N.
name). The interfaces behave as if there is an Ethernet with two	The interfaces behave as if there is an Ethernet with two
adapters connected. From this primitive, one can construct various	adapters connected. From this primitive, one can construct various
configurations. We focus on two common and useful cases for which	configurations. We focus on two common and useful cases for which
there are existing scripts: bridging and NAT.	there are existing scripts: bridging and NAT.
Line 477 The MAC address specified is the one use	Line 428 The MAC address specified is the one use
domain. The interface in dom0 will use this address XOR'd with	domain. The interface in dom0 will use this address XOR'd with
00:00:00:01:00:00. Random MAC addresses are assigned if not given.	00:00:00:01:00:00. Random MAC addresses are assigned if not given.

Sizing domains
--------------

Modern x86 hardware has vast amounts of resources. However, many
virtual servers can function just fine on far less. A system with
512M of RAM and a 4G disk can be a reasonable choice. Note that it is
far easier to adjust virtual resources than physical ones. For
memory, it's just a config file edit and a reboot. For disk, one can
create a new file and vnconfig it (or lvm), and then dump/restore,
just like updating physical disks, but without having to be there and
without those pesky connectors.

Starting domains automatically	Starting domains automatically
------------------------------	------------------------------

To start domains foo at bar at boot and shut them down cleanly on dom0	To start domains `domU-netbsd` and `domU-linux` at boot and shut them
shutdown, in rc.conf add:	down cleanly on dom0 shutdown, add the following in rc.conf:

xendomains="foo bar"	[[!template id=filecontent name="/etc/rc.conf" text="""
	xendomains="domU-netbsd domU-linux"
Note that earlier versions of the xentools41 xendomains rc.d script	"""]]
used xl, when one should use xm with 4.1.

Creating specific unprivileged domains (domU)	# Creating a domU
=============================================

Creating domUs is almost entirely independent of operating system. We	Creating domUs is almost entirely independent of operating system. We
have already presented the basics of config files. Note that you must	have already presented the basics of config files. Note that you must
have already completed the dom0 setup so that "xl list" (or "xm list")	have already completed the dom0 setup so that "xl list" works.
works.

Creating an unprivileged NetBSD domain (domU)	Creating a NetBSD PV domU
---------------------------------------------	--------------------------

See the earlier config file, and adjust memory. Decide on how much	See the earlier config file, and adjust memory. Decide on how much
storage you will provide, and prepare it (file or lvm).	storage you will provide, and prepare it (file or LVM).

While the kernel will be obtained from the dom0 file system, the same	While the kernel will be obtained from the dom0 file system, the same
file should be present in the domU as /netbsd so that tools like	file should be present in the domU as /netbsd so that tools like
Line 535 kernel to / and change the kernel line i	Line 471 kernel to / and change the kernel line i

kernel = "/home/bouyer/netbsd-INSTALL_XEN3_DOMU"	kernel = "/home/bouyer/netbsd-INSTALL_XEN3_DOMU"

Then, start the domain as "xl create -c configname".	Then, start the domain as "xl create -c configfile".

Alternatively, if you want to install NetBSD/Xen with a CDROM image, the following	Alternatively, if you want to install NetBSD/Xen with a CDROM image, the following
line should be used in the config file.	line should be used in the config file.
Line 580 not really a Xen-specific issue, but bec	Line 516 not really a Xen-specific issue, but bec
obtained from the dom0, it is far more likely to be out of sync or	obtained from the dom0, it is far more likely to be out of sync or
missing with Xen.)	missing with Xen.)

Creating an unprivileged Linux domain (domU)	Creating a Linux domU
--------------------------------------------	---------------------

Creating unprivileged Linux domains isn't much different from	Creating unprivileged Linux domains isn't much different from
unprivileged NetBSD domains, but there are some details to know.	unprivileged NetBSD domains, but there are some details to know.
Line 624 To get the Linux console right, you need	Line 560 To get the Linux console right, you need
to your configuration since not all Linux distributions auto-attach a	to your configuration since not all Linux distributions auto-attach a
tty to the xen console.	tty to the xen console.

Creating an unprivileged Solaris domain (domU)	## Creating a NetBSD HVM domU
----------------------------------------------
	Use type='hmv', probably. Use a GENERIC kernel within the disk image.

	## Creating a NetBSD PVH domU

	Use type='pvh'.

	\todo Explain where the kernel comes from.


	Creating a Solaris domU
	-----------------------

See possibly outdated	See possibly outdated
[Solaris domU instructions](/ports/xen/howto-solaris/).	[Solaris domU instructions](/ports/xen/howto-solaris/).
Line 634 See possibly outdated	Line 581 See possibly outdated
PCI passthrough: Using PCI devices in guest domains	PCI passthrough: Using PCI devices in guest domains
---------------------------------------------------	---------------------------------------------------

	NB: PCI passthrough only works on some Xen versions and as of 2020 it
	is not clear that it works on any version in pkgsrc. Reports
	confirming or denying this notion should be sent to port-xen@.

The dom0 can give other domains access to selected PCI	The dom0 can give other domains access to selected PCI
devices. This can allow, for example, a non-privileged domain to have	devices. This can allow, for example, a non-privileged domain to have
access to a physical network interface or disk controller. However,	access to a physical network interface or disk controller. However,
Line 701 note that only the "xpci" lines are unus	Line 652 note that only the "xpci" lines are unus
cd* at scsibus? target ? lun ? # SCSI CD-ROM drives	cd* at scsibus? target ? lun ? # SCSI CD-ROM drives


NetBSD as a domU in a VPS	# Specific Issues
=========================
	## domU

	[NetBSD 5 is known to panic.](http://mail-index.netbsd.org/port-xen/2018/04/17/msg009181.html)
	(However, NetBSD 5 systems should be updated to a supported version.)

	# NetBSD as a domU in a VPS

The bulk of the HOWTO is about using NetBSD as a dom0 on your own	The bulk of the HOWTO is about using NetBSD as a dom0 on your own
hardware. This section explains how to deal with Xen in a domU as a	hardware. This section explains how to deal with Xen in a domU as a
Line 729 A second issue is multiple CPUs. With N	Line 686 A second issue is multiple CPUs. With N
multiple vcpus, and it is typical for VPS providers to enable multiple	multiple vcpus, and it is typical for VPS providers to enable multiple
CPUs for NetBSD domUs.	CPUs for NetBSD domUs.

pygrub	## Complexities due to Xen changes
-------

pygrub runs in the dom0 and looks into the domU file system. This	Xen has many security advisories and people running Xen systems make
implies that the domU must have a kernel in a file system in a format	different choices.
known to pygrub. As of 2014, pygrub seems to be of mostly historical
interest.	### stub domains

	Some (Linux only?) dom0 systems use something called "stub domains" to
	isolate qemu from the dom0 system, as a security and reliabilty
	mechanism when running HVM domUs. Somehow, NetBSD's GENERIC kernel
	ends up using PIO for disks rather than DMA. Of course, all of this
	is emulated, but emulated PIO is unusably slow. This problem is not
	currently understood.

	### Grant tables

pvgrub	There are multiple versions of using grant tables, and some security
------	advisories have suggested disabling some versions. Some versions of
	NetBSD apparently only use specific versions and this can lead to
	"NetBSD current doesn't run on hosting provider X" situations.

	\todo Explain better.

	## Boot methods

	### pvgrub

pvgrub is a version of grub that uses PV operations instead of BIOS	pvgrub is a version of grub that uses PV operations instead of BIOS
calls. It is booted from the dom0 as the domU kernel, and then reads	calls. It is booted from the dom0 as the domU kernel, and then reads
Line 763 partition for the kernel with the intent	Line 736 partition for the kernel with the intent
which leads to /netbsd not being the actual kernel. One must remember	which leads to /netbsd not being the actual kernel. One must remember
to update the special boot partition.	to update the special boot partition.

Amazon	### pygrub
------

See the [Amazon EC2 page](/amazon_ec2/).	pygrub runs in the dom0 and looks into the domU file system. This
	implies that the domU must have a kernel in a file system in a format
	known to pygrub.

	pygrub doesn't seem to work to load Linux images under NetBSD dom0,
	and is inherently less secure than pvgrub due to running inside dom0. For both these
	reasons, pygrub should not be used, and is only still present so that
	historical DomU images using it still work.

Random pointers	As of 2014, pygrub seems to be of mostly historical
===============	interest. New DomUs should use pvgrub.

This section contains links from elsewhere not yet integrated into the	## Specific Providers
HOWTO, and other guides.

* http://www.lumbercartel.ca/library/xen/	### Amazon
* http://pbraun.nethence.com/doc/sysutils/xen_netbsd_dom0.html
* https://gmplib.org/~tege/xen.html	See the [Amazon EC2 page](/amazon_ec2/).

CVSweb for NetBSD wikisrc <wikimaster@NetBSD.org> software: FreeBSD-CVSweb

Removed from v.1.157
changed lines
	Added in v.1.182