...
| Info |
|---|
|
Copyright 2013 by Citrix Systems, Inc. This work is licensed under the Creative Commons Attribution 4.0 International License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/. |
| Info |
|---|
|
 Image Removed
Copyright 2015 by Assured Information Security, Inc. Contributions by Martin Osterloh <osterlohm@ainfosec.com>. This work is licensed under the Creative Commons Attribution 4.0 International License. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/. |
Introduction
...
| Code Block |
|---|
|
# nothing can be done by default
deny all
# allow stubdoms to talk to surfman,xenmgr,dbus
allow stubdom true destination destination com.citrix.xenclient.surfman
allow stubdom true destination com.citrix.xenclient.xenmgr
allow stubdom true destination org.freedesktop.DBus interface org.freedesktop.DBus
# allow guests to call 'gather' on diagnostics interface (required by xc-diag)
allow destination destination com.citrix.xenclient.xenmgr interface com.citrix.xenclient.xenmgr.diag member gather
# allow anybody to do some vm queries required for switcher bar
allow destination destination com.citrix.xenclient.xenmgr interface org.freedesktop.DBus.Properties member Get
allow destination com.citrix.xenclient.xenmgr interface com.citrix.xenclient.xenmgr member list_vms
allow destination com.citrix.xenclient.xenmgr interface com.citrix.xenclient.xenmgr.vm member get_db_key
allow destination com.citrix.xenclient.xenmgr interface com.citrix.xenclient.xenmgr.vm member read_icon
allow destination com.citrix.xenclient.xenmgr interface com.citrix.xenclient.xenmgr.vm member switch
allow destination com.citrix.xenclient.input interface com.citrix.xenclient.input member get_focus_domid
allow destination com.citrix.xenclient.xenmgr interface com.citrix.xenclient.xenmgr member find_vm_by_domid
# allow guest to do some requests allow destination
com.citrix.xenclient.xenmgr interface com.citrix.xenclient.xenmgr.guestreq member request_attention
# allow conditional domstore (private db space) access
allow destination destination com.citrix.xenclient.db interface com.citrix.xenclient.db member read if-boolean domstore-read-access true
allow destination com.citrix.xenclient.db interface com.citrix.xenclient.db member read_binary if-boolean domstore-read-access trueallowtrue
allow destination com.citrix.xenclient.db interface com.citrix.xenclient.db member list if-boolean domstore-read-access true
allow destination com.citrix.xenclient.db interface com.citrix.xenclient.db member exists if-boolean domstore-read-access true
#
allow destination com.citrix.xenclient.db interface com.citrix.xenclient.db member write if-boolean domstore-write-access true
allow destination com.citrix.xenclient.db interface com.citrix.xenclient.db member rm if-boolean domstore-write-access true |
...
It's sometimes handy to turn off the automatic overwrite of service VM templates each xenmgr start, so that the service VM can be reconfigured via manual xec-vm invocations. This can be achieved via
$ db-write /xenmgr/overwrite-<vmtype>-settings false
for example for NDVM: db-write /xenmgr/overwrite-ndvm-settings false
...
This configures how the toolstack handles requests to put a VM to S3. Note that this doesn't affect requests made from within guest, but just requests originating from the UI / closing the laptopt laptop lid etc. It can be one of the following:
...
- XenMgr/Connect/* - wrappers to access other daemons in the system
- XenMgr/Expose/* - entry points for all xenmgr's dbus server rpcs
- XenMgr/CdLock.hs - relatively new code for handling the AFRL request cd drive lock model
- XenMgr/Config.hs - global xenmgr config storage/query
- XenMgr/Diagnostics.hs - gathering status reports from vms + other diagnostics
- XenMgr/Diskmgr.hs - vhd creation
- XenMgr/Errors.hs - definition of numbered errors reported to the UI
- XenMgr/Host.hs - lots of host level query functions (eth0 mac adreesesadresses, bios versions, xc versions, update state etc)
- XenMgr/HostOps.hs - host shutdown/sleesleep/hibernate/reboot entry points
- XenMgr/PowerManagement.hs - actual implementation of host shutdown/sleep/hibernate/reboot etc plus code to handle lid state changes
- XenMgr/Notify.hs - wrappers for easier generation of various dbus signals
- XenMgr/Rpc.hs - definition of Rpc monad used in xenmgr for dbus access
- XenMgr/XM.hs - definition of XM monad based on reader monad containing context forall vms. Useful for doing some cross vm interactions which require locking / synchronization
...
you can put the following parameters in your config file:
(common options)
| key name | type | description |
|---|
| hvm | s | command line given to the kernel |
| startup | s | specify what to do with the domain at startup possibles value: started, paused, shutdown or restore |
| debug | b | logs all operations to /tmp/xenvm-debug-%uuid |
| uuid | s | specify the domain uuid (default to autogeneration) |
| on_crash | s | specify the action to be taken after notifying a |
| on_halt | s | crash/halt/reboot. possible values: |
| on_reboot | s | preserve, reboot, destroy |
| kernel | s | specify where to find the kernel to boot (can be empty for hvm. default to hvmloader) |
| memory | i | specify the memory given to the guest in megabytes |
| vcpus | i | number of vcpus available to the guest |
| disk | s | add a virtual disk. |
| |
|
| format: physpath:phystype:virtpath:mode:devty[:k=v...] |
| |
|
| - physpath: path to the disk image, raw device, .. |
| | | | | | | |
|
| - extra k=v arguments (cipher, key-size, key-file) |
| nic | s | add a virtual nic. |
| |
|
| format: key=value,key=value,... (can be empty) |
| |
|
| supported key: bridge, mac, id |
| | |
|
| "nic = bridge=xen-br0,mac=ab:ef:fe:dc:ba:ab" |
| |
|
| "nic = mac=ab:ef:fe:dc:ba:ab" |
| |
|
| "nic = " |
| pci | s | add a pci device. |
|
|
| format: devid,bind,domain:bus device.function |
| serial | s | redirect serial to device or network tcp:ip:port |
| |
|
| ex: "pty" or "tcp:1.2.3.4:1234" |
| display | s | details the type of display available for the guest |
| |
|
| format: :key[=value],key[=value],... |
| | | | |
|
| - vnc (keys allowed: use-port-unused, keymap, port) |
| | (the following are just useful for pv)
| key name | type | description |
|---|
| cmdline | s | command line given to the kernel |
| initrd | s | specify the initrd use, leave empty for none |
(the following are just useful for hvm)
| key name | type | description |
|---|
| pae | b | specify that the guest is using PAE |
| acpi | b | specify that the guest is using ACPI |
| apic | b | specify that the guest is using APIC |
| nx | b | specify that the guest is using NX |
| smbios-pt | b | specify that the guest is using smbios pass-through |
| smbios-oem-type-pt | i | tables number to passthrough |
| acpi-pt | b | specify that the guest is using ACPI pass-through |
| diskinfo-pt | b | specify the guest is using SCSI diskinfo pass-through |
| boot | s | specify the qemu boot string |
| extra-hvm | k=v | specify extra arguments passthrough to qemu as -k v |
| power-management | i | specify the power management passthrough mode |
| |
|
| - 1 : pass-through mode (limited scope) |
| | -
|
| - 2 : non pass-through mode (in doubt use this) |
| oem-features | i | specify whether or not to pass through oem features. |
| |
|
| Note: At the moment any integer value can be passed |
|
|
| but this is likely to change in future especially if |
| |
|
| we decide to pass through a subset of oem features |
| |
|
| and let user configure that subset. |
| timer-mode | i | specify the timer mode used. |
| timeoffset | s | specify the time offset (i.e. timezone) used. |
| pci-msitranslate | i | specify whether to use MSI-INTx translation for guest. |
| pci-power-management | i | specify whether or not to enable Dx power management |
| |
|
| for passthrough devices. |
| inject-sci | i | specify whether or not to inject SCIs like lid close, |
| |
|
| power button press to guest. (Default: no injection) |
Sending command to the monitor
...
| Code Block |
|---|
|
uuid = 00000000-0000-0000-0000-000000000002
hvm = true
memory = 256
disk = /dev/vg/testhvm:phy:hda:w:disk
disk = /var/opt/xen/iso_import/w2k3eesp2.iso:file:hdd:r:cdrom
boot = dc
pae = true
acpi = true
apic = true |
LibXL / XL Installation Instructions
This section highlights how to install the current LibXL (plus associated XL binary) in OpenXT and how to use it.
Installation of LibXL and XL
Firstly, we will make sure that LibXL and its associated binary will be compiled as part of the xen-tools package. In order to do so, we edit the file build/repos/xenclient-oe/recipes-extended/xen/xen-tools.bb to contain:
oe_runmake -C tools subdir-all-libaio
oe_runmake -C tools subdir-all-blktap2
oe_runmake -C tools subdir-all-libxl
within the function do_compile() and
oe_runmake -C tools subdir-install-blktap2
oe_runmake -C tools subdir-install-libxl
within the function do_install(). This will compile and install the necessary libraries and binaries to use LibXL. Next step is ensuring that the previously used blktap library is no longer in use. There are four recipes that reference the blktap library. They are:
- ./xenclient-oe/recipes-openxt/qemu-dm/qemu-dm.inc:4:DEPENDS = "xen-tools alsa-lib pciutils libpng blktap libv4v openssl zlib libcap-ng libdmbus"
- /xenclient-oe/recipes-core/images/xenclient-syncvm-image.bb:29: blktap
- ./xenclient-oe/recipes-core/tasks/task-xenclient-installer.bb:15: blktap
- ./xenclient-oe/recipes-core/tasks/task-xenclient-dom0.bb:63: blktap
Removing the occurences of blktap (and making sure that xen-tools is listed) will guarantee that Xen's blktap library is being used from now on.
The interface is the new blktap library has slightly changed, so we need to make a few changes to the install scripts to accommodate for the changes.
In the xenclient-installer directory, edit the file:
part2/stages/Functions/install-main
and replace tap-ctl destroy calls with:
tap-ctl destroy -p $UIVM_GCONF_DEV_PID -m $UIVM_GCONF_DEV_TRUNC >&2
The complete source can be found on my github page.
Once the installer is edited, we can make a new build via
...