Xen status in lenny?

[Lucas Nussbaum]

Hi,

AFAIK, the status of Xen in lenny is currently the following:
- no dom0 kernel
- domU kernel only for i386 (no domU kernel for amd64)

I was told (I don't remember where) that this is because the vanilla
kernel only supports domU for i386, and has no dom0 support, so distros
have to port the patches to their kernels (please correct me if I'm
wrong).

However:
- etch shipped with dom0 and domU kernels on i386 and amd64
- all major distros shipped with "full" Xen support

What are the plans for Xen for lenny? Is this situation likely to change
before the release?
--
| Lucas Nussbaum
| lucas@...   http://www.lucas-nussbaum.net/ |
| jabber: lucas@...             GPG: 1024D/023B3F4F |


--
To UNSUBSCRIBE, email to debian-devel-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Ian Campbell-2]

On Thu, 2008-07-10 at 21:53 +0200, Lucas Nussbaum wrote:

> Hi,
>
> AFAIK, the status of Xen in lenny is currently the following:
> - no dom0 kernel
> - domU kernel only for i386 (no domU kernel for amd64)
>
> I was told (I don't remember where) that this is because the vanilla
> kernel only supports domU for i386, and has no dom0 support, so distros
> have to port the patches to their kernels (please correct me if I'm
> wrong).

That is correct.

The upstream -tip tree currently has some 64 bit domU patches queued
(probably for 2.6.27). They are rather new and far reaching since they
make some some nice infrastructure cleanups along the way etc. There's a
rather slim chance they might make it in for Lenny but given their young
age I'm not quite happy to say we could support a kernel with them for
the lifetime of Lenny.

dom0 support is being worked on by Fedora people (I think) but there are
no patches upstream yet.

> However:
> - etch shipped with dom0 and domU kernels on i386 and amd64
> - all major distros shipped with "full" Xen support

FWIW fc9 didn't ship with dom0 support -- that is targeted for fc10.
For now I think they recommend you stick with fc8 for dom0.

I think we will be in a similar situation -- recommending sticking with
Etch for dom0 (or at least the Etch kernel, which I run on sid for my
Xen uses just fine) is probably the best we can do at the moment.

> What are the plans for Xen for lenny? Is this situation likely to change
> before the release?

Without a massive injection of manpower (Debian side or upstream) I
don't see much changing. I've heard that maybe a Lenny + 1/2 kernel
might be able to add the features (64bit + dom0) which are missed this
time around if they are available upstream, but that isn't my call to
make.

Ian.
--
Ian Campbell

People usually get what's coming to them ... unless it's been mailed.


--
To UNSUBSCRIBE, email to debian-devel-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Bastian Blank]

On Thu, Jul 10, 2008 at 09:53:25PM +0200, Lucas Nussbaum wrote:
> AFAIK, the status of Xen in lenny is currently the following:
> - no dom0 kernel

Yep. There are some preliminary patches but they break non-paravirt
usage for now.

> - domU kernel only for i386 (no domU kernel for amd64)

x86_64 is currently worked on, but the stuff in fedora 9 is rather
unclean.

> However:
> - etch shipped with dom0 and domU kernels on i386 and amd64

Well, it ships a slightly broken variant.

> - all major distros shipped with "full" Xen support

RHEL5/FC8 are 2.6.18 based and ships full support. SLES10 is 2.6.16 based
and ships full support. FC9 is 2.6.24 based and ships only domU support.
Anything else can be considered more or less broken.

> What are the plans for Xen for lenny? Is this situation likely to change
> before the release?

It will ship the hypervisor and a domU kernel. For dom0 it will need
either the etch or my own[1] kernel. This may be changed later if we can
get a new kernel in the stable release.

Bastian

[1]:
deb http://kernel-archive.buildserver.net/debian-kernel/waldi/xen-extra all main

--
I have never understood the female capacity to avoid a direct answer to
any question.
                -- Spock, "This Side of Paradise", stardate 3417.3

[Paul van der Vlis]

Ian Campbell schreef:

> On Thu, 2008-07-10 at 21:53 +0200, Lucas Nussbaum wrote:
>> Hi,
>>
>> AFAIK, the status of Xen in lenny is currently the following:
>> - no dom0 kernel
>> - domU kernel only for i386 (no domU kernel for amd64)
>>
>> I was told (I don't remember where) that this is because the vanilla
>> kernel only supports domU for i386, and has no dom0 support, so distros
>> have to port the patches to their kernels (please correct me if I'm
>> wrong).
>
> That is correct.
>
> The upstream -tip tree currently has some 64 bit domU patches queued
> (probably for 2.6.27). They are rather new and far reaching since they
> make some some nice infrastructure cleanups along the way etc. There's a
> rather slim chance they might make it in for Lenny but given their young
> age I'm not quite happy to say we could support a kernel with them for
> the lifetime of Lenny.
>
> dom0 support is being worked on by Fedora people (I think) but there are
> no patches upstream yet.
>
>> However:
>> - etch shipped with dom0 and domU kernels on i386 and amd64
>> - all major distros shipped with "full" Xen support
>
> FWIW fc9 didn't ship with dom0 support -- that is targeted for fc10.
> For now I think they recommend you stick with fc8 for dom0.
>
> I think we will be in a similar situation -- recommending sticking with
> Etch for dom0 (or at least the Etch kernel, which I run on sid for my
> Xen uses just fine) is probably the best we can do at the moment.
>
>> What are the plans for Xen for lenny? Is this situation likely to change
>> before the release?
>
> Without a massive injection of manpower (Debian side or upstream) I
> don't see much changing. I've heard that maybe a Lenny + 1/2 kernel
> might be able to add the features (64bit + dom0) which are missed this
> time around if they are available upstream, but that isn't my call to
> make.

Some Fedora-links about Xen:
http://fedoraproject.org/wiki/Features/XenPvopsDom0
http://fedoraproject.org/wiki/Features/XenPvops
http://www.redhat.com/archives/fedora-xen/2008-March/msg00013.html
http://www.redhat.com/archives/fedora-xen/2008-March/thread.html
http://git.et.redhat.com/?p=xen-pvops-64.git
http://git.et.redhat.com/?p=linux-2.6-fedora-pvops.git;a=summary
http://cvs.fedora.redhat.com/viewcvs/rpms/kernel-xen-2.6/devel/
http://fedoraproject.org/wiki/Releases/10/Schedule

Eventually we could support the Etch-kernel in Lenny until there is
another solution?

Maybe we could make some publicity about this situation in Debian
Project News. Maybe there is someone who can help.
http://wiki.debian.org/ProjectNews/Issues/Current

With regards,
Paul van der Vlis.




--
http://www.vandervlis.nl/


--
To UNSUBSCRIBE, email to debian-devel-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Lucas Nussbaum]

Hi,

On 11/07/08 at 11:24 +0200, Bastian Blank wrote:
> > - all major distros shipped with "full" Xen support
>
> RHEL5/FC8 are 2.6.18 based and ships full support. SLES10 is 2.6.16 based
> and ships full support. FC9 is 2.6.24 based and ships only domU support.
> Anything else can be considered more or less broken.

It seems that Ubuntu 8.04 shipped with a 2.6.24 domU. So Ubuntu is
the only distro shipping a dom0 based on Linux >> 2.6.18? How did they
achieve this? :-)

> > What are the plans for Xen for lenny? Is this situation likely to change
> > before the release?
>
> It will ship the hypervisor and a domU kernel. For dom0 it will need
> either the etch or my own[1] kernel. This may be changed later if we can
> get a new kernel in the stable release.

The problem I see with that is that people will be left without a
supported dom0 kernel at some point during the etch lifetime. Do we have
a plan to address that? Shouldn't we make it clear that we will support
the etch kernel until a lenny+1/2 kernel is available, for example?

Also, can you use the Xen 3.2 features with the etch kernel, or are you
somehow limited?

Wouldn't it be a good idea to ship a linux 2.6.18 kernel in lenny, only
for dom0, so it's clear that it is supported?

Thank you,
--
| Lucas Nussbaum
| lucas@...   http://www.lucas-nussbaum.net/ |
| jabber: lucas@...             GPG: 1024D/023B3F4F |

[Lucas Nussbaum]

On 11/07/08 at 12:18 +0200, Lucas Nussbaum wrote:

> Hi,
>
> On 11/07/08 at 11:24 +0200, Bastian Blank wrote:
> > > - all major distros shipped with "full" Xen support
> >
> > RHEL5/FC8 are 2.6.18 based and ships full support. SLES10 is 2.6.16 based
> > and ships full support. FC9 is 2.6.24 based and ships only domU support.
> > Anything else can be considered more or less broken.
>
> It seems that Ubuntu 8.04 shipped with a 2.6.24 domU. So Ubuntu is

                                                  ^^^^ dom0 (well, they

  shipped with a 2.6.24 domU, but my question is about the dom0)
> the only distro shipping a dom0 based on Linux >> 2.6.18? How did they
> achieve this? :-)
--
| Lucas Nussbaum
| lucas@...   http://www.lucas-nussbaum.net/ |
| jabber: lucas@...             GPG: 1024D/023B3F4F |

[Bastian Blank]

On Fri, Jul 11, 2008 at 12:18:51PM +0200, Lucas Nussbaum wrote:
> On 11/07/08 at 11:24 +0200, Bastian Blank wrote:
> > Anything else can be considered more or less broken.
> It seems that Ubuntu 8.04 shipped with a 2.6.24 domU. So Ubuntu is
> the only distro shipping a dom0 based on Linux >> 2.6.18? How did they
> achieve this? :-)

FC8 ships a forward ported 2.6.22, Ubuntu 8.04 a forward ported 2.6.24.
They pushed work into it and got something which works more or less
good. The Ubuntu patch never worked for me.

> > It will ship the hypervisor and a domU kernel. For dom0 it will need
> > either the etch or my own[1] kernel. This may be changed later if we can
> > get a new kernel in the stable release.
> The problem I see with that is that people will be left without a
> supported dom0 kernel at some point during the etch lifetime.

Which is at least lenny + 1 year, which gives us some time.

>                                                               Do we have
> a plan to address that? Shouldn't we make it clear that we will support
> the etch kernel until a lenny+1/2 kernel is available, for example?

-security is needed for this.

> Also, can you use the Xen 3.2 features with the etch kernel, or are you
> somehow limited?

It does not support power management, but otherwise it works.

> Wouldn't it be a good idea to ship a linux 2.6.18 kernel in lenny, only
> for dom0, so it's clear that it is supported?

This needs redefining of the rule that we don't longer want multiple
kernels in a stable release. But should be possible if -release and
-security don't veto it.

Bastian

--
Where there's no emotion, there's no motive for violence.
                -- Spock, "Dagger of the Mind", stardate 2715.1

[Vincent Bernat-3]

OoO Pendant  le temps de midi  du vendredi 11 juillet  2008, vers 12:18,
Lucas Nussbaum <lucas@...> disait :

> The problem I see with that is that people will be left without a
> supported dom0 kernel at some point during the etch lifetime. Do we have
> a plan to address that? Shouldn't we make it clear that we will support
> the etch kernel until a lenny+1/2 kernel is available, for example?

The problem also appears for vserver kernel.
--
printk("VFS: Busy inodes after unmount. "
        "Self-destruct in 5 seconds.  Have a nice day...\n");
        2.3.99-pre8 /usr/src/linux/fs/super.c

[Steve Langasek]

On Fri, Jul 11, 2008 at 12:18:51PM +0200, Lucas Nussbaum wrote:
> > > What are the plans for Xen for lenny? Is this situation likely to change
> > > before the release?

> > It will ship the hypervisor and a domU kernel. For dom0 it will need
> > either the etch or my own[1] kernel. This may be changed later if we can
> > get a new kernel in the stable release.

> The problem I see with that is that people will be left without a
> supported dom0 kernel at some point during the etch lifetime. Do we have
> a plan to address that? Shouldn't we make it clear that we will support
> the etch kernel until a lenny+1/2 kernel is available, for example?

Which "we" do you expect will support it?  I haven't heard any comments from
the security team indicating that they're willing to provide support for
such a stale kernel beyond the normal support lifetime of etch.  If there
should happen not to be a lenny+1/2 kernel, how long would the security team
be expected to provide security support for 2.6.18?  Until the release of
lenny+1?  Until the end of the *lenny* support cycle?

> Wouldn't it be a good idea to ship a linux 2.6.18 kernel in lenny, only
> for dom0, so it's clear that it is supported?

I think the first question to resolve is to establish that it *is*
supported...

--
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
Ubuntu Developer                                    http://www.debian.org/
slangasek@...                                     vorlon@...


--
To UNSUBSCRIBE, email to debian-devel-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Gunnar Wolf]

Vincent Bernat dijo [Fri, Jul 11, 2008 at 10:08:09PM +0200]:
> > The problem I see with that is that people will be left without a
> > supported dom0 kernel at some point during the etch lifetime. Do we have
> > a plan to address that? Shouldn't we make it clear that we will support
> > the etch kernel until a lenny+1/2 kernel is available, for example?
>
> The problem also appears for vserver kernel.

It is currently in Sid [1], and it has been for some time already. It
seems it will very soon reach Lenny [2] (In case status changes by the
moment you check it: linux-2.6 is going in today (thanks to manual
hinting by luk) )

Greetings,

[1] http://packages.debian.org/search?keywords=linux-image-2.6.25-2-vserver-amd64

[2] http://release.debian.org/migration/testing.pl?package=linux-2.6

--
Gunnar Wolf - gwolf@... - ([phone] / 1451-2244
PGP key 1024D/8BB527AF 2001-10-23
Fingerprint: 0C79 D2D1 2C4E 9CE4 5973  F800 D80E F35A 8BB5 27AF


--
To UNSUBSCRIBE, email to debian-devel-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Roberto C. Sánchez]

On Sat, Jul 12, 2008 at 12:03:30PM -0700, Steve Langasek wrote:

> On Fri, Jul 11, 2008 at 12:18:51PM +0200, Lucas Nussbaum wrote:
> > > > What are the plans for Xen for lenny? Is this situation likely to change
> > > > before the release?
>
> > > It will ship the hypervisor and a domU kernel. For dom0 it will need
> > > either the etch or my own[1] kernel. This may be changed later if we can
> > > get a new kernel in the stable release.
>
> > The problem I see with that is that people will be left without a
> > supported dom0 kernel at some point during the etch lifetime. Do we have
> > a plan to address that? Shouldn't we make it clear that we will support
> > the etch kernel until a lenny+1/2 kernel is available, for example?
>
> Which "we" do you expect will support it?  I haven't heard any comments from
> the security team indicating that they're willing to provide support for
> such a stale kernel beyond the normal support lifetime of etch.  If there
> should happen not to be a lenny+1/2 kernel, how long would the security team
> be expected to provide security support for 2.6.18?  Until the release of
> lenny+1?  Until the end of the *lenny* support cycle?
>
> > Wouldn't it be a good idea to ship a linux 2.6.18 kernel in lenny, only
> > for dom0, so it's clear that it is supported?
>
> I think the first question to resolve is to establish that it *is*
> supported...
>

I think that the prudent thing for Debian to do is to continue to

support the older kernel if that is the only way to ensure Xen support
for the users.  I personally have a few servers running Xen that run
stable.  If the support for Xen in a stable release is not suitable, I
would have to consider migrating those servers to some other distro.  I
would really hate to have to do that.

Regards,

-Roberto

--
Roberto C. Sánchez
http://people.connexer.com/~roberto
http://www.connexer.com

[Lucas Nussbaum]

On 12/07/08 at 12:03 -0700, Steve Langasek wrote:

> On Fri, Jul 11, 2008 at 12:18:51PM +0200, Lucas Nussbaum wrote:
> > > > What are the plans for Xen for lenny? Is this situation likely to change
> > > > before the release?
>
> > > It will ship the hypervisor and a domU kernel. For dom0 it will need
> > > either the etch or my own[1] kernel. This may be changed later if we can
> > > get a new kernel in the stable release.
>
> > The problem I see with that is that people will be left without a
> > supported dom0 kernel at some point during the etch lifetime. Do we have
> > a plan to address that? Shouldn't we make it clear that we will support
> > the etch kernel until a lenny+1/2 kernel is available, for example?
>
> Which "we" do you expect will support it?  I haven't heard any comments from
> the security team indicating that they're willing to provide support for
> such a stale kernel beyond the normal support lifetime of etch.  If there
> should happen not to be a lenny+1/2 kernel, how long would the security team
> be expected to provide security support for 2.6.18?  Until the release of
> lenny+1?  Until the end of the *lenny* support cycle?
>
> > Wouldn't it be a good idea to ship a linux 2.6.18 kernel in lenny, only
> > for dom0, so it's clear that it is supported?
>
> I think the first question to resolve is to establish that it *is*
> supported...

If nothing changes, the only choice for users will be to run an etch
dom0 (or an etch dom0 kernel with a lenny userland, but that doesn't
change much). An etch dom0 will only be supported until the end of the
etch support cycle. After that, users will need a supported upgrade
path (and I would prefer it not to be "use Ubuntu").

We (Debian) should make a clear statement that users of Debian as dom0
will have at least one supported configuration at any time during the
lenny lifetime.

Shipping an additional 2.6.18 kernel in lenny is just one extreme
solution. Another solution might work too, like stating that we (Debian)
will support the etch dom0 kernel until a dom0 kernel is available in
lenny (+ an interim period), even if the support cycle for etch ends
before that.
--
| Lucas Nussbaum
| lucas@...   http://www.lucas-nussbaum.net/ |
| jabber: lucas@...             GPG: 1024D/023B3F4F |


--
To UNSUBSCRIBE, email to debian-devel-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Steve Langasek]

On Sat, Jul 12, 2008 at 06:05:14PM -0400, Roberto C. Sánchez wrote:
> > I think the first question to resolve is to establish that it *is*
> > supported...

> I think that the prudent thing for Debian to do is to continue to
> support the older kernel if that is the only way to ensure Xen support
> for the users.  I personally have a few servers running Xen that run
> stable.  If the support for Xen in a stable release is not suitable, I
> would have to consider migrating those servers to some other distro.  I
> would really hate to have to do that.

The distro used on dom0 is pretty uninteresting, given that part of the
point of having Xen-style virtualization for servers is to a) be able to run
different OSes in different guests, and b) not to run services in dom0.[1]

If the Debian security team is unwilling or unable to provide support for a
2.6.18 kernel over the lifetime of lenny, I'm happy to see us let dom0 be
Somebody Else's Problem.  I'm certainly happier with that than having us
/claim/ to support 2.6.18, have users rely on that claim, and then not be
able to deliver.

--
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
Ubuntu Developer                                    http://www.debian.org/
slangasek@...                                     vorlon@...

[1] I can sympathize with users who want to run Xen on systems for
virtualization purposes while also being able to run a full desktop
environment in dom0 where hardware is more accessible; but I think this is
probably a fairly small group of people still given the hardware
requirements, and in any case I don't think that's a use case that should
compel us to overextend ourselves.


--
To UNSUBSCRIBE, email to debian-devel-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Steve Langasek]

On Sun, Jul 13, 2008 at 12:10:28AM +0200, Lucas Nussbaum wrote:
> > > The problem I see with that is that people will be left without a
> > > supported dom0 kernel at some point during the etch lifetime. Do we have
> > > a plan to address that? Shouldn't we make it clear that we will support
> > > the etch kernel until a lenny+1/2 kernel is available, for example?

> > Which "we" do you expect will support it?  I haven't heard any comments from
> > the security team indicating that they're willing to provide support for
> > such a stale kernel beyond the normal support lifetime of etch.  If there
> > should happen not to be a lenny+1/2 kernel, how long would the security team
> > be expected to provide security support for 2.6.18?  Until the release of
> > lenny+1?  Until the end of the *lenny* support cycle?

> > > Wouldn't it be a good idea to ship a linux 2.6.18 kernel in lenny, only
> > > for dom0, so it's clear that it is supported?

> > I think the first question to resolve is to establish that it *is*
> > supported...

> If nothing changes, the only choice for users will be to run an etch
> dom0 (or an etch dom0 kernel with a lenny userland, but that doesn't
> change much). An etch dom0 will only be supported until the end of the
> etch support cycle. After that, users will need a supported upgrade
> path (and I would prefer it not to be "use Ubuntu").

I would note that, although built as part of the main 'linux' source package
in Ubuntu, the Xen kernel images are in Ubuntu universe - which means any
Xen-specific code is effectively not guaranteed to be covered by Canonical's
security support anyway.  So you might want to take a closer look at the
security status of this, before deciding that Ubuntu is the right choice for
a security-supported dom0 kernel (or before goading Debian folks into
overcommitting themselves to Xen support in lenny using Ubuntu as a bogeyman
;).

(N.B., I'm not speaking on behalf of the Ubuntu Xen folks; they may indeed
have made arrangements with the security team to provide security coverage
for the Xen kernels - I'm just saying not to assume it's a given.)

> We (Debian) should make a clear statement that users of Debian as dom0
> will have at least one supported configuration at any time during the
> lenny lifetime.

What I don't see you saying is that *you* are volunteering to step up and
help provide security support for this kernel.  So it's "we" when we're
making a statement, but it's still "they" who would have to provide the
actual support, AFAICS.

--
Steve Langasek                   Give me a lever long enough and a Free OS
Debian Developer                   to set it on, and I can move the world.
Ubuntu Developer                                    http://www.debian.org/
slangasek@...                                     vorlon@...


--
To UNSUBSCRIBE, email to debian-devel-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Roberto C. Sánchez]

On Sat, Jul 12, 2008 at 06:01:30PM -0700, Steve Langasek wrote:

> On Sat, Jul 12, 2008 at 06:05:14PM -0400, Roberto C. Sánchez wrote:
> > > I think the first question to resolve is to establish that it *is*
> > > supported...
>
> > I think that the prudent thing for Debian to do is to continue to
> > support the older kernel if that is the only way to ensure Xen support
> > for the users.  I personally have a few servers running Xen that run
> > stable.  If the support for Xen in a stable release is not suitable, I
> > would have to consider migrating those servers to some other distro.  I
> > would really hate to have to do that.
>
> The distro used on dom0 is pretty uninteresting, given that part of the
> point of having Xen-style virtualization for servers is to a) be able to run
> different OSes in different guests, and b) not to run services in dom0.[1]
>
> If the Debian security team is unwilling or unable to provide support for a
> 2.6.18 kernel over the lifetime of lenny, I'm happy to see us let dom0 be
> Somebody Else's Problem.  I'm certainly happier with that than having us
> /claim/ to support 2.6.18, have users rely on that claim, and then not be
> able to deliver.
>

While agree that from a technical standpoint, that distro is rather

uninteresting, I don't want to have increase the complexity of the
networks I administer by bringing yet another distro into the mix.

Regards,

-Roberto

--
Roberto C. Sánchez
http://people.connexer.com/~roberto
http://www.connexer.com

[Guido Trotter]

On Sat, Jul 12, 2008 at 06:01:30PM -0700, Steve Langasek wrote:

Hi,

> The distro used on dom0 is pretty uninteresting, given that part of the
> point of having Xen-style virtualization for servers is to a) be able to run
> different OSes in different guests, and b) not to run services in dom0.[1]
>

Agreed, we shouldn't support arbitrary dom0s, but it would be nice to have one
supported way to run dom0 in debian, be it etch or lenny... If we say "run dom0
in etch" at least can we have the limited etch needed for a dom0 to work blessed
with an extended support, if not support 2.6.18 in lenny?

Thanks,

Guido


--
To UNSUBSCRIBE, email to debian-devel-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...