Difference between pages "Xen" and "Building a Kernel from Source"

From Funtoo
(Difference between pages)
Jump to: navigation, search
 
m
 
Line 1: Line 1:
'''Funtoo Xen Fun'''
+
Setting up a proper kernel yourself - lean, mean and tailored to your hardware, is the challenge by which a linux user can graduate to becoming a Funtoo knight ;-)
We are talking about Xen on Funtoo Linux and how to setup Xen virtualization properly.
+
Especially, we are going to show you how much fun it is to work with Xen hosts and domU's and
+
setting up a Funtoo Xen Server without general clicky GUI's or other frontends. This is true hardcore OS Xen setup especially for NOC server systems, headless servers, etc..
+
  
= Funtoo Xen Server with paravirt funtoo domU =
+
Even though many of us are using enterprise-ready kernels in datacenters, there is almost nobody who hasn't at least considered building a kernel for his laptop / PC.
'''Assumptions'''
+
We are showing here how an intermediate Linux user can use an alternative to the standard beginners "genkernel" approach,  to compile a custom kernel,  in a relatively still speedy and easy set up.
''We build a 64bit headless XEN hypervisor rockstable and rocket fast with a funtoo headless 64bit paravirt domU.''
+
We are '''not''' building Xen with pvgrub or hvm (which is kinda slow and overhead as long as you don't want to install Windoze).
+
  
== Buiding Funtoo Xen Host Dom0 ==
+
=== Minimum Requirements ===
Most of the necessary steps are covered in the Installation Tutorial.
+
You should understand the way how things work in a terminal and how to use an editor and tweak config files. This is crucial.
We only do outline here the steps that are necessary to enjoy an easy and successful Dom0 setup or if something differs from the normal installation tutorial.
+
You don't need much knowledge about the linux kernel and it's internals. Nevertheless, you have to know at least where the files are located, how they are used and what is the file logic behind the overall structure. Otherwise you should consider using a non source based linux distribution.
 +
If you are scared now, don't worry - we are going to build a kernel the Funtoo way and you will pick up everthing necessary to accomplish this challenge, step by step, so the next time you do it yourself and become a real Funtoo knight!
  
Please, open in a second tab the [[Installation (Tutorial)|Installation Tutorial]] and follow in both carefully the next steps!
+
=== Assumptions ===
 +
You start from an installed Funtoo system on the disk, or at least, you are on stage3 in a chrooted environment from a live cd, following somehow the Funto [[Installation (Tutorial)|Installation Tutorial]].
  
=== Basic Funtoo Xen Host Dom0 setup ===
+
In this case we are building a kernel that is booting root in LVM over encrypted LUKS container.
 +
If you don't have this setup, don't worry, you just don't need all the modules, but everything else is similar.
  
I recommend you use only stable packages for the host dom0 !
 
  
Please consider the decision carefully. I can't stress out enough, you will avoid a lot of problems taking the stable distrib as dom0.
+
= Getting everything in order to start =
The domU guests could be either unstable or hardened, as you wish! There comes the true fun part ;-)
+
That's why I first edit my make.conf befor building anything!
+
  
Here is how I set up the system basics:
+
First there is the decision which linux kernel sources we need.
Disk is <tt>/dev/sda</tt>
+
There are plenty of them in the repositories around, often it is not easy to distinguish between them.
  
<pre>
+
I would always trust my distribution of choice and take what is has to offer - and funtoo has a lot to offer!
/dev/sda1 is our / partition ca 20GB ext4
+
/dev/sda2 is our swap partition ca 4GB
+
/dev/sda3 holds the lvm volume group vgxen
+
</pre>
+
  
I am using volume groups over raid - which I strongly advice to everybody.
+
I really do recommend (especially if it is your first time) to build a debian-sourced genkernel like described in chapter 5 "Using Debian-Sources with Genkernel" in the [[Funtoo_Linux_Kernels| Funtoo Kernels Tutorial]].
  
Store of xen stuff:
+
From there you should have a running system booting nicely from your own build (just little bit bloated) kernel. This is more than you can expect from any other ready to go distribution.
<pre>/etc/xen/ --> xend configuration files
+
/xen/configs/ --> my xen domU configuration files folder
+
/xen/kernel/ --> my xen domU kernel folder
+
/xen/disks/ --> my xen domU image files folder
+
</pre>
+
  
Edit <tt>/etc/rc.conf</tt> and uncomment the line at the bottom for rc_sys
+
{{Note}} We are using RedHat's dracut in order to build a nice initramfs (containing all the necessary tools and extra drivers our kernel might need to start the system). Although dracut is the way to go, more sophisticated and not as buggy as gentoo's genkernel approach, more and more funtoo geeks start using slashbeast's better-initramfs, which we will cover at the end of this howto! So after having set up a genkernel from debian or gentoo sources we are going to build a kernel with either (or both) dracut or/and better-initramfs. So gentoo sources with genkernel is always my backup if anything is not working correctly on my system. For the slightly more geeky approach with my own initram I am using pf-sources, ck-sources or any other more or less heavily patched sources.
<pre>rc_sys="xen0"</pre>
+
  
== Configure and Build Xen Dom0 Kernel ==
+
Let's go!
<console>
+
###i## emerge gentoo-sources
+
###i## cd /usr/src/linux
+
###i## make menuconfig
+
</console>
+
  
These settings are current as of 3.2.1-gentoo-r2, other versions may vary:
+
== Kernel Sources ==
 +
We are going to use the kernel sources from the funtoo git repository.
  
{{kernelop
+
The source you use on your system is up to you and your needs.
|title=
+
For a laptop or desktop system, we recommend the following:
|desc=
+
General setup  --->
+
  <*> Kernel .config support
+
      [*]  Enable access to .config through /proc/config.gz
+
  
Processor type and features  --->
+
* '''sys-kernel/pf-sources'''
  [*] Paravirtualized guest support  --->
+
* '''sys-kernel/ck-sources'''
      [*]  Xen guest support
+
* '''sys-kernel/gentoo-sources'''
 +
* '''sys-kernel/git-sources'''
 +
* '''sys-kernel/sysrescue-std-sources'''
 +
* '''sys-kernel/debian-sources'''
  
Bus options (PCI etc.)  --->
+
Please, have a look in the ebuild description, look onto their homepage and take the one that suits you best!
  [*]  Xen PCI Frontend 
+
If you are unsure for now, use sys-kernel/gentoo-sources. That's always a safe bet for a general system.
  
[*] Networking support  --->
+
It is not a problem to have various kernels installed parallel, so go on with any one of them.
  Networking options  --->
+
      <*> 802.1d Ethernet Bridging
+
  
Device Drivers  --->
+
I am going to use the sys-kernel/pf-sources now, as I already had the gentoo-sources installed.
  [*] Block devices (NEW)  --->
+
      <M>  DRBD Distributed Replicated Block Device support
+
      < >  Xen virtual block device support
+
      <*>  Xen block-device backend driver
+
  
Device Drivers  --->
+
== Prerequisites ==
  [*] Network device support  --->
+
      < >  Xen network device frontend driver
+
      <*>  Xen backend network device
+
  
Device Drivers  --->
+
I don't know which tools you have already installed, so some information here might be redundant.
  Graphics support  --->
+
It doesn't harm to just copy and paste and do some steps again.
      -*- Support for frame buffer devices  ---
+
        < >  Xen virtual frame buffer support
+
  
Device Drivers  --->
+
First, we look into our <code>/etc/make.conf</code>:
  Xen driver support  --->
+
      [*] Xen memory balloon driver (NEW)
+
      [*]  Scrub pages before returning them to system (NEW)
+
      <*> Xen /dev/xen/evtchn device (NEW)
+
      [*] Backend driver support (NEW)
+
      <*> Xen filesystem (NEW)
+
      [*]  Create compatibility mount point /proc/xen (NEW)
+
      [*] Create xen entries under /sys/hypervisor (NEW)
+
      <M> userspace grant access device driver (NEW)
+
      <M> User-space grant reference allocator driver (NEW)
+
      <M> xen platform pci device driver (NEW)
+
  
File systems  --->
+
<console>
  < > Ext3 journalling file system support
+
###i## nano /etc/make.conf
  <*> The Extended 4 (ext4) filesystem
+
#These compiler flags are just tweaking (optimazation) and NOT necessary:
  [*]  Use ext4 for ext2/ext3 file systems (NEW)
+
CFLAGS="-O2 -pipe -march=native -ftracer -fforce-addr"
  [*]  Ext4 extended attributes (NEW)
+
CXXFLAGS="${CFLAGS} -fpermissive -fomit-frame-pointer"
}}
+
KDIR=/usr/src/linux
{{Fancyimportant|Don't forget to add the required drivers for your networking and sata cards. If you use RAID, make sure to add the correct CONFIG_MD_RAID* entries to your config.}}
+
KERNEL="symlink build"
 +
USE="$KERNEL ....here are your use flags...."
 +
## These modules are available:
 +
## DRACUT_MODULES="dracut_modules_biosdevname dracut_modules_btrfs dracut_modules_caps dracut_modules_crypt dracut_modules_crypt-gpg dracut_modules_dmraid dracut_modules_dmsquash-live dracut_modules_gensplash dracut_modules_iscsi dracut_modules_livenet dracut_modules_lvm dracut_modules_mdraid dracut_modules_multipath dracut_modules_nbd dracut_modules_nfs dracut_modules_plymouth dracut_modules_ssh-client dracut_modules_syslog"
 +
## We will use these modules for LVM / LUKS:
 +
DRACUT_MODULES="crypt lvm plymouth biosdevname dmraid crypt-gpg dmsquash-live ssh-client syslog"
 +
</console>
  
 +
Next, we set the package keywords:
 
<console>
 
<console>
###i## make
+
/etc/portage/package.use/dracut:
###i## make modules_install
+
sys-kernel/dracut dm net device-mapper crypt lvm
 
</console>
 
</console>
  
{{Fancynote| If you experience issues with connecting to the console ensure the module "xen_gntdev" (userspace grant access device driver) is loaded before the xenconsoled process is started (you may have to restart it after loading the module).}}
+
{{Note}} If you don't have lvm over encrypted LUKS you probably just add the "net" keyword here, or "selinux".
  
== Configuring Grub ==
 
Work has been completed to automatically enable Xen Grub entries, so after you copy your dom0 kernel edit your /etc/boot.conf as follows:
 
  
{{File
+
After that we are going to build our packages:
|/etc/boot.conf|<pre>
+
<console>
"Funtoo on Xen" {
+
###i## emerge -av app-portage/gentoolkit sys-kernel/pf-sources sys-kernel/dracut sys-boot/plymouth sys-boot/plymouth-openrc-plugin
  type xen
+
</console>
  xenkernel xen.gz
+
  xenparams loglvl=all guest_loglvl=all xsave=1 iommu=1 iommu_inclusive_mapping=1 dom0_max_vcpus=2 dom0_vcpus_pin dom0_mem=4096M
+
  kernel kernel[-v]
+
  params += quiet
+
}
+
</pre>}}
+
 
+
{{Fancynote| iommu is the paravirtualized instructions, if your motherboard or CPU does not support VT-d do, not enable it. Xsave saves the supported CPU instruction sets -- without it you're dom0 kernel may not boot. dom0_vcpus_pin permanatly assigns cpu's to dom0 -- increasing performance.}}
+
  
== Basic Networking with the Dom0 ==
+
Finished? Well, then let's go on and
Funtoo Linux offers its own modular, template-based network configuration system. This system offers a lot of flexibility for configuring network interfaces, essentially serving as a "network interface construction kit."
+
  
We are going to set eth0 as the default interface to the outside world for now. eth1 will be part of a bridge (xenbr0) that is going to be used by various domU guests.
+
== Preparing the kernel ==
  
Construct the interfaces:
+
We go now to the sources directory and enter the following commands to update the kernel's  .config  file:
 
<console>
 
<console>
###i## cd /etc/init.d/
+
###i## cd /usr/src/linux/
###i## ln -s netif.tmpl netif.xenbr0
+
###i## make clean
###i## ln -s netif.tmpl netif.extbr0
+
  CLEAN  .
###i## ln -s netif.tmpl netif.eth0
+
  CLEAN  arch/x86/kernel/acpi/realmode
###i## ln -s netif.tmpl netif.eth1
+
  CLEAN  arch/x86/kernel/cpu
###i## rc-update add netif.xenbr0 sysinit
+
  CLEAN  arch/x86/kernel
###i## rc-update add netif.extbr0 sysinit
+
  CLEAN  arch/x86/vdso
 +
  CLEAN  arch/x86/lib
 +
  CLEAN  drivers/gpu/drm/radeon
 +
  CLEAN  drivers/net/wan
 +
  CLEAN  drivers/scsi/aic7xxx
 +
  CLEAN  drivers/tty/vt
 +
  CLEAN  drivers/video/logo
 +
  CLEAN  firmware
 +
  CLEAN  kernel
 +
  CLEAN  lib/raid6
 +
  CLEAN  lib
 +
  CLEAN  security/apparmor
 +
  CLEAN  security/selinux
 +
  CLEAN  usr
 +
  CLEAN  arch/x86/boot/compressed
 +
  CLEAN  arch/x86/boot
 +
  CLEAN  .tmp_versions
 +
  CLEAN  vmlinux System.map .tmp_kallsyms2.S .tmp_kallsyms1.o .tmp_kallsyms2.o .tmp_kallsyms1.S .tmp_vmlinux1 .tmp_vmlinux2 .tmp_System.map
 +
###i## zcat /proc/config.gz > /usr/src/linux/.config
 
</console>
 
</console>
  
Make sure dhcpcd, eth0 and eth1 don't start at boot:
 
 
<console>
 
<console>
###i## rc-update del dhcpcd sysinit
+
###i## make localmodconfig
###i## rc-update del netif.eth0 sysinit
+
###i## rc-update del netif.eth1 sysinit
+
 
</console>
 
</console>
  
Configure the slave interfaces:
+
You will get some questions which you can answer mostly with either M (compiled as a module) or Y (compiled directly into the kernel).
<console>
+
<pre>
###i## cd /etc/conf.d/
+
Enable different security models (SECURITY) [Y/n/?] y
###i## echo 'template="interface-noip"' > netif.eth0
+
Enable the securityfs filesystem (SECURITYFS) [Y/?] y
###i## echo 'template="interface-noip"' > netif.eth1
+
Socket and Networking Security Hooks (SECURITY_NETWORK) [Y/?] y
</console>
+
Security hooks for pathname based access control (SECURITY_PATH) [Y/?] y
Now, we prepare the bridges:
+
Low address space for LSM to protect from user allocation (LSM_MMAP_MIN_ADDR) [65536] 65536
<console>
+
NSA SELinux Support (SECURITY_SELINUX) [Y/n/?] y
###i## nano netif.xenbr0
+
  NSA SELinux boot parameter (SECURITY_SELINUX_BOOTPARAM) [N/y/?] n
</console>
+
  NSA SELinux runtime disable (SECURITY_SELINUX_DISABLE) [N/y/?] n
here we set the internal Xen bridge:
+
  NSA SELinux Development Support (SECURITY_SELINUX_DEVELOP) [Y/n/?] y
 +
  NSA SELinux AVC Statistics (SECURITY_SELINUX_AVC_STATS) [Y/n/?] y
 +
  NSA SELinux checkreqprot default value (SECURITY_SELINUX_CHECKREQPROT_VALUE) [1] 1
 +
  NSA SELinux maximum supported policy format version (SECURITY_SELINUX_POLICYDB_VERSION_MAX) [Y/n/?] y
 +
    NSA SELinux maximum supported policy format version value (SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE) [19] 19
 +
TOMOYO Linux Support (SECURITY_TOMOYO) [Y/n/?] y
 +
  Default maximal count for learning mode (SECURITY_TOMOYO_MAX_ACCEPT_ENTRY) [2048] 2048
 +
  Default maximal count for audit log (SECURITY_TOMOYO_MAX_AUDIT_LOG) [1024] 1024
 +
  Activate without calling userspace policy loader. (SECURITY_TOMOYO_OMIT_USERSPACE_LOADER) [Y/n/?] y
 +
AppArmor support (SECURITY_APPARMOR) [Y/n/?] y
 +
  AppArmor boot parameter default value (SECURITY_APPARMOR_BOOTPARAM_VALUE) [1] 1
 +
Integrity Measurement Architecture(IMA) (IMA) [Y/n/?] y
 +
EVM support (EVM) [N/y/?] (NEW)
 +
Default security module
 +
  1. SELinux (DEFAULT_SECURITY_SELINUX)
 +
  2. TOMOYO (DEFAULT_SECURITY_TOMOYO)
 +
  3. AppArmor (DEFAULT_SECURITY_APPARMOR)
 +
> 4. Unix Discretionary Access Controls (DEFAULT_SECURITY_DAC)
 +
choice[1-4?]: 4
 +
warning: (ACPI_HOTPLUG_CPU) selects ACPI_CONTAINER which has unmet direct dependencies (ACPI && EXPERIMENTAL)
 +
warning: (MEDIA_TUNER) selects MEDIA_TUNER_TEA5761 which has unmet direct dependencies (MEDIA_SUPPORT && VIDEO_MEDIA && I2C && EXPERIMENTAL)
 +
#
 +
# configuration written to .config
 +
#
 +
warning: (GFS2_FS) selects DLM which has unmet direct dependencies (EXPERIMENTAL && INET && SYSFS && CONFIGFS_FS && (IPV6 || IPV6=n))
 +
warning: (IMA) selects TCG_TPM which has unmet direct dependencies (HAS_IOMEM && EXPERIMENTAL)
 +
warning: (MEDIA_TUNER) selects MEDIA_TUNER_TEA5761 which has unmet direct dependencies (MEDIA_SUPPORT && VIDEO_MEDIA && I2C && EXPERIMENTAL)
 +
warning: (ACPI_HOTPLUG_CPU) selects ACPI_CONTAINER which has unmet direct dependencies (ACPI && EXPERIMENTAL)
 +
root@[~src/linux] #
 +
 
 +
</pre>
  
{{File
+
Now comes the most adventurous part!
|/etc/conf.d/netif.xenbr0|<pre>
+
template="bridge"
+
ipaddr="10.0.1.200/24"
+
gateway="10.0.1.1"
+
nameservers="10.0.1.1 10.0.1.2"
+
domain="funtoo.org"
+
slaves="netif.eth0"
+
</pre>}}
+
  
Then, we set up the external interface:
+
= Building the Kernel =
 
<console>
 
<console>
###i## nano netif.extbr0
+
##i### make -j8  bzImage
 +
##i### make -j8 modules
 +
##i### make modules_install
 +
##i### make install
 
</console>
 
</console>
{{Fancynote| This will look quite similar. Please watch out for the correct slave setting!}}
 
  
{{File
 
|/etc/conf.d/netif.extbr0|<pre>
 
template="bridge"
 
ipaddr="10.0.1.201/24"
 
gateway="10.0.1.1"
 
nameservers="10.0.1.1 10.0.1.2"
 
domain="funtoo.org"
 
slaves="netif.eth1"
 
</pre>}}
 
  
This gives us the possibility to play around with various setups later, it's modular and easy to tweak and change.
+
'''Building an initramfs or not?'''
  
{{Fancytip| It is probably a good idea to try starting the interfaces with rc before rebooting.}}
+
The reason to build a kernel with an initramfs is mostly for interoperability (e.g. live-cd's) and special features like an included busybox, ssh, etc.  But mostly, and that's why we are doing this here now, to have a proper kernel up and running quick'n dirty in a reasonable time without fighting hours and days until a more or less exotic hardware is perfectly run by the kernel.
 +
After having a proper basic kernel running with the help of an initramfs, I really recommend you to go a step further and build a true kernel with all features includes without an initramfs. But this could be pain in the ass and very time consuming - so we do it the funtoo way here - at least in the second example when we stick to better-initramfs instead of Red-Hat's ''dracut''.
  
== Basic Networking with domU ==
+
= Option one: Initrd with dracut =
  
The easiest way is to let Xen set up the networking. But if everything is up and running it is not possible to change the routings, etc.
+
To build the initrd we just execute
Letting Xen do the bridges will be obsolete in the near future. So this is not the recommended way anymore. As we already set up the bridges in the previous section it may be enough to comment everything network related. If not, just un-comment the last lines.
+
  
We edit the /etc/xen/xend-config.sxp
+
<console>
 +
# ##i##dracut -f --fstab --xz /boot/initramfs-3.2.6-pf.img  3.2.6-pf
 +
</console>
  
<pre>
+
Generally, this really should be enough!
#### Xen config from maiwald.tk - Xen 4.x Network in bridge mode
+
If you experience booting problems like missing modules / drivers then just boot from the genkernel section and fix the initrd building. You can look into the man page to tweak the command a bit (e.g. --add-drivers "xz dm_crypt" etc...).
  
(logfile /var/log/xen/xend.log)
+
Ok let's go on and finish the taks, we are going to tell now grub how to boot off correctly!
(loglevel DEBUG)
+
  
(xend-relocation-server no)
+
<pre>
(xend-relocation-hosts-allow '^localhost$ ^localhost\\.localdomain$')
+
root@[~src/linux] # nano /etc/boot.conf
  
# The limit (in kilobytes) on the size of the console buffer
+
boot {
(console-limit 1024)
+
        generate grub
 +
        default "Funtoo Linux dracut"
 +
        timeout 3
 +
}
  
(dom0-min-mem 384)
+
"Funtoo Linux genkernel" {
(enable-dom0-ballooning no)
+
        kernel kernel-genkernel[-v]
 +
        initrd initramfs-genkernel[-v]
 +
        params = quiet rootfstype=ext4
 +
        params += luks enc_root=/dev/sda3
 +
        params += lvm root=/dev/mapper/vg-root
 +
}
  
(total_available_memory 0)
+
"Funtoo Linux dracut" {
(dom0-cpus 0)
+
        kernel vmlinuz[-v]
 +
## this is the better-initramfs generated initrd
 +
        initrd initramfs[-v].img
 +
        params  = quiet rootfstype=ext4
 +
        params += luks enc_root=/dev/sda3
 +
        params += lvm root=/dev/mapper/vg-root
 +
}
  
(vncpasswd 'geheim')
 
 
# let xen create the net
 
# (network-script    network-bridge)
 
# (vif-script        vif-bridge)
 
 
# we create the net - new default in Xen 4
 
#
 
#(network-script 'network-bridge netdev=eth0 bridge=xenbr0 vifnum=0')
 
#(vif-script vif-bridge bridge=xenbr0)
 
 
</pre>
 
</pre>
  
= Building the Funtoo Xen DomU Container =
+
That's it almost!
 
+
We are going to build the DomU now, preparing first from outside the domU.
+
 
+
=== create lvm volume or partition or image file ===
+
 
+
''This is a stub, please help completing this guide here!''
+
  
 +
Now write to the grub.cfg with the new handy boot-update script from funtoo:
 
<console>
 
<console>
###i## vgcreate vgxen /dev/sda3
+
root@[~src/linux] # boot-update -v
###i## lvcreate -L10G -n funtoo_root vgxen
+
###i## lvcreate -L1G -n funtoo_swap vgxen
+
###i## vgchange -a y
+
###i## mkfs.ext4 -L funtoo_root /dev/vgxen/funtoo_root
+
###i## mkswap -L funtoo_swap /dev/vgxen/funtoo_swap
+
###i## rc-update add lvm boot
+
</console>
+
== Basic DomU System setup ==
+
=== mount domU lvm volume or physical partition or image file===
+
<console>
+
###i## mkdir /mnt/domu1
+
###i## mount /dev/vgxen/funtoo_root /mnt/domu1
+
###i## cd /mnt/domu1
+
 
</console>
 
</console>
 +
<pre>
 +
root@[~src/linux] # sudo boot-update -v
  
=== get stage3 ===
+
boot-update 1.5.2 / Copyright 2009-2011 Funtoo Technologies
from a funtoo mirror near you, I suggest you look at the funtoo homepage
+
  
<console>
+
[use option "-l" for license info, "-h" for help]
###i## links http://www.funtoo.org/wiki/Download </console>
+
Then choose a mirror near you ( I use Heanet in EU ) and look for the right stage3. I use XEON CPUs so I take the core2 distrib:
+
+
<console>
+
###i## wget -cv http://ftp.heanet.ie/mirrors/funtoo/funtoo-stable/x86-64bit/core2_64/stage3-latest.tar.xz </console>
+
Unfortunately I can't find md5sums or similar which is really unpleasant.
+
  
=== Get latest portage tree from the snapshots firectory ===
+
* Generating config for grub...
  
<console>
+
DEFAULT > Funtoo Linux - vmlinuz-3.2.6-pf
###i## wget -cv http://ftp.heanet.ie/mirrors/funtoo/funtoo-stable/snapshots/portage-current.tar.xz </console>
+
          Funtoo Linux genkernel - kernel-genkernel-x86_64-3.2.6-pf
=== Extract the stage3 ===
+
<console>
+
###i## tar xpf stage3-current.tar.xz
+
</console>
+
  
=== Extract Portage ===
+
* Completed successfully.
 +
</pre>
  
<console>
+
Okay,... here you go..! :)
###i## cd usr
+
###i## tar xf ../portage-current.tar.xz
+
</console>
+
  
== Preparing the chroot environment ==
+
Reboot and see how it works!
=== Editing the make.conf ===
+
copy the <tt>/etc/make.conf</tt> from dom0 and adjust it:
+
  
<console>
+
= Option two: using better-initramfs =
###i## cp /etc/portage/make.conf /mnt/domu1/etc/
+
</console>
+
  
make sure to adjust MAKEOPTS to your assigned CPUs (rule of thumb: cpu cores +1 - yes, even in XEN)
+
Piotr's better-initramfs is another approach that is tiny, nice and shiny and seems to become more and more a favourite among funtoo'ers. The biggest plus is that, once built it is kernel version independant.
<console>
+
 
###i## nano -w /mnt/domu1/etc/portage/make.conf
+
For using this you just do the following steps:
</console>
+
out there the MAKEOPTS variable in:
+
 
<pre>
 
<pre>
MAKEOPTS="-j2"
+
1. download sources
 +
2. build kernel with "make bzImage"
 +
3. download better-initramfs
 +
4. run better-initramfs
 +
5. adjust /etc/boot.conf
 
</pre>
 
</pre>
  
=== Copy <tt>/etc/resolv.conf</tt> ===
+
Here is how in detail:
<console>
+
###i## cp -L /etc/resolv.conf /mnt/domu1/etc/
+
</console>
+
  
=== mount proc and dev ===
+
Assuming you did install already a genkernel backup or at least you have a working bzImage + modules installed, we rush forward to step 3:
<console>
+
###i## mount -t proc none /mnt/domu1/proc
+
###i## mount --rbind /dev /mnt/domu1/dev
+
</console>
+
  
== Building Funtoo Xen Guest(s) DomU ==
+
=== download better-initramfs ===
  
== Final DomU System setup ==
 
=== chroot ===
 
 
<console>
 
<console>
###i## chroot /mnt/domu1 /bin/bash
+
# cd /usr/src/;
###i## env-update
+
# git clone https://github.com/slashbeast/better-initramfs.git
###i## source /etc/profile
+
###i## export PS1="(domU-chroot) $PS1"
+
</console>
+
  
=== sync portage ===
+
# /src # cd better-initramfs
<console>
+
# better-initramfs git:(master) ls
###i## emerge --sync
+
AUTHORS    LICENSE  README.rst  bootstrap  output  sourceroot
 +
ChangeLog  Makefile  TODO        examples  scripts
 
</console>
 
</console>
  
=== set locales ===  
+
=== build the better-initramfs ===
 
<console>
 
<console>
###i## nano -w /etc/locale.gen
+
# better-initramfs git:(master) sudo bootstrap/bootstrap-all
###i## locale-gen
+
Passwort: xxx
 +
# from here go and grab a coffee
 +
# sudo make prepare
 +
# sudo make image
 +
# sudo mv output/initramfs.cpio.gz /boot
 
</console>
 
</console>
  
=== Set your timezone ===  
+
=== adjust grub ===
(choose your timezone in <tt>/usr/share/zoneinfo</tt>)
+
<console>
+
###i## ln -v -sf /usr/share/zoneinfo/Europe/Amsterdam /etc/localtime
+
</console>
+
  
=== Edit <tt>/etc/fstab</tt> (see also gentoo handbook as reference) ===
+
Taking the above setup we edit the /etc/boot.conf
We assume that we name our root partition <tt>xvda1</tt> and the swap partition <tt>xvda2</tt> in our <tt>domU-xen-</tt> config (we will do that later)
+
as I installed genkernel first, and dracut after - you see this setup:
<console>
+
###i## nano -w /etc/fstab
+
</console>
+
  
 
<pre>
 
<pre>
/dev/xvda1      /              ext4    noatime 0 1
+
boot {
/dev/xvda2      none          swap    sw      0 0
+
        generate grub
shm            /dev/shm      tmpfs  nodev,nosuid,noexec    0 0
+
        default "Funtoo Linux"
</pre>
+
        timeout 3
 +
}
  
=== The most important stuff ===
+
# Rootfs over lvm over luks
Copy this into your terminal:
+
# /dev/sda3 - encrypted lvm's pv
 +
# /dev/mapper/vg-root - rootfs's lv
  
<pre>
+
"Funtoo Linux" {
echo '
+
        kernel bzImage[-v]
                        Larry loves Funtoo
+
## this is the better-initramfs generated initrd
                      _________________________
+
        initrd initramfs.cpio.gz
                      < Have you mooed today? >
+
        params  = quiet rootfstype=ext4
                      -------------------------
+
        params += luks enc_root=/dev/sda3
                        \  ^__^
+
        params += lvm root=/dev/mapper/vg-root
                        \  (oo)\_______
+
}
                            (__)\      )\/\
+
                                ||----w |
+
                                ||    ||
+
.::::::::::::::: WELCOME TO ^^^^^^^^^^^^^^^^^^^:::::::::::::..
+
...............................................................
+
:########:'##::::'##:'##::: ##:'########::'#######:::'#######::.
+
:##.....:: ##:::: ##: ###:: ##:... ##..::'##.... ##:'##.... ##::
+
:##::::::: ##:::: ##: ####: ##:::: ##:::: ##:::: ##: ##:::: ##::
+
:######::: ##:::: ##: ## ## ##:::: ##:::: ##:::: ##: ##:::: ##::
+
:##...:::: ##:::: ##: ##. ####:::: ##:::: ##:::: ##: ##:::: ##::
+
:##::::::: ##:::: ##: ##:. ###:::: ##:::: ##:::: ##: ##:::: ##::
+
:##:::::::. #######:: ##::. ##:::: ##::::. #######::. #######::′
+
.::::::::::.......:::..::::..:::::..::::::.......::::.......::´
+
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
+
'> /etc/motd
+
</pre>
+
We are using the echo instead of „emerge --moo „ as larry still moo's in gentoo'ish
+
  
So that's it - almost.
+
"Funtoo Linux dracut" {
 +
        kernel vmlinuz[-v]
 +
## this is the dracut generated initrd
 +
        initrd initramfs[-v].img
 +
        params  = quiet rootfstype=ext4
 +
        params += luks enc_root=/dev/sda3
 +
        params += lvm root=/dev/mapper/vg-root
 +
}
  
==== Adding networking to the domU: ====
 
  
<console>
+
"Funtoo Linux genkernel" {
(domU-chroot) ###i## cd /etc/init.d/
+
        kernel kernel-genkernel[-v]
(domU-chroot) ###i## ln -sf netif.tmpl netif.eth0
+
        initrd initramfs-genkernel[-v]
(domU-chroot) ###i## rc-update add netif.eth0
+
        params = quiet rootfstype=ext4
* service netif.eth0 added to runlevel sysinit
+
        params += luks enc_root=/dev/sda3
</console>
+
        params += lvm root=/dev/mapper/vg-root
 +
}
 +
</pre>
 +
Okay,... here you go..! :)
  
==== Now we are ready for the final setups ====
+
update the grub.cfg, then reboot and see how it works!
<console>
+
(domU-chroot) ###i## emerge eix
+
(domU-chroot) ###i## eix-update
+
Reading Portage settings ..
+
Building database (/var/cache/eix) ..
+
[0] "gentoo" /usr/portage/ (cache: metadata-md5-or-flat)
+
    Reading category 154|154 (100%) Finished           
+
Applying masks ..
+
Calculating hash tables ..
+
Writing database file /var/cache/eix ..
+
Database contains 15729 packages in 154 categories.
+
 
+
(domU-chroot) # exit
+
exit
+
</console>
+
 
+
From here you have to decide how you want to run your domU: with unpriviledged users and sudo or with a root account enabled or as a webserver or firewall.
+
 
+
I always install the openssh server and just place my ssh keys in there. From there the steps differ.
+
  
 
<console>
 
<console>
(dom0-xen) ###i## cp /root/.ssh/authorized_keys /mnt/domu1/root/.ssh/
+
root@[~src/linux-3.2.6-pf] # boot-update -v   
</console>
+
Also, don't forget to enable PubKeyAuth in your sshd_config in your domU and set <tt>PermitRootLogin</tt> to yes!
+
  
'''Double checking''': Does your domU use kernel modules or not? If you haven't built a monolitic kernel you should copy the modules from the dom0 to the domU now:
+
boot-update 1.5.2 / Copyright 2009-2011 Funtoo Technologies
<console>
+
(dom0-xen) ###i## mkdir /mnt/domu1/lib/modules
+
(dom0-xen) ###i## rsync -aP /lib/modules/2.6.38-xen-maiwald.tk-dom0 /mnt/domu1/lib/modules/
+
</console>
+
  
Don't forget to clean up the mounts!
+
[use option "-l" for license info, "-h" for help]
  
<console>
+
* Generating config for grub...
(dom0-xen) ###i## cd
+
(dom0-xen) ###i## umount -l /mnt/domu1/proc
+
(dom0-xen) ###i## umount -l /mnt/domu1/dev
+
(dom0-xen) ###i## umount -l /mnt/domu1
+
</console>
+
  
=== Booting the Xen DomU Guest ===
+
DEFAULT > Funtoo Linux better-initramfs - vmlinuz-3.2.6-pf
 +
          Funtoo Linux dracut - vmlinuz-3.2.6-pf
 +
          Funtoo Linux genkernel - kernel-genkernel-x86_64-3.2.6-ck
  
Ok, let's try the first boot of the newly created Xen DomU in Funtoo!
+
* Completed successfully.
  
<console>
+
root@[~src/linux-3.2.6-pf] #
(dom0-xen) ###i## cd /xen
+
(dom0-xen) ###i## xm create -c configs/funtoo.cfg
+
</console>
+
Huuuuiiiii.....
+
<pre>
+
Using config file "./configs/funtoo.cfg".
+
Started domain funtoo (id=4)
+
[    0.000000] Linux version 2.6.38-xen-maiwald.tk-domU (root@xen) (gcc version 4.4.5 (Gentoo 4.4.5 p1.0, pie-0.4.5) ) #4 SMP Wed Feb 8 17:30:33 CET 2012
+
[   0.000000] Command line: root=/dev/xvda1 ro ip=217.x.x.211:127.0.255.255:217.x.x.1:255.255.255.0:domU:eth0:off xencons=tty console=xvc0 raid=noautodetect
+
[    0.000000] Xen-provided physical RAM map:
+
[    0.000000]  Xen: 0000000000000000 - 0000000040800000 (usable)
+
[    0.000000] NX (Execute Disable) protection: active
+
[    0.000000] last_pfn = 0x40800 max_arch_pfn = 0x80000000
+
[    0.000000] init_memory_mapping: 0000000000000000-0000000040800000
+
[    0.000000] Zone PFN ranges:
+
[    0.000000]  DMA      0x00000000 -> 0x00001000
+
[    0.000000]  DMA32    0x00001000 -> 0x00100000
+
[    0.000000]  Normal  empty
+
[    0.000000] Movable zone start PFN for each node
+
[    0.000000] early_node_map[2] active PFN ranges
+
[    0.000000]    0: 0x00000000 -> 0x00040000
+
[    0.000000]    0: 0x00040800 -> 0x00040800
+
[    0.000000] setup_percpu: NR_CPUS:16 nr_cpumask_bits:16 nr_cpu_ids:1 nr_node_ids:1
+
[    0.000000] PERCPU: Embedded 18 pages/cpu @ffff88003efc0000 s42304 r8192 d23232 u73728
+
[    0.000000] Swapping MFNs for PFN 6d6 and 3efc7 (MFN 15deb0 and 1223bf)
+
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 256109
+
[    0.000000] Kernel command line: root=/dev/xvda1 ro ip=217.171.190.211:127.0.255.255:217.171.190.1:255.255.255.0:alyx1:eth0:off xencons=tty console=xvc0 raid=noautodetect
+
[    0.000000] PID hash table entries: 4096 (order: 3, 32768 bytes)
+
[    0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes)
+
[    0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes)
+
[    0.000000] Software IO TLB disabled
+
[    0.000000] Memory: 1022732k/1056768k available (3657k kernel code, 8192k absent, 25844k reserved, 1261k data, 264k init)
+
[    0.000000] SLUB: Genslabs=15, HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
+
[    0.000000] Hierarchical RCU implementation.
+
[    0.000000] NR_IRQS:96
+
[    0.000000] Xen reported: 2992.570 MHz processor.
+
[    0.000000] Console: colour dummy device 80x25
+
[    0.000000] console [tty-1] enabled
+
[    0.150003] Calibrating delay using timer specific routine.. 6018.63 BogoMIPS (lpj=30093193)
+
[    0.150008] pid_max: default: 32768 minimum: 301
+
[    0.150034] Mount-cache hash table entries: 256
+
[    0.150173] SMP alternatives: switching to UP code
+
[    0.170232] Freeing SMP alternatives: 20k freed
+
[    0.170342] Brought up 1 CPUs
+
[    0.170377] devtmpfs: initialized
+
[    0.170601] xor: automatically using best checksumming function: generic_sse
+
[    0.220004]    generic_sse:  7325.200 MB/sec
+
[    0.220008] xor: using function: generic_sse (7325.200 MB/sec)
+
[    0.220091] NET: Registered protocol family 16
+
[    0.220186] Brought up 1 CPUs
+
[    0.220217] bio: create slab <bio-0> at 0
+
[    0.390014] raid6: int64x1  2353 MB/s
+
[    0.560003] raid6: int64x2  2964 MB/s
+
[    0.730026] raid6: int64x4  2357 MB/s
+
[    0.900012] raid6: int64x8  2116 MB/s
+
[    1.070007] raid6: sse2x1    5349 MB/s
+
[    1.240009] raid6: sse2x2    5404 MB/s
+
[    1.410005] raid6: sse2x4    8597 MB/s
+
[    1.410008] raid6: using algorithm sse2x4 (8597 MB/s)
+
[    1.410022] suspend: event channel 6
+
[    1.410022] xen_mem: Initialising balloon driver.
+
[    1.410096] Switching to clocksource xen
+
[    1.410125] FS-Cache: Loaded
+
[    1.410152] CacheFiles: Loaded
+
[    1.410268] NET: Registered protocol family 2
+
[    1.410288] IP route cache hash table entries: 32768 (order: 6, 262144 bytes)
+
[    1.410391] TCP established hash table entries: 131072 (order: 9, 2097152 bytes)
+
[    1.410951] TCP bind hash table entries: 65536 (order: 8, 1048576 bytes)
+
[    1.411180] TCP: Hash tables configured (established 131072 bind 65536)
+
[    1.411183] TCP reno registered
+
[    1.411186] UDP hash table entries: 512 (order: 2, 16384 bytes)
+
[    1.411192] UDP-Lite hash table entries: 512 (order: 2, 16384 bytes)
+
[    1.411229] NET: Registered protocol family 1
+
[    1.411290] platform rtc_cmos: registered platform RTC device (no PNP device found)
+
[    1.411401] Intel AES-NI instructions are not detected.
+
[    1.411437] audit: initializing netlink socket (disabled)
+
[    1.411444] type=2000 audit(1330014455.606:1): initialized
+
[    1.412612] fuse init (API version 7.16)
+
[    1.412674] msgmni has been set to 2048
+
[    1.412990] NET: Registered protocol family 38
+
[    1.413018] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 253)
+
[    1.413024] io scheduler noop registered (default)
+
[    1.413026] io scheduler deadline registered
+
[    1.413049] io scheduler cfq registered
+
[    1.413079] Non-volatile memory driver v1.3
+
[    1.413088] Hangcheck: starting hangcheck timer 0.9.1 (tick is 180 seconds, margin is 60 seconds).
+
[    1.413090] Hangcheck: Using getrawmonotonic().
+
[    1.419520] Switched to NOHz mode on CPU #0
+
[    1.423394] brd: module loaded
+
[    1.423665] loop: module loaded
+
[    1.423771] nbd: registered device at major 43
+
[    1.426180] Xen virtual console successfully installed as tty1
+
[    1.426216] Event-channel device installed.
+
[    1.441658] netfront: Initialising virtual ethernet driver.
+
[    1.444972] xen-vbd: registered block device major 202
+
[    1.444988] blkfront: xvda1: barriers enabled
+
[    1.450287] Setting capacity to 20971520
+
[    1.450294] xvda1: detected capacity change from 0 to 10737418240
+
[    1.450677] blkfront: xvda2: barriers enabled
+
[    1.451661] Setting capacity to 2097152
+
[    1.451665] xvda2: detected capacity change from 0 to 1073741824
+
[    1.452020] bonding: Ethernet Channel Bonding Driver: v3.7.0 (June 2, 2010)
+
[    1.452023] bonding: Warning: either miimon or arp_interval and arp_ip_target module parameters must be specified, otherwise bonding will not detect link failures! see bonding.txt for details.
+
[    1.453016] i8042: No controller found
+
[    1.453066] mousedev: PS/2 mouse device common for all mice
+
[    1.453113] rtc_cmos rtc_cmos: rtc core: registered rtc_cmos as rtc0
+
[    1.453145] rtc_cmos: probe of rtc_cmos failed with error -38
+
[    1.453155] md: linear personality registered for level -1
+
[    1.453158] md: raid0 personality registered for level 0
+
[    1.453161] md: raid1 personality registered for level 1
+
[    1.453163] md: raid6 personality registered for level 6
+
[    1.453166] md: raid5 personality registered for level 5
+
[    1.453168] md: raid4 personality registered for level 4
+
[    1.453224] device-mapper: uevent: version 1.0.3
+
[    1.453273] device-mapper: ioctl: 4.19.1-ioctl (2011-01-07) initialised: dm-devel@redhat.com
+
[    1.453340] device-mapper: multipath: version 1.2.0 loaded
+
[    1.453343] device-mapper: multipath round-robin: version 1.0.0 loaded
+
[    1.453345] device-mapper: multipath queue-length: version 0.1.0 loaded
+
[    1.453347] device-mapper: multipath service-time: version 0.2.0 loaded
+
[    1.453396] Netfilter messages via NETLINK v0.30.
+
[    1.453410] nf_conntrack version 0.5.0 (8192 buckets, 32768 max)
+
[    1.453478] ctnetlink v0.93: registering with nfnetlink.
+
[    1.453486] IPv4 over IPv4 tunneling driver
+
[    1.453548] TCP westwood registered
+
[    1.453550] TCP highspeed registered
+
[    1.453552] TCP htcp registered
+
[    1.453553] TCP vegas registered
+
[    1.453555] Initializing XFRM netlink socket
+
[    1.453630] NET: Registered protocol family 10
+
[    1.453803] IPv6 over IPv4 tunneling driver
+
[    1.453863] NET: Registered protocol family 17
+
[    1.453868] NET: Registered protocol family 15
+
[    1.453870] Registering the dns_resolver key type
+
[    1.550094] /usr/src/linux-2.6.38-xen/drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
+
[    3.070104] IP-Config: Complete:
+
[    3.070109]      device=eth0, addr=217.171.190.211, mask=255.255.255.0, gw=217.171.190.1,
+
[    3.070116]      host=alyx1, domain=, nis-domain=(none),
+
[    3.070119]      bootserver=127.0.255.255, rootserver=127.0.255.255, rootpath=
+
[    3.070212] md: Skipping autodetection of RAID arrays. (raid=autodetect will force)
+
[    3.107309] EXT4-fs (xvda1): mounted filesystem with ordered data mode. Opts: (null)
+
[    3.107321] VFS: Mounted root (ext2 filesystem) readonly on device 202:1.
+
[    3.140059] devtmpfs: mounted
+
[    3.140239] Freeing unused kernel memory: 264k freed
+
INIT: version 2.88 booting
+
  
  OpenRC 0.8.3 is starting up Funtoo Linux (x86_64)
+
root@[~src/linux-3.2.6-pf] # reboot
  
* Mounting /proc ...
+
System going down for reboot!
[ ok ]
+
* WARNING: rc_sys not defined in rc.conf. Falling back to automatic detection
+
* Caching service dependencies ...
+
[ ok ]
+
* Mounting /sys ...
+
[ ok ]
+
* udev: /dev already mounted, skipping...
+
* Mounting /dev/pts ...
+
[ ok ]
+
* Mounting /dev/shm ...
+
[ ok ]
+
* Bringing up network interface lo ...
+
RTNETLINK answers: File exists
+
[ ok ]
+
* Bringing up network interface lo ...
+
RTNETLINK answers: File exists
+
RTNETLINK answers: File exists
+
[ ok ]
+
* Starting udevd daemon ...
+
* Populating /dev with existing devices through uevents ...
+
[ ok ]
+
* Autoloaded 0 module(s)
+
* Checking local filesystems  ...
+
funtoo_root: Superblock last write time is in the future.
+
        (by less than a day, probably due to the hardware clock being incorrectly set).  FIXED.
+
funtoo_root: clean, 173796/655360 files, 436917/2621440 blocks
+
[ ok ]
+
* Remounting root filesystem read/write ...
+
[ ok ]
+
* Updating /etc/mtab ...
+
[ ok ]
+
* Mounting local filesystems ...
+
[ ok ]
+
* Configuring kernel parameters ...
+
[ ok ]
+
* Creating user login records ...
+
[ ok ]
+
* Cleaning /var/run ...
+
[ ok ]
+
* Wiping /tmp directory ...
+
[ ok ]
+
* Setting hostname to localhost ...
+
[ ok ]
+
* Activating swap devices ...
+
[ ok ]
+
* udev: storing persistent rules ...
+
[ ok ]
+
* Initializing random number generator ...
+
[ ok ]
+
INIT: Entering runlevel: 3
+
* Mounting network filesystems ...
+
[ ok ]
+
* Generating dsa host key ...
+
Generating public/private dsa key pair.
+
Your identification has been saved in /etc/ssh/ssh_host_dsa_key.
+
Your public key has been saved in /etc/ssh/ssh_host_dsa_key.pub.
+
The key fingerprint is:
+
25:e0:a8:05:xxxxxxxxxxxx:1c:1f:ba root@localhost
+
The key's randomart image is:
+
+--[ DSA 1024]----+
+
|  ooo.B.o        |
+
| o o *.B o .    |
+
|  . + + = =      |
+
|  o  + *      |
+
|  .  E S        |
+
|                |
+
|                |
+
|                |
+
|                |
+
+-----------------+
+
[ ok ]
+
* Generating rsa host key ...
+
Generating public/private rsa key pair.
+
Your identification has been saved in /etc/ssh/ssh_host_rsa_key.
+
Your public key has been saved in /etc/ssh/ssh_host_rsa_key.pub.
+
The key fingerprint is:
+
22:e3:46:28:67:xxxxxxxxxxxxxxxxxxxxx:e5:c3 root@localhost
+
The key's randomart image is:
+
+--[ RSA 2048]----+
+
|.    o. ..      |
+
|oo  o ..o        |
+
|=oo  o  E      |
+
|.*oo.    .      |
+
|o *.+ . S        |
+
| + o o .        |
+
|    o            |
+
|  .            |
+
|                |
+
+-----------------+
+
[ ok ]
+
* Starting sshd ...
+
[ ok ]
+
* Starting local
+
[ ok ]
+
  
 
                        Larry loves Funtoo
 
                      _________________________
 
                      < Have you mooed today? >
 
                      -------------------------
 
                          ^__^
 
                          (oo)_______
 
                            (__)      )/
 
                                ||----w |
 
                                ||    ||
 
.::::::::::::::::::::: WELCOME TO ::::::::::::::::::::::::::..
 
...............................................................
 
:########:'##::::'##:'##::: ##:'########::'#######:::'#######::.
 
:##.....:: ##:::: ##: ###:: ##:... ##..::'##.... ##:'##.... ##::
 
:##::::::: ##:::: ##: ####: ##:::: ##:::: ##:::: ##: ##:::: ##::
 
:######::: ##:::: ##: ## ## ##:::: ##:::: ##:::: ##: ##:::: ##::
 
:##...:::: ##:::: ##: ##. ####:::: ##:::: ##:::: ##: ##:::: ##::
 
:##::::::: ##:::: ##: ##:. ###:::: ##:::: ##:::: ##: ##:::: ##::
 
:##:::::::. #######:: ##::. ##:::: ##::::. #######::. #######::′
 
.::::::::::.......:::..::::..:::::..::::::.......::::.......::´
 
This is localhost.unknown_domain (Linux x86_64 2.6.38-xen-maiwald.tk-domU) 17:27:40
 
 
localhost login:
 
</pre>
 
 
=== Finalizing the setup ===
 
Now we test if we can reach the DomU from our Desktop:
 
<console>
 
(2034)-~% ssh -lroot 217.x.x.211 
 
The authenticity of host '217.x.x.211 (217.x.x.211)' can't be established.
 
RSA key fingerprint is 22:e3:xxxxxxxx:b0:3c:xxxxx:d6:e5:c3.
 
Are you sure you want to continue connecting (yes/no)? yes
 
Warning: Permanently added '217.x.x.211' (RSA) to the list of known hosts.
 
Enter passphrase for key '/home/mm/.ssh/id_rsa':
 
localhost ~ # uname -a
 
Linux localhost 2.6.38-xen-maiwald.tk-domU #4 SMP Wed Feb 8 17:30:33 CET 2012 x86_64 Intel(R) Xeon(R) CPU E3110 @ 3.00GHz GenuineIntel GNU/Linux
 
localhost ~ #
 
 
</console>
 
</console>
  
Now switch back to the Funtoo [[Installation (Tutorial)|Installation Tutorial]] and go on with setting up your new domU guest like a normal funtoo linux system!
 
 
'''Please consider supporting this Wiki by editing this page and keeping it current!'''
 
 
Funtoo is a perfect Xen Host and I recommend it to everybody as an alternative to .deb/.rpm Systems.
 
  
Have fun!
+
[[Category:HOWTO]]
[[Category:Virtualization]]
+
 
[[Category:Featured]]
 
[[Category:Featured]]
 +
[[Category:Kernel]]

Revision as of 17:25, 9 January 2014

Setting up a proper kernel yourself - lean, mean and tailored to your hardware, is the challenge by which a linux user can graduate to becoming a Funtoo knight ;-)

Even though many of us are using enterprise-ready kernels in datacenters, there is almost nobody who hasn't at least considered building a kernel for his laptop / PC. We are showing here how an intermediate Linux user can use an alternative to the standard beginners "genkernel" approach, to compile a custom kernel, in a relatively still speedy and easy set up.

Minimum Requirements

You should understand the way how things work in a terminal and how to use an editor and tweak config files. This is crucial. You don't need much knowledge about the linux kernel and it's internals. Nevertheless, you have to know at least where the files are located, how they are used and what is the file logic behind the overall structure. Otherwise you should consider using a non source based linux distribution. If you are scared now, don't worry - we are going to build a kernel the Funtoo way and you will pick up everthing necessary to accomplish this challenge, step by step, so the next time you do it yourself and become a real Funtoo knight!

Assumptions

You start from an installed Funtoo system on the disk, or at least, you are on stage3 in a chrooted environment from a live cd, following somehow the Funto Installation Tutorial.

In this case we are building a kernel that is booting root in LVM over encrypted LUKS container. If you don't have this setup, don't worry, you just don't need all the modules, but everything else is similar.


Getting everything in order to start

First there is the decision which linux kernel sources we need. There are plenty of them in the repositories around, often it is not easy to distinguish between them.

I would always trust my distribution of choice and take what is has to offer - and funtoo has a lot to offer!

I really do recommend (especially if it is your first time) to build a debian-sourced genkernel like described in chapter 5 "Using Debian-Sources with Genkernel" in the Funtoo Kernels Tutorial.

From there you should have a running system booting nicely from your own build (just little bit bloated) kernel. This is more than you can expect from any other ready to go distribution.

Note Note: We are using RedHat's dracut in order to build a nice initramfs (containing all the necessary tools and extra drivers our kernel might need to start the system). Although dracut is the way to go, more sophisticated and not as buggy as gentoo's genkernel approach, more and more funtoo geeks start using slashbeast's better-initramfs, which we will cover at the end of this howto! So after having set up a genkernel from debian or gentoo sources we are going to build a kernel with either (or both) dracut or/and better-initramfs. So gentoo sources with genkernel is always my backup if anything is not working correctly on my system. For the slightly more geeky approach with my own initram I am using pf-sources, ck-sources or any other more or less heavily patched sources.

Let's go!

Kernel Sources

We are going to use the kernel sources from the funtoo git repository.

The source you use on your system is up to you and your needs. For a laptop or desktop system, we recommend the following:

  • sys-kernel/pf-sources
  • sys-kernel/ck-sources
  • sys-kernel/gentoo-sources
  • sys-kernel/git-sources
  • sys-kernel/sysrescue-std-sources
  • sys-kernel/debian-sources

Please, have a look in the ebuild description, look onto their homepage and take the one that suits you best! If you are unsure for now, use sys-kernel/gentoo-sources. That's always a safe bet for a general system.

It is not a problem to have various kernels installed parallel, so go on with any one of them.

I am going to use the sys-kernel/pf-sources now, as I already had the gentoo-sources installed.

Prerequisites

I don't know which tools you have already installed, so some information here might be redundant. It doesn't harm to just copy and paste and do some steps again.

First, we look into our /etc/make.conf:

# nano /etc/make.conf
#These compiler flags are just tweaking (optimazation) and NOT necessary:
CFLAGS="-O2 -pipe -march=native -ftracer -fforce-addr"
CXXFLAGS="${CFLAGS} -fpermissive -fomit-frame-pointer"
KDIR=/usr/src/linux
KERNEL="symlink build"
USE="$KERNEL ....here are your use flags...."
## These modules are available:
## DRACUT_MODULES="dracut_modules_biosdevname dracut_modules_btrfs dracut_modules_caps dracut_modules_crypt dracut_modules_crypt-gpg dracut_modules_dmraid dracut_modules_dmsquash-live dracut_modules_gensplash dracut_modules_iscsi dracut_modules_livenet dracut_modules_lvm dracut_modules_mdraid dracut_modules_multipath dracut_modules_nbd dracut_modules_nfs dracut_modules_plymouth dracut_modules_ssh-client dracut_modules_syslog"
## We will use these modules for LVM / LUKS:
DRACUT_MODULES="crypt lvm plymouth biosdevname dmraid crypt-gpg dmsquash-live ssh-client syslog"

Next, we set the package keywords:

/etc/portage/package.use/dracut:
sys-kernel/dracut dm net device-mapper crypt lvm

Note Note: If you don't have lvm over encrypted LUKS you probably just add the "net" keyword here, or "selinux".


After that we are going to build our packages:

# emerge -av app-portage/gentoolkit sys-kernel/pf-sources sys-kernel/dracut sys-boot/plymouth sys-boot/plymouth-openrc-plugin

Finished? Well, then let's go on and

Preparing the kernel

We go now to the sources directory and enter the following commands to update the kernel's .config file:

# cd /usr/src/linux/
# make clean
  CLEAN   .
  CLEAN   arch/x86/kernel/acpi/realmode
  CLEAN   arch/x86/kernel/cpu
  CLEAN   arch/x86/kernel
  CLEAN   arch/x86/vdso
  CLEAN   arch/x86/lib
  CLEAN   drivers/gpu/drm/radeon
  CLEAN   drivers/net/wan
  CLEAN   drivers/scsi/aic7xxx
  CLEAN   drivers/tty/vt
  CLEAN   drivers/video/logo
  CLEAN   firmware
  CLEAN   kernel
  CLEAN   lib/raid6
  CLEAN   lib
  CLEAN   security/apparmor
  CLEAN   security/selinux
  CLEAN   usr
  CLEAN   arch/x86/boot/compressed
  CLEAN   arch/x86/boot
  CLEAN   .tmp_versions
  CLEAN   vmlinux System.map .tmp_kallsyms2.S .tmp_kallsyms1.o .tmp_kallsyms2.o .tmp_kallsyms1.S .tmp_vmlinux1 .tmp_vmlinux2 .tmp_System.map
# zcat /proc/config.gz > /usr/src/linux/.config
# make localmodconfig

You will get some questions which you can answer mostly with either M (compiled as a module) or Y (compiled directly into the kernel).

Enable different security models (SECURITY) [Y/n/?] y
Enable the securityfs filesystem (SECURITYFS) [Y/?] y
Socket and Networking Security Hooks (SECURITY_NETWORK) [Y/?] y
Security hooks for pathname based access control (SECURITY_PATH) [Y/?] y
Low address space for LSM to protect from user allocation (LSM_MMAP_MIN_ADDR) [65536] 65536
NSA SELinux Support (SECURITY_SELINUX) [Y/n/?] y
  NSA SELinux boot parameter (SECURITY_SELINUX_BOOTPARAM) [N/y/?] n
  NSA SELinux runtime disable (SECURITY_SELINUX_DISABLE) [N/y/?] n
  NSA SELinux Development Support (SECURITY_SELINUX_DEVELOP) [Y/n/?] y
  NSA SELinux AVC Statistics (SECURITY_SELINUX_AVC_STATS) [Y/n/?] y
  NSA SELinux checkreqprot default value (SECURITY_SELINUX_CHECKREQPROT_VALUE) [1] 1
  NSA SELinux maximum supported policy format version (SECURITY_SELINUX_POLICYDB_VERSION_MAX) [Y/n/?] y
    NSA SELinux maximum supported policy format version value (SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE) [19] 19
TOMOYO Linux Support (SECURITY_TOMOYO) [Y/n/?] y
  Default maximal count for learning mode (SECURITY_TOMOYO_MAX_ACCEPT_ENTRY) [2048] 2048
  Default maximal count for audit log (SECURITY_TOMOYO_MAX_AUDIT_LOG) [1024] 1024
  Activate without calling userspace policy loader. (SECURITY_TOMOYO_OMIT_USERSPACE_LOADER) [Y/n/?] y
AppArmor support (SECURITY_APPARMOR) [Y/n/?] y
  AppArmor boot parameter default value (SECURITY_APPARMOR_BOOTPARAM_VALUE) [1] 1
Integrity Measurement Architecture(IMA) (IMA) [Y/n/?] y
EVM support (EVM) [N/y/?] (NEW)
Default security module
  1. SELinux (DEFAULT_SECURITY_SELINUX)
  2. TOMOYO (DEFAULT_SECURITY_TOMOYO)
  3. AppArmor (DEFAULT_SECURITY_APPARMOR)
> 4. Unix Discretionary Access Controls (DEFAULT_SECURITY_DAC)
choice[1-4?]: 4
warning: (ACPI_HOTPLUG_CPU) selects ACPI_CONTAINER which has unmet direct dependencies (ACPI && EXPERIMENTAL)
warning: (MEDIA_TUNER) selects MEDIA_TUNER_TEA5761 which has unmet direct dependencies (MEDIA_SUPPORT && VIDEO_MEDIA && I2C && EXPERIMENTAL)
#
# configuration written to .config
#
warning: (GFS2_FS) selects DLM which has unmet direct dependencies (EXPERIMENTAL && INET && SYSFS && CONFIGFS_FS && (IPV6 || IPV6=n))
warning: (IMA) selects TCG_TPM which has unmet direct dependencies (HAS_IOMEM && EXPERIMENTAL)
warning: (MEDIA_TUNER) selects MEDIA_TUNER_TEA5761 which has unmet direct dependencies (MEDIA_SUPPORT && VIDEO_MEDIA && I2C && EXPERIMENTAL)
warning: (ACPI_HOTPLUG_CPU) selects ACPI_CONTAINER which has unmet direct dependencies (ACPI && EXPERIMENTAL)
root@[~src/linux] #

Now comes the most adventurous part!

Building the Kernel

# make -j8  bzImage
# make -j8 modules
# make modules_install
# make install


Building an initramfs or not?

The reason to build a kernel with an initramfs is mostly for interoperability (e.g. live-cd's) and special features like an included busybox, ssh, etc. But mostly, and that's why we are doing this here now, to have a proper kernel up and running quick'n dirty in a reasonable time without fighting hours and days until a more or less exotic hardware is perfectly run by the kernel. After having a proper basic kernel running with the help of an initramfs, I really recommend you to go a step further and build a true kernel with all features includes without an initramfs. But this could be pain in the ass and very time consuming - so we do it the funtoo way here - at least in the second example when we stick to better-initramfs instead of Red-Hat's dracut.

Option one: Initrd with dracut

To build the initrd we just execute

# dracut -f --fstab --xz /boot/initramfs-3.2.6-pf.img  3.2.6-pf

Generally, this really should be enough! If you experience booting problems like missing modules / drivers then just boot from the genkernel section and fix the initrd building. You can look into the man page to tweak the command a bit (e.g. --add-drivers "xz dm_crypt" etc...).

Ok let's go on and finish the taks, we are going to tell now grub how to boot off correctly!

root@[~src/linux] # nano /etc/boot.conf

boot {
        generate grub
        default "Funtoo Linux dracut"
        timeout 3
}

"Funtoo Linux genkernel" {
        kernel kernel-genkernel[-v]
        initrd initramfs-genkernel[-v]
        params = quiet rootfstype=ext4
        params += luks enc_root=/dev/sda3
        params += lvm root=/dev/mapper/vg-root
}

"Funtoo Linux dracut" {
        kernel vmlinuz[-v]
## this is the better-initramfs generated initrd
        initrd initramfs[-v].img
        params  = quiet rootfstype=ext4
        params += luks enc_root=/dev/sda3
        params += lvm root=/dev/mapper/vg-root
}

That's it almost!

Now write to the grub.cfg with the new handy boot-update script from funtoo:

root@[~src/linux] # boot-update -v
root@[~src/linux] # sudo boot-update -v

 boot-update 1.5.2 / Copyright 2009-2011 Funtoo Technologies

 [use option "-l" for license info, "-h" for help]

 * Generating config for grub...

 DEFAULT > Funtoo Linux - vmlinuz-3.2.6-pf
           Funtoo Linux genkernel - kernel-genkernel-x86_64-3.2.6-pf

 * Completed successfully.

Okay,... here you go..! :)

Reboot and see how it works!

Option two: using better-initramfs

Piotr's better-initramfs is another approach that is tiny, nice and shiny and seems to become more and more a favourite among funtoo'ers. The biggest plus is that, once built it is kernel version independant.

For using this you just do the following steps:

1. download sources
2. build kernel with "make bzImage"
3. download better-initramfs
4. run better-initramfs
5. adjust /etc/boot.conf

Here is how in detail:

Assuming you did install already a genkernel backup or at least you have a working bzImage + modules installed, we rush forward to step 3:

download better-initramfs

➜ # cd /usr/src/;
➜ # git clone https://github.com/slashbeast/better-initramfs.git

➜ # /src #  cd better-initramfs
➜ # better-initramfs git:(master) ls
AUTHORS    LICENSE   README.rst  bootstrap  output   sourceroot
ChangeLog  Makefile  TODO        examples   scripts

build the better-initramfs

➜ # better-initramfs git:(master) sudo bootstrap/bootstrap-all
Passwort: xxx 
# from here go and grab a coffee
➜ # sudo make prepare
➜ # sudo make image
➜ # sudo mv output/initramfs.cpio.gz /boot

adjust grub

Taking the above setup we edit the /etc/boot.conf as I installed genkernel first, and dracut after - you see this setup:

boot {
        generate grub
        default "Funtoo Linux"
        timeout 3
}

# Rootfs over lvm over luks
# /dev/sda3 - encrypted lvm's pv
# /dev/mapper/vg-root - rootfs's lv

"Funtoo Linux" {
        kernel bzImage[-v]
## this is the better-initramfs generated initrd
        initrd initramfs.cpio.gz
        params  = quiet rootfstype=ext4
        params += luks enc_root=/dev/sda3
        params += lvm root=/dev/mapper/vg-root
}

"Funtoo Linux dracut" {
        kernel vmlinuz[-v]
## this is the dracut generated initrd
        initrd initramfs[-v].img
        params  = quiet rootfstype=ext4
        params += luks enc_root=/dev/sda3
        params += lvm root=/dev/mapper/vg-root
}


"Funtoo Linux genkernel" {
        kernel kernel-genkernel[-v]
        initrd initramfs-genkernel[-v]
        params = quiet rootfstype=ext4
        params += luks enc_root=/dev/sda3
        params += lvm root=/dev/mapper/vg-root
}

Okay,... here you go..! :)

update the grub.cfg, then reboot and see how it works!

root@[~src/linux-3.2.6-pf] # boot-update -v     

 boot-update 1.5.2 / Copyright 2009-2011 Funtoo Technologies

 [use option "-l" for license info, "-h" for help]

 * Generating config for grub...

 DEFAULT > Funtoo Linux better-initramfs - vmlinuz-3.2.6-pf
           Funtoo Linux dracut - vmlinuz-3.2.6-pf
           Funtoo Linux genkernel - kernel-genkernel-x86_64-3.2.6-ck

 * Completed successfully.

root@[~src/linux-3.2.6-pf] #

root@[~src/linux-3.2.6-pf] # reboot

System going down for reboot!