|
xen-users
Re: [Xen-users] PCI Passthrough
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi again,
Thanks Chris, this sounds very promising. If I run into any problems,
I will take you up on your offer. For now I am still in the planning
stage for this project of mine, which by the way proves to be much
more work than I initially thought.
Thanks alot for the hint about IOMMU, Todd, I think you nailed the
main problem I am facing, my initial thoughts were that as long as
only one DomU has exclusive rights to a certain PCI device, it would
not pose a threat to the entire system.
I have already heard about IOMMU being implemented in Intel CPUs (or
probably the North Bridge, because as I hear that is where the Memory
Controller is located) only, however, as far as I can see AMD isn't
quiet there yet (I hear they postponed it to 2009 again, almost
reminds me of GNU/Hurd). However, that is one of the main problems I
am facing: Intel does not offer a suitable basis for low power
systems with desktop performance. I already looked far and wide for a
suitable CPU + Mainboard combination with low power consumption and
onboard 3D graphics that are worth something and I'm sorry to say,
but Intel's are definitively not (compared to the AMD 4x50e CPUs with
AMD780G chipsets at least). So I am basically bound to AMD for this
particular project.
I already looked around for clues on a software IOMMU implementation
too, but the only thing I could find was SWIOTLB. As I understand it,
this solution merely allows 32bit devices to use more than 4gb of
RAM, or is there a way to use it as a software IOMMU in the sense of
Intel VT-d too? If not, is there another way to emulate IOMMU or at
least protect the system from a potentially compromised privileged
DomU until AMD CPUs supporting this feature are available? And am I
correct to assume that a possible feature for AMD CPUs will possibly
not need support from the chipset, because the Memory Controller is
located on the CPU?
I hope someone can help me out of my confusion,
Paul.
- --
Paul Schulze
avlex@xxxxxxx
Public Key: http://solaris-net.dyndns.org/keys/key_avlex.asc
"Making mistakes is human,
but to really fuck things up you need Computers"
Am 24.05.2008 um 14:35 schrieb Christopher Isip:
On Fri, May 23, 2008 at 11:57 PM, Todd Deshane <deshantm@xxxxxxxxx>
wrote:
Hi Paul,
I'm not going to answer all your questions since I don't have a lot of
experience with many of the things you mention. However I can do
the second part and give some hints on what I do know.
> Is that possible and am I really gaining security for the whole
system or is
> this just my imagination and doesn't make any sense at all? How
about the
> performance, especially for the graphics adapter, do I have to
factor in
> bigger losses there (maybe because PCI passthrough doesn't
support the full
> PCIe 16x speed)? Has anyone tried something similar yet or am I
the first to
> think this might be a good idea?
For PCI passthrough to be secure you need a system that has an
IOMMU. It is
my understanding that the only IOMMUs that are currently available
are in the
Intel VT-d systems. The reason you need the IOMMU is that otherwise
the
domain that you give direct access to the physical device could DMA
into
main memory and compromise the security of the system.
So, you first need to look for a system with an IOMMU.
I really like you explanation of what you want and what you are
trying to
accomplish, I believe you are right on in terms of the VGA
passthrough and
using serial for the Xen output instead. I have read the
experiences of others
for that case and it seems that part you could do.
People have also reported using Xen and mythTV, so I think that is
also
quite possible.
There are a lot of details to get right, but by the sounds of it
you are willing
to figure them and make things work. As for all the networking
stuff Xen is
pretty good at that already and it will be a matter of setting it up.
Your biggest initial hurdle is the IOMMU. Take a look at the VT-d
stuff there
is a lot going on with that on the xen mailing lists. (try
xen.markmail.org if
you haven't already, it has pretty good search).
You can find information on some of the other things as well, but I
would
expect that within the next few days others would share their
experiences
on some of the items that you mentioned.
Cheers,
Todd
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
I am currently running a mythtv backend in a Xen domU. It seems to
be working well. I am on the last stages of configuration. Its
using Ubuntu Hardy. Since it is a 2.6.24 kernel (compared to my
Dom0 2.6.18), there are far fewer DMA errors.
Some issues that I haven't resolved yet:
mythfilldatabase segfault in dmesg ( runs fine on command line)
PVR 250/500 record at default bitrate (2.2 Gb an hour) as opposed
to settings in the database.
The domU does not have a mysql server. This is still in dom0 but I
will be moving that to its own domU next. It also nfs mounts the
video directories from dom0. I like to keep my DomUs at 4 Gigabyte
or less for easy backup to a DVD.
If you need help setting up your mythtv DomU, let me know.
Chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)
iD8DBQFIOJCaYDWOGtiChoARAg7OAJ9AndUfRxJ0ry4Hw1TBNYTpD49JrQCdHxef
trWM+6qHbE7NolGi8jwkc38=
=W9mE
-----END PGP SIGNATURE-----
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
|
|
|
Home