Re: [Xen-users] PCI Passthrough

["Todd Deshane" <deshantm@xxxxxxxxx>]

Hi Paul,

I'm not going to answer all your questions since I don't have a lot of
experience with many of the things you mention. However I can do
the second part and give some hints on what I do know.

> Is that possible and am I really gaining security for the whole system or is
> this just my imagination and doesn't make any sense at all? How about the
> performance, especially for the graphics adapter, do I have to factor in
> bigger losses there (maybe because PCI passthrough doesn't support the full
> PCIe 16x speed)? Has anyone tried something similar yet or am I the first to
> think this might be a good idea?

For PCI passthrough to be secure you need a system that has an IOMMU. It is
my understanding that the only IOMMUs that are currently available are in the
Intel VT-d systems. The reason you need the IOMMU is that otherwise the
domain that you give direct access to the physical device could DMA into
main memory and compromise the security of the system.

So, you first need to look for a system with an IOMMU.

I really like you explanation of what you want and what you are trying to
accomplish, I believe you are right on in terms of the VGA passthrough and
using serial for the Xen output instead. I have read the experiences of others
for that case and it seems that part you could do.

People have also reported using Xen and mythTV, so I think that is also
quite possible.

There are a lot of details to get right, but by the sounds of it you are willing
to figure them and make things work. As for all the networking stuff Xen is
pretty good at that already and it will be a matter of setting it up.

Your biggest initial hurdle is the IOMMU. Take a look at the VT-d stuff there
is a lot going on with that on the xen mailing lists. (try xen.markmail.org if
you haven't already, it has pretty good search).

You can find information on some of the other things as well, but I would
expect that within the next few days others would share their experiences
on some of the items that you mentioned.

Cheers,
Todd

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users