[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] Back end domains : input desired

What I'd LOVE to achieve with XEN (for security reasons) is the

DOM0:  minimal linux install with LVM2 primarily for backending the ide

BE_NIC_0:  Back end NIC_0 domain (bridge) with minimal linux install -
no ip address assigned - using ebtables to filter/protect

BE_NIC_1:  Same as BE_NIC_0 only for NIC_1

BE_VNIC_2:  Back end for a "virtual nic"/bridge for DomU to DomU
communication (DMZ).

BE_MGMT:  firewall config/mgmt console (xwindows) (preferred x
displaying (direct) through AGP on console - is this possible) and
ntp/clock sync (can this happen here or does it have to happen on

Various front end DomU's:  for router/fw and various application layer

My idea here is to be able to isolate the components into minimal
operating environments allowing for specific need/application to be
rebooted without having to reboot the entire box should that particular
component be DoS'ed.

Your thoughts on this setup would be appreciated (also you can see that
having a socket interface rather than an ip interface for XEND would be
of GREAT advantage).

Now, I've tried setting this up but I'm running into some confusion

1)   I only seem to be able to compile the actual NIC drivers with DOM0
(e100/e1000/3c95x, etc).  Is this where I should be compiling them even
though the NIC's will be used in another DOM?  If not, how do I go about
compiling the drivers for the BE DOM'S? (they don't show up as options -

2)  Even with pci_dom0_hide=(01,01,0)(02,00,0) as part of my grub.conf
(for the startup of xen.gz), I still see these devices under DOM0, is
this normal? lspci shows the devices as 0000:01:01.0 and 0000:02:00:0.0)
respectively.  Are my parameters to pci_dom0_hide correct?

3)  Should I be using stable, testing or unstable for this?  NOTE:
stable and testing both are unable to attach xen console to ttyS whereas
unstable works correctly for this.

4)  It would be preferred to run X in a domain separate from Dom0, but
still be accessible for use on the local console without having to
install X and a VNC client in DOM0.  Is this possible, or am I just
dreaming here?


This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.