These steps work for me 9 out of 10 times for
net-disp, 10 out of 10 for
firewall-disp. The troubleshooting section fixes any problems with attaching PCI device and
net-disp not booting. After completion, the new VMs function the same as AppVMs only non-persistent.
Q: If the PCI device is attached to the
net-disp inherit the attached PCI device?
A: No, I tried that numerous times, does not work
Q: What do you mean by "the new DispVMs function like AppVMs only non-persistent?
A: These new service VMs can be set to auto-start, can be NetVM for other AppVMs, PCI devices can be attached and will be attached at every VM boot (persistent) with no user input required. DispVM for the most part can be used the same as a regular AppVM.
Q What names should the DispVMs be given in the steps?
Q: Should the steps be broken up (Section 1. create service-dvm) (Section 2. create net-disp) (Section 3. create firewall-disp) (Section 4. starting VMs) (Section 6. troubleshooting)
Off topic: Also VPN DispVMs and USB DispVMs <–working on this now) can be created
Please let me know what changes need to be made to the instructions
Create sys-net and sys-firewall Disposable VMs
Qubes R4.0 only!
Qubes users can configure both the
sys-firewall VMs as Disposable VMs. Using DispVMs for service VMs has the advantage of preventing malware from getting persistent hooks in the VMs’ filesystem. Whereas AppVMs
/home folder is persistent accross reboots, when a DisposableVM is shutdown, the VM is removed from Qubes and all related VM images are deleted from the host filesystem. Since fresh VMs are created every time a Dispvm is started, this ensures no malware could remain persistent across reboots.
Note: if users intend to use the same naming convention for the new VMs as currently on their system. The old
sys-firewall VMs must either be deleted or cloned with a new name.
These steps create the
service-dvm (template for DispVMs)
net-disp (Dispvm) and
dom0, create the dvm that will be used as Template for service DispVMs
qvm-create -P <pool_name> --template <template_name> --class AppVM --label gray service-dvm
service-dvm virtualizaion mode to
qvm-prefs service-dvm virt_mode hvm
service-dvm as template for disposable VMs
qvm-prefs service-dvm template_for_dispvms true
net-disp DispVM based on
qvm-create -P <pool_name> --template service-dvm --class DispVM --label red net-disp
net-disp to provide network for other VMs
qvm-prefs net-disp provides_network true
net-disp NetVM to none
qvm-prefs net-disp netvm ""
dom0, list all available PCI devices to determine the correct backend:BDF address(es) to assign to
Note: the bakend:BDF address will look similar to this
dom0, attach the network PCI device(s) to
00_1a.0 is the BDF of the Ethernet controller that will be assigned to
net-disp, the command would look similar to this:
qvm-pci attach --persistent net-test dom0:00_1a.0
qvm-pci attach --persistent net-disp <backend>:<bdf>
9. (Optional) In
net-disp to start automatically when Qubes boots
qvm-prefs net-disp autostart true
10. (Optional) In
net-disp as the
dom0 time source
qubes-prefs clockvm net-disp
qvm-create -P appvm_pool --template service-test --class DispVM --label green firewall-disp
firewall-disp to provide network for other VMs
qvm-prefs firewall-disp provides_network true
net-disp as NetVM for
qvm-prefs firewall-testing netvm net-testing
firewall-disp as NetVM for other AppVMs
qvm-prefs <vm_name> netvm firewall-disp
15. (Optional) In
firewall-disp to auto-start when Qubes boots
qvm-prefs firewall-disp autostart true
16. (Optional) In
firewall-disp as the default NetVM
qubes-prefs default_netvm firewall-disp
Prior to starting
net-disp, users must ensure that no currently running VMs – such as the current
sys-net – has the same PCI device attached. These VMs must be either shutdown or the PCI device detached.
Once VMs have been successfully started, users should ensure no other VMs will interfere with the VMs at the next Qubes boot. If the new
net-disp VM and the current
sys-net VM are both set to auto-start – and have identical PCI devices attached – may lead to failed starts for both VMs.
If users see an error stating “The PCI device could be attached”, rebooting the Qubes system will likely rectify the problem. After
net-disp boots successfully for the first time, users should have no further VM boot problems. The network PCI device will be attached with every VM boot without the need to manually attach proir to every VM start.