Re: CONFIG_XEN_VIRTIO{_FORCE_GRANT} interferes with nested virt

[Juergen Gross <jgross@suse.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 829 bytes --]

On 05.10.22 14:41, Marek Marczykowski-Górecki wrote:
> Hi,
> 
> When booting Xen with Linux dom0 nested under KVM,
> CONFIG_XEN_VIRTIO_FORCE_GRANT=y makes it unable to use virtio devices
> provided by L0 hypervisor (KVM with qemu). With PV dom0, grants are
> required for virtio even if just CONFIG_XEN_VIRTIO is enabled.
> 
> This is probably uncommon corner case, but one that has bitten me in my
> CI setup... I think Xen should set smarter
> virtio_require_restricted_mem_acc(), that enforces it only for devices
> really provided by another Xen VM (not by the "outer host"), but I'm not
> sure how that could be done. Any ideas?
> 

It should be possible to add a boot parameter for that purpose. Using it
would open a security hole, though (basically like all PCI passthrough to
PV guests).


Juergen

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3149 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]