From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ian Campbell Subject: [PATCH] docs: xl.cfg: permissive option is not PV only. Date: Tue, 6 Oct 2015 09:42:35 +0100 Message-ID: <1444120955-20825-1-git-send-email-ian.campbell@citrix.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: ian.jackson@eu.citrix.com, wei.liu2@citrix.com, xen-devel@lists.xen.org Cc: Eric , Ian Campbell List-Id: xen-devel@lists.xenproject.org Since XSA-131 qemu-xen has defaulted to non-permissive mode and the option was extended to cover that case in 015a373351e5 "tools: libxl: allow permissive qemu-upstream pci passthrough". Since I was rewrapping to adjust the text anyway I've split the safety warning into a separate paragraph to make it more obvious. Signed-off-by: Ian Campbell Cc: Eric --- docs/man/xl.cfg.pod.5 | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/docs/man/xl.cfg.pod.5 b/docs/man/xl.cfg.pod.5 index f8fa48f..b63846a 100644 --- a/docs/man/xl.cfg.pod.5 +++ b/docs/man/xl.cfg.pod.5 @@ -752,14 +752,17 @@ Possible Bs are: =item B -(PV only) By default pciback only allows PV guests to write "known -safe" values into PCI config space. But many devices require writes -to other areas of config space in order to operate properly. This -tells the pciback driver to allow all writes to PCI config space of -this device by this domain. This option should be enabled with -caution: it gives the guest much more control over the device, which -may have security or stability implications. It is recommended to -enable this option only for trusted VMs under administrator control. +By default pciback only allows PV guests to write "known safe" values +into PCI config space, likewise QEMU (both qemu-xen and +qemu-traditional) imposes the same contraint on HVM guests. However +many devices require writes to other areas of config space in order to +operate properly. This option tells the backend (pciback or QEMU) to +allow all writes to PCI config space of this device by this domain. + +This option should be enabled with caution: it gives the guest much +more control over the device, which may have security or stability +implications. It is recommended to enable this option only for +trusted VMs under administrator control. =item B @@ -798,9 +801,8 @@ Note this would override global B option. =item B -(PV only) Changes the default value of 'permissive' for all PCI -devices passed through to this VM. See L -above. +Changes the default value of 'permissive' for all PCI devices passed +through to this VM. See L above. =item B -- 2.1.4