<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Am 12.07.2012 00:38, schrieb Eric
Blake:<br>
</div>
<blockquote cite="mid:4FFE0080.7050200@redhat.com" type="cite">
This may be the result of a security fix in the new kernel. I know
at
least one older version of Intel chips has a bug where IOMMU can
be
exploited by a guest to take control over the host, so on those
chips,
newer kernels now require to explicitly enable a kernel module
parameter
to state that you are going to allow passthrough to the guest in
spite
of the security risk. That is, you may need to use:
modprobe kvm allow_unsafe_assigned_interrupts=1
with your newer kernel. Unfortunately, I wasn't able to find a
better
URL to a page documenting this issue, so that implies we probably
also
need a patch to the libvirt documentation with regards to using
device
passthrough.
</blockquote>
<br>
Hi Eric,<br>
<br>
thanks for the info. <br>
<br>
Reading
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<a href="https://bugzilla.redhat.com/show_bug.cgi?id=715555">https://bugzilla.redhat.com/show_bug.cgi?id=715555</a>
, it seems that 5.8 shouldn't be affected since the kvm on that
version doesn't support interrupt remapping, if I understand
correctly. Additionally, if I run the script provided in the issue
description, the check passes with "Interrupt remapping support
available" and the error message differs: I don't get "Operation not
permitted" but "Invalid argument". I also can't set provides switch
in /sys/module/kvm/parameters/allow_unsafe_assigned_interrupts,
since the file isn't there on my box.<br>
<br>
Are there any other circumstances where pci passthrough could fail?
Googling for the error message i get, I can't seem to find any case
that matches mine. This makes me guess that I'd rather accidentally
introduced a misconfiguration than encountered a qemu-kvm/libvirt
bug. I have attached the configuration file of that machine, maybe
someone could have a look at the hostdev section?<br>
<br>
Unfortunately, i am currently not able to switch back to the prior
kernel, since the system is in production right now - I will test
that later during the day.<br>
<br>
Thanks & cheers,<br>
<br>
Rouven<br>
<br>
<br>
<br>
<pre class="moz-signature" cols="72">--
Blinkenlichten Open Source Solutions
Maass Sacha GbR | Weigandufer 45 | 12059 Berlin
tel: +493013896247 | fax: +493013896249 | mob: +491744220127
Web: <a class="moz-txt-link-freetext" href="http://www.blinkenlichten.de/">http://www.blinkenlichten.de/</a> G+: <a class="moz-txt-link-freetext" href="http://gplus.to/blinkenlichten">http://gplus.to/blinkenlichten</a>
Blinkenlichten Zarafa Hosted Tweets: <a class="moz-txt-link-freetext" href="http://twitter.com/zarafamail/">http://twitter.com/zarafamail/</a>
</pre>
</body>
</html>