PCI Passthrough - extraconfig no longer available?

[meisenst-dnd]

Hi, all. First time poster, long time reader and dabbler in CloudStack.

I'm setting up a proof of concept at work for a potential migration to CloudStack from VMware, and I've run into a situation that isn't making any sense to me. I'm trying to pass a storage controller through to a VM using VFIO/PCI passthrough, and the only instructions that I can find on how to do this revolve around the use of extraconfig in the VM settings. However, I understand that this was just the subject of a pretty nasty CVE, and mitigated or fixed in a recent release.

I'm assuming that the extraconfig functionality is either more guarded now, or is not currently working (I've tried to use the instructions available in various places on the internet, to no avail).

How does one do PCI passthrough without the use of extraconfig? Is it still possible? Am I just missing something that should probably be obvious?

Thanks,
Mark

[andrijapanicsb]

Hi Mark, long cloudstack user here, but first time posting in discussion :)

extraconfig is more guarded now, yes, but still should be working fine.

I would suggest that you check the 2 following articles from a community member who made good use of extraConfig for his own use case:

• https://lab.piszki.pl/cloudstack-kvm-and-running-vm-with-vgpu/
• https://lab.piszki.pl/cloudstack-vm-with-vtpm-and-secure-boot-uefi/

In general, you would need to know the exact XML that does what you want - then add the required keys as cloud admin to the list of allowed keys (XML keys) - and then, in theory, this should all work.

[meisenst-dnd]

In general, you would need to know the exact XML that does what you want - then add the required keys as cloud admin to the list of allowed keys (XML keys) - and then, in theory, this should all work.

Beautiful. This is the part that I was missing. Thank you for this!

Gotta say, I'm impressed by how quickly someone replied. I like this community already.