search

QubesOS / qubes-issues

The Qubes OS Project issue tracker
https://www.qubes-os.org/doc/issue-tracking/
526 stars 46 forks source link

Cloud Hypervisor support #9013

Open DemiMarie opened 4 months ago

DemiMarie commented 4 months ago

How to file a helpful issue

The problem you're addressing (if any)

virtio-GPU requires a userspace VMM running in the VM with the GPU attached (normally dom0). QEMU is not secure enough for this.

The solution you'd like

Use Cloud Hypervisor for that VMM. It doesn’t support virtio-GPU on its own, but @alyssais maintains a patchset that adds virtio-GPU support for Spectrum. Unlike QEMU, Cloud Hypervisor is secure enough that a stubdomain is not required.

The value to a user, and who that user might be

Users will be able to use GPU acceleration once the rest of it is is implemented. Users will be able to use HVMs without a stubdomain, so long as the HVM has support for virtio devices.

marmarek commented 4 months ago

Users will be able to use HVMs without a stubdomain, so long as the HVM has support for virtio devices.

We have this already, just replace virtio with xen pv. It's called PVH.

DemiMarie commented 4 months ago

Users will be able to use HVMs without a stubdomain, so long as the HVM has support for virtio devices.

We have this already, just replace virtio with xen pv. It's called PVH.

Cloud Hypervisor can do a few things that PVH can’t:

  1. It supports in-guest UEFI, whereas PVH requires either pvgrub2-pvh or a dom0-provided kernel.
  2. It supports Windows, provided that the image has been pre-prepared (using an ordinary QEMU-based HVM).
  3. With @alyssais’s patches, it supports virtio-GPU when combined with crosvm.

GPU acceleration is obviously the main motivation here, but the rest are useful side effects. A VM using Cloud Hypervisor in dom0 will still need PV network drivers, but this might be less of a concern than PV disk drivers, because PV network drivers are not required for booting and therefore can be loaded once the system is running.