dm_restrict=1 bios='ovmf' boot='d': can't boot from .iso image

[James Dingwall <james-xen@xxxxxxxxxxxxxx>]

Hi,

We've encountered a problem booting an 'ovmf' hvm instance from a .iso
image when dm_restrict=1.  The deprivileged qemu process can't connect
the .iso and in the qemu-dm .log:

qemu-system-i386: failed to create 'qdisk' device '5632': realization of device 
xen-cdrom failed: failed xs_open: No such file or directory

The problem is the qemu process is unable to open /dev/xen/{xenbus,
evtchn,gntdev}.  If I make those 0666 then no problem but that isn't
a permanent solution so currently we do dm_restrict=0 when
necessary.  If bios='seabios' then there is no need for any workaround.
Are there any suggestions on alternative ways we could look at
working out a solution?

Xen version is 4.18.3 with qemu built from the associated tag.  We do have
some local patches but I don't think any would interfere with this.

Thanks,
James