Hi, I have this weird situation:

1) Runner has 3 medium hosted on Personal Workshop
2) Runner has installed Grimoire
3) Corp has a Cyberdex Virus Suite

Before accessing R&D, runner install 1 medium from workshop and decide to access

Corporation react by rezzing CVS to purge virus

Runner react by installing two additional medium then decide to access...

Is this a legal play?

Does this mean priority can be passed back and fourth during a run until a player declines to react?

Exactly. Core set rules p 21:

Timing Priority

Whenever there is an opportunity to trigger paid abilities, rez cards and/or score agendas (usually at the beginning of a turn and after each action), the player who is currently taking his turn gets the first opportunity to act. He can trigger as many abilities, rez as many cards, and/or score as many agendas as he wishes in the order of his choosing. When he is finished, the other player gets the opportunity to act. When that player is finished, the first player gets the opportunity to act once again.

After both players have had at least one opportunity to act and a player declines to act, then the players cannot trigger more abilities, rez more cards, or score more agendas until the next opportunity to do so.

So you're pretty much dead on.

As a little additional clarification, here's a breakdown of the gameplay that happened here. In summary, the second chunk of paid abilities and the rez of CVS happened at 4.3. At this point the runner must access cards; he has already chosen to complete the run by not jacking out in 4.2. The window at 4.1 doesn't allow cards to be rezzed.

4.1:

• All ICE has been passed, and the server is being approached. The first action window opens. ONLY paid abilities are allowed. Priority goes to the runner.
• Runner pays X to use Personal Workdhop, removing tokens from Medium to 0, installing Medium with a single token from Grimoire, and passes. Priority goes to corp.
• Corp passes. Both players have passed, so the step ends, closing the action window.

4.2:

• The runner (being in great shape) decides not to jack out, and continues the run for the final time. There is no action window here, so the step ends.

4.3:

• The second action window opens. Paid abilities can be used and cards can be rezzed. Priority goes to the runner.
• The runner passes. Priority goes to the corp.
• The corp rezzes CVS for 3 credits, uses it's trash ability to purge virus counters, removing the counter from Medium, and then passes. Priority goes to the runner.
• The runner pays X to use Personal Workshop to remove the remaining tokens from each Medium, installing them with one counter a piece from Grimoire, then passes. Priority goes to the corp.
• The corp passes with a frown, the window closes, and the step ends.

4.4:

• The run is successful, triggering the conditions on all three Mediums in play. The runner adds a virus token to each, meaning without other modifiers he will access two additional cards next step.
• The step ends.

4.5

• Accessing begins, with the runner gaining two additional accesses from his two Mediums at 2+ counters, plus any other relevant bonuses.

From the rules:

4 . The Runner APPROACHES the attacked server.

1. 4.1 Paid abilities can be triggered.

2. 4.2 The Runner decides whether to continue the run.

   • ...Either the Runner JACKS OUT : go to [ 6 ]

   • ...Or the Runner continues the run: go to [ 4.3 ].

3. 4.3 Paid abilities can be triggered, Non-ice cards can be rezzed (in any order).

4. 4.4 The run is considered to be SUCCESSFUL . (“When successful” conditionals meet their trigger conditions)

5. 4.5 Access cards