884d801843
- conf: Parse hyperv features even for host-model (RHEL-151688) - qemu: Wire up new hyperv host-model mode behavior (RHEL-151688) - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-153653) - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-153653) - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-153653) - docs: Clarify host-model description in domain capabilities (RHEL-153653) - qemu: Fix job handling when domain dies in post-copy migration (RHEL-145179) - security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel (RHEL-159902) - security: Cleanup hostdev label error logic (RHEL-159902) - qemu: Fix IOMMUFD and VFIO security labels (RHEL-159902) - viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged (RHEL-156803) - conf: Move and rename virStorageSourceFDTuple object (RHEL-156803) - conf: Refactor virHostdevIsPCIDevice (RHEL-156803) - hypervisor: Fix virHostdevNeedsVFIO detection (RHEL-156803) - qemu: Expand call to qemuDomainNeedsVFIO (RHEL-156803) - qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD (RHEL-156803) - src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD (RHEL-156803) - conf: Introduce domain iommufd element (RHEL-156803) - qemu: Implement iommufd (RHEL-156803) - conf: Add iommufd fdgroup support (RHEL-156803) - qemu: Implement iommufd fdgroup (RHEL-156803) - tests: Add iommufd fdgroup test (RHEL-156803) - hypervisor: Call virWaitForDevices() after detaching host devices (RHEL-156803) - qemuMigrationSrcBeginXML: Don't call 'qemuMigrationSrcBeginPhaseBlockDirtyBitmaps' with offline VM (RHEL-173433) - qemuMigrationSrcBeginPhase: Don't call 'qemuBlockNodesEnsureActive' with offline VM (RHEL-173433) - util: virGetSubIDs: do not limit file size (RHEL-174491) - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-177364) - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-177364) - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel (RHEL-177364) - qemu_capabilities: Always sort features in host-model CPU (RHEL-177364) - qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel (RHEL-177364) - qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel (RHEL-177364) - qemu_capabilities: Cache expanded CPU (RHEL-177364) - domaincapstest: Test EXPAND_CPU_FEATURES flag (RHEL-177364) - util: Publish and mock virHostCPUGetMSRFromKVM (RHEL-177364) - cpu_x86: Introduce virCPUx86DataAddMSR (RHEL-177364) - cpu: Introduce virCPUUpdateFeatures (RHEL-177364) - Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-177364) - Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag (RHEL-177364) - virsh: Add --supported-cpu-features option for domcapabilities (RHEL-177364) - domaincapstest: Test SUPPORTED_CPU_FEATURES flag (RHEL-177364) - qemu_capabilities: Fix domain capabilities on AMD CPUs (RHEL-177364) - distro: Replace old gating with tmt Resolves: RHEL-145179, RHEL-151688, RHEL-153653, RHEL-156803, RHEL-159902 Resolves: RHEL-173433, RHEL-174491, RHEL-177364
80 lines
2.6 KiB
Diff
80 lines
2.6 KiB
Diff
From 32ff11b8bbc74b61f5ff531f9fb5c83f1a4da343 Mon Sep 17 00:00:00 2001
|
|
Message-ID: <32ff11b8bbc74b61f5ff531f9fb5c83f1a4da343.1780571166.git.jdenemar@redhat.com>
|
|
From: Pavel Hrdina <phrdina@redhat.com>
|
|
Date: Fri, 13 Mar 2026 10:50:36 +0100
|
|
Subject: [PATCH] viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running
|
|
privileged
|
|
|
|
If libvirt daemon is running unprivileged it will fail so we should not
|
|
even try to set it.
|
|
|
|
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
|
|
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
|
|
(cherry picked from commit 293bb59e75f4b4c975bbeccb1bb8b39b6f439a35)
|
|
|
|
Resolves: https://redhat.atlassian.net/browse/RHEL-156803
|
|
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
|
|
---
|
|
src/qemu/qemu_process.c | 2 +-
|
|
src/util/viriommufd.c | 6 +++---
|
|
src/util/viriommufd.h | 2 +-
|
|
3 files changed, 5 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/src/qemu/qemu_process.c b/src/qemu/qemu_process.c
|
|
index 0a69063a4b..9b8b378b1f 100644
|
|
--- a/src/qemu/qemu_process.c
|
|
+++ b/src/qemu/qemu_process.c
|
|
@@ -7695,7 +7695,7 @@ qemuProcessOpenIommuFd(virDomainObj *vm)
|
|
|
|
VIR_DEBUG("Opening IOMMU FD for domain %s", vm->def->name);
|
|
|
|
- if ((iommufd = virIOMMUFDOpenDevice()) < 0)
|
|
+ if ((iommufd = virIOMMUFDOpenDevice(priv->driver->privileged)) < 0)
|
|
return -1;
|
|
|
|
if (qemuSecuritySetImageFDLabel(priv->driver->securityManager, vm->def, iommufd) < 0)
|
|
diff --git a/src/util/viriommufd.c b/src/util/viriommufd.c
|
|
index b62d59241d..82920923a2 100644
|
|
--- a/src/util/viriommufd.c
|
|
+++ b/src/util/viriommufd.c
|
|
@@ -80,14 +80,14 @@ virIOMMUFDSetRLimitMode(int fd, bool processAccounting)
|
|
}
|
|
|
|
int
|
|
-virIOMMUFDOpenDevice(void)
|
|
+virIOMMUFDOpenDevice(bool privileged)
|
|
{
|
|
int fd = -1;
|
|
|
|
if ((fd = open(VIR_IOMMU_DEV_PATH, O_RDWR | O_CLOEXEC)) < 0)
|
|
virReportSystemError(errno, "%s", _("cannot open IOMMUFD device"));
|
|
|
|
- if (virIOMMUFDSetRLimitMode(fd, true) < 0) {
|
|
+ if (privileged && virIOMMUFDSetRLimitMode(fd, true) < 0) {
|
|
VIR_FORCE_CLOSE(fd);
|
|
return -1;
|
|
}
|
|
@@ -98,7 +98,7 @@ virIOMMUFDOpenDevice(void)
|
|
#else
|
|
|
|
int
|
|
-virIOMMUFDOpenDevice(void)
|
|
+virIOMMUFDOpenDevice(bool privileged G_GNUC_UNUSED)
|
|
{
|
|
virReportError(VIR_ERR_NO_SUPPORT, "%s",
|
|
_("IOMMUFD is not supported on this platform"));
|
|
diff --git a/src/util/viriommufd.h b/src/util/viriommufd.h
|
|
index 223f44eb5c..7bad5c7472 100644
|
|
--- a/src/util/viriommufd.h
|
|
+++ b/src/util/viriommufd.h
|
|
@@ -22,6 +22,6 @@
|
|
|
|
#define VIR_IOMMU_DEV_PATH "/dev/iommu"
|
|
|
|
-int virIOMMUFDOpenDevice(void);
|
|
+int virIOMMUFDOpenDevice(bool privileged);
|
|
|
|
bool virIOMMUFDSupported(void);
|
|
--
|
|
2.54.0
|