Ask Your Question

PCI passthrough issue seen with Kilo

asked 2015-05-19 15:09:28 -0600

opstkusr gravatar image

On a Kilo openstack installation using devstack (fedora 21)

PCI passthrough to VM fails:

File "/usr/lib64/python2.7/site-packages/", line 1037, in createWithFlags ^[[01;31m2015-05-19 15:53:52.475 TRACE nova.compute.manager ^[[01;35m[instance: b140bff4-ab14-48b4-83da-fe946257795e] ^[[00m if ret == -1: raise libvirtError ('virDomainCreateWithFlags() failed', dom=self) ^[[01;31m2015-05-19 15:53:52.475 TRACE nova.compute.manager ^[[01;35m[instance: b140bff4-ab14-48b4-83da-fe946257795e] ^[[00mlibvirtError: internal error: early end of file from monitor: possible problem: ^[[01;31m2015-05-19 15:53:52.475 TRACE nova.compute.manager ^[[01;35m[instance: b140bff4-ab14-48b4-83da-fe946257795e] ^[[00m2015-05-19T19:53:52.246745Z qemu-system-x86_64: -device vfio-pci,host=0a:10.3,id=hostdev0,bus=pci.0,addr=0x5: vfio: failed to open /dev/vfio/vfio: Operation not permitted

Any pointers on how to address this issue?

edit retag flag offensive close merge delete


GLaupre gravatar imageGLaupre ( 2015-05-19 16:10:26 -0600 )edit

What NIC do you use? Are you using the agent or you create a port and then boot an instance using nova boot CLI? Are you using macvtap or direct vif-type?

GLaupre gravatar imageGLaupre ( 2015-05-19 16:11:28 -0600 )edit

Are you using Fedora 21 ? I am doing regular pci passthrough (not sr-iov)

opstkusr gravatar imageopstkusr ( 2015-05-19 16:28:13 -0600 )edit

No I am using centos 7.1 and I try SR-IOV. But I my understanding this is the same thing to bind a PCI device, isn't it?

GLaupre gravatar imageGLaupre ( 2015-05-19 16:49:54 -0600 )edit

It should be. But for fedora i know that the default changed from pci-assign to vfio mode in fedora 21.

opstkusr gravatar imageopstkusr ( 2015-05-19 17:46:01 -0600 )edit

1 answer

Sort by ยป oldest newest most voted

answered 2015-05-19 21:50:50 -0600

Alex Williamson gravatar image

dmesg would probably be useful as it might tell you something like: 'No interrupt remapping support. Use the module param "allow_unsafe_interrupts" to enable VFIO IOMMU support on this platform'. If that's what you find, then it means your IOMMU hardware doesn't support interrupt remapping and you're potentially susceptible to an interrupt injection attack from your guest. If you trust your guest not to be malicious, add a modprobe.d conf file that contains "options vfio_iommu_type1 allow_unsafe_interrupts=1"

edit flag offensive delete link more


On second look, failed to _open_ /dev/vfio/vfio. You may not even be far enough to experience the problem I'm thinking of above. Do you have any vfio modules loaded (lsmod | grep vfio)? The vfio modules should be loaded automatically when the file is accessed and default mode is 0666.

Alex Williamson gravatar imageAlex Williamson ( 2015-05-19 21:56:41 -0600 )edit

I already tried setting the allow_unsafe_interrupts. No issues are seen in dmesg also: [ 0.175229] Enabled IRQ remapping in x2apic mode The vfio modules are also loaded. vfio,vfio_pci and vfio_iommu_type1

opstkusr gravatar imageopstkusr ( 2015-05-20 09:25:39 -0600 )edit

The default pci passthrough mechanism has change to vfio in Fedora 21. Has anyone successfully done this in fedora 21? I was able to get vfio working on the same server when running with Fedora 20.

opstkusr gravatar imageopstkusr ( 2015-05-20 09:38:36 -0600 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Get to know Ask OpenStack

Resources for moderators

Question Tools

1 follower


Asked: 2015-05-19 15:09:28 -0600

Seen: 776 times

Last updated: May 19 '15