[RFC HCI-8.1 PATCH 5/5] qemu update: refuse PCI hostdevs on non-shared guest RAM #VSTOR-103860

[Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>]

New domains with PCI hostdevs get shared memfd guest RAM since the
previous commits, but not all running domains have it: those started
by an older libvirt, those with explicitly configured private memory
backing, and those that got a PCI hostdev hotplugged while running on
anonymous RAM.  For them qemu-update would succeed while silently
breaking the device: DMA keeps going to the pages pinned before the
exec, which the guest stops seeing on its first write to them.

Refuse qemu-update for a domain with PCI hostdevs unless all of its
guest RAM is shared.  A cold restart gives such a domain shared memfd
RAM, unless its memory backing is configured otherwise.

Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
---
 src/qemu/qemu_driver.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index b3902f10c65..c39e0133ebb 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -25194,6 +25194,16 @@ qemuDomainGuestQemuUpdatePrechecks(virDomainObj *vm)
         return -1;
     }
 
+    /* Device DMA keeps going to the pages pinned before the exec, which the
+     * guest stops seeing on its first write if the RAM is private. */
+    if (virDomainDefHasPCIHostdev(vm->def) &&
+        !qemuDomainDefGuestRAMIsShared(vm->def)) {
+        virReportError(VIR_ERR_OPERATION_INVALID,
+                       _("VM '%1$s' has PCI hostdev on non-shared guest memory, qemu-update cancelled; a cold restart switches it to shared memory"),
+                       vm->def->name);
+        return -1;
+    }
+
     if (virDomainDefHasNVMeDisk(vm->def)) {
         virReportError(VIR_ERR_OPERATION_INVALID,
                        _("VM '%1$s' has NVMe disk, qemu-update cancelled"),
-- 
2.47.1