PCI domains other than 0000 or 4-digit break qubesd

[docelic]

Qubes OS release

Qubes-4.1.2

Brief summary

If a host machine has PCI devices in a PCI domain that is not "0000" or 4-digit (such as domain "10000"), it breaks qubesd.

In turn this makes all qubes fail to start, the Devices tab in Settings of all qubes becomes disabled, and commands like qvm-pci fail.

Steps to reproduce

Run Qubes on any hardware with PCI devices in domain other than 0000 or 4-digit.

Expected behavior

Dom0 and qubes to work as usual/expected.

Actual behavior

Dom0 will start, but qubes will be broken:

1. Qubes won't start (list of running qubes will be empty)
2. Running qubes manually will not work
3. Devices tab in Settings of all qubes will be grayed-out
4. qvm-pci will give a misleading error

More info

For example, on Asus G614J these devices are in domain 10000:

10000:e0:1d.0 System peripheral: Intel Corporation Device 09ab
10000:e0:1d.4 PCI bridge: Intel Corporation Device 7a34 (rev 11)
10000:e1:00.0 Non-Volatile memory controller: Samsung Electronics Co Ltd Device a80c

Luckily it seems that all important devices (which might want to be assigned to qubes) are in the default domain. A possible quick workaround for those who want to fix it immediately is to patch a line of Python code in dom0 to ignore other devices, and restart qubesd:

1. Open https://github.com/QubesOS/qubes-core-admin/blob/master/qubes/ext/pci.py#L186. On the installed system this file will be something like /usr/lib/python3.8/site-packages/qubes/ext/pci.py.
2. In function on_device_list_pci, above the line yield PCIDevice(...), add this code for example:

            if not libvirt_name.startswith("pci_0000_"):
              continue

Then restart qubesd with service qubesd restart.

More info is in: https://forum.qubes-os.org/t/major-problem-with-qvm-pci-and-devices-in-general/8359/15

[xaki23]

having watched this unfold on the irc side ... not sure what part needs diagnosis.

a) qubes has hardcoded assumption pci domain is 0000 in various places.
b) as of intel gen 11 (?) this seems no longer safe to assume.
c) ignoring all not-0000 domains seems safe for the two samples known so far.
d) adding support for multiple pci domains would probably be better longterm.

[Kenny606]

I've been playing around with RC1 in VMWare however this is my first 4.2 install on this bare metal laptop (which was running 4.1.2).
I can confirm this issue has carried through to R4.2 RC2 as well. The suggested adjustment to pci.py was still successful on RC2 just replace 3.8 with 3.11 in the path.

The 3 devices on the 0001 pci domain on my 12th Gen i7 Dell were also just 3 baseboard components you wouldn't be passing through to anything anyway.
I remember I had the same issue when I loaded 4.1 on this machine last year and made the same change.
I believe I experienced it initially on my XPS after loading 4.1 which is also a 12th Gen.

[marmarek]

Fixed in QubesOS/qubes-core-admin#560