)]}'
{"doc/source/contributor/pci-sim/testing.rst":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"f9552ab72b6059f7ea621ec3f1a757ce311ff0cb","unresolved":false,"context_lines":[{"line_number":133,"context_line":"echo path, and then deletes the test VM and tagged floating IP.  Use"},{"line_number":134,"context_line":"``--cleanup`` to remove leftovers from interrupted runs."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"DevStack Nova/Cyborg NVMe passthrough test"},{"line_number":137,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"After stacking with ``PCI_SIM_DEVICES\u003d\"cyborg:nvme\"`` (or ``nova:nvme``),"}],"source_content_type":"text/x-rst","patch_set":2,"id":"a8f86261_c4f29b5b","line":136,"updated":"2026-08-06 09:43:55.000000000","message":"The new \u0027DevStack Nova/Cyborg NVMe passthrough test\u0027 section in testing.rst instructs users to run tools/run-devstack-nvme-passthrough-test.sh, but that script does not exist anywhere in the repository.\n\n**Severity**: WARNING | **Confidence**: 1.0\n\n**Impact**: Users following the documentation will encounter a \u0027No such file or directory\u0027 error, undermining trust in the documentation and blocking the documented workflow.\n\n**Suggestion**:\nEither add the referenced tools/run-devstack-nvme-passthrough-test.sh script or remove the documentation section until the script is available.","commit_id":"b83f88e0832852e91855e958d376e9a5f89bcb04"}],"pci-sim/fake_pci_sriov_core.c":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"5922ec24155eedccc69e2b164412baeb53f0cdac","unresolved":false,"context_lines":[{"line_number":488,"context_line":"\tpci_unregister_driver(\u0026pci_sim_nvme_host_driver);"},{"line_number":489,"context_line":"\tpci_sim_nvme_host_unregister();"},{"line_number":490,"context_line":"\tpci_unregister_driver(\u0026pci_sim_vfio_driver);"},{"line_number":491,"context_line":"\tcancel_work_sync(\u0026pci_sim_nvme_handoff_work);"},{"line_number":492,"context_line":"\tpci_sim_tty_unregister_driver();"},{"line_number":493,"context_line":""},{"line_number":494,"context_line":"\tiommu_device_unregister(\u0026fake_iommu_dev);"}],"source_content_type":"text/x-csrc","patch_set":4,"id":"53f02154_61b23c00","line":491,"updated":"2026-08-07 08:49:33.000000000","message":"On module unload, cancel_work_sync may cancel a pending handoff work item. When the work function never runs, the pci_dev reference taken by pci_dev_get in pci_sim_vfio_close_device is never released via pci_dev_put, leaking the reference count on the pci_dev structure.\n\n**Severity**: SUGGESTION | **Confidence**: 0.8\n\n**Benefit**: On module unload with a pending handoff (VF just closed, work not yet executed), the pci_dev structure leaks a reference count. For a test fixture this is low-impact, but it is a concrete resource leak that a reviewer familiar with kernel lifecycle would note.\n\n**Recommendation**:\nAfter cancel_work_sync, drain the pending pointer: add \u0027pci_sim_nvme_handoff_pending \u003d NULL;\u0027 under the handoff lock and if the old value was non-NULL, call pci_dev_put() on it. Alternatively, check the return value of cancel_work_sync (true means work was pending) and release the pending reference if so.","commit_id":"45d6aee6924cc65f30a6bd2847bc383e5dace922"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"802a6ec49a5a3ae2a9883845e65fc581fe90876f","unresolved":false,"context_lines":[{"line_number":488,"context_line":"\tpci_unregister_driver(\u0026pci_sim_nvme_host_driver);"},{"line_number":489,"context_line":"\tpci_sim_nvme_host_unregister();"},{"line_number":490,"context_line":"\tpci_unregister_driver(\u0026pci_sim_vfio_driver);"},{"line_number":491,"context_line":"\tcancel_work_sync(\u0026pci_sim_nvme_handoff_work);"},{"line_number":492,"context_line":"\tpci_sim_tty_unregister_driver();"},{"line_number":493,"context_line":""},{"line_number":494,"context_line":"\tiommu_device_unregister(\u0026fake_iommu_dev);"}],"source_content_type":"text/x-csrc","patch_set":7,"id":"b2c9057b_8e7d6748","line":491,"updated":"2026-08-11 11:12:36.000000000","message":"The NVMe handoff deferred work acquires a pci_dev reference via pci_dev_get() in close_device and stores it in pci_sim_nvme_handoff_pending. The work function releases it with pci_dev_put(). However, if cancel_work_sync() in module exit cancels a pending (not-yet-running) work item, the work func...\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: If a guest is destroyed and the module is immediately unloaded before the workqueue runs, the pci_dev kref leaks. This prevents the pci_dev structure from being freed and can cause problems if the module is reloaded. The window is narrow but reachable in test/CI scenarios.\n\n**Suggestion**:\nAfter cancel_work_sync() in fake_pci_sriov_exit, check and release the pending reference: \u0027cancel_work_sync(\u0026pci_sim_nvme_handoff_work); if (pci_sim_nvme_handoff_pending) { pci_dev_put(pci_sim_nvme_handoff_pending); pci_sim_nvme_handoff_pending \u003d NULL; }\u0027","commit_id":"20d852e26b1d22e84c74bddf1a4d3472482ab058"}],"pci-sim/fake_pci_sriov_vfio.c":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"06010c6dde19a46460b449746ab71eae1cb28d98","unresolved":false,"context_lines":[{"line_number":136,"context_line":""},{"line_number":137,"context_line":"\tif (do_handoff) {"},{"line_number":138,"context_line":"\t\tmutex_lock(\u0026pci_sim_nvme_handoff_lock);"},{"line_number":139,"context_line":"\t\tpci_sim_nvme_handoff_pending \u003d pci_dev_get(sim-\u003ecore.pdev);"},{"line_number":140,"context_line":"\t\tmutex_unlock(\u0026pci_sim_nvme_handoff_lock);"},{"line_number":141,"context_line":"\t\tschedule_work(\u0026pci_sim_nvme_handoff_work);"},{"line_number":142,"context_line":"\t}"}],"source_content_type":"text/x-csrc","patch_set":3,"id":"9889ea1f_1aca27ff","line":139,"updated":"2026-08-06 13:50:56.000000000","message":"In pci_sim_vfio_close_device, pci_sim_nvme_handoff_pending is unconditionally overwritten with pci_dev_get(sim-\u003ecore.pdev) whenever do_handoff is true. If a previous handoff work is still queued (not yet executed), the previous pci_dev reference stored in pci_sim_nvme_handoff_pending is overwritt...\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: Leaked pci_dev references accumulate when two NVMe VFs are used sequentially without waiting for handoff work to complete. On systems with multiple VFs (the test script sets NUM_VFS\u003d2), this can cause kernel reference count leaks, potentially preventing clean module reload or causing kernel warni...\n\n**Suggestion**:\nBefore assigning pci_sim_nvme_handoff_pending, check if it is already non-NULL and call pci_dev_put on the previous value. Alternatively, call flush_work(\u0026pci_sim_nvme_handoff_work) before allowing a new VFIO open to ensure the previous handoff completes first.","commit_id":"8b71a3cf41ddc57f2b73646714e5e605a2e2160f"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"56d97e1b0a7663b41b9a489b98d2af74b789cd46","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"\tvfio_pci_core_close_device(core_vdev);"},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"\tif (do_handoff) {"},{"line_number":138,"context_line":"\t\tmutex_lock(\u0026pci_sim_nvme_handoff_lock);"},{"line_number":139,"context_line":"\t\tpci_sim_nvme_handoff_pending \u003d pci_dev_get(sim-\u003ecore.pdev);"},{"line_number":140,"context_line":"\t\tmutex_unlock(\u0026pci_sim_nvme_handoff_lock);"}],"source_content_type":"text/x-csrc","patch_set":10,"id":"b6b50c2e_a934d873","line":137,"updated":"2026-08-12 17:14:18.000000000","message":"The handoff work\u0027s pending pointer (pci_sim_nvme_handoff_pending) acquires a pci_dev_get reference in close_device but can be overwritten by a subsequent close or left set when cancel_work_sync cancels the work, leaking the pci_dev_get reference in both cases.\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: A leaked pci_dev_get reference prevents the PCI device reference count from reaching zero, which can block proper device cleanup during repeated test cycles or module reload. In the concurrent-close path, the leaked reference is on a specific VF device that may never be properly cleaned up. For a...\n\n**Suggestion**:\nAdd a guard in close_device to check if pending is already set and release the previous reference before overwriting: if (pci_sim_nvme_handoff_pending) pci_dev_put(pci_sim_nvme_handoff_pending);. For the module-unload path, add a cleanup step after cancel_work_sync in fake_pci_sriov_exit (or a small helper exported from vfio.c) that checks and releases any residual pending reference.","commit_id":"bbf1820e6246a0718955fb2e375e813250724eae"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"6a6c222acdc3c6b07d03deb148d3113e443e96a9","unresolved":false,"context_lines":[{"line_number":24,"context_line":"static struct pci_dev *pci_sim_nvme_handoff_pending;"},{"line_number":25,"context_line":"struct work_struct pci_sim_nvme_handoff_work;"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"void pci_sim_nvme_handoff_work_fn(struct work_struct *work)"},{"line_number":28,"context_line":"{"},{"line_number":29,"context_line":"\tstruct pci_dev *pdev;"},{"line_number":30,"context_line":"\tconst char *drv_name;"}],"source_content_type":"text/x-csrc","patch_set":13,"id":"0c2922c1_49f8803a","line":27,"updated":"2026-08-14 17:52:47.000000000","message":"pci_sim_nvme_handoff_work_fn() swaps the pending pointer under pci_sim_nvme_handoff_lock, then polls up to 4s (40 x msleep(100)) outside the mutex, while open_device()/close_device() take the same mutex and close_device() can re-arm pci_sim_nvme_handoff_pending and schedule_work() while the worke...\n\n**Severity**: CRITICAL | **Confidence**: 0.9\n\n**Risk**: Under concurrent VFIO open/close of NVMe VFs (one guest exiting while another boots, or repeated bind/unbind), a handoff can be silently dropped (pending overwritten), the system workqueue worker is pinned for 4s, and module unload can stall for ~4s.\n\n**Priority**: Immediate\n**Why This Matters**: Under concurrent VFIO open/close of NVMe VFs (one guest exiting while another boots, or repeated bind/unbind), a handoff can be silently dropped (pending overwritten), the system workqueue worker is pinned for 4s, and module unload can stall for ~4s.\n\n**Recommendation**:\nRun the rebind wait on a dedicated single-thread workqueue so the poll does not pin system_wq; serialize pending handoffs (list, or a busy flag checked under the mutex before arming pending); re-check pending after the poll loop so a handoff armed while the worker polled is not lost; flush the work before unregistering the VFIO driver in module exit.","commit_id":"44e91a755138621acbb9675d2d93ddc61c0b9918"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"6a6c222acdc3c6b07d03deb148d3113e443e96a9","unresolved":false,"context_lines":[{"line_number":107,"context_line":"err_disable:"},{"line_number":108,"context_line":"\tvfio_pci_core_disable(\u0026sim-\u003ecore);"},{"line_number":109,"context_line":"err_handoff:"},{"line_number":110,"context_line":"\tif (sim-\u003eops \u003d\u003d \u0026pci_sim_nvme_ops) {"},{"line_number":111,"context_line":"\t\tmutex_lock(\u0026pci_sim_nvme_handoff_lock);"},{"line_number":112,"context_line":"\t\tpci_sim_nvme_handoff_owner \u003d NULL;"},{"line_number":113,"context_line":"\t\tmutex_unlock(\u0026pci_sim_nvme_handoff_lock);"}],"source_content_type":"text/x-csrc","patch_set":13,"id":"bbf513e0_b76c88dc","line":110,"updated":"2026-08-14 17:52:47.000000000","message":"The err_handoff block in pci_sim_vfio_open_device() unconditionally sets pci_sim_nvme_handoff_owner \u003d NULL when a later open stage fails, without verifying the owner equals sim-\u003ecore.pdev - unlike close_device() in the same patch, which checks ownership before acting. If any path reaches err_hand...\n\n**Severity**: WARNING | **Confidence**: 0.8\n\n**Impact**: The single-owner handoff invariant can be violated, allowing two NVMe VFs to be assigned simultaneously or leaving the lock pointing at a stale owner until module reload.\n\n**Suggestion**:\nMirror close_device(): in the err_handoff block, only clear the owner if pci_sim_nvme_handoff_owner \u003d\u003d sim-\u003ecore.pdev. Two-line change that makes the invariant explicit and refactor-safe.","commit_id":"44e91a755138621acbb9675d2d93ddc61c0b9918"}],"pci-sim/test_nvme_data_persistence.sh":[{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"e0748030830f36e758d9ed20c03f3f92058e2b84","unresolved":false,"context_lines":[{"line_number":77,"context_line":"fi"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"# Parse memmap\u003d from /proc/cmdline"},{"line_number":80,"context_line":"MEMMAP_ENTRY\u003d$(grep -oP \u0027memmap\u003d\\S+\u0027 /proc/cmdline | head -1)"},{"line_number":81,"context_line":"if [ -z \"$MEMMAP_ENTRY\" ]; then"},{"line_number":82,"context_line":"    echo \"ERROR: no memmap\u003d kernel boot param — stock nvme cannot bind\""},{"line_number":83,"context_line":"    echo \"       add memmap\u003dSIZE\\$START to kernel cmdline and reboot\""}],"source_content_type":"text/x-sh","patch_set":9,"id":"472ababf_6574cde1","line":80,"updated":"2026-08-12 11:55:16.000000000","message":"On line 80, the pipeline `grep -oP \u0027memmap\u003d\\S+\u0027 /proc/cmdline | head -1` is used in a command substitution assignment. Under `set -euo pipefail`, if /proc/cmdline does not contain `memmap\u003d`, grep exits with status 1. With pipefail, the pipeline returns 1, and under set -e the assignment command f...\n\n**Severity**: WARNING | **Confidence**: 0.9\n\n**Impact**: When the system lacks a memmap\u003d boot parameter, the user sees an unhelpful `pipefail` abort instead of the intended guidance: \u0027add memmap\u003dSIZE$START to kernel cmdline and reboot\u0027. This makes debugging test failures harder.\n\n**Suggestion**:\nAppend `|| true` to the pipeline to suppress the non-zero exit, e.g.: `MEMMAP_ENTRY\u003d$(grep -oP \u0027memmap\u003d\\S+\u0027 /proc/cmdline | head -1 || true)`. This allows the `if [ -z \"$MEMMAP_ENTRY\" ]` check on line 81 to handle the missing-parameter case as intended.","commit_id":"1f031d3cac6a1064d428b58046d0a441a344d627"},{"author":{"_account_id":28006,"name":"teim-ci","display_name":"teim-ci","email":"ci@seanmooney.info","username":"ci-sean-mooney","status":"this is a third-party ci account run by sean-k-mooney on irc\nhosted at zuul.teim.app"},"tag":"autogenerated:zuul:automatic-ci","change_message_id":"6a6c222acdc3c6b07d03deb148d3113e443e96a9","unresolved":false,"context_lines":[{"line_number":339,"context_line":"msg \"Phase 3: Guest destroyed — verify data on host\""},{"line_number":340,"context_line":"# \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":341,"context_line":""},{"line_number":342,"context_line":"# Unbind VF from VFIO, clear override, let stock nvme rebind"},{"line_number":343,"context_line":"if [ -e \"/sys/bus/pci/devices/$VF_BDF/driver/unbind\" ]; then"},{"line_number":344,"context_line":"    echo \"$VF_BDF\" \u003e \"/sys/bus/pci/devices/$VF_BDF/driver/unbind\""},{"line_number":345,"context_line":"fi"}],"source_content_type":"text/x-sh","patch_set":13,"id":"dd9af146_2324fee5","line":342,"updated":"2026-08-14 17:52:47.000000000","message":"Phase 3 of the persistence test manually unbinds the VF from pci_sim_vfio_pci, clears driver_override, and reprobes - replicating in shell what the kernel handoff work introduced by this same patch is supposed to do automatically on VFIO close. The script neither waits for nor asserts the kernel-...\n\n**Severity**: HIGH | **Confidence**: 0.8\n\n**Risk**: Regressions in the patch\u0027s core automatic-handoff mechanism are hidden by the shell fallback, and the sysfs writes can race the deferred worker producing flaky results.\n\n**Priority**: Before merge\n**Why This Matters**: Regressions in the patch\u0027s core automatic-handoff mechanism are hidden by the shell fallback, and the sysfs writes can race the deferred worker producing flaky results.\n\n**Recommendation**:\nIn Phase 3, poll the driver symlink for up to the worker\u0027s ~4s budget and assert the rebind happened without manual unbind/override-clear; keep the manual path only as a documented fallback after the wait times out.","commit_id":"44e91a755138621acbb9675d2d93ddc61c0b9918"}]}