On an older, patched libvirt version (8.0.0), I've run into an issue when attempting to hot plug a PCI device via virsh attach-device --live. To repro: 1. start a guest and hot plug a device (works fine), 2. hot unplug the device 3. restart libvirt 4. attempt to hot plug the same device, it fails with EPERM, e.g. error: internal error: unable to execute QEMU command 'device_add': vfio 0000:86:01.2: failed to open /dev/vfio/165: Operation not permitted I'm not yet able to _attempt_ to reproduce on latest master (still working on that), however I've looked at the relevant piece of code and it looks the same so I would expect it to fail the same way. I've tried to debug this (on libvirt 8.0.0) and see that In qemuSetupHostdevCgroup(), virCgroupHasController() returns 0 since priv->cgroup is NULL. This prevents it from calling virCgroupAllowDevicePath(), hence the failure. priv->cgroup is NULL because it doesn't get initialized in virCgroupV1ValidateMachineGroup(): for (i = 0; i < VIR_CGROUP_CONTROLLER_LAST; i++) { if (STRNEQ(tmp, name) && ... ) { VIR_DEBUG("Name '%s' for controller '%s' does not match " "'%s', '%s', '%s', '%s' or '%s'", tmp, virCgroupV1ControllerTypeToString(i), name, machinename, partname, scopename_old, scopename_new); return false; } I've experimented replacing return false with continue and it works, however I don't know anything about this code so my hack might be completely wrong. Is this behaviour expected or is it a bug?