qemu: Enable unprivileged userfaultfd for post-copy migration

Userfaultfd is by default allowed only for privileged processes. Since
libvirt runs QEMU unprivileged, we need to enable unprivileged access to
userfaultfd to enable post-copy migration.

https://bugzilla.redhat.com/show_bug.cgi?id=1945420

Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>

diff --git a/libvirt.spec.in b/libvirt.spec.in
index 5a079cdaf302a10b4c0c0b353a8e1ea44b49fcea..3aa4cc75b5b66c75b4d45b3e9cae6f479f250418 100644 (file)
--- a/libvirt.spec.in
+++ b/libvirt.spec.in
@@ -1859,6 +1859,7 @@ exit 0
 %files daemon-driver-qemu
 %config(noreplace) %{_sysconfdir}/sysconfig/virtqemud
 %config(noreplace) %{_sysconfdir}/libvirt/virtqemud.conf
+%config(noreplace) %{_prefix}/lib/sysctl.d/60-qemu-postcopy-migration.conf
 %{_datadir}/augeas/lenses/virtqemud.aug
 %{_datadir}/augeas/lenses/tests/test_virtqemud.aug
 %{_unitdir}/virtqemud.service

diff --git a/src/qemu/meson.build b/src/qemu/meson.build
index 3898d23877cf3b2d34d63c6127b2421b2d74d16c..66ef594006435c94190662c10ef9585dc5ad62fe 100644 (file)
--- a/src/qemu/meson.build
+++ b/src/qemu/meson.build
@@ -170,6 +170,14 @@ if conf.has('WITH_QEMU')
     'file': files('virtqemud.sysconf'),
   }
 
+  if conf.has('WITH_SYSCTL')
+    install_data(
+      'postcopy-migration.sysctl',
+      install_dir: prefix / 'lib' / 'sysctl.d',
+      rename: [ '60-qemu-postcopy-migration.conf' ],
+    )
+  endif
+
   virt_install_dirs += [
     localstatedir / 'lib' / 'libvirt' / 'qemu',
     runstatedir / 'libvirt' / 'qemu',

diff --git a/src/qemu/postcopy-migration.sysctl b/src/qemu/postcopy-migration.sysctl
new file mode 100644 (file)
index 0000000..aa8f015
--- /dev/null
+++ b/src/qemu/postcopy-migration.sysctl
@@ -0,0 +1,6 @@
+# This is needed to support post-copy migration for QEMU run by libvirt,
+# i.e., unprivileged, as userfaultfd is by default only available to
+# privileged processes.
+# It can be safely overridden by a file in /etc/sysctl.d/ in case post-copy
+# migration is not used on the host.
+vm.unprivileged_userfaultfd = 1