[libvirt PATCH v3] qemu: Enable unprivileged userfaultfd for post-copy migration

[Jiri Denemark]

Userfaultfd is by default allowed only for privileged processes. Since
libvirt runs QEMU unprivileged, we need to enable unprivileged access to
userfaultfd to enable post-copy migration.

https://bugzilla.redhat.com/show_bug.cgi?id=1945420

Signed-off-by: Jiri Denemark <jdenemar at redhat.com>
---

Notes:
    If you wonder about the 60-* prefix of the installed sysctl file, we already
    install 60-libvirtd.conf so I think it makes sense to use the same prefix for
    all sysctl configuration installed by libvirt.
    
    Version 2:
    - setting unprivileged_userfaultfd only when it is not already enabled
    - virReportSystemError replaced with VIR_WARN
    
    Version 3:
    - set the knob via a sysctl conf file instead

 libvirt.spec.in                    | 1 +
 src/qemu/meson.build               | 8 ++++++++
 src/qemu/postcopy-migration.sysctl | 6 ++++++
 3 files changed, 15 insertions(+)
 create mode 100644 src/qemu/postcopy-migration.sysctl

diff --git a/libvirt.spec.in b/libvirt.spec.in
index 5a079cdaf3..3aa4cc75b5 100644
--- a/libvirt.spec.in
+++ b/libvirt.spec.in
@@ -1859,6 +1859,7 @@ exit 0
 %files daemon-driver-qemu
 %config(noreplace) %{_sysconfdir}/sysconfig/virtqemud
 %config(noreplace) %{_sysconfdir}/libvirt/virtqemud.conf
+%config(noreplace) %{_prefix}/lib/sysctl.d/60-qemu-postcopy-migration.conf
 %{_datadir}/augeas/lenses/virtqemud.aug
 %{_datadir}/augeas/lenses/tests/test_virtqemud.aug
 %{_unitdir}/virtqemud.service
diff --git a/src/qemu/meson.build b/src/qemu/meson.build
index 3898d23877..66ef594006 100644
--- a/src/qemu/meson.build
+++ b/src/qemu/meson.build
@@ -170,6 +170,14 @@ if conf.has('WITH_QEMU')
     'file': files('virtqemud.sysconf'),
   }
 
+  if conf.has('WITH_SYSCTL')
+    install_data(
+      'postcopy-migration.sysctl',
+      install_dir: prefix / 'lib' / 'sysctl.d',
+      rename: [ '60-qemu-postcopy-migration.conf' ],
+    )
+  endif
+
   virt_install_dirs += [
     localstatedir / 'lib' / 'libvirt' / 'qemu',
     runstatedir / 'libvirt' / 'qemu',
diff --git a/src/qemu/postcopy-migration.sysctl b/src/qemu/postcopy-migration.sysctl
new file mode 100644
index 0000000000..aa8f015ae0
--- /dev/null
+++ b/src/qemu/postcopy-migration.sysctl
@@ -0,0 +1,6 @@
+# This is needed to support post-copy migration for QEMU run by libvirt,
+# i.e., unprivileged, as userfaultfd is by default only available to
+# privileged processes.
+# It can be safely overridden by a file in /etc/sysctl.d/ in case post-copy
+# migration is not used on the host.
+vm.unprivileged_userfaultfd = 1
-- 
2.34.1