On 12/2/21 16:56, Jiri Denemark wrote: > Userfaultfd is by default allowed only for privileged processes. Since > libvirt runs QEMU unprivileged, we need to enable unprivileged access to > userfaultfd before starting post-copy migration. > > Rather than providing a static sysctl configuration file, we set the > sysctl knob in runtime once post-copy migration is requested. This way > unprivileged_userfaultfd is only enabled once actually used. > > https://bugzilla.redhat.com/show_bug.cgi?id=1945420 > > Signed-off-by: Jiri Denemark <jdenemar@xxxxxxxxxx> > --- > src/qemu/qemu_migration_params.c | 25 +++++++++++++++++++++++++ > 1 file changed, 25 insertions(+) > > diff --git a/src/qemu/qemu_migration_params.c b/src/qemu/qemu_migration_params.c > index dbc3219826..a9449ed1ff 100644 > --- a/src/qemu/qemu_migration_params.c > +++ b/src/qemu/qemu_migration_params.c > @@ -804,6 +804,24 @@ qemuMigrationCapsToJSON(virBitmap *caps, > } > > > +static void > +qemuMigrationParamsEnableUserfaultfd(virDomainObj *vm) > +{ > + const char *sysctl = "/proc/sys/vm/unprivileged_userfaultfd"; > + > + if (!virFileExists(sysctl)) > + return; > + > + VIR_DEBUG("Enabling unprivileged userfaultfd for post-copy migration of " > + "domain %s", vm->def->name); > + > + if (virFileWriteStr(sysctl, "1", 0) < 0) { > + virReportSystemError(errno, "%s", > + _("failed to enable unprivileged userfaultfd")); > + } I can imagine a wild scenario where libvirtd is run inside a restricted container but with the proper value set. How about we check whether the expected value isn't set already? No need to resend, the change is trivial enough to be done before push. Reviewed-by: Michal Privoznik <mprivozn@xxxxxxxxxx> Michal
