virtiofsd enablement

[Christian Ehrhardt ]

This is a try for groovy, but ok to postpong to 21.04 if major blockers show up.
Now that we soon have qemu 5.0 and libvirt >6.2 in Groovy it makes sense to look at virtiosd.

There will be apparmor needs
https://www.redhat.com/archives/libvir-list/2020-August/msg00804.html

And probably more as we are testing.

TODO - recheck if all prereqs now exist

Background:
http://blog.vmsplice.net/2020/04/virtio-fs-has-landed-in-qemu-50.html https://www.qemu.org/docs/master/interop/virtiofsd.html#qemu-virtio-fs-shared-file-system-daemon https://www.kernel.org/doc/html/latest/filesystems/virtiofs.html https://virtio-fs.gitlab.io/index.html#status https://libvirt.org/kbase/virtiofs.html

[Christian Ehrhardt  (paelzer)]

Tried:

sudo mkdir -p /var/lib/libvirt/virtiofsd/test1

Get a guest and add
<filesystem type='mount' accessmode='passthrough'>
    <driver type='virtiofs'/>
    <binary xattr='on'>
       <lock posix='on' flock='on'/>
    </binary>
    <source dir='/var/lib/libvirt/virtiofsd/test1'/>
    <target dir='test1'/>
</filesystem>

due to:
"error: unsupported configuration: virtiofs requires one or more NUMA nodes"
This is explained in https://libvirt.org/kbase/virtiofs.html as a pre-req for shared memory
Due to that also add something like:
    <numa>
      <cell id='0' cpus='0-7' memory='2' unit='GiB' memAccess='shared'/>
    </numa>

There are more details for memory backing in the link above, but this gets you working.

In the guest one can then mount that via:
$ sudo mount -t virtiofs test1 /mnt

Runs fine on the host and provides transparent host FS access
in a more modern fashion than 9p.

ubuntu@node-horsea:~$ systemctl status libvirtd
● libvirtd.service - Virtualization daemon
     Loaded: loaded (/lib/systemd/system/libvirtd.service; enabled; vendor preset: enabled)
     Active: active (running) since Wed 2020-08-26 06:11:11 UTC; 24min ago
TriggeredBy: ● libvirtd-admin.socket
             ● libvirtd.socket
             ● libvirtd-ro.socket
       Docs: man:libvirtd(8)
             https://libvirt.org
   Main PID: 1499817 (libvirtd)
      Tasks: 159 (limit: 32768)
     Memory: 63.1M
     CGroup: /system.slice/libvirtd.service
             ├─ 1355 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
             ├─ 1356 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
             ├─ 41956 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/net-host-only-bridge-for-dpdk-1.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
             ├─ 41957 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/net-host-only-bridge-for-dpdk-1.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
             ├─ 41984 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/net-host-only-bridge-for-dpdk-2.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
             ├─ 41985 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/net-host-only-bridge-for-dpdk-2.conf --leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper
             ├─1499817 /usr/sbin/libvirtd
             ├─1518124 /usr/lib/qemu/virtiofsd --fd=28 -o source=/var/lib/libvirt/virtiofsd/test1,xattr,flock,posix_lock
             └─1518142 /usr/lib/qemu/virtiofsd --fd=28 -o source=/var/lib/libvirt/virtiofsd/test1,xattr,flock,posix_lock

Works fine with the apparmor rule applied.
I also tried to remove the rule and can confirm the former error.

$ virsh start virtiofsd-guest
error: Failed to start domain virtiofsd-guest
error: internal error: virtiofsd died unexpectedly

[173492.773174] audit: type=1400 audit(1598423932.651:6460): apparmor="DENIED" operation="exec" profile="libvirtd" name="/usr/lib/qemu/virtiofsd" pid=1518858 comm="rpc-worker" reque...

[Christian Ehrhardt  (paelzer)]

This is good for now and will be uploaded.
Mid term we should try to get a working subprofile for virtiofsd.

I started that at:
https://www.redhat.com/archives/libvir-list/2020-August/msg00981.html

[Launchpad Janitor (janitor)]

This bug was fixed in the package libvirt - 6.6.0-1ubuntu2

---------------
libvirt (6.6.0-1ubuntu2) groovy; urgency=medium

  * d/p/u/lp-1892826-Revert-m4-virt-xdr-rewrite-XDR-check.patch: avoid clashes
    between libtripc and glibc that break libvirt-lxc (LP: #1892826)
  * d/p/ubuntu-aa/lp-1892736-apparmor-allow-libvirtd-to-call-virtiofsd.patch:
    allow libvirt to control virtiofsd (LP: #1892736)

libvirt (6.6.0-1ubuntu1) groovy; urgency=medium

  * Merge with Debian 6.6.0-1 from experimental
    Among many other new features and fixes this includes fixes for:
    (LP: #1874647) - Stale libvirt cache leads to VM startup failures
    (LP: #1869796) - bad ordering and dependent restarts of services/sockets
    Remaining changes:
    - d/p/ubuntu-aa/lp-1847361-load-versioned-module.patch: allow loading
      versioned modules after qemu package upgrades (LP 1847361)
    - libvirt-uri.sh: Automatically switch default libvirt URI for users
      via user profile (xen URI on dom0, qemu:///system otherwise)
    - Disable libssh2 support (universe dependency)
    - Disable firewalld support (universe dependency)
    - Set qemu-group to kvm (for compat with older ubuntu)
    - Additional apport package-hook
    - Autostart default bridged network (As upstream does, but not Debian).
      In addition to just enabling it our solution provides:
      + do not autostart if subnet is already taken (e.g. in guests).
      + iterate some alternative subnets before giving up
    - d/p/ubuntu/Allow-libvirt-group-to-access-the-socket.patch: This is
      the group based access to libvirt functions as it was used in Ubuntu
      for quite long.
      + d/p/ubuntu/daemon-augeas-fix-expected.patch fix some related tests
        due to the group access change.
      + d/libvirt-daemon-system.postinst: add users in sudo to the libvirt
        group.
    - ubuntu/parallel-shutdown.patch: set parallel shutdown by default.
    - Update README.Debian with Ubuntu changes
    - d/p/ubuntu/ubuntu_machine_type.patch: accept ubuntu types as pci440fx
    - fix autopkgtests
      + d/t/control, d/t/smoke-qemu-session: fixup smoke-qemu-session by making
        vmlinuz available and accessible (Debian bug 848314)
      + d/t/control: fix smoke-qemu-session by ensuring the service will run
        installing libvirt-daemon-system
      + d/t/smoke-lxc: fix smoke-lxc by ignoring potential issues on destroy as
        long as the following undefine succeeds
      + d/t/smoke-lxc: use systemd instead of sysV to restart the service
    - dnsmasq related enhancements
      + run dnsmasq as libvirt-dnsmasq (LP: 1743718)
      + d/libvirt-daemon-system.postinst: add libvirt-dnsmasq user and group
      + d/libvirt-daemon-system.postrm: remove libvirt-dnsmasq user and group
        on purge
      + d/p/ubuntu/dnsmasq-as-priv-user: write dnsmasq config with user
        libvirt-dnsmasq and adapt the self tests to expect that config
      + d/libvirt-daemon-system.postinst: fix old libvirt-dnsmasq users group
      + Add dnsmasq configuration to work with system wide dnsmasq-base
    - debian/rules: disable the netcf backend. (LP: 1764314)
    - debian/patches/ubuntu/ovmf_paths.patch...