[23.10 FEAT] KVM: Improve memory reclaiming for z15 Secure Execution guests - libvirt part

[bugproxy]

Feature Description:

Currently, Secure Execution guest memory needs to be exported or destroyed, when a secure guest is rebooted or shut down. On the z15 this currently happens in a serialized manner, which takes long and also causes the host system to become irresponsive for extended periods, if very large guests are terminated. Changes to the KVM memory management will be required to improve the scalability.

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2023-02-09 10:41 EDT-------
Please note: In addition to this libvirt part, there is also a kernel and a qemu part required to implement the feature "KVM: Improve memory reclaiming for z15 Secure Execution guests".

The two other parts (kernel and qemu) are handled in the following bugs / LP entries:
Bug 193343 - LP1933180 : [23.04 FEAT] [VS2106] KVM: Improve memory reclaiming for z15 Secure Execution guests - kernel part
Bug 201597 - [23.10 FEAT] KVM: Improve memory reclaiming for z15 Secure Execution guests - qemu part

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2023-07-11 10:57 EDT-------
(In reply to comment #7)
> Hello Boris F.:
> Can you please provide the commit IDs of the required patches of the libvirt
> part?
> Thanks

Patches are now upstream:

https://gitlab.com/libvirt/libvirt/-/commit/d8e95ab6b7c45acc121746e2e24
https://gitlab.com/libvirt/libvirt/-/commit/584820b6bbe8b0d20c3b38f029f
https://gitlab.com/libvirt/libvirt/-/commit/65c6513811d1cdc7e97319164d7
https://gitlab.com/libvirt/libvirt/-/commit/3bf02acdc5446b2c4a3078f99d8

With the four patches upstream and as long as the fifth patch (enable the async-teardown feature by default on S390) is NOT upstream the documentation for Secure Execution needs to be extended.
It needs to be described for Secure Execution guests to make use of the new feature manually as the last upstream patch by default is disabled.

Commit 3bf02acd
qemu: allow use of async teardown in domain

Asynchronous teardown can be specified if the QEMU binary supports it by
adding in the domain XML

<features>
...
<async-teardown enabled='yes|no'/>
...
</features>

By default this new feature is disabled.

[Christian Ehrhardt  (paelzer)]

Tagged and mentioned on the planned merge for this cycle in bug 2018082

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2023-07-18 04:19 EDT-------
One more patch needs to be added:
https://gitlab.com/libvirt/libvirt/-/commit/aece25f66517a327c2a6bde4d06

[Christian Ehrhardt  (paelzer)]

Thanks

All of them are in v9.6.0-rc1 and we plan to pick up 9.6 for Ubuntu 23.10
So this should be rather smooth.

[Frank Heimes (fheimes)]

Updating status to Fix Committed,
since 9.6.0 landed meanwhile in -proposed:
libvirt | 9.6.0-1ubuntu1 | mantic-proposed | source

[Frank Heimes (fheimes)]

Since 9.6.0-1ubuntu1 has landed in mantic's release pocket, I'm closing this ticket with Fix Released.