From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36133) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VhdBU-0005LX-Cb for qemu-devel@nongnu.org; Sat, 16 Nov 2013 05:33:04 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VhdBQ-0007Ic-Mk for qemu-devel@nongnu.org; Sat, 16 Nov 2013 05:33:00 -0500 Received: from mx1.redhat.com ([209.132.183.28]:37589) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VhdBQ-0007IU-Ea for qemu-devel@nongnu.org; Sat, 16 Nov 2013 05:32:56 -0500 Date: Sat, 16 Nov 2013 10:32:45 +0000 From: "Daniel P. Berrange" Message-ID: <20131116103245.GC9975@redhat.com> References: <1383764354-10588-1-git-send-email-mrhines@linux.vnet.ibm.com> <20131115170612.GO28794@redhat.com> <52865C83.10202@linux.vnet.ibm.com> <5286752A.4010105@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <5286752A.4010105@redhat.com> Subject: Re: [Qemu-devel] [PATCH v3 for-1.7] rdma: rename 'x-rdma' => 'rdma' Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eric Blake Cc: quintela@redhat.com, qemu-devel@nongnu.org, "Michael R. Hines" , owasserm@redhat.com, onom@us.ibm.com, abali@us.ibm.com, mrhines@us.ibm.com, gokul@us.ibm.com, pbonzini@redhat.com, chegu_vinod@hp.com On Fri, Nov 15, 2013 at 12:25:30PM -0700, Eric Blake wrote: > On 11/15/2013 10:40 AM, Michael R. Hines wrote: > > > > This is unrelated to RDMA - accessing the /dev/infiniband > > device nodes is already supported by libvirt my modifying > > the configuration file in /etc and that works just fine. > > http://wiki.qemu.org/Features/RDMALiveMigration states that you modify > the .conf file to expose /dev/infiniband/rdma_cm and friends. Are all > of these devices read/write accessible to non-root? Or is there going > to be a problem if using user="qemu" group="qemu"? (That is, merely > exposing the devices through cgroup device ACL checking may be > insufficient if you can't access the devices when not running root/root). > > Libvirt can be patched so that the .conf file does not have to be edited > (ie. change the defaults so that if cgroup_device_acl is not present in > the conf file, the defaults could still let a domainaccess the > /dev/infiniband devices). There's also an SELinux question to deal with there. If multiple QEMUs need concurrent access we can't do a selective grant of the device just when migration is running - we would have to give all QEMU's access all the time. This would be a case where doing FD passing of the pre-opened devices might be a better option. It depends on what the downsides are to giving QEMU access to the devices unconditionally. Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|