Re: [Qemu-devel] [PATCH v3 for-1.7] rdma: rename 'x-rdma' => 'rdma'

[Eric Blake <eblake@redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 2155 bytes --]

On 11/15/2013 12:44 PM, Michael R. Hines wrote:
> On 11/15/2013 02:25 PM, Eric Blake wrote:
>> On 11/15/2013 10:40 AM, Michael R. Hines wrote:
>>> This is unrelated to RDMA - accessing the /dev/infiniband
>>> device nodes is already supported by libvirt my modifying
>>> the configuration file in /etc and that works just fine.
>> http://wiki.qemu.org/Features/RDMALiveMigration states that you modify
>> the .conf file to expose /dev/infiniband/rdma_cm and friends.  Are all
>> of these devices read/write accessible to non-root?  Or is there going
>> to be a problem if using user="qemu" group="qemu"?  (That is, merely
>> exposing the devices through cgroup device ACL checking may be
>> insufficient if you can't access the devices when not running root/root).
> 
> Yes, non-root access is working just fine. Keep in mind that QEMU is no
> different than any other standard HPC application (like MPI programs)
> which perform RDMA operations.
> 
> QEMU is simply another librdmacm/libibverbs user and it does
> not require any special privileges to the device files.
> 
>> Libvirt can be patched so that the .conf file does not have to be edited
>> (ie. change the defaults so that if cgroup_device_acl is not present in
>> the conf file, the defaults could still let a domainaccess the
>> /dev/infiniband devices).
>>
> 
> That would be quite nice! Shall I include that in the next version
> of my libvirt patch?

Yes, if you can.

[rest of this is more for the libvirt list]
Ideally, the access should only be granted at the start of the
migration, and then revoked when no longer needed.  For an example of
granting ACL access while a domain is running, see how
qemuDomainPrepareDiskChainElement() calls qemuSetupDiskCgroup and
qemuTeardownDiskCgroup at appropriate times to alter the cgroup settings
on the fly.  These functions in turn call into virCgroupAllowDevicePath,
and follow it up with an audit log, to make it easy to track through the
audit which devices have been exposed to a guest.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 621 bytes --]