From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:45175) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VhPOa-0000Wv-Ps for qemu-devel@nongnu.org; Fri, 15 Nov 2013 14:49:41 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VhPOW-0001MH-EK for qemu-devel@nongnu.org; Fri, 15 Nov 2013 14:49:36 -0500 Received: from mx1.redhat.com ([209.132.183.28]:64825) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VhPOW-0001MB-6X for qemu-devel@nongnu.org; Fri, 15 Nov 2013 14:49:32 -0500 Message-ID: <52867ABA.6000602@redhat.com> Date: Fri, 15 Nov 2013 12:49:14 -0700 From: Eric Blake MIME-Version: 1.0 References: <1383764354-10588-1-git-send-email-mrhines@linux.vnet.ibm.com> <20131115170612.GO28794@redhat.com> <52865C83.10202@linux.vnet.ibm.com> <5286752A.4010105@redhat.com> <52867985.2070605@linux.vnet.ibm.com> In-Reply-To: <52867985.2070605@linux.vnet.ibm.com> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="tOmXag6AEiKpXPe6hvSdcpRHX8iU5tXiX" Subject: Re: [Qemu-devel] [PATCH v3 for-1.7] rdma: rename 'x-rdma' => 'rdma' List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Michael R. Hines" Cc: quintela@redhat.com, qemu-devel@nongnu.org, owasserm@redhat.com, onom@us.ibm.com, abali@us.ibm.com, mrhines@us.ibm.com, gokul@us.ibm.com, pbonzini@redhat.com, chegu_vinod@hp.com This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --tOmXag6AEiKpXPe6hvSdcpRHX8iU5tXiX Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On 11/15/2013 12:44 PM, Michael R. Hines wrote: > On 11/15/2013 02:25 PM, Eric Blake wrote: >> On 11/15/2013 10:40 AM, Michael R. Hines wrote: >>> This is unrelated to RDMA - accessing the /dev/infiniband >>> device nodes is already supported by libvirt my modifying >>> the configuration file in /etc and that works just fine. >> http://wiki.qemu.org/Features/RDMALiveMigration states that you modify= >> the .conf file to expose /dev/infiniband/rdma_cm and friends. Are all= >> of these devices read/write accessible to non-root? Or is there going= >> to be a problem if using user=3D"qemu" group=3D"qemu"? (That is, mere= ly >> exposing the devices through cgroup device ACL checking may be >> insufficient if you can't access the devices when not running root/roo= t). >=20 > Yes, non-root access is working just fine. Keep in mind that QEMU is no= > different than any other standard HPC application (like MPI programs) > which perform RDMA operations. >=20 > QEMU is simply another librdmacm/libibverbs user and it does > not require any special privileges to the device files. >=20 >> Libvirt can be patched so that the .conf file does not have to be edit= ed >> (ie. change the defaults so that if cgroup_device_acl is not present i= n >> the conf file, the defaults could still let a domainaccess the >> /dev/infiniband devices). >> >=20 > That would be quite nice! Shall I include that in the next version > of my libvirt patch? Yes, if you can. [rest of this is more for the libvirt list] Ideally, the access should only be granted at the start of the migration, and then revoked when no longer needed. For an example of granting ACL access while a domain is running, see how qemuDomainPrepareDiskChainElement() calls qemuSetupDiskCgroup and qemuTeardownDiskCgroup at appropriate times to alter the cgroup settings on the fly. These functions in turn call into virCgroupAllowDevicePath, and follow it up with an audit log, to make it easy to track through the audit which devices have been exposed to a guest. --=20 Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org --tOmXag6AEiKpXPe6hvSdcpRHX8iU5tXiX Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) Comment: Public key at http://people.redhat.com/eblake/eblake.gpg Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJShnq6AAoJEKeha0olJ0Nq504H/AmU1Xml9BeJCNYp1kRo5MOZ /JByOUOYajmLsusQQJg97KmS7/Ekru1HaX3pwTN/blwDnUMTeodmo7Zm67Omjo4N npIDPxS/XhIqexRFl6gDRfO4aM1l08XFen9BUOyD7mOrrSSeAVEboeXrZqixarJO 22Tj948a1hbxdRNjRDp8cvNmIwI6wI0jEP+45sAD9Qxdjl9UGARA18EfdJauTNNd a4NvKoe7GKSsfNV8XHuhMZGx0GAWDTyWFJhRuAus7f28GZ+PkxrPKTDsmCizZvlZ ZqFqwvqvxM9y0FE/GcAkAdDRKXnrgQp93pb4jN5t79zpzOfyqMSSIhwxha3bTOk= =iZwr -----END PGP SIGNATURE----- --tOmXag6AEiKpXPe6hvSdcpRHX8iU5tXiX--