4 # Copyright (C) 2008, 2009, 2010, 2011, 2012 Google Inc.
6 # This program is free software; you can redistribute it and/or modify
7 # it under the terms of the GNU General Public License as published by
8 # the Free Software Foundation; either version 2 of the License, or
9 # (at your option) any later version.
11 # This program is distributed in the hope that it will be useful, but
12 # WITHOUT ANY WARRANTY; without even the implied warranty of
13 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 # General Public License for more details.
16 # You should have received a copy of the GNU General Public License
17 # along with this program; if not, write to the Free Software
18 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
41 import affinity # pylint: disable=F0401
45 from ganeti import utils
46 from ganeti import constants
47 from ganeti import errors
48 from ganeti import serializer
49 from ganeti import objects
50 from ganeti import uidpool
51 from ganeti import ssconf
52 from ganeti.hypervisor import hv_base
53 from ganeti import netutils
54 from ganeti.utils import wrapper as utils_wrapper
57 _KVM_NETWORK_SCRIPT = constants.SYSCONFDIR + "/ganeti/kvm-vif-bridge"
58 _KVM_START_PAUSED_FLAG = "-S"
60 # TUN/TAP driver constants, taken from <linux/if_tun.h>
61 # They are architecture-independent and already hardcoded in qemu-kvm source,
62 # so we can safely include them here.
63 TUNSETIFF = 0x400454ca
64 TUNGETIFF = 0x800454d2
65 TUNGETFEATURES = 0x800454cf
71 def _ProbeTapVnetHdr(fd):
72 """Check whether to enable the IFF_VNET_HDR flag.
74 To do this, _all_ of the following conditions must be met:
75 1. TUNGETFEATURES ioctl() *must* be implemented
76 2. TUNGETFEATURES ioctl() result *must* contain the IFF_VNET_HDR flag
77 3. TUNGETIFF ioctl() *must* be implemented; reading the kernel code in
78 drivers/net/tun.c there is no way to test this until after the tap device
79 has been created using TUNSETIFF, and there is no way to change the
80 IFF_VNET_HDR flag after creating the interface, catch-22! However both
81 TUNGETIFF and TUNGETFEATURES were introduced in kernel version 2.6.27,
82 thus we can expect TUNGETIFF to be present if TUNGETFEATURES is.
85 @param fd: the file descriptor of /dev/net/tun
88 req = struct.pack("I", 0)
90 res = fcntl.ioctl(fd, TUNGETFEATURES, req)
91 except EnvironmentError:
92 logging.warning("TUNGETFEATURES ioctl() not implemented")
95 tunflags = struct.unpack("I", res)[0]
96 if tunflags & IFF_VNET_HDR:
99 logging.warning("Host does not support IFF_VNET_HDR, not enabling")
103 def _OpenTap(vnet_hdr=True):
104 """Open a new tap device and return its file descriptor.
106 This is intended to be used by a qemu-type hypervisor together with the -net
107 tap,fd=<fd> command line parameter.
109 @type vnet_hdr: boolean
110 @param vnet_hdr: Enable the VNET Header
111 @return: (ifname, tapfd)
116 tapfd = os.open("/dev/net/tun", os.O_RDWR)
117 except EnvironmentError:
118 raise errors.HypervisorError("Failed to open /dev/net/tun")
120 flags = IFF_TAP | IFF_NO_PI
122 if vnet_hdr and _ProbeTapVnetHdr(tapfd):
123 flags |= IFF_VNET_HDR
125 # The struct ifreq ioctl request (see netdevice(7))
126 ifr = struct.pack("16sh", "", flags)
129 res = fcntl.ioctl(tapfd, TUNSETIFF, ifr)
130 except EnvironmentError:
131 raise errors.HypervisorError("Failed to allocate a new TAP device")
133 # Get the interface name from the ioctl
134 ifname = struct.unpack("16sh", res)[0].strip("\x00")
135 return (ifname, tapfd)
139 """QEMU Messaging Protocol (QMP) message.
142 def __init__(self, data):
143 """Creates a new QMP message based on the passed data.
146 if not isinstance(data, dict):
147 raise TypeError("QmpMessage must be initialized with a dict")
151 def __getitem__(self, field_name):
152 """Get the value of the required field if present, or None.
154 Overrides the [] operator to provide access to the message data,
155 returning None if the required item is not in the message
156 @return: the value of the field_name field, or None if field_name
157 is not contained in the message
160 return self.data.get(field_name, None)
162 def __setitem__(self, field_name, field_value):
163 """Set the value of the required field_name to field_value.
166 self.data[field_name] = field_value
169 def BuildFromJsonString(json_string):
170 """Build a QmpMessage from a JSON encoded string.
172 @type json_string: str
173 @param json_string: JSON string representing the message
174 @rtype: L{QmpMessage}
175 @return: a L{QmpMessage} built from json_string
179 data = serializer.LoadJson(json_string)
180 return QmpMessage(data)
183 # The protocol expects the JSON object to be sent as a single line.
184 return serializer.DumpJson(self.data)
186 def __eq__(self, other):
187 # When comparing two QmpMessages, we are interested in comparing
188 # their internal representation of the message data
189 return self.data == other.data
193 """Connection to the QEMU Monitor using the QEMU Monitor Protocol (QMP).
196 _FIRST_MESSAGE_KEY = "QMP"
199 _RETURN_KEY = RETURN_KEY = "return"
200 _ACTUAL_KEY = ACTUAL_KEY = "actual"
201 _ERROR_CLASS_KEY = "class"
202 _ERROR_DATA_KEY = "data"
203 _ERROR_DESC_KEY = "desc"
204 _EXECUTE_KEY = "execute"
205 _ARGUMENTS_KEY = "arguments"
206 _CAPABILITIES_COMMAND = "qmp_capabilities"
207 _MESSAGE_END_TOKEN = "\r\n"
210 def __init__(self, monitor_filename):
211 """Instantiates the QmpConnection object.
213 @type monitor_filename: string
214 @param monitor_filename: the filename of the UNIX raw socket on which the
215 QMP monitor is listening
218 self.monitor_filename = monitor_filename
219 self.sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
220 # We want to fail if the server doesn't send a complete message
221 # in a reasonable amount of time
222 self.sock.settimeout(self._SOCKET_TIMEOUT)
223 self._connected = False
226 def _check_socket(self):
229 sock_stat = os.stat(self.monitor_filename)
230 except EnvironmentError, err:
231 if err.errno == errno.ENOENT:
232 raise errors.HypervisorError("No qmp socket found")
234 raise errors.HypervisorError("Error checking qmp socket: %s",
235 utils.ErrnoOrStr(err))
236 if not stat.S_ISSOCK(sock_stat.st_mode):
237 raise errors.HypervisorError("Qmp socket is not a socket")
239 def _check_connection(self):
240 """Make sure that the connection is established.
243 if not self._connected:
244 raise errors.ProgrammerError("To use a QmpConnection you need to first"
245 " invoke connect() on it")
248 """Connects to the QMP monitor.
250 Connects to the UNIX socket and makes sure that we can actually send and
251 receive data to the kvm instance via QMP.
253 @raise errors.HypervisorError: when there are communication errors
254 @raise errors.ProgrammerError: when there are data serialization errors
258 raise errors.ProgrammerError("Cannot connect twice")
262 # Check file existance/stuff
264 self.sock.connect(self.monitor_filename)
265 except EnvironmentError:
266 raise errors.HypervisorError("Can't connect to qmp socket")
267 self._connected = True
269 # Check if we receive a correct greeting message from the server
270 # (As per the QEMU Protocol Specification 0.1 - section 2.2)
271 greeting = self._Recv()
272 if not greeting[self._FIRST_MESSAGE_KEY]:
273 self._connected = False
274 raise errors.HypervisorError("kvm: qmp communication error (wrong"
277 # Let's put the monitor in command mode using the qmp_capabilities
278 # command, or else no command will be executable.
279 # (As per the QEMU Protocol Specification 0.1 - section 4)
280 self.Execute(self._CAPABILITIES_COMMAND)
282 def _ParseMessage(self, buf):
283 """Extract and parse a QMP message from the given buffer.
285 Seeks for a QMP message in the given buf. If found, it parses it and
286 returns it together with the rest of the characters in the buf.
287 If no message is found, returns None and the whole buffer.
289 @raise errors.ProgrammerError: when there are data serialization errors
293 # Check if we got the message end token (CRLF, as per the QEMU Protocol
294 # Specification 0.1 - Section 2.1.1)
295 pos = buf.find(self._MESSAGE_END_TOKEN)
298 message = QmpMessage.BuildFromJsonString(buf[:pos + 1])
299 except Exception, err:
300 raise errors.ProgrammerError("QMP data serialization error: %s" % err)
303 return (message, buf)
306 """Receives a message from QMP and decodes the received JSON object.
309 @return: the received message
310 @raise errors.HypervisorError: when there are communication errors
311 @raise errors.ProgrammerError: when there are data serialization errors
314 self._check_connection()
316 # Check if there is already a message in the buffer
317 (message, self._buf) = self._ParseMessage(self._buf)
321 recv_buffer = StringIO.StringIO(self._buf)
322 recv_buffer.seek(len(self._buf))
325 data = self.sock.recv(4096)
328 recv_buffer.write(data)
330 (message, self._buf) = self._ParseMessage(recv_buffer.getvalue())
334 except socket.timeout, err:
335 raise errors.HypervisorError("Timeout while receiving a QMP message: "
337 except socket.error, err:
338 raise errors.HypervisorError("Unable to receive data from KVM using the"
339 " QMP protocol: %s" % err)
341 def _Send(self, message):
342 """Encodes and sends a message to KVM using QMP.
344 @type message: QmpMessage
345 @param message: message to send to KVM
346 @raise errors.HypervisorError: when there are communication errors
347 @raise errors.ProgrammerError: when there are data serialization errors
350 self._check_connection()
352 message_str = str(message)
353 except Exception, err:
354 raise errors.ProgrammerError("QMP data deserialization error: %s" % err)
357 self.sock.sendall(message_str)
358 except socket.timeout, err:
359 raise errors.HypervisorError("Timeout while sending a QMP message: "
360 "%s (%s)" % (err.string, err.errno))
361 except socket.error, err:
362 raise errors.HypervisorError("Unable to send data from KVM using the"
363 " QMP protocol: %s" % err)
365 def Execute(self, command, arguments=None):
366 """Executes a QMP command and returns the response of the server.
369 @param command: the command to execute
370 @type arguments: dict
371 @param arguments: dictionary of arguments to be passed to the command
373 @return: dictionary representing the received JSON object
374 @raise errors.HypervisorError: when there are communication errors
375 @raise errors.ProgrammerError: when there are data serialization errors
378 self._check_connection()
379 message = QmpMessage({self._EXECUTE_KEY: command})
381 message[self._ARGUMENTS_KEY] = arguments
384 # Events can occur between the sending of the command and the reception
385 # of the response, so we need to filter out messages with the event key.
387 response = self._Recv()
388 err = response[self._ERROR_KEY]
390 raise errors.HypervisorError("kvm: error executing the %s"
391 " command: %s (%s, %s):" %
393 err[self._ERROR_DESC_KEY],
394 err[self._ERROR_CLASS_KEY],
395 err[self._ERROR_DATA_KEY]))
397 elif not response[self._EVENT_KEY]:
401 class KVMHypervisor(hv_base.BaseHypervisor):
402 """KVM hypervisor interface
407 _ROOT_DIR = constants.RUN_GANETI_DIR + "/kvm-hypervisor"
408 _PIDS_DIR = _ROOT_DIR + "/pid" # contains live instances pids
409 _UIDS_DIR = _ROOT_DIR + "/uid" # contains instances reserved uids
410 _CTRL_DIR = _ROOT_DIR + "/ctrl" # contains instances control sockets
411 _CONF_DIR = _ROOT_DIR + "/conf" # contains instances startup data
412 _NICS_DIR = _ROOT_DIR + "/nic" # contains instances nic <-> tap associations
413 _KEYMAP_DIR = _ROOT_DIR + "/keymap" # contains instances keymaps
414 # KVM instances with chroot enabled are started in empty chroot directories.
415 _CHROOT_DIR = _ROOT_DIR + "/chroot" # for empty chroot directories
416 # After an instance is stopped, its chroot directory is removed.
417 # If the chroot directory is not empty, it can't be removed.
418 # A non-empty chroot directory indicates a possible security incident.
419 # To support forensics, the non-empty chroot directory is quarantined in
420 # a separate directory, called 'chroot-quarantine'.
421 _CHROOT_QUARANTINE_DIR = _ROOT_DIR + "/chroot-quarantine"
422 _DIRS = [_ROOT_DIR, _PIDS_DIR, _UIDS_DIR, _CTRL_DIR, _CONF_DIR, _NICS_DIR,
423 _CHROOT_DIR, _CHROOT_QUARANTINE_DIR, _KEYMAP_DIR]
426 constants.HV_KERNEL_PATH: hv_base.OPT_FILE_CHECK,
427 constants.HV_INITRD_PATH: hv_base.OPT_FILE_CHECK,
428 constants.HV_ROOT_PATH: hv_base.NO_CHECK,
429 constants.HV_KERNEL_ARGS: hv_base.NO_CHECK,
430 constants.HV_ACPI: hv_base.NO_CHECK,
431 constants.HV_SERIAL_CONSOLE: hv_base.NO_CHECK,
432 constants.HV_VNC_BIND_ADDRESS:
433 (False, lambda x: (netutils.IP4Address.IsValid(x) or
434 utils.IsNormAbsPath(x)),
435 "the VNC bind address must be either a valid IP address or an absolute"
436 " pathname", None, None),
437 constants.HV_VNC_TLS: hv_base.NO_CHECK,
438 constants.HV_VNC_X509: hv_base.OPT_DIR_CHECK,
439 constants.HV_VNC_X509_VERIFY: hv_base.NO_CHECK,
440 constants.HV_VNC_PASSWORD_FILE: hv_base.OPT_FILE_CHECK,
441 constants.HV_KVM_SPICE_BIND: hv_base.NO_CHECK, # will be checked later
442 constants.HV_KVM_SPICE_IP_VERSION:
443 (False, lambda x: (x == constants.IFACE_NO_IP_VERSION_SPECIFIED or
444 x in constants.VALID_IP_VERSIONS),
445 "the SPICE IP version should be 4 or 6",
447 constants.HV_KVM_SPICE_PASSWORD_FILE: hv_base.OPT_FILE_CHECK,
448 constants.HV_KVM_SPICE_LOSSLESS_IMG_COMPR:
449 hv_base.ParamInSet(False,
450 constants.HT_KVM_SPICE_VALID_LOSSLESS_IMG_COMPR_OPTIONS),
451 constants.HV_KVM_SPICE_JPEG_IMG_COMPR:
452 hv_base.ParamInSet(False,
453 constants.HT_KVM_SPICE_VALID_LOSSY_IMG_COMPR_OPTIONS),
454 constants.HV_KVM_SPICE_ZLIB_GLZ_IMG_COMPR:
455 hv_base.ParamInSet(False,
456 constants.HT_KVM_SPICE_VALID_LOSSY_IMG_COMPR_OPTIONS),
457 constants.HV_KVM_SPICE_STREAMING_VIDEO_DETECTION:
458 hv_base.ParamInSet(False,
459 constants.HT_KVM_SPICE_VALID_VIDEO_STREAM_DETECTION_OPTIONS),
460 constants.HV_KVM_SPICE_AUDIO_COMPR: hv_base.NO_CHECK,
461 constants.HV_KVM_SPICE_USE_TLS: hv_base.NO_CHECK,
462 constants.HV_KVM_SPICE_TLS_CIPHERS: hv_base.NO_CHECK,
463 constants.HV_KVM_SPICE_USE_VDAGENT: hv_base.NO_CHECK,
464 constants.HV_KVM_FLOPPY_IMAGE_PATH: hv_base.OPT_FILE_CHECK,
465 constants.HV_CDROM_IMAGE_PATH: hv_base.OPT_FILE_CHECK,
466 constants.HV_KVM_CDROM2_IMAGE_PATH: hv_base.OPT_FILE_CHECK,
467 constants.HV_BOOT_ORDER:
468 hv_base.ParamInSet(True, constants.HT_KVM_VALID_BO_TYPES),
469 constants.HV_NIC_TYPE:
470 hv_base.ParamInSet(True, constants.HT_KVM_VALID_NIC_TYPES),
471 constants.HV_DISK_TYPE:
472 hv_base.ParamInSet(True, constants.HT_KVM_VALID_DISK_TYPES),
473 constants.HV_KVM_CDROM_DISK_TYPE:
474 hv_base.ParamInSet(False, constants.HT_KVM_VALID_DISK_TYPES),
475 constants.HV_USB_MOUSE:
476 hv_base.ParamInSet(False, constants.HT_KVM_VALID_MOUSE_TYPES),
477 constants.HV_KEYMAP: hv_base.NO_CHECK,
478 constants.HV_MIGRATION_PORT: hv_base.REQ_NET_PORT_CHECK,
479 constants.HV_MIGRATION_BANDWIDTH: hv_base.NO_CHECK,
480 constants.HV_MIGRATION_DOWNTIME: hv_base.NO_CHECK,
481 constants.HV_MIGRATION_MODE: hv_base.MIGRATION_MODE_CHECK,
482 constants.HV_USE_LOCALTIME: hv_base.NO_CHECK,
483 constants.HV_DISK_CACHE:
484 hv_base.ParamInSet(True, constants.HT_VALID_CACHE_TYPES),
485 constants.HV_SECURITY_MODEL:
486 hv_base.ParamInSet(True, constants.HT_KVM_VALID_SM_TYPES),
487 constants.HV_SECURITY_DOMAIN: hv_base.NO_CHECK,
488 constants.HV_KVM_FLAG:
489 hv_base.ParamInSet(False, constants.HT_KVM_FLAG_VALUES),
490 constants.HV_VHOST_NET: hv_base.NO_CHECK,
491 constants.HV_KVM_USE_CHROOT: hv_base.NO_CHECK,
492 constants.HV_MEM_PATH: hv_base.OPT_DIR_CHECK,
493 constants.HV_REBOOT_BEHAVIOR:
494 hv_base.ParamInSet(True, constants.REBOOT_BEHAVIORS),
495 constants.HV_CPU_MASK: hv_base.OPT_MULTI_CPU_MASK_CHECK,
498 _MIGRATION_STATUS_RE = re.compile("Migration\s+status:\s+(\w+)",
500 _MIGRATION_PROGRESS_RE = \
501 re.compile(r"\s*transferred\s+ram:\s+(?P<transferred>\d+)\s+kbytes\s*\n"
502 r"\s*remaining\s+ram:\s+(?P<remaining>\d+)\s+kbytes\s*\n"
503 r"\s*total\s+ram:\s+(?P<total>\d+)\s+kbytes\s*\n", re.I)
505 _MIGRATION_INFO_MAX_BAD_ANSWERS = 5
506 _MIGRATION_INFO_RETRY_DELAY = 2
508 _VERSION_RE = re.compile(r"\b(\d+)\.(\d+)(\.(\d+))?\b")
510 _CPU_INFO_RE = re.compile(r"cpu\s+\#(\d+).*thread_id\s*=\s*(\d+)", re.I)
511 _CPU_INFO_CMD = "info cpus"
517 ANCILLARY_FILES_OPT = [
522 hv_base.BaseHypervisor.__init__(self)
523 # Let's make sure the directories we need exist, even if the RUN_DIR lives
524 # in a tmpfs filesystem or has been otherwise wiped out.
525 dirs = [(dname, constants.RUN_DIRS_MODE) for dname in self._DIRS]
526 utils.EnsureDirs(dirs)
529 def _InstancePidFile(cls, instance_name):
530 """Returns the instance pidfile.
533 return utils.PathJoin(cls._PIDS_DIR, instance_name)
536 def _InstanceUidFile(cls, instance_name):
537 """Returns the instance uidfile.
540 return utils.PathJoin(cls._UIDS_DIR, instance_name)
543 def _InstancePidInfo(cls, pid):
544 """Check pid file for instance information.
546 Check that a pid file is associated with an instance, and retrieve
547 information from its command line.
549 @type pid: string or int
550 @param pid: process id of the instance to check
552 @return: (instance_name, memory, vcpus)
553 @raise errors.HypervisorError: when an instance cannot be found
556 alive = utils.IsProcessAlive(pid)
558 raise errors.HypervisorError("Cannot get info for pid %s" % pid)
560 cmdline_file = utils.PathJoin("/proc", str(pid), "cmdline")
562 cmdline = utils.ReadFile(cmdline_file)
563 except EnvironmentError, err:
564 raise errors.HypervisorError("Can't open cmdline file for pid %s: %s" %
571 arg_list = cmdline.split("\x00")
573 arg = arg_list.pop(0)
575 instance = arg_list.pop(0)
577 memory = int(arg_list.pop(0))
579 vcpus = int(arg_list.pop(0))
582 raise errors.HypervisorError("Pid %s doesn't contain a ganeti kvm"
585 return (instance, memory, vcpus)
587 def _InstancePidAlive(self, instance_name):
588 """Returns the instance pidfile, pid, and liveness.
590 @type instance_name: string
591 @param instance_name: instance name
593 @return: (pid file name, pid, liveness)
596 pidfile = self._InstancePidFile(instance_name)
597 pid = utils.ReadPidFile(pidfile)
601 cmd_instance = self._InstancePidInfo(pid)[0]
602 alive = (cmd_instance == instance_name)
603 except errors.HypervisorError:
606 return (pidfile, pid, alive)
608 def _CheckDown(self, instance_name):
609 """Raises an error unless the given instance is down.
612 alive = self._InstancePidAlive(instance_name)[2]
614 raise errors.HypervisorError("Failed to start instance %s: %s" %
615 (instance_name, "already running"))
618 def _InstanceMonitor(cls, instance_name):
619 """Returns the instance monitor socket name
622 return utils.PathJoin(cls._CTRL_DIR, "%s.monitor" % instance_name)
625 def _InstanceSerial(cls, instance_name):
626 """Returns the instance serial socket name
629 return utils.PathJoin(cls._CTRL_DIR, "%s.serial" % instance_name)
632 def _InstanceQmpMonitor(cls, instance_name):
633 """Returns the instance serial QMP socket name
636 return utils.PathJoin(cls._CTRL_DIR, "%s.qmp" % instance_name)
639 def _SocatUnixConsoleParams():
640 """Returns the correct parameters for socat
642 If we have a new-enough socat we can use raw mode with an escape character.
645 if constants.SOCAT_USE_ESCAPE:
646 return "raw,echo=0,escape=%s" % constants.SOCAT_ESCAPE_CODE
648 return "echo=0,icanon=0"
651 def _InstanceKVMRuntime(cls, instance_name):
652 """Returns the instance KVM runtime filename
655 return utils.PathJoin(cls._CONF_DIR, "%s.runtime" % instance_name)
658 def _InstanceChrootDir(cls, instance_name):
659 """Returns the name of the KVM chroot dir of the instance
662 return utils.PathJoin(cls._CHROOT_DIR, instance_name)
665 def _InstanceNICDir(cls, instance_name):
666 """Returns the name of the directory holding the tap device files for a
670 return utils.PathJoin(cls._NICS_DIR, instance_name)
673 def _InstanceNICFile(cls, instance_name, seq):
674 """Returns the name of the file containing the tap device for a given NIC
677 return utils.PathJoin(cls._InstanceNICDir(instance_name), str(seq))
680 def _InstanceKeymapFile(cls, instance_name):
681 """Returns the name of the file containing the keymap for a given instance
684 return utils.PathJoin(cls._KEYMAP_DIR, instance_name)
687 def _TryReadUidFile(cls, uid_file):
688 """Try to read a uid file
691 if os.path.exists(uid_file):
693 uid = int(utils.ReadOneLineFile(uid_file))
695 except EnvironmentError:
696 logging.warning("Can't read uid file", exc_info=True)
697 except (TypeError, ValueError):
698 logging.warning("Can't parse uid file contents", exc_info=True)
702 def _RemoveInstanceRuntimeFiles(cls, pidfile, instance_name):
703 """Removes an instance's rutime sockets/files/dirs.
706 utils.RemoveFile(pidfile)
707 utils.RemoveFile(cls._InstanceMonitor(instance_name))
708 utils.RemoveFile(cls._InstanceSerial(instance_name))
709 utils.RemoveFile(cls._InstanceQmpMonitor(instance_name))
710 utils.RemoveFile(cls._InstanceKVMRuntime(instance_name))
711 utils.RemoveFile(cls._InstanceKeymapFile(instance_name))
712 uid_file = cls._InstanceUidFile(instance_name)
713 uid = cls._TryReadUidFile(uid_file)
714 utils.RemoveFile(uid_file)
716 uidpool.ReleaseUid(uid)
718 shutil.rmtree(cls._InstanceNICDir(instance_name))
720 if err.errno != errno.ENOENT:
723 chroot_dir = cls._InstanceChrootDir(instance_name)
724 utils.RemoveDir(chroot_dir)
726 if err.errno == errno.ENOTEMPTY:
727 # The chroot directory is expected to be empty, but it isn't.
728 new_chroot_dir = tempfile.mkdtemp(dir=cls._CHROOT_QUARANTINE_DIR,
731 utils.TimestampForFilename()))
732 logging.warning("The chroot directory of instance %s can not be"
733 " removed as it is not empty. Moving it to the"
734 " quarantine instead. Please investigate the"
735 " contents (%s) and clean up manually",
736 instance_name, new_chroot_dir)
737 utils.RenameFile(chroot_dir, new_chroot_dir)
742 def _ConfigureNIC(instance, seq, nic, tap):
743 """Run the network configuration script for a specified NIC
745 @param instance: instance we're acting on
746 @type instance: instance object
747 @param seq: nic sequence number
749 @param nic: nic we're acting on
750 @type nic: nic object
751 @param tap: the host's tap interface this NIC corresponds to
756 tags = " ".join(instance.tags)
761 "PATH": "%s:/sbin:/usr/sbin" % os.environ["PATH"],
762 "INSTANCE": instance.name,
764 "MODE": nic.nicparams[constants.NIC_MODE],
766 "INTERFACE_INDEX": str(seq),
773 if nic.nicparams[constants.NIC_LINK]:
774 env["LINK"] = nic.nicparams[constants.NIC_LINK]
776 if nic.nicparams[constants.NIC_MODE] == constants.NIC_MODE_BRIDGED:
777 env["BRIDGE"] = nic.nicparams[constants.NIC_LINK]
779 result = utils.RunCmd([constants.KVM_IFUP, tap], env=env)
781 raise errors.HypervisorError("Failed to configure interface %s: %s."
782 " Network configuration script output: %s" %
783 (tap, result.fail_reason, result.output))
786 def _VerifyAffinityPackage():
788 raise errors.HypervisorError("affinity Python package not"
789 " found; cannot use CPU pinning under KVM")
792 def _BuildAffinityCpuMask(cpu_list):
793 """Create a CPU mask suitable for sched_setaffinity from a list of
796 See man taskset for more info on sched_setaffinity masks.
797 For example: [ 0, 2, 5, 6 ] will return 101 (0x65, 0..01100101).
799 @type cpu_list: list of int
800 @param cpu_list: list of physical CPU numbers to map to vCPUs in order
802 @return: a bit mask of CPU affinities
805 if cpu_list == constants.CPU_PINNING_OFF:
806 return constants.CPU_PINNING_ALL_KVM
808 return sum(2 ** cpu for cpu in cpu_list)
811 def _AssignCpuAffinity(cls, cpu_mask, process_id, thread_dict):
812 """Change CPU affinity for running VM according to given CPU mask.
814 @param cpu_mask: CPU mask as given by the user. e.g. "0-2,4:all:1,3"
815 @type cpu_mask: string
816 @param process_id: process ID of KVM process. Used to pin entire VM
818 @type process_id: int
819 @param thread_dict: map of virtual CPUs to KVM thread IDs
820 @type thread_dict: dict int:int
823 # Convert the string CPU mask to a list of list of int's
824 cpu_list = utils.ParseMultiCpuMask(cpu_mask)
826 if len(cpu_list) == 1:
827 all_cpu_mapping = cpu_list[0]
828 if all_cpu_mapping == constants.CPU_PINNING_OFF:
829 # If CPU pinning has 1 entry that's "all", then do nothing
832 # If CPU pinning has one non-all entry, map the entire VM to
833 # one set of physical CPUs
834 cls._VerifyAffinityPackage()
835 affinity.set_process_affinity_mask(process_id,
836 cls._BuildAffinityCpuMask(all_cpu_mapping))
838 # The number of vCPUs mapped should match the number of vCPUs
839 # reported by KVM. This was already verified earlier, so
840 # here only as a sanity check.
841 assert len(thread_dict) == len(cpu_list)
842 cls._VerifyAffinityPackage()
844 # For each vCPU, map it to the proper list of physical CPUs
845 for vcpu, i in zip(cpu_list, range(len(cpu_list))):
846 affinity.set_process_affinity_mask(thread_dict[i],
847 cls._BuildAffinityCpuMask(vcpu))
849 def _GetVcpuThreadIds(self, instance_name):
850 """Get a mapping of vCPU no. to thread IDs for the instance
852 @type instance_name: string
853 @param instance_name: instance in question
854 @rtype: dictionary of int:int
855 @return: a dictionary mapping vCPU numbers to thread IDs
859 output = self._CallMonitorCommand(instance_name, self._CPU_INFO_CMD)
860 for line in output.stdout.splitlines():
861 match = self._CPU_INFO_RE.search(line)
864 grp = map(int, match.groups())
865 result[grp[0]] = grp[1]
869 def _ExecuteCpuAffinity(self, instance_name, cpu_mask):
870 """Complete CPU pinning.
872 @type instance_name: string
873 @param instance_name: name of instance
874 @type cpu_mask: string
875 @param cpu_mask: CPU pinning mask as entered by user
878 # Get KVM process ID, to be used if need to pin entire VM
879 _, pid, _ = self._InstancePidAlive(instance_name)
880 # Get vCPU thread IDs, to be used if need to pin vCPUs separately
881 thread_dict = self._GetVcpuThreadIds(instance_name)
882 # Run CPU pinning, based on configured mask
883 self._AssignCpuAffinity(cpu_mask, pid, thread_dict)
885 def ListInstances(self):
886 """Get the list of running instances.
888 We can do this by listing our live instances directory and
889 checking whether the associated kvm process is still alive.
893 for name in os.listdir(self._PIDS_DIR):
894 if self._InstancePidAlive(name)[2]:
898 def GetInstanceInfo(self, instance_name):
899 """Get instance properties.
901 @type instance_name: string
902 @param instance_name: the instance name
903 @rtype: tuple of strings
904 @return: (name, id, memory, vcpus, stat, times)
907 _, pid, alive = self._InstancePidAlive(instance_name)
911 _, memory, vcpus = self._InstancePidInfo(pid)
916 qmp = QmpConnection(self._InstanceQmpMonitor(instance_name))
918 vcpus = len(qmp.Execute("query-cpus")[qmp.RETURN_KEY])
919 # Will fail if ballooning is not enabled, but we can then just resort to
921 mem_bytes = qmp.Execute("query-balloon")[qmp.RETURN_KEY][qmp.ACTUAL_KEY]
922 memory = mem_bytes / 1048576
923 except errors.HypervisorError:
926 return (instance_name, pid, memory, vcpus, istat, times)
928 def GetAllInstancesInfo(self):
929 """Get properties of all instances.
931 @return: list of tuples (name, id, memory, vcpus, stat, times)
935 for name in os.listdir(self._PIDS_DIR):
937 info = self.GetInstanceInfo(name)
938 except errors.HypervisorError:
939 # Ignore exceptions due to instances being shut down
945 def _GenerateKVMRuntime(self, instance, block_devices, startup_paused):
946 """Generate KVM information to start an instance.
948 @attention: this function must not have any side-effects; for
949 example, it must not write to the filesystem, or read values
950 from the current system the are expected to differ between
951 nodes, since it is only run once at instance startup;
952 actions/kvm arguments that can vary between systems should be
953 done in L{_ExecuteKVMRuntime}
956 # pylint: disable=R0914,R0915
957 _, v_major, v_min, _ = self._GetKVMVersion()
959 pidfile = self._InstancePidFile(instance.name)
960 kvm = constants.KVM_PATH
962 # used just by the vnc server, if enabled
963 kvm_cmd.extend(["-name", instance.name])
964 kvm_cmd.extend(["-m", instance.beparams[constants.BE_MAXMEM]])
965 kvm_cmd.extend(["-smp", instance.beparams[constants.BE_VCPUS]])
966 kvm_cmd.extend(["-pidfile", pidfile])
967 kvm_cmd.extend(["-balloon", "virtio"])
968 kvm_cmd.extend(["-daemonize"])
969 if not instance.hvparams[constants.HV_ACPI]:
970 kvm_cmd.extend(["-no-acpi"])
971 if instance.hvparams[constants.HV_REBOOT_BEHAVIOR] == \
972 constants.INSTANCE_REBOOT_EXIT:
973 kvm_cmd.extend(["-no-reboot"])
975 hvp = instance.hvparams
976 boot_disk = hvp[constants.HV_BOOT_ORDER] == constants.HT_BO_DISK
977 boot_cdrom = hvp[constants.HV_BOOT_ORDER] == constants.HT_BO_CDROM
978 boot_floppy = hvp[constants.HV_BOOT_ORDER] == constants.HT_BO_FLOPPY
979 boot_network = hvp[constants.HV_BOOT_ORDER] == constants.HT_BO_NETWORK
981 self.ValidateParameters(hvp)
984 kvm_cmd.extend([_KVM_START_PAUSED_FLAG])
986 if hvp[constants.HV_KVM_FLAG] == constants.HT_KVM_ENABLED:
987 kvm_cmd.extend(["-enable-kvm"])
988 elif hvp[constants.HV_KVM_FLAG] == constants.HT_KVM_DISABLED:
989 kvm_cmd.extend(["-disable-kvm"])
992 kvm_cmd.extend(["-boot", "n"])
994 disk_type = hvp[constants.HV_DISK_TYPE]
995 if disk_type == constants.HT_DISK_PARAVIRTUAL:
996 if_val = ",if=virtio"
998 if_val = ",if=%s" % disk_type
1000 disk_cache = hvp[constants.HV_DISK_CACHE]
1001 if instance.disk_template in constants.DTS_EXT_MIRROR:
1002 if disk_cache != "none":
1003 # TODO: make this a hard error, instead of a silent overwrite
1004 logging.warning("KVM: overriding disk_cache setting '%s' with 'none'"
1005 " to prevent shared storage corruption on migration",
1007 cache_val = ",cache=none"
1008 elif disk_cache != constants.HT_CACHE_DEFAULT:
1009 cache_val = ",cache=%s" % disk_cache
1012 for cfdev, dev_path in block_devices:
1013 if cfdev.mode != constants.DISK_RDWR:
1014 raise errors.HypervisorError("Instance has read-only disks which"
1015 " are not supported by KVM")
1016 # TODO: handle FD_LOOP and FD_BLKTAP (?)
1019 kvm_cmd.extend(["-boot", "c"])
1021 if (v_major, v_min) < (0, 14) and disk_type != constants.HT_DISK_IDE:
1022 boot_val = ",boot=on"
1024 drive_val = "file=%s,format=raw%s%s%s" % (dev_path, if_val, boot_val,
1026 kvm_cmd.extend(["-drive", drive_val])
1028 #Now we can specify a different device type for CDROM devices.
1029 cdrom_disk_type = hvp[constants.HV_KVM_CDROM_DISK_TYPE]
1030 if not cdrom_disk_type:
1031 cdrom_disk_type = disk_type
1033 iso_image = hvp[constants.HV_CDROM_IMAGE_PATH]
1035 options = ",format=raw,media=cdrom"
1037 kvm_cmd.extend(["-boot", "d"])
1038 if cdrom_disk_type != constants.HT_DISK_IDE:
1039 options = "%s,boot=on,if=%s" % (options, constants.HT_DISK_IDE)
1041 options = "%s,boot=on" % options
1043 if cdrom_disk_type == constants.HT_DISK_PARAVIRTUAL:
1044 if_val = ",if=virtio"
1046 if_val = ",if=%s" % cdrom_disk_type
1047 options = "%s%s" % (options, if_val)
1048 drive_val = "file=%s%s" % (iso_image, options)
1049 kvm_cmd.extend(["-drive", drive_val])
1051 iso_image2 = hvp[constants.HV_KVM_CDROM2_IMAGE_PATH]
1053 options = ",format=raw,media=cdrom"
1054 if cdrom_disk_type == constants.HT_DISK_PARAVIRTUAL:
1055 if_val = ",if=virtio"
1057 if_val = ",if=%s" % cdrom_disk_type
1058 options = "%s%s" % (options, if_val)
1059 drive_val = "file=%s%s" % (iso_image2, options)
1060 kvm_cmd.extend(["-drive", drive_val])
1062 floppy_image = hvp[constants.HV_KVM_FLOPPY_IMAGE_PATH]
1064 options = ",format=raw,media=disk"
1066 kvm_cmd.extend(["-boot", "a"])
1067 options = "%s,boot=on" % options
1068 if_val = ",if=floppy"
1069 options = "%s%s" % (options, if_val)
1070 drive_val = "file=%s%s" % (floppy_image, options)
1071 kvm_cmd.extend(["-drive", drive_val])
1073 kernel_path = hvp[constants.HV_KERNEL_PATH]
1075 kvm_cmd.extend(["-kernel", kernel_path])
1076 initrd_path = hvp[constants.HV_INITRD_PATH]
1078 kvm_cmd.extend(["-initrd", initrd_path])
1079 root_append = ["root=%s" % hvp[constants.HV_ROOT_PATH],
1080 hvp[constants.HV_KERNEL_ARGS]]
1081 if hvp[constants.HV_SERIAL_CONSOLE]:
1082 root_append.append("console=ttyS0,38400")
1083 kvm_cmd.extend(["-append", " ".join(root_append)])
1085 mem_path = hvp[constants.HV_MEM_PATH]
1087 kvm_cmd.extend(["-mem-path", mem_path, "-mem-prealloc"])
1089 monitor_dev = ("unix:%s,server,nowait" %
1090 self._InstanceMonitor(instance.name))
1091 kvm_cmd.extend(["-monitor", monitor_dev])
1092 if hvp[constants.HV_SERIAL_CONSOLE]:
1093 serial_dev = ("unix:%s,server,nowait" %
1094 self._InstanceSerial(instance.name))
1095 kvm_cmd.extend(["-serial", serial_dev])
1097 kvm_cmd.extend(["-serial", "none"])
1099 mouse_type = hvp[constants.HV_USB_MOUSE]
1100 vnc_bind_address = hvp[constants.HV_VNC_BIND_ADDRESS]
1101 spice_bind = hvp[constants.HV_KVM_SPICE_BIND]
1102 spice_ip_version = None
1105 kvm_cmd.extend(["-usb"])
1106 kvm_cmd.extend(["-usbdevice", mouse_type])
1107 elif vnc_bind_address:
1108 kvm_cmd.extend(["-usbdevice", constants.HT_MOUSE_TABLET])
1110 if vnc_bind_address:
1111 if netutils.IP4Address.IsValid(vnc_bind_address):
1112 if instance.network_port > constants.VNC_BASE_PORT:
1113 display = instance.network_port - constants.VNC_BASE_PORT
1114 if vnc_bind_address == constants.IP4_ADDRESS_ANY:
1115 vnc_arg = ":%d" % (display)
1117 vnc_arg = "%s:%d" % (vnc_bind_address, display)
1119 logging.error("Network port is not a valid VNC display (%d < %d)."
1120 " Not starting VNC", instance.network_port,
1121 constants.VNC_BASE_PORT)
1124 # Only allow tls and other option when not binding to a file, for now.
1125 # kvm/qemu gets confused otherwise about the filename to use.
1127 if hvp[constants.HV_VNC_TLS]:
1128 vnc_append = "%s,tls" % vnc_append
1129 if hvp[constants.HV_VNC_X509_VERIFY]:
1130 vnc_append = "%s,x509verify=%s" % (vnc_append,
1131 hvp[constants.HV_VNC_X509])
1132 elif hvp[constants.HV_VNC_X509]:
1133 vnc_append = "%s,x509=%s" % (vnc_append,
1134 hvp[constants.HV_VNC_X509])
1135 if hvp[constants.HV_VNC_PASSWORD_FILE]:
1136 vnc_append = "%s,password" % vnc_append
1138 vnc_arg = "%s%s" % (vnc_arg, vnc_append)
1141 vnc_arg = "unix:%s/%s.vnc" % (vnc_bind_address, instance.name)
1143 kvm_cmd.extend(["-vnc", vnc_arg])
1145 # FIXME: this is wrong here; the iface ip address differs
1146 # between systems, so it should be done in _ExecuteKVMRuntime
1147 if netutils.IsValidInterface(spice_bind):
1148 # The user specified a network interface, we have to figure out the IP
1150 addresses = netutils.GetInterfaceIpAddresses(spice_bind)
1151 spice_ip_version = hvp[constants.HV_KVM_SPICE_IP_VERSION]
1153 # if the user specified an IP version and the interface does not
1154 # have that kind of IP addresses, throw an exception
1155 if spice_ip_version != constants.IFACE_NO_IP_VERSION_SPECIFIED:
1156 if not addresses[spice_ip_version]:
1157 raise errors.HypervisorError("spice: unable to get an IPv%s address"
1158 " for %s" % (spice_ip_version,
1161 # the user did not specify an IP version, we have to figure it out
1162 elif (addresses[constants.IP4_VERSION] and
1163 addresses[constants.IP6_VERSION]):
1164 # we have both ipv4 and ipv6, let's use the cluster default IP
1166 cluster_family = ssconf.SimpleStore().GetPrimaryIPFamily()
1167 spice_ip_version = \
1168 netutils.IPAddress.GetVersionFromAddressFamily(cluster_family)
1169 elif addresses[constants.IP4_VERSION]:
1170 spice_ip_version = constants.IP4_VERSION
1171 elif addresses[constants.IP6_VERSION]:
1172 spice_ip_version = constants.IP6_VERSION
1174 raise errors.HypervisorError("spice: unable to get an IP address"
1175 " for %s" % (spice_bind))
1177 spice_address = addresses[spice_ip_version][0]
1180 # spice_bind is known to be a valid IP address, because
1181 # ValidateParameters checked it.
1182 spice_address = spice_bind
1184 spice_arg = "addr=%s" % spice_address
1185 if hvp[constants.HV_KVM_SPICE_USE_TLS]:
1186 spice_arg = "%s,tls-port=%s,x509-cacert-file=%s" % (spice_arg,
1187 instance.network_port, constants.SPICE_CACERT_FILE)
1188 spice_arg = "%s,x509-key-file=%s,x509-cert-file=%s" % (spice_arg,
1189 constants.SPICE_CERT_FILE, constants.SPICE_CERT_FILE)
1190 tls_ciphers = hvp[constants.HV_KVM_SPICE_TLS_CIPHERS]
1192 spice_arg = "%s,tls-ciphers=%s" % (spice_arg, tls_ciphers)
1194 spice_arg = "%s,port=%s" % (spice_arg, instance.network_port)
1196 if not hvp[constants.HV_KVM_SPICE_PASSWORD_FILE]:
1197 spice_arg = "%s,disable-ticketing" % spice_arg
1199 if spice_ip_version:
1200 spice_arg = "%s,ipv%s" % (spice_arg, spice_ip_version)
1202 # Image compression options
1203 img_lossless = hvp[constants.HV_KVM_SPICE_LOSSLESS_IMG_COMPR]
1204 img_jpeg = hvp[constants.HV_KVM_SPICE_JPEG_IMG_COMPR]
1205 img_zlib_glz = hvp[constants.HV_KVM_SPICE_ZLIB_GLZ_IMG_COMPR]
1207 spice_arg = "%s,image-compression=%s" % (spice_arg, img_lossless)
1209 spice_arg = "%s,jpeg-wan-compression=%s" % (spice_arg, img_jpeg)
1211 spice_arg = "%s,zlib-glz-wan-compression=%s" % (spice_arg, img_zlib_glz)
1213 # Video stream detection
1214 video_streaming = hvp[constants.HV_KVM_SPICE_STREAMING_VIDEO_DETECTION]
1216 spice_arg = "%s,streaming-video=%s" % (spice_arg, video_streaming)
1218 # Audio compression, by default in qemu-kvm it is on
1219 if not hvp[constants.HV_KVM_SPICE_AUDIO_COMPR]:
1220 spice_arg = "%s,playback-compression=off" % spice_arg
1221 if not hvp[constants.HV_KVM_SPICE_USE_VDAGENT]:
1222 spice_arg = "%s,agent-mouse=off" % spice_arg
1224 # Enable the spice agent communication channel between the host and the
1226 kvm_cmd.extend(["-device", "virtio-serial-pci"])
1227 kvm_cmd.extend(["-device", "virtserialport,chardev=spicechannel0,"
1228 "name=com.redhat.spice.0"])
1229 kvm_cmd.extend(["-chardev", "spicevmc,id=spicechannel0,name=vdagent"])
1231 logging.info("KVM: SPICE will listen on port %s", instance.network_port)
1232 kvm_cmd.extend(["-spice", spice_arg])
1234 # Tell kvm to use the paravirtualized graphic card, optimized for SPICE
1235 kvm_cmd.extend(["-vga", "qxl"])
1238 kvm_cmd.extend(["-nographic"])
1240 if hvp[constants.HV_USE_LOCALTIME]:
1241 kvm_cmd.extend(["-localtime"])
1243 if hvp[constants.HV_KVM_USE_CHROOT]:
1244 kvm_cmd.extend(["-chroot", self._InstanceChrootDir(instance.name)])
1246 # Save the current instance nics, but defer their expansion as parameters,
1247 # as we'll need to generate executable temp files for them.
1248 kvm_nics = instance.nics
1251 return (kvm_cmd, kvm_nics, hvparams)
1253 def _WriteKVMRuntime(self, instance_name, data):
1254 """Write an instance's KVM runtime
1258 utils.WriteFile(self._InstanceKVMRuntime(instance_name),
1260 except EnvironmentError, err:
1261 raise errors.HypervisorError("Failed to save KVM runtime file: %s" % err)
1263 def _ReadKVMRuntime(self, instance_name):
1264 """Read an instance's KVM runtime
1268 file_content = utils.ReadFile(self._InstanceKVMRuntime(instance_name))
1269 except EnvironmentError, err:
1270 raise errors.HypervisorError("Failed to load KVM runtime file: %s" % err)
1273 def _SaveKVMRuntime(self, instance, kvm_runtime):
1274 """Save an instance's KVM runtime
1277 kvm_cmd, kvm_nics, hvparams = kvm_runtime
1278 serialized_nics = [nic.ToDict() for nic in kvm_nics]
1279 serialized_form = serializer.Dump((kvm_cmd, serialized_nics, hvparams))
1280 self._WriteKVMRuntime(instance.name, serialized_form)
1282 def _LoadKVMRuntime(self, instance, serialized_runtime=None):
1283 """Load an instance's KVM runtime
1286 if not serialized_runtime:
1287 serialized_runtime = self._ReadKVMRuntime(instance.name)
1288 loaded_runtime = serializer.Load(serialized_runtime)
1289 kvm_cmd, serialized_nics, hvparams = loaded_runtime
1290 kvm_nics = [objects.NIC.FromDict(snic) for snic in serialized_nics]
1291 return (kvm_cmd, kvm_nics, hvparams)
1293 def _RunKVMCmd(self, name, kvm_cmd, tap_fds=None):
1294 """Run the KVM cmd and check for errors
1297 @param name: instance name
1298 @type kvm_cmd: list of strings
1299 @param kvm_cmd: runcmd input for kvm
1300 @type tap_fds: list of int
1301 @param tap_fds: fds of tap devices opened by Ganeti
1305 result = utils.RunCmd(kvm_cmd, noclose_fds=tap_fds)
1308 utils_wrapper.CloseFdNoError(fd)
1311 raise errors.HypervisorError("Failed to start instance %s: %s (%s)" %
1312 (name, result.fail_reason, result.output))
1313 if not self._InstancePidAlive(name)[2]:
1314 raise errors.HypervisorError("Failed to start instance %s" % name)
1316 def _ExecuteKVMRuntime(self, instance, kvm_runtime, incoming=None):
1317 """Execute a KVM cmd, after completing it with some last minute data.
1319 @type incoming: tuple of strings
1320 @param incoming: (target_host_ip, port)
1323 # Small _ExecuteKVMRuntime hv parameters programming howto:
1324 # - conf_hvp contains the parameters as configured on ganeti. they might
1325 # have changed since the instance started; only use them if the change
1326 # won't affect the inside of the instance (which hasn't been rebooted).
1327 # - up_hvp contains the parameters as they were when the instance was
1328 # started, plus any new parameter which has been added between ganeti
1329 # versions: it is paramount that those default to a value which won't
1330 # affect the inside of the instance as well.
1331 conf_hvp = instance.hvparams
1332 name = instance.name
1333 self._CheckDown(name)
1337 kvm_cmd, kvm_nics, up_hvp = kvm_runtime
1338 up_hvp = objects.FillDict(conf_hvp, up_hvp)
1340 _, v_major, v_min, _ = self._GetKVMVersion()
1342 # We know it's safe to run as a different user upon migration, so we'll use
1343 # the latest conf, from conf_hvp.
1344 security_model = conf_hvp[constants.HV_SECURITY_MODEL]
1345 if security_model == constants.HT_SM_USER:
1346 kvm_cmd.extend(["-runas", conf_hvp[constants.HV_SECURITY_DOMAIN]])
1348 keymap = conf_hvp[constants.HV_KEYMAP]
1350 keymap_path = self._InstanceKeymapFile(name)
1351 # If a keymap file is specified, KVM won't use its internal defaults. By
1352 # first including the "en-us" layout, an error on loading the actual
1353 # layout (e.g. because it can't be found) won't lead to a non-functional
1354 # keyboard. A keyboard with incorrect keys is still better than none.
1355 utils.WriteFile(keymap_path, data="include en-us\ninclude %s\n" % keymap)
1356 kvm_cmd.extend(["-k", keymap_path])
1358 # We have reasons to believe changing something like the nic driver/type
1359 # upon migration won't exactly fly with the instance kernel, so for nic
1360 # related parameters we'll use up_hvp
1364 kvm_cmd.extend(["-net", "none"])
1368 nic_type = up_hvp[constants.HV_NIC_TYPE]
1369 if nic_type == constants.HT_NIC_PARAVIRTUAL:
1370 # From version 0.12.0, kvm uses a new sintax for network configuration.
1371 if (v_major, v_min) >= (0, 12):
1372 nic_model = "virtio-net-pci"
1375 nic_model = "virtio"
1377 if up_hvp[constants.HV_VHOST_NET]:
1378 # vhost_net is only available from version 0.13.0 or newer
1379 if (v_major, v_min) >= (0, 13):
1380 tap_extra = ",vhost=on"
1382 raise errors.HypervisorError("vhost_net is configured"
1383 " but it is not available")
1385 nic_model = nic_type
1387 for nic_seq, nic in enumerate(kvm_nics):
1388 tapname, tapfd = _OpenTap(vnet_hdr)
1389 tapfds.append(tapfd)
1390 taps.append(tapname)
1391 if (v_major, v_min) >= (0, 12):
1392 nic_val = "%s,mac=%s,netdev=netdev%s" % (nic_model, nic.mac, nic_seq)
1393 tap_val = "type=tap,id=netdev%s,fd=%d%s" % (nic_seq, tapfd, tap_extra)
1394 kvm_cmd.extend(["-netdev", tap_val, "-device", nic_val])
1396 nic_val = "nic,vlan=%s,macaddr=%s,model=%s" % (nic_seq,
1398 tap_val = "tap,vlan=%s,fd=%d" % (nic_seq, tapfd)
1399 kvm_cmd.extend(["-net", tap_val, "-net", nic_val])
1402 target, port = incoming
1403 kvm_cmd.extend(["-incoming", "tcp:%s:%s" % (target, port)])
1405 # Changing the vnc password doesn't bother the guest that much. At most it
1406 # will surprise people who connect to it. Whether positively or negatively
1408 vnc_pwd_file = conf_hvp[constants.HV_VNC_PASSWORD_FILE]
1412 vnc_pwd = utils.ReadOneLineFile(vnc_pwd_file, strict=True)
1413 except EnvironmentError, err:
1414 raise errors.HypervisorError("Failed to open VNC password file %s: %s"
1415 % (vnc_pwd_file, err))
1417 if conf_hvp[constants.HV_KVM_USE_CHROOT]:
1418 utils.EnsureDirs([(self._InstanceChrootDir(name),
1419 constants.SECURE_DIR_MODE)])
1421 # Automatically enable QMP if version is >= 0.14
1422 if (v_major, v_min) >= (0, 14):
1423 logging.debug("Enabling QMP")
1424 kvm_cmd.extend(["-qmp", "unix:%s,server,nowait" %
1425 self._InstanceQmpMonitor(instance.name)])
1427 # Configure the network now for starting instances and bridged interfaces,
1428 # during FinalizeMigration for incoming instances' routed interfaces
1429 for nic_seq, nic in enumerate(kvm_nics):
1431 nic.nicparams[constants.NIC_MODE] != constants.NIC_MODE_BRIDGED):
1433 self._ConfigureNIC(instance, nic_seq, nic, taps[nic_seq])
1435 # CPU affinity requires kvm to start paused, so we set this flag if the
1436 # instance is not already paused and if we are not going to accept a
1437 # migrating instance. In the latter case, pausing is not needed.
1438 start_kvm_paused = not (_KVM_START_PAUSED_FLAG in kvm_cmd) and not incoming
1439 if start_kvm_paused:
1440 kvm_cmd.extend([_KVM_START_PAUSED_FLAG])
1442 # Note: CPU pinning is using up_hvp since changes take effect
1443 # during instance startup anyway, and to avoid problems when soft
1444 # rebooting the instance.
1446 if up_hvp.get(constants.HV_CPU_MASK, None):
1449 if security_model == constants.HT_SM_POOL:
1450 ss = ssconf.SimpleStore()
1451 uid_pool = uidpool.ParseUidPool(ss.GetUidPool(), separator="\n")
1452 all_uids = set(uidpool.ExpandUidPool(uid_pool))
1453 uid = uidpool.RequestUnusedUid(all_uids)
1455 username = pwd.getpwuid(uid.GetUid()).pw_name
1456 kvm_cmd.extend(["-runas", username])
1457 self._RunKVMCmd(name, kvm_cmd, tapfds)
1459 uidpool.ReleaseUid(uid)
1463 utils.WriteFile(self._InstanceUidFile(name), data=uid.AsStr())
1465 self._RunKVMCmd(name, kvm_cmd, tapfds)
1467 utils.EnsureDirs([(self._InstanceNICDir(instance.name),
1468 constants.RUN_DIRS_MODE)])
1469 for nic_seq, tap in enumerate(taps):
1470 utils.WriteFile(self._InstanceNICFile(instance.name, nic_seq),
1474 change_cmd = "change vnc password %s" % vnc_pwd
1475 self._CallMonitorCommand(instance.name, change_cmd)
1477 # Setting SPICE password. We are not vulnerable to malicious passwordless
1478 # connection attempts because SPICE by default does not allow connections
1479 # if neither a password nor the "disable_ticketing" options are specified.
1480 # As soon as we send the password via QMP, that password is a valid ticket
1482 spice_password_file = conf_hvp[constants.HV_KVM_SPICE_PASSWORD_FILE]
1483 if spice_password_file:
1486 spice_pwd = utils.ReadOneLineFile(spice_password_file, strict=True)
1487 except EnvironmentError, err:
1488 raise errors.HypervisorError("Failed to open SPICE password file %s: %s"
1489 % (spice_password_file, err))
1491 qmp = QmpConnection(self._InstanceQmpMonitor(instance.name))
1494 "protocol": "spice",
1495 "password": spice_pwd,
1497 qmp.Execute("set_password", arguments)
1499 for filename in temp_files:
1500 utils.RemoveFile(filename)
1502 # If requested, set CPU affinity and resume instance execution
1504 self._ExecuteCpuAffinity(instance.name, up_hvp[constants.HV_CPU_MASK])
1506 start_memory = self._InstanceStartupMemory(instance)
1507 if start_memory < instance.beparams[constants.BE_MAXMEM]:
1508 self.BalloonInstanceMemory(instance, start_memory)
1510 if start_kvm_paused:
1511 # To control CPU pinning, ballooning, and vnc/spice passwords the VM was
1512 # started in a frozen state. If freezing was not explicitely requested
1513 # resume the vm status.
1514 self._CallMonitorCommand(instance.name, self._CONT_CMD)
1516 def StartInstance(self, instance, block_devices, startup_paused):
1517 """Start an instance.
1520 self._CheckDown(instance.name)
1521 kvm_runtime = self._GenerateKVMRuntime(instance, block_devices,
1523 self._SaveKVMRuntime(instance, kvm_runtime)
1524 self._ExecuteKVMRuntime(instance, kvm_runtime)
1526 def _CallMonitorCommand(self, instance_name, command):
1527 """Invoke a command on the instance monitor.
1530 socat = ("echo %s | %s STDIO UNIX-CONNECT:%s" %
1531 (utils.ShellQuote(command),
1532 constants.SOCAT_PATH,
1533 utils.ShellQuote(self._InstanceMonitor(instance_name))))
1534 result = utils.RunCmd(socat)
1536 msg = ("Failed to send command '%s' to instance %s."
1537 " output: %s, error: %s, fail_reason: %s" %
1538 (command, instance_name,
1539 result.stdout, result.stderr, result.fail_reason))
1540 raise errors.HypervisorError(msg)
1545 def _ParseKVMVersion(cls, text):
1546 """Parse the KVM version from the --help output.
1549 @param text: output of kvm --help
1550 @return: (version, v_maj, v_min, v_rev)
1551 @raise errors.HypervisorError: when the KVM version cannot be retrieved
1554 match = cls._VERSION_RE.search(text.splitlines()[0])
1556 raise errors.HypervisorError("Unable to get KVM version")
1558 v_all = match.group(0)
1559 v_maj = int(match.group(1))
1560 v_min = int(match.group(2))
1562 v_rev = int(match.group(4))
1565 return (v_all, v_maj, v_min, v_rev)
1568 def _GetKVMVersion(cls):
1569 """Return the installed KVM version.
1571 @return: (version, v_maj, v_min, v_rev)
1572 @raise errors.HypervisorError: when the KVM version cannot be retrieved
1575 result = utils.RunCmd([constants.KVM_PATH, "--help"])
1577 raise errors.HypervisorError("Unable to get KVM version")
1578 return cls._ParseKVMVersion(result.output)
1580 def StopInstance(self, instance, force=False, retry=False, name=None):
1581 """Stop an instance.
1584 if name is not None and not force:
1585 raise errors.HypervisorError("Cannot shutdown cleanly by name only")
1587 name = instance.name
1588 acpi = instance.hvparams[constants.HV_ACPI]
1591 _, pid, alive = self._InstancePidAlive(name)
1592 if pid > 0 and alive:
1593 if force or not acpi:
1594 utils.KillProcess(pid)
1596 self._CallMonitorCommand(name, "system_powerdown")
1598 def CleanupInstance(self, instance_name):
1599 """Cleanup after a stopped instance
1602 pidfile, pid, alive = self._InstancePidAlive(instance_name)
1603 if pid > 0 and alive:
1604 raise errors.HypervisorError("Cannot cleanup a live instance")
1605 self._RemoveInstanceRuntimeFiles(pidfile, instance_name)
1607 def RebootInstance(self, instance):
1608 """Reboot an instance.
1611 # For some reason if we do a 'send-key ctrl-alt-delete' to the control
1612 # socket the instance will stop, but now power up again. So we'll resort
1613 # to shutdown and restart.
1614 _, _, alive = self._InstancePidAlive(instance.name)
1616 raise errors.HypervisorError("Failed to reboot instance %s:"
1617 " not running" % instance.name)
1618 # StopInstance will delete the saved KVM runtime so:
1619 # ...first load it...
1620 kvm_runtime = self._LoadKVMRuntime(instance)
1621 # ...now we can safely call StopInstance...
1622 if not self.StopInstance(instance):
1623 self.StopInstance(instance, force=True)
1624 # ...and finally we can save it again, and execute it...
1625 self._SaveKVMRuntime(instance, kvm_runtime)
1626 self._ExecuteKVMRuntime(instance, kvm_runtime)
1628 def MigrationInfo(self, instance):
1629 """Get instance information to perform a migration.
1631 @type instance: L{objects.Instance}
1632 @param instance: instance to be migrated
1634 @return: content of the KVM runtime file
1637 return self._ReadKVMRuntime(instance.name)
1639 def AcceptInstance(self, instance, info, target):
1640 """Prepare to accept an instance.
1642 @type instance: L{objects.Instance}
1643 @param instance: instance to be accepted
1645 @param info: content of the KVM runtime file on the source node
1646 @type target: string
1647 @param target: target host (usually ip), on this node
1650 kvm_runtime = self._LoadKVMRuntime(instance, serialized_runtime=info)
1651 incoming_address = (target, instance.hvparams[constants.HV_MIGRATION_PORT])
1652 self._ExecuteKVMRuntime(instance, kvm_runtime, incoming=incoming_address)
1654 def FinalizeMigrationDst(self, instance, info, success):
1655 """Finalize the instance migration on the target node.
1657 Stop the incoming mode KVM.
1659 @type instance: L{objects.Instance}
1660 @param instance: instance whose migration is being finalized
1664 kvm_runtime = self._LoadKVMRuntime(instance, serialized_runtime=info)
1665 kvm_nics = kvm_runtime[1]
1667 for nic_seq, nic in enumerate(kvm_nics):
1668 if nic.nicparams[constants.NIC_MODE] == constants.NIC_MODE_BRIDGED:
1669 # Bridged interfaces have already been configured
1672 tap = utils.ReadFile(self._InstanceNICFile(instance.name, nic_seq))
1673 except EnvironmentError, err:
1674 logging.warning("Failed to find host interface for %s NIC #%d: %s",
1675 instance.name, nic_seq, str(err))
1678 self._ConfigureNIC(instance, nic_seq, nic, tap)
1679 except errors.HypervisorError, err:
1680 logging.warning(str(err))
1682 self._WriteKVMRuntime(instance.name, info)
1684 self.StopInstance(instance, force=True)
1686 def MigrateInstance(self, instance, target, live):
1687 """Migrate an instance to a target node.
1689 The migration will not be attempted if the instance is not
1692 @type instance: L{objects.Instance}
1693 @param instance: the instance to be migrated
1694 @type target: string
1695 @param target: ip address of the target node
1697 @param live: perform a live migration
1700 instance_name = instance.name
1701 port = instance.hvparams[constants.HV_MIGRATION_PORT]
1702 _, _, alive = self._InstancePidAlive(instance_name)
1704 raise errors.HypervisorError("Instance not running, cannot migrate")
1707 self._CallMonitorCommand(instance_name, "stop")
1709 migrate_command = ("migrate_set_speed %dm" %
1710 instance.hvparams[constants.HV_MIGRATION_BANDWIDTH])
1711 self._CallMonitorCommand(instance_name, migrate_command)
1713 migrate_command = ("migrate_set_downtime %dms" %
1714 instance.hvparams[constants.HV_MIGRATION_DOWNTIME])
1715 self._CallMonitorCommand(instance_name, migrate_command)
1717 migrate_command = "migrate -d tcp:%s:%s" % (target, port)
1718 self._CallMonitorCommand(instance_name, migrate_command)
1720 def FinalizeMigrationSource(self, instance, success, live):
1721 """Finalize the instance migration on the source node.
1723 @type instance: L{objects.Instance}
1724 @param instance: the instance that was migrated
1726 @param success: whether the migration succeeded or not
1728 @param live: whether the user requested a live migration or not
1732 pidfile, pid, _ = self._InstancePidAlive(instance.name)
1733 utils.KillProcess(pid)
1734 self._RemoveInstanceRuntimeFiles(pidfile, instance.name)
1736 self._CallMonitorCommand(instance.name, self._CONT_CMD)
1738 def GetMigrationStatus(self, instance):
1739 """Get the migration status
1741 @type instance: L{objects.Instance}
1742 @param instance: the instance that is being migrated
1743 @rtype: L{objects.MigrationStatus}
1744 @return: the status of the current migration (one of
1745 L{constants.HV_MIGRATION_VALID_STATUSES}), plus any additional
1746 progress info that can be retrieved from the hypervisor
1749 info_command = "info migrate"
1750 for _ in range(self._MIGRATION_INFO_MAX_BAD_ANSWERS):
1751 result = self._CallMonitorCommand(instance.name, info_command)
1752 match = self._MIGRATION_STATUS_RE.search(result.stdout)
1754 if not result.stdout:
1755 logging.info("KVM: empty 'info migrate' result")
1757 logging.warning("KVM: unknown 'info migrate' result: %s",
1760 status = match.group(1)
1761 if status in constants.HV_KVM_MIGRATION_VALID_STATUSES:
1762 migration_status = objects.MigrationStatus(status=status)
1763 match = self._MIGRATION_PROGRESS_RE.search(result.stdout)
1765 migration_status.transferred_ram = match.group("transferred")
1766 migration_status.total_ram = match.group("total")
1768 return migration_status
1770 logging.warning("KVM: unknown migration status '%s'", status)
1772 time.sleep(self._MIGRATION_INFO_RETRY_DELAY)
1774 return objects.MigrationStatus(status=constants.HV_MIGRATION_FAILED,
1775 info="Too many 'info migrate' broken answers")
1777 def BalloonInstanceMemory(self, instance, mem):
1778 """Balloon an instance memory to a certain value.
1780 @type instance: L{objects.Instance}
1781 @param instance: instance to be accepted
1783 @param mem: actual memory size to use for instance runtime
1786 self._CallMonitorCommand(instance.name, "balloon %d" % mem)
1788 def GetNodeInfo(self):
1789 """Return information about the node.
1791 @return: a dict with the following keys (values in MiB):
1792 - memory_total: the total memory size on the node
1793 - memory_free: the available memory on the node for instances
1794 - memory_dom0: the memory used by the node itself, if available
1795 - hv_version: the hypervisor version in the form (major, minor,
1799 result = self.GetLinuxNodeInfo()
1800 _, v_major, v_min, v_rev = self._GetKVMVersion()
1801 result[constants.HV_NODEINFO_KEY_VERSION] = (v_major, v_min, v_rev)
1805 def GetInstanceConsole(cls, instance, hvparams, beparams):
1806 """Return a command for connecting to the console of an instance.
1809 if hvparams[constants.HV_SERIAL_CONSOLE]:
1810 cmd = [constants.KVM_CONSOLE_WRAPPER,
1811 constants.SOCAT_PATH, utils.ShellQuote(instance.name),
1812 utils.ShellQuote(cls._InstanceMonitor(instance.name)),
1813 "STDIO,%s" % cls._SocatUnixConsoleParams(),
1814 "UNIX-CONNECT:%s" % cls._InstanceSerial(instance.name)]
1815 return objects.InstanceConsole(instance=instance.name,
1816 kind=constants.CONS_SSH,
1817 host=instance.primary_node,
1818 user=constants.GANETI_RUNAS,
1821 vnc_bind_address = hvparams[constants.HV_VNC_BIND_ADDRESS]
1822 if vnc_bind_address and instance.network_port > constants.VNC_BASE_PORT:
1823 display = instance.network_port - constants.VNC_BASE_PORT
1824 return objects.InstanceConsole(instance=instance.name,
1825 kind=constants.CONS_VNC,
1826 host=vnc_bind_address,
1827 port=instance.network_port,
1830 spice_bind = hvparams[constants.HV_KVM_SPICE_BIND]
1832 return objects.InstanceConsole(instance=instance.name,
1833 kind=constants.CONS_SPICE,
1835 port=instance.network_port)
1837 return objects.InstanceConsole(instance=instance.name,
1838 kind=constants.CONS_MESSAGE,
1839 message=("No serial shell for instance %s" %
1843 """Verify the hypervisor.
1845 Check that the binary exists.
1848 if not os.path.exists(constants.KVM_PATH):
1849 return "The kvm binary ('%s') does not exist." % constants.KVM_PATH
1850 if not os.path.exists(constants.SOCAT_PATH):
1851 return "The socat binary ('%s') does not exist." % constants.SOCAT_PATH
1854 def CheckParameterSyntax(cls, hvparams):
1855 """Check the given parameters for validity.
1857 @type hvparams: dict
1858 @param hvparams: dictionary with parameter names/value
1859 @raise errors.HypervisorError: when a parameter is not valid
1862 super(KVMHypervisor, cls).CheckParameterSyntax(hvparams)
1864 kernel_path = hvparams[constants.HV_KERNEL_PATH]
1866 if not hvparams[constants.HV_ROOT_PATH]:
1867 raise errors.HypervisorError("Need a root partition for the instance,"
1868 " if a kernel is defined")
1870 if (hvparams[constants.HV_VNC_X509_VERIFY] and
1871 not hvparams[constants.HV_VNC_X509]):
1872 raise errors.HypervisorError("%s must be defined, if %s is" %
1873 (constants.HV_VNC_X509,
1874 constants.HV_VNC_X509_VERIFY))
1876 boot_order = hvparams[constants.HV_BOOT_ORDER]
1877 if (boot_order == constants.HT_BO_CDROM and
1878 not hvparams[constants.HV_CDROM_IMAGE_PATH]):
1879 raise errors.HypervisorError("Cannot boot from cdrom without an"
1882 security_model = hvparams[constants.HV_SECURITY_MODEL]
1883 if security_model == constants.HT_SM_USER:
1884 if not hvparams[constants.HV_SECURITY_DOMAIN]:
1885 raise errors.HypervisorError("A security domain (user to run kvm as)"
1886 " must be specified")
1887 elif (security_model == constants.HT_SM_NONE or
1888 security_model == constants.HT_SM_POOL):
1889 if hvparams[constants.HV_SECURITY_DOMAIN]:
1890 raise errors.HypervisorError("Cannot have a security domain when the"
1891 " security model is 'none' or 'pool'")
1893 spice_bind = hvparams[constants.HV_KVM_SPICE_BIND]
1894 spice_ip_version = hvparams[constants.HV_KVM_SPICE_IP_VERSION]
1896 if spice_ip_version != constants.IFACE_NO_IP_VERSION_SPECIFIED:
1897 # if an IP version is specified, the spice_bind parameter must be an
1899 if (netutils.IP4Address.IsValid(spice_bind) and
1900 spice_ip_version != constants.IP4_VERSION):
1901 raise errors.HypervisorError("spice: got an IPv4 address (%s), but"
1902 " the specified IP version is %s" %
1903 (spice_bind, spice_ip_version))
1905 if (netutils.IP6Address.IsValid(spice_bind) and
1906 spice_ip_version != constants.IP6_VERSION):
1907 raise errors.HypervisorError("spice: got an IPv6 address (%s), but"
1908 " the specified IP version is %s" %
1909 (spice_bind, spice_ip_version))
1911 # All the other SPICE parameters depend on spice_bind being set. Raise an
1912 # error if any of them is set without it.
1913 spice_additional_params = frozenset([
1914 constants.HV_KVM_SPICE_IP_VERSION,
1915 constants.HV_KVM_SPICE_PASSWORD_FILE,
1916 constants.HV_KVM_SPICE_LOSSLESS_IMG_COMPR,
1917 constants.HV_KVM_SPICE_JPEG_IMG_COMPR,
1918 constants.HV_KVM_SPICE_ZLIB_GLZ_IMG_COMPR,
1919 constants.HV_KVM_SPICE_STREAMING_VIDEO_DETECTION,
1920 constants.HV_KVM_SPICE_USE_TLS,
1922 for param in spice_additional_params:
1924 raise errors.HypervisorError("spice: %s requires %s to be set" %
1925 (param, constants.HV_KVM_SPICE_BIND))
1928 def ValidateParameters(cls, hvparams):
1929 """Check the given parameters for validity.
1931 @type hvparams: dict
1932 @param hvparams: dictionary with parameter names/value
1933 @raise errors.HypervisorError: when a parameter is not valid
1936 super(KVMHypervisor, cls).ValidateParameters(hvparams)
1938 security_model = hvparams[constants.HV_SECURITY_MODEL]
1939 if security_model == constants.HT_SM_USER:
1940 username = hvparams[constants.HV_SECURITY_DOMAIN]
1942 pwd.getpwnam(username)
1944 raise errors.HypervisorError("Unknown security domain user %s"
1947 spice_bind = hvparams[constants.HV_KVM_SPICE_BIND]
1949 # only one of VNC and SPICE can be used currently.
1950 if hvparams[constants.HV_VNC_BIND_ADDRESS]:
1951 raise errors.HypervisorError("both SPICE and VNC are configured, but"
1952 " only one of them can be used at a"
1955 # KVM version should be >= 0.14.0
1956 _, v_major, v_min, _ = cls._GetKVMVersion()
1957 if (v_major, v_min) < (0, 14):
1958 raise errors.HypervisorError("spice is configured, but it is not"
1959 " available in versions of KVM < 0.14")
1961 # if spice_bind is not an IP address, it must be a valid interface
1962 bound_to_addr = (netutils.IP4Address.IsValid(spice_bind)
1963 or netutils.IP6Address.IsValid(spice_bind))
1964 if not bound_to_addr and not netutils.IsValidInterface(spice_bind):
1965 raise errors.HypervisorError("spice: the %s parameter must be either"
1966 " a valid IP address or interface name" %
1967 constants.HV_KVM_SPICE_BIND)
1970 def PowercycleNode(cls):
1971 """KVM powercycle, just a wrapper over Linux powercycle.
1974 cls.LinuxPowercycle()