Qemu Networking Investigation - The Yocto Way

qemu provides many options for setting up lots of interesting things and for setting them up in lots of interesting ways. One such set of options allows you to configure how the networking is going to work between the host and the target.

Due to the fact there are so many different ways to do networking with a virtual machine, qemu simply provides the ability to run an "up" script and a "down" script. These scripts, which you can specify, are just hooks which allow you to do some funky networking fu just before qemu starts the image (up) and right after the image terminates (down).

If you do supply these scripts, and something within those scripts requires root privileges (which is most likely the case), then the entire qemu cmdline needs to be run as root. One of the clever things The Yocto Project's qemu scripts do is to not supply these scripts as part of the qemu invocation. It runs them, instead, just before and just after running the qemu command itself.

A "super script" is provided with The Yocto Project which runs the networking "up" script, then runs qemu (with all its options), then runs the networking "down" script. By doing it this way, the "super script" can simply run the up and down scripts with sudo, which gives an opportunity for the user to provide the required password. In this way the qemu image itself isn't run with root privileges, but simply with the privileges of the invoking user (which I assume is a regular, unprivileged user). In this way only the parts which really need root privileges (i.e. the networking up and down scripts) are run with root privileges, everything else is run as a regular user.

The Yocto Project's qemu "super script" is runqemu. runqemu very quickly runs runqemu-internal. It is runqemu-internal which invokes the networking up and down scripts. Within The Yocto Project the networking up script is runqemu-ifup and the networking down script is runqemu-ifdown.

I won't go into all the gory details here (you're welcome to look at The Yocto Project's scripts yourself) but at a high level the up script:

• uses tunctl to setup a new, virtual tap interface
• uses various ifconfig-fu to setup the host's side of the virtual interface as well as manipulate the host's routing tables
• fiddles with the host's firewall to enable NATing for the target

The down script reverses the work of the up script to leave the host as it was before the virtual machine was started.

In order to assign an IP address to the VM, The Yocto Project builds the kernel as a separate entity, invokes qemu specifying the kernel, and provides a kernel cmdline append specifying the IP address to use for the target.

qemu ... --kernel <path/to/kernel> ... --append "ip=192.168.7.$n2::192.168.7.$n1:255.255.255.0"

But what if you have used qemu to install a version of your favourite distribution? In this case the kernel is in the image itself, and doesn't exist outside of it. You could, theoretically, copy the kernel from inside the image to the host, but this gets messy if/when the distribution updates the kernel.

If your kernel is not outside your image then you can't use The Yocto Project's --append trick to specify an IP address for your virtual machine.

You could, during the course of installing and setting up your virtual machine, use your virtual machine distribution's networking tools to configure a static IP, but this means the networking up and down scripts would have to be tailored to match the virtual machine's static settings. This is less flexible.

My solution is to come in my next post.

Qemu Networking Investigation - Introduction

The Yocto Project's qemu integration is quite fascinating. It allows you to build an image targetting a qemu machine, then run it with their runqemu command. Various Yocto magic comes together to run the image under qemu, including getting the networking right so you can access the target from your host.

If all you need to do with a qemu image, networking-wise, is to reach out and do something over tcp (e.g. surf the web, install updates, etc) then qemu's "-net user" mode is more than adequate. One of the great features of the "-net user" mode is that it doesn't require root permissions.

If, however, instead of initiating the connection from inside the image, you want to initiate the connection from (for example) the host to connect to something running on the qemu target (e.g. you want to ssh from your host to the target), then you'll need some more qemu networking magic. As I said, The Yocto Project's qemu-fu fully handles this scenario for you. All you need to do is supply a password for sudo!

However, there are a couple caveats. The networking that The Yocto Project sets up for you supplies a static IP to the image as it is being spun up. This is done by providing a kernel cmdline append providing the IP address to use. Providing a kernel cmdline append can only be done in qemu if the kernel lives outside the image. If you have created your own image which contains its kernel inside the root filesystem, you can't use this trick to assign an IP address.

This post and a number of follow-up posts titled "Qemu Networking Investigation" explore these issues. The first issue is figuring out how to get a qemu image to acquire an IP address without having to assign it statically inside the image itself when you can't assign it with a kernel cmdline append. The second issue is figuring out how to set up the networking so that you can reach services running inside the image.

Knowing these pieces of information are useful if you're using qemu to run, say, openSUSE or if you want to use The Yocto Project's *.vmdk option.

The Yocto Project: Introducing devtool - updates!

Now that The Yocto Project's devtool is in the main trunk, some of the instructions from a previous post need to be updated. Here is a link to the updated instructions, enjoy!

Generating Yocto Documents in openSUSE 13.2

If you want to keep up-to-date with the latest Yocto Project documentation, you should be cloning git://git.yoctoproject.org/yocto-docs.

Once cloned, you can build (for example) a PDF version of the Developer's Manual by:

$ pushd documentation
$ make pdf DOC=ref-manual
$ popd

However, for some reason when I try this on my openSUSE 13.2 system I get:

cd dev-manual; ../tools/poky-docbook-to-pdf dev-manual.xml ../template; cd ..
warning: failed to load external entity "http://docbook.sourceforge.net/release/xsl/current/template/titlepage.xsl"
cannot parse http://docbook.sourceforge.net/release/xsl/current/template/titlepage.xsl

A quick work-around for this is to (temporarily) uninstall the docbook-xsl-stylesheet package:

#  rpm -e --nodeps docbook-xsl-stylesheets

Once done building the Yocto Project documentation simply re-install the package:

# zypper install docbook-xsl-stylesheets

The Yocto Project: Introducing devtool

Paul Eggleton, and a group of his co-workers at the Intel Open Source Technology Centre, have been working on a new tool to help developers and build engineers work better and more efficiently together. Integrating The Yocto Project into a developer's workflow has traditionally been a source of pain, and has held back some projects from adopting The Yocto Project and its tools.

I have written a quick tutorial on this new tool (called devtool) which you can find here. Enjoy!

FSOSS 2014 Report - The 2020 Datacentre

Chris Tyler gave a very thought-provoking and amusing talk at this year's FSOSS entitled The 2020 Datacentre.

For this talk Chris pretended (I think) to be a time traveler who had just returned from the year 2020 and was giving this talk to enlighten us about what had happened to a typical datacentre (and computing in general) during the intervening years.

What made the talk so humourous was how both Chris and the audience (!) stayed "in character" and used the past, present, and future tenses as though Chris really were from 2020. Even when asking questions, audience members would phrase a question as "...at what point did <technology> become cheap..." instead of "...when do you think <technology> will become cheap...".

But for me all of this "staying in character" also made the talk very thought-provoking. It was very interesting to pretend as though someone did live in a time when (as one example) NVDIMMs are ubiquitous. If NVDIMMs are everywhere, do people still use (traditional) hard disks? If not, what do you see when you type "ls"? Do you see files, or memory? How does one see memory as the output of an "ls" command?

Thanks Chris, for a very interesting talk!

FSOSS 2014 Report - Project Management for Open Source Development

I had the pleasure of being able to attend a couple sessions from this year's FSOSS 2014 Symposium. One such session was a presentation by David Zinman titled: Project Management for Open Source Development.

It may seem strange, for some, to put "project management" and "open source development" together in the same sentence. But as more and more companies adopt open source, there will be more interest in adopting traditional management techniques with respect to open source work (maybe not for the open source projects themselves, but certainly for a company's involvement with such projects). In other words: where there are schedules, so shall there be management :-)

David has been working for many years as a project manager at Linaro. Linaro is a company which employes engineers (who develop software in the open) and has adopted an agile project management model with which to manage said engineers. As a consequence, David has much personal experience on which to draw for a presentation such as this.

It seemed to me as though the main point of David's talk is that the success of any project is going to hinge on communication and collaboration; regardless of whether a project is closed or worked on in the open. In addition to presenting his slides, David shared his knowledge with the audience by way of anecdotes and even an exercise to emphasize the points he was making in his talk.

Overall David's talk went very well and there ended up being more questions from the inquisitive audience than could be answered during the session.