We use KVM for virtualisation, but I’m not going to discuss the details here. Like any virtualisation solution, KVM starts a virtual machine and attaches its virtual network hardware to a network interface on the host OS. What I want to discuss is how to implement the networking layer.

I previously wrote about creating a network bridge for Virtualbox virtual machines, and we’re going to do something similar here. However, we want to implement VLAN support and native 802.1q VLAN tagging at the same time.

The design:

• The physical server is connected to the Ethernet switch via a 802.1q VLAN tagged trunk port
• The host OS is aware of the trunk port, and implements several virtual network interfaces. Each virtual interface is associated with one VLAN. Any traffic on that virtual interface exits the physical network interface as tagged VLAN packets.
• The host OS provides a network bridge for each VLAN, and adds the virtual VLAN interface to the bridge.
• The guest OSes (virtual machines) are not VLAN-aware. They have a normal ethernet interface which requires no special configuration.
• The virtualisation software (KVM, in this case) attaches the network interface of the guest OS to the VLAN-specific network bridge.

Warning: changing the Ethernet setup to your server can cause you to lose access to it. At all times during this process, ensure you have console access to the server, and network or console access to the switch.

That said, we’ll try to time the network interruption such that we don’t lose access. First, configure your server for VLAN networking. This guide assumes the server runs Ubuntu 8.04 “Hardy Heron”, but the steps are similar for any recent Ubuntu release. I have no idea how Red Hat handles VLANs and bridging, but I invite you to provide the steps in comments.

This guide also assumes the server is connected to a VLAN unaware (access) port, on VLAN 100, with an existing /etc/network/interfaces like so:

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
	address 192.168.0.2
	netmask 255.255.255.0
	gateway 192.168.0.1

Finally, we assume that virtual machines will be attached to either VLAN 100 (the same as the host OS’s own traffic) or VLAN 200. So we’ll prepare support for both.

Install vlan and bridge support.
apt-get install vlan bridge-utils

Then edit /etc/network/interfaces. Modify the existing network setup to be aware of VLAN 100, and to create a bridge on it.

# The loopback network interface
auto lo
iface lo inet loopback          

# LAN uses VLAN trunking, so set any IP addresses on appropriate bridge
auto eth0
iface eth0 inet manual
	up ifconfig eth0 up

# VLAN 100
auto eth0.100
iface eth0.100 inet manual
	up ifconfig eth0.100 up

# KVM bridge, VLAN 100, via eth0
auto br100
iface br100 inet static
	address 192.168.0.2
	netmask 255.255.255.0
	gateway 192.168.0.1
	bridge_ports eth0.100
	bridge_maxwait 5
	bridge_fd 1
	bridge_stp on

We must bring eth0 up before we can create eth0.100, and we must bring eth0.100 up before we can attach it to the bridge interface. Finally, we must configure the host OS’s IP address on the bridge. If you don’t want to attach virtual machines to VLAN 100, you could configure the IP directly on eth0.100 and leave out the stanza for br100.

Now, apply changes. Because we’re going to move the existing IP from eth0 to br100, the easiest way is to reboot. Alternatively, you may try /etc/init.d/networking restart, but make sure you run this from console so you can fix any problems.

Network interruption begins as soon as you run the above command, or reboot. To restore access to the host OS, we must now configure the Ethernet port on the switch. For Cisco, this is easy. Assuming the server is connected to gigabit Ethernet port 1, run:

configure terminal
interface GigabitEthernet0/1
 switchport mode trunk

You should now be able to ping your server. Once you verify that works, add the configuration for VLAN 200 to /etc/network/interfaces.

# VLAN 200
auto eth0.200
iface eth0.200 inet manual
	up ifconfig eth0.200 up

# KVM bridge, VLAN 200, via eth0
auto br200
iface br200 inet manual
	bridge_ports eth0.200
	bridge_maxwait 5
	bridge_fd 1
	bridge_stp on

VLAN 200 doesn’t need an IP on the host OS, so it lacks the static IP configuration. Configure any additional VLANs the same way.

Now we are ready to attach virtual machines to the new bridges. For KVM, use virt-install to create a machine with 20 GB hard disk, 1 GB of RAM, booting the hardy iso, and attached to VLAN 100.

virt-install --connect qemu:///system -n guestname -r 1024 -f /path/to/virtual/disks/guestname.qcow2 -s 20 -c /path/to/isos/ubuntu-8.04.3-server-i386.iso --vnc --os-type linux --os-variant ubuntuHardy --accelerate --network=bridge:br100

Now use virt-manager to connect to the guest and configure it.

The last step can be replaced with any other virtualisation solution. For instance, with Virtualbox, you can create a VM and then attach it to the bridged interface br100.

Unlike the Virtualbox NAT/routing setup, we don’t need to enable IP forwarding (sysctl -w net.ipv4.ip_forward=1). This method uses layer 2 switching only. However, if you use an iptables firewall, make sure the FORWARD chain of the filter table defaults to “ACCEPT”, or use an equivalent rule matching traffic to/from the virtual bridges.

I waited 4 months after the release of jaunty, so the problems should be either documented or resolved, and the release notes didn’t mention anything that seemed too serious. So I decided to give it a test.

First I made a complete backup with rsync to an external USB2 harddrive (partitioned ext3). I partition my harddrive with separate root (/) and home (/home) partitions, so in the event of a reinstall I don’t have to restore my data from backup. So the second thing I did was to copy /, excluding /home, to /home/root.old/. I’ll keep this backup for a few months so I can compare config files and copy over whatever I’ve forgotten, like udev rules, apache configs, etc. You’d be surprised what stuff you changed in /etc a year ago and then forgot about. Finally, I cloned just the dotfiles in /home/tyler to /home/tyler.old. I expected KDE 4 to mangle all my settings, so just to be safe I kept a backup.

Then I upgraded, following the instructions. When the upgrade was done and I rebooted, everything was totally screwed up. The icon for the KDE menu had become a left-arrow, various hotkeys were remapped, customised application toolbars were screwed up, and the KDE menu hierarchy was a mess. To be fair, I tend to be hard on the menus and toolbars.

OK, log out, remove all the dotfiles in /home/tyler, and log in again. This should give me a default KDE 4 desktop and application environment. I can copy individual dotfiles back later. Nope, icons still borked. I expected this to happen (skipping a release, moving to KDE 4), so I reinstalled 9.04 directly as a fresh install. As usual, I selected manual partitioning, reused and reformatted the root partition, and reused /home without formatting. I also left /home/tyler with no dotfiles, again to make the transition easier.

After the install, things were much better. KDE 4′s desktop (Plasma) was happy, icons were normal, and I didn’t have 16 months of installed cruft all over the /usr/local tree (sometimes I compile from source, typically network hacking tools). I copied back dotfiles for firefox; wireshark; and the kde apps kontact, kmail, kabc, korganizer, kopete, and amarok; and a few others. I avoided copying anything with “event” and “ui” in it, as I wanted to try the new default UI settings.

Since then I’ve enabled the PPA for KDE updates and am now using KDE 4.3 (stock jaunty only offers 4.2.2).

What went wrong:

Intel video is totally borked. Seriously, if you are using Intel video, stay on intrepid or wait for karmic. The warning in the release notes is not worded strongly enough. DO NOT USE JAUNTY AND INTEL VIDEO. I’m using a GM965 chipset, which is partially functional. Google Earth and Kwin compositing don’t get along at all, and all OpenGL and video operations perform significantly worse under jaunty. There are random graphics corruption issues in KDE apps, but mousing over most of them causes them to redraw. Two months to go, and I’m seriously considering the karmic beta. Some help is available, but I’m not willing to add to my problems by running an unsupported kernel.

Kontact/Korganizer pops up an annoying dialog whenever you select a contact with more than one email address. This is a known issue in 4.2.2, and it prompted me to move to 4.3.

Kopete has inexplicably renamed all instances of “MSN Messenger”, including the variables in its rc files, to “WLM Messenger”. So after upgrading from Kopete for KDE 3, enable the “WLM Messenger” plugin, and then change a bunch of things:

1. ~/.kde/share/config/kopeterc, replace all instances of “MSNProtocol” with “WlmProtocol”.
2. ~/.kde/share/apps/kopete/contactlist.xml, replace all instances of “MSNProtocol” with “WlmProtocol”.
3. ~/.kde/share/apps/kopete/, rename directory “msnpictures” to “wlmpictures”
4. (If using the History plugin) ~/.kde/share/apps/kopete/logs/, rename directory “MSNProtocol” to “WlmProtocol”
5. (If using the OTR plugin) ~/.kde/share/apps/kopete_otr/privkeys, replace all instances of “MSN Messenger” with “WLM Messenger”
6. (If using the OTR plugin) ~/.kde/share/apps/kopete_otr/fingerprints, replace all instances of “MSN Messenger” with “WLM Messenger”

I really appreciate all the hard work done by the KDE developers. But I have a very special kick in the nuts for whoever did this. Please, either enable backwards compatibility, or write an upgrade script! If you must change the cosmetic name of an option, do so in the user interface. But don’t arbitrarily change variable and directory names! Some of us have existing configurations that we’d like to have continue working, thank you.

Amarok 2 still has poor iPod support, and crashes frequently. I have joined the hordes that downgraded to Amarok 1.4. I am now much happier. Configuring the iPod in Amarok 1.4 is easy:

1. sudo apt-get install pmount
2. append your iPod devices to /etc/pmount.allow (first and second USB devices for me, just in case I plugin a drive or stick at the same time):

   /dev/sdb1
   /dev/sdb2
   /dev/sdc1
   /dev/sdc2

3. sudo dpkg-statoverride --update --add root root 4755 /usr/bin/eject
4. In Amarok, set iPod pre-connect command to “pmount /dev/disk/by-label/IPODLABEL ipod” where “IPODLABEL” is the filesystem label of your device. You could use /dev/sdb2 here, but that changes if you plug in anything else.
5. In Amarok, set iPod post-disconnect command to “pumount %m; eject /dev/disk/by-label/IPODLABEL”

Step 3 means any normal user can eject devices, which isn’t an issue on desktops. Anybody know what happened to the “kdeeject” command?

apt-get/KPackageKit/Synaptic now install packages in the “Recommended” line by default. This is a really dumb idea, at least until all the mainstream packages are updated. Why do I get exim installed if I just want smartmontools? I would like to be able to check my harddrive temperature without installing a mail server, thank you. Create /etc/apt/apt.conf.d/99no-install-recommends with the contents:

APT::Install-Recommends "false";

Unfortunately, it seems some of the metapackages such as ubuntu-restricted-extras have switched from using “Depends” (the correct behaviour) to “Recommends”. Thanks, guys! Now we’re damned if we do, and damned if we don’t.

kregexpeditor is gone, and no replacement exists. I mourn.

knetworkmanager has been replaced by the abundantly inferior “Network Management” plasmoid. Although you can reinstall it, it doesn’t work with openvpn and its functionality has been reduced (it doesn’t display new connections automatically, for instance. I’ve installed network-manager-gnome and network-manager-openvpn in the interim. However, openvpn won’t work until you edit /etc/dbus-1/system.d/nm-openvpn-service.conf and add the following to the “busconfig” stanza:

<policy user="at_console">
        <allow own="org.freedesktop.NetworkManager.openvpn"/>
        <allow send_destination="org.freedesktop.NetworkManager.openvpn"/>
</policy>

Intel 3945 wireless is unstable. I guess it always was, but knetworkmanager had a habit of restarting the card. Now it’s just screwed. I’ve got a second wireless card, an Atheros AR242x chipset, which I’ve long used for injecting wireless packets to crack WEP networks. That works just fine. I imagine I’ll revisit this issue once I have to upgrade my wife’s laptop, which only has an Intel 3945. Or I’ll buy a £10 Atheros and replace it.

Plasma crashes sometimes. But it restarts immediately, without losing anything. It did this the first time I logged in after a fresh install, which is not a strong selling point for using KDE 4 or Jaunty. If you have issues with this, delete ~/.kde/share/config/plasma-desktop-appletsrc and ~/.kde/share/config/plasma-appletsrc, or edit them and fix geometry lines that cannot fit on your screen or that use floating-point numbers.

What went right:

Suspend and resume work flawlessly. Perhaps this is because I no longer use the Intel wireless card, but I’ve had no problems at all and I’ve resumed at least 30 times since upgrading. This is the first time it has ever been stable on any laptop I use (mostly Dells using Intel or ATI video, and Intel wireless).

KDE 4 is shiny, shiny, shiny. Also a little slower, but that could be the Intel video issue. I love Kwin compositing, especially the exposé-like zooming out by application or by desktop. I hardly use the desktop pager now. The plasmoids (desktop widgets) are great. I see it is going to be hot tomorrow, and that it will rain on Thursday.

New KDE apps are no longer infested with an abundance of the letter K. Rock on, Plasma! Rock on, Dolphin. At last, sanity!

khexedit has been replaced by Okteta. It is better. Install it.

Webcam support on amd64 works better. My webcam used to freeze after 5-10 seconds. Now it works with Cheese and Skype.

The KDE games packages have shiny new Egyptian themes. They look very good, and many have polished new features.

Overall, I’m happy with KDE 4, but I’m not sure the Intel video issues are worth it. I’ll wait for Karmic, and then we’ll really have to evaluate if we are to move to that release internally. Unlike the rest of hardy, the Kubuntu packages go unmaintained this October, so we have little choice if we want to stay with KDE. Which is something we’re considering.

diff root@server1:/etc/randomrcfile root@server2:/etc/randomrcfile

There are ways to do this with Kompare (a KDE diff app) and the fish:// Kioslave, but not on the command line. SSHFS makes it easy:

mkdir /tmp/server1 /tmp/server2
sshfs root@server1:/ /tmp/server1/
sshfs root@server2:/ /tmp/server2/
diff /tmp/server1/etc/randomrcfile /tmp/server2/etc/randomrcfile

I do this so often that I’ve written my own script to handle this for me, smount. Copy it somewhere in your path, and optionally make a copy or symlink called “sumount”. Now you can rapidly mount and unmount multiple hosts.

List hosts:
smount

Mount two hosts:
smount server1 server2

Unmount all hosts:
smount -a

Help:
smount -h

Caution: this script is a dirty hack written in bash script. It assumes that it is free to create /tmp/hostname, and it doesn’t play well on a multi-user workstations (I don’t want to mount in /tmp/tyler@host or something like that). It also assumes that you have root access on your remote machines, so you probably want to use SSH keys.

smount works on Ubuntu hardy. However, I’ve found that the output of “mount” listings for FUSE filesystems changes from release to release. So don’t be surprised if “smount -a” stops working when you upgrade Ubuntu. I’ll try to keep an up-to-date copy here.

If you don’t know what you’re doing with mount or SSHFS, or if you’ve never totally destroyed a filesystem by accident (and are thus extremely cautious about doing it a second time), then DO NOT use this script. No warranty or fitness for purpose is implied. Your mileage may vary. RTFM.

Just download and install the Jaunty versions of sun-java6-bin, sun-java6-jre, sun-java6-fonts, and sun-java6-plugin. Install them, and remove the old icedtea plugin if you have it:

sudo dpkg -i sun-java6-bin_6-13-1_amd64.deb sun-java6-fonts_6-13-1_all.deb sun-java6-jre_6-13-1_all.deb sun-java6-plugin_6-13-1_amd64.deb
sudo apt-get remove --purge icedtea-gcjwebplugin

Then restart Firefox and Sun java will load natively 64-bit. Check it:

tyler@baal:~$ java -version

java version "1.6.0_13"
Java(TM) SE Runtime Environment (build 1.6.0_13-b03)
Java HotSpot(TM) 64-Bit Server VM (build 11.3-b02, mixed mode)

I’ve included them in the repository.

Update 2009-07-16: A more recent version is now available in the hardy-updates repository. I have removed the above copy from my repo. Intrepid users should upgrade to jaunty anyway, but can still download packages directly.

Aside: tolaris.com’s neat new automagically expanding header images look terrible in IE 5/6. I have no intention of fixing this. If you’re reading my site, you probably know better than to use IE for everyday browsing.

In October I recompiled wine from the Hardy source packages with the proposed bug fix. But I never announced it. If you missed that, you can find it in the repository.

I’ve packaged the latest release, 0.10.0, for Ubuntu Hardy amd64 and i386. It is available in my repository now. Source packages are provided, so any other Debian-based distro or architecture should be able to build it.