- Devel - libvirt List Archives

RE: [libvirt] Using Xen config files
by Matthew Donovan 22 Aug '08

22 Aug '08

I'm still having problems with this. I've dug around and found errors in the qemu-dm log. When I try to start the VM with libvirt, the error I'm getting is: "xs_read(/vm/414e73de-cf1e-487c-87e0-d4ebf7a23576/rtc/timeoffset): read error" I did a xenstore-ls on the /vm/414e73de-cf1e-487c-87e0-d4ebf7a23576 directory and sure enough, rtc/timeoffset is not there. When I start the VM with the Xen config file I used to generate the XML the rtc/timeoffset is there (timeoffset is set to "0"). Is there a way to set that in the XML? I didn't see it in the online XML description. I'm using a slightly different XML description than I had originally so I've included here (along with the Xen Config file) Thanks! -matthew const char* foo = "<domain type='xen'>" "<name>LinuxVM</name>" "<uuid>414e73de-cf1e-487c-87e0-d4ebf7a23576</uuid>" "<os>" "<type>hvm</type>" "<loader>/usr/lib/xen/boot/hvmloader</loader>" "<boot dev='hd'/>" "</os>" "<memory>512000</memory>" "<vcpu>1</vcpu>" "<on_shutdown>shutdown</on_shutdown>" "<on_reboot>restart</on_reboot>" "<on_crash>restart</on_crash>" "<features>" "<pae/>" "<acpi/>" "<apic/>" "</features>" "<clock sync='localtime'/>" "<devices>" "<emulator>/usr/lib/xen/bin/qemu-dm</emulator>" "<disk type='block'>" "<source dev='/dev/vgvms/LinuxVM'/>" "<target dev='hda'/>" "</disk>" "<interface type='ioemu'>" "<mac address='7A:AB:D0:01:82:98'/>" "</interface>" "<input type='tablet' bus='usb'/>" "<graphics type='sdl' password=''/>" "<serial type='pty'/>" "</devices>" "</domain>"; //serial = "pty" int main (int argc, char** argv) { virConnectPtr con; /* connection to the Xen hypervisor */ virDomainPtr domain; virInitialize(); con = virConnectOpen ("xen:///"); if (!con) { virErrorPtr err = virGetLastError (); printf ("virConnectOpen failed: %s\n", err->message); return -1; } domain = virDomainDefineXML (con, foo); if (!domain) { virErrorPtr err = virConnGetLastError (con); printf ("virDomainDefineXML failed: %s\n", err->message); } else { if (virDomainCreate (domain) < 0) { virErrorPtr err = virConnGetLastError (con); printf ("virDomainCreate failed: %s\n", err->message); } else { virDomainInfo info = {0}; virDomainGetInfo (domain, &info); printf ("state = %d\n", info.state); getchar (); } } virConnectClose (con); return 0; } # Automatically generated xen config file name = "LinuxVM" builder = "hvm" memory = "500" disk = [ 'phy:/dev/vgvms/LinuxVM,hda,w', ] vif = [ 'type=ioemu, mac=7A:AB:D0:01:82:98', ] uuid = "414e73de-cf1e-487c-87e0-d4ebf7a23576" device_model = "/usr/lib/xen/bin/qemu-dm" kernel = "/usr/lib/xen/boot/hvmloader" vnc=1 vnc=0 sdl=1 stdvga=0 boot="cda" usbdevice="tablet" vncunused=1 apic=1 acpi=1 pae=1 vcpus=1 serial = "pty" on_reboot = 'restart' on_crash = 'restart' > -----Original Message----- > From: Daniel P. Berrange [mailto:berrange@redhat.com] > Sent: Wednesday, August 20, 2008 1:05 PM > To: Richard W.M. Jones > Cc: Matthew Donovan; libvir-list(a)redhat.com > Subject: Re: [libvirt] Using Xen config files > > On Wed, Aug 20, 2008 at 04:44:04PM +0100, Richard W.M. Jones wrote: > > On Wed, Aug 20, 2008 at 11:35:17AM -0400, Matthew Donovan wrote: > > > > It certainly looks OK, and it seems like the domain should run after > > virDomainCreate. Have you tried adding a delay of 30 > seconds just to > > check if the domain is starting up slowly? > > Yep, that debug suggests the libvirt part of creation has > completed OK. > I think if anything is going wrong, its going to be in XenD's > arena. I'd > recommend looking in /var/log/xen for any further hints of trouble > > Daniel > -- > |: Red Hat, Engineering, London -o- > http://people.redhat.com/berrange/ :| > |: http://libvirt.org -o- http://virt-manager.org -o- > http://ovirt.org :| > |: http://autobuild.org -o- > http://search.cpan.org/~danberr/ :| > |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF > F742 7D3B 9505 :| >

2 1

Re: [libvirt] Libvirt Xen daemon interaction in Red Hat Enterprise with virtualization
by vaibhav chugh 21 Aug '08

21 Aug '08

Thanks a lot for the reply. I checked the setting in my config file and they look correct as specified by the webpage. I am able to connect to the unix socket but my login to xend is failing. What I am looking for is the exact function call that is made by libvirt to connect to xen daemon. i.e. the function that makes libvirt send out xml RPC message for xend to read. session.login_with_password() is not supported by xenAPI version being used in Red Hat. Please help me with the substitute of this method in Red Hat. Thanks Vaibhav > > > > On Wed, Aug 20, 2008 at 10:18 AM, Daniel P. Berrange <berrange(a)redhat.com>wrote: > >> On Wed, Aug 20, 2008 at 10:15:49AM -0700, vaibhav chugh wrote: >> > Hi, >> > >> > I am new to libvirt and I am trying to figure out that how libvert >> connects >> > to Xend in Red Hat Enterprise with virtualization. I read a few posts >> but >> > was not able to find this out. >> > >> > The eariler versions of Xen were using xen_session_login_with_password() >> > function call to connect to Xen daemon but I am not able to find >> anything >> > similar to this in libvirt. >> >> Libvirt talks to XenD using its UNIX socket, and SEXPR interface. This >> page gives a quick list of config settings you need in XenD to make it >> work with libvirt: >> >> http://libvirt.org/drvxen.html >> >> Daniel >> -- >> |: Red Hat, Engineering, London -o- >> http://people.redhat.com/berrange/ :| >> |: http://libvirt.org -o- http://virt-manager.org -o- >> http://ovirt.org :| >> |: http://autobuild.org -o- >> http://search.cpan.org/~danberr/ <http://search.cpan.org/%7Edanberr/> :| >> |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 >> :| >> > > > > -- > Vaibhav Chugh >

4 3

[libvirt] Bug: Libvirt java : Connect domainDefineXML shows no effect, listDefinedDomains throws exception
by Thomas Fricke 21 Aug '08

21 Aug '08

Hi everybody in the libvirt java binding the the Connect method domainDefineXML() seems to have no effect. Implementing a full lifecycle junit test for the virtual machine this method does not have any result. Perhaps related: listDefinedDomains shows empty result If at least one domain is running, listDomains show correctly the virtual machine. Anybody going to fix this? Cheers, Thomas

2 1

[libvirt] PATCH: Add libvirt_lxc to specfile
by Daniel P. Berrange 21 Aug '08

21 Aug '08

FYI, just committed this change to fix the broken build last night Daniel Index: libvirt.spec.in =================================================================== RCS file: /data/cvs/libvirt/libvirt.spec.in,v retrieving revision 1.90 diff -u -p -r1.90 libvirt.spec.in --- libvirt.spec.in 20 Aug 2008 13:16:29 -0000 1.90 +++ libvirt.spec.in 21 Aug 2008 08:50:24 -0000 @@ -3,6 +3,8 @@ %define with_xen 1 %define with_xen_proxy 1 %define with_qemu 1 +%define with_openvz 1 +%define with_lxc 1 %define with_polkit 0 # Xen is available only on i386 x86_64 ia64 @@ -152,8 +154,18 @@ of recent versions of Linux (and other O %define _without_qemu --without-qemu %endif +%if ! %{with_openvz} +%define _without_openvz --without-openvz +%endif + +%if ! %{with_lxc} +%define _without_lxc --without-lxc +%endif + %configure %{?_without_xen} \ %{?_without_qemu} \ + %{?_without_openvz} \ + %{?_without_lxc} \ --with-init-script=redhat \ --with-qemud-pid-file=%{_localstatedir}/run/libvirt_qemud.pid \ --with-remote-file=%{_localstatedir}/run/libvirtd.pid @@ -248,6 +260,9 @@ fi %attr(4755, root, root) %{_libexecdir}/libvirt_proxy %endif %attr(0755, root, root) %{_libexecdir}/libvirt_parthelper +%if %{with_openvz} +%attr(0755, root, root) %{_libexecdir}/libvirt_lxc +%endif %attr(0755, root, root) %{_sbindir}/libvirtd %doc docs/*.rng %doc docs/*.xml -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

1 0

[libvirt] virsh/virt-install for dummies
by Jun Koi 21 Aug '08

21 Aug '08

Hi, I am frustrated searching for a quick-start documentation for virsh, just to no avail. Any help is greatly appreciated! Here is what I did: - Compile and install libvirt, virt-manager, virt-install and virt-viewer from source code. This is done (on Ubuntu 8.04). - Now I want to do install a new VM with QEMU or KVM. I got the below error with virt-install: # virt-install -c qemu:///system --name jeos2 --ram 500 --file img.jeos2 --cdrom jeos-8.04.1-jeos-i386.iso Fri, 15 Aug 2008 19:19:10 ERROR virConnectOpen() failed Traceback (most recent call last): File "/usr/bin/virt-install", line 496, in <module> main() File "/usr/bin/virt-install", line 345, in main conn = cli.getConnection(options.connect) File "/usr/lib/python2.5/site-packages/virtinst/cli.py", line 92, in getConnection return libvirt.open(connect) File "/usr/lib/python2.5/site-packages/libvirt.py", line 139, in open if ret is None:raise libvirtError('virConnectOpen() failed') libvirtError: virConnectOpen() failed How to fix this? Perhaps I need to run libvirtd before using virsh??? What frustrates me is that there seems no documentation about this process at libvirt.org at all (?). Final question: I have an old QEMU image. How to "import" it to virsh script? Is there any easy way to do that? Thanks, Jun

4 16

[libvirt] Libvirt Xen daemon interaction in Red Hat Enterprise with virtualization
by vaibhav chugh 20 Aug '08

20 Aug '08

Hi, I am new to libvirt and I am trying to figure out that how libvert connects to Xend in Red Hat Enterprise with virtualization. I read a few posts but was not able to find this out. The eariler versions of Xen were using xen_session_login_with_password() function call to connect to Xen daemon but I am not able to find anything similar to this in libvirt. Please help me with the functions or the area of source code which are being used by libvirt to make the connections. Thanks Vaibhav

2 1

RE: [libvirt] Using Xen config files
by Matthew Donovan 20 Aug '08

20 Aug '08

Thanks for the quick reply! I set the LIBVIRT_DEBUG flag to 1 and ran it again. (The output is below.) One other thing I can think to mention is that I'm using version 0.4.4-2, installed with yum. Maybe I should try compiling and installing from source? Thanks again! -matthew [root@grape ~]$ gcc -g virt_test.c -lvirt && ./a.out DEBUG: libvirt.c: virInitialize (register drivers) DEBUG: xen_internal.c: xenHypervisorInit (Using new hypervisor call: 30001 ) DEBUG: xen_internal.c: xenHypervisorInit (Using hypervisor call v2, sys ver3 dom ver5 ) DEBUG: libvirt.c: virConnectOpen (name=xen:///) DEBUG: libvirt.c: do_open (name "xen:///" to URI components: scheme xen opaque (null) authority (null) server (null) user (null) port 0 path / ) DEBUG: libvirt.c: do_open (trying driver 0 (Test) ...) DEBUG: libvirt.c: do_open (driver 0 Test returned DECLINED) DEBUG: libvirt.c: do_open (trying driver 1 (QEMU) ...) DEBUG: libvirt.c: do_open (driver 1 QEMU returned DECLINED) DEBUG: libvirt.c: do_open (trying driver 2 (Xen) ...) DEBUG: xen_unified.c: xenUnifiedOpen (Trying hypervisor sub-driver) DEBUG: xen_unified.c: xenUnifiedOpen (Activated hypervisor sub-driver) DEBUG: xen_unified.c: xenUnifiedOpen (Trying XenD sub-driver) DEBUG: xen_unified.c: xenUnifiedOpen (Activated XenD sub-driver) DEBUG: xen_unified.c: xenUnifiedOpen (Trying XS sub-driver) DEBUG: xen_unified.c: xenUnifiedOpen (Activated XS sub-driver) DEBUG: libvirt.c: do_open (driver 2 Xen returned SUCCESS) DEBUG: libvirt.c: do_open (network driver 0 Test returned DECLINED) DEBUG: libvirt.c: do_open (network driver 1 QEMU returned DECLINED) DEBUG: remote_internal.c: doRemoteOpen (proceeding with name = xen:///) DEBUG: libvirt.c: do_open (network driver 2 remote returned SUCCESS) DEBUG: libvirt.c: do_open (storage driver 0 Test returned DECLINED) DEBUG: libvirt.c: do_open (storage driver 1 storage returned DECLINED) DEBUG: libvirt.c: do_open (storage driver 2 remote returned SUCCESS) DEBUG: libvirt.c: virDomainDefineXML (conn=0x96fe478, xml=<domain type='xen'><name>fc8.conf</name><os><type>hvm</type><loader>/usr/lib/xen/boo t/hvmloader</loader><boot dev='hd'/></os><memory>1024</memory><vcpu>1</vcpu><on_poweroff>destroy</on_p oweroff><on_reboot>restart</on_reboot><on_crash>restart</on_crash><features> <pae/><acpi/><apic/></features><clock sync="localtime"/><devices><emulator>/usr/lib/xen/bin/qemu-dm</emulator><int erface type='bridge'><source bridge='xenbr0'/><script path='vif-bridge'/></interface><disk type='block'><source dev='/dev/vgvms/fc8'/><target dev='hda'/></disk><disk type='block' device='cdrom'><source dev='/dev/cdrom'/><target dev='hdc'/><readonly/></disk><graphics type='vnc'/></devices></domain>) DEBUG: libvirt.c: virDomainLookupByName (conn=0x96fe478, name=fc8.conf) DEBUG: hash.c: __virGetDomain (New hash entry 0x9702a18) DEBUG: libvirt.c: virDomainCreate (domain=0x9702a18) DEBUG: libvirt.c: virDomainGetInfo (domain=0x9702a18, info=0xbfa2b658) state = 0 DEBUG: libvirt.c: virConnectClose (conn=0x96fe478) DEBUG: hash.c: virUnrefConnect (unref connection 0x96fe478 xen:/// 2) > -----Original Message----- > From: Richard W.M. Jones [mailto:rjones@redhat.com] > Sent: Wednesday, August 20, 2008 9:49 AM > To: Matthew Donovan > Cc: libvir-list(a)redhat.com > Subject: Re: [libvirt] Using Xen config files > > On Wed, Aug 20, 2008 at 08:35:46AM -0400, Matthew Donovan wrote: > > I am trying to programmatically start Xen guest VMs (HVM) > with libvirt (on > > Fedora Core 8) and I'm having some trouble with it. I've > included my code > > below. Essentially, the domain seems to get created > correctly but it > > doesn't seem to run. > > > > I don't receive any error messages from the libvirt > > functions but the VM does not get any CPU time (as shown > with "xm list"). > > > > [root@grape ~]$ xm list > > Name ID Mem VCPUs > State > > Time(s) > > Domain-0 0 1462 2 > r----- > > 1313.5 > > fc8.conf 7 128 1 > ------ > > 0.0 > > > > Can someone explain what I'm doing wrong here? I've tried > to get this > > working with linux and windows guests with the same results. > > That's really strange. Your program looks correct to me (but see my > comment about error handling below). One thing you can do is to run > your program after first setting the environment variable > LIBVIRT_DEBUG=1 which will cause all calls to libvirt to be printed > out. Just to make sure you are actually calling the functions that > you think you are calling. > > > I've seen references on this mailing list to libvirt's > ability to handle Xen > > configuration files but I haven't seen anything in the API > documentation or > > public header files that refer to it. Is there a public > interface to > > specifying a configuration file? > > No there isn't. This ability refers to old versions of Xen which used > /etc/xen. We have a driver that can parse files from here and present > those as inactive ("defined" but not running) domains, eg. when you > do "virsh list". > > For all other uses, use the libvirt XML configuration format. The > advantage is that it will keep working with other types of > virtualization. > > > domain = virDomainDefineXML (con, fedora); > > if (!domain) { > > virErrorPtr err = virGetLastError (); > > printf ("virDomainDefineXML failed: %s\n", > > err->message); > > By the way, this error reporting is wrong. Confusingly there are two > levels of errors stored by virterror, a global error and a > per-connection error. The global error is only used where you don't > have a virConnectPtr object (almost the only time is just after > virConnectOpen fails, when conn == NULL). The rest of the time you > should use virConnGetLastError: > > http://libvirt.org/html/libvirt-virterror.html#virConnGetLastError > > Rich. > > -- > Richard Jones, Emerging Technologies, Red Hat > http://et.redhat.com/~rjones > virt-top is 'top' for virtual machines. Tiny program with many > powerful monitoring features, net stats, disk stats, logging, etc. > http://et.redhat.com/~rjones/virt-top >

3 2

[libvirt] libvirt-java: change org.libvirt.Error implementing Serializable
by Daniel Schwager 20 Aug '08

20 Aug '08

Hi java-api-team (-: could you please let org.libvirt.Error implements the serializable interface ? Exceptions (and the content like org.libvirt.Error) should be serializable. I got an exception on my host system connected via RMI to the client-system running libvirt-java (libvirt-java, cvs-snapshot 2008-08-18) like this: ------------------------------------------------ ... cause:java.rmi.UnmarshalException: Error unmarshaling return; nested exception is: java.io.WriteAbortedException: writing aborted; java.io.NotSerializableException: org.libvirt.Error package org.libvirt; ------------------------------------------------ public class Error { VIR_FROM_NONE, /** * Error at Xen hypervisor layer */ VIR_FROM_XEN, ------------------------------------------------ thank you very much regards Danny ------------------------------------------------------------------- DT Netsolution GmbH - Taläckerstr. 30 - D-70437 Stuttgart Geschäftsführer: Daniel Schwager, Stefan Hörz - HRB Stuttgart 19870 Tel: +49-711-849910-32, Fax: -932 - Mailto:daniel.schwager@dtnet.de

2 3

RE: [libvirt] Using Xen config files
by Matthew Donovan 20 Aug '08

20 Aug '08

Found it! I added serial and console devices to the XML and it appears to be running. It's not working completely as expcted but it's doing more than it was. Thanks for your help. -matthew > -----Original Message----- > From: Richard W.M. Jones [mailto:rjones@redhat.com] > Sent: Wednesday, August 20, 2008 11:44 AM > To: Matthew Donovan > Cc: libvir-list(a)redhat.com > Subject: Re: [libvirt] Using Xen config files > > On Wed, Aug 20, 2008 at 11:35:17AM -0400, Matthew Donovan wrote: > > Thanks for the quick reply! > > > > I set the LIBVIRT_DEBUG flag to 1 and ran it again. (The > output is below.) > [...] > > [root@grape ~]$ gcc -g virt_test.c -lvirt && ./a.out > > DEBUG: libvirt.c: virInitialize (register drivers) > > DEBUG: xen_internal.c: xenHypervisorInit (Using new > hypervisor call: 30001 > > ) > > DEBUG: xen_internal.c: xenHypervisorInit (Using hypervisor > call v2, sys ver3 > > dom ver5 > > ) > > DEBUG: libvirt.c: virConnectOpen (name=xen:///) > > DEBUG: libvirt.c: do_open (name "xen:///" to URI components: > > scheme xen > > opaque (null) > > authority (null) > > server (null) > > user (null) > > port 0 > > path / > > ) > > DEBUG: libvirt.c: do_open (trying driver 0 (Test) ...) > > DEBUG: libvirt.c: do_open (driver 0 Test returned DECLINED) > > DEBUG: libvirt.c: do_open (trying driver 1 (QEMU) ...) > > DEBUG: libvirt.c: do_open (driver 1 QEMU returned DECLINED) > > DEBUG: libvirt.c: do_open (trying driver 2 (Xen) ...) > > DEBUG: xen_unified.c: xenUnifiedOpen (Trying hypervisor sub-driver) > > DEBUG: xen_unified.c: xenUnifiedOpen (Activated hypervisor > sub-driver) > > DEBUG: xen_unified.c: xenUnifiedOpen (Trying XenD sub-driver) > > DEBUG: xen_unified.c: xenUnifiedOpen (Activated XenD sub-driver) > > DEBUG: xen_unified.c: xenUnifiedOpen (Trying XS sub-driver) > > DEBUG: xen_unified.c: xenUnifiedOpen (Activated XS sub-driver) > > DEBUG: libvirt.c: do_open (driver 2 Xen returned SUCCESS) > > DEBUG: libvirt.c: do_open (network driver 0 Test returned DECLINED) > > DEBUG: libvirt.c: do_open (network driver 1 QEMU returned DECLINED) > > DEBUG: remote_internal.c: doRemoteOpen (proceeding with > name = xen:///) > > DEBUG: libvirt.c: do_open (network driver 2 remote returned SUCCESS) > > DEBUG: libvirt.c: do_open (storage driver 0 Test returned DECLINED) > > DEBUG: libvirt.c: do_open (storage driver 1 storage > returned DECLINED) > > DEBUG: libvirt.c: do_open (storage driver 2 remote returned SUCCESS) > > DEBUG: libvirt.c: virDomainDefineXML (conn=0x96fe478, xml=<domain > > > type='xen'><name>fc8.conf</name><os><type>hvm</type><loader>/u > sr/lib/xen/boo > > t/hvmloader</loader><boot > > > dev='hd'/></os><memory>1024</memory><vcpu>1</vcpu><on_poweroff > >destroy</on_p > > > oweroff><on_reboot>restart</on_reboot><on_crash>restart</on_cr > ash><features> > > <pae/><acpi/><apic/></features><clock > > > sync="localtime"/><devices><emulator>/usr/lib/xen/bin/qemu-dm< > /emulator><int > > erface type='bridge'><source bridge='xenbr0'/><script > > path='vif-bridge'/></interface><disk type='block'><source > > dev='/dev/vgvms/fc8'/><target dev='hda'/></disk><disk type='block' > > device='cdrom'><source dev='/dev/cdrom'/><target > > dev='hdc'/><readonly/></disk><graphics > type='vnc'/></devices></domain>) > > DEBUG: libvirt.c: virDomainLookupByName (conn=0x96fe478, > name=fc8.conf) > > DEBUG: hash.c: __virGetDomain (New hash entry 0x9702a18) > > DEBUG: libvirt.c: virDomainCreate (domain=0x9702a18) > > DEBUG: libvirt.c: virDomainGetInfo (domain=0x9702a18, > info=0xbfa2b658) > > state = 0 > > DEBUG: libvirt.c: virConnectClose (conn=0x96fe478) > > DEBUG: hash.c: virUnrefConnect (unref connection 0x96fe478 > xen:/// 2) > > It certainly looks OK, and it seems like the domain should run after > virDomainCreate. Have you tried adding a delay of 30 seconds just to > check if the domain is starting up slowly? > > Dan & Dan, any ideas? > > Rich. > > -- > Richard Jones, Emerging Technologies, Red Hat > http://et.redhat.com/~rjones > virt-df lists disk usage of guests without needing to install any > software inside the virtual machine. Supports Linux and Windows. > http://et.redhat.com/~rjones/virt-df/ >

1 0

[libvirt] networking
by James Bardin 20 Aug '08

20 Aug '08

Hello, I'm having trouble digging up some documentation on libvirt's network config. I'm not sure where to set this up, but I have a bridged device br0 that I would like to have available in virt-manager/virsh. Right now, I can edit the VM's xml interface element manually to use br0. Virt-manager has an option for shared physical device, but it's empty, and I can't figure out how to see it from virsh. thanks -jim

4 8

[libvirt] Using Xen config files
by Matthew Donovan 20 Aug '08

20 Aug '08

I am trying to programmatically start Xen guest VMs (HVM) with libvirt (on Fedora Core 8) and I'm having some trouble with it. I've included my code below. Essentially, the domain seems to get created correctly but it doesn't seem to run. I don't receive any error messages from the libvirt functions but the VM does not get any CPU time (as shown with "xm list"). [root@grape ~]$ xm list Name ID Mem VCPUs State Time(s) Domain-0 0 1462 2 r----- 1313.5 fc8.conf 7 128 1 ------ 0.0 Can someone explain what I'm doing wrong here? I've tried to get this working with linux and windows guests with the same results. I've seen references on this mailing list to libvirt's ability to handle Xen configuration files but I haven't seen anything in the API documentation or public header files that refer to it. Is there a public interface to specifying a configuration file? Thanks -matthew CODE: #include <stdio.h> #include <libvirt/libvirt.h> #include <libvirt/virterror.h> //"" //"<graphics type='vnc' port='5904'/>" const char* fedora = "<domain type='xen'>" "<name>fc8.conf</name>" "<os>" "<type>hvm</type>" "<loader>/usr/lib/xen/boot/hvmloader</loader>" "<boot dev='hd'/>" "</os>" "<memory>1024</memory>" "<vcpu>1</vcpu>" "<on_poweroff>destroy</on_poweroff>" "<on_reboot>restart</on_reboot>" "<on_crash>restart</on_crash>" "<features>" "<pae/>" "<acpi/>" "<apic/>" "</features>" "<clock sync=\"localtime\"/>" "<devices>" "<emulator>/usr/lib/xen/bin/qemu-dm</emulator>" "<interface type='bridge'>" "<source bridge='xenbr0'/>" "<script path='vif-bridge'/>" "</interface>" "<disk type='block'>" "<source dev='/dev/vgvms/fc8'/>" "<target dev='hda'/>" "</disk>" "<disk type='block' device='cdrom'>" "<source dev='/dev/cdrom'/>" "<target dev='hdc'/>" "<readonly/>" "</disk>" "<graphics type='vnc'/>" "</devices>" "</domain>"; int main (int argc, char** argv) { virConnectPtr con; /* connection to the Xen hypervisor */ virDomainPtr domain; virInitialize(); con = virConnectOpen ("xen:///"); if (!con) { virErrorPtr err = virGetLastError (); printf ("virConnectOpen failed: %s\n", err->message); return -1; } domain = virDomainDefineXML (con, fedora); if (!domain) { virErrorPtr err = virGetLastError (); printf ("virDomainDefineXML failed: %s\n", err->message); } else { if (virDomainCreate (domain) < 0) { virErrorPtr err = virGetLastError (); printf ("virDomainCreate failed: %s\n", err->message); } else { virDomainInfo info = {0}; virDomainGetInfo (domain, &info); printf ("state = %d\n", info.state); } } virConnectClose (con); return 0; }

2 1

[libvirt] [PATCH] manage number of virtual CPUs
by Evgeniy Sokolov 20 Aug '08

20 Aug '08

OpenVZ containers use all CPUs available in system by default. Limitations may be caused only by Linux kernel limitation. There is way to artificially limit number of CPUs. patch add cpu management functionality to OpenVZ driver.

3 3

[libvirt] [PATCH] Ignore specified target path when creating logical vol
by Cole Robinson 20 Aug '08

20 Aug '08

Specifying a target path when creating a storage volume has no effect, since volumes only really use the pool's target path and 'name' field to establish the volume's target. Logical volumes expect a target path to be passed, and it can only cause problems. The attached patch erases the passed target volume and fills it in with the one generated from the create operation. Thanks, Cole

3 2

[libvirt] [PATCH] Fix size reporting for disk pools without partitions
by Cole Robinson 20 Aug '08

20 Aug '08

The attached patch updates parthelper to print size information for a disk device if it doesn't have any allocated partitions. The current code starts by requesting the first partition, then iterating from there. But if there is no first partition, that whole info reporting thing never happens :) Seems to produce desired results for partitioned and unpartitioned devices. Thanks, Cole

3 2

[libvirt] Question about html file in docs
by Atsushi SAKAI 20 Aug '08

20 Aug '08

Hi, I think html files in docs directory are redundunt. It is because html file is created by html.in. May I remove these files? Or are there any reason about staying these files? Thanks Atsushi SAKAI

4 10

[libvirt] qemud/.libs/libvirtd?
by Jun Koi 20 Aug '08

20 Aug '08

Hi, I added some new code to libvirt.c, and recompile. However, when "make install". qemud/.libs/libvirtd is installed but not qemud/libvirtd. Why? Looks like a bug? The problem is that qemud/libvirtd has my new code, but not qemud/.libs/libvirtd! So "make install" installs the old binary, which I dont know where it is from. (Perhaps from the first compilation?) I am not familiar with the autoconf Makefile, and cannot figure it out why it is working this way. Many thanks, Jun

4 7

[libvirt] On shutdown Destroy/Delete
by Stefan de Konink 20 Aug '08

20 Aug '08

Hi, I would really like to know how I can make a defined domain *gone* after shutdown :) (instead of it still be defined, after shutdown) Stefan

4 5

[libvirt] Use existing QEMU image with libvirt?
by Jun Koi 19 Aug '08

19 Aug '08

Hi, I have some existing QEMU images. Now I want to use it with libvirt/virsh. Is there any easy way to do that? I suppose that we need an XML file for each image, but dont want to craft them from scratch. Thanks, Jun

2 1

[libvirt] PATCH: Improve some remote driver error messages
by Daniel P. Berrange 19 Aug '08

19 Aug '08

Bug reports from users have shown diagnosing problems with the remote driver are quite tricky, so I've been looking at improving its error messages where possible. There's a number of places where we simply pass in strerror(errno) as the only data in virRaiseError. This doesn't let us narrow down just which call failed - we just get a generic message "Permission denied" or "Connection refused" with no clue what was being tried. This patch adds descriptive error messages whereever possible, fixes a place where we'd report an error to connect to IPv4 even if IPv6 succeeded, and adds some missing translations Before $ virsh --connect qemu:///system libvir: Remote error : Permission denied $ virsh --connect qemu+tcp:///system libvir: Remote error : Connection refused $ virsh --connect qemu+tcp://wibble/system libvir: Remote error : invalid argument in Name or service not known After $ ./src/virsh --connect qemu:///system libvir: Remote error : unable to connect to '/var/run/libvirt/libvirt-sock': Permission denied $ ./src/virsh --connect qemu+tcp:///system libvir: Remote error : unable to connect to 'localhost': Connection refused $ ./src/virsh --connect qemu+tcp://wibble/system libvir: Remote error : unable to resolve hostname 'wibble': Name or service not known Daniel Index: src/remote_internal.c =================================================================== RCS file: /data/cvs/libvirt/src/remote_internal.c,v retrieving revision 1.80 diff -u -r1.80 remote_internal.c --- src/remote_internal.c 26 Jun 2008 09:37:51 -0000 1.80 +++ src/remote_internal.c 19 Aug 2008 10:36:32 -0000 @@ -371,13 +371,12 @@ priv->hostname = strdup (uri->server ? uri->server : "localhost"); - if (!priv->hostname) { - error (NULL, VIR_ERR_NO_MEMORY, _("allocating priv->hostname")); - goto failed; - } + if (!priv->hostname) + goto out_of_memory; if (uri->user) { username = strdup (uri->user); - if (!username) goto out_of_memory; + if (!username) + goto out_of_memory; } /* Get the variables from the query string. @@ -491,12 +490,15 @@ // http://people.redhat.com/drepper/userapi-ipv6.html struct addrinfo *res, *r; struct addrinfo hints; + int saved_errno = EINVAL; memset (&hints, 0, sizeof hints); hints.ai_socktype = SOCK_STREAM; hints.ai_flags = AI_ADDRCONFIG; int e = getaddrinfo (priv->hostname, port, &hints, &res); if (e != 0) { - error (conn, VIR_ERR_INVALID_ARG, gai_strerror (e)); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("unable to resolve hostname '%s': %s"), + priv->hostname, gai_strerror (e)); goto failed; } @@ -516,7 +518,7 @@ priv->sock = socket (r->ai_family, SOCK_STREAM, 0); if (priv->sock == -1) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (socket_errno ())); + saved_errno = socket_errno(); continue; } @@ -526,7 +528,7 @@ sizeof no_slow_start); if (connect (priv->sock, r->ai_addr, r->ai_addrlen) == -1) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (socket_errno ())); + saved_errno = socket_errno(); close (priv->sock); continue; } @@ -545,6 +547,9 @@ } freeaddrinfo (res); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("unable to connect to '%s': %s"), + priv->hostname, strerror (saved_errno)); goto failed; tcp_connected: @@ -563,23 +568,23 @@ uid_t uid = getuid(); if (!(pw = getpwuid(uid))) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("unable to lookup user '%d': %s"), + uid, strerror (errno)); goto failed; } if (asprintf (&sockname, "@%s" LIBVIRTD_USER_UNIX_SOCKET, pw->pw_dir) < 0) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); - goto failed; + sockname = NULL; + goto out_of_memory; } } else { if (flags & VIR_DRV_OPEN_REMOTE_RO) sockname = strdup (LIBVIRTD_PRIV_UNIX_SOCKET_RO); else sockname = strdup (LIBVIRTD_PRIV_UNIX_SOCKET); - if (sockname == NULL) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); - goto failed; - } + if (sockname == NULL) + goto out_of_memory; } } @@ -598,7 +603,9 @@ autostart_retry: priv->sock = socket (AF_UNIX, SOCK_STREAM, 0); if (priv->sock == -1) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("unable to create socket %s"), + strerror (errno)); goto failed; } if (connect (priv->sock, (struct sockaddr *) &addr, sizeof addr) == -1) { @@ -620,7 +627,9 @@ goto autostart_retry; } } - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("unable to connect to '%s': %s"), + sockname, strerror (errno)); goto failed; } @@ -634,17 +643,13 @@ if (no_tty) nr_args += 5; /* For -T -o BatchMode=yes -e none */ command = command ? : strdup ("ssh"); - if (command == NULL) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); - goto failed; - } + if (command == NULL) + goto out_of_memory; // Generate the final command argv[] array. // ssh -p $port [-l $username] $hostname $netcat -U $sockname [NULL] - if (VIR_ALLOC_N(cmd_argv, nr_args) < 0) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); - goto failed; - } + if (VIR_ALLOC_N(cmd_argv, nr_args) < 0) + goto out_of_memory; j = 0; cmd_argv[j++] = strdup (command); @@ -667,12 +672,9 @@ cmd_argv[j++] = strdup (sockname ? sockname : LIBVIRTD_PRIV_UNIX_SOCKET); cmd_argv[j++] = 0; assert (j == nr_args); - for (j = 0; j < (nr_args-1); j++) { - if (cmd_argv[j] == NULL) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (ENOMEM)); - goto failed; - } - } + for (j = 0; j < (nr_args-1); j++) + if (cmd_argv[j] == NULL) + goto out_of_memory; } /*FALLTHROUGH*/ @@ -685,28 +687,38 @@ * to faff around with two file descriptors (a la 'pipe(2)'). */ if (socketpair (PF_UNIX, SOCK_STREAM, 0, sv) == -1) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("unable to create socket pair %s"), + strerror (errno)); goto failed; } pid = fork (); if (pid == -1) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("unable to fork external network transport: %s"), + strerror (errno)); goto failed; } else if (pid == 0) { /* Child. */ close (sv[0]); // Connect socket (sv[1]) to stdin/stdout. close (0); - if (dup (sv[1]) == -1) perror ("dup"); + if (dup (sv[1]) == -1) { + perror ("dup"); + _exit(1); + } close (1); - if (dup (sv[1]) == -1) perror ("dup"); + if (dup (sv[1]) == -1) { + perror ("dup"); + _exit(1); + } close (sv[1]); // Run the external process. if (!cmd_argv) { if (VIR_ALLOC_N(cmd_argv, 2) < 0) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); - goto failed; + perror("malloc"); + _exit(1); } cmd_argv[0] = command; cmd_argv[1] = 0; @@ -770,7 +782,7 @@ return retcode; out_of_memory: - error (NULL, VIR_ERR_NO_MEMORY, _("uri params")); + error (conn, VIR_ERR_NO_MEMORY, NULL); failed: /* Close the socket if we failed. */ @@ -882,10 +894,9 @@ { struct stat sb; if (stat(file, &sb) < 0) { - __virRaiseError (conn, NULL, NULL, VIR_FROM_REMOTE, VIR_ERR_RPC, - VIR_ERR_ERROR, LIBVIRT_CACERT, NULL, NULL, 0, 0, - _("Cannot access %s '%s': %s (%d)"), - type, file, strerror(errno), errno); + errorf(conn, VIR_ERR_RPC, + _("Cannot access %s '%s': %s (%d)"), + type, file, strerror(errno), errno); return -1; } return 0; @@ -905,7 +916,9 @@ /* X509 stuff */ err = gnutls_certificate_allocate_credentials (&x509_cred); if (err) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to allocate TLS credentials: %s"), + gnutls_strerror (err)); return -1; } @@ -923,7 +936,9 @@ gnutls_certificate_set_x509_trust_file (x509_cred, LIBVIRT_CACERT, GNUTLS_X509_FMT_PEM); if (err < 0) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to load CA certificate: %s"), + gnutls_strerror (err)); return -1; } @@ -936,7 +951,9 @@ LIBVIRT_CLIENTKEY, GNUTLS_X509_FMT_PEM); if (err < 0) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to load private key/certificate: %s"), + gnutls_strerror (err)); return -1; } @@ -963,21 +980,27 @@ */ err = gnutls_init (&session, GNUTLS_CLIENT); if (err) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to initialize TLS client: %s"), + gnutls_strerror (err)); return NULL; } /* Use default priorities */ err = gnutls_set_default_priority (session); if (err) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to set TLS algorithm priority: %s"), + gnutls_strerror (err)); return NULL; } err = gnutls_certificate_type_set_priority (session, cert_type_priority); if (err) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to set certificate priority: %s"), + gnutls_strerror (err)); return NULL; } @@ -985,7 +1008,9 @@ */ err = gnutls_credentials_set (session, GNUTLS_CRD_CERTIFICATE, x509_cred); if (err) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to set session credentials: %s"), + gnutls_strerror (err)); return NULL; } @@ -998,7 +1023,9 @@ if (err < 0) { if (err == GNUTLS_E_AGAIN || err == GNUTLS_E_INTERRUPTED) goto again; - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (err)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to complete TLS handshake: %s"), + gnutls_strerror (err)); return NULL; } @@ -1018,12 +1045,14 @@ if (len < 0 && len != GNUTLS_E_UNEXPECTED_PACKET_LENGTH) { if (len == GNUTLS_E_AGAIN || len == GNUTLS_E_INTERRUPTED) goto again_2; - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (len)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to complete TLS initialization: %s"), + gnutls_strerror (len)); return NULL; } if (len != 1 || buf[0] != '\1') { error (conn, VIR_ERR_RPC, - _("server verification (of our certificate or IP address) failed\n")); + _("server verification (of our certificate or IP address) failed\n")); return NULL; } @@ -1047,33 +1076,39 @@ time_t now; if ((ret = gnutls_certificate_verify_peers2 (session, &status)) < 0) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (ret)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to verify server certificate: %s"), + gnutls_strerror (ret)); return -1; } if ((now = time(NULL)) == ((time_t)-1)) { - error (conn, VIR_ERR_SYSTEM_ERROR, strerror (errno)); + errorf (conn, VIR_ERR_SYSTEM_ERROR, + _("cannot get current time: %s"), + strerror (errno)); return -1; } if (status != 0) { - const char *reason = "Invalid certificate"; + const char *reason = _("Invalid certificate"); if (status & GNUTLS_CERT_INVALID) - reason = "The certificate is not trusted."; + reason = _("The certificate is not trusted."); if (status & GNUTLS_CERT_SIGNER_NOT_FOUND) - reason = "The certificate hasn't got a known issuer."; + reason = _("The certificate hasn't got a known issuer."); if (status & GNUTLS_CERT_REVOKED) - reason = "The certificate has been revoked."; + reason = _("The certificate has been revoked."); #ifndef GNUTLS_1_0_COMPAT if (status & GNUTLS_CERT_INSECURE_ALGORITHM) - reason = "The certificate uses an insecure algorithm"; + reason = _("The certificate uses an insecure algorithm"); #endif - error (conn, VIR_ERR_RPC, reason); + errorf (conn, VIR_ERR_RPC, + _("server certificate failed validation: %s"), + reason); return -1; } @@ -1092,13 +1127,17 @@ ret = gnutls_x509_crt_init (&cert); if (ret < 0) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (ret)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to initialize certificate: %s"), + gnutls_strerror (ret)); return -1; } ret = gnutls_x509_crt_import (cert, &certs[i], GNUTLS_X509_FMT_DER); if (ret < 0) { - error (conn, VIR_ERR_GNUTLS_ERROR, gnutls_strerror (ret)); + errorf (conn, VIR_ERR_GNUTLS_ERROR, + _("unable to import certificate: %s"), + gnutls_strerror (ret)); gnutls_x509_crt_deinit (cert); return -1; } @@ -1117,13 +1156,9 @@ if (i == 0) { if (!gnutls_x509_crt_check_hostname (cert, priv->hostname)) { - __virRaiseError - (conn, NULL, NULL, - VIR_FROM_REMOTE, VIR_ERR_RPC, - VIR_ERR_ERROR, priv->hostname, NULL, NULL, - 0, 0, - _("Certificate's owner does not match the hostname (%s)"), - priv->hostname); + errorf(conn, VIR_ERR_RPC, + _("Certificate's owner does not match the hostname (%s)"), + priv->hostname); gnutls_x509_crt_deinit (cert); return -1; } @@ -4721,8 +4756,9 @@ errmsg = __virErrorMsg (code, errorMessage); __virRaiseError (conn, NULL, NULL, VIR_FROM_REMOTE, - code, VIR_ERR_ERROR, NULL, NULL, NULL, 0, 0, - "%s", errmsg); + code, VIR_ERR_ERROR, + errmsg, errorMessage, NULL, -1, -1, + errmsg, errorMessage); } /* For errors generated on the server side and sent back to us. */ -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

3 2

[libvirt] PATCH: Ensure errors are guarenteed reported in virConnectOpen
by Daniel P. Berrange 19 Aug '08

19 Aug '08

The virConnectOpen method is unfortuantely rather special. While there is a virConnect object available, the current rule is that drivers must report errors against the global error object, because upon failure no virConnect object will be returned to the caller. Unforatunately, despite frequent cleanups of code getting this wrong, I've just audited the remote driver and found another 20 or so places where its wrong. This is clearly not a sustainable approach to error reporting. The guarenteed correct solution is actually rather simple - Always report errors against the virConnect object, even in the driver open method - In the cleanup patch of do_open() in libvirt.c, if no global error is set, copy the error from the virConnect object's virError, into the global virError. With this in place we can change all the drivers back to always report against the error object, and thus cleanup some disgusting code like __virRaiseError (in_open ? NULL : conn, ... To just __virRaiseError (conn, ... Daniel Index: src/libvirt.c =================================================================== RCS file: /data/cvs/libvirt/src/libvirt.c,v retrieving revision 1.151 diff -u -r1.151 libvirt.c --- src/libvirt.c 18 Aug 2008 09:24:46 -0000 1.151 +++ src/libvirt.c 19 Aug 2008 10:29:51 -0000 @@ -735,10 +735,8 @@ name = "xen:///"; ret = virGetConnect(); - if (ret == NULL) { - virLibConnError(NULL, VIR_ERR_NO_MEMORY, _("allocating connection")); + if (ret == NULL) return NULL; - } uri = xmlParseURI (name); if (!uri) { @@ -839,7 +837,21 @@ failed: if (ret->driver) ret->driver->close (ret); if (uri) xmlFreeURI(uri); - virUnrefConnect(ret); + + /* If not global error was set, copy any error set + in the connection object we're about to dispose of */ + if (__lastErr.code == VIR_ERR_OK) { + memcpy(&__lastErr, &ret->err, sizeof(ret->err)); + memset(&ret->err, 0, sizeof(ret->err)); + } + + /* Still no error set, then raise a generic error */ + if (__lastErr.code == VIR_ERR_OK) + virLibConnError (NULL, VIR_ERR_INTERNAL_ERROR, + _("unable to open connection")); + + virUnrefConnect(ret); + return NULL; } -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

4 9

[libvirt] Libvirt XML description
by Dimitrios Kalogeras 19 Aug '08

19 Aug '08

Hi to all of you, I am trying to gather knowledge about the XML DTD of libvirt bu the http://libvirt.org/format.html does not provide any useful info. Can you point me somewhere else ? Cheers, Dimitris -- -- Dimitrios K. Kalogeras Electrical Engineer, Ph.D. Network Engineer NTUA/GR-Net Network Management Center _____________________________________ icq: 11887484 voice: +30-210-772 1863 fax: +30-210-772 1866 e-mail: D.Kalogeras(a)noc.ntua.gr pub 1024D/0E421B50 2007-01-17 [expires: 2008-01-17] Dimitrios Kalogeras (dkalo) <D.Kalogeras(a)noc.ntua.gr> Key fingerprint = F8C8 7B67 74A4 1F82 CDDF 8554 E1EF 7FAE 0E42 1B50 PGP-KEY: http://ajax.noc.ntua.gr/~dkalo/dkalo_pgp.txt

5 5

[libvirt] fail to connect via ssh
by MINAI Katsuhito 19 Aug '08

19 Aug '08

Hi all, I have built libvirt by http://libvirt.org/sources/libvirt-0.4.4.tar.gz on fedora 9 as follows. $ tar zxf libvirt-cvs-snapshot.tar.gz $ cd libvirt-0.4.4 $ ./configure --without-xen $ make However, virsh failed to connect via SSH to remote server. How can I fix the problem? $ ./src/virsh -c xen+ssh://root@server list root@server's password: libvir: Remote error : socket closed unexpectedly error: failed to connect to the hypervisor Thanks, Minai

1 1

[libvirt] [patch] remove duplicate call of virInitialize()
by Nguyen Anh Quynh 18 Aug '08

18 Aug '08

Hi, This patch removes the redundant call to virInitialize() inside __virStateInitialize(). Thanks, Quynh

2 1

[libvirt] virt-install and custom distros
by Kay Williams 15 Aug '08

15 Aug '08

We have an application that builds custom distributions based on RHEL, CentOS or Fedora. We would like to install these over the network using virt-install, but we've run into an issue with the distro check logic. Specifically, virt-install fails unless it finds a string "Red Hat Enterprise Linux", "Fedora" or "CentOS" within the family field of the .treeinfo file. Our application currently sets the family field to the user-provided distro name (see below). We have avoided using the base distro name given trademark concerns. [general] family = <user provided value> variant = <user provided value> We can get virt-install to pass the distro check by setting the family name to one of the accepted values, e.g. [general] family = Fedora variant = [user provided distro name] Is this the expected/desired use for the family and variant fields? Or is there another approach we should consider? Thanks, Kay

2 1

[libvirt] [PATCH] Fix serial console telnet protocol support
by Mark McLoughlin 15 Aug '08

15 Aug '08

With e.g.: <serial type='tcp'> <source mode='bind' host='127.0.0.1' service='4444'/> <protocol type='telnet'/> <target port='0'/> </serial> You currently get: Unknown option: listen qemu: could not open serial device 'telnet:127.0.0.1:4444,listen' With the telnet protocol, qemu expects "server" as an option rather than "listen". Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/qemu_conf.c =================================================================== --- libvirt.orig/src/qemu_conf.c 2008-08-13 18:14:34.000000000 +0100 +++ libvirt/src/qemu_conf.c 2008-08-13 18:35:20.000000000 +0100 @@ -685,12 +685,19 @@ break; case VIR_DOMAIN_CHR_TYPE_TCP: - if (snprintf(buf, buflen, "%s:%s:%s%s", - dev->data.tcp.protocol == VIR_DOMAIN_CHR_TCP_PROTOCOL_TELNET ? "telnet" : "tcp", - dev->data.tcp.host, - dev->data.tcp.service, - dev->data.tcp.listen ? ",listen" : "") >= buflen) - return -1; + if (dev->data.tcp.protocol == VIR_DOMAIN_CHR_TCP_PROTOCOL_TELNET) { + if (snprintf(buf, buflen, "telnet:%s:%s%s", + dev->data.tcp.host, + dev->data.tcp.service, + dev->data.tcp.listen ? ",server" : "") >= buflen) + return -1; + } else { + if (snprintf(buf, buflen, "tcp:%s:%s%s", + dev->data.tcp.host, + dev->data.tcp.service, + dev->data.tcp.listen ? ",listen" : "") >= buflen) + return -1; + } break; case VIR_DOMAIN_CHR_TYPE_UNIX:

3 4

[libvirt] [ANNOUNCE][RFC] sVirt: Integrating SELinux and Linux-based virtualization
by James Morris 15 Aug '08

15 Aug '08

This is to announce the formation of the sVirt project, which aims to integrate SELinux and Linux-based virtualization (KVM et al). The idea has been discussed a few times over the last year or so, and in recent weeks, a few Fedora folk (such as Dan Walsh, Daniel Berrange and myself) have put together some requirements and had some preliminary technical discussions. The requirements document and initital technical considerations are included below inline for review and discussion. In a nutshell, we'd like to be able to apply distinct security labels to individual VM instances and their resources, so that they can be isolated from each other via MAC policy. We want this to "just work" when configuring and managing VMs via the libvirt toolchain, e.g. provide a simple option during VM creation to make the VM "isolated", and have the toolchain do all the labeling and policy configuration behind the scenes. Greater detail may be found in the requirements document. If you wish to contribute, please reply to this email with any enhancements to the requirements, technical ideas, issues etc. I'd suggest joining the libvir-list (in the to: line) if not already on it, as that is where the integration work is expected to happen. There's also a wiki page: http://selinuxproject.org/page/SVirt ------------------------------------------------------------------------ 11 Aug 2008 sVirt: Integration of SELinux and Linux-based Virtualization Requirements and Design Considerations v1.0 1. Introduction This document establishes a set of functional and technical requirements for integrating SELinux with Linux-based virtualization (i.e. Linux-as-hypervisor schemes such as KVM/Qemu amd lguest). Note that non-Linux hypervisor models such as Xen are not covered explicitly in this document, although may be afforded some MAC coverage due to shared infrastructure (e.g. libvirt). Non-Linux hypervisor models may considered further at a later stage. Also, while this document focuses on SELinux as the MAC scheme, consideration should be given to ensuring support for other label-based MAC schemes. 1.1 Rationale With increased use of virtualization, one security benefit of physically separated systems -- strong isolation -- is reduced, an issue which may be ameliorated with the application of Mandatory Access Control (MAC) security in the host system. Integration of MAC with virtualization will also help increase the overall robustness and security assurance of both host and guest systems. Many threats arising from flaws in the VM environment, or misconfiguration, may be mitigated through tighter isolation and specific MAC policy enforcement. By incorporating MAC support into the virtualization toolchain and documentation, users will also be able to make more use of the MAC security capabilities provided by the OS. 1.2 Use-cases The following use-cases have been identified: o Providing virtualized services with a level of isolation similar to that previously afforded by physical separation. o Increased protection of the host from untrusted VM guests (e.g. for VM hosting providers, grid/cloud servers etc.). o Increased protection of VM guests from each other in the event of host flaws or misconfiguration. Some protection may also be provided against a compromised host. o Consolidating access to multiple networks which require strong isolation from each other (e.g. military, government, corporate extranets, internal "Chinese wall" separation etc.) o Strongly isolating desktop applications by running them in separately labeled VMs (e.g. online banking in one VM and World of Warcraft in another; opening untrusted office documents in an isolated VM for view/print only). o Forensic analysis of disk images, binaries, browser scripts etc. in a highly isolated VM, protecting both the host system and the integrity of the components under analysis. o Isolated test environments, preventing e.g. simulated trades from entering a production system, leakage of sensitive customer data to internal networks etc. o General ability to specify a wide range of high-level security goals for virtualization through flexible MAC policy. 2. Current Situation SELinux is already able to provide general MAC protection to Linux-based virtualization, such as protecting the integrity and confidentiality of disk images and providing strong isolation of Linux hypervisor processes from the rest of the system. There is, however, no explicit support for Linux-based virtualization in SELinux, and all VMs currently run in the same security context. Thus, there is no MAC isolation applied between VMs. 3. Functional Security Requirements 3.1 Strong isolation between active VMs Running different VMs with different MAC labels allows stronger isolation between VMs, reducing risks arising from flaws in or misconfiguration of the VM environment. For example, the threat of a rogue VM exploiting a flaw in KVM could be greatly reduced if it is isolated from other VMs by MAC security policy. 3.2 Improved control over access to VM resources Distinct MAC labeling of resources belonging to VMs (disk images, disk partitions etc.) binds VM instances to those resources, ensuring that VMs can only access their own resources. This can protect the VM from invalid VM resources; and protect VM resources from flawed or misconfigured VMs. 3.3 Improved control over access to shared resources Where VMs may share resources (e.g. miscellaneous devices, virtual networking, read-only disk images etc.), fine-grained MAC policy may be specified to control information flow between VMs. 3.4 Fine-grained interaction with the host With distinct labeling of VMs and their resources, interactions with host entities on a per-VM basis may then be controlled by MAC policy. An example of this would be to safely allow different users on the host to administer different VMs. Configuration of this could be managed via the RBAC scheme integrated with SELinux. 3.5 Coarse MAC containment of VMs High-level security constraints may be applied to different VMs, to allow simplified lock-down of the overall system. For example, a VM may be restricted so that it cannot transmit TCP traffic on port 25 via virtual networking (i.e. the guest cannot be used as a spam bot even if it is compromised via a rootkit). 3.6 Leverage general MAC architecture As MAC is extended to the desktop, it will be possible to apply uniform MAC policy to the OS, desktop and Linux-based virtualization components. This will provide a basis for a variety of sophisticated security applications such as a virtualized MLS desktop with different windows running VMs at different security levels. 4. Design Considerations 4.1 Consensus in preliminary discussion appears to be that adding MAC to libvirt will be the most effective approach. Support may then be extended to virsh, virt-manager, oVirt etc. 4.2 Initially, sVirt should "just work" as a means to isolate VMs, with minimal administrative interaction. e.g. an option is added to virt-manager which allows a VM to be designated as "isolated", and from then on, it is automatically run in a separate security context, with policy etc. being generated and managed by libvirt. 4.3 We need to consider very carefully exactly how VMs will be launched and controlled e.g. overall security ultimately must be enforced by the host kernel, even though VM launch will be initially controlled by host userspace. 4.4 We need to consider overall management of labeling both locally and in distributed environments (e.g. oVirt), as well as situations where VMs may be migrated between systems, backed up etc. One possible approach may be to represent the security label as the UUID of the guest and then translate that to locally meaningful values as needed. 4.5 MAC controls/policy will need to be considered for any control planes (e.g. /dev/kvm). 4.6 We need to ensure that we have high-level management tools available from the start, avoiding past mistakes with SELinux where we dropped a bunch of complicated pieces in the user's lap. All aspects of sVirt must be managed by the via the virt tools and only present high-level abstractions to the user (and then, only if essential). 4.7 As sVirt involves creating and managing arbitrary numbers of security labels, we will need to address the effects of label space explosion and resulting complexity. Possible approaches already discussed include: - SELinux RBAC or IBAC mechanisms. - MCS labels. This has the possible advantage of not requiring any policy changes for simple isolation: just have a general policy which applies to all MCS labels, and possibly customize behavior via the type. e.g. system_u:object_r:virt_image_t:c1 ^ ^ type mcs label 'c0' = isolated inactive VM image/device. 'cN' = dynamically assigned MCS label for active VM, bound to the UUID, and translated via MCS translation file. i.e. a user running ls -Z or ps -Z will see the UUID instead of cN. 'virt_image_t' = standard VM which is also isolated if an MCS label is present. 'virt_image_nonet_t' = VM with no network access at all. etc. So, MCS is used to enforce VM isolation, Type is used to enforce general security behavior. We can then provide a high-level GUI interface for selecting this behavior without the admin knowing anything about SELinux. Note: proof of concept testing has been performed using MCS labels, which appears to be workable at this stage. - Utilize the new hierarchical types being proposed upstream by NEC. (No analysis done yet). 4.8 Accessing images via shared storage will present challenges as we do not yet have labeling for networked filesystems. 4.9 We must ensure that any MAC support integrated into libvirt is readily debuggable. e.g. hook into auditsp to actively process policy violations and handle them via the virt toolchain; also develop good setroubleshoot plugins. 4.10 {lib}semanage needs performance optimization work to reduce impact on the virt toolchain. ------------------------------------------------------------------------

7 17

[libvirt] fail to run virsh
by Jun Koi 15 Aug '08

15 Aug '08

Hi, I installed libvirt (cvs version), and can confirm that libvirtd is running. However, virsh failed to work. I got the below message when running virsh with debugging information. How to fix this problem? Many thanks, Jun # LIBVIRT_DEBUG=1 virsh DEBUG: libvirt.c: virInitialize (register drivers) DEBUG: libvirt.c: virConnectOpenAuth (name=(null), auth=0xb7f53b84, flags=0) DEBUG: libvirt.c: do_open (Probed qemu:///system) DEBUG: lxc_driver.c: lxcCheckContainerSupport (clone call returned EINVAL, container support is not enabled) DEBUG: libvirt.c: do_open (Using qemu:///system as default URI, 1 hypervisor found) DEBUG: libvirt.c: do_open (name "qemu:///system" to URI components: scheme qemu opaque (null) authority (null) server (null) user (null) port 0 path /system ) DEBUG: libvirt.c: do_open (trying driver 0 (Test) ...) DEBUG: libvirt.c: do_open (driver 0 Test returned DECLINED) DEBUG: libvirt.c: do_open (trying driver 1 (QEMU) ...) DEBUG: libvirt.c: do_open (driver 1 QEMU returned DECLINED) DEBUG: libvirt.c: do_open (trying driver 2 (Xen) ...) DEBUG: libvirt.c: do_open (driver 2 Xen returned DECLINED) DEBUG: libvirt.c: do_open (trying driver 3 (OPENVZ) ...) DEBUG: libvirt.c: do_open (driver 3 OPENVZ returned DECLINED) DEBUG: libvirt.c: do_open (trying driver 4 (LXC) ...) DEBUG: libvirt.c: do_open (driver 4 LXC returned DECLINED) DEBUG: libvirt.c: do_open (trying driver 5 (remote) ...) DEBUG: remote_internal.c: doRemoteOpen (proceeding with name = qemu:///system) libvir: Remote error : No such file or directory DEBUG: libvirt.c: do_open (driver 5 remote returned ERROR) DEBUG: hash.c: virUnrefConnect (unref connection 0x806b588 qemu:///system 1) DEBUG: hash.c: virReleaseConnect (release connection 0x806b588 qemu:///system) error: failed to connect to the hypervisor

2 3

[libvirt] [PATCH] fix minor typo
by John Levon 15 Aug '08

15 Aug '08

Fix a typo in the message for the 'dump' command in virsh. Signed-off-by: John Levon <john.levon(a)sun.com> Index: src/virsh.c =================================================================== RCS file: /data/cvs/libvirt/src/virsh.c,v retrieving revision 1.157 diff -u -r1.157 virsh.c --- src/virsh.c 22 Jul 2008 16:12:01 -0000 1.157 +++ src/virsh.c 13 Aug 2008 15:50:09 -0000 @@ -1320,7 +1320,7 @@ return FALSE; if (virDomainCoreDump(dom, to, 0) == 0) { - vshPrint(ctl, _("Domain %s dumpd to %s\n"), name, to); + vshPrint(ctl, _("Domain %s dumped to %s\n"), name, to); } else { vshError(ctl, FALSE, _("Failed to core dump domain %s to %s"), name, to);

3 2

[libvirt] Reusing dumpxml output
by Stefan de Konink 15 Aug '08

15 Aug '08

I would like to reuse configurations that have been edited using the libvirt api. For example by attaching interfaces. Now the output that dumpxml generates, is very 'specific' to an active configuration. I am not able to use a stored configuration from an active domain to redefine it after it has been undefined. Is there a trick to do so? Or should one really strip all 'live' attributes first? Stefan

5 14

[libvirt] breaking out of virsh console?
by Schroeder, Paul 14 Aug '08

14 Aug '08

Hello all... In my VM's inittab, I set agetty to run on ttyS0 so I could do "virsh console myvm" and log in from the host machine's command line. It works perfectly. Trouble is, I don't know how to break out of it to get back to the command line on my host. I've only been able to do so by killing the virsh process. There's gotta be a better way.. Right? Thanks...Paul...

5 4

[libvirt] VMWare support, any news?
by Yushu Yao 14 Aug '08

14 Aug '08

Hi All, I noticed there are some discussion about VMWare support of libvirt several back in April-May. Just wondering is there a prototype yet? The function I¹m interested in is to stop/start a VM by VMWare player/workstation/free server. Thanks, -Yushu

5 5

[libvirt] [PATCH] get memory in openvz driver
by Evgeniy Sokolov 14 Aug '08

14 Aug '08

OpenVZ has several parameters for memory management. All of them can be configured independetly. Patch allow to get configuration of memory from container config and then calculate total usage of memory. It is open question how to manage memory?

2 4

[libvirt] [PATCH] kvm/virtio: Set IFF_VNET_HDR when setting up tap fds
by Mark McLoughlin 13 Aug '08

13 Aug '08

Hey, Here's a patch that allows libvirt created guests to use KVM's recent GSO support in order to increase the throughput achieved with virtio_net network interfaces. We shouldn't apply this yet - we need the kernel and kvm TUNGETIFF patches to be applied first - so this is just intended as an RFC. See also: http://marc.info/?l=linux-netdev&m=121863813904363 and: http://marc.info/?l=kvm&m=121863857305255 Cheers, Mark. Subject: [PATCH] kvm/virtio: Set IFF_VNET_HDR when setting up tap fds IFF_VNET_HDR is a tun/tap flag that allows you to send and receive large (i.e. GSO) packets and packets with partial checksums. Setting the flag means that every packet is proceeded by the same header which virtio uses to communicate GSO/csum metadata. By enabling this flag on the tap fds we create, we greatly increase the achievable throughput with virtio_net. However, we need to be careful to only set the flag when a) KVM has support for this ABI and b) the value of the flag is queryable using the TUNGETIFF ioctl. Signed-off-by: Mark McLoughlin <markmc(a)redhat.com> Index: libvirt/src/bridge.c =================================================================== --- libvirt.orig/src/bridge.c 2008-08-13 15:40:34.000000000 +0100 +++ libvirt/src/bridge.c 2008-08-13 15:40:53.000000000 +0100 @@ -275,10 +275,52 @@ #endif /** + * brProbeVnetHdr: + * @tapfd: a tun/tap file descriptor + * + * Check whether it is safe to enable the IFF_VNET_HDR flag on the + * tap interface. + * + * Setting IFF_VNET_HDR enables KVM's virtio_net driver to allow + * guests to pass larger (GSO) packets, with partial checksums, to + * the host. This greatly increases the achievable throughput. + * + * It is only useful to enable this when we're setting up a virtio + * interface. And it is only *safe* to enable it when we know for + * sure that a) qemu has support for IFF_VNET_HDR and b) the running + * kernel implements the TUNGETIFF ioctl(), which qemu needs to query + * the supplied tapfd. + * + * Returns 0 in case of success or an errno code in case of failure. + */ +static int +brProbeVnetHdr(int tapfd) +{ +#if defined(IFF_VNET_HDR) && defined(TUNGETFEATURES) && defined(TUNGETIFF) + unsigned int features; + struct ifreq dummy; + + if (ioctl(tapfd, TUNGETFEATURES, &features) != 0) + return 0; + + if (!(features & IFF_VNET_HDR)) + return 0; + + if (ioctl(tapfd, TUNGETIFF, &dummy) != -1 || errno != EBADFD) + return 0; + + return 1; +#else + return 0; +#endif +} + +/** * brAddTap: * @ctl: bridge control pointer * @bridge: the bridge name * @ifname: the interface name (or name template) + * @vnet_hdr: whether to try enabling iFF_VNET_HDR * @tapfd: file descriptor return value for the new tap device * * This function creates a new tap device on a bridge. @ifname can be either @@ -292,6 +334,7 @@ brAddTap(brControl *ctl, const char *bridge, char **ifname, + int vnet_hdr, int *tapfd) { int id, subst, fd; @@ -307,6 +350,9 @@ if ((fd = open("/dev/net/tun", O_RDWR)) < 0) return errno; + if (vnet_hdr) + vnet_hdr = brProbeVnetHdr(fd); + do { struct ifreq try; int len; @@ -315,6 +361,11 @@ try.ifr_flags = IFF_TAP|IFF_NO_PI; +#ifdef IFF_VNET_HDR + if (vnet_hdr) + try.ifr_flags |= IFF_VNET_HDR; +#endif + if (subst) { len = snprintf(try.ifr_name, BR_IFNAME_MAXLEN, *ifname, id); if (len >= BR_IFNAME_MAXLEN) { Index: libvirt/src/bridge.h =================================================================== --- libvirt.orig/src/bridge.h 2008-08-13 15:40:34.000000000 +0100 +++ libvirt/src/bridge.h 2008-08-13 15:40:53.000000000 +0100 @@ -61,6 +61,7 @@ int brAddTap (brControl *ctl, const char *bridge, char **ifname, + int vnet_hdr, int *tapfd); int brSetInterfaceUp (brControl *ctl, Index: libvirt/src/qemu_conf.c =================================================================== --- libvirt.orig/src/qemu_conf.c 2008-08-13 15:40:34.000000000 +0100 +++ libvirt/src/qemu_conf.c 2008-08-13 15:41:15.000000000 +0100 @@ -474,6 +474,8 @@ *flags |= QEMUD_CMD_FLAG_DRIVE; if (strstr(help, "boot=on")) *flags |= QEMUD_CMD_FLAG_DRIVE_BOOT; + if (strstr(help, "IFF_VNET_HDR")) + *flags |= QEMUD_CMD_FLAG_VNET_HDR; if (ver >= 9000) *flags |= QEMUD_CMD_FLAG_VNC_COLON; } @@ -545,7 +547,8 @@ int **tapfds, int *ntapfds, virDomainNetDefPtr net, - int vlan) + int vlan, + int vnet_hdr) { virNetworkObjPtr network = NULL; char *brname; @@ -593,7 +596,7 @@ } if ((err = brAddTap(driver->brctl, brname, - &net->ifname, &tapfd))) { + &net->ifname, vnet_hdr, &tapfd))) { if (errno == ENOTSUP) { /* In this particular case, give a better diagnostic. */ qemudReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, @@ -1011,9 +1014,16 @@ case VIR_DOMAIN_NET_TYPE_NETWORK: case VIR_DOMAIN_NET_TYPE_BRIDGE: { - char *tap = qemudNetworkIfaceConnect(conn, driver, - tapfds, ntapfds, - net, vlan); + char *tap; + int vnet_hdr = 0; + + if (qemuCmdFlags & QEMUD_CMD_FLAG_VNET_HDR && + net->model && !strcmp(net->model, "virtio")) + vnet_hdr = 1; + + tap = qemudNetworkIfaceConnect(conn, driver, + tapfds, ntapfds, + net, vlan, vnet_hdr); if (tap == NULL) goto error; ADD_ARG(tap); Index: libvirt/src/qemu_conf.h =================================================================== --- libvirt.orig/src/qemu_conf.h 2008-08-13 15:40:34.000000000 +0100 +++ libvirt/src/qemu_conf.h 2008-08-13 15:41:15.000000000 +0100 @@ -47,6 +47,7 @@ QEMUD_CMD_FLAG_DRIVE = (1 << 3), QEMUD_CMD_FLAG_DRIVE_BOOT = (1 << 4), QEMUD_CMD_FLAG_NAME = (1 << 5), + QEMUD_CMD_FLAG_VNET_HDR = (1 << 6), }; /* Main driver state */

2 4

[libvirt] PATCH: 0/7: Re-factor LXC driver
by Daniel P. Berrange 13 Aug '08

13 Aug '08

This is a long overdue followup to my previous set of patches to make the LXC driver use the new domain XML apis. Getting this merged is a blocker for the new libvirt release, now we've turned on LXC by default. Likewise we need to get OpenVZ fully ported to new XML before release too. The previous posting was here: http://www.redhat.com/archives/libvir-list/2008-July/msg00182.html Regards, Daniel -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

3 24

[libvirt] virt-install?
by Jun Koi 13 Aug '08

13 Aug '08

Hi, I got the libvirt source code (cvs), and compiled. However, I cannot find the virt-install anywhere. Is it included inside libvirt? Thank you, Jun

3 4

[libvirt] [PATCH] Change disk type 'dos' to 'msdos'
by Cole Robinson 13 Aug '08

13 Aug '08

parted doesn't seem to want the label 'dos', instead wanting 'msdos'. Patch is basically s/dos/msdos/ Thanks, Cole

4 6

[libvirt] Re: virDomainMemoryPeek for Xen?
by Richard W.M. Jones 13 Aug '08

13 Aug '08

On Wed, Aug 13, 2008 at 01:19:42PM +0900, Jun Koi wrote: > According to the comment in your driver code for virDomainMemoryPeek, > libvirt is not currently supporting Xen. Why is that? As far as I see, > Xen is use the same GPL2 version as libvirt. > > I am thinking about implementing the driver for Xen, so have this question. It'd be really good to have a driver for this for libvirt. QEMU does virtual->physical translation for us, through the guest's CR3 & page tables. [This discussion will concentrate on x86 for the moment :-)] If you look at the qemu source, file target-i386/ helper2.c, function cpu_get_phys_page_debug, you will see the code they use to navigate through the 3 or 4 levels of page tables for i386 & x86-64 respectively. The QEMU memsave command made it almost trivial to write virDomainMemoryPeek (...VIR_MEMORY_VIRTUAL...); On Xen things are a bit different. You can map in physical pages from another guest using the libxc call xc_map_foreign_range. Note that you cannot just call xc_map_foreign_range because the libxc & libvirt licenses are _not_ compatible. So instead you'd need to do the underlying sequence of mmap / ioctl / munmap. (See tools/libxc/ xc_linux.c in the Xen source). But you still need to do virtual to physical page translation, either using the qemu source as an example, or using xc_translate_foreign_address as a guide (or just using the Intel Programmers Reference Manual and doing it from first principles). Another alternative is to implement virDomainMemoryPeek (...VIR_MEMORY_PHYSICAL...). It is not possible to implement this for QEMU at all, at least not without changing QEMU. Implementing this for Xen would be much easier because you don't need to do address translation, but it does push the problem of address translation up to the callers. Places to look in the QEMU source for inspiration: monitor.c:do_memory_save target-i386/helper2.c:cpu_get_phys_page_debug Other places to look in the Xen source for inspiration: tools/libxc/xc_linux.c tools/libxc/xc_pagetab.c tools/xentrace/xenctx.c (thanks Mark McLoughlin) Rich. -- Richard Jones, Emerging Technologies, Red Hat http://et.redhat.com/~rjones virt-top is 'top' for virtual machines. Tiny program with many powerful monitoring features, net stats, disk stats, logging, etc. http://et.redhat.com/~rjones/virt-top

2 1

[libvirt] [PATCH]: ruby-libvirt migration fixes
by Chris Lalancette 13 Aug '08

13 Aug '08

Attached is a relatively simple patch to the ruby-libvirt bindings with some bugfixes for the migrate call. The first problem was that there was no way to pass a "nil" through to the underlying virDomainMigrate() call. This is important because generally the "dname" and "uri" parameters end up being NULL. This patch also makes all the parameters beyond the first 2 optional. I've tested this out by live migrating a KVM guest between two hosts, and this now does what I expect. Signed-off-by: Chris Lalancette <clalance(a)redhat.com>

3 4

[libvirt] PATCH: Block & reset signals when fork/exec'ing children
by Daniel P. Berrange 12 Aug '08

12 Aug '08

The LXC patches identified a race condition between fork/exec'ing child processes and signal handlers. The process using libvirt can have setup arbitrary signal handlers. In the libvirtd case we have one attached to SIGCHILD, and the handler writes to a pipe which is then processeed in the main loop. When you fork() signal handlers are preserved in the child process, but you may well not want the signal handlers to be run in the children - for example in LXC we closed the FD associated the pipe after fork(), and that FD is now asociated with a socket we use to talk to the container. So if the original signal handler is run bad stuff will happen in the child. Now signal handlers will eventually get reset when you exec(), but this leaves open a race condition window between the fork & exec() when we cannot assume it is safe to run the signal handlers from the parent So, this changes the virExec() function so that before fork()ing it blocks all signals. After fork() the parent process can restore its original signal mask. The child process meanwhile calls sigaction() to reset all signal handlers to SIG_DFL, and then unblocks all signals. NB, the child does not restore the parents sig-mask - libvirt can be called from any app, and we don't want to inherit whatever mask the app may have setup. On Linux there is a convenient NSIG constant defined in signal.h telling us how many signals there are. If this isn't defined I simply set it to 32 which is enough for UNIX pre-dating the addition of real-time signals to POSIX. If we find convenient or more appropriate values for other non-Linux OS we can update this as needed. NB I call pthread_sigmask() instead of sigprocmask() when doing the fork/exec, because we cannot assume that the application using libvirt is single-threaded & thus we only want to block signals in the thread doing the fork/exec. Daniel diff -r 1dbfb08d365d src/util.c --- a/src/util.c Thu Aug 07 16:55:11 2008 +0100 +++ b/src/util.c Thu Aug 07 16:55:53 2008 +0100 @@ -37,6 +37,7 @@ #include <sys/wait.h> #endif #include <string.h> +#include <signal.h> #include "c-ctype.h" #ifdef HAVE_PATHS_H @@ -49,6 +50,10 @@ #include "util.h" #include "memory.h" #include "util-lib.c" + +#ifndef NSIG +# define NSIG 32 +#endif #ifndef MIN # define MIN(a, b) ((a) < (b) ? (a) : (b)) @@ -104,9 +109,23 @@ _virExec(virConnectPtr conn, const char *const*argv, int *retpid, int infd, int *outfd, int *errfd, int non_block) { - int pid, null; + int pid, null, i; int pipeout[2] = {-1,-1}; int pipeerr[2] = {-1,-1}; + sigset_t oldmask, newmask; + struct sigaction sig_action; + + /* + * Need to block signals now, so that child process can safely + * kill off caller's signal handlers without a race. + */ + sigfillset(&newmask); + if (pthread_sigmask(SIG_SETMASK, &newmask, &oldmask) < 0) { + ReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, + _("cannot block signals: %s"), + strerror(errno)); + return -1; + } if ((null = open(_PATH_DEVNULL, O_RDONLY)) < 0) { ReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, @@ -122,6 +141,34 @@ goto cleanup; } + if (outfd) { + if(non_block && + virSetNonBlock(pipeout[0]) == -1) { + ReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, + _("Failed to set non-blocking file descriptor flag")); + goto cleanup; + } + + if(virSetCloseExec(pipeout[0]) == -1) { + ReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, + _("Failed to set close-on-exec file descriptor flag")); + goto cleanup; + } + } + if (errfd) { + if(non_block && + virSetNonBlock(pipeerr[0]) == -1) { + ReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, + _("Failed to set non-blocking file descriptor flag")); + goto cleanup; + } + if(virSetCloseExec(pipeerr[0]) == -1) { + ReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, + _("Failed to set close-on-exec file descriptor flag")); + goto cleanup; + } + } + if ((pid = fork()) < 0) { ReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, _("cannot fork child process: %s"), strerror(errno)); @@ -132,33 +179,48 @@ close(null); if (outfd) { close(pipeout[1]); - if(non_block) - if(virSetNonBlock(pipeout[0]) == -1) - ReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, - _("Failed to set non-blocking file descriptor flag")); - - if(virSetCloseExec(pipeout[0]) == -1) - ReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, - _("Failed to set close-on-exec file descriptor flag")); *outfd = pipeout[0]; } if (errfd) { close(pipeerr[1]); - if(non_block) - if(virSetNonBlock(pipeerr[0]) == -1) - ReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, - _("Failed to set non-blocking file descriptor flag")); - - if(virSetCloseExec(pipeerr[0]) == -1) - ReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, - _("Failed to set close-on-exec file descriptor flag")); *errfd = pipeerr[0]; } *retpid = pid; + + /* Restore our original signal mask now child is safely + running */ + if (pthread_sigmask(SIG_SETMASK, &oldmask, NULL) < 0) { + ReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, + _("cannot unblock signals: %s"), + strerror(errno)); + return -1; + } + return 0; } /* child */ + + /* Clear out all signal handlers from parent so nothing + unexpected can happen in our child here */ + sig_action.sa_handler = SIG_DFL; + sig_action.sa_flags = 0; + sigemptyset(&sig_action.sa_mask); + + for (i = 0 ; i < NSIG ; i++) + /* Only possible errors are EFAULT or EINVAL + The former wont happen, the latter we + expect, so no need to check return value */ + sigaction(i, &sig_action, NULL); + + /* Unmask all signals in child, since we've no idea + what the caller's done with their signal mask */ + if (pthread_sigmask(SIG_SETMASK, &oldmask, NULL) < 0) { + ReportError(conn, NULL, NULL, VIR_ERR_INTERNAL_ERROR, + _("cannot unblock signals: %s"), + strerror(errno)); + return -1; + } if (pipeout[0] > 0 && close(pipeout[0]) < 0) _exit(1); -- |: Red Hat, Engineering, London -o- http://people.redhat.com/berrange/ :| |: http://libvirt.org -o- http://virt-manager.org -o- http://ovirt.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: GnuPG: 7D3B9505 -o- F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|

2 2

[libvirt] [PATCH] rewrite virFileLinkPointsTo
by Jim Meyering 12 Aug '08

12 Aug '08

I've rewritten virFileLinkPointsTo to be a lot simpler, and more importantly, it has far fewer failure points. If anyone wants to preserve the original behavior that makes it fail when the first parameter does not specify a symlink, I can add that. The only difference in behavior would be when the two files are hard-linked. In any case, I'll remove the FIXME comment. The diff below is not very readable. Bottom line, it replaces a pair of functions (the latter is a stub for mingw) with this: #define SAME_INODE(Stat_buf_1, Stat_buf_2) \ ((Stat_buf_1).st_ino == (Stat_buf_2).st_ino \ && (Stat_buf_1).st_dev == (Stat_buf_2).st_dev) int virFileLinkPointsTo(const char *checkLink, const char *checkDest) { struct stat src_sb; struct stat dest_sb; if (stat (checkLink, &src_sb) || stat (checkDest, &dest_sb)) return 0; /* FIXME: if required, lstat checkLink to ensure it's a symlink */ if (! SAME_INODE (src_sb, dest_sb)) { virLog("Link '%s' does not point to '%s', ignoring\n", checkLink, checkDest); return 0; } return 1; } >From 4e70c02e547b078b8f35afd0996b6887e1593afd Mon Sep 17 00:00:00 2001 From: Jim Meyering <meyering(a)redhat.com> Date: Tue, 12 Aug 2008 19:07:46 +0200 Subject: [PATCH] rewrite virFileLinkPointsTo * src/util.c (SAME_INODE): Define. (virFileLinkPointsTo): Rewrite to be more portable and more efficient. --- src/util.c | 97 ++++++----------------------------------------------------- 1 files changed, 10 insertions(+), 87 deletions(-) diff --git a/src/util.c b/src/util.c index 9f056e0..2905a0a 100644 --- a/src/util.c +++ b/src/util.c @@ -397,107 +397,30 @@ int virFileHasSuffix(const char *str, return STREQ(str + len - suffixlen, suffix); } -#ifndef __MINGW32__ +#define SAME_INODE(Stat_buf_1, Stat_buf_2) \ + ((Stat_buf_1).st_ino == (Stat_buf_2).st_ino \ + && (Stat_buf_1).st_dev == (Stat_buf_2).st_dev) int virFileLinkPointsTo(const char *checkLink, const char *checkDest) { - char dest[PATH_MAX]; - char real[PATH_MAX]; - char checkReal[PATH_MAX]; - int n; - - /* read the link destination */ - if ((n = readlink(checkLink, dest, PATH_MAX)) < 0) { - switch (errno) { - case ENOENT: - case ENOTDIR: - return 0; - - case EINVAL: - virLog("File '%s' is not a symlink\n", - checkLink); - return 0; - - } - virLog("Failed to read symlink '%s': %s\n", - checkLink, strerror(errno)); - return 0; - } else if (n >= PATH_MAX) { - virLog("Symlink '%s' contents too long to fit in buffer\n", - checkLink); - return 0; - } + struct stat src_sb; + struct stat dest_sb; - dest[n] = '\0'; + if (stat (checkLink, &src_sb) || stat (checkDest, &dest_sb)) + return 0; - /* make absolute */ - if (dest[0] != '/') { - char dir[PATH_MAX]; - char tmp[PATH_MAX]; - char *p; + /* FIXME: if required, lstat checkLink to ensure it's a symlink */ - strncpy(dir, checkLink, PATH_MAX); - dir[PATH_MAX-1] = '\0'; - - if (!(p = strrchr(dir, '/'))) { - virLog("Symlink path '%s' is not absolute\n", checkLink); - return 0; - } - - if (p == dir) /* handle unlikely root dir case */ - p++; - - *p = '\0'; - - if (virFileBuildPath(dir, dest, NULL, tmp, PATH_MAX) < 0) { - virLog("Path '%s/%s' is too long\n", dir, dest); - return 0; - } - - strncpy(dest, tmp, PATH_MAX); - dest[PATH_MAX-1] = '\0'; - } - - /* canonicalize both paths */ - if (!realpath(dest, real)) { - virLog("Failed to expand path '%s' :%s\n", dest, strerror(errno)); - strncpy(real, dest, PATH_MAX); - real[PATH_MAX-1] = '\0'; - } - - if (!realpath(checkDest, checkReal)) { - virLog("Failed to expand path '%s' :%s\n", checkDest, strerror(errno)); - strncpy(checkReal, checkDest, PATH_MAX); - checkReal[PATH_MAX-1] = '\0'; - } - - /* compare */ - if (STRNEQ(checkReal, real)) { + if (! SAME_INODE (src_sb, dest_sb)) { virLog("Link '%s' does not point to '%s', ignoring\n", - checkLink, checkReal); + checkLink, checkDest); return 0; } return 1; } -#else /* !__MINGW32__ */ - -/* Gnulib has an implementation of readlink which could be used - * to implement this, but it requires LGPLv3. - */ - -int -virFileLinkPointsTo (const char *checkLink ATTRIBUTE_UNUSED, - const char *checkDest ATTRIBUTE_UNUSED) -{ - virLog (_("%s: not implemented\n"), __FUNCTION__); - return 0; -} - -#endif /*! __MINGW32__ */ - int virFileExists(const char *path) { struct stat st; -- 1.6.0.rc2.38.g413e06

2 3

[libvirt] Qemu Monitor
by Listen 12 Aug '08

12 Aug '08

Hi all, A simple question, I hope ;) Is it possible to enable the qemu monitor in libvirt's xml? It need the monitor, to dynamically add a usb device to a windows vm. Regards, Eric

4 4

[libvirt] gnome-applet-vm orphaned
by Karel Zak 12 Aug '08

12 Aug '08

Hi folks, unfortunately, I have not enough time to work on the gnome applet. I'm looking for a new upstream maintainer, or for co-maintainer. Project home page: http://fedorahosted.org/gnome-applet-vm/ Note that the applet does not require any heavy development. Any volunteers around? Karel -- Karel Zak <kzak(a)redhat.com>

1 0

[libvirt] [PATCH] Ensure parted doesn't prompt if labeling disk
by Cole Robinson 12 Aug '08

12 Aug '08

Trying to 'build' a disk pool uses 'parted mklabel' which can prompt for confirmation. Patch adds the '--script' option to remove the chance of this happening. Thanks, Cole

4 4

[libvirt] Announcement of a companion project the "UnifiedSessionsManager"
by acue 12 Aug '08

12 Aug '08

Hello, I would like to announce the unifiedSessionsManager(GPL3, including the claimed inventions), which is based for Xen on the virsh-tool, but basically uses a different approach. I guess it could be a quite usable companion of libvirt for advanced usage and enhanced customizabelity of the handling of huge amounts of virtual and physical machines in a distributed environment. It is targeting on test, development and productive environments. This requirement will particularly arise, when "bulk-core-CPUs" enter the market, providing for independently executed bulks of virtual machines, which may be logically designed as stacked and nested VMs, founding a tree like multi-layered structure of VM clusters. The design-preview as estimated by the unifiedSessionsManager is here the v-component, what could be seen as the extensin of the slogan/concept of a so called virtual appliance, where a full scale VM including it's inherent GuestOS is handeled as a virtual software component. V-Compoents are foreseen to be grouped into clusters of VMs, arranged within a nested VMSTACK and managed - e.g. suspended - as a group of services, founding a combined service by their self. In case this preview becomes reality, this may have an impact on the basic design, particularly the interface design of each of it's components to be stack-aware, thus for libvirt too. For example providing the shutdown of a stack of VMs, including the suspension of machines containing upper VMs, might require some kind of communications and propagation.. The usage of multilayered VMSTACKs is already supported by the unifiedSessionsManager. Particularly MACRO and GROUP features support for handling of the number of entities required to be handled for a VMSTACK. Whereas much of the required functionality from the VMs is simulated, particularly by utilizing a recursive Stack-Propagation based on native access to GuestOSs with SSO-accounts. The concrete supported products of current version 01_07_001b02 are: - GuestOS and HostOS on physical machines: CentOS, Fedora, debian, OpenSUSE, Ubuntu, OpenBSD, Solaris10(limited) - Hypervisors/Emulators: QEMU, Xn, VMware(workstation,server,player) Future Plans are, mostly for the next version already: -Planned-OS: FreeBSD, NetBSD, Solaris10(complete), OpenSolaris, ScientificLinux -Planned-OS: eCos(?), uCLinux(several ARCH), SkyEye, ... -Planned-VM: VirtualBOX(evaluation first), OpenVZ(evaluation first) .Introduction of a LDAP based nameservice for VMs. -Evaluation of:Cygwin The Idea was the easy to adapt utilization of a minimalistic-bash-scripts only implementation for setting up a unified wrapper interface customizable for almost any kind of user sessions by almost anyone. Even though I would prefer now at least Perl or for specific parts full scale C/C++ code and Java/JavaScript for some administrative parts. The managed user environment comprises sessions to VMs which could be allocated in a nested multilayered VMSTACK as well as within a PM, which are physical machines - layer-0 entities. Also HOSTs sessions as native access to GuestOSs are integrated. Additionally a simple implemented but with sophisticated functionally equipped cache database is introduced in order to support for hundreds and thousands of virtual machines to be managed, with an average query-response-time for single-level-filters of less than 1second. Results are measured with an average of 0.3-0.8seconds in the ref.-env., even though bash and awk is mainly used only with an Office-Compatible record format. Information could be found within the User-Manual, which has more than 600pages, and within the sources of more than 110.000LinesOfCode. The following sites provide downloads: http://www.heise.de/software/download/unified_sessions_manager_ctys/51630 http://www.unifiedsessionsmanager.org http://www.unifiedsessionsmanager.eu http://sourceforge.net/projects/ctys (sourceforge not yet complete) (berlios follows) There are basically three reasons for sending this Mail: 1. Announcing a new supplemental project focusing on usage of distributed and stacked VMs 2. Getting some feedback and ideas for the future direction of the development of libvirt and the unifiedSessionsManager. 3. Probably initiation of setting up a common overall concept for the future vision of an IT environment and it's integrated handling of VMs. And of course, I would appreciate, if the current version already is of some benefit for the OpenSource community. Yours Sincerely Arno-Can Uestuensoez -- ---------------------------------------------------------------------------- Arno-Can Uestuensoez www.i4p.de / www.i4p.com

1 0

[libvirt] [PATCH/RFC]: hostdev passthrough support
by Guido Günther 12 Aug '08

12 Aug '08

Hi, attached is some basic support for host device passthrough. It enables you to passthrough usb devices in qemu/kvm via: <devices> <hostdev type='usb' vendor='0204' product='6025'/> <hostdev type='usb' bus='001' device='007'/> </devices> I didn't implement unplug yet since this needs some modifications to qemu/kvm to be able to identify the correct device to unplug. Does this look reasonable? -- Guido

5 35

[libvirt] [PATCH] fix MinGW compilation(200808)
by Atsushi SAKAI 12 Aug '08

12 Aug '08

Hi, Currently, compilation for MinGW is broken. Here is the patch. But configure script option for MinGW is changed from previous posting. https://www.redhat.com/archives/libvir-list/2008-June/msg00145.html Currently, it should do # ./configure --without-xen --without-qemu --without-sasl --without-lxc --without-openvz --without-libvirtd --without-test currently following 3 make works, make make install make check I do not know why syntax-check is not exist on Makefile on MinGW. src/domain_conf.c | 2 ++ src/network_conf.c | 2 ++ src/virsh.c | 8 ++++++++ tests/testutilsxen.c | 2 ++ 4 files changed, 14 insertions(+) Thanks Atsushi SAKAI

5 31

[libvirt] [PATCH] make sure we call the freshly build libvirtd
by Guido Guenther 11 Aug '08

11 Aug '08

...not the one in $PATH. I was wondering why this test kept failing... -- Guido --- tests/daemon-conf | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/daemon-conf b/tests/daemon-conf index db1f0d3..4a42d1e 100755 --- a/tests/daemon-conf +++ b/tests/daemon-conf @@ -1,6 +1,8 @@ #!/bin/sh # Get coverage of libvirtd's config-parsing code. +LIBVIRTD=$abs_top_builddir/qemud/libvirtd + # Boilerplate code to set up a test directory, cd into it, # and to ensure we remove it upon completion. this_test_() { echo "./$0" | sed 's,.*/,,'; } @@ -27,7 +29,7 @@ while :; do # Change an RHS that starts with '"' or '[' to "3". # Change an RHS that starts with 0 or 1 to the string '"foo"'. sed "$i"'s/ = [["].*/ = 3/;'"$i"'s/ = [01].*/ = "foo"/' tmp.conf > $f - libvirtd --config=$f 2> err && fail=1 + $LIBVIRTD --config=$f 2> err && fail=1 case $rhs in # '"'*) msg='should be a string';; '"'*) msg='invalid type: got long; expected string';; @@ -48,7 +50,7 @@ while :; do done # Run with the unmodified config file. -libvirtd --config=tmp.conf > log 2>&1 & pid=$! +$LIBVIRTD --config=tmp.conf > log 2>&1 & pid=$! sleep 2 kill $pid -- 1.5.6.3

4 5

[libvirt] /var/run/libvirt
by Stefan de Konink 11 Aug '08

11 Aug '08

It is a trivial error, but i wonder if: Failed to change group ownership of /var/run/libvirt Failed to bind socket to '/var/run/libvirt/libvirt-sock': No such file or directory This could be corrected to: /var/run/libvirt doesn't exist or an mkdir is done on the directory... Stefan

6 9

[libvirt] virStoragePoolRefresh (costs)
by Stefan de Konink 10 Aug '08

10 Aug '08

Could anyone elaborate on the cost of running virStoragePoolRefresh on the different backends. I recall one of the Daniels here suggested it was expensive for some backends could anyone elaborate on it? Stefan

1 0

[libvirt] [ANNOUNCE] virt-mem tools version 0.2.8 released
by Richard W.M. Jones 10 Aug '08

10 Aug '08

I'm pleased to announce the latest release of the virt-mem tools, version 0.2.8. These are tools for system administrators which let you find things like kernel messages, process lists and network information of your guests. For example: virt-uname 'uname' command, shows OS version, architecture, etc. virt-dmesg 'dmesg' command, shows kernel messages virt-ps 'ps' command, shows process list Nothing needs to be installed in the guest for this to work, and the tools are specifically designed to allow easy scripting and integration with databases and monitoring systems. Source is available from the web page here: http://et.redhat.com/~rjones/virt-mem/ The latest version (0.2.8) reworks the internals substantially so that we have direct access to basically any kernel structure, and this will allow us to quickly add the remaining features that people have asked for (memory usage information, lists of network interfaces and so on). As usual, patches, feedback, suggestions etc. are very welcome! Binaries will be available in Fedora 10 (Rawhide) at some point soon. Rich. -- Richard Jones, Emerging Technologies, Red Hat http://et.redhat.com/~rjones virt-top is 'top' for virtual machines. Tiny program with many powerful monitoring features, net stats, disk stats, logging, etc. http://et.redhat.com/~rjones/virt-top

8 11