- Users - libvirt List Archives

[libvirt-users] Running libvirtd outside of a shell results in qemu defunct processes
by Roman Mohr 12 Sep '18

12 Sep '18

Hi, In KubeVirt we are right now starting libvirt via a wrapper shell script. I want to remove that wrapper and directly start libvirtd from our golang code. This means that our golang code is PID 1 in the container and we start libvirtd as a fork from there. When I did this, strange things started to happen. Libvirt was still able to start and manage qemu processes, but stopping the qemu processes stopped working. I can see that all qemu processes, the ones with VMs and the ones used by libvirt to do some host capability detection, stay in the process table as zombies: qemu 54 0.0 0.0 0 0 ? Zs 11:44 0:00 [qemu-system-i38] <defunct> qemu 56 0.2 0.0 0 0 ? Z 11:44 0:00 [qemu-system-i38] <defunct> qemu 61 0.0 0.0 0 0 ? Zs 11:44 0:00 [qemu-system-i38] <defunct> qemu 63 0.1 0.0 0 0 ? Z 11:44 0:00 [qemu-system-i38] <defunct> qemu 70 0.0 0.0 0 0 ? Zs 11:44 0:00 [qemu-system-x86] <defunct> qemu 72 0.2 0.0 0 0 ? Z 11:44 0:00 [qemu-system-x86] <defunct> qemu 79 0.0 0.0 0 0 ? Zs 11:44 0:00 [qemu-system-x86] <defunct> qemu 81 0.2 0.0 0 0 ? Z 11:44 0:00 [qemu-system-x86] <defunct> qemu 86 0.0 0.0 0 0 ? Zs 11:44 0:00 [qemu-system-x86] <defunct> qemu 88 0.3 0.0 0 0 ? Z 11:44 0:00 [qemu-system-x86] <defunct> qemu 93 0.0 0.0 0 0 ? Zs 11:44 0:00 [qemu-system-x86] <defunct> qemu 95 0.1 0.0 0 0 ? Z 11:44 0:00 [qemu-system-x86] <defunct> So to sum up, when I start our golang wrapper around libvirtd inside a bash script without "exec" everything works as usual. If I start in the container pid namespace the golang wrapper directly, or use "exec" from the bash script, things stop working. I also see the libvirt repeatedly tries to kill the qemu processes, but they are stuck. Maybe someone has a clue why things stop working. Thanks and Best Regards, Roman

1 1

[libvirt-users] Shared clipboard not working
by Filipe Laíns 10 Sep '18

10 Sep '18

Hi! I have been plaing arround with libvirt and I've ran into a problem that I don't seem to able to fix, sharing the clipboard. Both my host and my guest are running Arch Linux. I have properly installed, enabled and started spice-vdagent on both machines and I don't see any error in the logs. Am I doing anything wrong? Do I need to have anything else in consideration? Any help is appreciated :) Thank you, Filipe Laíns 3DCE 51D6 0930 EBA4 7858 BA41 46F6 33CB B0EB 4BF2

2 1

[libvirt-users] Immutable backing files
by Gionatan Danti 08 Sep '18

08 Sep '18

Hi list, suppose I have an immutable (ie: due to a read-only snapshot) backing file. After creating an overlay file with "qemu-img create -f qcow2 -o backing_file=/path/to/immutable/file.img current.qcow2", libvirt refuse to start the virtual machine and exits with an error stating "Could not open backing file /path/to/immutable/file.img: Permission denied". From my understanding, libvirtd is trying to change the owner/permissions/selinux context of the backing file but, being it immutable, fails to start the VM. Is that the expected behavior? Thanks. -- Danti Gionatan Supporto Tecnico Assyoma S.r.l. - www.assyoma.it email: g.danti(a)assyoma.it - info(a)assyoma.it GPG public key ID: FF5F32A8

2 5

[libvirt-users] Domain vCPU threads affinity
by Nikos Anastopoulos 06 Sep '18

06 Sep '18

Hello, According to the docs, vcpupin will use either cgroups or sched_setaffinity to pin vcpu threads to cpus. How is this decision made? I observe differences even on different hosts featuring the same version of libvirtd (1.3.1): on one host vcpupin affects cpuset.cpus (cgroup), and on the other it affects vcpu threads affinity (observed through taskset). Thanks, Nikos

2 2

[libvirt-users] How to specify a x509-dir from XML config file?
by 陈炤 05 Sep '18

05 Sep '18

Hi Everyone, I'd like to ask a question about libvirt xml config. I am using kvm with tls certification. For some reason I need to specify a unique certificate file for every instance, so my kvm command would be like: /usr/libexec/qemu-kvm -spice port=5900,tls-port=5901,addr=0.0.0.0,disable-ticketing,x509-dir=/openstack/etc/pki/libvirt-spice the argument x509-dir=/openstack/etc/pki/libvirt-spice is specified in /etc/libvirt/qemu.conf. It's a global argument. Can I specify it from xml? I searched the xml doc but unable to find useful infomation. BR Don

2 1

[libvirt-users] Intel's latest L1TF vulnerability and libvirt
by Paul O'Rorke 05 Sep '18

05 Sep '18

Hi, with regards Intels L1TF vulnerabilities, it seems they are somewhat non-committal on whether turning off HyperThreading is required, suggesting people > Consult with your hypervisor vendor for more guidance. https://www.intel.com/content/www/us/en/architecture-and-technology/l1tf.ht… What is the consensus in the Libvirt community about the risks (or not) of leaving Hyperthreading enabled? After updates my hosts are showing they have conditional cache flushing enabled yet still report as "SMT vulnerable": root@trk-kvm-03:~# cat /sys/devices/system/cpu/vulnerabilities/l1tf Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT vulnerable Thoughts? -- *Paul O'Rorke* *Tracker Software Products (Canada) Limited * www.tracker-software.com <http://www.tracker-software.com/> Tel: +1 (250) 324 1621 Fax: +1 (250) 324 1623 <http://www.tracker-software.com/> Support: http://www.tracker-software.com/support Download latest Releases http://www.tracker-software.com/downloads/

2 1

[libvirt-users] So Close - Port forwarding in user mode.
by Rhys Ferris 03 Sep '18

03 Sep '18

People of the interwebs please help me! I am so close, but can't quite get it. I think due to my limited understanding of iptables. Here's what’s up: I'm trying to port forward from my host to a VM on usermode NAT with libvirt. Using the hook script provided on the wiki, it doesn't work (connection refused) but it if give the command "sudo iptables -t nat -D POSTROUTING -j MASQUERADE" the port forwarding works, but name resolution on my host breaks. I think maybe I need to be more specific in the Masquerade command, but I have no idea what to do. Here’s my iptables (without the above command): https://pastebin.com/J2vdKkLU The source interface is eno1 with an IP of 172.16.99.170 and the destination is virbr1 with a VM IP of 10.128.10.100 Thanks in advance! Rhys Sent from Mail for Windows 10

1 0

[libvirt-users] Snapshot overlay-file deletion
by Gionatan Danti 01 Sep '18

01 Sep '18

Hi list, issuing the command "virsh blockcommit --delete --pivot" (on a previously created external snapshot/overlay) returns an error regarding an unsupported flag warning stating "error: unsupported flags (0x2)". I need to manually "rm" the affected file after the blockcommit. A similar issue was reported many years ago here [1]. Am I missing something, or is the "--delete" flag not supported? Thanks. [1] https://bugzilla.redhat.com/show_bug.cgi?id=1001475 -- Danti Gionatan Supporto Tecnico Assyoma S.r.l. - www.assyoma.it email: g.danti(a)assyoma.it - info(a)assyoma.it GPG public key ID: FF5F32A8

2 2

[libvirt-users] Setting up port forwarding to guests on nat network
by Rhys Ferris 31 Aug '18

31 Aug '18

Hello all, I’m currently trying to figure out how to forward ports to guests that are on a NAT Network. I have followed the directions on https://wiki.libvirt.org/page/Networking under the “Forwarding Incoming Connections” Section and get connection refused when attempting to connect. System: Ubuntu Server 18.04.1 Virsh / LibVirtd Version: 4.0.0 Here’s the contents of /etc/libvirt/hooks/qemu #!/bin/bash # IMPORTANT: Change the "VM NAME" string to match your actual VM Name. # In order to create rules to other VMs, just duplicate the below block and configure # it accordingly. if [ "${1}" = "testy" ]; then # Update the following variables to fit your setup GUEST_IP='10.128.10.100' GUEST_PORT='22' HOST_PORT='2588' if [ "${2}" = "stopped" ] || [ "${2}" = "reconnect" ]; then /sbin/iptables -D FORWARD -o virbr0 -d $GUEST_IP -j ACCEPT /sbin/iptables -t nat -D PREROUTING -p tcp --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT fi if [ "${2}" = "start" ] || [ "${2}" = "reconnect" ]; then /sbin/iptables -I FORWARD -o virbr0 -d $GUEST_IP -j ACCEPT /sbin/iptables -t nat -I PREROUTING -p tcp --dport $HOST_PORT -j DNAT --to $GUEST_IP:$GUEST_PORT fi fi Here’s my network XML <network> <name>olympus</name> <uuid>3b0d968c-8166-42f7-8109-e5f0317cab42</uuid> <forward mode='nat'> <nat> <port start='1024' end='65535'/> </nat> </forward> <bridge name='virbr1' stp='on' delay='0'/> <mac address='52:54:00:bb:18:6b'/> <ip address='10.128.10.1' netmask='255.255.255.0'> <dhcp> <range start='10.128.10.2' end='10.128.10.254'/> <host mac='52:54:00:8d:f5:0c' name='testy' ip='10.128.10.100'/> </dhcp> </ip> </network> And here’s the results of iptables -L -vt nat: BEFORE VM BOOT: Chain PREROUTING (policy ACCEPT 46615 packets, 6618K bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 46615 packets, 6618K bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 198K packets, 18M bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 198K packets, 18M bytes) pkts bytes target prot opt in out source destination 24 1812 RETURN all -- any any 10.128.10.0/24 base-address.mcast.net/24 0 0 RETURN all -- any any 10.128.10.0/24 255.255.255.255 17 1020 MASQUERADE tcp -- any any 10.128.10.0/24 !10.128.10.0/24 masq ports: 1024-65535 15 1700 MASQUERADE udp -- any any 10.128.10.0/24 !10.128.10.0/24 masq ports: 1024-65535 0 0 MASQUERADE all -- any any 10.128.10.0/24 !10.128.10.0/24 22 1666 RETURN all -- any any 192.168.122.0/24 base-address.mcast.net/24 0 0 RETURN all -- any any 192.168.122.0/24 255.255.255.255 0 0 MASQUERADE tcp -- any any 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 8 1168 MASQUERADE udp -- any any 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 0 0 MASQUERADE all -- any any 192.168.122.0/24 !192.168.122.0/24 AFTER VM BOOT Chain PREROUTING (policy ACCEPT 2 packets, 120 bytes) pkts bytes target prot opt in out source destination 0 0 DNAT tcp -- any any anywhere anywhere tcp dpt:2588 to:10.128.10.100:22 Chain INPUT (policy ACCEPT 2 packets, 120 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 18 packets, 1263 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 18 packets, 1263 bytes) pkts bytes target prot opt in out source destination 24 1812 RETURN all -- any any 10.128.10.0/24 base-address.mcast.net/24 0 0 RETURN all -- any any 10.128.10.0/24 255.255.255.255 17 1020 MASQUERADE tcp -- any any 10.128.10.0/24 !10.128.10.0/24 masq ports: 1024-65535 15 1700 MASQUERADE udp -- any any 10.128.10.0/24 !10.128.10.0/24 masq ports: 1024-65535 0 0 MASQUERADE all -- any any 10.128.10.0/24 !10.128.10.0/24 22 1666 RETURN all -- any any 192.168.122.0/24 base-address.mcast.net/24 0 0 RETURN all -- any any 192.168.122.0/24 255.255.255.255 0 0 MASQUERADE tcp -- any any 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 8 1168 MASQUERADE udp -- any any 192.168.122.0/24 !192.168.122.0/24 masq ports: 1024-65535 0 0 MASQUERADE all -- any any 192.168.122.0/24 !192.168.122.0/24 And lastly heres what actually happens on attempt to SSH: rhys@odin:~$ ssh rhys(a)172.16.99.170 -p 2258 ssh: connect to host 172.16.99.170 port 2258: Connection refused rhys@odin:~$ The connection refused is instant, not a timeout. I’ve ensured that ufw is disabled. Any help appreciated. I just can’t figure this out. Sent from Mail for Windows 10

2 3

[libvirt-users] ceph rbd pool and libvirt manageability (virt-install)
by Jelle de Jong 29 Aug '18

29 Aug '18

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello everybody, I created a rbd pool and activated it, but I can't seem to create volumes in it with virsh or virt-install? # virsh pool-dumpxml myrbdpool <pool type='rbd'> <name>myrbdpool</name> <uuid>2d786f7a-2df3-4d79-ae60-1535bcf1c6b5</uuid> <capacity unit='bytes'>6997998301184</capacity> <allocation unit='bytes'>10309227031</allocation> <available unit='bytes'>6977204658176</available> <source> <host name='ceph01.powercraft.nl' port='6789'/> <host name='ceph02.powercraft.nl' port='6789'/> <host name='ceph03.powercraft.nl' port='6789'/> <name>libvirt-pool</name> <auth type='ceph' username='libvirt'> <secret uuid='029a334e-ed57-4293-bb99-ffafa8867122'/> </auth> </source> </pool> # virt-install --version 1.0.1 # virsh --version 1.2.9 I ended using virsh edit ceph-test.powercraft.nl and making creating the disk manually. <disk type='network' device='disk'> <auth username='libvirt'> <secret type='ceph' uuid='029a334e-ed57-4293-bb99-ffafa8867122'/> </auth> <source protocol='rbd' name='libvirt-pool/kvm01-storage'> <host name='ceph01.powercraft.nl' port='6789'/> <host name='ceph02.powercraft.nl' port='6789'/> <host name='ceph03.powercraft.nl' port='6789'/> </source> <target dev='vdc' bus='virtio'/> </disk> I use virt-install a lot to define, import and undefine domains, how can I use virt-install to manage my rdb disks? Kind regards, Jelle de Jong -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iJwEAQECAAYFAlV1xlQACgkQ1WclBW9j5HkbPQP+PjNrzvlqysslOp2Yk7wH4Mxy 2sh2dn96G0KOAHEeEn3BN6IWlnD1TADZbHdpTtMwkdv48Xwn0sP1s+3QDM4pb3gP n+z+dVxS8FouDIy/eiso3IBCj3g4TWbEX8ZHqs3jKqe0lZgAXBzB9xYSUowcEBrZ ddkPbr8p8ozWyOG+9V8= =lkK7 -----END PGP SIGNATURE-----

2 3