- Users - libvirt List Archives

ecrypting image file breaks efi/boot of the guest/Ubuntu - ?
by lejeczek 20 Apr '23

20 Apr '23

Hi guys. I've have a guest and that guest differs from all other guest by: <os> <type arch='x86_64' machine='pc-q35-rhel9.0.0'>hvm</type> <loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> <nvram>/var/lib/libvirt/qemu/nvram/ubusrv1_VARS.fd</nvram> <boot dev='hd'/> <bootmenu enable='yes'/> </os> whereas everything else has: <os> <type arch='x86_64' machine='pc-q35-rhel9.0.0'>hvm</type> <boot dev='hd'/> <boot dev='cdrom'/> <bootmenu enable='yes'/> </os> Now, that different guest fails - as the only one - to start, to boot after its qcow2 image was luks-encrypted. Guest starts but says that: BdsDxe: failed to load Boot0001 "Uefi Misc Device" from PciRoot (0x0)/Pci(0x2,0x3)/Pci(0x0,0x0): Not found revert back to original, non-encrypted qcow2 image and all works a ok. All and any thoughts shared are much appreciated. many thanks, L.

2 7

which daemon/service for live migration - ?
by lejeczek 19 Apr '23

19 Apr '23

Hi guys. With this relatively new modular approach in libvirt - which service is needed in order to migrate guests via tcp? many thanks, L.

3 11

storage backup with encryption on-the-fly ?
by lejeczek 11 Apr '23

11 Apr '23

Hi guys. Is there a solution, perhaps a function of libvirt, to backup guest's storage and encrypt the resulting image file? On-the-fly ideally. If not ready/built-in solution then perhaps a best technique you recommend/use? I currently use 'backup-begin' on qcow2s, which are LUKS encrypted. many thanks, L.

2 4

Virtiofsd
by Simon Fairweather 06 Apr '23

06 Apr '23

Hi In QEMU 8 virtiofsd has been removed in favor of the rust version. Which includes options that are not longer supported, Do you have a view on what should be used going forwards to support virtiofsd in libvirt with qemu 8? The options are showing as depreciated, -o <compat-options>... Options in a format compatible with the legacy implementation [deprecated] Rust version options virtiofsd backend 1.5.1 Launch a virtiofsd backend. USAGE: virtiofsd [FLAGS] [OPTIONS] --fd <fd> --socket <socket> --socket-path <socket-path> FLAGS: --allow-direct-io Honor the O_DIRECT flag passed down by guest applications --announce-submounts Tell the guest which directories are mount points -d Set log level to "debug" [deprecated] -f Compatibility option that has no effect [deprecated] -h, --help Prints help information --killpriv-v2 Enable KILLPRIV V2 support --no-killpriv-v2 Disable KILLPRIV V2 support [default] --no-readdirplus Disable support for READDIRPLUS operations --posix-acl Enable support for posix ACLs (implies --xattr) --print-capabilities Print vhost-user.json backend program capabilities and exit --security-label Enable security label support. Expects SELinux xattr on file creation from client and stores it in the newly created file --syslog Log to syslog [default: stderr] -V, --version Prints version information --writeback Enable writeback cache --xattr Enable support for extended attributes OPTIONS: --cache <cache> The caching policy the file system should use (auto, always, never) [default: auto] -o <compat-options>... Options in a format compatible with the legacy implementation [deprecated] --fd <fd> File descriptor for the listening socket --inode-file-handles=<inode-file-handles> When to use file handles to reference inodes instead of O_PATH file descriptors (never, prefer, mandatory) - never: Never use file handles, always use O_PATH file descriptors. - prefer: Attempt to generate file handles, but fall back to O_PATH file descriptors where the underlying filesystem does not support file handles. Useful when there are various different filesystems under the shared directory and some of them do not support file handles. ("fallback" is a deprecated alias for "prefer".) - mandatory: Always use file handles, never fall back to O_PATH file descriptors. Using file handles reduces the number of file descriptors virtiofsd keeps open, which is not only helpful with resources, but may also be important in cases where virtiofsd should only have file descriptors open for files that are open in the guest, e.g. to get around bad interactions with NFS's silly renaming. [default: never] --log-level <log-level> Log level (error, warn, info, debug, trace, off) [default: info] --modcaps <modcaps> Modify the list of capabilities, e.g., --modcaps=+sys_admin:-chown --rlimit-nofile <rlimit-nofile> Set maximum number of file descriptors (0 leaves rlimit unchanged) [default: min(1000000, '/proc/sys/fs/nr_open')] --sandbox <sandbox> Sandbox mechanism to isolate the daemon process (namespace, chroot, none) [default: namespace] --seccomp <seccomp> Action to take when seccomp finds a not allowed syscall (none, kill, log, trap) [default: kill] --shared-dir <shared-dir> Shared directory path --socket <socket> vhost-user socket path [deprecated] --socket-group <socket-group> Name of group for the vhost-user socket --socket-path <socket-path> vhost-user socket path --thread-pool-size <thread-pool-size> Maximum thread pool size. A value of "0" disables the pool [default: 0] --xattrmap <xattrmap> Add custom rules for translating extended attributes between host and guest (e.g. :map::user.virtiofs.:) Regards Simon.

2 4

backup-begin
by André Malm 06 Apr '23

06 Apr '23

Hello, For some vms the virsh backup-begin sometimes shuts off the vm and returns "error: operation failed: domain is not running" although it was clearly in state running (or paused). Is the idea that you should guest-fsfreeze-freeze / virsh suspend before virsh backup-begin? I have tried with both with the same results. What could be causing the machine to shut off? Thanks, André

2 6

Xen with libvirt and SR-IOV
by nospam＠godawa.de 04 Apr '23

04 Apr '23

Hi everybody, since long time, I'm using Xen on CentOS with XL, currently latest CentOS 7 with Xen 4.15 from the CentOS-Xen-Project. For several VMs I have to use SR-IOV, to lower the CPU-usage on Dom0 on the host. CentOS 7 comes to an end, Xen is not supported by RHEL nor RockyLinux anymore, so unfortunately I have to switch to KVM. First step will be now, converting all the scripts for managing and running VMs, that they run with the additional libvirt-layer. Mostly everything is working, but I do not get a network interface in the VM, when I start it with "virsh start ..." instead of "xl create ...". First of all, is there documentation how to configure the VMs in the dom-definition for XEN (all docs I found are KVM-related)? The converted xl-config does not do the job: virsh -c xen:/// domxml-from-native --format xen-xl vm > vm.xml These are some none working examples I tried out: ... <interface type='hostdev' managed='yes'> <mac address='02:16:32:10:20:30'/> <driver name='xen'/> <source> <address type='pci' domain='0x0000' bus='0x81' slot='0x02' function='0x6'/> </source> <vlan> <tag id='11'/> </vlan> </interface> ... ... <hostdev mode='subsystem' type='pci' managed='yes'> <driver name='xen'/> <source> <address domain='0x0000' bus='0x81' slot='0x02' function='0x6'/> </source> <address type='pci' domain='0x0000' bus='0x81' slot='0x02' function='0x6'/> </hostdev> ... Result is always the same, the VM does not find any interface to configure, when starting as libvirt: # dmesg | egrep -i "net|eth" ... [ 4.523173] iavf: Intel(R) Ethernet Adaptive Virtual Function Network Driver - version 4.4.2.1 # lspci | egrep -i "net|eth" 00:00.6 Ethernet controller: Intel Corporation Ethernet Virtual Function 700 Series (rev 02) # lspci -vmmks 00:00.6 Slot: 00:00.6 Class: Ethernet controller Vendor: Intel Corporation Device: Ethernet Virtual Function 700 Series SVendor: Intel Corporation SDevice: Device 0000 Rev: 02 Module: i40evf Module: iavf NUMANode: 0 # lsmod | egrep -i "iavf|i40" iavf 135168 0 auxiliary 16384 1 iavf ptp 20480 1 iavf # ifconfig eth0 eth0: error fetching interface information: Device not found The same VM after starting with XL: # dmesg | egrep -i "net|eth" ... [ 4.742038] iavf: Intel(R) Ethernet Adaptive Virtual Function Network Driver - version 4.4.2.1 [ 40.578461] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready [ 40.642868] iavf 0000:00:00.6 eth0: NIC Link is Up Speed is 10 Gbps Full Duplex [ 40.644015] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready # lspci | egrep -i "net|eth" 00:00.6 Ethernet controller: Intel Corporation Ethernet Virtual Function 700 Series (rev 02) # lspci -vmmks 00:00.6 Slot: 00:00.6 Class: Ethernet controller Vendor: Intel Corporation Device: Ethernet Virtual Function 700 Series SVendor: Intel Corporation SDevice: Device 0000 Rev: 02 Driver: iavf Module: i40evf Module: iavf NUMANode: 0 # lsmod | egrep -i "iavf|i40" iavf 135168 0 auxiliary 16384 1 iavf ptp 20480 1 iavf # ifconfig eth0 eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 10.20.30.40 netmask 255.255.255.0 broadcast 10.20.30.1 ... ether 02:16:32:10:20:30 txqueuelen 1000 (Ethernet) I expect, that all the SR-IOV stuff is configured correctly, because the VMs runs in XL-mode without any problems. Thanks a lot for any ideas, -- kind regards, Thorolf

2 5

SR-IOV pool with static MAC address and vlan
by Paul B. Henson 03 Apr '23

03 Apr '23

I'm planning to set up a libvirt/kvm system using a card with SR-IOV support. I'd like to use the vf pool option rather than statically assigning a vf to each vm. However, I'd also like each vm to have a static MAC address and I have multiple VLANs they will be on. I found in the documentation a syntax for specifying a MAC and a vlan when the vf is statically assigned, but I don't see anything in the documentation about doing so when using a vf pool? Did I miss something? Is it possible to do so? If not, is there some other way to handle MAC addresses and vlans with a vf pool, or if you need those are you stuck with static assignment? Thanks much...

2 2

About libvirt domain dump state and persistent state
by Shen, Tao 30 Mar '23

30 Mar '23

Hi all, I use libvirt-go in my agent to attach rbd volumes. I ofen suffer the issue of incosistent of domain dump xml and domain persistent xml file. For example, when I try to attach volume, the the domain by “virConnectListAllDomains” api from libvirt tell me the vdf or 0x0a is empty, but when attach it with the vdf device or 0x0a address, qemu return the error duplicated with vdf or PCI address are double used: 2021-09-28T16:00:03.816682107-07:00 stderr F I0928 23:00:03.816558 1 cephvolume.go:73] attach disk &{XMLName:{Space: Local:} Device:disk RawIO: SGIO: Snapshot: Model: Driver:0xc00073b420 Auth:0xc000f49e40 Source:0xc000159860 BackingStore:<nil> Geometry:<nil> BlockIO:<nil> Mirror:<nil> Target:0xc000a58b40 IOTune:0xc00019b970 ReadOnly:<nil> Shareable:<nil> Transient:<nil> Serial:pvc-33003998-6624-4ac9-a923-d94f9401abdf WWN: Vendor: Product: Encryption:<nil> Boot:<nil> Alias:<nil> Address:0xc001420b40} error: virError(Code=27, Domain=20, Message='XML error: target 'vdf' duplicated for disk sources 'volume-0aab375c-1858-4f09-b276-ea297cd29a3d' and 'volume-63ef92c4-a027-476c-a2de-9fcf501dd4de'') I0330 00:28:55.070331 1 cephvolume.go:73] attach disk &{XMLName:{Space: Local:} Device:disk RawIO: SGIO: Snapshot: Model: Driver:0xc000024380 Auth:0xc006a51600 Source:0xc000640cd0 BackingStore:<nil> Geometry:<nil> BlockIO:<nil> Mirror:<nil> Target:0xc00342db80 IOTune:0xc005071c30 ReadOnly:<nil> Shareable:<nil> Transient:<nil> Serial:pvc-39c80157-0862-433c-a1ec-49475db818cf WWN: Vendor: Product: Encryption:<nil> Boot:<nil> Alias:<nil> Address:0xc000f5e240} error: virError(Code=27, Domain=20, Message='XML error: Attempted double use of PCI Address 0000:00:0a.0') In first case of “target 'vdf' duplicated” , I find the volume is in the dump xml by “virsh dumpxml” but not in the persistent xml at /etc/libvirt/qemu/xxx.xml or “virsh edit”. But the second case of “double use of PCI Address” I found the volume is on the persistent xml but not int the duml xml. I think there is a middle state that qemu try to attach or detach but not finished. But what is the api to get the different domain state except “virConnectListAllDomains”? The reversed case is that when I try to detach volume, the domain tell me the volume is allocated at vde, but I detach the volume with vde, it also return the error “vde not found”: I0330 00:38:54.615254 1 cephvolume.go:227] detach disk &{XMLName:{Space: Local:disk} Device:disk RawIO: SGIO: Snapshot: Model: Driver:0xc000736540 Auth:0xc0027b68a0 Source:0xc000641040 BackingStore:<nil> Geometry:<nil> BlockIO:<nil> Mirror:<nil> Target:0xc004557640 IOTune:0xc0006e4370 ReadOnly:<nil> Shareable:<nil> Transient:<nil> Serial:pvc-febae406-15ad-4d05-9c93-b2d09c197840 WWN: Vendor: Product: Encryption:<nil> Boot:<nil> Alias:<nil> Address:0xc00709cba0} error: virError(Code=9, Domain=10, Message='operation failed: disk vde not found') In this case, I found the volume is not in dump but in the persistent. All my volume api are use persistent operation. So I want to know 1. What is the state return by “virConnectListAllDomains” ? 2. What is the detail of state and how the state transition of qemu/libvirt? 3. Any way in libvirt api to get the different state of domain? Thanks, Tao

1 0

Option Flags
by Simon Fairweather 23 Mar '23

23 Mar '23

Hi Are the flags documented? can this function be used to specify same as virsh undefine --nvram "name of VM" libvirt_domain_undefine_flags($res, $flags) [Since version (null)] Function is used to undefine(with flags) the domain identified by it's resource. *@res [resource]*: libvirt domain resource, e.g. from libvirt_domain_lookup_by_*() *@flags [int]*: optional flags *Returns*: : TRUE for success, FALSE on error

3 3

virsh domifaddr --domain domname --source {lease, arp} not showing results with ipv6
by Natxo Asenjo 21 Mar '23

21 Mar '23

hi, I have configured a routed network on my laptop with a ipv6 subnet and dnsmasq is handing out ipv6 addresses to my vms and it works really wel, but finding out which ips have been used is not as easy as with ipv4. [root@lenovo ~]# virsh domifaddr --domain wec --source lease Name MAC address Protocol Address ------------------------------------------------------------------------------- [root@lenovo ~]# virsh domifaddr --domain wec --source arp Name MAC address Protocol Address ------------------------------------------------------------------------------- When using a ipv4 network, this works: root@lenovo ~]# virsh domifaddr --domain evenng --source arp Name MAC address Protocol Address ------------------------------------------------------------------------------- vnet2 52:54:00:4c:83:98 ipv4 192.168.122.229/0 [root@lenovo ~]# virsh domifaddr --domain evenng --source lease Name MAC address Protocol Address ------------------------------------------------------------------------------- vnet2 52:54:00:4c:83:98 ipv4 192.168.122.229/24 I can obviously look into the leases file and find out the address, but it would be nice to be able to use the virt tooling. This is on a fedora 37 running qemu-kvm-7.0.0-14.fc37.x86_64 and dnsmasq-2.89-1.fc37.x86_64, everything intalled from the fedora repositories. -- -- Groeten, natxo

2 4