- Users - libvirt List Archives

[libvirt-users] libvirt and UEFI/SecureBoot
by Shmuel Melamud 16 Jul '18

16 Jul '18

Hi! I'm working currently on integration of UEFI/SecureBoot support into oVirt. And I have several questions about UEFI/SecureBoot support in libvirt. Can you please help me with them? For UEFI I add the following to the XML: <loader readonly="yes" secure="no" type="pflash"> /usr/share/OVMF/OVMF_CODE.secboot.fd </loader> <nvram template="/usr/share/OVMF/OVMF_VARS.fd"> /var/lib/libvirt/qemu/nvram/VM_UUID.fd </nvram> 1. Are all paths mandatory or there are some defaults? 2. If nvram image file is absent, libvirt creates it? 3. Is nvram image file only read or is it also written? 4. If nvram image file is present, is it used? Or removed and created again? 5. Is nvram image file used only on VM startup, or it must be present all the time the VM is running? Is it used on VM shutdown? 6. What happens if the VM is migrated at the moment when nvram image file is used? Is this file migrated also? 7. Is it enough to set secure="yes" to boot the VM with SecureBoot? Or I need to prepare the nvram somehow (install keys etc.)? 8. How to verify that the VM was indeed booted with UEFI? With SecureBoot? Shmuel

2 1

[libvirt-users] compile error libvirt-python 4.5.0 - error: unknown type name ?virNWFilterBindingPtr?
by Holger Schranz 11 Jul '18

11 Jul '18

Hello, I have tried to upgrade libvirt / libvort-python from 4.4.0 to 4.5.0 1) libvirt configure and install Compile and install of libvirt 4.5.0 complete without problems. Configure: ./configure -q --with-lxc --with-storage-iscsi --with-storage-scsi --with-interface --with-storage-lvm --with-storage-fs --with-udev --with-vmware --with-storage-mpath --prefix=/usr;make -j6 The following installation was successful: ETCSVMS3:~ # virsh version --daemon Compiled against library: libvirt 4.5.0 Using library: libvirt 4.5.0 Using API: QEMU 4.5.0 Running hypervisor: QEMU 2.12.0 Running against daemon: 4.5.0 ETCSVMS3:~ # 2) libvirt-python build and install this steps end with a compile error. Protocol: shl@ETCSVMS3:~/Install/libvirt-python-4.5.0> python setup.py build running build /usr/bin/pkg-config --print-errors --atleast-version=0.9.11 libvirt /usr/bin/python generator.py libvirt /usr/share/libvirt/api/libvirt-api.xml Found 446 functions in /usr/share/libvirt/api/libvirt-api.xml Found 0 functions in libvirt-override-api.xml Generated 365 wrapper functions /usr/bin/python generator.py libvirt-qemu /usr/share/libvirt/api/libvirt-qemu-api.xml Found 5 functions in /usr/share/libvirt/api/libvirt-qemu-api.xml Found 0 functions in libvirt-qemu-override-api.xml Generated 3 wrapper functions /usr/bin/pkg-config --atleast-version=1.0.2 libvirt /usr/bin/python generator.py libvirt-lxc /usr/share/libvirt/api/libvirt-lxc-api.xml Found 4 functions in /usr/share/libvirt/api/libvirt-lxc-api.xml Found 0 functions in libvirt-lxc-override-api.xml Generated 2 wrapper functions running build_py creating build/lib.linux-x86_64-2.7 copying build/libvirt.py -> build/lib.linux-x86_64-2.7 copying build/libvirt_qemu.py -> build/lib.linux-x86_64-2.7 copying build/libvirt_lxc.py -> build/lib.linux-x86_64-2.7 running build_ext building 'libvirtmod' extension creating build/temp.linux-x86_64-2.7 creating build/temp.linux-x86_64-2.7/build gcc -pthread -fno-strict-aliasing -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g -DNDEBUG -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g -DOPENSSL_LOAD_CONF -fwrapv -fPIC -I. -I/usr/include/python2.7 -c libvirt-override.c -o build/temp.linux-x86_64-2.7/libvirt-override.o In file included from libvirt-override.c:24:0: typewrappers.h:114:5: error: unknown type name ?virNWFilterBindingPtr? virNWFilterBindingPtr obj; ^ typewrappers.h:201:46: error: unknown type name ?virNWFilterBindingPtr? PyObject * libvirt_virNWFilterBindingPtrWrap(virNWFilterBindingPtr node); ^ error: command 'gcc' failed with exit status 1 shl@ETCSVMS3:~/Install/libvirt-python-4.5.0> ================================================================================ Best regards Holger --- Diese E-Mail wurde von Avast Antivirus-Software auf Viren geprüft. https://www.avast.com/antivirus

2 2

[libvirt-users] dmesg shows Intel Virt., lsmod shows kvm_intel; "Host does not [have] virt. options"
by Quincy Wofford 11 Jul '18

11 Jul '18

Hello, I've tried over at IRC and it appears the solution to this problem may not be obvious. I'm working with a Centos7 box on HP ProLiant 380p hardware. The BIOS is a bit outdated, but both Intel Virtualization Options and VT-d are present and enabled in the firmware. Some relevant command outputs below: -bash-4.2$ dmesg | grep Virtualization [ 1.299295] DMAR: Intel(R) Virtualization Technology for Directed I/O -bash-4.2$ lsmod | grep kvm kvm_intel 174841 0 kvm 578518 1 kvm_intel irqbypass 13503 1 kvm sudo virt-install --virt-type kvm --name <my name> --memory 8192 --cdrom <my path>/CentOS-7-x86_64-Everything-1708.iso --disk size=4 --os-variant rhel7 ERROR Host does not support any virtualization options I don't see any options to increase the verbosity of virt-install. Any ideas?

2 2

[libvirt-users] How about giving commit ID in release notes
by Han Han 09 Jul '18

09 Jul '18

Hello developers, Your release notes from libvirt(https://libvirt.org/news.html) are really helpful to our users and QAs. How about giving commit ID of each item in release notes, so that our user can gather more info from release notes. For example,in v4.5.0 release note, add commit ID on each item: capabilities: Provide info about host IOMMU support Capabilities XML now provide information about host IOMMU support. (commit dc34e7) Though we can seach them from git, it is more accurate doing by the authors. -- Best regards, ----------------------------------- Han Han Quality Engineer Redhat. Email: hhan(a)redhat.com Phone: +861065339333

3 2

[libvirt-users] Breaking a virtlockd lock?
by Steve Gaarder 04 Jul '18

04 Jul '18

I have several Qemu/kvm servers running VMs hosted on an NFS share, and am using virtlockd. (lock_manager = "lockd" in qemu.conf) After a power failure, one of the VMs will not start, claiming that it is locked. How do I get out of this? thanks, Steve Gaarder System Administrator, Dept of Mathematics Cornell University, Ithaca, NY, USA gaarder(a)math.cornell.edu

2 1

[libvirt-users] East-west traffic network filter
by Ales Musil 03 Jul '18

03 Jul '18

Hello, I would like to make filter that allows communication only between specified VMs. Those VMs should be specified by their MAC address. The filter should extend clean-traffic but I was not able to get it working with that reference. I have came up with modified clean-traffic which works fine [1]. Is there a way to achieve the same behavior with reference to clean-traffic? Thank you. Best wishes, Ales Musil [1] <filter name='clean-traffic-gateway'>  <filterref filter='no-mac-spoofing'/>  <filterref filter='no-ip-spoofing'/>  <filterref filter='no-arp-spoofing'/>  <rule action='accept' direction='inout' priority='-500'> <mac protocolid='arp'/> </rule>  <rule action='accept' direction='in'> <mac match='yes' srcmacaddr='$GATEWAY_MAC' srcmacmask='$GATEWAY_MAC_MASK' /> </rule>  <rule action='accept' direction='out'> <mac match='yes' dstmacaddr='$GATEWAY_MAC' dstmacmask='$GATEWAY_MAC_MASK' /> </rule>  <filterref filter='no-other-l2-traffic'/>  <filterref filter='qemu-announce-self'/> </filter> -- ALES MUSIL INTERN - rhv network Red Hat EMEA <https://www.redhat.com/> amusil(a)redhat.com IM: amusil <https://red.ht/sig>

3 5

[libvirt-users] Reintroduce "allocate entire disk" checkbox on virt-manager
by Gionatan Danti 28 Jun '18

28 Jun '18

Hi list, on older virt-manager versions (ie: what shipped with RHEL 6), a checkbox called "allocate entire disk" was selectable when configuring a new virtual machine. When checked, it means that the RAW disk image file was entirely allocated, generally issuing a fallocate() call. When unchecked, the disk image was a sparse file, with on-demand space allocation. On new virt-manager versions (ie: what ships with RHEL 7), the checkbox is gone. This means that for creating a sparse allocated file from within the "new vm" wizard, one is forced to use a Qcow2 file (selectable in the global preferences). No sparse RAM images can be created within such wizard. As a heavy consumer of RAW disk files, I would really like to have the checkbox back, especially in RHEL/CentOS 7.x Do you plan to reintroduce it? For RHEL/CentOS, should I open a Bugzilla ticket? Thanks. -- Danti Gionatan Supporto Tecnico Assyoma S.r.l. - www.assyoma.it email: g.danti(a)assyoma.it - info(a)assyoma.it GPG public key ID: FF5F32A8

3 9

[libvirt-users] Virtio-net drivers immune to Nethammer?
by procmem 26 Jun '18

26 Jun '18

Hi I'm a privacy distro maintainer investigating the implications of the newly published nethammer attack [0] on KVM guests particularly the virtio-net drivers. The summary of the paper is that rowhammer can be remotely triggered by feeding susceptible* network driver crafted traffic. This attack can do all kinds of nasty things such as modifying SSL certs on the victim system. * Susceptible drivers are those relying on Intel CAT, uncached memory or the clflush instruction. My question is, do virtio-net drivers do any of these things? *** [0] https://arxiv.org/abs/1805.04956

4 7

[libvirt-users] virsh error: domain is already quiesced
by Jérôme 25 Jun '18

25 Jun '18

Hi all. I'm having issues while creating snapshots. I posted on Stack Exchange [1], but figured I might get more success here. My VM backup script fails while creating the snapshot. virsh snapshot-create-as --domain machine_1 snap --diskspec vda,file=/srv/test/test-snap.qcow2 --disk-only --atomic --no-metadata --quiesce error: Requested operation is not valid: domain is already quiesced Even after a VM reboot, the system is still quiesced and I get the same error. I thought quiesce means FS freeze, but this makes no sense since I can still write to the FS when logged in the faulty VMs. And this would not survive a reboot, right? Could it be a communication issue that makes the host think the GA says the machine is quiesced while it is not? In any case, is there a command to enquire the quiesce state (apart from attempting a snapshot and see if I get an error)? Assuming the faulty VMs went quiesced after a unreproducible error, I could fix that by exiting quiesced state, whatever that means. Is there a virsh command to unquiesce the VM? The whole backup procedure used to work and now it fails on 2 VMs but still works on 2 others and I can't think of any relevant difference between them. Software versions: - Host is Debian Jessie with qemu-kvm 2.8+dfsg-3~bop8+1 from backports. - Guests are Debian Stretch with qemu-guest-agent 2.8+dfsg-6+deb9u4. (For the record, the backup script is on GitHub [2]. Basically, what it does is 1/ create snapshot, 2/ copy, 3/ commit snapshot.) If I remove the `quiesce` option from the snapshot command line, things work smooth. But obviously, this is not ideal. Thanks for any hint. [1] https://serverfault.com/questions/917247/virsh-error-domain-is-already-quie… [2] https://github.com/Nobatek/vmbackup/blob/master/vmbackup -- Jérôme

2 2

[libvirt-users] How libvirt interacts with dhcpd?
by Daniel. 20 Jun '18

20 Jun '18

Hi everybody, I'm using libvirt together with xCAT, on the same host, for testing purposes. xCAT install and manages dhcpd. How libvirt interacts with dhcpd? And if doens't how does the dhcp server of libvirt works, plus where I can find information on how to troubleshot it? Regards, -- “If you're going to try, go all the way. Otherwise, don't even start. ..." Charles Bukowski

2 6