- Users - libvirt List Archives

[libvirt-users] changing to cache='none' on the fly?
by W Kern 10 Jan '17

10 Jan '17

As is already well documented, we find that we need cache='none' to support migration, otherwise there is the chance of a hang and/or failure to pivot. However we prefer the default of cache=writethrough when operating in production. Our practice is to 'shutdown' the VM completely make the change with virsh edit, then restart. Then we have to repeat the process to revert back once we migrate. Is it possible to change that function on the fly and avoid the shutdown/start process? Note: we have had inconsistent results with virsh edit first and then a reboot. A complete shutdown seems to be necessary, but I am hoping there is some other procedure available. Our images are all qcow2 (1.1) Sincerely, W Kern PixelGate Networks

2 1

[libvirt-users] 回复： [libvirt] xml config nested
by 放牛班的春天 10 Jan '17

10 Jan '17

thanks your mail，now below： If the KVM supports nested VMX and QEMU starts with the arguments -enable-kvm and -cpu ..., + vmx, then the LOCK bit of the guest MSR_IA32_FEATURE_CONTROL and Enable VMX out of SMX operation bit will be set. Well, I should add -enable-kvm parameters of the document which xml position, Exactly speaking, how to amend xml configuration file? ------------------ 原始邮件 ------------------ 发件人: "Daniel P. Berrange";<berrange(a)redhat.com>; 发送时间: 2017年1月5日(星期四) 晚上8:53 收件人: "放牛班的春天"<446844717(a)qq.com>; 抄送: "libvirt-users"<libvirt-users(a)redhat.com>; 主题: Re: [libvirt] xml config nested NB, in future please don't CC all possible mailing lists at once. Just pick the most appropriate mailing list for your question. I've dropped libvirt-list & libvirt-announce from the CC, since this is a question most suited for libvirt-users. On Thu, Jan 05, 2017 at 11:44:29AM +0800, 放牛班的春天 wrote: > How to configure libvirt, so qemu-kvm support nested virtualization, virtual machine installed operating system is windows_7_ultimate_sp1_x64_dvd_618537.iso, configure libvirt xml file is as follows: > > <cpu mode='custom' match='exact'> > <model fallback='allow'>core2duo</model> > <feature policy='require' name='vmx'/> > </cpu> > > > or > > <cpu mode='host-model'> > <model fallback='allow'/> > </cpu> > > or > <cpu mode='host-passthrough'> > <topology sockets='2' cores='2' threads='2'/> > </cpu> Yes, that's the key guest configuration step - exposing the 'vmx' feature to the guest. In addition to that though, you need to make sure the kvm-intel kernel module in your host has the "nested=1" parameter set. eg in /etc/modprobe.d/kvm.conf you want options kvm_intel nested=1 If loaded correctly you should see # cat /sys/module/kvm_intel/parameters/nested Y if it says "N", then nested VMX will be disabled. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://entangle-photo.org -o- http://search.cpan.org/~danberr/ :|

1 0

[libvirt-users] xml config nested
by 放牛班的春天 10 Jan '17

10 Jan '17

How to configure libvirt, so qemu-kvm support nested virtualization, virtual machine installed operating system is windows_7_ultimate_sp1_x64_dvd_618537.iso, configure libvirt xml file is as follows: <cpu mode='custom' match='exact'> <model fallback='allow'>core2duo</model> <feature policy='require' name='vmx'/> </cpu> or <cpu mode='host-model'> <model fallback='allow'/> </cpu> or <cpu mode='host-passthrough'> <topology sockets='2' cores='2' threads='2'/> </cpu> We install libvirt in centos 7, qemu-kvm version is: [Root @ localhost libexec] # ./qemu-kvm --version QEMU emulator version 2.6.0 (qemu-kvm-ev-2.6.0-27.1.el7), Copyright (c) 2003-2008 Fabrice Bellard Above is the basic environment and libvirt configuration, but in this environment to install the internal implementation of the following windows7 virtual machine kernel interface calls are as follows: if (!FeatrueControlMsr.fields.enable_vmxon) { MyWriteFile(FileHanle, "Bios设置没有开启虚拟化\n", strlen("Bios设置没有开启虚拟化\n"), &ReturnLen); MyCloseFile(FileHanle); KdPrint(("Bios设置没有开启虚拟化")); return FALSE; } in conclusion: Through this kernel interface to determine the result is: Bios settings do not turn on virtualization How to solve this problem? Hope to get your help. thank you very much。

2 2

[libvirt-users] Regarding Migration Code
by Anubhav Guleria 09 Jan '17

09 Jan '17

Greetings, I was trying to understand the flow of Migration Code in libvirt and have few doubts: 1) libvirt talks to QEMU/KVM guests via QEMU API. So overall, in order to manage QEMU/KVM guests I can either use libvirt (or tools based on libvirt like virsh) or QEMU monitor. Is it so? 2) Since libvirt is Hypervisor neutral so actual migration algorithm(precopy or postcopy) is present in the hypervisor ,i.e. in case of QEMU it should be present in QEMU code base . I was going through the code starting from libvirt-domain api and not able to follow after virDomainMigrateVersion3Full(.....) . Kindly help. Thanks in advance. And sorry if that was too basic. Anubhav

2 2

[libvirt-users] libvirtError: block copy still active: disk not ready for pivot yet
by Ala Hino 05 Jan '17

05 Jan '17

Hi guys, When performing live merge, in few cases, we see the following exception: Traceback (most recent call last): File "/usr/lib/python2.7/site-packages/vdsm/utils.py", line 736, in wrapper return f(*a, **kw) File "/usr/share/vdsm/virt/vm.py", line 5278, in run self.tryPivot() File "/usr/share/vdsm/virt/vm.py", line 5247, in tryPivot ret = self.vm._dom.blockJobAbort(self.drive.name, flags) File "/usr/share/vdsm/virt/virdomain.py", line 68, in f ret = attr(*args, **kwargs) File "/usr/lib/python2.7/site-packages/vdsm/libvirtconnection.py", line 124, in wrapper ret = f(*args, **kwargs) File "/usr/lib/python2.7/site-packages/vdsm/utils.py", line 1313, in wrapper return func(inst, *args, **kwargs) File "/usr/lib64/python2.7/site-packages/libvirt.py", line 733, in blockJobAbort if ret == -1: raise libvirtError ('virDomainBlockJobAbort() failed', dom=self) libvirtError: block copy still active: disk 'vdb' not ready for pivot yet That exception observed in following BZs: https://bugzilla.redhat.com/1376580 https://bugzilla.redhat.com/1397122 I am trying to understand what this exception indicates in order to handle it appropriately when thrown by libvirt. Thanks, Ala

2 3

[libvirt-users] how to configure seabios with libvirt
by dw 05 Jan '17

05 Jan '17

Hi: Anyone knows how to configure seabios with libvirt? Or Can I configure seabios in XML file? I know that could configre seabios with "qemu-system-x86_64 -fw_cfg",but how to with libvirt? thanks! dw

2 1

[libvirt-users] Virsh Fail to Connect to Hypervisor
by Xu, Rongjie (Nokia - CN/Hangzhou) 04 Jan '17

04 Jan '17

Hi, I am upgrading libvirt from 1.2.9 to 2.0.0 and I have successfully make the libvirtd running. However, virsh cannot connect to hypervisor with following errors: virsh # connect error: failed to connect to the hypervisor root@node-55:/usr/local# virsh -c 'qemu:///system' connect error: failed to connect to the hypervisor error: no connection driver available for qemu:///system Can you give me some suggestion about where will be the problem. Thanks. libvirtd is running: root@node-55:/usr/lib/python2.7/dist-packages# ps aux | grep -i libvirtd root 1246963 0.0 0.0 1245780 3428 ? Ssl 06:04 0:00 /usr/sbin/libvirtd --config /etc/libvirt/libvirtd.conf -l Best Regards Xu Rongjie (Max) Mobile:18658176819

2 1

[libvirt-users] Default firewall rules and forwarding to a guest
by Omer Aldemir 04 Jan '17

04 Jan '17

Hello, I am trying to understand how libvirt firewall rules are loaded as I have firewalld and iptables services are disabled. Where is the configuration files for firewall and NAT rules for libvirt? How can I load default firewall rules if I mess things up Also I have realized that followings is default ACCEPT all -- 0.0.0.0/0 192.168.122.0/24 ctstate RELATED,ESTABLISHED but If I am to forward a port for a real IP to internal guest machine I need ACCEPT all -- 0.0.0.0/0 192.168.122.0/24 state NEW,RELATED,ESTABLISHED (NEW state is required) and also of course a forwarding rule iptables -t nat -I PREROUTING -p tcp --dport 3389 -j DNAT --to-destination 192.168.122.16:3389 Is there a place I can make this rules static with LibVirt (not playing with firewalld and/or iptables service for Centos 7) Regards.

2 3

[libvirt-users] how to modified virsh's editor forever?
by dw 29 Dec '16

29 Dec '16

Hi: when I modify VM's xml file,the editor is VI,how to set to other editor forever? Now I can change the editor to VIM from VI with setting environment EDITOR=$my-favorite-editor, but after rebooting,it is VI again. thanks

2 2

[libvirt-users] nwfilters seem fundamentally unusable or unfinished
by J Mo 28 Dec '16

28 Dec '16

Hello! I just spent the last four days working with nwfilters only to decide that they are apparently unusable. I've come to the mailing list seeking input on this subject. First off, please forgive my offensiveness. I'm sure people worked hard on nwfilters and it looks like a lot of effort went into providing this functionality. This is also an extremely difficult subject to get right in the many possible use cases, so I'm very sympathetic to how difficult it would be to try and implement this. However, the existing system didn't work out for me, I've found a number of other people who are saying the same thing (it didn't work out for them), and I don't see any hope continuing down the path of trying to make it work. For now, I've given up on nwfilters and I created a hook script that works with my existing iptables rules and applies network filter policies on specific VM/guests where needed. If you are doing extensive VM network filtering in your environment, how did you do it? I've listed a bunch of my gripes below. Please correct me if I've gotten anything wrong here. I'm new to nwfilters so maybe I overlooked something or I might just misunderstand the whole thing and could be totally wrong. The first and primary problem that I have with nwfilters are that the documentation is poor. There is very little documentation which exists, and that which does exist seems like it was spat out just to fulfill business requirements that some documentation be produced, rather than an effort into creating good usable documentation. I've run into large amounts of undocumented behavior and I don't feel like reading the source code any further to figure out what the intent of these tools were. My second big issue, and a clue very few people actually use nwfilters in the wild, is the low quantity of examples and how-to docs I found while googling. Complex examples just don't seem to exist. Further, of those complex examples I did find, people were often going down the route of creating their own hook script programs to replace nwfilters, indicating that this isn't just me. Additionally... I discovered that nwfilters do not play well with existing system iptables/ebtables rules. There is some good examples on this regarding Red Hat's firewalld and how libvirt's nwfilters does not play well together if you google around a little. It seems like this was just not considered in scope, or the assumption was that the local host would not have any existing iptables/ebtables rules and that libvirt would have complete control over the hypervisor host. There is no documented means of controlling where libvirt inserts it's rules into an existing set of rules, and libvirt creates numerous rules in both ebtables and iptables, making the problem even more complex. nwfilter seems to have been designed with a bias towards user-networking. I am using bridged interfaces, and some features and virsh commands don't apply to this mode of operation. I've been able to produce scenarios where nwfilter would abandon rules after changes had been made to running guests, and the only way I could get rid of them was manual intervention (iptables/ebtables -F -X). There is no command/control to apply an existing nwfilter to a running guest, or to remove/clear the existing nwfilters on a running guest. This item is a huge indication that this isn't a production-ready feature set. I think the worst problem I've run into, however, is that I was able to create very simple nwfilters that either broke networking of the hypervisor system (stopped all traffic), or failed to drop traffic which should have been dropped. I still don't understand why nwfilter is often creating rules in the ebtables "nat" table instead of the "filter" table, where they belong. That one right there is a huge WTF -- packets never get inspected because the rules are in the wrong table! In general, I found the output iptables/ebables rules that nwfilter generated often did not reflect the obvious intent of the rules that went into the nwfilter xml configuration. This abstraction layer produces unreliable and/or confusing results. I put a series of rules into a nwfilter xml file and the iptables/ebtables rules that I get out are insane. Nwfilter rules in = mystery meat out. Priorities are a huge WTF that caused me a lot of grief. Are rules going to be assembled in iptables/ebtables in the order which they are declared in XML? (this is undocumented) If so, why do priorities exist? (undocumented). What is the default priority? Is it zero? (undocumented). Want to create a filter rule that will log certain packets? Apparently there is no logging functionality at all. Can't be done. Anything beyond the most basic packet allow/drop (even reject was an afterthought) isn't supported by nwfilter rules. Thanks for reading

1 0