- Users - libvirt List Archives

[libvirt-users] vlan tagging for openVSwitch
by lejeczek 15 Mar '19

15 Mar '19

hi everyone, I'm trying to get vlans tagged in libvirt as my switch's end (yes traffic will be leaving the host and into network switches) allows only tagged vlans. But with network as such: ... <portgroup name='vlan-55'> <vlan trunk='yes'> <tag id='55'/> </vlan> </portgroup> </network> and guest as: <interface type='network'> <mac address='52:54:00:15:00:26'/> <source network='ovsbr0' portgroup='vlan-55'/> <model type='virtio'/> </interface> When the guest is fully initialized vSwitch shows: ... _uuid : b3c130db-fa84-49f8-9cf5-824ec8cf3b81 bond_downdelay : 0 bond_fake_iface : false bond_mode : [] bond_updelay : 0 external_ids : {} fake_bridge : false interfaces : [35c0a914-a21a-43d7-9f63-adacffbb62bc] lacp : [] mac : [] name : "ovsbr0" other_config : {} qos : [] statistics : {} status : {} tag : [] trunks : [] vlan_mode : [] No tags, no trunks, no vlan mode??? Is there something I missed (in docs though I sroogled exensively) ? I also tried to add mode='trunk' into <tag id='55'/> and virsh does not complains but next time I edit the guest the mode bit is gone. My vSwitch's bridge has only one phys iface (into the net switch) and I tried setting that iface with tag/no tag, with vlan_mode/no vlan_mode but if guest is up with above libvirt's vSwitch initialization then guest cannot ping net switch no matter the setting for phys iface. I'm on Centos 7.6 with libvirt-4.5.0-10.el7_6.4.x86_64 & openvswitch-2.0.0-7.el7.x86_64. What can be the problem here? many thanks, L.

2 1

[libvirt-users] KVM-Docker-Networking using TAP and MACVLAN
by Lars Lindstrom 15 Mar '19

15 Mar '19

Hi everyone! I have the following requirement: I need to connect a set of Docker containers to a KVM. The containers shall be isolated in a way that they cannot communicate to each other without going through the KVM, which will act as router/firewall. For this, I thought about the following simple setup (as opposed to a more complex one involving a bridge with vlan_filtering and a seperate VLAN for each container): +------------------------------------------------------------------+ | Host | | +-------------+ +----------------------+---+ | | KVM | | Docker +-> | a | | | +----------+ +----------+ +--------------+ +---+ | | | NIC lan0 | <-> | DEV tap0 | <-> | NET macvlan0 | <-+-> | b | | | +----------+ +----------+ +--------------+ +---+ | | | | +-> | c | | +-------------+ +----------------------+---+ | | +------------------------------------------------------------------+ NIC lan0: <interface type='direct'> <source dev='tap0' mode='vepa'/> <model type='virtio'/> </interface> *** Welcome to pfSense 2.4.4-RELEASE-p1 (amd64) on pfSense *** LAN (lan) -> vtnet0 -> v4: 10.0.20.1/24 DEV tap0: [root@server ~]# ip tuntap add tap0 mode tap [root@server ~]# ip l set tap0 up [root@server ~]# ip l show tap0 49: tap0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN mode DEFAULT group default qlen 1000 link/ether ce:9e:95:89:33:5f brd ff:ff:ff:ff:ff:ff [root@server ~]# virsh start pfsense [root@server opt]# ip l show tap0 49: tap0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN mode DEFAULT group default qlen 1000 link/ether ce:9e:95:89:33:5f brd ff:ff:ff:ff:ff:ff NET macvlan0: [root@server ~]# docker network create --driver macvlan --subnet=10.0.20.0/24 --gateway=10.0.20.1 --opt parent=tap0 macvlan0 CNT a: [root@server ~]# docker run --network macvlan0 --ip=10.0.20.2 -it alpine /bin/sh / # ping -c 4 10.0.20.1 PING 10.0.20.1 (10.0.20.1): 56 data bytes --- 10.0.20.1 ping statistics --- 4 packets transmitted, 0 packets received, 100% packet loss / # ifconfig eth0 Link encap:Ethernet HWaddr 02:42:0A:00:14:02 inet addr:10.0.20.2 Bcast:10.0.20.255 Mask:255.255.255.0 UP BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:4 errors:0 dropped:0 overruns:0 frame:0 TX packets:4 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:448 (448.0 B) TX bytes:448 (448.0 B) / # ip r default via 10.0.20.1 dev eth0 10.0.20.0/24 dev eth0 scope link src 10.0.20.2 CNT b: [root@server ~]# docker run --network macvlan0 --ip=10.0.20.2 -it alpine /bin/ping 10.0.20.1 PING 10.0.20.1 (10.0.20.1): 56 data bytes CNT c: [root@server ~]# docker run --network macvlan0 --ip=10.0.20.2 -it alpine /bin/ping 10.0.20.1 PING 10.0.20.1 (10.0.20.1): 56 data bytes The KVM is not reachable from within a Docker container (during the test firewalld was disabled) and vice versa. The first thing I noticed is that tap0 remains NO-CARRIER and DOWN, even though the KVM has been started. Shouldn't the link come up as soon as the KVM is started (and thus is connected to the tap0 device)? The next thing that looked strange to me - even though interface and routing configuration within the container seemingly looks OK, there are 0 packets TX/RX on eth0 after pinging the KVM (but 4 on lo instead). Any idea on how to proceed from here? Is this a valid setup and a valid libvirt configuration for that setup? Thanks and br, Lars

2 5

[libvirt-users] How to insert a dummy NIC
by wferi＠niif.hu 11 Mar '19

11 Mar '19

Hi, I have to host (with KVM) an appliance which does not use its second and third NIC. They have to be present in the guest, but they'd better stay totally disconnected from anything in the host. "Second" and "third" apparently means bus order. Let's consider virtio devices only. I think the best technical solution is adding -device virtio-net-pci,addr=0x3 and similar options to the KVM command line, without any corresponding -netdev options (better ideas welcome). QEMU emits "Warning: nic virtio-net-pci.2 has no peer" messages, but that's expected. I can even do this much using the <qemu:commandline> element, but libvirt assigns the 0x3 address to other virtio devices, leading to collision. Is there a way to "reserve" a bus address for such manually added devices without assigning explicit addresses to all other devices in the configuration? Things I also tried (and found inadequate): * Using "generic ethernet connection" for the dummy NICs. Close, but requires extra permissions for accessing /dev/net/tun, and technically feels a little inferior to using a peerless network device like above. * TCP tunnel server. Even more inferior, does not require extra permissions but leaves even looser ends (listening sockets). Also, the RelaxNG grammal does not let me specify a model for this interface type, so maintaining bus order with respect to the virtio interfaces is impossible. A grammar bug? * Using a dummy VLAN in the bridge. This is what I temporarily settled for, but this requires global agreement and still technically inferior, so I'd like to move away. * A <network> without forwarding. Still inferior, and also requires configuration sharing across the host cluster. -- Thanks, Feri

2 2

[libvirt-users] Obtaining the PID of a domain's QEMU process from C
by Shawn Anastasio 11 Mar '19

11 Mar '19

Hello all, I'm currently writing a C program that uses the libvirt API and I need a way to obtain the pid of a given domain's QEMU process. Specifically, I'm writing an ivshmem server that uses SO_PEERCRED to get the pid of clients that connect to it, and I would like to use that pid to look up the domain in libvirt to determine the proper domain ID to return to the client. As far as I can tell, libvirt doesn't expose this information in an easy to access manner. Of course it is possible to call `ps` and grep for the information I'm looking for, but I was hoping for a cleaner solution. If anybody knows how to do this, advice would be greatly appreciated. Thanks in advance, Shawn

7 10

[libvirt-users] Development of Libvirt PHP
by Maximilian Schieder 08 Mar '19

08 Mar '19

Hey, I want to ask if LibVirt PHP will be develop further or if it is deprecated. Kind regards, Maxi

4 3

[libvirt-users] why attach-disk can't be effective when the guest is booting
by Jianan Gao 07 Mar '19

07 Mar '19

Hi, When i use "virsh attach-device rhel disk.xml" when the guest is booting,then i can't find the disk in the guest after booting.But i can find it by "virsh domblklist rhel",and when i want to detach it from the guest and use "virsh detach-disk rhel vdb", i still can find the disk by "virsh domblklist rhel" The disk.xml is like: <disk type="file" device="disk"> <driver name='qemu' type='raw' cache='none'/> <source file="/var/lib/libvirt/images/foo.img"/> <target dev="vdb" bus="virtio"/> </disk> Libvirt-release is 5.0.0.4 and the qemu-kvm release is 3.1.0 So i want to know why it failed to attach-disk when booting,and why we design in this way.Maybe it's better to return failure if we can't use it like this.

2 1

[libvirt-users] virsh hangs when backup jobs run on the kvm host
by Zhan Adlun 07 Mar '19

07 Mar '19

Hi, Has anyone met the same problem that virsh hangs when there are some backup jobs running on the kvm host? I use dirty bitmap supported by qemu to do backups every 6 minitues. About a few hours later, I ran 'virsh list', It hung. Then I stopped the backup jobs ，nothing was getting better. I had checked the libvirt logs ，but found nothing useful . Maybe the high I/O caused the problem? or there are connection number limits when using virsh, because I use virsh to check the backup jobs are still running every 10 seconds? My os version is ' Ubuntu 12.04 LTS Release: 12.04 Codename: precise,Linux version 4.1.0-generic (gcc version 4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5) ) #1 SMP Wed Nov 9 02:04:23 CST 2016'. KVM version is 'QEMU emulator version 2.7.1(Debian 1:2.7+dfsg-3)'. Hoping for you reply. Thanks!

3 3

[libvirt-users] How do I close a console connection?
by Lars Kellogg-Stedman 05 Mar '19

05 Mar '19

I'm working on (re-) implementing serial console support in virtualbmc [1], and one of the issues I'm hitting right now is that after establishing a console connection via... self._stream = self._conn.newStream(libvirt.VIR_STREAM_NONBLOCK) self._domain.openConsole(None, self._stream, 0) ...I can't figure out how to close the console. Subsequent calls to openConsole fail because "a console connection is already open". I thought maybe I should close the stream, but that doesn't appear to be possible (there is a finish method, but it just tells me that "this function is not supported by the connection driver"). [1]: https://github.com/openstack/virtualbmc Cheers, -- Lars Kellogg-Stedman <lars(a)redhat.com> | larsks @ {irc,twitter,github} http://blog.oddbit.com/ |

2 1

[libvirt-users] libvirt 5.0.0 - LXC container still in "virsh list" output after shutdown
by mxs kolo 25 Feb '19

25 Feb '19

Hello. Centos 7.6 with libvirt build from base "virt" repository: libvirt-daemon-driver-lxc-5.0.0-1.el7.x86_64 libvirt-client-5.0.0-1.el7.x86_64 libvirt-daemon-5.0.0-1.el7.x86_64 libvirt-daemon-driver-network-5.0.0-1.el7.x86_64 libvirt-libs-5.0.0-1.el7.x86_64 + systemd-219-62.el7_6.2.x86_64 Now lxc containers with type='direct' can be started, but can't be stopped :) Before shutdown. # virsh list --all Id Name State ------------------------------------------ 16312 test.lxc running # machinectl | grep test lxc-16312-test.lxc container libvirt-lxc # pstree -apA 16312 libvirt_lxc,16312 --name test.lxc --console 42 --security=none --handshake 45 --veth macvlan0 |-systemd,16315 | |-agetty,16690 --noclear --keep-baud console 115200 38400 9600 vt220 | |-dbus-daemon,16659 --system --address=systemd: --nofork --nopidfile --systemd-activation | |-rsyslogd,17614 -n | | |-{rsyslogd},17616 | | `-{rsyslogd},17626 | |-sshd,17613 -D | |-systemd-journal,16613 | `-systemd-logind,16657 `-{libvirt_lxc},16319 Shutdown. # virsh shutdown 16312 Domain 16312 is being shutdown # echo $? 0 After. In list output still present: # virsh list --all Id Name State ------------------------------------------ 16312 test.lxc running # machinectl | grep test | wc -l 0 No main process: # ps axuwwf | grep libvirt_lxc | grep test | wc -l 0 LXC realy stopped, but only virsh still show it in list Cgroups "blkio, cpuacct, memory, cpu, cpu,cpuacct, devices, hugetlb, pids" deleted. But another cgroups still present in fs: drwxr-xr-x 2 root root 0 Jan 21 13:07 /sys/fs/cgroup/cpuset/machine.slice/machine-lxc\x2d16312\x2dtest.lxc.scope drwxr-xr-x 2 root root 0 Jan 21 13:07 /sys/fs/cgroup/freezer/machine.slice/machine-lxc\x2d16312\x2dtest.lxc.scope drwxr-xr-x 2 root root 0 Jan 21 13:07 /sys/fs/cgroup/net_cls/machine.slice/machine-lxc\x2d16312\x2dtest.lxc.scope drwxr-xr-x 2 root root 0 Jan 21 13:07 /sys/fs/cgroup/net_cls,net_prio/machine.slice/machine-lxc\x2d16312\x2dtest.lxc.scope drwxr-xr-x 2 root root 0 Jan 21 13:07 /sys/fs/cgroup/net_prio/machine.slice/machine-lxc\x2d16312\x2dtest.lxc.scope drwxr-xr-x 2 root root 0 Jan 21 13:07 /sys/fs/cgroup/perf_event/machine.slice/machine-lxc\x2d16312\x2dtest.lxc.scope Restarted libvirtd temporary place container in correct state: # systemctl restart libvirtd # virsh list --all | grep test - test.lxc shut off libvirt 4.5.0 and 4.10.0 perform correct LXC shutdown. b.r. Maxim Kozin

2 3

[libvirt-users] virsh confirmed edits do not persist
by Josh Mcneil 21 Feb '19

21 Feb '19

This may be user error, I am new to libvirt. I am using libvirt 5.0.0. I have created a VM (win10) in the system URI using virt-manager. I stopped the VM to edit it. I set my LIBVIRT_DEFAULT_URI="qemu:///system" and am able to read the domain configuration with `EDITOR=nano virsh edit win10`. When I save (ctrl+o) and exit (ctrl+x) I see the message "Domain win10 XML configuration edited." as expected. However, when I run the edit command again the changes do not appear to have persisted. I have tried starting and stopping the VM. I read that I may need to define the domain with virsh so I did that. None of these things seem to work. I would appreciate it if someone could help me solve this issue in order to be able to modify domains from virsh! Thanks in advance for any help! Josh

2 3