- Users - libvirt List Archives

[libvirt-users] Disable certain VMs from being launched
by Sureshkumar Kaliannan 17 May '16

17 May '16

The VMs are launched using a pre-defined domain.xml + raw disk. All VMs (whitelisted + backlisted) ones are launched the same way (virsh define followed by virsh start) I want to be able to disable launching of certain VMs(blacklisted ones) unless explicitly allowed. What is the best way to accomplish this? I am exploring the selinux path for this requirement. The current implementation(understandably) isolates each guest into their own MCS categories but by default the resources are always relabeled. Unless, I change the libvirtd code, the auto relabelling can't be disabled(?) Still trying to understand the various virt selinux policies, and XML seclabel options to accomplish this. Are there better alternatives? thanks Suresh

1 0

[libvirt-users] How to set virtual pci slot address > 3 on creating VM?
by Eddie Yen 17 May '16

17 May '16

Hello everyone, this is my first time post this question at this mailing list. And I'm not so well in English, so apologize first if I got any sentence wrong or the question doesn't mean so well. OK, I'm now trying the KVMGT on QEMU and it works well even I didn't set any virtual display. For now KVMGT only can launch with QEMU command line, I know that libvirt didn't support it yet. So I have to set command line for KVMGT features in one of the shell script (i.e /usr/bin/kvm). The problem is, KVMGT set itself as VGA device, that means the default virtual PCI address gave from QEMU is 0000:00:02.0. If I set KVMGT feature command on shell script file (i.e -vga vgt), I will get this error while creating the VM from virt-manager. qemu-system-x86_64: -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x2: PCI: slot 2 function 0 not available for virtio-balloon-pci, in use by vgt-vga qemu-system-x86_64: -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x2: Device 'virtio-balloon-pci' could not be initialized So I have to create the VM without KVMGT first, then manually edit virtual PCI address to avoid 0000:00:02.0 But I want to make it automatically for each creation in some reasons. How can I do? And appreciate first for every reply. Many thanks, Eddie.

1 0

[libvirt-users] Nested Virtualization not working
by Daniel Sanabria 16 May '16

16 May '16

Hi, I wonder if someone can provide pointers on what might be wrong with my setup. I'm running a kvm host Fedora23 with rawhide kernel on top of a skylake cpu - Intel(R) Core(TM) i5-6260U CPU @ 1.80GHz (family: 0x6, model: 0x4e, stepping: 0x3) As part of an experiment, I have enabled Nested virt support on the host and created a fedora23 guest with virt-manager using host-passthrough as the cpu model. The guest comes up fine and was updated without issues. Now if I install VirtualBox 5.0 and try to start a vm (fedora 23 again) I end up with a protection fault in the console (below) and the vm does not boot. A similar fault appeared when trying with a centos7.2 guest and a ubuntu vm but in that case just after the fault the guest reboots itself. What could be the problem here? Any help is very appreciated. Thanks, Daniel [ 77.538312] general protection fault: 0000 [#1] SMP [ 77.539235] Modules linked in: ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink vboxpci(OE) vboxnetadp(OE) vboxnetflt(OE) ebtable_broute bridge stp llc ebtable_filter ebtable_nat ebtables ip6table_mangle ip6table_security ip6table_raw ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_filter ip6_tables iptable_mangle iptable_security iptable_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack snd_hda_codec_generic vboxdrv(OE) iosf_mbi kvm_intel snd_hda_intel kvm snd_hda_codec snd_hda_core snd_hwdep snd_seq snd_seq_device joydev snd_pcm ppdev irqbypass crct10dif_pclmul crc32_pclmul snd_timer snd acpi_cpufreq virtio_balloon parport_pc tpm_tis soundcore tpm i2c_piix4 parport nfsd auth_rpcgss nfs_acl lockd grace sunrpc xfs libcrc32c virtio_console virtio_net virtio_blk qxl drm_kms_helper ttm drm crc32c_intel serio_raw virtio_pci virtio_ring virtio ata_generic pata_acpi [ 77.548011] CPU: 0 PID: 1991 Comm: EMT Tainted: G OE 4.4.9-300.fc23.x86_64 #1 [ 77.548719] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.2-20150714_191134- 04/01/2014 [ 77.549715] task: ffff8800b4e8dd00 ti: ffff8800b4fdc000 task.ti: ffff8800b4fdc000 [ 77.550320] RIP: 0010:[<ffffffffa05ee506>] [<ffffffffa05ee506>] 0xffffffffa05ee506 [ 77.551053] RSP: 0018:ffff8800b4fdfd70 EFLAGS: 00050206 [ 77.551548] RAX: 00000000003406f0 RBX: 00000000ffffffdb RCX: 000000000000009b [ 77.552193] RDX: 0000000000000000 RSI: ffff8800b4fdfd00 RDI: ffff8800b4fdfcc8 [ 77.552952] RBP: ffff8800b4fdfd90 R08: 0000000000000004 R09: 00000000003406f0 [ 77.553498] R10: 0000000049656e69 R11: 000000000f8bfbff R12: 0000000000000020 [ 77.554042] R13: 0000000000000000 R14: ffffc90001c0207c R15: ffffffffa04c5220 [ 77.554594] FS: 00007fc70f128700(0000) GS:ffff88013fc00000(0000) knlGS:0000000000000000 [ 77.555208] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 77.555650] CR2: 00007fc70eecb000 CR3: 00000000ba695000 CR4: 00000000003406f0 [ 77.556195] Stack: [ 77.556360] 0000000000000000 ffffffff00000000 0000000000000000 0000000000000002 [ 77.556985] ffff8800b4fdfdb0 ffffffffa0603db1 ffffc90001c02010 ffff88013822f6d0 [ 77.557597] ffff8800b4fdfe30 ffffffffa048b2f6 ffff8800b4ebc5c0 ffff8800b4fdc000 [ 77.558210] Call Trace: [ 77.558421] [<ffffffffa048b2f6>] ? supdrvIOCtl+0x2d36/0x3250 [vboxdrv] [ 77.558964] [<ffffffff813c2e45>] ? copy_user_enhanced_fast_string+0x5/0x10 [ 77.559526] [<ffffffffa04845b0>] ? VBoxDrvLinuxIOCtl_5_0_20+0x150/0x250 [vboxdrv] [ 77.560133] [<ffffffff81241648>] ? do_vfs_ioctl+0x298/0x480 [ 77.560593] [<ffffffff81338393>] ? security_file_ioctl+0x43/0x60 [ 77.561081] [<ffffffff812418a9>] ? SyS_ioctl+0x79/0x90 [ 77.561503] [<ffffffff817a0f2e>] ? entry_SYSCALL_64_fastpath+0x12/0x71 [ 77.562033] Code: 88 e4 fc ff ff b9 3a 00 00 00 0f 32 48 c1 e2 20 89 c0 48 09 d0 48 89 05 f9 db 0e 00 0f 20 e0 b9 9b 00 00 00 48 89 05 d2 db 0e 00 <0f> 32 48 c1 e2 20 89 c0 b9 80 00 00 c0 48 09 d0 48 89 05 cb db [ 77.564260] RIP [<ffffffffa05ee506>] 0xffffffffa05ee506 [ 77.564701] RSP <ffff8800b4fdfd70> [ 77.565103] ---[ end trace 9cf480524482767b ]---

1 1

[libvirt-users] Guest still receive packet with vlan tag (SR-IOV transparent VLAN)
by Long Hoang 16 May '16

16 May '16

Hello everyone, I'm having problem with SR-IOV transparent VLAN. My host is Fedora 22 and my guest is: pfSense 2.3. The NIC is Intel 82576. I'm using pfSense Packet Capture to check the packet and find that inbound packet still have the vlan tag. The outbound packet seem fine because the router can receive DHCP discover packet from the guest and then send DHCP offer and ARP request packet to the guest (which still have the vlan tag so the guest does not response). Loading Ubuntu LiveCD in the same VM does not have this issue so I do not know what is the cause? Any idea to diagnose? Another problem I have is libvirt does not correctly restore the vf mac address to all zero and then some occasion, there will be duplicate mac address in different vfs which will trigger spoof checking. I found the related mail here https://www.redhat.com/archives/libvir-list/2015-December/msg00478.html which point to this bug https://bugzilla.redhat.com/show_bug.cgi?id=1302166 . The bug only mention to mellanox cards. Do anyone have the same problem (with igb/igbvf driver) ? Or is it fixed in upstream?

2 2

[libvirt-users] More recent libvirt builds for CentOS 7
by Le Nucksi 15 May '16

15 May '16

Hello list, is there a way to get more recent libvirt builds for CentOS 7 that include support for the xl (modern Xen) toolstack? I tried to build libvirt from the SRPM, which succeeded, however, without the mentioned Xen parts. I have also found two repos from people who provide upstream libvirt builds for CentOS 7, again, without the Xen parts. - https://copr.fedorainfracloud.org/coprs/jmliger/virt7-upstream/ and - https://build.opensuse.org/package/show/home:aevseev/libvirt Within the CentOS virtualization SIG builds for Xen there is a 1.3.x build of libvirt that includes support for the modern Xen toolstack. Would it be possible to inline this into the upstream to enable building it with Xen features on CentOS 7 such that the aforementioned people's RPMs would contain it? I appreciate any enlightment on the topic. Cheers, Le

2 2

[libvirt-users] More recent libvirt builds for CentOS 7
by Le Nucksi 15 May '16

15 May '16

Hello list, is there a way to get more recent libvirt builds for CentOS 7 that include support for the xl (modern Xen) toolstack? I tried to build libvirt from the SRPM, which succeeded, however, without the mentioned Xen parts. I have also found two repos from people who provide upstream libvirt builds for CentOS 7, again, without the Xen parts. - https://copr.fedorainfracloud.org/coprs/jmliger/virt7-upstream/ and - https://build.opensuse.org/package/show/home:aevseev/libvirt Within the CentOS virtualization SIG builds for Xen there is a 1.3.x build of libvirt that includes support for the modern Xen toolstack. Would it be possible to inline this into the upstream to enable building it with Xen features on CentOS 7 such that the aforementioned people's RPMs would contain it? I appreciate any enlightment on the topic. Cheers, Le

1 0

[libvirt-users] Connectivity between Guest and Host
by christopher＠padarom.io 14 May '16

14 May '16

Hello everyone, I have followed this guide to enable my Windows 10 guest to reach my Arch Linux host: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/ht… My VM now has 2 NICs: - macvtap (VEPA) - virtual network 'isolated' I have statically assigned the IP 192.168.254.2 to my guest. The host's IP is 192.168.254.1. The interface it is using on the host is *virbr1*. I am able to ping the host from the guest and vice versa, so the network connectivity seems to be generally working. To control my VM I'd like to use Synergy which I have already set up and tested successfully once with the VM as the Server, but never since. When I try to connect the Synergy client from the host to a server running on the guest, I get the error *"failed to connect to server: address not found for: 192.168.254.2"*. This is the result of nmap: [root@thearch ~]# nmap 192.168.254.0/30 Starting Nmap 7.12 ( https://nmap.org[1] ) at 2016-05-14 17:14 CEST Nmap scan report for 192.168.254.2 Host is up (0.0010s latency). Not shown: 995 filtered ports PORT STATE SERVICE 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 5357/tcp open wsdapi 24800/tcp open unknown MAC Address: 52:54:00:96:11:A9 (QEMU virtual NIC) Nmap scan report for 192.168.254.1 Host is up (0.0000040s latency). Not shown: 999 closed ports PORT STATE SERVICE 53/tcp open domain Nmap done: 4 IP addresses (2 hosts up) scanned in 5.16 seconds I also did nmap from a non-root user: [christopher@thearch ~]$ nmap 192.168.254.0/30 Starting Nmap 7.12 ( https://nmap.org[2] ) at 2016-05-14 17:17 CEST Nmap scan report for 192.168.254.1 Host is up (0.000073s latency). Not shown: 999 closed ports PORT STATE SERVICE 53/tcp open domain Nmap done: 4 IP addresses (1 host up) scanned in 1.26 seconds As you can see, the host 192.168.254.2 is only found when running nmap with root, not with my other user. Pinging the guest still works however. I suspect this is the core of the issue, but I don't know how to solve it. Any suggestions are appreciated. Thanks, Christopher Mühl Links: 1. https://nmap.org/ 2. https://nmap.org/

1 0

[libvirt-users] Connectiviity between Guest and Host
by christopher＠padarom.io 14 May '16

14 May '16

Hello everyone, I have followed this guide to enable my Windows 10 guest to reach my Arch Linux host: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/ht… My VM now has 2 NICs: - macvtap (VEPA) - virtual network 'isolated' I have statically assigned the IP 192.168.254.2 to my guest. The host's IP is 192.168.254.1. The interface it is using on the host is *virbr1*. I am able to ping the host from the guest and vice versa, so the network connectivity seems to be generally working. To control my VM I'd like to use Synergy which I have already set up and tested successfully once with the VM as the Server, but never since. When I try to connect the Synergy client from the host to a server running on the guest, I get the error *"failed to connect to server: address not found for: 192.168.254.2"*. This is the result of nmap: [root@thearch ~]# nmap 192.168.254.0/30 Starting Nmap 7.12 ( https://nmap.org ) at 2016-05-14 17:14 CEST Nmap scan report for 192.168.254.2 Host is up (0.0010s latency). Not shown: 995 filtered ports PORT STATE SERVICE 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 5357/tcp open wsdapi 24800/tcp open unknown MAC Address: 52:54:00:96:11:A9 (QEMU virtual NIC) Nmap scan report for 192.168.254.1 Host is up (0.0000040s latency). Not shown: 999 closed ports PORT STATE SERVICE 53/tcp open domain Nmap done: 4 IP addresses (2 hosts up) scanned in 5.16 seconds I also did nmap from a non-root user: [christopher@thearch ~]$ nmap 192.168.254.0/30 Starting Nmap 7.12 ( https://nmap.org ) at 2016-05-14 17:17 CEST Nmap scan report for 192.168.254.1 Host is up (0.000073s latency). Not shown: 999 closed ports PORT STATE SERVICE 53/tcp open domain Nmap done: 4 IP addresses (1 host up) scanned in 1.26 seconds As you can see, the host 192.168.254.2 is only found when running nmap with root, not with my other user. Pinging the guest still works however. I suspect this is the core of the issue, but I don't know how to solve it. Any suggestions are appreciated. Thanks, Christopher Mühl

1 0

[libvirt-users] libvirt + openvswitch, <parameters interfaceid='x'/> seems less-than-useful?
by Richard Harman 14 May '16

14 May '16

Hey folks, I'm working on setting up a Cuckoo sandbox malware lab at home, and can't seem to get openvswitch and libvirt to work together as-documented. I'm not subscribed to the list, so please reply-all. Thanks in advance! I've debugged this, and I think the interfaceid stuff in network XML isn't doing much besides setting a custom interfaceid in an OpenVSwitch table that really has no effect on the operation of OpenVSwitch. I think the -- set Interface vnet0 "external-ids:iface-id="{uuid here}" command run by libvirt doesn't actually set the _uuid of a new interface. :( It's just for an external system (e.g. libvirt) to track an interface *it* creates in OVS. I've got an OVS switch, "malware0" which is my malware lab network. I made a "monitor0" interface, and told OVS to make that a span/mirror of all the traffic on the malware0 switch. I attach monitor0 to my cuckoo VM, and boot the VM. Well, actually libvirt REALLY wants to create the interface itself, so I have to delete the monitor0 interface from OVS. I boot the VM, libvirt creates the monitor0 interface (with a different UUID) and it's not a span/mirror port any more. :( I had all the ports in the cuckoo VM <parameters interfaceid='{uuid here}'/>, but libvirt keeps deleting/creating ports and the OVS internal UUID changes, which means any setting applied in OVS (e.g. setting a port as a mirror) is lost during the add/delete cycle. With my cuckoo sandbox vm up: (no bfc10d05 UUID in ports, the mirror port UUID) # ovs-vsctl list bridge _uuid : 16847994-eb75-4e71-a913-50edd8a89252 mirrors : [bfc10d05-846e-4653-8417-27e1f648da93] name : "malware0" ports : [3931cb83-1f85-4fc8-880d-ffe299a85857, 6c6e3d97-d55b-4d55-8179-302412242664, 8eb4e13b-b5ea-4994-8e95-87d61db87ba6] With the cuckoo vm down: (393, 83b go away) # ovs-vsctl list bridge _uuid : 16847994-eb75-4e71-a913-50edd8a89252 mirrors : [bfc10d05-846e-4653-8417-27e1f648da93] name : "malware0" ports : [6c6e3d97-d55b-4d55-8179-302412242664] ... and lets bring up the cuckoo vm again: (only 6c6 remains) # ovs-vsctl list bridge _uuid : 16847994-eb75-4e71-a913-50edd8a89252 mirrors : [bfc10d05-846e-4653-8417-27e1f648da93] name : "malware0" ports : [1c09dd43-52d0-449b-81a2-537ddafb4966, 6c6e3d97-d55b-4d55-8179-302412242664, f90820f9-056f-47a3-bd51-c5190ad1df46]

2 3

[libvirt-users] dhcpd (via systemd) @boottime which does not wait for the interface..
by lejeczek 14 May '16

14 May '16

hi users I have my dhcpd to serve nothing but virbr0 (libvirt), OS is Centos 7.2 Dhcpd would not start, complaining like this: No subnet declaration for virbr0 (no IPv4 addresses). ** Ignoring requests on virbr0. If this is not what you want, please write a subnet declaration in your dhcpd.conf file for the network segment to which interface virbr0 is attached. ** ##SELECTION_END## and systemctl -l shows: ... systemd[1]: start request repeated too quickly for dhcpd.service ... but suffice to restart dhcpd and all works! I'v customized systemd's service conf, I've put: After=libvirtd.service Requisite=libvirtd.service but this did not help. Would you share your thoughts? Systemd list say it's libvirt (wrong)doing. many thanks. L.

2 5