- Users - libvirt List Archives

Domain XML of a restored VM
by Tomáš Golembiovský 14 Jun '22

14 Jun '22

Hi, I am looking for clarification on what exactly is happening to the domain XML when resuming a suspended VM. We would like to make sure we don't lose any configuration and we also see some unexpected behavior. The VM with the name/UUID same as resumed VM may or may not already exist. If it does, what role does the original domain XML of a VM play when resuming? Is there any merging taking place between the existing domain XML and the domain XML stored in save image? Is the original XML simply thrown away and replaced? Is there any difference how the stored XML is treated compared to the XML passed in `virDomainRestoreFlags()`? I see some unexpected changes here. When I use `virDomainSaveImageGetXMLDesc()` to retrieve the stored XML and pass it unchanged to the `virDomainRestoreFlags()` the final domain XML is different then when `virDomainRestore()` is used or when `virDomainRestoreFlags()` with no `dxml` argument is used. We have: <graphics ... passwdValidTo='1970-01-01T00:00:01'> in the domain XML and the `passwdValidTo` argument disappears when domain XML is passed in `dxml` argument but it is preserved in other cases. Is this behavior expected? If yes, can we do anything to preserve the configuration? What other changes in domain XML can be expected? Thanks, Tomas -- Tomáš Golembiovský <tgolembi(a)redhat.com>

2 2

vepa-mode directly attached interface
by Gionatan Danti 14 Jun '22

14 Jun '22

Hi all, I just realized that libvirt default for directly attached interface is vepa mode. I discovered it now because virt-manager automatically enables bridge mode, while cockpit-machines get the default vepa mode. This is unfortunate because, being vepa switches very rare, it means that using cockpit to configure directly attached interfaces causes guests to not talk each other. I have some questions: - can libvirt default be changed/configured somehow (ie: to automatically create bridge-mode directly attached interface when no mode is specified)? - how can I use virsh to discover machines with vepa-mode interfaces (virsh domiflist <domain> does not return the interface mode)? - can I change the interface type at runtime (virt-xml <domain> --edit --network type=direct,source.mode=bridge works for inactive domains only)? Thanks. -- Danti Gionatan Supporto Tecnico Assyoma S.r.l. - www.assyoma.it email: g.danti(a)assyoma.it - info(a)assyoma.it GPG public key ID: FF5F32A8

3 4

[Libvirt][emulator-cores][dpdk] Emulatorpin cpuset best practices
by Laurent Dumont 07 Jun '22

07 Jun '22

Hey folks, I am curious to understand a bit more the core use of the emulatorpin CPUs with libvirt. For example : <vcpupin vcpu='0' cpuset='34'/> <vcpupin vcpu='1' cpuset='14'/> <vcpupin vcpu='2' cpuset='10'/> <vcpupin vcpu='3' cpuset='30'/> <emulatorpin cpuset='10,14,30,34'/> In this case : - The VM has 4 vCPUs. - Each of the core is pinned to a physical/thread core - 34,14,10,30 - The emulatorpin is also attached to the same physical CPUs. In our case : - Same setup for cores. - Running DPDK inside the virtual machine. - The compute/libvirt is using OVS but without DPDK. What we saw is the following : - DPDK is polling two cores at 100% to process packets. - From the compute metrics, we see USER %usage at 100% when the application starts. - From the compute metrics, as traffic increases, we see %SYSTEM going up. - As %SYSTEM goes up, %USER goes down. We are not quite sure, but we are wondering if this could cause a direct impact to the ability of DPDK to process traffic at the same X speed? - We can "live" move the emulator CPU to other cores. - This seems to be the recommended default setup for VNF/NFV deployments. Feels like I am missing a piece of the puzzle but gotta start somewhere! Thanks!

2 1

how to use "virsh shutdown domain --mode [initctl|signal|paravirt) ?
by Lentes, Bernd 01 Jun '22

01 Jun '22

Hi, ocasionally my Virtual Domains running on a pacmekaer cluster don't shutdown, although beeing told to do it. "virsh help shutdown" says: ... --mode <string> shutdown mode: acpi|agent|initctl|signal|paravirt How is it possible to use initctl or signal or paravirt ? What do i have to do ? What are the prerequisites ? Bernd -- Bernd Lentes System Administrator Institute for Metabolism and Cell Death (MCD) Building 25 - office 122 HelmholtzZentrum München bernd.lentes(a)helmholtz-muenchen.de phone: +49 89 3187 1241 fax: +49 89 3187 2294 http://www.helmholtz-muenchen.de/mcd Public key: 30 82 01 0a 02 82 01 01 00 b3 72 3e ce 2c 0a 6f 58 49 2c 92 23 c7 b9 c1 ff 6c 3a 53 be f7 9e e9 24 b7 49 fa 3c e8 de 28 85 2c d3 ed f7 70 03 3f 4d 82 fc cc 96 4f 18 27 1f df 25 b3 13 00 db 4b 1d ec 7f 1b cf f9 cd e8 5b 1f 11 b3 a7 48 f8 c8 37 ed 41 ff 18 9f d7 83 51 a9 bd 86 c2 32 b3 d6 2d 77 ff 32 83 92 67 9e ae ae 9c 99 ce 42 27 6f bf d8 c2 a1 54 fd 2b 6b 12 65 0e 8a 79 56 be 53 89 70 51 02 6a eb 76 b8 92 25 2d 88 aa 57 08 42 ef 57 fb fe 00 71 8e 90 ef b2 e3 22 f3 34 4f 7b f1 c4 b1 7c 2f 1d 6f bd c8 a6 a1 1f 25 f3 e4 4b 6a 23 d3 d2 fa 27 ae 97 80 a3 f0 5a c4 50 4a 45 e3 45 4d 82 9f 8b 87 90 d0 f9 92 2d a7 d2 67 53 e6 ae 1e 72 3e e9 e0 c9 d3 1c 23 e0 75 78 4a 45 60 94 f8 e3 03 0b 09 85 08 d0 6c f3 ff ce fa 50 25 d9 da 81 7b 2a dc 9e 28 8b 83 04 b4 0a 9f 37 b8 ac 58 f1 38 43 0e 72 af 02 03 01 00 01

2 2

Virtiofs xattr options on domain xml
by ksobrenat32 24 May '22

24 May '22

Hi! I have a debian 11 (bullseye) machine running libvirtd version 7.0.0 and a RHEL 9 virtual machine that I need to share a disk and though about virtiofs. The disk is a btrfs disk and I have successfully mount it with: <filesystem type='mount' accessmode='passthrough'> <driver type='virtiofs' queue='1024'/> <binary path='/usr/lib/qemu/virtiofsd' xattr='on'> <cache mode='always'/> <lock posix='on' flock='on'/> </binary> <source dir='/mnt/WD-Disk'/> <target dir='media'/> <alias name='fs0'/> <address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/> </filesystem> The problem I have is with selinux, when I try to change the context of a file inside the virtual machine I get a 'Operation not permitted' error, I can change the context in the Debian host and see the changes in the virtual machine but I would want to be able to change the context from the vm to able to use podman containers with selinux enabled. I see on the docs https://qemu.readthedocs.io/en/latest/tools/virtiofsd.html#selinux-support you can run virtiofsd with a xattr option so it is compatible with selinux but I do not find a way to change the domain xml to add this option, is there a way to add this option? Does a better option exists (maybe on the guest side)?

2 2

something (qemu?) is leaking
by lejeczek 23 May '22

23 May '22

Hi guys. I do a simple thing which should be easy to reproduce. -> $ virt-install -n rum1 --virt-type kvm --os-variant centos8 --memory $((4*1024)) --disk=/VMs3/rum1.qcow2,device=disk,bus=virtio --network network=10_3_1,model=virtio --graphics=listen=0.0.0.0 --cpu EPYC-Rome --vcpus 3 --cdrom /VMs3/CentOS-Stream-9-latest-x86_64-dvd1.iso During manual setup in the VM I set 'hostname' to something and when installation begins and disk config stage takes place I can see - and later when VM(c9s) is ready can confirm - that VG name is taken from another VM defined/running on the host. Host is c9s with: qemu-kvm-7.0.0-1.el9.x86_64 libvirt-daemon-8.2.0-1.el9.x86_64 5.14.0-86.el9.x86_64 Does anybody see this/similar? many thanks, L.

3 3

Slow VM start/revert, when trying to start/revert dozens of VMs in parallel
by Petr Beneš 20 May '22

20 May '22

Hi, my problem can be described simply: libvirt can't handle starting dozens of VMs at the same time. (technically, it can, but it's really slow.) We have an AMD machine with 256 logical cores and 1.5T ram. On that machine there is roughly 200 VMs. Each VM is the same: 8GB of RAM, 4 VCPUs. Half of them is Win7 x86, the other half is Win7 x64. VMs are using qcow2 as the disk image. These images reside in the ramdisk (tmpfs). We use these machines for automatic malware analysis, so our scenario consists of this cycle: - reverting VM to a running state - execute sample inside of the VM for ~1-2 minutes - shutdown the VM Of course, this results in multiple VMs trying to start at the same time. At first, reverts/starts are really fast - second or two. After about a minute, the "revertToSnapshot" suddenly takes 10-15 seconds, which is really unacceptable. For comparison, we're running the same scenarion on Proxmox, where the revertToSnapshot usually takes 2 seconds. Few notes: - Because of this fast cycle (~2-3 minutes) and because of VMs taking 10-15 seconds to start, there is barely more than 25-30 VMs running at once. We would really love to utilise the whole potential of such beast machine of ours, and have at least ~100 VMs running at any given time. - During the time running, the avg. CPU load isn't higher than 25%. Also, there's only about 280 GB of RAM used. Therefore, it's not limitation of our resources. - When the framwork is running and libvirt is making its best to start our VMs, I noticed that every libvirt operation is suddenly very slow. Even simple "virsh list [--all]" takes few seconds to complete, even though it finishes instantly when no VM is running/starting. I was trying to search for this issue, but didn't really find anything besides this presentation: https://events19.linuxfoundation.org/wp-content/uploads/2017/12/Scalability… However, I couldn't find those commits in your upstream. Is this a known issue? Or is there some setting I don't know of which would magically make the VMs start faster? As for steps to reproduce - I don't think there is anything special needed. Just try to start/destroy several VMs in a loop. There is even provided one-liner for that in the presentation above. ``` # For multiple domains: # while virsh start $vm && virsh destroy $vm; do : ; done # → ~30s hang ups of the libvirtd main loop ``` Best Regards, Petr

2 3

macvtap with disconnected physical interface
by Gionatan Danti 20 May '22

20 May '22

Dear list, I just discovered the hard way that if the lower lever physical interface of a macvlan bridge is disconnected (ie: by unplugging the eth cable, resulting in no carrier), inter-guest network traffic from all virtual machines bound to the disconnected interface is dropped. This behavior surprises me, as with the classic bridges I can disconnect the underlying physical interface without causing any harm to inter-guest traffic. Am I doing something wrong, or this really is the expected behavior? If so, can I force the macvtap interfaces to bridge traffic even when the underlying physical interface is disconnected? Regards. -- Danti Gionatan Supporto Tecnico Assyoma S.r.l. - www.assyoma.it email: g.danti(a)assyoma.it - info(a)assyoma.it GPG public key ID: FF5F32A8

4 8

Updating domains definitions via API
by Darragh Bailey 17 May '22

17 May '22

Hi, Looking into a bug in vagrant-libvirt where an error during the update will cause the domain to be completely discarded. https://github.com/vagrant-libvirt/vagrant-libvirt/issues/949 Basically I think it stems from doing an undefine -> create with XML new process, which if there is an issue with the new XML due to KVM module not loaded or something similar it will be rejected, but unfortunately it is also unlikely to allow the old definition to be restored either. I'm looking around to try and see if there is an API (specfically in ruby-libvirt) for updating the domain definition, so that if the new XML is rejected at least the old definition remains, and so far I'm drawing a blank. Is the only option here to write using a temporary domain name, then remove the old domain and rename the new definition to the old domain? Or have I missed the obvious API analogous to the edit functionality? -- Darragh Bailey "Nothing is foolproof to a sufficiently talented fool" - unknown

3 13

Problem calling 'virsh' in a script
by Digimer 16 May '22

16 May '22

3 4