- Users - libvirt List Archives

[libvirt-users] Default firewall rules and forwarding to a guest
by Omer Aldemir 04 Jan '17

04 Jan '17

Hello, I am trying to understand how libvirt firewall rules are loaded as I have firewalld and iptables services are disabled. Where is the configuration files for firewall and NAT rules for libvirt? How can I load default firewall rules if I mess things up Also I have realized that followings is default ACCEPT all -- 0.0.0.0/0 192.168.122.0/24 ctstate RELATED,ESTABLISHED but If I am to forward a port for a real IP to internal guest machine I need ACCEPT all -- 0.0.0.0/0 192.168.122.0/24 state NEW,RELATED,ESTABLISHED (NEW state is required) and also of course a forwarding rule iptables -t nat -I PREROUTING -p tcp --dport 3389 -j DNAT --to-destination 192.168.122.16:3389 Is there a place I can make this rules static with LibVirt (not playing with firewalld and/or iptables service for Centos 7) Regards.

2 3

[libvirt-users] how to modified virsh's editor forever?
by dw 29 Dec '16

29 Dec '16

Hi: when I modify VM's xml file,the editor is VI,how to set to other editor forever? Now I can change the editor to VIM from VI with setting environment EDITOR=$my-favorite-editor, but after rebooting,it is VI again. thanks

2 2

[libvirt-users] nwfilters seem fundamentally unusable or unfinished
by J Mo 28 Dec '16

28 Dec '16

Hello! I just spent the last four days working with nwfilters only to decide that they are apparently unusable. I've come to the mailing list seeking input on this subject. First off, please forgive my offensiveness. I'm sure people worked hard on nwfilters and it looks like a lot of effort went into providing this functionality. This is also an extremely difficult subject to get right in the many possible use cases, so I'm very sympathetic to how difficult it would be to try and implement this. However, the existing system didn't work out for me, I've found a number of other people who are saying the same thing (it didn't work out for them), and I don't see any hope continuing down the path of trying to make it work. For now, I've given up on nwfilters and I created a hook script that works with my existing iptables rules and applies network filter policies on specific VM/guests where needed. If you are doing extensive VM network filtering in your environment, how did you do it? I've listed a bunch of my gripes below. Please correct me if I've gotten anything wrong here. I'm new to nwfilters so maybe I overlooked something or I might just misunderstand the whole thing and could be totally wrong. The first and primary problem that I have with nwfilters are that the documentation is poor. There is very little documentation which exists, and that which does exist seems like it was spat out just to fulfill business requirements that some documentation be produced, rather than an effort into creating good usable documentation. I've run into large amounts of undocumented behavior and I don't feel like reading the source code any further to figure out what the intent of these tools were. My second big issue, and a clue very few people actually use nwfilters in the wild, is the low quantity of examples and how-to docs I found while googling. Complex examples just don't seem to exist. Further, of those complex examples I did find, people were often going down the route of creating their own hook script programs to replace nwfilters, indicating that this isn't just me. Additionally... I discovered that nwfilters do not play well with existing system iptables/ebtables rules. There is some good examples on this regarding Red Hat's firewalld and how libvirt's nwfilters does not play well together if you google around a little. It seems like this was just not considered in scope, or the assumption was that the local host would not have any existing iptables/ebtables rules and that libvirt would have complete control over the hypervisor host. There is no documented means of controlling where libvirt inserts it's rules into an existing set of rules, and libvirt creates numerous rules in both ebtables and iptables, making the problem even more complex. nwfilter seems to have been designed with a bias towards user-networking. I am using bridged interfaces, and some features and virsh commands don't apply to this mode of operation. I've been able to produce scenarios where nwfilter would abandon rules after changes had been made to running guests, and the only way I could get rid of them was manual intervention (iptables/ebtables -F -X). There is no command/control to apply an existing nwfilter to a running guest, or to remove/clear the existing nwfilters on a running guest. This item is a huge indication that this isn't a production-ready feature set. I think the worst problem I've run into, however, is that I was able to create very simple nwfilters that either broke networking of the hypervisor system (stopped all traffic), or failed to drop traffic which should have been dropped. I still don't understand why nwfilter is often creating rules in the ebtables "nat" table instead of the "filter" table, where they belong. That one right there is a huge WTF -- packets never get inspected because the rules are in the wrong table! In general, I found the output iptables/ebables rules that nwfilter generated often did not reflect the obvious intent of the rules that went into the nwfilter xml configuration. This abstraction layer produces unreliable and/or confusing results. I put a series of rules into a nwfilter xml file and the iptables/ebtables rules that I get out are insane. Nwfilter rules in = mystery meat out. Priorities are a huge WTF that caused me a lot of grief. Are rules going to be assembled in iptables/ebtables in the order which they are declared in XML? (this is undocumented) If so, why do priorities exist? (undocumented). What is the default priority? Is it zero? (undocumented). Want to create a filter rule that will log certain packets? Apparently there is no logging functionality at all. Can't be done. Anything beyond the most basic packet allow/drop (even reject was an afterthought) isn't supported by nwfilter rules. Thanks for reading

1 0

Re: [libvirt-users] Audio in Windows 10 VM is distorted. Using ALSA.
by Žilvinas Žaltiena 21 Dec '16

21 Dec '16

Hi, I found the main reason for sound distortions on my system is guest timer configuration. The working one is: <clock offset="localtime"> <timer name="hypervclock" present="yes"/> <timer name="hpet" present="no"/> <timer name="rtc" present="yes" track="guest" tickpolicy="delay"/> </clock> ... <qemu:commandline>a <qemu:arg value='-machine'/> <qemu:arg value='kernel_irqchip=on'/> <qemu:arg value='-cpu'/> <qemu:arg value='host,migratable=no,+invtsc,hv_time,+kvm_pv_eoi,hv_relaxed,hv_spinlocks=0x1fff,hv_vendor_id=nv_fuck_you!,kvm=off'/> </qemu:commandline> The important part here is "host,migratable=no,+invtsc". It gives guest the invariant TSC (CPU must support it). This is a bit of a hack. Everything, except migratable=no, can be configured through proper XML elements, however +invtsc requires migratable=no, and I don't know a way to pass it other than using qemu:arg. Note it completely overrides qemus -cpu parameter created from other tags. Don't paste my qemu:arg of it. Run your VM without it, check libvirt log, and copy from it what is passed to qemu as -cpu parameter, then add migratable=no,+invtsc. 2016-12-20 4:41 GMT+02:00 Manuel Ullmann <ullman.alias(a)posteo.de>: > Hi, > > I can’t seem to find a solution for my last VM issue. > I have distorted sound, when I play the Windows 10 device test > sound. Only the Windows sound is affected. Mpd of the host is playing just > fine > meanwhile. I am using ich9 as emulated card, which is detected and > installed correctly. The VM is using vfio-igd passthrough, so vnc or > spice are not used. > I tried to match the Windows driver configuration, which only supports > 16 bit output. I have a 24 bit USB headphone amplifier, which does not > support it (S32_LE only). Trying direct playback on the PCH card jack > did not help though. > > The headphone amplifier is connected via optical Toslink, so there is > standard snd_hda_intel output used (snd_usb_audio is not involved). > Passing the USB part through I get much clearer output, but still have > popping sounds. Googling around, they seem to be quite common on Windows > 10, although I had it working fine on two bare-metal machines. > > I have tried fixed settings matching the ones of the dmixed device > too. Don’t know, what is polled with enabled poll option. I also tried > sdl and pulseaudio, which did not help. For the latter not so surprising > since it is an Alsa pipe. The former was worse. > > The goal of this setup is having the same playlist state on both > systems and using the better audio framework for music playback (Windows > uses > too much software layers). Of course the popping sounds on audio device > passthrough also would be annoying, but that might be a different issue. > > Best regards, > Manuel > > used alsa device: > pcm.dmixed { > type asym > playback.pcm { > # See plugin:dmix at http://www.alsa-project.org/ > alsa-doc/alsa-lib/pcm_plugins.html > type dmix > > # Don't block other users, e.g. the Timidity midi-player > daemon > # http://www.alsa-project.org/ > alsa-doc/alsa-lib/pcm_plugins.html > ipc_key_add_uid false > > ipc_key 1025 > ipc_perm 0660 > ipc_gid audio > > # Don't put the rate here! Otherwise it resets the rate & > channels set below, as shown by: cat /proc/asound/card0/pcm0p/sub0/ > hw_params > slave { > # 2 for stereo, 6 for surround51, 8 for surround71 > channels 2 > pcm { > format S16_LE > #format S32_LE > > #rate 44100 > rate 48000 > > # http://www.alsa-project.org/ > alsa-doc/alsa-lib/pcm_plugins.html > # Maybe helps > nonblock true > type hw > card "PCH" > device 0 > subdevice 0 > } > > # mplayer2 chooses 1024 > # period_size 512 with buffer_size 16384 stops > crackling in xmame > # 320 breaks flash - https://bbs.archlinux.org/ > viewtopic.php?id=129458 > #period_size 512 > period_size 1024 > > # 4096 might make sound crackle > # mplayer2 chooses 8192. Half-Life 2 chooses 16384. > # If too large, use CONFIG_SND_HDA_PREALLOC_SIZE= > 2048 > buffer_size 8192 > } > } > capture.pcm "schneeball" > } > > libvirt xml snippets: > > <sound model='ich9'> > <address type='pci' domain='0x0000' bus='0x00' slot='0x09' > function='0x0'/> > </sound> > ... > <qemu:env name='QEMU_AUDIO_DRV' value='alsa'/> > <qemu:env name='QEMU_DAC_FIXED_SETTINGS' value='0'/> > <qemu:env name='QEMU_DAC_TRY_POLL' value='0'/> > <qemu:env name='QEMU_DAC_TIMER_PERIOD' value='0'/> > <qemu:env name='QEMU_DAC_BUFFER_SIZE' value='0'/> > <qemu:env name='QEMU_DAC_PERIOD_SIZE' value='0'/> > <qemu:env name='QEMU_DAC_DEV' value='dmixed'/> > > _______________________________________________ > libvirt-users mailing list > libvirt-users(a)redhat.com > https://www.redhat.com/mailman/listinfo/libvirt-users

2 1

[libvirt-users] how to create container image for an existing container
by WANG Cheng D 21 Dec '16

21 Dec '16

Dear all, I installed 8 containers using "yum --installroot=/root/fedora16lxc" to create the container filesystem. Now I want to manage these containers with openstack. So I need to deploy these containers by openstack which needs the container image. Can anyone tell me how to export my existing container's image? I am not sure if openstack can create container without an image file. And I don't want to use Docker. Thank you in advance. Cheng

1 0

[libvirt-users] Audio in Windows 10 VM is distorted. Using ALSA.
by Manuel Ullmann 21 Dec '16

21 Dec '16

Hi, I can’t seem to find a solution for my last VM issue. I have distorted sound, when I play the Windows 10 device test sound. Only the Windows sound is affected. Mpd of the host is playing just fine meanwhile. I am using ich9 as emulated card, which is detected and installed correctly. The VM is using vfio-igd passthrough, so vnc or spice are not used. I tried to match the Windows driver configuration, which only supports 16 bit output. I have a 24 bit USB headphone amplifier, which does not support it (S32_LE only). Trying direct playback on the PCH card jack did not help though. The headphone amplifier is connected via optical Toslink, so there is standard snd_hda_intel output used (snd_usb_audio is not involved). Passing the USB part through I get much clearer output, but still have popping sounds. Googling around, they seem to be quite common on Windows 10, although I had it working fine on two bare-metal machines. I have tried fixed settings matching the ones of the dmixed device too. Don’t know, what is polled with enabled poll option. I also tried sdl and pulseaudio, which did not help. For the latter not so surprising since it is an Alsa pipe. The former was worse. The goal of this setup is having the same playlist state on both systems and using the better audio framework for music playback (Windows uses too much software layers). Of course the popping sounds on audio device passthrough also would be annoying, but that might be a different issue. Best regards, Manuel used alsa device: pcm.dmixed { type asym playback.pcm { # See plugin:dmix at http://www.alsa-project.org/alsa-doc/alsa-lib/pcm_plugins.html type dmix # Don't block other users, e.g. the Timidity midi-player daemon # http://www.alsa-project.org/alsa-doc/alsa-lib/pcm_plugins.html ipc_key_add_uid false ipc_key 1025 ipc_perm 0660 ipc_gid audio # Don't put the rate here! Otherwise it resets the rate & channels set below, as shown by: cat /proc/asound/card0/pcm0p/sub0/hw_params slave { # 2 for stereo, 6 for surround51, 8 for surround71 channels 2 pcm { format S16_LE #format S32_LE #rate 44100 rate 48000 # http://www.alsa-project.org/alsa-doc/alsa-lib/pcm_plugins.html # Maybe helps nonblock true type hw card "PCH" device 0 subdevice 0 } # mplayer2 chooses 1024 # period_size 512 with buffer_size 16384 stops crackling in xmame # 320 breaks flash - https://bbs.archlinux.org/viewtopic.php?id=129458 #period_size 512 period_size 1024 # 4096 might make sound crackle # mplayer2 chooses 8192. Half-Life 2 chooses 16384. # If too large, use CONFIG_SND_HDA_PREALLOC_SIZE=2048 buffer_size 8192 } } capture.pcm "schneeball" } libvirt xml snippets: <sound model='ich9'> <address type='pci' domain='0x0000' bus='0x00' slot='0x09' function='0x0'/> </sound> ... <qemu:env name='QEMU_AUDIO_DRV' value='alsa'/> <qemu:env name='QEMU_DAC_FIXED_SETTINGS' value='0'/> <qemu:env name='QEMU_DAC_TRY_POLL' value='0'/> <qemu:env name='QEMU_DAC_TIMER_PERIOD' value='0'/> <qemu:env name='QEMU_DAC_BUFFER_SIZE' value='0'/> <qemu:env name='QEMU_DAC_PERIOD_SIZE' value='0'/> <qemu:env name='QEMU_DAC_DEV' value='dmixed'/>

2 1

[libvirt-users] virDomainBlockInfo for local volume
by Shahar Havivi 21 Dec '16

21 Dec '16

Hi, I am using virStorageVolGetInfo to get the volume size virStorageVol.download to download a normal file for VDSM project. I want to add support for block devices as well, I was able to see the size via virDomainBlockInfo and download via virDomain.blockPeek which is works fine for both file and block device. 1. Can I depend on virDomainBlockInfo for non block devices? 2. Does the virDomainBlockInfo return the correct physical size for normal file? 3. Performance wise do we have a difference between virStorageVol.download and virDomain.blockPeek? Assuming the VMs are down, this is the code I intend to use for all formats: vm = con.lookupByName(options.vmname) info = vm.blockInfo(src) physical = info[2] off = 0 size = 0 with open(dest, 'w+') as f: while off < physical: if (physical - off) < bufsize: size = physical - off else: size = bufsize buf = vm.blockPeek(src, off, size) f.write(buf) off += size

2 3

[libvirt-users] Trying virgl in fedora 25
by Gianluca Cecchi 14 Dec '16

14 Dec '16

Hello, I'm trying to test what found here: http://blog.wikichoon.com/2016/05/spice-openglvirgl-acceleration-on.html and here: https://www.kraxel.org/blog/tag/virgl/ My system is a fedora 25 laptop, born in version 23 and gradually updated to 24 and 25 now. I had a fedora 25 guest that worked ok with "normal"spice and I'm trying to configure with virgl Main components currently installed on host: qemu-kvm-2.7.0-7.fc25.x86_64 libvirt-2.2.0-2.fc25.x86_64 virt-manager-1.4.0-4.fc25.noarch VirtualGL-2.4-7.fc25.x86_64 Commands executed to modify configuration: [root@ope46 qemu]# virt-xml f25 --confirm --edit --video clearxml=yes,model=virtio,accel3d=yes --- Original XML +++ Altered XML @@ -94,8 +94,9 @@ <address type="pci" domain="0x0000" bus="0x00" slot="0x04" function="0x0"/> </sound> <video> - <model type="virtio" heads="1" primary="yes"/> - <address type="pci" domain="0x0000" bus="0x00" slot="0x02" function="0x0"/> + <model type="virtio"> + <acceleration accel3d="yes"/> + </model> </video> <redirdev bus="usb" type="spicevmc"> <address type="usb" bus="0" port="1"/> Define 'f25' with the changed XML? (y/n): y Domain 'f25' defined successfully. [root@ope46 qemu]# virt-xml f25 --confirm --edit --graphics clearxml=yes,type=spice,gl=on,listen=none WARNING qemu/libvirt version may not support spice GL --- Original XML +++ Altered XML @@ -86,9 +86,9 @@ </channel> <input type="mouse" bus="ps2"/> <input type="keyboard" bus="ps2"/> - <graphics type="spice" autoport="yes"> - <listen type="address"/> - <image compression="off"/> + <graphics type="spice" autoport="no"> + <gl enable="yes"/> + <listen type="none"/> </graphics> <sound model="ich6"> <address type="pci" domain="0x0000" bus="0x00" slot="0x04" function="0x0"/> Define 'f25' with the changed XML? (y/n): y Domain 'f25' defined successfully. [root@ope46 qemu]# I don't know if the WARNING above is a generic one or if it makes any pre-check to system... Anyway both from vrt-manager and virsh I get error [root@ope46 qemu]# virsh start f25 error: Failed to start domain f25 error: internal error: process exited while connecting to monitor: 2016-12-13T11:18:37.784324Z qemu-system-x86_64: egl: no drm render node available 2016-12-13T11:18:37.784375Z qemu-system-x86_64: Failed to initialize EGL render node for SPICE GL [root@ope46 qemu]# and this in /var/log/libvirt/qemu/f25.log: 2016-12-13 11:18:37.584+0000: starting up libvirt version: 2.2.0, package: 2.fc25 (Fedora Project, 2 016-11-14-21:04:29, buildvm-25.phx2.fedoraproject.org) qemu version: 2.7.0(qemu-2.7.0-7.fc25), host name: ope46.ceda.polimi.it LC_ALL=C PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin QEMU_AUDIO_DRV=spice /usr/bin/qemu-k vm -name guest=f25,debug-threads=on -S -object secret,id=masterKey0,format= raw,file=/var/lib/libvirt /qemu/domain-2-f25/master-key.aes -machine pc-i440fx-2.6,accel=kvm,usb=off,vmport=off -cpu Nehalem - m 4096 -realtime mlock=off -smp 1,sockets=1,cores=1,threads=1 -uuid d4c23620-b805-4656-9b97-d9d4ab9d ba63 -no-user-config -nodefaults -chardev socket,id=charmonitor,path=/ var/lib/libvirt/qemu/domain-2- f25/monitor.sock,server,nowait -mon chardev=charmonitor,id=monitor,mode=control -rtc base=utc,driftfix=slew -global kvm-pit.lost_tick_policy=discard -no-hpet -no-shutdown -global PIIX4_PM.disable_s3=1 -global PIIX4_PM.disable_s4=1 -boot strict=on -device ich9-usb-ehci1,id=usb,bus=pci.0,addr=0x6.0x7 -device ich9-usb-uhci1,masterbus=usb.0,firstport=0,bus=pci.0,multifunction=on,addr=0x6 -device ich9-usb-uhci2,masterbus=usb.0,firstport=2,bus=pci.0,addr=0x6.0x1 -device ich9-usb-uhci3,masterbus=usb.0,firstport=4,bus=pci.0,addr=0x6.0x2 -device virtio-scsi-pci,id=scsi0,bus=pci.0,addr=0x8 -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x5 -drive if=none,id=drive-ide0-0-0,readonly=on -device ide-cd,bus=ide.0,unit=0,drive= drive-ide0-0-0,id=ide0-0-0,bootindex=1 -drive file=/var/lib/libvirt/images/ f25.qcow2,format=qcow2,if=none,id=drive-scsi0-0-0-0 -device scsi-hd,bus=scsi0.0,channel=0,scsi-id=0,lun=0,drive=drive- scsi0-0-0-0,id=scsi0-0-0-0,bootindex=2 -netdev tap,fd=26,id=hostnet0 -device rtl8139,netdev=hostnet0,id=net0,mac=52:54:00:17:49:49,bus=pci.0,addr=0x3 -chardev pty,id=charserial0 -device isa-serial,chardev=charserial0,id=serial0 -chardev spicevmc,id=charchannel0,name=vdagent -device virtserialport,bus=virtio-serial0.0,nr=1,chardev= charchannel0,id=channel0,name=com.redhat.spice.0 -spice port=0,disable-ticketing,gl=on,seamless-migration=on -device virtio-vga,id=video0,virgl=on,bus=pci.0,addr=0x2 -device intel-hda,id=sound0,bus=pci.0,addr=0x4 -device hda-duplex,id=sound0-codec0,bus=sound0.0,cad=0 -chardev spicevmc,id=charredir0,name=usbredir -device usb-redir,chardev=charredir0,id=redir0,bus=usb.0,port=1 -chardev spicevmc,id=charredir1,name=usbredir -device usb-redir,chardev=charredir1,id=redir1,bus=usb.0,port=2 -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x7 -msg timestamp=on char device redirected to /dev/pts/1 (label charserial0) 2016-12-13T11:18:37.784324Z qemu-system-x86_64: egl: no drm render node available 2016-12-13T11:18:37.784375Z qemu-system-x86_64: Failed to initialize EGL render node for SPICE GL 2016-12-13 11:18:37.891+0000: shutting down What can I check? Any pre-requisite in laptop video adapter or other? Thanks in advance, Gialuca

2 1

Re: [libvirt-users] virsh not detecting hugepage mount; disabled by config?
by Manuel Ullmann 14 Dec '16

14 Dec '16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Thanks a lot you two, yes hugetlbfs is not mounted, when libvirtd is started… It was a long night. Did put it to fstab and since I do not allocate them on regular boots, it won’t eat my ram (that was the main consideration for doing it like this). As a last means before going to sleep, I added <qemu:arg value='-numa'/> <qemu:arg value='node,memdev=mem42'/> <qemu:arg value='-object'/> <qemu:arg value='memory-backend-file,size=6G,mem-path=/var/lib/hugetlbfs,share=on,id=mem42'/> to the xml which worked too (surprise), but I have it working now in the intended way. Then I never got to the last part of the qemu.conf option comment so I had to do another 3 reboots. Well, reading helps. So the fstab entry reads now: hugetlbfs /var/lib/hugetlbfs/libvirt/qemu hugetlbfs relatime,rw,pagesize=1073741824 0 0 with /var/lib/hugetlbfs being the mount point in qemu.conf. At least I didn’t forget to create the mount point before rebooting. Best regards, Manuel > Hi, > > I use gentoo with desktop+systemd profile to run Windows 10 VM with pci > passthrough and hugetlbs. > > Things I had to do for hugetlbs: > 1) Made sure their support was enabled in kernel > 2) Passed parameters for their allocation to kernel. There are other > ways, but I use 1GB page size and I have to allocate them before memory > gets fragmented. Note, you do that with hugepages=3072. > 3) Passed hugetlbs settings to libvirt VM domain (XML). > > That is it. I don't mount them myself. I think (can't check now) they > are automounted to /dev/hugetlbs. By default, libvirtd runs as root, and > qemu as user qemu. Consuming hugetlb and releasing them should be > transparent. > > I suggest starting without softlevel=qemuvm into default runlevel, and > then check /proc/meminfo. Hugetlbs total and free should be > 0. Do the > same with qemuvm runlevel. Maybe this runlevel misses something. > > On 2016-12-14 00:05, Manuel Ullmann wrote: >> Hi, >> >> I’m struggling with virsh not detecting my hugepage mount. >> >> I have the following kernel command line: >> BOOT_IMAGE=/vmlinuz-4.8.13-gentoo root=/dev/mapper/gensd-gentoo ro quiet >> splash intel_iommu=on video=efifb:off,vesafb:off,simplefb:off >> splash=verbose,theme:livedvd-aurora kvm.ignore_msrs=1 >> transparent_hugepage=never hugepages=3072 softlevel=qemuvm >> >> My startup script outputs the following: >> hugetlbfs /var/lib/hugetlbfs hugetlbfs >> rw,relatime,pagesize=2097152,uid=77,gid=77,mode=0770 0 0 >> [2016.12.13 22:22:50 virsh 2808] ERROR Failed to start domain win10 >> [2016.12.13 22:22:50 virsh 2808] ERROR internal error: hugetlbfs >> filesystem is not mounted or disabled by administrator config >> virsh was unsuccessful >> >> So hugetlbfs is definitively mounted, but virsh does either not detect >> it or some magical option, that I’ve not found in a day searching for >> it, disables it (the documentation could explain that better). Since the >> Ubuntu guys refer to the KVM_HUGEPAGES environment, I tried adding it to >> start-stop-daemon environment, but it seems non-relevant. 77 is the qemu >> user id, but I’m quite sure the permission issues were excluded (tried >> root permissions as well). Besides I had permission errors occasionally >> occasionally and don’t have them anymore. If you could provide a hint to >> the magical administrator configuration option, that would be helpful. >> Tried hugeadm as well, pointing the config to the correct destination. >> >> Thanks in advance, >> Manuel >> >> PS: >> The virsh script reads like this: >> #!/bin/sh >> cmdline="$(cat /proc/cmdline)" >> if [[ "${cmdline##* }" == "softlevel=qemuvm" ]]; then >> mount -o rw,relatime,pagesize=2097152,uid=77,gid=77,mode=0770 -t >> hugetlbfs hugetlbfs /var/lib/hugetlbfs >> sysctl kernel.shmmax=6442450944 >> cat /proc/mounts | grep hugetlb >> /var/log/virsh.log >> sed -i -e '/^hugetlb/{s/^/\#/}' /etc/libvirt/qemu.conf >> counter=0 >> while [ "${counter}" -lt 10 && ! -S /var/run/libvirt/libvirt-sock ]; do >> sleep 1 >> counter=$(( ++counter )) >> done >> if [ $counter -gt 9 ]; then >> echo "libvirtd socket generation timed out" >> /var/log/virsh.log >> fi >> if pidof libvirtd &>/dev/null; then >> LC_ALL=C /usr/bin/virsh -l /var/log/virsh.log start win10 >> if [ $? -gt 0 ]; then >> echo "virsh was unsuccessful" >> /var/log/virsh.log >> reboot >> fi >> else >> echo "libvirtd is not started" >> /var/log/virsh.log >> reboot >> fi >> fi >> >> reboot is more convenient, since this is a vfio-igd passthrough vm. >> >> >> _______________________________________________ >> libvirt-users mailing list >> libvirt-users(a)redhat.com >> https://www.redhat.com/mailman/listinfo/libvirt-users >> -----BEGIN PGP SIGNATURE----- iQQcBAEBCAAGBQJYUVAKAAoJELgK9xQKkpX6sTof/2fdLX9qjiNgecKEIzHKEjBY ln6o7E0nMY796Jf3HQ/v620uVZS3Nf4dRSFC9NVetzAgVcQizwko0ikVDsaCZlNP 5HojcRm2SK8c5CgU/ZLdLPp73PgrORtKYytYldhPQFebgOpNCJGzWAPXGnoLK78s aHsKGKb5R79+K2Bq5DAQGR5N9wiV84Oi+afNjBunjj1dT+80YPAAtXuRKkDdD3lQ hVBEdzgRLWW48FdEhIp2TlTJCyx4OwMGnIXaOPXrQSyMW6Omn49ZXYqwIgsOW45S bzFZ4BPuqhrANne4YDPjuxwtL65YUKAyHZWl/bTBmqkFrpjecxYDnlg219t2KsiM k3W9GQ0CWR74f0lJLULaV+ome13ydga5pDRe6+dyi7g0O7/4DTPuxQTRo07UiA/i dQmvtzTAbGdSpGqyFBQqIFGMG4sB8kypXp1PIK06jX1Muon6WCdzAzt1IztLeuSW qUj/srdnD9rLWWPlIV2NCZ3E5Da4szRD8gbhNIG2hg+Ss50pLdIFwlUbfksryY7B B6L6KmpOw4LrpCZVFBeFhG5lFns9YSvYNKvSBRwJaxl838j8Kr8B1bo51nMYERL1 wJXK9IyFqx8jkbmFvfwXij5lx3DFBrLEQwymGmaLmJ4FQmnA9491L2F3K+NyG8kX Yi/w+Xh9ZARoRy8/2SmVYwvB1vZkFpf04adocHxIYMT1P3ZLpCktu3P/DMdkdR26 DcnQedl7qbf7NeldxMiY0zTAti85VFuQggFQlRrB36pRdOXvFMk3mNLBiifICNvP 32sTl/9HnmscWCTSebmK/KjQjrLf9ijbc3V942WziwkEyDbOhfTUn0JfcZJl0FdM OQ0j00t5wv14KFPP/hpWqRiypwXpboHLpB4k718NZElObUOob0ziz6PJc5iCzJDW AkNbO1sEDgWN/pPorAYKPtre3TV6qk/k6A13zgNmMdZA4ZHRq6dsZLzCLnEaLwJE G5WFveDyi4COVpelysArTPrw6aL4LAzIhkRN5A5YCANgsPtnhjql6XmL3sTSN93Z R42klgPKNZVq5Bkdp2EpE70X+F/4j2jhRNznVp3YDU+6q6aNWHdqw7jCAhEji0aA 49gR3tIUgXp1883zc0vSFIMnCwYQQoCjqGpVZXWLtbxAmJrz5c4XeUCnpplfJW3Z jRS19MEy6HgKmdkq1a4bRG5XFc87Ga2JWqwSXpGb1EsMvyMU3CQq47D98WqaeC9p JTOuLMpYvlH+EEbEkL/deysLGVZ7QDTr5P4L+wOzN9jhSOrnIoNlVU5DVP7dhT2L z1d3UY3cFhoVFLKyfbLF+flK7Y5aygQ/eO/+MlXmd9TI+2qTVehNSXiYTEnnsO0= =1DU1 -----END PGP SIGNATURE-----

1 0

[libvirt-users] virsh not detecting hugepage mount; disabled by config?
by Manuel Ullmann 14 Dec '16

14 Dec '16

Hi, I’m struggling with virsh not detecting my hugepage mount. I have the following kernel command line: BOOT_IMAGE=/vmlinuz-4.8.13-gentoo root=/dev/mapper/gensd-gentoo ro quiet splash intel_iommu=on video=efifb:off,vesafb:off,simplefb:off splash=verbose,theme:livedvd-aurora kvm.ignore_msrs=1 transparent_hugepage=never hugepages=3072 softlevel=qemuvm My startup script outputs the following: hugetlbfs /var/lib/hugetlbfs hugetlbfs rw,relatime,pagesize=2097152,uid=77,gid=77,mode=0770 0 0 [2016.12.13 22:22:50 virsh 2808] ERROR Failed to start domain win10 [2016.12.13 22:22:50 virsh 2808] ERROR internal error: hugetlbfs filesystem is not mounted or disabled by administrator config virsh was unsuccessful So hugetlbfs is definitively mounted, but virsh does either not detect it or some magical option, that I’ve not found in a day searching for it, disables it (the documentation could explain that better). Since the Ubuntu guys refer to the KVM_HUGEPAGES environment, I tried adding it to start-stop-daemon environment, but it seems non-relevant. 77 is the qemu user id, but I’m quite sure the permission issues were excluded (tried root permissions as well). Besides I had permission errors occasionally occasionally and don’t have them anymore. If you could provide a hint to the magical administrator configuration option, that would be helpful. Tried hugeadm as well, pointing the config to the correct destination. Thanks in advance, Manuel PS: The virsh script reads like this: #!/bin/sh cmdline="$(cat /proc/cmdline)" if [[ "${cmdline##* }" == "softlevel=qemuvm" ]]; then mount -o rw,relatime,pagesize=2097152,uid=77,gid=77,mode=0770 -t hugetlbfs hugetlbfs /var/lib/hugetlbfs sysctl kernel.shmmax=6442450944 cat /proc/mounts | grep hugetlb >> /var/log/virsh.log sed -i -e '/^hugetlb/{s/^/\#/}' /etc/libvirt/qemu.conf counter=0 while [ "${counter}" -lt 10 && ! -S /var/run/libvirt/libvirt-sock ]; do sleep 1 counter=$(( ++counter )) done if [ $counter -gt 9 ]; then echo "libvirtd socket generation timed out" >> /var/log/virsh.log fi if pidof libvirtd &>/dev/null; then LC_ALL=C /usr/bin/virsh -l /var/log/virsh.log start win10 if [ $? -gt 0 ]; then echo "virsh was unsuccessful" >> /var/log/virsh.log reboot fi else echo "libvirtd is not started" >> /var/log/virsh.log reboot fi fi reboot is more convenient, since this is a vfio-igd passthrough vm.

2 1

[libvirt-users] Kernel panic after kernel update
by Michael Ströder 07 Dec '16

07 Dec '16

HI! On one qemu-kvm instance a kernel update failed and booting the image is not possible anymore (see below). A dozen other VMs are correctly working after the upgrade. Anything I can quickly try to make it work again? (This is not really a bad emergency case because I could simply re-install and re-configure with ansible. But I'd like to learn about these cases...) Ciao, Michael. Loading Linux 4.8.12-1-default ... [ 0.651328] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0) [ 0.654408] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.8.12-1-default #1 [ 0.656941] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.1-0-gb3ef39f-prebuilt.qemu-project.org 04/01/2014 [ 0.661166] 0000000000000000 ffffffff813a4252 ffff9a5348c4d000 ffff9a5349957e60 [ 0.664652] ffffffff8118e3fa ffff9a5300000010 ffff9a5349957e70 ffff9a5349957e08 [ 0.668124] ffffffff8118e715 ffff9a5349957e78 0000000000000001 0000000000000000 [ 0.671457] Call Trace: [ 0.672460] [<ffffffff8102eefe>] dump_trace+0x5e/0x310 [ 0.674389] [<ffffffff8102f2cb>] show_stack_log_lvl+0x11b/0x1a0 [ 0.676570] [<ffffffff81030001>] show_stack+0x21/0x40 [ 0.678480] [<ffffffff813a4252>] dump_stack+0x5c/0x7a [ 0.680369] [<ffffffff8118e3fa>] panic+0xd5/0x217 [ 0.682169] [<ffffffff81f56419>] mount_block_root+0x1fe/0x2c0 [ 0.684285] [<ffffffff81f56668>] prepare_namespace+0x12b/0x161 [ 0.686439] [<ffffffff81f56103>] kernel_init_freeable+0x1f6/0x20a [ 0.688675] [<ffffffff816c727a>] kernel_init+0xa/0x100 [ 0.690623] [<ffffffff816d485f>] ret_from_fork+0x1f/0x40 [ 0.696659] DWARF2 unwinder stuck at ret_from_fork+0x1f/0x40 [ 0.698858] [ 0.699533] Leftover inexact backtrace: [ 0.699533] [ 0.701580] [<ffffffff816c7270>] ? rest_init+0x90/0x90 [ 0.703944] Kernel Offset: 0x0 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)

2 1

[libvirt-users] How to best I/O performance for Window2008 and MSSQL guest VM
by Roberto Fichera 07 Dec '16

07 Dec '16

Hi There, I've moved some Windows2012 with MSSQL VMs from an hold ESXi 5.5 machine to a more recent and powerful machine running Fedora 24 x86_64 and related libvirt + KVM virtualization. I've moved the VMs filesystem to LVM slices and installed the VirtIO drivers in to all Windows VMs. I've also set both Disk and Network interface to work using VirtIO. So far so good everything works pretty fine. Now I would like to tune at best the MSSQL VM for both Disk and Network interfaces in order to get the best performance possible. Regarding network interface I've set it to work as bridge instead to go through to macvtap, so I'm not sure what is the best in this case. Regarding disk, since it's LVM I've chosen to go to cache mode none and IO mode native. Also here cannot judge what's the best setup for the workload. I'm undecided to use IO mode threads along directsync cache mode. Finally I've set "ionice -c 1 -p <qemu-pid> -n 0" and "renice -n -10 <qemu-pid>" for the interested VM that I want to get best performance possible. Even with the above setup, the MSSQL VM has performance similar to the old machine running ESXi 5.5, so does anyone can suggest where too look at and/or what would be the right setup? Thanks in advance. Roberto Fichera

2 3

[libvirt-users] How can openstack retrieve the CPU usage of a lxc via libvirt?
by WANG Cheng D 06 Dec '16

06 Dec '16

Dear all, I want to have a view of lxc CPU usage in openstack Dashboard. According the Openstack official site , Openstack Ceilometer can poll libvirt daemon to obtain CPU usage of a virtual machine. I tried the command locally on the libvirtd host "virsh -c lxc:/// domjobinfo", I got an error "error: this function is not supported by the connection driver: virDomainGetJobInfo" I am not sure if Openstack Ceilometer can retrieve the CPU usage of a linux container, if it can, which virsh command or API should be used to this? Thank you for your response in advance. Cheng

2 1

[libvirt-users] Understanding and converting between type='drive' and type='pci'
by Leroy Tennison 02 Dec '16

02 Dec '16

First, if this isn't the right list please tell me where i should post. I've searched for an explanation and I'm either searching for the wrong thing or it's not there. I'm trying to get an understanding of the "controller='0' bus='0' target='0' unit='0' " parameters for 'drive' compared to the "domain='0x0000' bus='0x00' slot='0x05' function='0x0' " parameters for 'pci'. It appears that 'dev hda' to 'dev hdd' is the maximum associated with 'drive', how many are available with 'pci' and what are the valid ranges for those parameters? If I have an xml using 'drive' and want to convert it to 'pci' what do I need to do? I've had trouble with this when moving disk images between hypervisors but have never had the time to investigate fully, does it have to do with how the drives are referenced (/dev/disk/by0id or /dev/[h|s|v]da as opposed to UUID)? Thanks for your help.

2 1

[libvirt-users] sudo user to access xen server remotely.
by ganesh kg 29 Nov '16

29 Nov '16

HI, i am trying to use sudo user to access xen server remotely. As its documented, libvirtd can be accessed only through root user or users from libvirtd usergroup. is there any tweak or possibility to access libvirt remotely through sudo user? or by using certificate? code snippet: #!/usr/bin/env python import sys import libvirt conn = libvirt.open('xen+ssh://sudo_user@xen_server') <== Trying to establish connection to the remote xen using sudo user. if conn == None: print('Failed to open connection to xen+ssh:xen_server') exit(1) host = conn.getHostname() print('Hostname:'+host) conn.close() exit(0)

1 0

[libvirt-users] Routed mode problem with SSH
by Marcelo Palma 27 Nov '16

27 Nov '16

Hi guys, I describe the context of the problem below: I installed a Tor relay on a virtual machine on my server with IP 9.1.1.101. This virtual machine needs to use a static IP (9.1.1.102) to work as a Tor relay. After that I create a virtual network in *Routed mode* to connect to the physical network (used as a bridge between the virtual machine and the external network (Internet)). Since I change the NAT to Routed mode, I can't access my server via ssh user(a)9.1.1.101. Will it be a Routed mode problem? How can I solve this problem? Thank you Marcelo

2 1

[libvirt-users] stream finish throws exception via python API
by Shahar Havivi 27 Nov '16

27 Nov '16

Hi, The following snippet works fine e.g. receiving the data but when calling stream.finish() we get the following error: stream = con.newStream() vol.download(stream, 0, 0, 0) buf = stream.recv(1024) stream.finish() libvirt: I/O Stream Utils error : internal error: I/O helper exited abnormally Traceback (most recent call last): File "./helpers/kvm2ovirt", line 149, in <module> download_volume(vol, item[1], diskno, disksitems, pksize) File "./helpers/kvm2ovirt", line 102, in download_volume stream.finish() File "/usr/lib64/python2.7/site-packages/libvirt.py", line 5501, in finish if ret == -1: raise libvirtError ('virStreamFinish() failed') libvirt.libvirtError: internal error: I/O helper exited abnormally Am I doing something wrong? Thank you, Shahar.

5 12

[libvirt-users] locking domain memory
by Dennis Jacobfeuerborn 26 Nov '16

26 Nov '16

Hi, is there a way to lock a guests memory so it doesn't get swapped out? I now there is memoryBacking->locked but that says it requires memtune->hard_limit and the description of that basically "don't ever do this" rendering the locked element kind of pointless. How can I prevent the guests memory from being swapped out without shooting myself in the foot? Regards, Dennis

3 3

[libvirt-users] NUMA VM and assigning interfaces
by Amir Shehata 26 Nov '16

26 Nov '16

Hello, Hope all is well. I've been looking at how I can create a virtual machine which is NUMA capable. I was able to do that by: 140 <qemu:commandline> 143 <qemu:arg value='-numa'/> 144 <qemu:arg value='node'/> 145 <qemu:arg value='-numa'/> 146 <qemu:arg value='node'/> 147 </qemu:commandline> This creates two NUMA nodes. Now I would like to assign my virtual network interfaces, of which I have three, to the different NUMA nodes on the VM. Anyone know how I can do that? Any help/pointers would be much appreciated. I'm trying to create a VM that will enable me to test a NUMA based feature. thanks amir

2 5

[libvirt-users] Fwd: Re: Attach libvirt guest to an existing openvswitch port
by Ivan Borodin 25 Nov '16

25 Nov '16

Thank you, Laine for you time and patience to give me a detailed answer. I missed the interfaceid parameter in the docs, but now I didn't manage to get it working. > http://www.libvirt.org/formatdomain.html The docs state: "The Open vSwitch type virtualport accepts two parameters in its <parameters> element - an interfaceid which is a standard uuid used to uniquely identify this particular interface to Open vSwitch (if you do not specify one, a random interfaceid will be generated for you when you first define the interface[...]" This interfaceid doesn't seem to have anything to do with ovsdb values. $ ovs-vsctl find Port 'name=vm_test' _uuid : f0f06327-6fcc-4073-b8c8-3f42944d43ca bond_downdelay : 0 bond_fake_iface : false bond_mode : [] bond_updelay : 0 external_ids : {} fake_bridge : false interfaces : [eb7fad6e-3728-4bf7-b31e-4a1693e2ec4b] lacp : [] mac : [] name : "vm_test" other_config : {} qos : [] statistics : {} status : {} tag : [] trunks : [] vlan_mode : [] The "_uuid" is ovsdb internal id of a record. If you take "interfaces" value for "interfaceid", libvirt will silently create its own new ovs port, with its own new uuid and defining a libvirt guest's interface with a unique uuid in "interfaceid"... Libvirt will create a new ovs port, and the ovsdb-"interfaces" value will be the interfaceid... And I could not find anything specific about this ovsdb/Port/interfaces. Actually, my point was to find a way to control ovs vlans outside libvirt. Since virsh doesn't have capabilities to edit interface's vlan options, the only way to do it is editing domains' xml-configs through virsh-edit, which is a bit tiresome. (By the way, there must be some technical reason(beyond virt-xml-validate) for designing libvirt writing it's own configuration files instead of reading them...) There should be.. There must be a way to do this. Port parameters are ovs authority. If there is no such way, could you, please, tell me the reason. On 11/21/2016 09:46 PM, Laine Stump wrote: > On 11/13/2016 01:23 PM, Ivan Borodin wrote: >> Somehow with interface types 'bridge' and 'network', libvirt does attach >> domain to the existing port specified in <target dev=''/>, wiping the >> exixting settings and always deletes this port upon domain shutdown, >> thus making me loose ovs configuration.

1 0

[libvirt-users] virt-manager wont connect to remote libvirt instance
by bherman 23 Nov '16

23 Nov '16

I am using virt-manager on debian 8 and I am remotely connecting to a libvirt instance on a server. It was all working fine until today when I discovered that I cannot remotely connect to the libvirt server anymore. ● libvirtd.service - Virtualization daemon Loaded: loaded (/lib/systemd/system/libvirtd.service; enabled) Active: active (running) since Tue 2016-11-22 10:27:09 CST; 46min ago Docs: man:libvirtd(8) http://libvirt.org Process: 27630 ExecReload=/bin/kill -HUP $MAINPID (code=exited, status=0/SUCCESS) Main PID: 27823 (libvirtd) CGroup: /system.slice/libvirtd.service ├─ 4787 /usr/sbin/libvirtd ├─ 8187 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --dhcp-script=/usr/lib/libvi... ├─ 8188 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --dhcp-script=/usr/lib/libvi... └─27823 /usr/sbin/libvirtd It says it is running however I cant connect to it either remotely or on the server using virt-manager. When I do a virsh --list It just hangs and doesn't output anything. Any ideas? -- Thanks, Brian Herman IT O: (773)299-7557 F: (773)299-7505

2 2

[libvirt-users] Routed mode problem with SSH
by Marcelo Palma 22 Nov '16

22 Nov '16

Hi guys, I describe the context of the problem below: I installed a Tor relay on a virtual machine on my server with IP 9.1.1.101. This virtual machine needs to use a static IP (9.1.1.102) to work as a Tor relay. After that I create a virtual network in *Routed mode* to connect to the physical network (used as a bridge between the virtual machine and the external network (Internet)). Since I change the NAT to Routed mode, I can't access my server via ssh user(a)9.1.1.101. Will it be a Routed mode problem? How can I solve this problem? Thank you Marcelo

1 0

[libvirt-users] blockcommit and gluster network disk path
by Sahina Bose 22 Nov '16

22 Nov '16

Hi, I'm running into problems with blockcommit and gluster network disks - wanted to check how to pass path for network disks. How's the protocol and host parameters specified? For a backing volume chain as below, executing virsh blockcommit fioo5 vmstore/912d9062-3881-479b-a6e5-7b074a252cb6/images/27b0cbcb-4dfd-4eeb-8ab0-8fda54a6d8a4/027a3b37-77d4-4fa9-8173-b1fedba1176c --base vmstore/912d9062-3881-479b-a6e5-7b074a252cb6/images/27b0cbcb-4dfd-4eeb-8ab0-8fda54a6d8a4/d4c23ec6-20ce-4a2f-9b32-ca91e65a114a --top vmstore/912d9062-3881-479b-a6e5-7b074a252cb6/images/27b0cbcb-4dfd-4eeb-8ab0-8fda54a6d8a4/027a3b37-77d4-4fa9-8173-b1fedba1176c --verbose --wait gives "error: invalid argument: No device found for specified path". <disk type='network' device='disk' snapshot='no'> <driver name='qemu' type='qcow2' cache='none' error_policy='stop' io='threads'/> <source protocol='gluster' name='vmstore/912d9062-3881-47 9b-a6e5-7b074a252cb6/images/27b0cbcb-4dfd-4eeb-8ab0-8fda54a6 d8a4/027a3b37-77d4-4fa9-8173-b1fedba1176c'> <host name='10.70.37.28' port='0'/> </source> <backingStore type='network' index='1'> <format type='qcow2'/> <source protocol='gluster' name='vmstore/912d9062-3881-47 9b-a6e5-7b074a252cb6/images/27b0cbcb-4dfd-4eeb-8ab0-8fda54a6 d8a4/d4c23ec6-20ce-4a2f-9b32-ca91e65a114a'> <host name='10.70.37.28' port='0'/> </source> <backingStore type='network' index='2'> <format type='raw'/> <source protocol='gluster' name='vmstore/912d9062-3881-47 9b-a6e5-7b074a252cb6/images/27b0cbcb-4dfd-4eeb-8ab0-8fda54a6 d8a4/f5098809-e719-404b-8d80-3f824f4333a2'> <host name='10.70.37.28' port='0'/> </source> <backingStore/> </backingStore> </backingStore> <target dev='vda' bus='virtio'/> <serial>27b0cbcb-4dfd-4eeb-8ab0-8fda54a6d8a4</serial> <boot order='2'/> <alias name='virtio-disk0'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> </disk> thanks sahina

1 1

[libvirt-users] Attach libvirt guest to an existing openvswitch port
by Ivan Borodin 21 Nov '16

21 Nov '16

Good day gentlemen. I am building a study project and trying to configure openvswitch vlans outside libvirt by means of openvswitch itself. Somehow with interface types 'bridge' and 'network', libvirt does attach domain to the existing port specified in <target dev=''/>, wiping the exixting settings and always deletes this port upon domain shutdown, thus making me loose ovs configuration. Could you, please, tell me how should I configure an interface or libvirt itself to avoid this libvirt's greedines. libvirt 2.4.0 Thak you. Ivan.

2 1

[libvirt-users] export a cert
by lejeczek 21 Nov '16

21 Nov '16

hi everybody I'm browsing around but probably missing that obvious little thing - exporting certs to pem format with ipa command toolkit - that must be there somewhere, right? thanks, L.

2 1