virt April 2014

virt@lists.centos.org

14 participants
16 discussions

MS-Win7 kvm guest gets dhcp from host bridge
by James B. Byrne 23 Jun '14

23 Jun '14

CentOS-6.5 i86_64 qemu-kvm-0.12.1.2-2.415.el6_5.4 MS-Windows v7proSP1 We have installed a MicroSoft Win7 system as a guest and have joined it to our MS AD domain. The system runs and has internet access. However, the IPv4 address it obtains and the gateway it is assigned are both sourced from the virtual machine host system and not from our AD DC DHCP server. To clarify, the virbr0 IP address is 192.168.122.1 and the Windows guest has that address as its gateway and an IP address in the 192.168.122.0/24 netblock. This is not as we desire as the internal addresses we regularly assign to MS workstations via DHCP are supposed to belong to a different netblock entirely. This permit filtering on incoming and outgoing traffic at the gateway. I realize that there is a DHCP service running on virbr0 for the purpose of provisioning guests with system control traffic but I do not know how to limit that to its intended purpose and allow another DHCP server to provide the IP address to the windows guests. I hope that problem description is not too confusing. Can anyone provide me with some guidance on the matter? Are kvm guests required to have either static ip addresses or dhcp addresses provided by the host system? Thanks in advance. -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

4 3

Xen Security patching
by Chris Elliott 07 Jun '14

07 Jun '14

Hi Guys When is the next update of Hypervisor packages going to be released? There appears to be no changes to the main hypervisor RPMs since September (Even in the BETA / RC1 tree) and there are 5+ Xen Security Advisories with patches which need to be added. "Security issues are handled and released in sync with public disclosure upstream with zero lag" I can rebuild my own, but that's not really the point. In other news I've been doing some testing of the 3.10 kernel and so far so good! Thanks - Chris

3 7

Xen4CentOS: Unnecessary gpxe / ipxe obsoletes
by George Dunlap 20 May '14

20 May '14

I installed CentOS6 with the xen4centos set of packages; then I tried to install KVM (for performance comparison), I got the following error in YUM: --> Processing Dependency: /usr/share/gpxe/e1000-0x100e.rom for package: 2:qemu-kvm-0.12.1.2-2.415.el6_5.4.x86_64 Package gpxe-roms-qemu is obsoleted by ipxe-roms-qemu, but obsoleting package does not provide for requirements I manually downloaded the gpxe package and installed it with no problems, so there are no actual conflicts in the files. Thus, ipxe probably *shouldn't* obsolete gpxe -- there are no conflicts between the two, and ipxe doesn't provide what gpxe does. If I had already installed KVM, and was toying with the idea of giving Xen a spin, this may have been enough to deter me. I checked with the XenServer guys, and their version of ipxe doesn't obsolete gpxe; so that must have been something that was introduced in CentOS. -George

4 11

VMs failing to restart
by Lars Hecking 09 May '14

09 May '14

This is a problem I've had on and off under CentOS5 and CentOS6, with both xen and kvm. Currently, it happens consistently with kvm on 6.5, e.g. with every kernel update. I *think* it generally worked fine with the 6.4 kernels. There are 7 VMs running on a 6.5, x86_64, 8GB RAM host, each with 512MB RAM and using the e1000 NIC. I picked this specific NIC because the default does not allow reliable monitoring through SNMP (IIRC). The host has two bonded NICs with br0 running on top. When the host reboots, the VMs will generally hang bringing up the virtual NIC, and I need to go through several iterations of destroy/create, for each VM, to get them running. The always hang here (copy&paste from console): ... Welcome to CentOS Starting udev: udev: starting version 147 piix4_smbus 0000:00:01.3: SMBus Host Controller at 0xb100, revision 0 e1000: Intel(R) PRO/1000 Network Driver - version 7.3.21-k8-NAPI e1000: Copyright (c) 1999-2006 Intel Corporation. ACPI: PCI Interrupt Link [LNKC] enabled at IRQ 11 e1000 0000:00:03.0: PCI INT A -> Link[LNKC] -> GSI 11 (level, high) -> IRQ 11 e1000 0000:00:03.0: eth0: (PCI:33MHz:32-bit) 00:16:3e:52:e3:0b e1000 0000:00:03.0: eth0: Intel(R) PRO/1000 Network Connection Any suggestions on where to start looking?

4 9

Pages In and Read Sectors in Guest Domain
by Deron 29 Apr '14

29 Apr '14

Hello. I have been doing some performance tests with Xen and CentOS and have found some strange statistics when comparing the virtual memory (/proc/vmstat) and I/O (/proc/diskstat) statistics between the Domain 0 and guests. When I look at the "pgpgin" statistic it is exactly the same as the "read sectors" in Dom0. However, when I look at the same statistics in the guest, the "read sectors" is exactly 2x "pgpgin". I have tried this on 2 different versions, each on a different physical server. Here is an example of the statistics over a 30 second period (while running a benchmark in Dom1) in the Dom0 and Guest Domain. pgpgin read sectors ======= ========= Dom0 1698024 1698024 Dom1 848412 1696824 I have looked at some various settings to see if I could explain it. I can't tell if the Dom1 guest kernel is reporting incorrectly, or there is some other explanation. If anyone has any ideas about this I would appreciate any feedback. Dom 0 kernels 3.10.29-11.el6.centos.alt.x86_64 3.4.54-8.el6.centos.alt.x86_64 Guest kernel 2.6.32-431.el6.x86_64 Thanks, Deron

2 2

Virt SIG roadmap
by George Dunlap 25 Apr '14

25 Apr '14

As promised, in preparation for next week's SIG meeting, here's a kick-off discussion about the Virtualization SIG roadmap. I'm mainly tossing out ideas here -- see this is an invitation to discussion. Key things I think should be on the roadmap: * Release process - General cadence - Estimate of the next release (if any) * Specification of targets - Right now, mainly xen4centos - What packages? * "Backlog" of work items - Updates (mostly suggested by Pasi) - Items caveats from Russ P's CentOS talk == Release process == I don't have any real opinions on this -- KB / Johnny, did you guys have a vision for what the release schedule for any of the SIGs would look like? Are we going to have specific releases, or just continue to do rolling updates? If so, how frequent should the updates be? Obviously estimates for releases will need to wait until all the infrastructure has been set up, and we've discussed cadence / targets, &c. == Targets == Targets will depend on community support. I'll be committing to extending the Xen4CentOS project. There was talk of having an OpenVZ variant, but that would require someone to actually step up and do the work to integrate and support it. == Backlog == Most of the items below are from the discussion Pasi started in February; a couple are from Russ Pavliczek's slides at a talk given recently. * Pull in updates f/ XenServer > Suggested by dvrabel in http://marc.info/?l=centos-virt&m=139289353315469 - 0001-x86-xen-rename-early_p2m_alloc-and-early_p2m_alloc_m.patch - 0008-x86-remove-the-Xen-specific-_PAGE_IOMAP-PTE-flag.patch - 0160676bba69523e8b0ac83f306cce7d342ed7c8 (xen/p2m: check MFN is in range before using the m2p table) - 7cde9b27e7b3a2e09d647bb4f6d94e842698d2d5 (xen: Fix possible user space selector corruption) * Xen 4.4 (Xen + qemu) * libvirt: 1.2.2 - Possibly with migration / pci pass-through back-ported? * dom0 / xen serial console * Ballooning bug? > http://bugs.centos.org/view.php?id=6893 * UEFI? Anything else we need to discuss / plan? -George

3 5

libvirt versions / difference to upstream?
by Sven Kieske 22 Apr '14

22 Apr '14

Hi, I want to upgrade my libvirt version, in order to get a bugfix from upstream, see this BZ for details: https://bugzilla.redhat.com/show_bug.cgi?id=1084477 in short: libvirt does not handle qos correctly prior to version 0.10.2-33.el6 however, it is not (yet?) available in CentOS. The latest available package seems to be: libvirt-0.10.2-29.el6_5.7.x86_64 Please correct me if I'm wrong. Is it just the versioning scheme that differs between CentOS and upstream? Or did the new rpm just not hit the repo yet? Thanks in advance! PS: This is CentOS 6.5 -- Mit freundlichen Grüßen / Regards Sven Kieske Systemadministrator Mittwald CM Service GmbH & Co. KG Königsberger Straße 6 32339 Espelkamp T: +49-5772-293-100 F: +49-5772-293-333 https://www.mittwald.de Geschäftsführer: Robert Meyer St.Nr.: 331/5721/1033, USt-IdNr.: DE814773217, HRA 6640, AG Bad Oeynhausen Komplementärin: Robert Meyer Verwaltungs GmbH, HRB 13260, AG Bad Oeynhausen

2 1

AWS Images updated for new instance types
by Karanbir Singh 22 Apr '14

22 Apr '14

hi, · CentOS 6.3 (x86_64) – Release Media: https://aws.amazon.com/marketplace/pp/B00A6L6F9I · CentOS 6.4 (x86_64) – Release Media: https://aws.amazon.com/marketplace/pp/B00DGYP804 are now marked for and updated to run with the m3 and c3 instance types. I'm still working with the amazon crew to get the 6.5 images online and an automated pipeline proposed ( hopefully, also adopted ) to get this image injection speeded up in the future. Regards -- Karanbir Singh +44-207-0999389 | http://www.karan.org/ | twitter.com/kbsingh GnuPG Key : http://www.karan.org/publickey.asc

2 6

VIRT SIG Meeting Minutes [11/04]
by Lars Kurth 15 Apr '14

15 Apr '14

Will copy these to http://wiki.centos.org/SpecialInterestGroup/Virtualization, after intial discussion or just point to the e-mail/email thread from the wiki. Feel free to correct as needed. Lars == Attendees == SIG Members: * LarsKurth (LK) * GeorgeDunlap (GD) * KaranbirSingh (KB) Travelling: * JohnnyHughes (JH) Guest * EuanHarris === Meeting time and cadence === Meetings will be held every other Tuesday from 14:00-15:00 London time starting on April 22nd We will use Bluejeans conferencing as voice is higher velocity We will hold every alternating meeting on #centosdevel Meetings will be minuted, IRC sessions are logged * ACTION: KB, provide Bluejeans conferencing details * ACTION: LK: announce on the list and add information to wiki page === Roles and Responsibilities === We confirmed who does what based on the current list of SIG members KB, JH: Developing Build Systems, Other Infrastructure enablement, CentOS Board liasion LK: Minutes, Chair meetings, Outreach, Community GD: Access Controls, Build triggers, Technical Leadership * ACTION: LK and GD to discuss who wants to act as SIG lead. We may want to run this dually for a while, until it is clearer what is involved. LK is often on the road, which may prove challenging. === Decision Making === Lazy Consenus decision making process (amongst the SIG members). In other words, proposals are made on the list and accepted if there is no veto. === Ongoing business: Press Release & Linux.com Article === Both were discussed by CentOS board yesterday. A couple of phrases need correcting and some clarifications are needed. * ACTION: KB, provide changes suggested by Centos board by Friday (or Monday) * ACTION: LK, after changes are received kick off Xen Project AB board approvals === Infrastructure === ==== Wiki ==== * Wiki access : done ==== Repositories ==== Migrate Xen4CentOS git repositories to newlocation * KB stated that there is a dependency on build system * We can either wait for the new build system or use the one we have (with migrated repos). * Present system: each package is within its own named git repository. Each git repository has named branches. * Workflow: anyone can clone these and commit changes. A commit to a named git branch triggers a build. Proposal: * migrate git repositories * use exisiting build system for now * when available migrate to new system Issue: GD, LK are blocked due to lack of instructions and information * Action: KB put together list of repository names in Xen4CentOS such that we can use it as a baseline * Action: KB put together a doc on how to get builds going and join/administer the git repos ==== Repositories / Process ==== We want a lightweight review and ACK process with a list of committers (initially: KB, GD, JH, LK) However, it is OK to nominate one or two people who can commit directly We already have a mixture of people working with git directly and ome on github : set up github such that merge requests on github are sent to virt list, such that anyone can see the requests * Action: make mods to github repos *after* migration ==== Lists ==== LK noticed that there are some issues with list moderation : aka posts seem to go missing on centos-virt KB stated that "if you are not subscribed : posts to the list are autodiscarded". This is due to the volume of spam to the centos lists. LK, is OK with this, but we need to set expecations. As this may be difficult for new people engaging with the SIG * ACTION : LK state this policy on the wiki page and make a post to the list and seeing whether we want to change it. The volume of spam is likely smaller on the virt list than the centos-devel list ==== Bug tracking ==== Bugs related to Xen4CentOS currently get raised on the virt list Other virt related bugs too Upstreams monitor the list and they get addressed upstream CentOS specific go into bugs.centos.org This seems to be working now: let's not change anything that isnt broken But may want to reconsider once we are through the bootstrapping issues === Establish a backlog / roadmap === GD suggested that we have a regular roundup call for backlog items on the list, which we can collate into a roadmap. We can either just link to the threads from the wiki or nicely format and copy it. * ACTION : GD kick off a backlog / roadmap discussion via e-mail on the list and discuss at next meeting * ACTION : LK these minutes contain a number of next steps. LK volunteers to track on wiki for now * ACTION: KB, GD, and who else wants to come - get together at Xen Project Hackathon, May 29&30th (http://wiki.xenproject.org/wiki/Hackathon/May2014) to work on technical issues. Most of us are local, so this should give us a boost === Interfaces and Scope === Given where we are, we probably need to focus on the basics in the coming weeks and months : infrastructure, migrating, virtualization components. GD made a good point that SIGs and Variants are essentially about interfaces. We have INBOUND and OUTBOUND interfaces. INBOUND: are those who make the virtualization components that are in the SIG work Example: Kernel, Qemu... OUTBOUND: are those that end-users and other SIGs interface with. Example: libvirt, virsh, ... One of the main function of the VIRT SIG is to try to ensure that versions of INBOUND interfaces will work for the components maintained within the SIG and that OUTBOUND interfaces are suitable for users and those SIGs trying to consume the variants created by the virt SIG KB noted that the scope of SIG is not constrained. E.g. we could include Xen Orchestra or something similar, if desired. KB: have you looked at the osstree? GD has, but not in much detail. Following ongoing discussion === Relationships to other SIGs === Right now it makes sense to focuse on other active SIGs * Cloud Instances SIG * Storage SIG * ACTION LK: to keep in touch with patrick from Storage SIG * ACTION GD: reach out to Cloud Instance SIG (I think there are issues with preseeding, and passwords) * ACTION LK: knows DavidNalley - chat to him about Cloud Instances SIG

2 2

Virt SIG moving forward
by Lars Kurth 11 Apr '14

11 Apr '14

Hi, just a quick note that I found the CentOS board meeting minutes which state that the Virt SIG is moving forward. Consequently I updated * http://wiki.centos.org/SpecialInterestGroup/Virtualization * http://wiki.centos.org/SpecialInterestGroup/Virtualization/Proposal (& http://www.centos.org/minutes/2014/march/centos-devel.2014-03-05-21.04.html) Apologies for the short notice. We are going to have a first quick meeting on Friday the 11th, 11:00AM BST (London time) because many of us will be on the road the following weeks and we didn't want to stall progress. Please drop me a line if you want to participate on lars dot kurth at xenproject dot org. If you cannot make it, don't worry: we will set up a proper regular meeting once everyone is back from their travels and revisit agenda items as needed. It probably wont be very popular, but I'd propose a hangout or teleconf and will write up minutes. I expect that we will cover * Meeting time & cadence * Form & Function (confirm who does what based on the current list of members) * Infrastructure loose ends (repositories, lists, access, etc - enough pointers to get started) * Establish a draft TODO list * Identify potential additions to SIG (KVM, OpenVZ, etc. and whether there are any individuals to proactively reach out to) * AOB Best Regards Lars

2 2

Re: [CentOS-virt] OpenVZ variant
by Lars Kurth 09 Apr '14

09 Apr '14

Andres, thanks for your interest. Could you elaborate what your thoughts related to CentOS 7 and the CentOS virtualization SIG are? I am not sure I exactly understand what you are proposing and it is also not quite clear to me whether there is some overlap with other SIGs (such as the Cloud SIG). I guess the key question I have is whether you are suggesting / considering to use the output of the virtualization SIG as upstream for OpenNode and would want to contribute to the SIG. Best Regards Lars On 03/04/2014 21:30, Andres Toomsalu wrote: > > Dear Scott, Lars, > > Currently we already have CentOS 6 based respin (called OpenNode - > http://opennodecloud.com) targeted for virtualization - supporting > both OpenVZ and QEMU/KVM at the moment - yet it would be possible to > add Xen/LXC/Docker support as well - as we are based on libvirt. > > We are just discussing some ideas how we would like to develop next > major version - CentOS 7 based virtualization host - yet we would be > really interested for having an open discussion and community based > development - if anybody wants to join in or there will be some > interest to create something like community CentOS virtualization host > project - where we could join. Our current ideas are spinning around > CoreOS like (perhaps stateless) CentOS 7 compute host with modern > clustering built-in (perhaps etcd) - and we still want to continue to > support both containers and full virtual machines on the same host. > Hopefully also Docker will be mature enough soon and supporting OpenVZ > userland tools - as LXC and OpenVZ share the kernel part and > surprisingly LXC seems still not enough mature/feature rich - yet LXC > project has existed already quite a long time (which makes me a bit > pessimistic predicting on future LXC progress pace). LXC container > isolation features still suck a bit (for production systems) and still > no live migration feature - yet support for it seems to come from > OpenVZ team - as http://criu.org. But hopefully we can get rid of > OpenVZ patched kernels - so it will be only the choice of userspace > tools (for containers). > > Our goal would be to have something way simpler than Openstack (which > is huge and quite a mess in its current state - if you really want to > create a production grade system with it) - and to have a nicely > packaged + easy to use system (which might not support all 1001 ways > of doing the same thing - yet enforcing some simple best-practices). > > So - if anybody interested - lets discuss! > > Kind regards, > -- > <http://www.getpostbox.com>---------------------------------------------- > > Andres Toomsalu > http://www.opennodecloud.com <http://www.opennodecloud.com/> > >

1 0

libvirt POSTIN scriplet failure
by Peter Peltonen 08 Apr '14

08 Apr '14

While updating a CentOS 6 Xen domU server with yum I received the following error: Updating : libvirt-0.10.2-29.el6_5.7.i686 65/168 Non-fatal POSTIN scriptlet failure in rpm package libvirt-0.10.2-29.el6_5.7.i686 warning: %post(libvirt-0.10.2-29.el6_5.7.i686) scriptlet failed, exit status 1 After a reboot everything seems to run fine. Anything I should be considered about? Regards, Peter

1 0

OpenSSL Heartbeat exploit agains KVM guest systems
by James B. Byrne 08 Apr '14

08 Apr '14

Is it possible to use this exploit against a kvm guest to read memory used by the host? In other words: if an exploitable service, say httpd with mod_ssl, is running in guest system 'vm1' hosted on system 'virthost' then what implications does that have with respect to guests vm2 and vm3 and to virthost itself? -- *** E-Mail is NOT a SECURE channel *** James B. Byrne mailto:ByrneJB@Harte-Lyne.ca Harte & Lyne Limited http://www.harte-lyne.ca 9 Brockley Drive vox: +1 905 561 1241 Hamilton, Ontario fax: +1 905 561 0757 Canada L8E 3C3

2 1

OpenVZ variant
by Scott Dowdle 07 Apr '14

07 Apr '14

Greetings, I was reading the LWN article from today (free to non-subscribers next Thursday). Here's a subscriber link for those who might want to see it now: CentOS and Red Hat - http://lwn.net/SubscriberLink/592723/485ea802859f6c36/ I saw that Xen was mentioned as an area where CentOS went beyond RHEL with CentOS 6... and being that I'm deeply in the OpenVZ community, I thought it might be natural to have an OpenVZ CentOS Variant. I just noticed that the CentOS Virt-SIG page already mentions OpenVZ. Is this only for the upcoming CentOS 7 or would it be possible to produce a spin/remix that is CentOS 6-based that includes the OpenVZ kernel and OpenVZ utils? Looking at the stats provided by the OpenVZ Project (http://stats.openvz.org/) it is obvious that CentOS is the most popular platform for both OpenVZ hosts and OpenVZ containers: Top host distros ------------------- CentOS 56,725 Scientific 2,471 RHEL 869 Debian 576 Fedora 111 Ubuntu 82 Gentoo 54 openSUS 18 ALT Linux 10 Sabayon 6 and Top 10 CT distros ------------------- centos 245,468 debian 106,350 ubuntu 83,197 OR 8,354 gentoo 7,017 pagoda 4,024 scientific 3,604 fedora 3,173 seedunlimited 1,965 This morning I sent out some feelers to the OpenVZ community (via the OpenVZ Users mailing list, blog.openvz.org, and the #openvz IRC channel) to see if any OpenVZ users were already working with the CentOS project (I'm not). So does anyone that is part of this SIG care to tell me how much OpenVZ interest there currently is and how I might become a part of the effort? I know the virt-sig is probably quite broad beyond OpenVZ. TYL, -- Scott Dowdle 704 Church Street Belgrade, MT 59714 (406)388-0827 [home] (406)994-3931 [work]

4 4

Cleaning up virt SIG related wiki pages
by Lars Kurth 04 Apr '14

04 Apr '14

Hi all, I took a little bit of stock in light of preparing the re-launch of the Virtualization SIG as per the board decision recently and noticed that there are quite a few old and out-of-date wiki pages lying around In particular the following pages seem very old (Iast edited in 2007) * http://wiki.centos.org/SpecialInterestGroup/Virtualization * http://wiki.centos.org/SpecialInterestGroup/Virtualization/Packages I suppose these pages should link to http://wiki.centos.org/Manuals/ReleaseNotes/Xen4-01 and the actual SIG description as was discussed and approved by the CentOS board. I don't seem to be able to create an account on the wiki. Do I and George need to wait for someone to create it, or is there a way to self-sign up Regards Lars

2 3

injecting a key into the xen images
by Karanbir Singh 02 Apr '14

02 Apr '14

hi, As a part of the test suite for xen that I've started off - I needed a way to inject a ssh key into the image [1]; so have come up with this : https://github.com/CentOS/sig-virt-t_xen/blob/master/scripts/inject_ssh.sh ; its not pretty and it wont handle lots of use cases, but it does what is needed at hand. Comments ? I'm also considering if we should include this script within the .bz2 file for the image itself ( and for all such images ) Further feature creep, should we now extend this script a bit to also include a 'download and inject ssh key' with some param's like : ./get_image.sh 6.5 x86_64 <path to sshkey> and that can hit http://cloud.centos.org/<calculated path to image>/ ; download it, and add the key. This script could live within centos-release-xen dramatically reducing the barrier to entry and get-go with the xen4centos stack. thoughts ? - KB 1: qcow2, http://cloud.centos.org/centos/6/devel/CentOS-6-x86_64-xen-pv.bz2 -- Karanbir Singh +44-207-0999389 | http://www.karan.org/ | twitter.com/kbsingh GnuPG Key : http://www.karan.org/publickey.asc

4 6

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

virt April 2014