特殊:Badtitle/NS100:KVM

{{#ifexist: :KVM/zh | | {{#ifexist: KVM/zh | | {{#ifeq: {{#titleparts:KVM|1|-1|}} | zh | | }} }} }} {{#ifeq: {{#titleparts:KVM|1|-1|}} | zh | | }}

The Kernel Virtual Machine is part of Ubuntu 7.04. It's a fast and simple way to run entire Operating Systems, including Windows, inside Linux.

Setting up KVM on Ubuntu 7.04 Feisty Fawn

• Install the 'kvm' and 'qemu' packages. See InstallingSoftware.
• Manually load the driver:
  • For AMD processors

   sudo modprobe kvm-amd

• • For Intel processors

   sudo modprobe kvm-intel

Especially for Intel based machines, you might need to update BIOS and enable virtualization in BIOS before you can process. Otherwise modprobe kvm-intel tell that "Operation is not supported". For more information, refer to this ubuntuforums.com thread:

http://ubuntuforums.org/showthread.php?t=350691

• • Make /dev/kvm accessible to the user (needed in some cases):

sudo chmod 777 /dev/kvm

or

sudo adduser $USER kvm
# logout and back in

Installing a Windows XP Guest

• Create a file for the virtual disk drive. Using the '-f qcow' option as shown below saves space, by not using the space until the guest does (till the maximum size of the disk is read).

qemu-img create windows.img -f qcow 6G

• Start KVM and install Windows

Insert the Windows install CD and run:

kvm -no-acpi -m 384 -cdrom /dev/cdrom -boot d windows.img

-m tells how much memory to use - 256M is a safe minimum.  

To avoid issues with acpi later, when the Windows XP installer says "Press F6 for additional drivers", press F5 instead. The installer will give you the option to select Standard PC or other. Pick Standard PC and the install will continue.

IMPORTANT: the '-boot d' flag tells KVM to attempt to boot from cdrom first. After installing XP, you can boot your virtual machine simply with

kvm -no-acpi -m 384 -cdrom /dev/cdrom windows.img

You can create a panel launcher for XP by specifying the absolute path to the image (/home/user/windows.img)

If you get the error:

Could not configure '/dev/rtc' to have a 1024 Hz timer. This is not a fatal
error, but for better emulation accuracy either use a 2.6 host Linux kernel or
type 'echo 1024 > /proc/sys/dev/rtc/max-user-freq' as root.

Then this can be fixed by doing:

sudo -s
echo 1024 > /proc/sys/dev/rtc/max-user-freq

Currently it will not work to simply try 'sudo echo 1024 > /proc/sys/dev/rtc/max-user-freq'

If your virtual Windows boots and runs very slowly, you should use the ACPI-Workaround:

[1]

Installing a Ubuntu Edgy Guest

• Create a file for the virtual disk drive. Using the '-f qcow' option as shown below saves space, by not using the space until the guest does (till the maximum size of the disk is read).

qemu-img create edgy.img -f qcow 6G

• Start KVM and install Edgy

Insert the Edgy install CD and run:

kvm -m 256 -cdrom /dev/cdrom -boot d edgy.img

You may also specify an .iso file on your hard drive ("-cdrom ~/Desktop/ubuntu-6.10-server-i386.iso").

With Intel processors the standard installer will fail due to use of real mode. Try the netboot mini.iso or alternate installer instead.

Boot your virtual machine with

kvm -m 256 edgy.img

TODO: how do I tell it to boot a 32-bit VM vs. a 64-bit VM? Answer: it looks totally automatic?

Advanced Networking

If the following doesn't address your needs, all existing qemu documentation should be relevant for KVM as well.

Terminology

VLAN: a virtual network segment. Usually you can picture it as just a virtual switch. You plug virtual NICs into VLANs, and wire VLANs together, and can ultimately create a switch fabric that very closely matches real-world setups.

Default, Usermode Networking

If you don't specify any networking options, KVM by default constructs a NIC connected to a private VLAN. On this VLAN it also emulates single host that acts as a DHCP server and default router. Any connections initiated by the guest are routed through KVM's private stack and appear to the host computer as requests coming from sockets opened by the KVM process on 127.0.0.1.

KVM's usermode networks typically contain only two addresses: 10.0.2.2 (the virtual host) and 10.0.2.15 (the guest).

Here it is in KVM's language:

  $ kvm -net nic -net user ...

In other words: add a nic and connect it vlan 1. Also add a virtual host connected to vlan 1. The virtual host connects the VLAN via NAT to the physical host.

Because usermode networking is implemented using the SLIRP protocol, UDP is not supported. If you need to move UDP packets to the host or the outside world, you will need to use a different technique.

Connecting VLANs to Each Other

Multiple NICs / VLANs

What if you want to set up a virtual machine with multiple NICs? You need to create multiple VLANs to plug the NICs into. To create more than one VLAN, assign each VLAN a unique ID. For instance, this will create two NICs and two VLANs:

   $ kvm -net nic,vlan=0 -net socket,listen=:8010,vlan=0 -net nic,vlan=1 -net user,vlan=1 ...

Socket Connections

So, I can connect my virtual machines to private VLANs. How do I connect those VLANs together? The easiest is probably using regular TCP sockets. One vlan must be the listener:

   $ kvm -net nic -net socket,listen=:8010 ...

and the other vlan must be the initiator:

   $ kvm -net nic -net socket,connect=127.0.0.1:8010 ...

If you don't specify an address, the listener will listen on all connected interfaces. To only listen on localhost, specify this:

   $ kvm -net nic -net socket,listen=127.0.0.1:8010 ...

This, of course, also allows you to connect virtual lans running on different hosts.

Multicast Sockets

If you want to connect multiple initiators to a single listener, you must use a multicast socket.

   $ kvm -net nic -net socket,mcast=230.0.0.1:1234 ...
   $ kvm -net nic -net socket,mcast=230.0.0.1:1234 ...
   $ kvm -net nic -net socket,mcast=230.0.0.1:1234 ...

That connects 3 different VLANs at the same point. Frames sent on any VLAN will be received by all others.

VDE

Multiple VLANs can also be connected to a single VDE. VDEs are described further in Advanced Networking below. TODO: introduce VDEs here, provide examples.

Connecting VLANs to the Host

Great, we can now create and wire up a huge virtual switching fabric, but how do we connect it to the outside world? Our packets are still entirely virtual. We did see how to masquerade TCP connections through the usermode device but that has too many limitations. How do we connect VLANs to existing, physical networks?

The Tap Device

Most (all?) virtual-to-physical connections are made through a tap device. Tap devices are regular network interfaces, not any different from eth0, eth1, lo, etc. One end of the tap is connected to the VLAN, the other end is configured and routed using regular networking tools (ifconfig, route, etc).

   $ kvm -net nic -net tap ...

That command created a new, unique tap ethernet device (tap0, tap1, etc). The /etc/qemu-ifup script is used to provision the new network device. The default /etc/qemu-ifup simply assigns the new interface the IP address 172.20.0.1. You can specify an explicit network name using ifname=IF, and a different script to run using script=SCRIPT, like this:

   $ kvm -net nic -net tap,ifname=qtap0,script=/var/vm/vm0.ifup

Taps cleanly solve the networking problem for a single virtual machine. Unfortunately, each guest requires its own tap device. As you might imagine, this gets unweildy fast.

Advanced Networking

So, how can we run an arbitrary number of virtual machines, all able to talk to each other and the outside world? Alas, there are a huge number of different ways to solve this, all with their own benefits and drawbacks (that's why network engineers get paid the big bucks). Here are some common techniques.

Virtual NICs on VDE, VDE Tap'd to Host, Tap NATed to Outside

This allows guests to initiate connections with each other, the host, and the outside world. It also allows the host to initiate connections with any guest. It doesn't allow the outside world to initiate connections with guests however (although you could manually proxy the connections through the host using kvm's -redir, port forwarding or ssh -L). It's realtively unobtrusive to set up; you don't need to modify the host's network configuration at all.

These steps show how to test out this type of network, but not how to make it persistent. You will have to run these programs manually every time your machine boots.

• $ sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"

• add "tun" to /etc/modules.conf. Also run sudo modprobe tun.

• $ sudo apt-get install vde dnsmasq

• $ sudo /etc/init.d/dnsmasq stop

• $ sudo vde_switch -tap qtap0 -daemon Now vde_switch is listening on /tmp/vde.ctl (use -socket PATH to specify where to put the socket).

• $ sudo ifconfig qtap0 10.111.111.254 broadcast 10.111.111.255 netmask 255.255.255.0 up

• $ sudo iptables -t nat -A POSTROUTING -o `route -n | egrep '^0\.0\.0\.0 ' | nawk '{print $8}'` -j MASQUERADE

  This command should work on 99% of setups; ie with one default route. IF you run a machine with more than one default route you should be able to work out a substitute for this command.

• $ sudo dnsmasq --log-queries --user=nobody --dhcp-leasefile=/var/tmp/dnsmasq-leasefile --dhcp-range=10.111.111.129,10.111.111.199,255.255.255.0,10.111.111.255,8h --interface=qtap0 --domain=qemu.lan -d TODO: tell how to configure /etc/dnsmasq.conf to do this.

• $ sudo vdeq kvm -hda v2.qcow -boot c -net nic -net vde -m 192

• In the guest, put nameserver 10.111.111.254 into /etc/resolv.conf. Also, check that DHCP gave it a sane IP address.

• In the guest, ping 10.111.111.254 should work. In the host, ping 10.111.111.140 (or whatever the guest's IP address is) should work. If so, the tap device works great.

• Now, from the guest, try pinging an external IP address. If that works, then masquerading works. Now try pinging an external domain name, like google.com. If that works, congratulations, dnsmasq works and everything should be set up correctly.

TODO: Tell how to make these settings permanent. We need to copy the dnsmasq command line into /etc/dnsmasq.conf, launch vde when /etc/network/interfaces brings up qtun0, but how do we automate adding the MASQUERADE chain? I suppose we need to add and remove this chain from /etc/network/interfaces as well.

Cribbed from the exellent http://alien.slackbook.org/dokuwiki/doku.php?id=slackware:vde

Virtual NICs Bridged Directly to Outside

This technique replaces the host's default network interface with a bridged connection. When you connect guest VLANs to the bridge, they appear to the external network exactly as if they were real. It's the most reliable way to make guests appear to be actual physical machines on the network, but it's also harder to set up and somewhat intrusive.

Be careful! This technique makes your virtual interfaces visible all over the office. For instance, make very sure you give each virtual interface a valid MAC address!

When you use this within a small home network, this actually is the easiest approach.

• In the KVM command line, include the following. Ensure that this MAC address is not duplicated anywhere within your network.

-net nic,macaddr=00:xx:xx:xx:xx:xx -net tap

• Edit /etc/network/interfaces to

auto lo br0 eth0

iface lo inet loopback

iface br0 inet dhcp
    bridge_ports eth0

iface eth0 inet manual

• • above is based on your network interface on eth0

Comment from someone who tested the bridge: It works very well, but I had to reboot after editing the /etc/network/interfaces. It was NOT enough to stop networking beforehand, editing the /etc/network/interfaces, start networking and finally to initialize the kvm-guest. So reboot or find out, what I forgot to reset.

Credits and See Also

Credits: Thanks to Finally User Friendly Virtualization For Linux and http://wiki.u32.net/KVM

See Also: http://compsoc.dur.ac.uk/~djw/qemu.html http://kidsquid.com/cgi-bin/moin.cgi/bridge