- Users - libvirt List Archives

Can't start vm with enc backing files, No secret with id 'sec0' ?
by 18781374080 26 Oct '23

26 Oct '23

Hey, guys I've been working on whether libvirt supports encrypted snapshots,Here are my versions of libvirt and qemu [root@xx ~]# libvirtd -V libvirtd (libvirt) 4.5.0 [root@xx ~]# qemu-img -V qemu-img version 2.12.0 (qemu-kvm-ev-2.12.0-33.1.el7_7.4) Copyright (c) 2003-2017 Fabrice Bellard and the QEMU Project developers 1. assign $MYSECRET to libvirt secret using the secret-define and secret-set-value commands,and $MYSECRET is in base64 format MYSECRET=`printf %s "123456" | base64` 2. created a disk encrypted in luks format qemu-img create --object secret,id=sec0,data=$MYSECRET,format=base64 -f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 enc.qcow220G 3. The encrypted disk is defined in the XML configuration file, as shown below.Then I successfully started the virtual machine. <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/root/enc.qcow2'/> <backingStore/> <target dev='hda' bus='ide'/> <encryption format='luks'> <secret type='passphrase' uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/> </encryption> <alias name='ide0-0-0'/> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> 4. According to the qemu documentation, an encrypted snap.qcow2 disk was created with enc.qcow2 as backing qemu-img create -f qcow2 -F qcow2 --object secret,id=sec0,data=$MYSECRET,format=base64 --object secret,id=sec1,data=$MYSECRET,format=base64 -o encrypt.format=luks,encrypt.key-secret=sec1 -b 'json:{"encrypt.key-secret": "sec0", "driver": "qcow2", "file": {"driver": "file", "filename": "/root/enc/enc.qcow2"}}' snap.qcow2 I used the same $MYSECRET as the password data for the disk. Here is the disk information for snap.qcow2 image: snap.qcow2 file format: qcow2 virtual size: 20G (21474836480 bytes) disk size: 480K encrypted: yes cluster_size: 65536 backing file: json:{"encrypt.key-secret": "sec0", "driver": "qcow2", "file": {"driver": "file", "filename": "/root//enc.qcow2"}} backing file format: qcow2 Format specific information: compat: 1.1 lazy refcounts: false refcount bits: 16 encrypt: ivgen alg: plain64 hash alg: sha256 cipher alg: aes-256 uuid: ab0e3f87-35e7-40cb-9888-9fe9bb54e981 format: luks cipher mode: xts slots: [0]: active: true iters: 115582 key offset: 4096 stripes: 4000 [1]: active: false key offset: 262144 [2]: active: false key offset: 520192 [3]: active: false key offset: 778240 [4]: active: false key offset: 1036288 [5]: active: false key offset: 1294336 [6]: active: false key offset: 1552384 [7]: active: false key offset: 1810432 payload offset: 2068480 master key iters: 30085 corrupt: false 5. Then I changed the configuration of the XML, as shown below.And re-define and start the virtual machine <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/root/snap.qcow2'/> <backingStore type='file'> <format type='qcow2'/> <source file='/root/enc.qcow2'/> <backingStore/> </backingStore> <target dev='hda' bus='ide'/> <encryption format='luks'> <secret type='passphrase' uuid='694bdf38-214e-48d3-8c4c-9dbbcf0f5fa0'/> </encryption> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> Then the startup failed and an error was thrown. As shown below. qemu-kvm: -drive file=/root/enc/vm/enc-snap.qcow2,encrypt.format=luks,encrypt.key-secret=ide0-0-0-luks-secret0,format=qcow2,if=none,id=drive-ide0-0-0: Could not open backing file: No secret with id 'sec0' The sec0 secret id could not be found in the backing file, this is my problem. Is there a problem with the way I implemented it, or does libvirt currently not support this? Any tips or help will be appreciated, Looking forward to your reply. Thank you | | 18781374080 | | 18781374080(a)163.com | 签名由网易邮箱大师定制

2 2

[libvirt-users] How can I rebase network disk?
by Boxiang Zhu 26 Oct '23

26 Oct '23

Hi. I am using openstack, ceph and libvirt now. The live volume migration will call the libvirt rebase function in openstack nova project. https://github.com/openstack/nova/blob/stable/rocky/nova/virt/libvirt/drive… https://github.com/openstack/nova/blob/stable/rocky/nova/virt/libvirt/guest… But I use the ceph as the openstack block backend. And the type of disk is network in xml. <disk type='network' device='disk'> <driver name='qemu' type='raw' cache='writeback' discard='unmap'/> <auth username='cinder'> <secret type='ceph' uuid='86d3922a-b471-4dc1-bb89-b46ab7024e81'/> </auth> <source protocol='rbd' name='volumes002/volume-127f46fc-ef10-4462-af30-c3893cda31f9'> <host name='172.16.140.63' port='6789'/> </source> <target dev='vdb' bus='virtio'/> <serial>127f46fc-ef10-4462-af30-c3893cda31f9</serial> <alias name='virtio-disk1'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/> </disk> Now I found it is not supported to rebase network disk. It is only rebase block or file disk now. https://libvirt.org/html/libvirt-libvirt-domain.html#virDomainBlockRebase My question is that can I rebase network disk by some other ways from libvirt? Cheers, Boxiang

2 4

[libvirt-users] Does libvirt (will) support qemu's userspace vhost scsi and blk
by wuzhouhui 26 Oct '23

26 Oct '23

Does libvirt (will) support qemu's userspace vhost scsi and blk?

1 0

[libvirt-users] how xml generated
by 李卓瑶 26 Oct '23

26 Oct '23

hi : i create a domain by virt-manager tool, then there is a xxx.xml generated in /etc/libvirt/qemu/. so, my question is how the xx.xml generated? What the code involves in libvirt ? Thanks! -- Have a good day

3 6

[libvirt-users] How to convert "device_model_version = "qemu-xen-traditiona"" into libvirt xml file How to convert "device_model_version = "qemu-xen-traditiona"" into libvirt xml file
by hanyandong 26 Oct '23

26 Oct '23

I am using Xen-4.4.0, libvirt-1.2.9 My ubuntu.cfg is: ubuntu10.cfg bootloader = "/usr/local/lib/xen/boot/hvmloader" builder="hvm" memory = 512 name = "ubuntu" vif = [ "type=ioemu,bridge=ovsbr0", "type=ioemu,bridge=ovsbr0","type=ioemu,bridge=ovsbr0","type=ioemu,bridge=ovsbr0",,"type=ioemu,bridge=ovsbr0"] device_model_version = "qemu-xen-traditional" If I didnot add " device_model_version = "qemu-xen-traditional" " to ubuntu.cfg, I only can add four NICs to VM. If I add five or more,, I got these errors: libxl: error: libxl_dm.c:1371:device_model_spawn_outcome: domain 12 device model: spawn failed (rc=-3) libxl: error: libxl_create.c:1186:domcreate_devmodel_started: device model did not start: -3 libxl: error: libxl_dm.c:1475:kill_device_model: Device Model already exited If I add " device_model_version = "qemu-xen-traditional" " to ubuntu.cfg, I can apply 8 NICs to VM. But, I want to create domU by virsh(libvirt), so How convert " device_model_version = "qemu-xen-traditional"" to xml file used by virsh? and How many NIC can a VM have? what leads to this limit？ -- Best Regards, yandong

1 0

ANNOUNCE: Forthcoming changes to libvirt mailing list hosting
by Daniel P. Berrangé 13 Oct '23

13 Oct '23

Hello Libvirt Community, For the last 18(!) years, libvirt community mailing lists have been kindly hosted by Red Hat Corporate IT on the redhat.com Mailman installation. In retrospect this wasn't the ideal home for community mailing lists but that decision is ancient history. Unfortunately as a consequence of infrastructure changes, the redhat.com Mailman service is scheduled to be decomissioned, and in the very near future ($low weeks) will cease to be able to send/receive mail for libvirt lists. As a result, all the libvirt mailing lists will need to move to a new Mailman installation, managed on our behalf by the Red Hat Open Source Community Infrastructure team[1], who provide services for a variety of OSS projects. It is intended that this new service will be dedicated for our community and thus located somewhere under the libvirt.org domain. It should go without saying that all existing mail archives will be migrated over to the new server. None of the historical record should be lost. It is not considered appropriate netiquette, however, to bulk-resubscribe all current list members under a new domain. Thus anyone who wants to remain on the community lists will soon be requested to take action to enroll on the new mailman service. The new service is not quite ready for use yet. This mail serves as a heads up that the changes will be coming in the next couple of weeks that will require action. A further announcement will be sent when the new mailman is ready to accept subscriptions, as well as warnings before the old lists stop accepting messages. With regards, Daniel [1] https://www.osci.io/ -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|

1 0

Problem starting Windows 11 EE
by Rahul S 12 Oct '23

12 Oct '23

Hi, I configured a W11EE VM using virt-manager and joined it to my work domain. Everything was fine for a while. Later when I tried to reboot, I got the "Preparing Automatic Repair" message and when I selected "Startup Repair", I got the error "Startup repair couldn't repair your PC". I then went to command prompt, started 'diskpart' and ran "list disk" and got the error "there are no fixed disks to show". I have tried re-installing several times - it always ends up in this state. A few details of my system: host OS: OpenSUSE 15.5 libvirt version: 9.0.0-150500.4.3 virtio drivers: https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/archive-vi… Disk device type: virtio bitlocker is enabled in VM I am able to configure and use W11-professional without joining my work domain. The above problem isn't seen there. I booted the broken VM using my linux rescue disk image and examined the partition table. Everything seems to be proper. But windows isn't able to find the disk as I explained above. Can anybody provide any pointers for troubleshooting this ? Thanks, -Rahul

2 1

any advantage to using pool type glusterfs if no GFAPI
by W Kern 09 Oct '23

09 Oct '23

I have used fuse mounted gluster with 'dir' for years. Works great, aside from having to use the --unsafe flag on migrations. I am building up a new system and wondering if using the glusterfs type would be a better/safer choice. I'm not concerned about gfapi (host is U22LTS so I'm not even sure if it has it). I'm not concerned about the automount feature as that happens on start up anyway. I'm more interested if there is any technical or performance reasons to prefer 'glusterfs' pool type over 'dir' of course not having the --unsafe flag would be nice, but thats all scripted in anyway. -wk

2 2

Issue accidentally creating a '--type' defined pool
by Joshua Blake 04 Oct '23

04 Oct '23

Hello, I seem to have accidentally created a pool called "--type", but it doesn't appear in 'virsh pool-list'. See below. [root@vh01 /]# virsh pool-define-as --name --type dir --target /data/storage/ Pool --type defined [root@vh01 /]# virsh pool-list Name State Autostart ------------------------------ isos active yes jblake active yes [root@vh01 /]# virsh pool-destroy '--type' error: command 'pool-destroy' doesn't support option --type I can't also create a new "default" type because the directory exists for this defined '--type' [root@vh01 /]# virsh pool-define-as --name default --type dir --target /data/storage/ error: Failed to define pool default error: operation failed: Storage source conflict with pool: '--type' [root@vh01 /]# virsh pool-delete "--type" error: command 'pool-delete' doesn't support option --type Any help would be greatly appreciated.

3 3

Question about encryption and tls
by Kamil Jońca 29 Sep '23

29 Sep '23

(Posted few days ago on qemu group but no reactions) Do I understand correctly that ssl shoudl be configured independently for libvirt and each hypervisor? I asked because I configured libvirt connection as qemu+tls://bambus.kjonca/system?pkipath=... (and on bambus in /etc/libvirt/libvirtd.conf) I set key_file = ... cert_file = ... ca_file = ... But after connect and lauching (on bambus) vm I tried to snif traffic to bambus:5900 on client) and wireshark was able to detect "VNC" protocol (BTW not spice?), so I am confused. should I configure in /etc/libvirt/qemu.conf spice_tls option and certificates ? KJ

3 4