- Users - libvirt List Archives

AMD SEV-SNP encryption at rest
by me+libvirt＠gsora.xyz 14 Oct '24

14 Oct '24

Hello folks, I’m exploring the capabilities of the AMD SEV-SNP platform for a TEE implementation that will handle and store secret data. This data should be tied to a single guest, that is no other guest that boots with the same kernel/initrd/cmdline - in the form of a UKI - should be able to decrypt it. I have a prototype that encrypts the boot disk with a key derived from the VCEK, but a different guest is able to derive the same key provided it boots either the same UKI. The key has been derived with the snpguest tool developed by the virtee project. Does anybody have experience with encryption at rest with the AMD SEV SNP platform? I understand that it’s possible to inject secrets into a SEV VM at creation time, but documentation is scarce on that front. Thank you

2 1

New application (library)
by Erik Huelsmann 05 Oct '24

05 Oct '24

Hi! On https://libvirt.org/apps.html it says to send a mail to this mailinglist to get your app listed on apps/libraries the list. Over the past months, I've been writing a set of Perl libraries, culminating in Sys::Async::Virt (https://metacpan.org/pod/Sys::Async::Virt) which is a library for developing LibVirt client applications supporting the asynchronous paradigm introduced by Future::AsyncAwait ( https://metacpan.org/pod/Future::AsyncAwait) The library binds to the network protocol and instantiates Perl objects for manipulating server-side resources. The API tries to stay close to the Sys::Virt API, although I've been looking closely at the C API as well. At the time of writing, the local and ssh transports are supported, but work is on-going for more. Not all protocol messages are supported at the moment; 47 out of 448 messages are remaining. Effort to implement them is on-going here too. The list of unimplemented messages is published at the bottom of the documentation page on MetaCPAN referenced above. Let me know your feedback, or submit your bugs and ideas at https://github.com/ehuelsmann/perl-sys-async-virt. Thanks in advance for listing the library! -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

How to use UEFI_VARS.fd using virt-manager on Ubuntu 24.04...
by Mario Marietto 01 Oct '24

01 Oct '24

Hello. On FreeBSD I've installed Windows 11 on the first partition of a 200 GB disk and Android X86 on the second partition of a 200 GB image file called "Android.img". This is how I boot Android : /usr/sbin/./bhyve-win -S -c sockets=4,cores=2,threads=1 -m 8G -w -H -A \ -s 0,hostbridge \ -s 1,ahci-hd,/mnt/zroot-133/bhyve/img/Android/Android.img,bootindex=1 \ -s 13,virtio-net,tap13 \ -s 29,fbuf,tcp=0.0.0.0:5913,w=1600,h=950,wait \ -s 30,xhci,tablet \ -s 31,lpc \ -l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI_CODE.fd,/usr/local/share/uefi-firmware/BHYVE_UEFI_VARS.fd \ as you can see to boot Android correctly,I SHOULD use "/usr/local/share/uefi-firmware/BHYVE_UEFI_VARS.fd" Now I'm using Ubuntu 24.04 and I want to boot Android from the same img file. But,what I don't know is how to add the parameter "/usr/local/share/uefi-firmware/BHYVE_UEFI_VARS.fd" to virt-manager. Without it Android will not boot,but only Windows is able to boot ONLY from the first partition.... -- Mario.

1 0

Debian pipewire host + Debian pipewire guest with SPICE = No sound
by bo0od＠whonix.org 28 Sep '24

28 Sep '24

Debian 12 DVD installed, Debian XML: ``` <domain type='kvm'> <name>debian-12-DVD</name> <uuid>0471b577-3315-4cfb-8d65-87a3ca34cc22</uuid> <metadata> <libosinfo:libosinfo xmlns:libosinfo="http://libosinfo.org/xmlns/libvirt/domain/1.0"> <libosinfo:os id="http://debian.org/debian/12"/> </libosinfo:libosinfo> </metadata> <memory unit='KiB'>2097152</memory> <currentMemory unit='KiB'>2097152</currentMemory> <vcpu placement='static'>2</vcpu> <os> <type arch='x86_64' machine='pc-q35-8.2'>hvm</type> <bootmenu enable='no'/> </os> <features> <acpi/> <apic/> <vmport state='off'/> </features> <cpu mode='host-passthrough' check='none' migratable='on'/> <clock offset='utc'> <timer name='rtc' tickpolicy='catchup'/> <timer name='pit' tickpolicy='delay'/> <timer name='hpet' present='no'/> </clock> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <pm> <suspend-to-mem enabled='no'/> <suspend-to-disk enabled='no'/> </pm> <devices> <emulator>/usr/bin/qemu-system-x86_64</emulator> <disk type='file' device='disk'> <driver name='qemu' type='qcow2' discard='unmap'/> <source file='/var/lib/libvirt/images/debian-12-DVD.qcow2'/> <target dev='vda' bus='virtio'/> <boot order='1'/> <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/> </disk> <disk type='file' device='cdrom'> <driver name='qemu' type='raw'/> <target dev='sda' bus='sata'/> <readonly/> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> <controller type='usb' index='0' model='qemu-xhci' ports='15'> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </controller> <controller type='pci' index='0' model='pcie-root'/> <controller type='pci' index='1' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='1' port='0x10'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/> </controller> <controller type='pci' index='2' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='2' port='0x11'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/> </controller> <controller type='pci' index='3' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='3' port='0x12'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/> </controller> <controller type='pci' index='4' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='4' port='0x13'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/> </controller> <controller type='pci' index='5' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='5' port='0x14'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/> </controller> <controller type='pci' index='6' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='6' port='0x15'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/> </controller> <controller type='pci' index='7' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='7' port='0x16'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/> </controller> <controller type='pci' index='8' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='8' port='0x17'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x7'/> </controller> <controller type='pci' index='9' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='9' port='0x18'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0' multifunction='on'/> </controller> <controller type='pci' index='10' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='10' port='0x19'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x1'/> </controller> <controller type='pci' index='11' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='11' port='0x1a'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x2'/> </controller> <controller type='pci' index='12' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='12' port='0x1b'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x3'/> </controller> <controller type='pci' index='13' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='13' port='0x1c'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x4'/> </controller> <controller type='pci' index='14' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='14' port='0x1d'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x5'/> </controller> <controller type='sata' index='0'> <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/> </controller> <controller type='virtio-serial' index='0'> <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/> </controller> <interface type='network'> <mac address='52:54:00:33:90:23'/> <source network='default'/> <model type='virtio'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> <serial type='pty'> <target type='isa-serial' port='0'> <model name='isa-serial'/> </target> </serial> <console type='pty'> <target type='serial' port='0'/> </console> <channel type='unix'> <target type='virtio' name='org.qemu.guest_agent.0'/> <address type='virtio-serial' controller='0' bus='0' port='1'/> </channel> <channel type='spicevmc'> <target type='virtio' name='com.redhat.spice.0'/> <address type='virtio-serial' controller='0' bus='0' port='2'/> </channel> <input type='tablet' bus='usb'> <address type='usb' bus='0' port='1'/> </input> <input type='mouse' bus='ps2'/> <input type='keyboard' bus='ps2'/> <graphics type='spice' autoport='yes'> <listen type='address'/> <image compression='off'/> </graphics> <sound model='ich9'> <address type='pci' domain='0x0000' bus='0x00' slot='0x1b' function='0x0'/> </sound> <audio id='1' type='spice'/> <video> <model type='virtio' heads='1' primary='yes'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </video> <redirdev bus='usb' type='spicevmc'> <address type='usb' bus='0' port='2'/> </redirdev> <redirdev bus='usb' type='spicevmc'> <address type='usb' bus='0' port='3'/> </redirdev> <watchdog model='itco' action='reset'/> <memballoon model='virtio'> <address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/> </memballoon> <rng model='virtio'> <backend model='random'>/dev/urandom</backend> <address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/> </rng> </devices> </domain> ``` Qemu ticket: https://gitlab.com/qemu-project/qemu/-/issues/2561

1 0

KVM Fails 3D Acceleration on Debian (failed to validate against schema)
by bo0od＠whonix.org 28 Sep '24

28 Sep '24

Full VM xml: ``` <domain type='kvm'> <name>Whonix-Gateway</name> <uuid>c011d3d3-8383-47a8-b2cd-d54f883d8af1</uuid> <genid>bc5b233c-46ea-4bfb-ad99-00f1165a09e6</genid> <description>Do not change any settings if you do not understand the consequences! Learn more: https://www.whonix.org/wiki/KVM#XML_Settings</description> <memory dumpCore='off' unit='KiB'>1250000</memory> <currentMemory unit='KiB'>1250000</currentMemory> <blkiotune> <weight>250</weight> </blkiotune> <memoryBacking> <nosharepages/> <allocation mode='ondemand'/> <discard/> </memoryBacking> <vcpu placement='static' cpuset='0'>1</vcpu> <os> <type arch='x86_64' machine='pc-q35-9.0'>hvm</type> <boot dev='hd'/> </os> <features> <acpi/> <hap state='on'/> <pvspinlock state='on'/> <pmu state='off'/> <vmport state='off'/> </features> <cpu mode='host-passthrough' check='none' migratable='on'/> <clock offset='utc'> <timer name='rtc' tickpolicy='catchup' track='guest'/> <timer name='kvmclock' present='yes'/> <timer name='pit' present='no'/> <timer name='hpet' present='no'/> <timer name='hypervclock' present='no'/> </clock> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>restart</on_crash> <pm> <suspend-to-mem enabled='no'/> <suspend-to-disk enabled='no'/> </pm> <devices> <emulator>/usr/bin/qemu-system-x86_64</emulator> <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/var/lib/libvirt/images/Whonix-Gateway.qcow2'/> <target dev='vda' bus='virtio'/> <address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/> </disk> <controller type='virtio-serial' index='0'> <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/> </controller> <controller type='usb' index='0' model='qemu-xhci'> <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/> </controller> <controller type='sata' index='0'> <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/> </controller> <controller type='pci' index='0' model='pcie-root'/> <controller type='pci' index='1' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='1' port='0x10'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/> </controller> <controller type='pci' index='2' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='2' port='0x11'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/> </controller> <controller type='pci' index='3' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='3' port='0x12'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/> </controller> <controller type='pci' index='4' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='4' port='0x13'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/> </controller> <controller type='pci' index='5' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='5' port='0x14'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/> </controller> <controller type='pci' index='6' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='6' port='0x15'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/> </controller> <controller type='pci' index='7' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='7' port='0x16'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/> </controller> <interface type='network'> <mac address='52:54:00:c1:95:49'/> <source network='Whonix-External'/> <model type='virtio'/> <driver name='qemu'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> <interface type='network'> <mac address='52:54:00:bf:80:2e'/> <source network='Whonix-Internal'/> <model type='virtio'/> <driver name='qemu'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </interface> <serial type='pty'> <target type='isa-serial' port='0'> <model name='isa-serial'/> </target> </serial> <console type='pty'> <target type='serial' port='0'/> </console> <channel type='spicevmc'> <target type='virtio' name='com.redhat.spice.0'/> <address type='virtio-serial' controller='0' bus='0' port='1'/> </channel> <input type='mouse' bus='ps2'/> <input type='keyboard' bus='ps2'/> <graphics type='spice' autoport='yes'> <listen type='address'/> <clipboard copypaste='no'/> <filetransfer enable='no'/> <gl enable='yes'/> </graphics> <audio id='1' type='spice'/> <video> <model type='virtio' heads='1' primary='yes'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> <acceleration accel3d='yes' accel2d='yes'/> <gl enable='yes'/> </video> <watchdog model='itco' action='reset'/> <memballoon model='none'/> <rng model='virtio'> <rate bytes='1024' period='1000'/> <backend model='random'>/dev/random</backend> <address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/> </rng> </devices> </domain> ``` But it will always show: ``` error: XML document failed to validate against schema: Unable to validate doc against /usr/share/libvirt/schemas/domain.rng Extra element devices in interleave Element domain failed to validate content ``` Any idea how to resolve this?

2 2

How to enable KVM nesting virtualization on the Jetson nano.
by Mario Marietto 22 Sep '24

22 Sep '24

Hello to everyone. while I was looking for a way to enable the nesting virtualization on my Jetson nano,after having enabled KVM applying these patches : https://github.com/OE4T/linux-tegra-4.9/blob/oe4t-patches-l4t-r37.4/ <https://github.com/OE4T/linux-tegra-4.9/blob/oe4t-patches-l4t-r32.4/arch/ar…> When I have googled for acquiring more informations,I found these interesting threads : https://patches.linaro.org/project/qemu-devel/patch/b7c2626e6c720ccc43e5719… https://superuser.com/questions/1838383/arm-cpu-nested-virtualization-how-c… On the first site,he says : > can be enabled by "-M virt,accel=kvm,virtualization=on" when starting a VM Good,I could try,but I'm not using qemu directly (I've installed qemu vers. 9) ,but virt-manager version 4.0. Maybe I should upgrade it ? In virt-manager I don't see how I can specify those parameters. Anyway I'm not sure that it will work,because on the second thread he said to : -append "kvm-arm.mode=nested" \ Where is the truth ? Very thanks. -- Mario.

1 0

Host network conflicting with guests network
by bd730c5053df9efb 20 Sep '24

20 Sep '24

Hi all! I have a question about networking and haven't been able to find it online. I need to replicate a server installation in a host to be able to test a procedure but the host is on the same network as the servers so I am not being able to create an isolated network on the host because there is an interface in the same range of ip adresses. Is there any way to create this isolated virtual network without it conflicting with the hosts network? Thanks in advance! Best regards, Dave. Sent with Proton Mail secure email.

3 8

libvirtError with pipewire audio backend
by Karl Frederick Roldan 17 Sep '24

17 Sep '24

Hi everyone, I'm having trouble regarding using the pipewire backend for libvirt. My OS is GNU Guix with Wayland and pipewire running with wireplumber on a user session. I have the following versions: libvirt-9.10.0 (with pipewire enabled) qemu-8.2.2 (with pipewire enabled) libpipewire-1.0.3 I only modified the =<audio>= configuration in the xml file using =sudo virsh edit win10= as follows: <audio id='1' type='pipewire' runtimeDir='/run/user/1000'/> I can confirm that pipewire is running and that I have pipewire sockets in the directory specified. But when running the VM using virt-manager, I get the following error: Error starting domain: internal error: process exited while connecting to monitor: 2024-09-17T05:54:03.785811Z qemu-system-x86_64: Failed to initialize PW context Traceback (most recent call last): File "/gnu/store/nxpr6npj618pqmlanqqh7ks9a92jgm98-virt-manager-4.1.0/share/virt-manager/virtManager/asyncjob.py", line 72, in cb_wrapper callback(asyncjob, *args, **kwargs) File "/gnu/store/nxpr6npj618pqmlanqqh7ks9a92jgm98-virt-manager-4.1.0/share/virt-manager/virtManager/asyncjob.py", line 108, in tmpcb callback(*args, **kwargs) File "/gnu/store/nxpr6npj618pqmlanqqh7ks9a92jgm98-virt-manager-4.1.0/share/virt-manager/virtManager/object/libvirtobject.py", line 57, in newfn ret = fn(self, *args, **kwargs) File "/gnu/store/nxpr6npj618pqmlanqqh7ks9a92jgm98-virt-manager-4.1.0/share/virt-manager/virtManager/object/domain.py", line 1402, in startup self._backend.create() File "/gnu/store/yaqxaja0ckyf6fm7gnd9iqlrijz6qcqy-python-libvirt-10.6.0/lib/python3.10/site-packages/libvirt.py", line 1362, in create raise libvirtError('virDomainCreate() failed') libvirt.libvirtError: internal error: process exited while connecting to monitor: 2024-09-17T05:54:03.785811Z qemu-system-x86_64: Failed to initialize PW context If I switch the audio backend back to =spice=, the VM will run but there's no sound. I am not sure if this is a virt-manager problem or I somehow misconfigured libvirt. How should I proceed about this problem?

2 2

About virsh(1) and Postcopy migration
by Prasad Pandit 04 Sep '24

04 Sep '24

Hello, * virsh(1) offers multiple options to initiate Postcopy migration: 1) virsh migrate --postcopy --postcopy-after-precopy 2) virsh migrate --postcopy + virsh migrate-postcopy 3) virsh migrate --postcopy --timeout <N> --timeout-postcopy When Postcopy migration is invoked via options (2) or (3) above, the migrated guest on the destination host hangs sometimes. But such a hang is not reproducible with option (1) above. * When using option (1) above, libvirtd(8) waits for the first pass of pre-copy to finish before enabling postcopy migration. * Does the same waiting happen when using options (2) and (3) above? === 2024-07-24 14:16:27.448+0000: msg={"execute":"migrate" 2024-07-24 14:16:29.318+0000: msg={"execute":"migrate-start-postcopy" 2024-07-24 14:28:39.737+0000: msg={"execute":"migrate" 2024-07-24 14:28:41.119+0000: msg={"execute":"migrate-start-postcopy" 2024-07-24 14:44:11.684+0000: msg={"execute":"migrate" 2024-07-24 14:44:12.835+0000: msg={"execute":"migrate-start-postcopy" 2024-07-24 14:48:00.675+0000: msg={"execute":"migrate" 2024-07-24 14:48:02.319+0000: msg={"execute":"migrate-start-postcopy" 2024-07-24 15:03:36.110+0000: msg={"execute":"migrate" 2024-07-24 15:03:37.341+0000: msg={"execute":"migrate-start-postcopy" 2024-07-24 16:05:25.602+0000: msg={"execute":"migrate" 2024-07-24 16:05:26.756+0000: msg={"execute":"migrate-start-postcopy" === * While running migration tests with options (2) and (3) above, switch to postcopy appears to happen within 2 seconds of starting migration. - Is that reasonable time to switch from pre-copy to postcopy? - Is there an ideal time to wait before switching to postcopy? * The feature page below suggests to wait until one cycle of RAM migration has completed -> https://wiki.qemu.org/Features/PostCopyLiveMigration * I'd much appreciate any clarification/confirmation about this. Thank you. --- -Prasad

2 3

Possible issue with shared folder from host to virtual machine
by Mulloch94＠protonmail.com 04 Sep '24

04 Sep '24

I ran into an issue when trying to connect a shared folder from my host to my virtual OS in KVM. The folder actually does appear in the virtual OS, but it's empty, unlike the folder in the host which has files in it. I'm not ruling out the possibility that I configured something wrong, but the instructions on setting it up seemed to be pretty straightforward. Basically I did the following procedures: mkdir ~/shared chmod 777 ~/shared Went to VirtManager enabled shared memory, added FileSystem with driver virtiofs. My source path to find the folder was /home/username/shared and the target path was /mnt/shared. Upon booting the virtual machine everything seemed to work. I found the folder where it should be, only there was nothing in it. And on the host there was files I had already placed in the folder. So this is where I'm at now.

2 1