- Users - libvirt List Archives

[libvirt-users] bridge / ubuntu / no arp reply
by François Chenais 15 Oct '26

15 Oct '26

Hello I'm trying to setup a bridged guest on an ubuntu 13.10 but it doesn't work. (Everything is ok with NAT) Network sniffing shows that arp replies don't come back to the guest. Test 1 ------ Guest : ping host_bridge_ip (ok) Test 2 ------ Guest: ping other_lan_host (KO) other_lan_host - receives arp who-is request - sends arp reply - arp -a shows the guest macaddr => Guest doesn't receive reply Test 3 ------ other_lan_host ping the Guest (KO) - arp -a shows "incomplete" addr - Guest receives nothing On Host ------- network tcpdump on bridge or vnet interfaces shows request but no reply ... Thanks in advance for help or ideas François

3 4

does the 'bandwidth' work?
by lejeczek 09 Oct '26

09 Oct '26

Hi guys. I have a network like so: <network> <name>10_1_1</name> <uuid>864fb78e-0fb0-4c32-bb47-0e5ac68d9491</uuid> <forward mode='bridge'/> <bridge name='nm-bridge1011'/> <bandwidth> <inbound average='610351' peak='620000'/> <outbound average='610351' peak='620000'/> </bandwidth> </network> I'd expect this to limit network to 10Gbs - since this is in kibibytes - I assume these two add to make the max? But when I _iperf3_ in guests then I get speeds near host's native, which are much higher than expected limit. Am I missing something - no <bandwidth> in guests - or there actually might be an issue here? I'm on Centos10 with libvirt-12.8.0-1.el10 thanks, L.

2 4

When libvirt would start dnsmasq?
by lejeczek 08 Oct '26

08 Oct '26

Hi guys. Under what circumstances libvrirt would start _dnsmasq_ on it's own? I certainly did not plan for libvirt to manage dhcp but sometimes I find: -> $ netstat -utapn | grep \:67 udp 0 0 0.0.0.0:67 0.0.0.0:* 19678/dnsmasq -> $ ps -Fp 19678 UID PID PPID C SZ RSS PSR STIME TTY TIME CMD dnsmasq 19678 1 0 2258 1824 8 Oct07 ? 00:00:00 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/libexec/libvirt_leaseshelper which... does fcuk up my main (should be the only) DHCP server. Is it possible to tell libvirt not to do that no matter the circumstances? (or it's not libvirt?) many thanks, L.

3 4

Failed to unseal secret using TPM2
by lejeczek 30 Aug '26

30 Aug '26

Hi guys. Do you have some idea what is failing here: Starting virtsecretd.service - libvirt secret daemon... Failed to unseal secret using TPM2: Operation not permitted virtsecretd.service: Failed to set up credentials: Protocol error virtsecretd.service: Failed at step CREDENTIALS spawning /usr/sbin/virtsecretd: Protocol error virtsecretd.service: Main process exited, code=exited, status=243/CREDENTIALS virtsecretd.service: Failed with result 'exit-code'. Failed to start virtsecretd.service - libvirt secret daemon. I'm on Centos with libvirt-12.5.0-3.el10. Only think I can think of - this the only box out of few I have which updated - was EFI update via: -> $ fwupdmgr update After OS reboot this persists. I had to re-enrol LUKS keyslots which use TPM also, but that worked a ok, block devices unlock. Any/all suggestions/thoughts are much appreciated. Thanks.

1 1

Redirect guest COM port to host tty
by bd730c5053df9efb 25 Aug '26

25 Aug '26

Hi all! I have a slackware64-15.0 linux host running libvirt-11.10.0 with qemu 10.2.2 and a windows XP guest. I'm trying to have the gustes COM1 port redirected to the hosts /dev/ttyUSB0 device. I have not found a direct way of doing this in virt-manager since the only options for a serial device are "Output to a file", "Pseudo TTY" or a "UNIX socket". I have managed to modify the domains XML adding the following > <commandline xmlns:qemu='http://libvirt.org/schemas/domain/qemu/1.0'> > <arg value='-chardev'/> > <arg value='serial,path=/dev/ttyUSB0,id=hostserial0'/> > <arg value='-device'/> > <arg value='pci-serial,chardev=hostserial0'/> > </commandline> When I start the VM with this I get an error that says > Could not open '/dev/ttyUSB0': Operation not permitted I checked the device's permissions which are u+rw,g+rw and qemu is being executed with root permissions, I added o+rw to /dev/ttyUSB0 just in case but got the same error. I also tried with /dev/tty0 but got the same error. Thanks in advance! Best regards, Dave. Sent with Proton Mail secure email.

2 2

Libvirt/sanlock doesn't lock after a migration then trashes my disk.
by Matthew Schumacher 20 Aug '26

20 Aug '26

Hello All, Trying to figure out how this is supposed to work. I’m using pacemaker with the ocf:heartbeat:VirtualDomain to manage my virtual machines. If I start a vm on hyper-1 I get locks: > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerPluginGetDriver:275 : plugin=0x7f9b6003b080 > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerNew:298 : driver=0x7f9ba717d020 type=0 nparams=5 params=0x7f9bb00776c0 flags=0x0 > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerLogParams:96 : key=uuid type=uuid value=a5318b9d-48ea-4e06-8591-4f7826b3d0fa > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerLogParams:89 : key=name type=string value=testvm1 > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerLogParams:77 : key=id type=uint value=12 > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerLogParams:77 : key=pid type=uint value=7258 > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerLogParams:92 : key=uri type=cstring value=qemu:///system > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerAddResource:324 : lock=0x7f9ba8011280 type=0 name=/datastore/vm/testvm1/testvm1.raw nparams=0 params=(nil) flags=0x0 > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerAcquire:342 : lock=0x7f9ba8011280 state='<null>' flags=0x0 action=0 fd=(nil) > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerSanlockAcquire:1007 : Acquiring object 1 > 2026-08-20 02:11:14.845+0000: 27626: debug : virLockManagerSanlockAcquire:1057 : Acquire completed fd=-1 > 2026-08-20 02:11:14.845+0000: 27626: debug : virLockManagerFree:380 : lock=0x7f9ba8011280 If I move that VM to hyper-2 using (virsh --connect=qemu:///system --quiet migrate --live testvm1 qemu+ssh://hyper-2/system) it frees the lock on hyper-1: > 2026-08-20 02:11:32.485+0000: 27630: debug : virLockManagerPluginGetDriver:275 : plugin=0x7f9b6003b080 > 2026-08-20 02:11:32.485+0000: 27630: debug : virLockManagerNew:298 : driver=0x7f9ba717d020 type=0 nparams=5 params=0x7f9bae8744d0 flags=0x0 > 2026-08-20 02:11:32.485+0000: 27630: debug : virLockManagerLogParams:96 : key=uuid type=uuid value=a5318b9d-48ea-4e06-8591-4f7826b3d0fa > 2026-08-20 02:11:32.485+0000: 27630: debug : virLockManagerLogParams:89 : key=name type=string value=testvm1 > 2026-08-20 02:11:32.485+0000: 27630: debug : virLockManagerLogParams:77 : key=id type=uint value=12 > 2026-08-20 02:11:32.485+0000: 27630: debug : virLockManagerLogParams:77 : key=pid type=uint value=7258 > 2026-08-20 02:11:32.485+0000: 27630: debug : virLockManagerLogParams:92 : key=uri type=cstring value=(null) > 2026-08-20 02:11:32.486+0000: 27630: debug : virLockManagerAddResource:324 : lock=0x7f9b94069210 type=0 name=/datastore/vm/testvm1/testvm1.raw nparams=0 params=(nil) flags=0x0 > 2026-08-20 02:11:32.486+0000: 27630: debug : virLockManagerInquire:370 : lock=0x7f9b94069210 state=0x7f9b940656b0 flags=0x0 > 2026-08-20 02:11:32.486+0000: 27630: debug : virLockManagerSanlockInquire:1148 : pid=7258 > 2026-08-20 02:11:32.486+0000: 27630: debug : virLockManagerFree:380 : lock=0x7f9b94069210 > 2026-08-20 02:11:32.486+0000: 27630: debug : virLockManagerPluginGetName:259 : plugin=0x7f9b6003b080 > 2026-08-20 02:11:32.774+0000: 27628: debug : virLockManagerPluginUsesState:267 : plugin=0x7f9b6003b080 > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerPluginGetDriver:275 : plugin=0x7f9b6003b080 > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerNew:298 : driver=0x7f9ba717d020 type=0 nparams=5 params=0x7f9b9effc790 flags=0x0 > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerLogParams:96 : key=uuid type=uuid value=a5318b9d-48ea-4e06-8591-4f7826b3d0fa > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerLogParams:89 : key=name type=string value=testvm1 > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerLogParams:77 : key=id type=uint value=12 > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerLogParams:77 : key=pid type=uint value=7258 > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerLogParams:92 : key=uri type=cstring value=(null) > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerAddResource:324 : lock=0x7f9b60001590 type=0 name=/datastore/vm/testvm1/testvm1.raw nparams=0 params=(nil) flags=0x0 > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerRelease:358 : lock=0x7f9b60001590 state=0x7f9ba83df8d8 flags=0x0 > 2026-08-20 02:11:33.030+0000: 7260: debug : virLockManagerFree:380 : lock=0x7f9b60001590 Then on hyper-2 I get the lock: > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerPluginGetDriver:275 : plugin=0x7f4694043cd0 > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerNew:298 : driver=0x7f46be7e1020 type=0 nparams=5 params=0x7f46db6dc5f0 flags=0x0 > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerLogParams:96 : key=uuid type=uuid value=a5318b9d-48ea-4e06-8591-4f7826b3d0fa > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerLogParams:89 : key=name type=string value=testvm1 > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerLogParams:77 : key=id type=uint value=3 > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerLogParams:77 : key=pid type=uint value=17070 > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerLogParams:92 : key=uri type=cstring value=qemu:///system > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerAddResource:324 : lock=0x7f46cc006fb0 type=0 name=/datastore/vm/testvm1/testvm1.raw nparams=0 params=(nil) flags=0x0 > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerAcquire:342 : lock=0x7f46cc006fb0 state='__LIBVIRT__DISKS__:9ac7be7343fc02b995dcdfe541d0bcbc:/datastore/sanlock/9ac7be7343fc02b995dcdfe541d0bcbc:0:5' flags=0x0 action=0 fd=(nil) > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerSanlockAcquire:1007 : Acquiring object 1 > 2026-08-20 02:11:33.063+0000: 3357: debug : virLockManagerSanlockAcquire:1057 : Acquire completed fd=-1 > 2026-08-20 02:11:33.063+0000: 3357: debug : virLockManagerFree:380 : lock=0x7f46cc006fb0 All is well, but then I call on hyper-1 virsh create /datastore/vm/testvm1/testvm1.xml I get: error: internal error: QEMU unexpectedly closed the monitor (vm='testvm1'): 2026-08-20T02:12:28.413165Z qemu-system-x86_64: -device {"driver":"scsi-hd","bus":"scsi0.0","channel":0,"scsi-id":0,"lun":0,"device_id":"drive-scsi0-0-0-0","drive":"libvirt-2-storage","id":"scsi0-0-0-0","bootindex":2,"write-cache":"on"}: Failed to get "write” lock But in the logs I never see it checking the lock and while the NFS4.2 file system didn’t give it a lock and blocked, it still trashes the VM disk and the VM shows disk errors and mounts read-only. Shouldn’t libvirt/sanlock block this before starting qemu? I’m running libvirt 12.6.0 and qemu 10.2.4 on kernel 6.18.44. I would think these settings would work: # grep lock_ /etc/libvirt/qemu.conf lock_manager = "sanlock" # grep "^[^#]" /etc/libvirt/qemu-sanlock.conf auto_disk_leases = 1 disk_lease_dir = "/datastore/sanlock" host_id = 1 require_lease_for_disks = 1 Thanks!

1 0

File permissions in CIFS network filesystem pool
by Thomas Pircher 19 Aug '26

19 Aug '26

Hi, I'm trying to use a network filesystem pool on a Samba/CIFS share. Libvirt is configured with this pool: <pool type='netfs'> <name>netfs-default</name> <source> <host name='samba.lan.internal'/> <dir path='libvirt/default'/> <format type='cifs'/> </source> <target> <path>/var/lib/libvirt/images/netfs/default</path> <permissions> <mode>0755</mode> <owner>0</owner> <group>0</group> </permissions> </target> </pool> The Samba share is configured with: [libvirt] comment = VM storage pool browseable = yes path = /srv/datastore/samba/libvirt/ writeable = yes public = no guest ok = yes create mask = 0644 directory mask = 0755 force user = shared force group = +shared I can create the pool in virsh. The mounted files are owned by root on the libvirt machine. I can create and edit files as root if I access them via shell. However, libvirt can't start VMs. It fails to open the qcow2 file in the network filesystem pool with "permission denied". The libvirt host is Debian 14 (testing). I can't see any Selinux or Apparmor messages when the failure happens. So I believe the permissions problem is that libvirt tries to access the files as libvirt-qemu user, and this fails. I have tried adding the following snippet to the network fs pool definition, but after saving the pool, these options simply vanish from the network fs pool definition: <fs:mount_opts> <fs:option name='uid=libvirt-qemu'/> <fs:option name='gid=libvirt-qemu'/> </fs:mount_opts> So my question: how can I make this work? I have previously tried using NFSv4, but ran into similar issues. I guess I could make this work by mounting the share outside of libvirt and then point the filesystem pool at the mounted directory. Is there a more elegant way? Thanks, Thomas

2 2

Could not initialize refcount handling - efi ?
by lejeczek 17 Jul '26

17 Jul '26

Hi guys. I cannot start a domain - I wonder if the firmware, in xml, have anything to do with it or issue is different? Jul 17 11:07:41 virtqemud[5658]: Unable to read from monitor: Connection reset by peer Jul 17 11:07:41 virtqemud[5658]: internal error: QEMU unexpectedly closed the monitor (vm='ubusrv2'): 2026-07-17T09:07:41.089484Z qemu-kvm: -blockdev {"node-name":"libvirt-2-format","read-only":false,"discard":"unmap","cache":{"direct":true,"no-flush":false},"driver":"qcow2","encrypt":{"format":"luks","key-secret":"libvirt-2-format-encryption-secret0"},"file":"libvirt-2-storage","backing":null}: Could not initialize refcount handling: Input/output error Jul 17 11:07:41 virtqemud[5658]: internal error: process exited while connecting to monitor: 2026-07-17T09:07:41.089484Z qemu-kvm: -blockdev {"node-name":"libvirt-2-format","read-only":false,"discard":"unmap","cache":{"direct":true,"no-flush":false},"driver":"qcow2","encrypt":{"format":"luks","key-secret":"libvirt-2-format-encryption-secret0"},"file":"libvirt-2-storage","backing":null}: Could not initialize refcount handling: Input/output error Above happens with: <os firmware='efi'> <type arch='x86_64' machine='pc-q35-rhel10.2.0'>hvm</type> <firmware> <feature enabled='no' name='enrolled-keys'/> <feature enabled='yes' name='secure-boot'/> </firmware> <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/ubusrv2_VARS.fd</nvram> if I do not use EFI than domain starts, no above virtqemud errors, but guest does not boot, expectedly I think - I used to boot a ok. qemu-img shows no issues. Any thoughts? many thanks, L.

2 3

SELinux label with nvram?
by lejeczek 15 Jul '26

15 Jul '26

Hi guys. Having a domain like so: .... <os firmware='efi'> <type arch='x86_64' machine='pc-q35-rhel10.2.0'>hvm</type> <firmware> <feature enabled='yes' name='enrolled-keys'/> <feature enabled='yes' name='secure-boot'/> </firmware> <loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/ubusrv2_VARS.fd</nvram> ... <seclabel type='dynamic' model='selinux' relabel='yes'> <label>system_u:system_r:svirt_t:s0</label> <imagelabel>system_u:object_r:svirt_image_t:s0</imagelabel> </seclabel> <seclabel type='dynamic' model='dac' relabel='yes'> <label>+107:+107</label> <imagelabel>+107:+107</imagelabel> </seclabel> _seclabels_ are from virt-install - I'd presume this mandatory/default Any such domain - using NVRAM - fails to start with SELinux logging: ... virtqemud[1340835]: internal error: child reported (status=125): Requested operation is not valid: Setting different SELinux label on /var/lib/libvirt/qemu/nvram/ubusrv2_VARS.fd which is already in use ... Do you have any thoughts on how to "fix" it? I think I've seen this/similar issue a few years ago - I might have even filed a BZ. Also - I got a number of rpm updates among which is qemu to version 10.1.0-24 - prior to that my VMs worked a ok, on Centos 10. Anybody with similar experience? many thanks, L.

2 1

Extending sVirt to work under qemu:///session
by procmem＠riseup.net 07 Jun '26

07 Jun '26

Hi. I'm a developer with the security and privacy project; WhonixOS and recently we've ported our VMs to make use of the unprivileged qemu:///session mode to be compatible with our host OS that runs in a strict user only mode for daily activities. To my surprise, sVirt is not applied to VMs running in this mode. Inter VM isolation is important for our security model where traffic from an untrusted VM is forcefully tunneled to a trusted gateway VM running Tor to anonymize traffic. We don't want to be in a situation where we have to choose between running in the relatively riskier qemu:///system mode to gain the benefits of sVirt vs sacrificing sVirt inter VM isolation in order to be more compatible with our stricter unprivileged user implementation (which is just safer overall). Please consider extending sVirt to be compatible with qemu session for AppArmor and SELinux

1 0