- Users - libvirt List Archives

Running DHCP server inside of the Guest VM instead of the host.
by gameplayer2019pl＠tutamail.com 27 Mar '25

27 Mar '25

Hello, I've recently tried to run KEA DHCP server inside of a Debian VM and the following host interface configuration, attached to that VM: ``` <network> <name>netasn-dhcpv6</name> <bridge name="netasn-dhcpv6" stp="on" delay="0"/> <mtu size="1500"/> <mac address="XX:XX:XX:XX:XX:XX"/> <dns enable="no"/> <ip family="ipv6" address="2a14:7581:feb::1" prefix="64"> </ip> </network> ``` But whenever I'm trying to run dhclient on another Debian VM attached to the same network I couldn't obtain the IPv6 lease from KEA DHCP. The host is as well running Debian, 12 version. Is there anyway to make the DHCP work from Guest VM instead of using built-in libvirt DHCP?

2 2

Integrating Open Virtual Network with Libvert Provisioned VMs
by odukoyaonline＠gmail.com 26 Mar '25

26 Mar '25

I am having a little confusion trying to integrate OVN defined networks(I tried with Ovs and it worked fine) with the VMs I have provisioned with Libvirt. I want to ask if there are resource around this and if not, will appreciate input from anyone who has a prior experience with it no matter how little.

1 0

General use of zstd instead of zlib compression
by Michael Niehren 17 Mar '25

17 Mar '25

Hi, currently i use on all VM's qcow2-Images with zlib compression. If i do an Backup, the Backup-Image will be compressed with zstd Level 3 to shrink the image for transfering it over not so fast internet connections. So, why not directly using zstd compression on the images. Are there any reason's not to do that ? As i always use virt-manager for administration, i patched qemu (V9.2.2) to create on default zstd compressed images (only 1 change in line 3525). So newly created images do have compression type zstd, which work's (qemi-img info). I see one unusual thing. If i do an qemi-img convert with compression_type=zstd the size of the converted image is much smaller than the original file while "qemu-img info" shows on both as compression type zstd. Do they use different compression levels, maybe ? If i now do an virsh backup-begin <domain>, the backup-Image does also has a bigger size than the original, while showing zstd as compression type (qemu-img info). If i convert it with the similar command as above, both converted images has nearly the same size. Even if i copy the smaller converted image to the original and boot the vm from the smaller image, the backup-image (after backup-begin) is bigger. So, i am confused. Are there any explanations about the different image sizes or what's going on here ? best regards Michael

3 10

live migration of SR-IOV vm
by Paul B. Henson 17 Mar '25

17 Mar '25

I have a vm using an sr-iov NIC that I'm testing live migration on (Debian 12, OS packages). Per the documentation, I have the sr-iov link set as transient with a pointer to the persistent virtio link: <interface type='network'> <mac address='52:54:00:a1:e0:38'/> <source network='sr-iov-intel-10G-1'/> <vlan> <tag id='400'/> </vlan> <model type='virtio'/> <teaming type='transient' persistent='ua-sr-iov-backup'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> and a persistent virto link down by default: <interface type='direct'> <mac address='52:54:00:a1:e0:38'/> <source dev='eno5np0.400' mode='bridge'/> <model type='virtio'/> <teaming type='persistent'/> <link state='down'/> <alias name='ua-sr-iov-backup'/> <address type='pci' domain='0x0000' bus='0x07' slot='0x00' function='0x0'/> </interface> The failover driver finds this in the vm: 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 100 0 3: eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel master eth0 state DOWN mode DEFAULT group default qlen 1000 10: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master eth0 state UP mode DEFAULT group default qlen 1000 and the network works fine. However, during migration, the sr-iov interface is removed, but the link on the virtio interface is *not* brought up: 2: eth0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default qlen 1000 3: eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel master eth0 state DOWN mode DEFAULT group default qlen 1000 resulting in no network for part of the migration. Once the box finished migrating, the replacement sv-iov link is plugged back in, and all is well once again: 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000 3: eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel master eth0 state DOWN mode DEFAULT group default qlen 1000 11: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master eth0 state UP mode DEFAULT group default qlen 1000 My understanding was that virsh migrate was supposed to automatically bring up the virtio link when the sr-iov link is removed? Or do I need to explicitly bring it up myself before the migration and take it down after? If I bring up the link manually before the migration, there are a few packets lost at that time, but then none are lost during the migration when the sr-iov link is pulled, or after the migration when I shut that link down again. Ideally no packets would be lost :), but I realize that's unlikely in practice... Thanks...

1 1

system cache dropped
by matus valentin 15 Mar '25

15 Mar '25

Hi, I have a setup with multiple virtual machines (VMs), each with a saved state. All VMs share the same parent, which is located on a shared drive. Whenever I restore any VM using virsh restore, the parent is dropped from the system cache, causing all data to be downloaded from the shared drive again. This results in unnecessary network traffic, even though the parent changes very rarely. However, if I create a child from the parent and call virsh create to create a new VM, the parent is never dropped from the system cache. Is this expected behavior? Should the parent be retained in the system cache during a virsh restore operation? Are there any configurations or settings that can prevent the parent from being dropped from the cache? thanks

1 0

best backup strategy for full backup's
by Michael Niehren 10 Mar '25

10 Mar '25

Hi together, actually i only do full-backup's of my virtual machines. I use the for the backup the "old" strategy: - virsh snapshot-create-as $vmname overlay --disk-only --atomic --no-metadata --quiesce - copy the qcow2 image file - virsh blockcommit $vmname $device --active --wait --pivot - the guest agent in the VM got's an 2 seconds freeze/thaw intervall Now i want to switch to the new strategy with "backup-begin". - virsh backup-begin $vmname - the guest agent does not got an freez/thaw signal As the guest agent got's no signal, is the backup over "backup-begin" still consistent ? Or do i have to be consistent to send an virsh domfsfreeze $vmname before starting the backup and an virsh domfsthaw $vmname it it is finished ? If so, the time intervall between freeze/thaw would be on an huge disk much more then 2 secords. So, is the old method currently still the better way, if only doing full-backup's ? best regards, Michael

2 6

So hey let's talk about this nftables ordering situation.
by robinleepowell＠gmail.com 26 Feb '25

26 Feb '25

So I, like many other people, have hit problems with nftables ordering, as has been discussed on this mailing list MANY TIMES. This whole thing seemed ridiculous so I asked the nftables people about what one is *supposed* to do in this situation. It turns out that the standard solution is for libvirt's nftables rules to set a packet mark (there's a collision possibility here but it's a 32 bit integer if you pick one at random it shouldn't be a problem) and then the user adds a rule to exclude packets with that mark from any reject rules they might have, or explicitly accept marked packets in their own chains, or whatever. It's not *as nice* as the iptables situation, but having documentation that says "if you're using nftables make sure that packets with mark 79892 are accepted in all your chains" is quite straightforward compared to the current situation of "LOL good luck". (I'm not blaming anyone there!, the current situation is impossible for libvirt to navigate and it's not anyone's fault.) If y'all don't like that, what's working excellently for me is adding `iifname "virbr*" accept` to my rule chain. FWIW. It was very hard to navigate through this situation because there's no documentation that this problem even exists. My suggestion is to describe the situation at https://libvirt.org/firewall.html and suggest the virbr* fix, and down the road maybe look at this mark thing. I'd like to help. I'm happy to write up issues for this, and I'm happy to write the updates to the firewall docs; just tell me what you'd like me to do.

4 8

nftables rules (DNS, DHCP, etc) not being written on Fedora 41
by robinleepowell＠gmail.com 22 Feb '25

22 Feb '25

I do not think this is any of the similar issues that have been posted to this list; I've checked. In particular, this in *NOT* an issue with nft rules precedence; the rules are simply not being written by libvirt. I'm running vagrant which is running libvirt on a Fedora 41 host. I do not think this is a vagrant problem, but if people want me to run virsh commands directly I certainly can. Anyway, vagrant was failing until I noticed that the default for /etc/libvirt/network.conf is now nftables, which I did not have set up. When I set `firewall_backend = "iptables"`, everything worked fine. I want to emphasize that: the same vagrant / libvirt setup *was* working with iptables. But I took that as a sign that it was time to move to nftables, so I moved everything on this host and stuff is back to working. But libvirt just isn't writing out the right nft rules. Like, at all. Here's the network vagrant creates: $ sudo virsh net-dumpxml vagrant-libvirt <network connections='1' ipv6='yes'> <name>vagrant-libvirt</name> <uuid>b2d93ef4-b305-4382-a380-c1eca92d8ebd</uuid> <forward mode='nat'> <nat> <port start='1024' end='65535'/> </nat> </forward> <bridge name='virbr1' stp='on' delay='0'/> <mac address='52:54:00:63:d3:f6'/> <ip address='192.168.121.1' netmask='255.255.255.0'> <dhcp> <range start='192.168.121.1' end='192.168.121.254'/> </dhcp> </ip> </network> And here's the *entire* libvirt-related ruleset in nftables: table ip libvirt_network { chain forward { type filter hook forward priority filter; policy accept; counter packets 0 bytes 0 jump guest_cross counter packets 0 bytes 0 jump guest_input counter packets 0 bytes 0 jump guest_output } chain guest_output { ip saddr 192.168.121.0/24 iif "virbr1" counter packets 0 bytes 0 accept iif "virbr1" counter packets 0 bytes 0 reject } chain guest_input { oif "virbr1" ip daddr 192.168.121.0/24 ct state established,related counter packets 0 bytes 0 accept oif "virbr1" counter packets 0 bytes 0 reject } chain guest_cross { iif "virbr1" oif "virbr1" counter packets 0 bytes 0 accept } chain guest_nat { type nat hook postrouting priority srcnat; policy accept; ip saddr 192.168.121.0/24 ip daddr 224.0.0.0/24 counter packets 1 bytes 187 return ip saddr 192.168.121.0/24 ip daddr 255.255.255.255 counter packets 0 bytes 0 return meta l4proto tcp ip saddr 192.168.121.0/24 ip daddr != 192.168.121.0/24 counter packets 0 bytes 0 masquerade to :1024-65535 meta l4proto udp ip saddr 192.168.121.0/24 ip daddr != 192.168.121.0/24 counter packets 0 bytes 0 masquerade to :1024-65535 ip saddr 192.168.121.0/24 ip daddr != 192.168.121.0/24 counter packets 0 bytes 0 masquerade } } table ip6 libvirt_network { chain forward { type filter hook forward priority filter; policy accept; counter packets 0 bytes 0 jump guest_cross counter packets 0 bytes 0 jump guest_input counter packets 0 bytes 0 jump guest_output } chain guest_output { iif "virbr1" counter packets 0 bytes 0 reject } chain guest_input { oif "virbr1" counter packets 0 bytes 0 reject } chain guest_cross { iif "virbr1" oif "virbr1" counter packets 0 bytes 0 accept } chain guest_nat { type nat hook postrouting priority srcnat; policy accept; } } Here's some log output (I have virtnetworkd running with -v): $ sudo journalctl -u virtnetworkd.service | grep -i nft [snip] Feb 20 21:36:42 stodi.digitalkingdom.org virtnetworkd[89119]: using firewall_backend: 'nftables' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft list table ip libvirt_network' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft list table ip6 libvirt_network' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_output iif virbr1 counter reject' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_input oif virbr1 counter reject' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_cross iif virbr1 oif virbr1 counter accept' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip6 libvirt_network guest_output iif virbr1 counter reject' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip6 libvirt_network guest_input oif virbr1 counter reject' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip6 libvirt_network guest_cross iif virbr1 oif virbr1 counter accept' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_output ip saddr 192.168.121.0/24 iif virbr1 counter accept' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_input oif virbr1 ip daddr 192.168.121.0/24 ct state related,established counter accept' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_nat ip saddr 192.168.121.0/24 ip daddr '!=' 192.168.121.0/24 counter masquerade' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_nat meta l4proto udp ip saddr 192.168.121.0/24 ip daddr '!=' 192.168.121.0/24 counter masquerade to :1024-65535' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_nat meta l4proto tcp ip saddr 192.168.121.0/24 ip daddr '!=' 192.168.121.0/24 counter masquerade to :1024-65535' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_nat ip saddr 192.168.121.0/24 ip daddr 255.255.255.255/32 counter return' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_nat ip saddr 192.168.121.0/24 ip daddr 224.0.0.0/24 counter return' So it's not like trying to create the rules and failing, that I can see; it just isn't trying. To clarify this setup appears to be missing every rule that would be needed for DHCPv4 and DNS to work. Like https://gitlab.com/libvirt/libvirt/-/issues/88#note_694493261 shows rules for udp 67 and 53 that are just 100% not being created at all. I have no idea what's going wrong here or even where to look; the code at https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/GT75… sure *looks like* it should be unconditionally adding those rules. Help?

2 2

nftables rules (DNS, DHCP, etc) not being written on Fedora 41
by Robin Lee Powell 21 Feb '25

21 Feb '25

I do not think this is any of the similar issues that have been posted to this list; I've checked. In particular, this in *NOT* an issue with nft rules precedence; the rules are simply not being written by libvirt. I'm running vagrant which is running libvirt on a Fedora 41 host. I do not think this is a vagrant problem, but if people want me to run virsh commands directly I certainly can. Anyway, vagrant was failing until I noticed that the default for /etc/libvirt/network.conf is now nftables, which I did not have set up. When I set `firewall_backend = "iptables"`, everything worked fine. I want to emphasize that: the same vagrant / libvirt setup *was* working with iptables. But I took that as a sign that it was time to move to nftables, so I moved everything on this host and stuff is back to working. But libvirt just isn't writing out the right nft rules. Like, at all. Here's the network vagrant creates: $ sudo virsh net-dumpxml vagrant-libvirt <network connections='1' ipv6='yes'> <name>vagrant-libvirt</name> <uuid>b2d93ef4-b305-4382-a380-c1eca92d8ebd</uuid> <forward mode='nat'> <nat> <port start='1024' end='65535'/> </nat> </forward> <bridge name='virbr1' stp='on' delay='0'/> <mac address='52:54:00:63:d3:f6'/> <ip address='192.168.121.1' netmask='255.255.255.0'> <dhcp> <range start='192.168.121.1' end='192.168.121.254'/> </dhcp> </ip> </network> And here's the *entire* libvirt-related ruleset in nftables: table ip libvirt_network { chain forward { type filter hook forward priority filter; policy accept; counter packets 0 bytes 0 jump guest_cross counter packets 0 bytes 0 jump guest_input counter packets 0 bytes 0 jump guest_output } chain guest_output { ip saddr 192.168.121.0/24 iif "virbr1" counter packets 0 bytes 0 accept iif "virbr1" counter packets 0 bytes 0 reject } chain guest_input { oif "virbr1" ip daddr 192.168.121.0/24 ct state established,related counter packets 0 bytes 0 accept oif "virbr1" counter packets 0 bytes 0 reject } chain guest_cross { iif "virbr1" oif "virbr1" counter packets 0 bytes 0 accept } chain guest_nat { type nat hook postrouting priority srcnat; policy accept; ip saddr 192.168.121.0/24 ip daddr 224.0.0.0/24 counter packets 1 bytes 187 return ip saddr 192.168.121.0/24 ip daddr 255.255.255.255 counter packets 0 bytes 0 return meta l4proto tcp ip saddr 192.168.121.0/24 ip daddr != 192.168.121.0/24 counter packets 0 bytes 0 masquerade to :1024-65535 meta l4proto udp ip saddr 192.168.121.0/24 ip daddr != 192.168.121.0/24 counter packets 0 bytes 0 masquerade to :1024-65535 ip saddr 192.168.121.0/24 ip daddr != 192.168.121.0/24 counter packets 0 bytes 0 masquerade } } table ip6 libvirt_network { chain forward { type filter hook forward priority filter; policy accept; counter packets 0 bytes 0 jump guest_cross counter packets 0 bytes 0 jump guest_input counter packets 0 bytes 0 jump guest_output } chain guest_output { iif "virbr1" counter packets 0 bytes 0 reject } chain guest_input { oif "virbr1" counter packets 0 bytes 0 reject } chain guest_cross { iif "virbr1" oif "virbr1" counter packets 0 bytes 0 accept } chain guest_nat { type nat hook postrouting priority srcnat; policy accept; } } Here's some log output (I have virtnetworkd running with -v): $ sudo journalctl -u virtnetworkd.service | grep -i nft [snip] Feb 20 21:36:42 stodi.digitalkingdom.org virtnetworkd[89119]: using firewall_backend: 'nftables' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft list table ip libvirt_network' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft list table ip6 libvirt_network' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_output iif virbr1 counter reject' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_input oif virbr1 counter reject' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_cross iif virbr1 oif virbr1 counter accept' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip6 libvirt_network guest_output iif virbr1 counter reject' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip6 libvirt_network guest_input oif virbr1 counter reject' Feb 20 21:36:46 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip6 libvirt_network guest_cross iif virbr1 oif virbr1 counter accept' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_output ip saddr 192.168.121.0/24 iif virbr1 counter accept' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_input oif virbr1 ip daddr 192.168.121.0/24 ct state related,established counter accept' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_nat ip saddr 192.168.121.0/24 ip daddr '!=' 192.168.121.0/24 counter masquerade' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_nat meta l4proto udp ip saddr 192.168.121.0/24 ip daddr '!=' 192.168.121.0/24 counter masquerade to :1024-65535' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_nat meta l4proto tcp ip saddr 192.168.121.0/24 ip daddr '!=' 192.168.121.0/24 counter masquerade to :1024-65535' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_nat ip saddr 192.168.121.0/24 ip daddr 255.255.255.255/32 counter return' Feb 20 21:36:47 stodi.digitalkingdom.org virtnetworkd[89119]: Applying 'nft -ae insert rule ip libvirt_network guest_nat ip saddr 192.168.121.0/24 ip daddr 224.0.0.0/24 counter return' So it's not like trying to create the rules and failing, that I can see; it just isn't trying. To clarify this setup appears to be missing every rule that would be needed for DHCPv4 and DNS to work. Like https://gitlab.com/libvirt/libvirt/-/issues/88#note_694493261 shows rules for udp 67 and 53 that are just 100% not being created at all. I have no idea what's going wrong here or even where to look; the code at https://lists.libvirt.org/archives/list/devel@lists.libvirt.org/thread/GT75… sure *looks like* it should be unconditionally adding those rules. Help?

1 0

Re: SEV-SNP Libvirt Support
by Michal Prívozník 18 Feb '25

18 Feb '25

On 2/17/25 11:11, Paraskevas Nik wrote: > Hello Michael, > Thanks for responding. I have built the libvirt and and then used ninja > install to install it. Does this also installs the correct selinux labels? Depends, if you've passed "-Dsystem=true" to meson setup then it should replace the system binaries and thus SELinux might have the correct policy. But otherwise, I'd suggest 'meson dist && rpmbuild -ta ...' and then installing those RPMs. Michal

2 1

SEV-SNP Libvirt Support
by Paraskevas Nik 17 Feb '25

17 Feb '25

Hello, I am trying to build libvirt v10.5.0 to support SEV-SNP but when I run virsh domcapabilities I am getting <sev support=no>. If I install libvirt 8.0.0 using apt install libvirt-daemon-system qemu-kvm them sev shows as supported. Everything is enabled on the system about SEV, SEV-ES, SEV-SNP. Is there a specific build option to enable SEV? *# cat /sys/module/kvm_amd/parameters/sev* *Y* *CPU: AMD EPYC 9254* *# dmesg | grep -i sev* *[ 0.000000] SEV-SNP: RMP table physical range [0x000000002d500000 - 0x000000004ddfffff]* *[ 0.009021] SEV-SNP: Reserving start/end of RMP table on a 2MB boundary [0x000000002d400000]* *[ 11.184492] ccp 0000:01:00.5: sev enabled* *[ 12.664210] ccp 0000:01:00.5: SEV API:1.55 build:36* *[ 12.664217] ccp 0000:01:00.5: SEV-SNP API:1.55 build:36* *[ 12.671343] kvm_amd: SEV enabled (ASIDs 16 - 1006)* *[ 12.671345] kvm_amd: SEV-ES enabled (ASIDs 1 - 15)* *[ 12.671346] kvm_amd: SEV-SNP enabled (ASIDs 1 - 15)* *Linux kernel version: 6.12**Libvirt version: 10.5.0* *qemu-system-x86_64 version : 9.1.0* *If you need any other information please let me know.Cheers*

2 1

Re: Network denied access
by Rodrigo Prieto 12 Feb '25

12 Feb '25

Thank you for taking the time to respond. I want to mention that I don't speak English, and it's difficult for me to understand using a translator. In the file */etc/libvirt/libvirtd.conf*, I have the following: access_drivers = [ "polkit" ] The *virtqemud* and *virtnetworkd* services are not installed. I used the version from the Debian 12 repositories. systemctl status virtnetworkd.socket Unit virtnetworkd.socket could not be found. systemctl status virtqemud.socket Unit virtqemud.socket could not be found. In the file */etc/libvirt/qemu.conf*, the default configuration is present. Best regards. El jue, 6 feb 2025 a las 20:48, Rodrigo Prieto (<rodrigoprieto2019(a)gmail.com>) escribió: > Thank you for taking the time to respond. I want to mention that I don't > speak English, and it's difficult for me to understand using a translator. > > In the file */etc/libvirt/libvirtd.conf*, I have the following: > access_drivers = [ "polkit" ] > > > The *virtqemud* and *virtnetworkd* services are not installed. I used the > version from the Debian 12 repositories. > > systemctl status virtnetworkd.socket > Unit virtnetworkd.socket could not be found. > > systemctl status virtqemud.socket > Unit virtqemud.socket could not be found. > > In the file */etc/libvirt/qemu.conf*, the default configuration is > present. > > Best regards. > > El jue, 6 feb 2025 a las 12:55, Martin Kletzander (<mkletzan(a)redhat.com>) > escribió: > >> On Fri, Jan 31, 2025 at 03:34:03AM -0300, Rodrigo Prieto wrote: >> >Hello, >> > >> >I am configuring Polkit using an example I found on the web. It correctly >> >displays the assigned domain for a given user, but when I try to start >> the >> >VM, I get the following error: >> > >> >error: Failed to start domain 'debian12' >> >error: access denied: 'network' denied access >> > >> >Here is my configuration: >> > >> >polkit.addRule(function(action, subject) { >> > if (action.id == "org.libvirt.unix.manage" && >> > subject.user == "lolo") { >> > return polkit.Result.YES; >> > } >> >}); >> >polkit.addRule(function(action, subject) { >> > if (action.id.indexOf("org.libvirt.api.domain.") == 0 && >> > subject.user == "lolo") { >> > if (action.lookup("connect_driver") == 'QEMU' && >> > action.lookup("domain_name") == 'debian12') { >> > return polkit.Result.YES; >> > } else { >> > return polkit.Result.NO; >> > } >> > } >> >}); >> > >> >> So doing this allows you to do anything with debian12 domain on the QEMU >> connection driver. >> >> >To grant network access, I have to configure the following: >> > >> >polkit.addRule(function(action, subject) { >> > if (action.id.indexOf("org.libvirt.api.network") == 0 && >> > subject.user == "lolo") { >> > return polkit.Result.YES; >> > } >> >}); >> > >> >> Adding this allows you to do anything with any network. This rule does >> omit a condition similar to the above one from the api.domain rule. >> >> >The problem with the previous configuration is that it allows full access >> >to the network, requiring the following configuration: >> > >> >> *to all the networks >> >> >polkit.addRule(function(action, subject) { >> > if ((action.id == "org.libvirt.api.network.stop" || >> > action.id == "org.libvirt.api.network.delete" || >> > action.id == "org.libvirt.api.network.write") && >> > subject.user == "lolo") { >> > return polkit.Result.NO; >> > } >> >}); >> > >> >By default, shouldn't network access behave like domains or pools, which >> >cannot be deleted? >> >> Can you not? The domain undefine API checks domain:delete ACL with the >> domain name and network undefine API checks network:delete ACL with the >> network name. I'll have to test it, but in the meantime could you try >> reproducing that with the same polkit rules (obviously modified to fit >> the domain/network difference)? >> >> >I tested it on Libvirt 9.0.0 and 10.0.0 >> > >> >> I did not find any difference between 9.0.0 and the current master with >> a quick git-fu. >> >> I tested it on current git master and it works fine, the user can >> undefine both the network and the domain, but only the one named as >> specified. >> >> >If you can help me, I would really appreciate it. >> >> Be sure to check that both virtqemud and virtnetworkd use polkit as >> their access driver in their respective configs. >> >> Have a nice day, >> Martin >> >

2 1

How can I control iptables/nftables rules addition on libvirtd host on Debian 12 ?
by oza.4h07＠gmail.com 10 Feb '25

10 Feb '25

Hello, When I install libvirt-daemon on a Debian 12 host, I can see the iptables rules below beeing added. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :LIBVIRT_FWI - [0:0] :LIBVIRT_FWO - [0:0] :LIBVIRT_FWX - [0:0] :LIBVIRT_INP - [0:0] :LIBVIRT_OUT - [0:0] -A INPUT -j LIBVIRT_INP -A FORWARD -j LIBVIRT_FWX -A FORWARD -j LIBVIRT_FWI -A FORWARD -j LIBVIRT_FWO -A OUTPUT -j LIBVIRT_OUT -A LIBVIRT_FWI -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A LIBVIRT_FWI -o virbr0 -j REJECT --reject-with icmp-port-unreachable -A LIBVIRT_FWO -s 192.168.122.0/24 -i virbr0 -j ACCEPT -A LIBVIRT_FWO -i virbr0 -j REJECT --reject-with icmp-port-unreachable -A LIBVIRT_FWX -i virbr0 -o virbr0 -j ACCEPT -A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 53 -j ACCEPT -A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT -A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 67 -j ACCEPT -A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT -A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 53 -j ACCEPT -A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 53 -j ACCEPT -A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT -A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 68 -j ACCEPT COMMIT For some reason, I need to add a couple of other rules. How can I do that ? Best regards

5 15

SEV Support Libvirt
by Paraskevas Nik 08 Feb '25

08 Feb '25

*Hello I am trying to enable libvirt to support sev-snp. Currently I am using virsh domcapabilities to check if its enabled but I am getting : <sev supported='no'/>* *Followed the instructions at : * *https://libvirt.org/kbase/launch_security_sev.html* <https://libvirt.org/kbase/launch_security_sev.html> * My AMD CPU supports SEV,SEV-SNP and I have followed all the steps and it is enabled. BIOS settings are configured to support SEV,SNP CPU: AMD EPYC 9254* *# cat /sys/module/kvm_amd/parameters/sev* *Y* *# dmesg | grep -i sev* *[ 0.000000] SEV-SNP: RMP table physical range [0x000000002d500000 - 0x000000004ddfffff]* *[ 0.009021] SEV-SNP: Reserving start/end of RMP table on a 2MB boundary [0x000000002d400000]* *[ 11.184492] ccp 0000:01:00.5: sev enabled* *[ 12.664210] ccp 0000:01:00.5: SEV API:1.55 build:36* *[ 12.664217] ccp 0000:01:00.5: SEV-SNP API:1.55 build:36* *[ 12.671343] kvm_amd: SEV enabled (ASIDs 16 - 1006)* *[ 12.671345] kvm_amd: SEV-ES enabled (ASIDs 1 - 15)* *[ 12.671346] kvm_amd: SEV-SNP enabled (ASIDs 1 - 15)* *Versions:* *Libvirt version: 10.7.0* *qemu-system-x86_64 version : 9.1.0* *Linux kernel version: 6.11.0-rc3* *Distro: Ubuntu 22.04.4 LTS* * If you need any other information please let me know.* Thanks!

2 1

Network denied access
by Rodrigo Prieto 07 Feb '25

07 Feb '25

Hello, I am configuring Polkit using an example I found on the web. It correctly displays the assigned domain for a given user, but when I try to start the VM, I get the following error: error: Failed to start domain 'debian12' error: access denied: 'network' denied access Here is my configuration: polkit.addRule(function(action, subject) { if (action.id == "org.libvirt.unix.manage" && subject.user == "lolo") { return polkit.Result.YES; } }); polkit.addRule(function(action, subject) { if (action.id.indexOf("org.libvirt.api.domain.") == 0 && subject.user == "lolo") { if (action.lookup("connect_driver") == 'QEMU' && action.lookup("domain_name") == 'debian12') { return polkit.Result.YES; } else { return polkit.Result.NO; } } }); To grant network access, I have to configure the following: polkit.addRule(function(action, subject) { if (action.id.indexOf("org.libvirt.api.network") == 0 && subject.user == "lolo") { return polkit.Result.YES; } }); The problem with the previous configuration is that it allows full access to the network, requiring the following configuration: polkit.addRule(function(action, subject) { if ((action.id == "org.libvirt.api.network.stop" || action.id == "org.libvirt.api.network.delete" || action.id == "org.libvirt.api.network.write") && subject.user == "lolo") { return polkit.Result.NO; } }); By default, shouldn't network access behave like domains or pools, which cannot be deleted? I tested it on Libvirt 9.0.0 and 10.0.0 If you can help me, I would really appreciate it.

2 1

Detect OS
by rodrigoprieto2019＠gmail.com 31 Jan '25

31 Jan '25

Hello, I would like to know if this behavior is normal. When I create a VM locally using the virt-install command with the argument --osinfo detect=on, it works perfectly and detects the operating system version. However, when I try to do it remotely using virt-install --connect=qemu+tcp://x.x.x.x/system, the following error appears: `--os-variant/--osinfo OS name is required, but no value was set or detected. This is now a fatal error. Specifying an OS name is required for modern, performant, and secure virtual machine defaults. If you expected virt-install to detect an OS name from the install media, you can set a fallback OS name with: --osinfo detect=on,name=OSNAME You can see a full list of possible OS name values with: virt-install --osinfo list If your Linux distro is not listed, try one of generic values such as: linux2024, linux2022, linux2020, linux2018, linux2016 If you just need to get the old behavior back, you can use: --osinfo detect=on,require=off Or export VIRTINSTALL_OSINFO_DISABLE_REQUIRE=1` Both the host machine and the client PC have osinfo updated to the latest version as of today. If I execute the command with --os-variant, it works correctly when done remotely. Is there a way to make it detect the operating system automatically when connected remotely? I’m using libvirtd (libvirt) 10.10.0 on Debian 12. Best regards, and thank you.

3 2

The right way to revert to external disk snapshots
by Alex Serban 29 Jan '25

29 Jan '25

Hello everyone, I'm seeking guidance on *best practices* for virtual machine recovery using external disk snapshots, particularly in a storage environment with ZFS. My current snapshot and recovery *workflow* involves: - Keeping VM disks & state on a ZFS volume; - Creating external KVM/Libvirt disk-only snapshots, resulting in deltas kept on the volume, next to the disk images; - Capturing the entire VM state through ZFS snapshots; - VM recovery through ZFS snapshot clones. I am particularly interested in obtaining an app-consistent recovery, in which I need to revert to the KVM snapshot of the VM, to ensure the possible clean state offered by a quiesced snapshot. Reading other posts from the archive and forums, it is clear for me that I cannot simply revert to the VM's snapshot, if it's a disk-only one, and that I have to manage them manually. Thus, my question is: *what is the best practice in order to recover the VM to the external disk snapshot that we have*? *What I have tried* and worked but I'm not sure is the best practice: on a VM with only one snapshot, I've changed the disk source files (which were pointing to deltas), to the ones pointed by their backingStore source files, effectively making them use the disk state of the snapshot time. This only works for shut-off VMs, as live VMs cannot have their disk sources changed, of course. Thus, for powered on VMs in the use case with only one snapshot, I've chosen to use `virDomainBlockPull` in order to have the app-consistent state pulled on the current disk (which was and still is pointing to the delta). *My concerns* on the approach I took regard, mostly, scalability and the safety of the whole process: - I am not sure how I could revert again to the current snapshot with the operations I did: for powered off VMs, disk images will change once we start using the VM, and for powered on VMs, the blockpull will alter the deltas which the disks were pointing to; - I don't see how I could apply this method in a scalable way, if the VM had more than one snapshot. At least for powered-on VMs. Thus, I thought I should seek some advice from you guys and see if there's another, smarter way that I can do this. Thanks a lot for your time, Alex Serban

2 3

Cannot start network interfaces
by Iain M Conochie 29 Jan '25

29 Jan '25

Good day all, I have having an issue starting virtual networks defined within libvirt: virsh # net-start cmdb error: Failed to start network cmdb error: internal error: Child process (VIR_BRIDGE_NAME=virbr3 /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/cmdb.conf -- leasefile-ro --dhcp-script=/usr/lib/libvirt/libvirt_leaseshelper) unexpected exit status 2: dnsmasq: failed to create listening socket for 172.26.80.1: Address already in use The definition of the network is pretty simple: virsh # net-dumpxml cmdb <network> <name>cmdb</name> <uuid>42ffd3c4-624d-46ad-be21-bb3c61c67e41</uuid> <bridge name='virbr3' stp='on' delay='0'/> <mac address='52:54:00:5b:e9:6c'/> <domain name='shihad.org'/> <ip address='172.26.80.1' netmask='255.255.255.0'> </ip> </network> At the OS level, this network interface should get created by libvirt, so I am a bit mystified why dnsmasq is having an issue starting, as there is nothing using this address yet. In fact, virbr3 does not exist until libvirt would bring up this interface: ifconfig -a | grep virbr virbr0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500 I am running libvirt 9.0.0 on Debian 12. Any help or pointers greatly appreciated. Thanks! Iain

4 7

RBD pool not starting "An error occurred, but the cause is unknown"
by Stuart Longland VK4MSL 28 Jan '25

28 Jan '25

Hi all, I have an issue getting a RBD pool going on a newly deployed compute node. The storage back-end is a Ceph storage cluster running Ceph 14 (Nautilus… yes I know this is old, an update to 18 is planned soon). I have an existing node, running Debian 10 (again, updating this is planned, but I'd like to deploy new nodes to migrate the instances to whilst this node is updated), which runs about a dozen VMs with disks on this back-end. I've loaded a new machine (a MSI Cubi 5 mini PC) up with AlpineLinux 3.21. Boot disk is a 240GB SATA SSD, and there's a 1TB nVME for local VM storage. My intent is to allow VMs to mount RBDs for back-up purposes. The machine has two Ethernet interfaces (a 2.5Gbps and a 1Gbps link), one will be the "front-end" used by the VMs, the other will be a "back-end" link to talk to Ceph and administer the host. - OpenVSwitch 2.17.11 is deployed with two bridges - libvirtd 10.9.0 installed - a LVM pool called 'data' has been created on nVME - Ceph 19.2.0 is installed (libvirtd is linked to this version of librbd) - /etc/ceph has been cloned from my existing working compute node I have two RBD pools; 'one' and 'ha'. 'one' has most of my virtual machine images in it (it is from a former OpenNebula install), 'ha' has core router root disk images in it ('ha' for high availability; it has stronger replication settings than 'one' to guarantee better reliability). I've created a `libvirt` user in Ceph, and on the intended node, this works: > ~ # rbd --id libvirt ls -p one | head > mastodon-vda > mastodon-vdb > mastodon-vdd > mastodon-vde > one-14 > one-15 > one-19 > one-20 > one-22 > one-23 > ~ # rbd --id libvirt ls -p ha | head > core-router-obsd75-vda > core-router-obsd76-vda I can also access RBD images just fine: > ~ # rbd --id libvirt map one/shares-vda > /dev/rbd0 > ~ # fdisk -l /dev/rbd0 > Disk /dev/rbd0: 20 GB, 21474836480 bytes, 41943040 sectors > 2610 cylinders, 255 heads, 63 sectors/track > Units: sectors of 1 * 512 = 512 bytes > > Device Boot StartCHS EndCHS StartLBA EndLBA Sectors Size Id Type > /dev/rbd0p1 * 2,0,33 611,8,56 2048 616447 614400 300M 83 Linux > /dev/rbd0p2 611,8,57 1023,15,63 616448 2584575 1968128 961M 82 Linux swap > /dev/rbd0p3 1023,15,63 1023,15,63 2584576 41943039 39358464 18.7G 83 Linux > ~ # rbd unmap one/shares-vda This is registered in libvirtd: > ~ # virsh secret-list > UUID Usage > -------------------------------------------------------------------- > c14a16b5-bba5-473a-ae9b-53a9a6b0a4e3 ceph client.libvirt secret > ~ # virsh secret-dumpxml c14a16b5-bba5-473a-ae9b-53a9a6b0a4e3 > <secret ephemeral='no' private='no'> > <uuid>c14a16b5-bba5-473a-ae9b-53a9a6b0a4e3</uuid> > <usage type='ceph'> > <name>client.libvirt secret</name> > </usage> > </secret> I have defined four pools, 'temp', 'local', 'ha-images' and 'opennebula-images': > ~ # virsh pool-list --all > Name State Autostart > ------------------------------------------- > default active yes > ha-images active yes > local active yes > opennebula-images inactive yes > temp active yes 'ha-images' works just fine, this is its config: > ~ # virsh pool-dumpxml ha-images > <pool type='rbd'> > <name>ha-images</name> > <uuid>6beab982-52b3-495b-a4a7-ab7ebb522ef5</uuid> > <capacity unit='bytes'>20003977953280</capacity> > <allocation unit='bytes'>159339114496</allocation> > <available unit='bytes'>13142248669184</available> > <source> > <host name='172.31.252.1' port='6789'/> > <host name='172.31.252.2' port='6789'/> > <host name='172.31.252.5' port='6789'/> > <host name='172.31.252.6' port='6789'/> > <host name='172.31.252.7' port='6789'/> > <host name='172.31.252.8' port='6789'/> > <host name='172.31.252.9' port='6789'/> > <host name='172.31.252.10' port='6789'/> > <name>ha</name> > <auth type='ceph' username='libvirt'> > <secret uuid='c14a16b5-bba5-473a-ae9b-53a9a6b0a4e3'/> > </auth> > </source> > </pool> 'opennebula-images' does not, its config: > ~ # virsh pool-dumpxml opennebula-images > <pool type='rbd'> > <name>opennebula-images</name> > <uuid>fcaa2fa8-f0d2-4919-9168-756a9f4ad7ee</uuid> > <capacity unit='bytes'>20003977953280</capacity> > <allocation unit='bytes'>5454371495936</allocation> > <available unit='bytes'>13142254759936</available> > <source> > <host name='172.31.252.1' port='6789'/> > <host name='172.31.252.2' port='6789'/> > <host name='172.31.252.5' port='6789'/> > <host name='172.31.252.6' port='6789'/> > <host name='172.31.252.7' port='6789'/> > <host name='172.31.252.8' port='6789'/> > <host name='172.31.252.9' port='6789'/> > <host name='172.31.252.10' port='6789'/> > <name>one</name> > <auth type='ceph' username='libvirt'> > <secret uuid='c14a16b5-bba5-473a-ae9b-53a9a6b0a4e3'/> > </auth> > </source> > </pool> It's not obvious what the differences are. `name`, `uuid`, `allocation`, `available` and `source/name` are expected to be different, everything else 100% matches. I've tried removing and zeroing out the `capacity`, `allocation` and `available` tags to no effect. > ~ # virsh pool-dumpxml ha-images > /tmp/ha-images.xml > ~ # virsh pool-dumpxml opennebula-images > /tmp/opennebula-images.xml > ~ # diff -u /tmp/ha-images.xml /tmp/opennebula-images.xml > --- /tmp/ha-images.xml > +++ /tmp/opennebula-images.xml > @@ -1,9 +1,9 @@ > <pool type='rbd'> > - <name>ha-images</name> > - <uuid>6beab982-52b3-495b-a4a7-ab7ebb522ef5</uuid> > + <name>opennebula-images</name> > + <uuid>fcaa2fa8-f0d2-4919-9168-756a9f4ad7ee</uuid> > <capacity unit='bytes'>20003977953280</capacity> > - <allocation unit='bytes'>159339114496</allocation> > - <available unit='bytes'>13142248669184</available> > + <allocation unit='bytes'>5454371495936</allocation> > + <available unit='bytes'>13142254759936</available> > <source> > <host name='172.31.252.1' port='6789'/> > <host name='172.31.252.2' port='6789'/> > @@ -13,7 +13,7 @@ > <host name='172.31.252.8' port='6789'/> > <host name='172.31.252.9' port='6789'/> > <host name='172.31.252.10' port='6789'/> > - <name>ha</name> > + <name>one</name> > <auth type='ceph' username='libvirt'> > <secret uuid='c14a16b5-bba5-473a-ae9b-53a9a6b0a4e3'/> > </auth> > ~ # diff -y /tmp/ha-images.xml /tmp/opennebula-images.xml When I start this errant pool, I get this: > ~ # virsh pool-start opennebula-images > error: Failed to start pool opennebula-images > error: An error occurred, but the cause is unknown If I crank debugging up in `libvirtd` (via the not-recommended `log_level` and directing all output to a file), I see it successfully connects to the pool for about 15 seconds, lists the sizes of about a dozen disk images, then seemingly gives up and disconnects. > 2025-01-19 05:16:55.176+0000: 3609: info : vir_object_finalize:319 : OBJECT_DISPOSE: obj=0x7f975fc816a0 > 2025-01-19 05:16:55.177+0000: 3609: info : virObjectUnref:378 : OBJECT_UNREF: obj=0x7f975fc816a0 > 2025-01-19 05:16:55.183+0000: 3609: debug : virStorageBackendRBDRefreshPool:693 : Utilization of RBD pool one: (kb: 19535134720 kb_ > avail: 12800438616 num_bytes: 5489355030528) > 2025-01-19 05:16:55.988+0000: 3609: debug : volStorageBackendRBDRefreshVolInfo:569 : Refreshed RBD image one/mastodon-vda (capacity > : 21474836480 allocation: 21474836480 obj_size: 4194304 num_objs: 5120) > 2025-01-19 05:16:55.993+0000: 3609: info : virObjectNew:256 : OBJECT_NEW: obj=0x7f975fa6bba0 classname=virStorageVolObj > 2025-01-19 05:16:55.993+0000: 3609: info : virObjectRef:400 : OBJECT_REF: obj=0x7f975fa6bba0 > 2025-01-19 05:16:55.993+0000: 3609: info : virObjectRef:400 : OBJECT_REF: obj=0x7f975fa6bba0 > 2025-01-19 05:16:55.993+0000: 3609: info : virObjectRef:400 : OBJECT_REF: obj=0x7f975fa6bba0 > 2025-01-19 05:16:55.993+0000: 3609: info : virObjectUnref:378 : OBJECT_UNREF: obj=0x7f975fa6bba0 > 2025-01-19 05:16:56.011+0000: 3609: debug : volStorageBackendRBDRefreshVolInfo:569 : Refreshed RBD image one/mastodon-vdb (capacity > : 536870912000 allocation: 536870912000 obj_size: 4194304 num_objs: 128000) …snip… > 2025-01-19 05:17:03.756+0000: 3609: debug : volStorageBackendRBDRefreshVolInfo:569 : Refreshed RBD image one/wsmail-vdb (capacity: > 21474836480 allocation: 21474836480 obj_size: 4194304 num_objs: 5120) > 2025-01-19 05:17:03.758+0000: 3609: info : virObjectNew:256 : OBJECT_NEW: obj=0x7f975f9cf250 classname=virStorageVolObj > 2025-01-19 05:17:03.758+0000: 3609: info : virObjectRef:400 : OBJECT_REF: obj=0x7f975f9cf250 > 2025-01-19 05:17:03.758+0000: 3609: info : virObjectRef:400 : OBJECT_REF: obj=0x7f975f9cf250 > 2025-01-19 05:17:03.758+0000: 3609: info : virObjectRef:400 : OBJECT_REF: obj=0x7f975f9cf250 > 2025-01-19 05:17:03.758+0000: 3609: info : virObjectUnref:378 : OBJECT_UNREF: obj=0x7f975f9cf250 > 2025-01-19 05:17:03.777+0000: 3609: debug : volStorageBackendRBDRefreshVolInfo:569 : Refreshed RBD image one/sjl-router-obsd76-vda > (capacity: 34359738368 allocation: 34359738368 obj_size: 4194304 num_objs: 8192) > 2025-01-19 05:17:03.778+0000: 3609: debug : virStorageBackendRBDCloseRADOSConn:369 : Closing RADOS IoCTX > 2025-01-19 05:17:03.778+0000: 3609: debug : virStorageBackendRBDCloseRADOSConn:374 : Closing RADOS connection > 2025-01-19 05:17:03.783+0000: 3609: debug : virStorageBackendRBDCloseRADOSConn:378 : RADOS connection existed for 15 seconds > 2025-01-19 05:17:03.783+0000: 3609: info : virObjectUnref:378 : OBJECT_UNREF: obj=0x7f975f9cf2b0 > 2025-01-19 05:17:03.783+0000: 3609: info : virObjectUnref:378 : OBJECT_UNREF: obj=0x7f975ef90ac0 > 2025-01-19 05:17:03.783+0000: 3609: info : virObjectUnref:378 : OBJECT_UNREF: obj=0x7f975fa6bd20 > 2025-01-19 05:17:03.783+0000: 3609: info : virObjectUnref:378 : OBJECT_UNREF: obj=0x7f975fa6ecc0 …snip… > 2025-01-19 05:17:03.785+0000: 3609: info : vir_object_finalize:319 : OBJECT_DISPOSE: obj=0x7f975f9cee90 > 2025-01-19 05:17:03.785+0000: 3609: info : virObjectUnref:378 : OBJECT_UNREF: obj=0x7f975f9cee90 > 2025-01-19 05:17:03.785+0000: 3609: info : vir_object_finalize:319 : OBJECT_DISPOSE: obj=0x7f975fa6e960 > 2025-01-19 05:17:03.785+0000: 3609: info : virObjectUnref:378 : OBJECT_UNREF: obj=0x7f975fa6e960 > 2025-01-19 05:17:03.785+0000: 3609: error : storageDriverAutostartCallback:213 : internal error: Failed to autostart storage pool 'opennebula-images': no error > 2025-01-19 05:17:03.785+0000: 3609: info : virObjectUnref:378 : OBJECT_UNREF: obj=0x7f975fcd0490 > 2025-01-19 05:17:03.785+0000: 3609: info : virObjectRef:400 : OBJECT_REF: obj=0x7f975fcd27c0 > 2025-01-19 05:17:03.785+0000: 3609: info : virObjectUnref:378 : OBJECT_UNREF: obj=0x7f975fcd27c0 > 2025-01-19 05:17:03.786+0000: 3609: info : virObjectRef:400 : OBJECT_REF: obj=0x7f975fcd06d0 > 2025-01-19 05:17:03.786+0000: 3609: info : virObjectUnref:378 : OBJECT_UNREF: obj=0x7f975fcd06d0 > 2025-01-19 05:17:03.786+0000: 3609: info : virObjectRef:400 : OBJECT_REF: obj=0x7f975fcd0130 If there's no cause for the error, it should not fail. If it fails, there should be a cause listed, there's no excuse for it being "unknown" -- just because Microsoft's OSes make up error codes that its own help system can't explain is no excuse for the open-source world to follow their example. I'd happily provide more information, if someone can provide guidance on how to locate it. -- Stuart Longland (aka Redhatter, VK4MSL) I haven't lost my mind... ...it's backed up on a tape somewhere.

2 2

Authoritative info on backup-begin versus snapshots/other state capture
by camccuk＠yahoo.com 18 Jan '25

18 Jan '25

Hello all Apologies for the basic nature of the question, but having recently started working with libvirt - and virtualisation in general - I find there is a lot of out-of-date and sometimes contradictory material out there across blogs, articles, stackoverflow, the usual sources... I thought I might be able to get definitive answers here. For the record, I assume libvirt.org is authoritative but while there is a lot of material there, its structure is not always clear to me. Also the lack of dates on any pages leaves some room for doubt. I am wondering if there is a recent, reliable summary of the various approaches and current best practices for backing up VMs that covers snapshots both internal and external, approaches that use backup-begin and third-party approaches which simply stop the VM and copy off files. If there is not such a summary, can anyone confirm my reading of https://libvirt.org/kbase/domainstatecapture.html that a simple backup-begin <domain-name> will: - pause the VM and quiesce the disk (in which case is qemu agent a requirement on the guest?) - generate a date-suffixed disk-only copy of a VMs disks alongside the originals wherever that storage is - not generate any backing image chains or metadata that needs to be retained Furthermore, is it then possible to restore to that point by stopping a VM, and associating that backup file with the VM either by virsh-editing its xml or overwriting the original file with the backup file. This seems to be my experience in testing this, but there are very few references to this tool compared to the many lengthy discussions about snapshots and other approaches which is a bit puzzling. It would be great to have this understanding confirmed or refined! Many thanks for any pointers

2 4

libvirt-guests on Redhat
by Joe Muller 06 Jan '25

06 Jan '25

Hello, Per libvirt and Redhat (up to RHEL7) documentation, the libvirt-guests daemon should be enabled to ensure that guest VMs are properly shutdown/suspended if the KVM host is shutdown/rebooted. I understand that in addition to other changes, Redhat moved from the 'monolithic' libvirtd service model to the 'modular' multiple service model. Out of the box, the systemd libvirt-guests.service is disabled, and testing shows that the associated qemu-kvm processes for virtual machines are simply killed as the various virt* services are stopped as part of the systemd shutdown target. Did Redhat just decide to fork libvirt and do their own thing, or there some equivalent way to get the same clean shutdown behavior which libvirt-guests used to provide? Relevant documentation: --- https://libvirt.org/daemons.html https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/co… -- Joe Muller System Administrator Sonic.

2 1

Best practice to manage network
by linux＠hklb.ch 03 Jan '25

03 Jan '25

Hi, First, sorry if the topic has already been discussed recently (the only thread I found related to my problem was created in 2010..) I have a hypervisor with KVM and LXC installed on a Debian 12, and I'm using libvirt to create my VM. All my networks are defined in my /etc/network/interfaces.d/* (I'm using openvswitch with specific options, such as port mirroring/patch/...) , and I'm configuring the network on my VM XML definition like this : <interface type='bridge'> <mac address='52:54:00:ab:c3:d3'/> <source bridge='prod'/> <vlan> <tag id='55'/> </vlan> <virtualport type='openvswitch'> <parameters interfaceid='331d973c-0c5b-4d3c-b2ad-590f908e680d'/> </virtualport> <target dev='vnet180'/> <model type='virtio'/> <mtu size='9216'/> <alias name='net1'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/> </interface> It is working perfectly, until I'm restarting my network (using ifreload, ifup, systemctl network restart, ...) - all my VM come unreachable... To make it work again, I also need to restart libvirtd Is it still expected to have this behavior ? What would be a better way to configure the network ? Thanks in advance Lucas

2 1

kernel panic when hotswapping nvidia gpu via gpu passthrough in a windows vm
by 5zj1zxgr＠anonaddy.me 31 Dec '24

31 Dec '24

This may be more issue with nvidia drivers, but just wanted to check if anyone tried to perform gpu passthrough with an nvidia gpu that is used as a secondary gpu on a nvidia "prime" laptop - laptop with both an integrated intel iGPU and a secondary nvidia dGPU. I was able SOMETIMES to perform GPU passthrough successfully with a VM, but SOMETIMES it led to kernel panics. It usually happens when virtual machine shuts down and nvidia dGPU is returned to the host. Dec 30 14:29:53 host kernel: ACPI Error: Needed [Integer/String/Buffer], found [Reference] 00000000f0ed5a9d (20240827/exresop-388) Dec 30 14:29:53 host kernel: ACPI Error: AE_AML_OPERAND_TYPE, While resolving operands for [And] (20240827/dswexec-433) Dec 30 14:29:53 host kernel: ACPI Error: Aborting method \_SB.PCI0.LPCB.EC0._Q20 due to previous error (AE_AML_OPERAND_TYPE) (20240827/psparse-529) Dec 30 14:29:56 host kernel: ACPI Error: Needed [Integer/String/Buffer], found [Reference] 0000000059be91f0 (20240827/exresop-388) Dec 30 14:29:56 host kernel: ACPI Error: AE_AML_OPERAND_TYPE, While resolving operands for [And] (20240827/dswexec-433) Dec 30 14:29:56 host kernel: ACPI Error: Aborting method \_SB.PCI0.LPCB.EC0._Q20 due to previous error (AE_AML_OPERAND_TYPE) (20240827/psparse-529) Any advice would be really appreciated.

1 0

Re: Features from Capabilities
by Simon Fairweather 24 Dec '24

24 Dec '24

For HyperV looks like I can build a list from the schema, but for CPU options would I use the xml in /usr/share/libvirt/cpu

1 0

Features from Capabilities
by Simon Fairweather 22 Dec '24

22 Dec '24

HI, Is there any documentation or somewhere I can look at features that could be selected? I have started to create an extract from capabilities and domcapabilities to provide a list I can use for selection. Example these are the following entries I have selected to allow running of Hyperv in Server 2019 <features> <acpi/> <apic/> <hyperv mode='custom'> <relaxed state='on'/> <vapic state='on'/> <spinlocks state='on' retries='8191'/> <vendor_id state='on' value='none'/> </hyperv> </features> <cpu mode='custom' match='strict' check='none'> <model fallback='forbid'>Skylake-Client-IBRS</model> <topology sockets='1' dies='1' clusters='1' cores='4' threads='1'/> </cpu> <clock offset='localtime'> <timer name='hpet' present='no'/> <timer name='hypervclock' present='no'/> </clock> But looking to find a list of options that would be valid to be specified. Regards Simon.

1 0