- Users - libvirt List Archives

SEV start VM help
by 435285706＠qq.com 28 Oct '24

28 Oct '24

Hi, I'm new to libvirt. I recently tried to start a sev vm with secret injection, and the documentation on this is very good, could you provide me with the steps to start a VM with libvirt's SEV, or documentation on this, thank you very much!

2 1

SEV start VM
by 435285706＠qq.com 25 Oct '24

25 Oct '24

Hi, I'm new to libvirt. I recently tried to start a sev vm with secret injection, and the documentation on this is very good, could you provide me with the steps to start a VM with libvirt's SEV, or documentation on this, thank you very much!

1 0

FreeBSD dhcp failing with UDP checksum errors
by Richard W.M. Jones 21 Oct '24

21 Oct '24

I recently reinstalled Fedora (host) and I'm trying to import a previously working FreeBSD 13 guest. It boots fine, but fails to get an address from DHCP. In the FreeBSD boot output it prints: Starting dhclient. DHCPDISCOVER on vtnet0 to 255.255.255.255 port 67 interval 7 DHCPDISCOVER on vtnet0 to 255.255.255.255 port 67 interval 9 DHCPDISCOVER on vtnet0 to 255.255.255.255 port 67 interval 9 DHCPDISCOVER on vtnet0 to 255.255.255.255 port 67 interval 10 DHCPDISCOVER on vtnet0 to 255.255.255.255 port 67 interval 17 5 bad udp checksums in 5 packets Indeed, tcpdumping the network on the host side shows that checksums are wrong (note "bad udp cksum" in the reply message): 0.0.0.0.bootpc > 255.255.255.255.bootps: [udp sum ok] BOOTP/DHCP, Request from 52:54:00:d4:07:ab (oui Unknown), length 300, xid 0xf9ee0d34, secs 53, Flags [none] (0x0000) Client-Ethernet-Address 52:54:00:d4:07:ab (oui Unknown) Vendor-rfc1048 Extensions Magic Cookie 0x63825363 DHCP-Message (53), length 1: Discover Requested-IP (50), length 4: freebsd.home.annexia.org Client-ID (61), length 7: ether 52:54:00:d4:07:ab Hostname (12), length 7: "freebsd" Parameter-Request (55), length 10: Subnet-Mask (1), BR (28), Time-Zone (2), Classless-Static-Route (121) Default-Gateway (3), Domain-Name (15), Domain-Name-Server (6), Hostname (12) Unknown (119), MTU (26) END (255), length 0 PAD (0), length 0, occurs 20 13:07:37.304083 IP (tos 0xc0, ttl 64, id 20207, offset 0, flags [none], proto UDP (17), length 328) cash.bootps > 192.168.122.203.bootpc: [bad udp cksum 0x7763 -> 0x88a0!] BOOTP/DHCP, Reply, length 300, xid 0xf9ee0d34, secs 53, Flags [none] (0x0000) Your-IP 192.168.122.203 Server-IP cash Client-Ethernet-Address 52:54:00:d4:07:ab (oui Unknown) Vendor-rfc1048 Extensions Magic Cookie 0x63825363 DHCP-Message (53), length 1: Offer Server-ID (54), length 4: cash Lease-Time (51), length 4: 3600 RN (58), length 4: 1800 RB (59), length 4: 3150 Subnet-Mask (1), length 4: 255.255.255.0 BR (28), length 4: 192.168.122.255 Default-Gateway (3), length 4: cash Domain-Name-Server (6), length 4: cash END (255), length 0 PAD (0), length 0, occurs 8 I guess this is something to do with checksum offloading. I can only find ancient bugs related to this. How to fix? The host is: libvirt-daemon-10.6.0-1.fc41.x86_64 dnsmasq-2.90-3.fc41.x86_64 Linux cash 6.11.0-0.rc5.20240830git20371ba12063.47.fc42.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Aug 30 15:36:28 UTC 2024 x86_64 GNU/Linux Rich. -- Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones Read my programming and virtualization blog: http://rwmj.wordpress.com nbdkit - Flexible, fast NBD server with plugins https://gitlab.com/nbdkit/nbdkit

3 7

AMD SEV-SNP encryption at rest
by me+libvirt＠gsora.xyz 14 Oct '24

14 Oct '24

Hello folks, I’m exploring the capabilities of the AMD SEV-SNP platform for a TEE implementation that will handle and store secret data. This data should be tied to a single guest, that is no other guest that boots with the same kernel/initrd/cmdline - in the form of a UKI - should be able to decrypt it. I have a prototype that encrypts the boot disk with a key derived from the VCEK, but a different guest is able to derive the same key provided it boots either the same UKI. The key has been derived with the snpguest tool developed by the virtee project. Does anybody have experience with encryption at rest with the AMD SEV SNP platform? I understand that it’s possible to inject secrets into a SEV VM at creation time, but documentation is scarce on that front. Thank you

2 1

New application (library)
by Erik Huelsmann 04 Oct '24

04 Oct '24

Hi! On https://libvirt.org/apps.html it says to send a mail to this mailinglist to get your app listed on apps/libraries the list. Over the past months, I've been writing a set of Perl libraries, culminating in Sys::Async::Virt (https://metacpan.org/pod/Sys::Async::Virt) which is a library for developing LibVirt client applications supporting the asynchronous paradigm introduced by Future::AsyncAwait ( https://metacpan.org/pod/Future::AsyncAwait) The library binds to the network protocol and instantiates Perl objects for manipulating server-side resources. The API tries to stay close to the Sys::Virt API, although I've been looking closely at the C API as well. At the time of writing, the local and ssh transports are supported, but work is on-going for more. Not all protocol messages are supported at the moment; 47 out of 448 messages are remaining. Effort to implement them is on-going here too. The list of unimplemented messages is published at the bottom of the documentation page on MetaCPAN referenced above. Let me know your feedback, or submit your bugs and ideas at https://github.com/ehuelsmann/perl-sys-async-virt. Thanks in advance for listing the library! -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

1 0

How to use UEFI_VARS.fd using virt-manager on Ubuntu 24.04...
by Mario Marietto 01 Oct '24

01 Oct '24

Hello. On FreeBSD I've installed Windows 11 on the first partition of a 200 GB disk and Android X86 on the second partition of a 200 GB image file called "Android.img". This is how I boot Android : /usr/sbin/./bhyve-win -S -c sockets=4,cores=2,threads=1 -m 8G -w -H -A \ -s 0,hostbridge \ -s 1,ahci-hd,/mnt/zroot-133/bhyve/img/Android/Android.img,bootindex=1 \ -s 13,virtio-net,tap13 \ -s 29,fbuf,tcp=0.0.0.0:5913,w=1600,h=950,wait \ -s 30,xhci,tablet \ -s 31,lpc \ -l bootrom,/usr/local/share/uefi-firmware/BHYVE_UEFI_CODE.fd,/usr/local/share/uefi-firmware/BHYVE_UEFI_VARS.fd \ as you can see to boot Android correctly,I SHOULD use "/usr/local/share/uefi-firmware/BHYVE_UEFI_VARS.fd" Now I'm using Ubuntu 24.04 and I want to boot Android from the same img file. But,what I don't know is how to add the parameter "/usr/local/share/uefi-firmware/BHYVE_UEFI_VARS.fd" to virt-manager. Without it Android will not boot,but only Windows is able to boot ONLY from the first partition.... -- Mario.

1 0

Debian pipewire host + Debian pipewire guest with SPICE = No sound
by bo0od＠whonix.org 27 Sep '24

27 Sep '24

Debian 12 DVD installed, Debian XML: ``` <domain type='kvm'> <name>debian-12-DVD</name> <uuid>0471b577-3315-4cfb-8d65-87a3ca34cc22</uuid> <metadata> <libosinfo:libosinfo xmlns:libosinfo="http://libosinfo.org/xmlns/libvirt/domain/1.0"> <libosinfo:os id="http://debian.org/debian/12"/> </libosinfo:libosinfo> </metadata> <memory unit='KiB'>2097152</memory> <currentMemory unit='KiB'>2097152</currentMemory> <vcpu placement='static'>2</vcpu> <os> <type arch='x86_64' machine='pc-q35-8.2'>hvm</type> <bootmenu enable='no'/> </os> <features> <acpi/> <apic/> <vmport state='off'/> </features> <cpu mode='host-passthrough' check='none' migratable='on'/> <clock offset='utc'> <timer name='rtc' tickpolicy='catchup'/> <timer name='pit' tickpolicy='delay'/> <timer name='hpet' present='no'/> </clock> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>destroy</on_crash> <pm> <suspend-to-mem enabled='no'/> <suspend-to-disk enabled='no'/> </pm> <devices> <emulator>/usr/bin/qemu-system-x86_64</emulator> <disk type='file' device='disk'> <driver name='qemu' type='qcow2' discard='unmap'/> <source file='/var/lib/libvirt/images/debian-12-DVD.qcow2'/> <target dev='vda' bus='virtio'/> <boot order='1'/> <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/> </disk> <disk type='file' device='cdrom'> <driver name='qemu' type='raw'/> <target dev='sda' bus='sata'/> <readonly/> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> <controller type='usb' index='0' model='qemu-xhci' ports='15'> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </controller> <controller type='pci' index='0' model='pcie-root'/> <controller type='pci' index='1' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='1' port='0x10'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/> </controller> <controller type='pci' index='2' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='2' port='0x11'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/> </controller> <controller type='pci' index='3' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='3' port='0x12'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/> </controller> <controller type='pci' index='4' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='4' port='0x13'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/> </controller> <controller type='pci' index='5' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='5' port='0x14'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/> </controller> <controller type='pci' index='6' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='6' port='0x15'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/> </controller> <controller type='pci' index='7' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='7' port='0x16'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/> </controller> <controller type='pci' index='8' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='8' port='0x17'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x7'/> </controller> <controller type='pci' index='9' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='9' port='0x18'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0' multifunction='on'/> </controller> <controller type='pci' index='10' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='10' port='0x19'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x1'/> </controller> <controller type='pci' index='11' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='11' port='0x1a'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x2'/> </controller> <controller type='pci' index='12' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='12' port='0x1b'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x3'/> </controller> <controller type='pci' index='13' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='13' port='0x1c'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x4'/> </controller> <controller type='pci' index='14' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='14' port='0x1d'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x5'/> </controller> <controller type='sata' index='0'> <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/> </controller> <controller type='virtio-serial' index='0'> <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/> </controller> <interface type='network'> <mac address='52:54:00:33:90:23'/> <source network='default'/> <model type='virtio'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> <serial type='pty'> <target type='isa-serial' port='0'> <model name='isa-serial'/> </target> </serial> <console type='pty'> <target type='serial' port='0'/> </console> <channel type='unix'> <target type='virtio' name='org.qemu.guest_agent.0'/> <address type='virtio-serial' controller='0' bus='0' port='1'/> </channel> <channel type='spicevmc'> <target type='virtio' name='com.redhat.spice.0'/> <address type='virtio-serial' controller='0' bus='0' port='2'/> </channel> <input type='tablet' bus='usb'> <address type='usb' bus='0' port='1'/> </input> <input type='mouse' bus='ps2'/> <input type='keyboard' bus='ps2'/> <graphics type='spice' autoport='yes'> <listen type='address'/> <image compression='off'/> </graphics> <sound model='ich9'> <address type='pci' domain='0x0000' bus='0x00' slot='0x1b' function='0x0'/> </sound> <audio id='1' type='spice'/> <video> <model type='virtio' heads='1' primary='yes'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> </video> <redirdev bus='usb' type='spicevmc'> <address type='usb' bus='0' port='2'/> </redirdev> <redirdev bus='usb' type='spicevmc'> <address type='usb' bus='0' port='3'/> </redirdev> <watchdog model='itco' action='reset'/> <memballoon model='virtio'> <address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/> </memballoon> <rng model='virtio'> <backend model='random'>/dev/urandom</backend> <address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/> </rng> </devices> </domain> ``` Qemu ticket: https://gitlab.com/qemu-project/qemu/-/issues/2561

1 0

KVM Fails 3D Acceleration on Debian (failed to validate against schema)
by bo0od＠whonix.org 27 Sep '24

27 Sep '24

Full VM xml: ``` <domain type='kvm'> <name>Whonix-Gateway</name> <uuid>c011d3d3-8383-47a8-b2cd-d54f883d8af1</uuid> <genid>bc5b233c-46ea-4bfb-ad99-00f1165a09e6</genid> <description>Do not change any settings if you do not understand the consequences! Learn more: https://www.whonix.org/wiki/KVM#XML_Settings</description> <memory dumpCore='off' unit='KiB'>1250000</memory> <currentMemory unit='KiB'>1250000</currentMemory> <blkiotune> <weight>250</weight> </blkiotune> <memoryBacking> <nosharepages/> <allocation mode='ondemand'/> <discard/> </memoryBacking> <vcpu placement='static' cpuset='0'>1</vcpu> <os> <type arch='x86_64' machine='pc-q35-9.0'>hvm</type> <boot dev='hd'/> </os> <features> <acpi/> <hap state='on'/> <pvspinlock state='on'/> <pmu state='off'/> <vmport state='off'/> </features> <cpu mode='host-passthrough' check='none' migratable='on'/> <clock offset='utc'> <timer name='rtc' tickpolicy='catchup' track='guest'/> <timer name='kvmclock' present='yes'/> <timer name='pit' present='no'/> <timer name='hpet' present='no'/> <timer name='hypervclock' present='no'/> </clock> <on_poweroff>destroy</on_poweroff> <on_reboot>restart</on_reboot> <on_crash>restart</on_crash> <pm> <suspend-to-mem enabled='no'/> <suspend-to-disk enabled='no'/> </pm> <devices> <emulator>/usr/bin/qemu-system-x86_64</emulator> <disk type='file' device='disk'> <driver name='qemu' type='qcow2'/> <source file='/var/lib/libvirt/images/Whonix-Gateway.qcow2'/> <target dev='vda' bus='virtio'/> <address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/> </disk> <controller type='virtio-serial' index='0'> <address type='pci' domain='0x0000' bus='0x03' slot='0x00' function='0x0'/> </controller> <controller type='usb' index='0' model='qemu-xhci'> <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/> </controller> <controller type='sata' index='0'> <address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/> </controller> <controller type='pci' index='0' model='pcie-root'/> <controller type='pci' index='1' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='1' port='0x10'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/> </controller> <controller type='pci' index='2' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='2' port='0x11'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/> </controller> <controller type='pci' index='3' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='3' port='0x12'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/> </controller> <controller type='pci' index='4' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='4' port='0x13'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/> </controller> <controller type='pci' index='5' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='5' port='0x14'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/> </controller> <controller type='pci' index='6' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='6' port='0x15'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/> </controller> <controller type='pci' index='7' model='pcie-root-port'> <model name='pcie-root-port'/> <target chassis='7' port='0x16'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/> </controller> <interface type='network'> <mac address='52:54:00:c1:95:49'/> <source network='Whonix-External'/> <model type='virtio'/> <driver name='qemu'/> <address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/> </interface> <interface type='network'> <mac address='52:54:00:bf:80:2e'/> <source network='Whonix-Internal'/> <model type='virtio'/> <driver name='qemu'/> <address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/> </interface> <serial type='pty'> <target type='isa-serial' port='0'> <model name='isa-serial'/> </target> </serial> <console type='pty'> <target type='serial' port='0'/> </console> <channel type='spicevmc'> <target type='virtio' name='com.redhat.spice.0'/> <address type='virtio-serial' controller='0' bus='0' port='1'/> </channel> <input type='mouse' bus='ps2'/> <input type='keyboard' bus='ps2'/> <graphics type='spice' autoport='yes'> <listen type='address'/> <clipboard copypaste='no'/> <filetransfer enable='no'/> <gl enable='yes'/> </graphics> <audio id='1' type='spice'/> <video> <model type='virtio' heads='1' primary='yes'/> <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/> <acceleration accel3d='yes' accel2d='yes'/> <gl enable='yes'/> </video> <watchdog model='itco' action='reset'/> <memballoon model='none'/> <rng model='virtio'> <rate bytes='1024' period='1000'/> <backend model='random'>/dev/random</backend> <address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/> </rng> </devices> </domain> ``` But it will always show: ``` error: XML document failed to validate against schema: Unable to validate doc against /usr/share/libvirt/schemas/domain.rng Extra element devices in interleave Element domain failed to validate content ``` Any idea how to resolve this?

2 2

How to enable KVM nesting virtualization on the Jetson nano.
by Mario Marietto 21 Sep '24

21 Sep '24

Hello to everyone. while I was looking for a way to enable the nesting virtualization on my Jetson nano,after having enabled KVM applying these patches : https://github.com/OE4T/linux-tegra-4.9/blob/oe4t-patches-l4t-r37.4/ <https://github.com/OE4T/linux-tegra-4.9/blob/oe4t-patches-l4t-r32.4/arch/ar…> When I have googled for acquiring more informations,I found these interesting threads : https://patches.linaro.org/project/qemu-devel/patch/b7c2626e6c720ccc43e5719… https://superuser.com/questions/1838383/arm-cpu-nested-virtualization-how-c… On the first site,he says : > can be enabled by "-M virt,accel=kvm,virtualization=on" when starting a VM Good,I could try,but I'm not using qemu directly (I've installed qemu vers. 9) ,but virt-manager version 4.0. Maybe I should upgrade it ? In virt-manager I don't see how I can specify those parameters. Anyway I'm not sure that it will work,because on the second thread he said to : -append "kvm-arm.mode=nested" \ Where is the truth ? Very thanks. -- Mario.

1 0

Host network conflicting with guests network
by bd730c5053df9efb 19 Sep '24

19 Sep '24

Hi all! I have a question about networking and haven't been able to find it online. I need to replicate a server installation in a host to be able to test a procedure but the host is on the same network as the servers so I am not being able to create an isolated network on the host because there is an interface in the same range of ip adresses. Is there any way to create this isolated virtual network without it conflicting with the hosts network? Thanks in advance! Best regards, Dave. Sent with Proton Mail secure email.

3 8

libvirtError with pipewire audio backend
by Karl Frederick Roldan 17 Sep '24

17 Sep '24

Hi everyone, I'm having trouble regarding using the pipewire backend for libvirt. My OS is GNU Guix with Wayland and pipewire running with wireplumber on a user session. I have the following versions: libvirt-9.10.0 (with pipewire enabled) qemu-8.2.2 (with pipewire enabled) libpipewire-1.0.3 I only modified the =<audio>= configuration in the xml file using =sudo virsh edit win10= as follows: <audio id='1' type='pipewire' runtimeDir='/run/user/1000'/> I can confirm that pipewire is running and that I have pipewire sockets in the directory specified. But when running the VM using virt-manager, I get the following error: Error starting domain: internal error: process exited while connecting to monitor: 2024-09-17T05:54:03.785811Z qemu-system-x86_64: Failed to initialize PW context Traceback (most recent call last): File "/gnu/store/nxpr6npj618pqmlanqqh7ks9a92jgm98-virt-manager-4.1.0/share/virt-manager/virtManager/asyncjob.py", line 72, in cb_wrapper callback(asyncjob, *args, **kwargs) File "/gnu/store/nxpr6npj618pqmlanqqh7ks9a92jgm98-virt-manager-4.1.0/share/virt-manager/virtManager/asyncjob.py", line 108, in tmpcb callback(*args, **kwargs) File "/gnu/store/nxpr6npj618pqmlanqqh7ks9a92jgm98-virt-manager-4.1.0/share/virt-manager/virtManager/object/libvirtobject.py", line 57, in newfn ret = fn(self, *args, **kwargs) File "/gnu/store/nxpr6npj618pqmlanqqh7ks9a92jgm98-virt-manager-4.1.0/share/virt-manager/virtManager/object/domain.py", line 1402, in startup self._backend.create() File "/gnu/store/yaqxaja0ckyf6fm7gnd9iqlrijz6qcqy-python-libvirt-10.6.0/lib/python3.10/site-packages/libvirt.py", line 1362, in create raise libvirtError('virDomainCreate() failed') libvirt.libvirtError: internal error: process exited while connecting to monitor: 2024-09-17T05:54:03.785811Z qemu-system-x86_64: Failed to initialize PW context If I switch the audio backend back to =spice=, the VM will run but there's no sound. I am not sure if this is a virt-manager problem or I somehow misconfigured libvirt. How should I proceed about this problem?

2 2

About virsh(1) and Postcopy migration
by Prasad Pandit 04 Sep '24

04 Sep '24

Hello, * virsh(1) offers multiple options to initiate Postcopy migration: 1) virsh migrate --postcopy --postcopy-after-precopy 2) virsh migrate --postcopy + virsh migrate-postcopy 3) virsh migrate --postcopy --timeout <N> --timeout-postcopy When Postcopy migration is invoked via options (2) or (3) above, the migrated guest on the destination host hangs sometimes. But such a hang is not reproducible with option (1) above. * When using option (1) above, libvirtd(8) waits for the first pass of pre-copy to finish before enabling postcopy migration. * Does the same waiting happen when using options (2) and (3) above? === 2024-07-24 14:16:27.448+0000: msg={"execute":"migrate" 2024-07-24 14:16:29.318+0000: msg={"execute":"migrate-start-postcopy" 2024-07-24 14:28:39.737+0000: msg={"execute":"migrate" 2024-07-24 14:28:41.119+0000: msg={"execute":"migrate-start-postcopy" 2024-07-24 14:44:11.684+0000: msg={"execute":"migrate" 2024-07-24 14:44:12.835+0000: msg={"execute":"migrate-start-postcopy" 2024-07-24 14:48:00.675+0000: msg={"execute":"migrate" 2024-07-24 14:48:02.319+0000: msg={"execute":"migrate-start-postcopy" 2024-07-24 15:03:36.110+0000: msg={"execute":"migrate" 2024-07-24 15:03:37.341+0000: msg={"execute":"migrate-start-postcopy" 2024-07-24 16:05:25.602+0000: msg={"execute":"migrate" 2024-07-24 16:05:26.756+0000: msg={"execute":"migrate-start-postcopy" === * While running migration tests with options (2) and (3) above, switch to postcopy appears to happen within 2 seconds of starting migration. - Is that reasonable time to switch from pre-copy to postcopy? - Is there an ideal time to wait before switching to postcopy? * The feature page below suggests to wait until one cycle of RAM migration has completed -> https://wiki.qemu.org/Features/PostCopyLiveMigration * I'd much appreciate any clarification/confirmation about this. Thank you. --- -Prasad

2 3

Possible issue with shared folder from host to virtual machine
by Mulloch94＠protonmail.com 03 Sep '24

03 Sep '24

I ran into an issue when trying to connect a shared folder from my host to my virtual OS in KVM. The folder actually does appear in the virtual OS, but it's empty, unlike the folder in the host which has files in it. I'm not ruling out the possibility that I configured something wrong, but the instructions on setting it up seemed to be pretty straightforward. Basically I did the following procedures: mkdir ~/shared chmod 777 ~/shared Went to VirtManager enabled shared memory, added FileSystem with driver virtiofs. My source path to find the folder was /home/username/shared and the target path was /mnt/shared. Upon booting the virtual machine everything seemed to work. I found the folder where it should be, only there was nothing in it. And on the host there was files I had already placed in the folder. So this is where I'm at now.

2 1

dnsmasq DHCP server with nwfilter
by Kai 30 Aug '24

30 Aug '24

Hello, I'm trying to set up a nwfilter ruleset, where the client only should be able to answer to incoming requests and pings. The outbound traffic (LAN and Internet) shouldn't be working. I've gut the rules as mentioned below (I moved all filterref inside for debugging): <filter name='fwrule-test0' chain='root' priority='-700'> <uuid>89daa6f3-0300-439d-bbba-4d298b4420f2</uuid> <rule action='accept' direction='out' priority='100'> <ip protocol='udp' srcportstart='68' dstportstart='67'/> </rule> <rule action='accept' direction='in' priority='101'> <ip protocol='udp' srcportstart='67' dstportstart='68'/> </rule> <rule action='accept' direction='out' priority='200'> <ip dstipaddr='10.16.136.6'/> </rule> <rule action='accept' direction='out' priority='200'> <ip dstipaddr='10.16.136.9'/> </rule> <rule action='accept' direction='in' priority='250'> <all/> </rule> <rule action='accept' direction='inout' priority='300'> <all state='ESTABLISHED,RELATED'/> </rule> <rule action='accept' direction='inout' priority='301'> <icmp/> </rule> <rule action='accept' direction='out' priority='400'> <udp dstportstart='53'/> </rule> <rule action='accept' direction='inout' priority='400'> <mac protocolid='arp'/> </rule> <rule action='drop' direction='out' priority='800'> <all/> </rule> </filter> When the guest already has a proper IP address, this seems to work on first sight, the client can't talk to the internet anymore, but is reachable for TCP and UDP requests. However, I can't get DHCP working. I'm using the integrated dnsmasq service for DHCP. It works again, when I remove the last DROP rule taking care of the rest. I looked inside tcpdump / Wireshark for the corresponding interface (virbr4). With the enabled DHCP port rules I can see that DHCP requests go out to 255.255.255.255. I also activated dnsmasq logging for the virbr4 instance. Here, I don't get any DHCP logs. Without the last DROP rule, I can see clients getting an IP address. I currently have no idea where to look "in between" as the dnsmasq is listening von virbr4. My expectation for DHCP was ports 67 <-> 68 to be open as in the nwfilter 'allow-dhcp'. Am I missing here something? Thank you! Kai

2 2

any update
by dh8827.kim＠samsung.com 30 Aug '24

30 Aug '24

Has there been any update? Has anyone solved this issue? I am experiencing the same problem. To resolve this, try downgrading the libvirtexport version to tinkoff. ( https://github.com/Tinkoff/libvirt-exporter/blob/master/libvirt_exporter.go )

1 0

autostart sessiioned vms
by daggs 28 Aug '24

28 Aug '24

Greetings, I'm running sessioned vms which I want to start them up at boot. I've marked a vm inside a use as autostart, added libvirtd to the boot order and rebooted but it didn't started the vm. I tried adding libvirt-guests to bott services but my sessioned vm is still not autostarting. what is the proper way to do so? Thanks, Dagg

2 6

KVM image fails to resume
by libvirt＠eyal.emu.id.au 27 Aug '24

27 Aug '24

I upgraded f38->f40 but left the vm saved rather than shutdown (my bad but here we are) Attempting to restore the vm with 'virsh restore /data1/VMs/libvirt/images/e4.saved' I get: error: Failed to restore domain from /data1/VMs/libvirt/images/e4.saved error: operation failed: guest CPU doesn't match specification: extra features: vmx-ins-outs,vmx-true-ctls,vmx-store-lma,vmx-activity-hlt,vmx-vmwrite-vmexit-fields,vmx-apicv-xapic,vmx-ept,vmx-desc-exit,vmx-rdtscp-exit,vmx-vpid,vmx-wbinvd-exit,vmx-unrestricted-guest,vmx-rdrand-exit,vmx-invpcid-exit,vmx-vmfunc,vmx-shadow-vmcs,vmx-rdseed-exit,vmx-pml,vmx-ept-execonly,vmx-page-walk-4,vmx-ept-2mb,vmx-ept-1gb,vmx-invept,vmx-eptad,vmx-invept-single-context,vmx-invept-all-context,vmx-invvpid,vmx-invvpid-single-addr,vmx-invvpid-all-context,vmx-intr-exit,vmx-nmi-exit,vmx-vnmi,vmx-preemption-timer,vmx-vintr-pending,vmx-tsc-offset,vmx-hlt-exit,vmx-invlpg-exit,vmx-mwait-exit,vmx-rdpmc-exit,vmx-rdtsc-exit,vmx-cr3-load-noexit,vmx-cr3-store-noexit,vmx-cr8-load-exit,vmx-cr8-store-exit,vmx-flexpriority,vmx-vnmi-pending,vmx-movdr-exit,vmx-io-exit,vmx-io-bitmap,vmx-mtf,vmx-msr-bitmap,vmx-monitor-exit,vmx-pause-exit,vmx-secondary-ctls,vmx-exit-nosave-debugctl,vmx-exit-load-perf-global-ctrl,vmx-exit-ack-i ntr,vmx-exit-save-pat,vmx-exit-load-pat,vmx-exit-save-efer,vmx-exit-load-efer,vmx-exit-save-preemption-timer,vmx-entry-noload-debugctl,vmx-entry-ia32e-mode,vmx-entry-load-perf-global-ctrl,vmx-entry-load-pat,vmx-entry-load-efer,vmx-eptp-switching Then, trying to resume from the "virtual Machine Manager" UI gets the message: ===== Error unpausing domain: Requested operation is not valid: domain is not running Error unpausing domain: Requested operation is not valid: domain is not running Traceback (most recent call last): File "/usr/share/virt-manager/virtManager/asyncjob.py", line 72, in cb_wrapper callback(asyncjob, *args, **kwargs) File "/usr/share/virt-manager/virtManager/asyncjob.py", line 108, in tmpcb callback(*args, **kwargs) File "/usr/share/virt-manager/virtManager/object/libvirtobject.py", line 57, in newfn ret = fn(self, *args, **kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/share/virt-manager/virtManager/object/domain.py", line 1437, in resume self._backend.resume() File "/usr/lib64/python3.12/site-packages/libvirt.py", line 2425, in resume raise libvirtError('virDomainResume() failed') libvirt.libvirtError: Requested operation is not valid: domain is not running I searched for a solution and most say to fiddle with some settings and reboot. I cannot reboot, I want to resume (unpause). How can I restore the vm without crashing it (throwing away the saved memory), if it even boots this way? TIA

2 4

autostart fails on host boot. NAT-bridge doesn't come up fast enough
by Fred Clift 26 Aug '24

26 Aug '24

I have 18 VMs that are all supposed to attach to a NAT-bridge. The bridge definition seems to be ok - it used to work when I didn't have any guests defined. It worked when I had only a couple guests defined. Now that I have 18 of them, it seems to take more than a minute for virbr0 to come up, and the guests all fail to autostart because the bridge doesn't exist yet. The host system (AlmaLinux 9.4) has dual Xeon(R) CPU E5-2680v4 with plenty of cores and ram. Is there some easy way to delay the start of the guests to wait for virbr0 to be up? Or can I specify a boot order? I assume that libvirtd autostarts networks before guests but I really have no idea... Can I specify an autostart dependency? As a stopgap measure I turned 'autostart' off on these and made a systemd-run bash script that just starts the network, and then starts the guests all serially. It has worked 10 or so test boots in a row. I'd prefer not to have to use an external script if possible. Fred Clift

2 3

splitting a bt wifi combo between two vms
by daggs 26 Aug '24

26 Aug '24

Greetings, I have the following combo device: dagg@NCC-5001D ~ $ lsusb -d8087:0029 Bus 001 Device 002: ID 8087:0029 Intel Corp. AX200 Bluetooth dagg@NCC-5001D ~ $ lspci -vv -s 03:00.0 03:00.0 Network controller: Intel Corporation Wi-Fi 6 AX200 (rev 1a) Subsystem: Intel Corporation Wi-Fi 6 AX200NGW Control: I/O- Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Interrupt: pin A routed to IRQ 34 IOMMU group: 13 Region 0: Memory at fc600000 (64-bit, non-prefetchable) [size=16K] Capabilities: <access denied> Kernel modules: iwlwifi I want to pass each of them to a different vm. should I expect problems? Thanks, Dagg

3 3

Updating authentication for a Ceph (RBD) disk in a live domain
by will.gorman＠joyent.com 21 Aug '24

21 Aug '24

Is it possible to update and change the <auth/> for an RBD network disk while the domain the disk is attached to is running and without detaching/reattaching the disk? For example if I have a disk attached like the following: <disk type='network' device='disk'> <driver name='qemu' type='raw'/> <auth username='someuser'> <secret type='ceph' usage='someuser key'/> </auth> <source protocol='rbd' name='somepool/someimage'> <host name='127.0.0.1' port='3300'/> </source> <target dev='sdd' bus='scsi'/> <alias name='scsi0-0-0-3'/> <address type='drive' controller='0' bus='0' target='0' unit='3'/> </disk> If I want to change the auth to <auth username='someotheruser'> <secret type='ceph' usage='someotheruser key'/> </auth> can I do that without either attaching/detaching the disk or stopping/restarting the domain? I've tried `virsh update-device domain disk.xml --live --persistent` using xml identical to the current disk except for the auth and it says "Device updated successfully" but when I check the domain with `dumpxml` I can still see the original auth settings for the disk.

2 1

cap seach for session libvirt
by daggs 09 Aug '24

09 Aug '24

Greetings, I'm working on allowing a session vm to create a tap iface. the vm has this defintion: <interface type='ethernet'> <mac address='52:54:00:a7:79:6b'/> <target dev='veth0'/> <model type='virtio'/> <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/> </interface> when I try to start the vm, I get this error: Unable to create tap device veth0: Operation not permitted searching the code led me to this line: https://github.com/libvirt/libvirt/blob/0caacf47d7b423db9126660fb0382ed56cd… I've looked on line and found out I need the net_admin_cap set. so I took the relevant code in to a dedicated test file and using pam_cap I've defined such cap for the test file, all went well. so I took it back to virsh and defined that cap to virsh but I'm still getting the same issue, see: https://ibb.co/zHggRQZ the os is debian 12 any ideas why I'm still getting this error? Thanks, Dagg

2 4

luks devices and libvirt
by Marc Haber 05 Aug '24

05 Aug '24

Hi, this is an ongoing issue. I don't know whether I ever have addresses this here, but it's still annoying. I am using debian unstable, libvirt 10.5.0, virt-manager 4.1.0, qemu 9.0.2. I work through virt-manager, rarely I use virsh. I regularly configure virtual disks that are located on a luks-encrypted LVM volume. when unlocked, the block devices appears as /dev/mapper/foo and is a symlink to a ../dm-xx node with xx being a random number, ../dm-xx being a regular block device. To facilitate this, I have defined a storage pool with this XML: <pool type="dir"> <name>mapper</name> <uuid></uuid> <capacity unit="bytes">24598757376</capacity> <allocation unit="bytes">0</allocation> <available unit="bytes">24598757376</available> <source> </source> <target> <path>/dev/mapper</path> <permissions> <mode>0755</mode> <owner>0</owner> <group>0</group> </permissions> </target> </pool> This is necessary as the storage type "LVM volume group" now insists on a volume group name, and the DM mappings created by LUKS dont have a volume group name. When I add a disk to a VM from this storage pool, it generates the XML: <disk type="file" device="disk"> <driver name="qemu" type="raw"/> <source file="/dev/mapper/wintest"/> <target dev="vda" bus="virtio"/> <address type="pci" domain="0x0000" bus="0x05" slot="0x00" function="0x0"/> </disk> qemu won't start with this settings: error: Failed to start domain 'win11test' error: internal error: QEMU unexpectedly closed the monitor (vm='win11test'): 2024-07-28T15:20:25.250387Z qemu-system-x86_64: -blockdev {"driver":"file","filename":"/dev/mapper/wintest","node-name":"libvirt-1-storage","read-only":false}: 'file' driver requires '/dev/mapper/wintest' to be a regular file Changing the XML to <disk type="block" device="disk"> <driver name="qemu" type="raw"/> <source dev="/dev/mapper/wintest"/> <target dev="vda" bus="virtio"/> <address type="pci" domain="0x0000" bus="0x05" slot="0x00" function="0x0"/> </disk> (note type="block" and "source dev") makes the VM work. Can virt-manager somehow be coaxed into generating XML that works here? If not, is this a virt-manager issue or should qemu just accept type="file" and "source file")? Greetings Marc -- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224 1600402 Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421

2 1

setting bridge for VMs IP assignment by router's DHCP server
by Germano Massullo 02 Aug '24

02 Aug '24

I am running a libvirt hostmachine (Fedora 40) which has 192.168.1.6 IP address, assigned by router's DHCP server. I want the libvirt VMs IPs to be assigned by router's DHCP server, so I tried to setup a bridge via # virsh net-define foo.xml and trying the following files as xml file, but they all failed to achieve the task. Here I list the two XML variants I tried to use 1) <network> <name>bridge-no-nat</name> <bridge name='virbr1_no-nat' stp='on' delay='0'/> <forward mode='open'/> </network> RETURNS: open forwarding requested, but no IP address provided for network 'bridge-no-nat' 2) I created in nmtui the bridge virbr1_no_nat then I used following XML for virsh net-define <network> <name>br1_no_nat</name> <forward mode='bridge'/> <bridge name='virbr1_no_nat'/> <virtualport type='openvswitch'/> <portgroup name='default'/> </network> then I configure the VM network to use but when I start the VM I get error: internal error: Unable to add port vnet1 to OVS bridge virbr1_no_nat: <null> Do you know how I can solve this? Thank you

3 2

KVM static internal networking without host bridge interface (virbr)
by Daniel 01 Aug '24

01 Aug '24

How to set up an internal network between two KVM network interfaces while using static networking (avoiding dnsmasq) and while avoiding a host bridge interface (virbr)? Currently I am using this for the network. <network> <name>Internal</name> <bridge name='virbr2' stp='on' delay='0'/> </network> And then for the VM. <interface type='network'> <source network='Internal'/> <model type='virtio'/> <driver name='qemu'/> </interface> * I would like to avoid the host `virbr2` interface. This is because ideally package sniffers on the host such as tshark / wireshark would be unable to see these packages following between an internal network between two VMs. * SLIRP should be avoided due to past security issues. [1] * dnsmasq on the host operating system or inside the VMs should also be avoided in favor of static IP addresses. By comparison, this is possible in VirtualBox. [2] Is that possible with KVM too? Could you please show an example configuration file on how to accomplish that? [1] CVE-2019-6778 [2] VirtualBox has this capability. VirtualBox can have an internal network using static networking. No vibr bridge interfaces can be seen on the host operating system. And VM to VM internal traffic is not visible to package analyzers on the host operating system either. Regards, Daniel -- Daniel Winzen Steinkaulstr. 47 52070 Aachen Germany Web: https://danwin1210.de/ E-Mail: daniel(a)danwin1210.de Phone: +49 176 98819809 PGP-Key: https://danwin1210.de/pgp.txt

2 3

Certificate verification error for qemu while migrating
by jdeberles＠gmail.com 29 Jul '24

29 Jul '24

Hello, I'm running ovirt 4.4.10 (using libvirt 7.10.0-1.module_el8.6.0+1046+bd8eec5e) and I have the following qemu error while I launch a VM migration Jul 3 12:37:07myhostname1 journal[958949]: Certificate [session] owner does not match the hostname myhostname2 Jul 3 12:37:07 myhostname1journal[958949]: Certificate check failed Certificate [session] owner does not match the hostname myhostname2 Jul 3 12:37:07 myhostname1 journal[958949]: authentication failed: Failed to verify peer's certificate Jul 3 12:37:07myhostname1 journal[958949]: operation failed: Failed to connect to remote libvirt URI qemu+tls://myhostname3/system: authentication failed: Failed to verify peer's certificate To avoid this error I set the following paramaters inside the /etc/libvirt/qemu.conf and restard vdsmd and libvirtd daemons. migrate_tls_x509_verify = 0 default_tls_x509_verify = 0 But I still have the same error. Can you help me to understand why this set of parameters are not working as expected ? kind regards, Julien

3 4