- Users - libvirt List Archives

Could not initialize refcount handling - efi ?
by lejeczek 17 Jul '26

17 Jul '26

Hi guys. I cannot start a domain - I wonder if the firmware, in xml, have anything to do with it or issue is different? Jul 17 11:07:41 virtqemud[5658]: Unable to read from monitor: Connection reset by peer Jul 17 11:07:41 virtqemud[5658]: internal error: QEMU unexpectedly closed the monitor (vm='ubusrv2'): 2026-07-17T09:07:41.089484Z qemu-kvm: -blockdev {"node-name":"libvirt-2-format","read-only":false,"discard":"unmap","cache":{"direct":true,"no-flush":false},"driver":"qcow2","encrypt":{"format":"luks","key-secret":"libvirt-2-format-encryption-secret0"},"file":"libvirt-2-storage","backing":null}: Could not initialize refcount handling: Input/output error Jul 17 11:07:41 virtqemud[5658]: internal error: process exited while connecting to monitor: 2026-07-17T09:07:41.089484Z qemu-kvm: -blockdev {"node-name":"libvirt-2-format","read-only":false,"discard":"unmap","cache":{"direct":true,"no-flush":false},"driver":"qcow2","encrypt":{"format":"luks","key-secret":"libvirt-2-format-encryption-secret0"},"file":"libvirt-2-storage","backing":null}: Could not initialize refcount handling: Input/output error Above happens with: <os firmware='efi'> <type arch='x86_64' machine='pc-q35-rhel10.2.0'>hvm</type> <firmware> <feature enabled='no' name='enrolled-keys'/> <feature enabled='yes' name='secure-boot'/> </firmware> <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/ubusrv2_VARS.fd</nvram> if I do not use EFI than domain starts, no above virtqemud errors, but guest does not boot, expectedly I think - I used to boot a ok. qemu-img shows no issues. Any thoughts? many thanks, L.

2 3

SELinux label with nvram?
by lejeczek 15 Jul '26

15 Jul '26

Hi guys. Having a domain like so: .... <os firmware='efi'> <type arch='x86_64' machine='pc-q35-rhel10.2.0'>hvm</type> <firmware> <feature enabled='yes' name='enrolled-keys'/> <feature enabled='yes' name='secure-boot'/> </firmware> <loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/ubusrv2_VARS.fd</nvram> ... <seclabel type='dynamic' model='selinux' relabel='yes'> <label>system_u:system_r:svirt_t:s0</label> <imagelabel>system_u:object_r:svirt_image_t:s0</imagelabel> </seclabel> <seclabel type='dynamic' model='dac' relabel='yes'> <label>+107:+107</label> <imagelabel>+107:+107</imagelabel> </seclabel> _seclabels_ are from virt-install - I'd presume this mandatory/default Any such domain - using NVRAM - fails to start with SELinux logging: ... virtqemud[1340835]: internal error: child reported (status=125): Requested operation is not valid: Setting different SELinux label on /var/lib/libvirt/qemu/nvram/ubusrv2_VARS.fd which is already in use ... Do you have any thoughts on how to "fix" it? I think I've seen this/similar issue a few years ago - I might have even filed a BZ. Also - I got a number of rpm updates among which is qemu to version 10.1.0-24 - prior to that my VMs worked a ok, on Centos 10. Anybody with similar experience? many thanks, L.

2 1

Extending sVirt to work under qemu:///session
by procmem＠riseup.net 07 Jun '26

07 Jun '26

Hi. I'm a developer with the security and privacy project; WhonixOS and recently we've ported our VMs to make use of the unprivileged qemu:///session mode to be compatible with our host OS that runs in a strict user only mode for daily activities. To my surprise, sVirt is not applied to VMs running in this mode. Inter VM isolation is important for our security model where traffic from an untrusted VM is forcefully tunneled to a trusted gateway VM running Tor to anonymize traffic. We don't want to be in a situation where we have to choose between running in the relatively riskier qemu:///system mode to gain the benefits of sVirt vs sacrificing sVirt inter VM isolation in order to be more compatible with our stricter unprivileged user implementation (which is just safer overall). Please consider extending sVirt to be compatible with qemu session for AppArmor and SELinux

1 0

How to use qemu's blkdebug driver (can't see backing device)
by Ian Pilcher 18 May '26

18 May '26

I am working on a disk burn-in utility, and I'd like to use qemu's blkdebug driver to simulate disk errors. I've added the qemu namespace to my domain. <domain xmlns:qemu="http://libvirt.org/schemas/domain/qemu/1.0" type="kvm"> I've set an alias for my SCSI controller. <controller type="scsi" index="0" model="virtio-scsi"> <driver queues="4" iothread="1"/> <alias name="ua-scsi0"/> <address type="pci" domain="0x0000" bus="0x07" slot="0x00" function="0x0"/> </controller> And I've added the qemu command-line options. <qemu:commandline> <qemu:arg value="-blockdev"/> <qemu:arg value="{"driver":"host_device","filename":"/dev/ram0","node-name":"ram-backend","cache":{"direct":true,"no-flush":false},"discard":"unmap"}"/> <qemu:arg value="-blockdev"/> <qemu:arg value="{"driver":"raw","file":"ram-backend","node-name":"raw-layer"}"/> <qemu:arg value="-blockdev"/> <qemu:arg value="{"driver":"blkdebug","config":"/var/lib/libvirt/images/test.conf","image":"raw-layer","node-name":"debug-disk"}"/> <qemu:arg value="-device"/> <qemu:arg value="scsi-hd,drive=debug-disk,id=scsi0-0-0-1,wwn=0x5000c50030000001,logical_block_size=4096,physical_block_size=4096,bus=ua-scsi0.0,channel=0,scsi-id=0,lun=1"/> </qemu:commandline> When I try to start the VM, I get this. Error starting domain: internal error: process exited while connecting to monitor: 2026-05-15T16:42:46.891789Z qemu-system-x86_64: -blockdev {"driver":"host_device","filename":"/dev/ram0","node-name":"ram-backend","cache":{"direct":true,"no-flush":false},"discard":"unmap"}: Could not open '/dev/ram0': No such file or directory /dev/ram0 definitely exists, and is owned by qemu:qemu. Google Gemini tells me that this is some sort of security feature, but it hasn't been able to suggest a non-janky way to work around it. (To me, changing the global libvirt configuration, rando trigger scripts, or creating some sort of redundant fake drive all fall into the janky category.) Is there really not a clean way to do this? -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================

2 1

virt-viewer cage full screen tty issues
by Bram Diederik 09 May '26

09 May '26

my .profile is filled with scripts like this. pasted below. it allows a full screen desktop with out any other screens. at a dedicated tty. but it has two issues. If there already is an connection i need to kill everuthing on the tty. And sometimes when i pkill -9 -t tty9 switch from client system the keyboard and mouse dont work. they do work after i rebooted the VM. I dont google stuff deeply and make it my self if i cant find it right away. So i might be doing it wrong. anyway some one can help me with the two issues. ps one bash question. I have an exit. but a right placed ctrl C can break to prompt i dont want that does some one know how i always run the program or exit to logout state. Cheers. bram if [[ "$(tty)" == "/dev/tty10" ]]; then export XDG_RUNTIME_DIR=/run/user/$(id -u)/cage10 while true; do # start agent if needed [ -z "$SSH_AUTH_SOCK" ] && eval "$(ssh-agent -s)" >/dev/null # load key if needed ssh-add -l >/dev/null 2>&1 || ssh-add ~/.ssh/id_rsa mkdir -p "$XDG_RUNTIME_DIR" chmod 700 "$XDG_RUNTIME_DIR" # Run virt-viewer cage -s -- virt-viewer \ --domain-name vision \ -c "qemu+ssh://bram@jack/system?ssh_compression=yes" \ --attach -f \ --auto-resize=always sleep 2 done exit fi

1 0

virt-host-validate should warn about false positives
by therandshow＠gmail.com 04 May '26

04 May '26

virt-host-validate seems to sometimes complain about freezer support on machines with cgroups v2 where it doesn't matter, it also reports lack of devices cgroup if the user isn't running as root. Ideally, it should report N/A on freezer support for cgroups v2 or just PASS because it has validated that it wasn't necessary. Or maybe just have a warning at the bottom, failure for the freezer cgroup only applies to cgroups v1 For devices cgroup, a warning if the user is running not as root and the test fails, you may need elevated privileges to check cgroup 'devices' or something along those lines. Or failing to put it in the output, it would be nice if these facts were more prominent in a troubleshooting page

2 2

NVRAM storage live migration
by jchrist＠anexia-it.com 28 Apr '26

28 Apr '26

Hi, via virsh blockcopy I can live migrate disks between paths. Internally, this seems to use QEMU's drive-mirror or blockdev-mirror. Is something similar possible with the EFI NVRAM / vars file? blockcopy does not work, as judging by the code it only searches disk elements in the domain XML definition, which doesn't include single files like this. Under the hood, however, the vars file is represented in QEMU as a -blockdev. Judging by the docs for virDomainQemuMonitorCommand, it is unsafe to manually command QEMU to move this file around via drive-mirror and friends. Is there an alternative approach? Thanks, Jakob

1 0

Migrating VM to new supervisor - general question
by fc26wuqa＠studserv.uni-leipzig.de 20 Apr '26

20 Apr '26

Hello, I planned to move my VMs to a new (VM) supervisor, because I want to use another operation system for it. I am doubting myself, if this is such a good idea. When all my VMs are on different disks, can I just install a different OS on the root partition and just import the qcow2 files afterwards. Or am I risking losing my VMs/disks? I am a little bit afraid of messing it up... Thank you.

2 3

Windows 11 sound driver problem
by Owen Le Blanc 20 Apr '26

20 Apr '26

I have a Windows 11 system running under libvirt/qemu. A recent Microsoft software update overwrote the audio driver. Device manager would not let me install the one from the virtio ISO because it had determined that the "best driver was already installed". But sound wasn't working. I solved this by going into device manager and deleting the windows driver, then adding the viogpudo driver from the ISO manually. After rebooting the virtual machine, audio was working again. Yours, -- Owen Dr O V Le Blanc

1 0

attaching a specific usb device to vm
by daggs 20 Apr '26

20 Apr '26

Greetings, I have two identical hdd to usb enclosures connected to a server which run two vms, lets call the foo and goo. I'm looking for the ability to connect a specific hdd to a specific vm, naturally using vendor and device is not possible and using bus+port will provide what I need however it does not persists incase of port change. I saw that using the hooks, libvirt provides the xml to the hook and read it from the output of the hook. I tried adding detection and adding accurate hostdev xml tag to the vm xml and I see it from the output of the hook execution in the prepare stage however, the system boots but the hdd is not visible in guest. the docs reference this feature only for migrate and restore ops, does this means I cannot use it in the prepare stage? if so, is there another way to do what I want? Thanks, Dagg

3 4