- Users - libvirt List Archives

splitting a bt wifi combo between two vms
by daggs 27 Aug '24

27 Aug '24

Greetings, I have the following combo device: dagg@NCC-5001D ~ $ lsusb -d8087:0029 Bus 001 Device 002: ID 8087:0029 Intel Corp. AX200 Bluetooth dagg@NCC-5001D ~ $ lspci -vv -s 03:00.0 03:00.0 Network controller: Intel Corporation Wi-Fi 6 AX200 (rev 1a) Subsystem: Intel Corporation Wi-Fi 6 AX200NGW Control: I/O- Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx- Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx- Interrupt: pin A routed to IRQ 34 IOMMU group: 13 Region 0: Memory at fc600000 (64-bit, non-prefetchable) [size=16K] Capabilities: <access denied> Kernel modules: iwlwifi I want to pass each of them to a different vm. should I expect problems? Thanks, Dagg

3 3

Updating authentication for a Ceph (RBD) disk in a live domain
by will.gorman＠joyent.com 21 Aug '24

21 Aug '24

Is it possible to update and change the <auth/> for an RBD network disk while the domain the disk is attached to is running and without detaching/reattaching the disk? For example if I have a disk attached like the following: <disk type='network' device='disk'> <driver name='qemu' type='raw'/> <auth username='someuser'> <secret type='ceph' usage='someuser key'/> </auth> <source protocol='rbd' name='somepool/someimage'> <host name='127.0.0.1' port='3300'/> </source> <target dev='sdd' bus='scsi'/> <alias name='scsi0-0-0-3'/> <address type='drive' controller='0' bus='0' target='0' unit='3'/> </disk> If I want to change the auth to <auth username='someotheruser'> <secret type='ceph' usage='someotheruser key'/> </auth> can I do that without either attaching/detaching the disk or stopping/restarting the domain? I've tried `virsh update-device domain disk.xml --live --persistent` using xml identical to the current disk except for the auth and it says "Device updated successfully" but when I check the domain with `dumpxml` I can still see the original auth settings for the disk.

2 1

cap seach for session libvirt
by daggs 10 Aug '24

10 Aug '24

Greetings, I'm working on allowing a session vm to create a tap iface. the vm has this defintion: <interface type='ethernet'> <mac address='52:54:00:a7:79:6b'/> <target dev='veth0'/> <model type='virtio'/> <address type='pci' domain='0x0000' bus='0x04' slot='0x00' function='0x0'/> </interface> when I try to start the vm, I get this error: Unable to create tap device veth0: Operation not permitted searching the code led me to this line: https://github.com/libvirt/libvirt/blob/0caacf47d7b423db9126660fb0382ed56cd… I've looked on line and found out I need the net_admin_cap set. so I took the relevant code in to a dedicated test file and using pam_cap I've defined such cap for the test file, all went well. so I took it back to virsh and defined that cap to virsh but I'm still getting the same issue, see: https://ibb.co/zHggRQZ the os is debian 12 any ideas why I'm still getting this error? Thanks, Dagg

2 4

luks devices and libvirt
by Marc Haber 05 Aug '24

05 Aug '24

Hi, this is an ongoing issue. I don't know whether I ever have addresses this here, but it's still annoying. I am using debian unstable, libvirt 10.5.0, virt-manager 4.1.0, qemu 9.0.2. I work through virt-manager, rarely I use virsh. I regularly configure virtual disks that are located on a luks-encrypted LVM volume. when unlocked, the block devices appears as /dev/mapper/foo and is a symlink to a ../dm-xx node with xx being a random number, ../dm-xx being a regular block device. To facilitate this, I have defined a storage pool with this XML: <pool type="dir"> <name>mapper</name> <uuid></uuid> <capacity unit="bytes">24598757376</capacity> <allocation unit="bytes">0</allocation> <available unit="bytes">24598757376</available> <source> </source> <target> <path>/dev/mapper</path> <permissions> <mode>0755</mode> <owner>0</owner> <group>0</group> </permissions> </target> </pool> This is necessary as the storage type "LVM volume group" now insists on a volume group name, and the DM mappings created by LUKS dont have a volume group name. When I add a disk to a VM from this storage pool, it generates the XML: <disk type="file" device="disk"> <driver name="qemu" type="raw"/> <source file="/dev/mapper/wintest"/> <target dev="vda" bus="virtio"/> <address type="pci" domain="0x0000" bus="0x05" slot="0x00" function="0x0"/> </disk> qemu won't start with this settings: error: Failed to start domain 'win11test' error: internal error: QEMU unexpectedly closed the monitor (vm='win11test'): 2024-07-28T15:20:25.250387Z qemu-system-x86_64: -blockdev {"driver":"file","filename":"/dev/mapper/wintest","node-name":"libvirt-1-storage","read-only":false}: 'file' driver requires '/dev/mapper/wintest' to be a regular file Changing the XML to <disk type="block" device="disk"> <driver name="qemu" type="raw"/> <source dev="/dev/mapper/wintest"/> <target dev="vda" bus="virtio"/> <address type="pci" domain="0x0000" bus="0x05" slot="0x00" function="0x0"/> </disk> (note type="block" and "source dev") makes the VM work. Can virt-manager somehow be coaxed into generating XML that works here? If not, is this a virt-manager issue or should qemu just accept type="file" and "source file")? Greetings Marc -- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Leimen, Germany | lose things." Winona Ryder | Fon: *49 6224 1600402 Nordisch by Nature | How to make an American Quilt | Fax: *49 6224 1600421

2 1

setting bridge for VMs IP assignment by router's DHCP server
by Germano Massullo 03 Aug '24

03 Aug '24

I am running a libvirt hostmachine (Fedora 40) which has 192.168.1.6 IP address, assigned by router's DHCP server. I want the libvirt VMs IPs to be assigned by router's DHCP server, so I tried to setup a bridge via # virsh net-define foo.xml and trying the following files as xml file, but they all failed to achieve the task. Here I list the two XML variants I tried to use 1) <network> <name>bridge-no-nat</name> <bridge name='virbr1_no-nat' stp='on' delay='0'/> <forward mode='open'/> </network> RETURNS: open forwarding requested, but no IP address provided for network 'bridge-no-nat' 2) I created in nmtui the bridge virbr1_no_nat then I used following XML for virsh net-define <network> <name>br1_no_nat</name> <forward mode='bridge'/> <bridge name='virbr1_no_nat'/> <virtualport type='openvswitch'/> <portgroup name='default'/> </network> then I configure the VM network to use but when I start the VM I get error: internal error: Unable to add port vnet1 to OVS bridge virbr1_no_nat: <null> Do you know how I can solve this? Thank you

3 2

KVM static internal networking without host bridge interface (virbr)
by Daniel 02 Aug '24

02 Aug '24

How to set up an internal network between two KVM network interfaces while using static networking (avoiding dnsmasq) and while avoiding a host bridge interface (virbr)? Currently I am using this for the network. <network> <name>Internal</name> <bridge name='virbr2' stp='on' delay='0'/> </network> And then for the VM. <interface type='network'> <source network='Internal'/> <model type='virtio'/> <driver name='qemu'/> </interface> * I would like to avoid the host `virbr2` interface. This is because ideally package sniffers on the host such as tshark / wireshark would be unable to see these packages following between an internal network between two VMs. * SLIRP should be avoided due to past security issues. [1] * dnsmasq on the host operating system or inside the VMs should also be avoided in favor of static IP addresses. By comparison, this is possible in VirtualBox. [2] Is that possible with KVM too? Could you please show an example configuration file on how to accomplish that? [1] CVE-2019-6778 [2] VirtualBox has this capability. VirtualBox can have an internal network using static networking. No vibr bridge interfaces can be seen on the host operating system. And VM to VM internal traffic is not visible to package analyzers on the host operating system either. Regards, Daniel -- Daniel Winzen Steinkaulstr. 47 52070 Aachen Germany Web: https://danwin1210.de/ E-Mail: daniel(a)danwin1210.de Phone: +49 176 98819809 PGP-Key: https://danwin1210.de/pgp.txt

2 3

Certificate verification error for qemu while migrating
by jdeberles＠gmail.com 29 Jul '24

29 Jul '24

Hello, I'm running ovirt 4.4.10 (using libvirt 7.10.0-1.module_el8.6.0+1046+bd8eec5e) and I have the following qemu error while I launch a VM migration Jul 3 12:37:07myhostname1 journal[958949]: Certificate [session] owner does not match the hostname myhostname2 Jul 3 12:37:07 myhostname1journal[958949]: Certificate check failed Certificate [session] owner does not match the hostname myhostname2 Jul 3 12:37:07 myhostname1 journal[958949]: authentication failed: Failed to verify peer's certificate Jul 3 12:37:07myhostname1 journal[958949]: operation failed: Failed to connect to remote libvirt URI qemu+tls://myhostname3/system: authentication failed: Failed to verify peer's certificate To avoid this error I set the following paramaters inside the /etc/libvirt/qemu.conf and restard vdsmd and libvirtd daemons. migrate_tls_x509_verify = 0 default_tls_x509_verify = 0 But I still have the same error. Can you help me to understand why this set of parameters are not working as expected ? kind regards, Julien

3 4

can this network setup works?
by daggs 13 Jul '24

13 Jul '24

Greetings, I have this setup. host and two vms, a and b. vm a servers as router, it has one physical nic passed directly into it. I want to connect vm a to vm b and the host to provide internet access to both. so I've created a virtual switch like this: <network> <name>default</name> <uuid>f90b3044-81c1-4c22-98df-8bbca3153f21</uuid> <bridge name='virsw0' stp='on' delay='0'/> <mac address='52:54:00:6b:1b:92'/> </network> with this xml entry: <interface type='bridge'> <mac address='xx:xx:xx:xx:xx:xx'/> <source bridge='virsw0'/> <model type='virtio'/> <address type='pci' domain='x' bus='x' slot='x' function='x'/> </interface> in vm a and vm b should connect the both to the virtual switch thus allowing vm b internet access. this however doesn't solves the host connection to the internet. reading docs points to the fact I can add new tun devs outside of libvirt and add it to the virtual switch. so I did this: $ ip tuntap add QemuTap0 mode tap user root $ ip link set QemuTap0 master virsw0 and brctl show virsw0 returns this: $ brctl show virsw0 bridge name bridge id STP enabled interfaces virsw0 8000.5254006b1b92 yes QemuTap0 so theoretically speaking, when vm a is started and libvirt creates a device and connects it to the virtual switch and run dhcpd, vm a will provide ip. am I correct? Thanks, Dagg

1 0

per user vm isolation with shared network
by daggs 03 Jul '24

03 Jul '24

Greetings, I have two vm which I want to isolate per user, if I'm not mistaken, I can to that with per session uri. but I want to setup a virtual bridge so they will get connected with each other. looks like that if I define the network as system, it isn't visible in the session. is there a way to do that? if I define the same network in both sessions, will it work? Thanks, Dagg

2 8

Re: dm-crypt performance regression due to workqueue changes
by Mikulas Patocka 02 Jul '24

02 Jul '24

On Sun, 30 Jun 2024, Tejun Heo wrote: > Hello, > > On Sat, Jun 29, 2024 at 08:15:56PM +0200, Mikulas Patocka wrote: > > > With 6.5, we get 3600MiB/s; with 6.6 we get 1400MiB/s. > > > > The reason is that virt-manager by default sets up a topology where we > > have 16 sockets, 1 core per socket, 1 thread per core. And that workqueue > > patch avoids moving work items across sockets, so it processes all > > encryption work only on one virtual CPU. > > > > The performance degradation may be fixed with "echo 'system' > > >/sys/module/workqueue/parameters/default_affinity_scope" - but it is > > regression anyway, as many users don't know about this option. > > > > How should we fix it? There are several options: > > 1. revert back to 'numa' affinity > > 2. revert to 'numa' affinity only if we are in a virtual machine > > 3. hack dm-crypt to set the 'numa' affinity for the affected workqueues > > 4. any other solution? > > Do you happen to know why libvirt is doing that? There are many other > implications to configuring the system that way and I don't think we want to > design kernel behaviors to suit topology information fed to VMs which can be > arbitrary. > > Thanks. I don't know why. I added users(a)lists.libvirt.org to the CC. How should libvirt properly advertise "we have 16 threads that are dynamically scheduled by the host kernel, so the latencies between them are changing and unpredictable"? Mikulas

4 7