From nobody Sun Feb 8 14:52:15 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1496339050493837.7639753574158; Thu, 1 Jun 2017 10:44:10 -0700 (PDT) Received: from localhost ([::1]:45979 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dGU8m-0006JF-JZ for importer@patchew.org; Thu, 01 Jun 2017 13:44:08 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:42317) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dGTuS-0001hi-7K for qemu-devel@nongnu.org; Thu, 01 Jun 2017 13:29:21 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dGTuQ-0000TN-Vk for qemu-devel@nongnu.org; Thu, 01 Jun 2017 13:29:20 -0400 Received: from mx1.redhat.com ([209.132.183.28]:38766) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1dGTuM-0000IP-Ks; Thu, 01 Jun 2017 13:29:14 -0400 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 983F5804EB; Thu, 1 Jun 2017 17:29:13 +0000 (UTC) Received: from t460.redhat.com (ovpn-116-124.ams2.redhat.com [10.36.116.124]) by smtp.corp.redhat.com (Postfix) with ESMTP id 39B88A8420; Thu, 1 Jun 2017 17:28:57 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 983F5804EB Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx03.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=berrange@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 983F5804EB From: "Daniel P. Berrange" To: qemu-devel@nongnu.org Date: Thu, 1 Jun 2017 18:27:33 +0100 Message-Id: <20170601172734.9039-20-berrange@redhat.com> In-Reply-To: <20170601172734.9039-1-berrange@redhat.com> References: <20170601172734.9039-1-berrange@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Thu, 01 Jun 2017 17:29:13 +0000 (UTC) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v8 19/20] qcow2: report encryption specific image information X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Kevin Wolf , Alberto Garcia , qemu-block@nongnu.org, Max Reitz Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Currently 'qemu-img info' reports a simple "encrypted: yes" field. This is not very useful now that qcow2 can support multiple encryption formats. Users want to know which format is in use and some data related to it. Wire up usage of the qcrypto_block_get_info() method so that 'qemu-img info' can report about the encryption format and parameters in use $ qemu-img create \ --object secret,id=3Dsec0,data=3D123456 \ -o encrypt.format=3Dluks,encrypt.key-secret=3Dsec0 \ -f qcow2 demo.qcow2 1G Formatting 'demo.qcow2', fmt=3Dqcow2 size=3D1073741824 \ encryption=3Doff encrypt.format=3Dluks encrypt.key-secret=3Dsec0 \ cluster_size=3D65536 lazy_refcounts=3Doff refcount_bits=3D16 $ qemu-img info demo.qcow2 image: demo.qcow2 file format: qcow2 virtual size: 1.0G (1073741824 bytes) disk size: 480K encrypted: yes cluster_size: 65536 Format specific information: compat: 1.1 lazy refcounts: false refcount bits: 16 encrypt: ivgen alg: plain64 hash alg: sha256 cipher alg: aes-256 uuid: 3fa930c4-58c8-4ef7-b3c5-314bb5af21f3 format: luks cipher mode: xts slots: [0]: active: true iters: 1839058 key offset: 4096 stripes: 4000 [1]: active: false key offset: 262144 [2]: active: false key offset: 520192 [3]: active: false key offset: 778240 [4]: active: false key offset: 1036288 [5]: active: false key offset: 1294336 [6]: active: false key offset: 1552384 [7]: active: false key offset: 1810432 payload offset: 2068480 master key iters: 438487 corrupt: false With the legacy "AES" encryption we just report the format name $ qemu-img create \ --object secret,id=3Dsec0,data=3D123456 \ -o encrypt.format=3Daes,encrypt.key-secret=3Dsec0 \ -f qcow2 demo.qcow2 1G Formatting 'demo.qcow2', fmt=3Dqcow2 size=3D1073741824 \ encryption=3Doff encrypt.format=3Daes encrypt.key-secret=3Dsec0 \ cluster_size=3D65536 lazy_refcounts=3Doff refcount_bits=3D16 $ ./qemu-img info demo.qcow2 image: demo.qcow2 file format: qcow2 virtual size: 1.0G (1073741824 bytes) disk size: 196K encrypted: yes cluster_size: 65536 Format specific information: compat: 1.1 lazy refcounts: false refcount bits: 16 encrypt: format: aes corrupt: false Signed-off-by: Daniel P. Berrange Reviewed-by: Alberto Garcia Reviewed-by: Eric Blake Reviewed-by: Max Reitz --- block/qcow2.c | 32 +++++++++++++++++++++++++++++++- qapi/block-core.json | 27 ++++++++++++++++++++++++++- 2 files changed, 57 insertions(+), 2 deletions(-) diff --git a/block/qcow2.c b/block/qcow2.c index 58da658..a8a23af 100644 --- a/block/qcow2.c +++ b/block/qcow2.c @@ -3196,8 +3196,14 @@ static int qcow2_get_info(BlockDriverState *bs, Bloc= kDriverInfo *bdi) static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs) { BDRVQcow2State *s =3D bs->opaque; - ImageInfoSpecific *spec_info =3D g_new(ImageInfoSpecific, 1); + ImageInfoSpecific *spec_info; + QCryptoBlockInfo *encrypt_info =3D NULL; =20 + if (s->crypto !=3D NULL) { + encrypt_info =3D qcrypto_block_get_info(s->crypto, &error_abort); + } + + spec_info =3D g_new(ImageInfoSpecific, 1); *spec_info =3D (ImageInfoSpecific){ .type =3D IMAGE_INFO_SPECIFIC_KIND_QCOW2, .u.qcow2.data =3D g_new(ImageInfoSpecificQCow2, 1), @@ -3224,6 +3230,30 @@ static ImageInfoSpecific *qcow2_get_specific_info(Bl= ockDriverState *bs) assert(false); } =20 + if (encrypt_info) { + ImageInfoSpecificQCow2Encryption *qencrypt =3D + g_new(ImageInfoSpecificQCow2Encryption, 1); + switch (encrypt_info->format) { + case Q_CRYPTO_BLOCK_FORMAT_QCOW: + qencrypt->format =3D BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_AES; + qencrypt->u.aes =3D encrypt_info->u.qcow; + break; + case Q_CRYPTO_BLOCK_FORMAT_LUKS: + qencrypt->format =3D BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_LUKS; + qencrypt->u.luks =3D encrypt_info->u.luks; + break; + default: + assert(false); + } + /* Since we did shallow copy above, erase any pointers + * in the original info */ + memset(&encrypt_info->u, 0, sizeof(encrypt_info->u)); + qapi_free_QCryptoBlockInfo(encrypt_info); + + spec_info->u.qcow2.data->has_encrypt =3D true; + spec_info->u.qcow2.data->encrypt =3D qencrypt; + } + return spec_info; } =20 diff --git a/qapi/block-core.json b/qapi/block-core.json index a4e47a1..043c9e9 100644 --- a/qapi/block-core.json +++ b/qapi/block-core.json @@ -33,6 +33,27 @@ 'vm-clock-sec': 'int', 'vm-clock-nsec': 'int' } } =20 ## +# @ImageInfoSpecificQCow2EncryptionBase: +# +# @format: The encryption format +# +# Since: 2.10 +## +{ 'struct': 'ImageInfoSpecificQCow2EncryptionBase', + 'data': { 'format': 'BlockdevQcow2EncryptionFormat'}} + +## +# @ImageInfoSpecificQCow2Encryption: +# +# Since: 2.10 +## +{ 'union': 'ImageInfoSpecificQCow2Encryption', + 'base': 'ImageInfoSpecificQCow2EncryptionBase', + 'discriminator': 'format', + 'data': { 'aes': 'QCryptoBlockInfoQCow', + 'luks': 'QCryptoBlockInfoLUKS' } } + +## # @ImageInfoSpecificQCow2: # # @compat: compatibility level @@ -44,6 +65,9 @@ # # @refcount-bits: width of a refcount entry in bits (since 2.3) # +# @encrypt: details about encryption parameters; only set if image +# is encrypted (since 2.10) +# # Since: 1.7 ## { 'struct': 'ImageInfoSpecificQCow2', @@ -51,7 +75,8 @@ 'compat': 'str', '*lazy-refcounts': 'bool', '*corrupt': 'bool', - 'refcount-bits': 'int' + 'refcount-bits': 'int', + '*encrypt': 'ImageInfoSpecificQCow2Encryption' } } =20 ## --=20 2.9.3