[PATCH] qemu: Fix error code for SEV launchSecurity unsupported
by Boris Fiuczynski
When SEV is not supported but specified in the domain XML by a user it
should not result in an internal error (VIR_ERR_INTERNAL_ERROR)
therefore switching to XML error (VIR_ERR_CONFIG_UNSUPPORTED).
Signed-off-by: Boris Fiuczynski <fiuczy(a)linux.ibm.com>
---
This patch is based on top of the series
[PATCH v4 0/8] Support for launchSecurity type s390-pv
src/qemu/qemu_validate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c
index 7482bedee6..bb672727d5 100644
--- a/src/qemu/qemu_validate.c
+++ b/src/qemu/qemu_validate.c
@@ -1218,7 +1218,7 @@ qemuValidateDomainDef(const virDomainDef *def,
switch ((virDomainLaunchSecurity) def->sec->sectype) {
case VIR_DOMAIN_LAUNCH_SECURITY_SEV:
if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_SEV_GUEST)) {
- virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
_("SEV launch security is not supported with "
"this QEMU binary"));
return -1;
--
2.31.1
3 years, 4 months
[libvirt PATCH 0/2] Remove macros "VIR_INSERT_ELEMENT_COPY" and "VIR_INSERT_ELEMENT_COPY_INPLACE"
by Tim Wiederhake
There was but one use left, and that is removed in patch 1.
Tim Wiederhake (2):
virQEMUCapsGetMachineTypesCaps: Use GPtrArray
viralloc: Delete VIR_INSERT_ELEMENT_COPY and
VIR_INSERT_ELEMENT_COPY_INPLACE
src/qemu/qemu_capabilities.c | 37 ++++++++++++++++++------------------
src/util/viralloc.h | 22 ++++-----------------
2 files changed, 22 insertions(+), 37 deletions(-)
--
2.31.1
3 years, 4 months
[libvirt PATCH] qemu: remove default audio backend for migratable XML
by Daniel P. Berrangé
When seeing a guest with a sound device, and no audio backend, we
automatically add an audio backend XML element based on the historical
QEMU driver behaviour. Unfortunately when we live migrate back to an
old libvirt, it may not understand the audio driver type we configured.
We thus need to strip the default audio backend when migrating.
Signed-off-by: Daniel P. Berrangé <berrange(a)redhat.com>
---
src/libvirt_private.syms | 1 +
src/qemu/qemu_domain.c | 128 ++++++++++++++++++++++++++++++---------
2 files changed, 101 insertions(+), 28 deletions(-)
diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
index 43e6398ae5..cc7533a707 100644
--- a/src/libvirt_private.syms
+++ b/src/libvirt_private.syms
@@ -226,6 +226,7 @@ virDiskNameParse;
virDiskNameToBusDeviceIndex;
virDiskNameToIndex;
virDomainActualNetDefFree;
+virDomainAudioDefFree;
virDomainAudioFormatTypeFromString;
virDomainAudioFormatTypeToString;
virDomainAudioIOCommonIsSet;
diff --git a/src/qemu/qemu_domain.c b/src/qemu/qemu_domain.c
index 8488f58e09..3af678a283 100644
--- a/src/qemu/qemu_domain.c
+++ b/src/qemu/qemu_domain.c
@@ -3587,18 +3587,19 @@ qemuDomainDefAddImplicitInputDevice(virDomainDef *def)
}
static int
-qemuDomainDefAddDefaultAudioBackend(virQEMUDriver *driver,
- virDomainDef *def)
+qemuDomainDefSuggestDefaultAudioBackend(virQEMUDriver *driver,
+ virDomainDef *def,
+ bool *addAudio,
+ int *audioBackend,
+ int *audioSDLDriver)
{
size_t i;
- bool addAudio = false;
bool audioPassthrough = false;
- int audioBackend = VIR_DOMAIN_AUDIO_TYPE_NONE;
g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver);
- if (def->naudios > 0) {
- return 0;
- }
+ *addAudio = false;
+ *audioBackend = VIR_DOMAIN_AUDIO_TYPE_NONE;
+ *audioSDLDriver = VIR_DOMAIN_AUDIO_SDL_DRIVER_DEFAULT;
for (i = 0; i < def->ngraphics; i++) {
virDomainGraphicsDef *graph = def->graphics[i];
@@ -3609,18 +3610,18 @@ qemuDomainDefAddDefaultAudioBackend(virQEMUDriver *driver,
audioPassthrough = true;
} else {
audioPassthrough = false;
- audioBackend = VIR_DOMAIN_AUDIO_TYPE_NONE;
+ *audioBackend = VIR_DOMAIN_AUDIO_TYPE_NONE;
}
- addAudio = true;
+ *addAudio = true;
break;
case VIR_DOMAIN_GRAPHICS_TYPE_SPICE:
audioPassthrough = false;
- audioBackend = VIR_DOMAIN_AUDIO_TYPE_SPICE;
- addAudio = true;
+ *audioBackend = VIR_DOMAIN_AUDIO_TYPE_SPICE;
+ *addAudio = true;
break;
case VIR_DOMAIN_GRAPHICS_TYPE_SDL:
audioPassthrough = true;
- addAudio = true;
+ *addAudio = true;
break;
case VIR_DOMAIN_GRAPHICS_TYPE_RDP:
@@ -3639,24 +3640,24 @@ qemuDomainDefAddDefaultAudioBackend(virQEMUDriver *driver,
audioPassthrough = true;
} else {
audioPassthrough = false;
- audioBackend = VIR_DOMAIN_AUDIO_TYPE_NONE;
+ *audioBackend = VIR_DOMAIN_AUDIO_TYPE_NONE;
}
- addAudio = true;
+ *addAudio = true;
}
- if (addAudio && audioPassthrough) {
+ if (*addAudio && audioPassthrough) {
const char *audioenv = g_getenv("QEMU_AUDIO_DRV");
if (audioenv == NULL) {
- addAudio = false;
+ *addAudio = false;
} else {
/*
* QEMU audio driver names are mostly the same as
* libvirt XML audio backend names
*/
if (STREQ(audioenv, "pa")) {
- audioBackend = VIR_DOMAIN_AUDIO_TYPE_PULSEAUDIO;
+ *audioBackend = VIR_DOMAIN_AUDIO_TYPE_PULSEAUDIO;
} else {
- if ((audioBackend = virDomainAudioTypeTypeFromString(audioenv)) < 0) {
+ if (((*audioBackend) = virDomainAudioTypeTypeFromString(audioenv)) < 0) {
virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
_("unknown QEMU_AUDIO_DRV setting %s"), audioenv);
return -1;
@@ -3664,6 +3665,79 @@ qemuDomainDefAddDefaultAudioBackend(virQEMUDriver *driver,
}
}
}
+
+ if (*addAudio && *audioBackend == VIR_DOMAIN_AUDIO_TYPE_SDL) {
+ const char *sdldriver = g_getenv("SDL_AUDIODRIVER");
+ if (sdldriver != NULL &&
+ (((*audioSDLDriver) =
+ virDomainAudioSDLDriverTypeFromString(sdldriver)) <= 0)) {
+ virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+ _("unknown SDL_AUDIODRIVER setting %s"), sdldriver);
+ return -1;
+ }
+ }
+
+ return 0;
+}
+
+static int
+qemuDomainDefClearDefaultAudioBackend(virQEMUDriver *driver,
+ virDomainDef *def)
+{
+ bool addAudio;
+ int audioBackend;
+ int audioSDLDriver;
+ virDomainAudioDef *audio;
+
+ if (def->naudios != 1) {
+ return 0;
+ }
+
+ if (qemuDomainDefSuggestDefaultAudioBackend(driver,
+ def,
+ &addAudio,
+ &audioBackend,
+ &audioSDLDriver) < 0)
+ return -1;
+
+ if (!addAudio)
+ return 0;
+
+ audio = def->audios[0];
+ if (audio->type != audioBackend)
+ return 0;
+
+ if (audio->type == VIR_DOMAIN_AUDIO_TYPE_SDL &&
+ audio->backend.sdl.driver != audioSDLDriver)
+ return 0;
+
+ virDomainAudioDefFree(audio);
+ g_free(def->audios);
+ def->naudios = 0;
+ def->audios = NULL;
+
+ return 0;
+}
+
+static int
+qemuDomainDefAddDefaultAudioBackend(virQEMUDriver *driver,
+ virDomainDef *def)
+{
+ bool addAudio;
+ int audioBackend;
+ int audioSDLDriver;
+
+ if (def->naudios > 0) {
+ return 0;
+ }
+
+ if (qemuDomainDefSuggestDefaultAudioBackend(driver,
+ def,
+ &addAudio,
+ &audioBackend,
+ &audioSDLDriver) < 0)
+ return -1;
+
if (addAudio) {
virDomainAudioDef *audio = g_new0(virDomainAudioDef, 1);
@@ -3674,16 +3748,8 @@ qemuDomainDefAddDefaultAudioBackend(virQEMUDriver *driver,
def->audios = g_new0(virDomainAudioDef *, def->naudios);
def->audios[0] = audio;
- if (audioBackend == VIR_DOMAIN_AUDIO_TYPE_SDL) {
- const char *sdldriver = g_getenv("SDL_AUDIODRIVER");
- if (sdldriver != NULL &&
- ((audio->backend.sdl.driver =
- virDomainAudioSDLDriverTypeFromString(sdldriver)) <= 0)) {
- virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
- _("unknown SDL_AUDIODRIVER setting %s"), sdldriver);
- return -1;
- }
- }
+ if (audioBackend == VIR_DOMAIN_AUDIO_TYPE_SDL)
+ audio->backend.sdl.driver = audioSDLDriver;
}
return 0;
@@ -6298,6 +6364,12 @@ qemuDomainDefFormatBufInternal(virQEMUDriver *driver,
if (def->cpu && qemuDomainMakeCPUMigratable(def->cpu) < 0)
return -1;
+
+ /* Old libvirt doesn't understand <audio> elements so
+ * remove any we added by default
+ */
+ if (qemuDomainDefClearDefaultAudioBackend(driver, def) < 0)
+ return -1;
}
format:
--
2.31.1
3 years, 4 months
[PATCH] lib: Specify domain redefinition requirements
by Roman Bolshakov
There might be misunderstanding [1] when libvirt permits domain
redefinition and if it's a valid case at all.
1. https://github.com/ansible-collections/community.libvirt/blob/b973d7c4b40...
Signed-off-by: Roman Bolshakov <r.bolshakov(a)yadro.com>
---
src/libvirt-domain.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c
index 750e32f0ca..e48f3cdb02 100644
--- a/src/libvirt-domain.c
+++ b/src/libvirt-domain.c
@@ -6290,8 +6290,8 @@ virDomainGetBlockInfo(virDomainPtr domain, const char *disk,
*
* Define a domain, but does not start it.
* This definition is persistent, until explicitly undefined with
- * virDomainUndefine(). A previous definition for this domain would be
- * overridden if it already exists.
+ * virDomainUndefine(). A previous definition for this domain with the same
+ * UUID and name would be overridden if it already exists.
*
* virDomainFree should be used to free the resources after the
* domain object is no longer needed.
@@ -6333,8 +6333,8 @@ virDomainDefineXML(virConnectPtr conn, const char *xml)
*
* Defines a domain, but does not start it.
* This definition is persistent, until explicitly undefined with
- * virDomainUndefine(). A previous definition for this domain would be
- * overridden if it already exists.
+ * virDomainUndefine(). A previous definition for this domain with the same
+ * UUID and name would be overridden if it already exists.
*
* virDomainFree should be used to free the resources after the
* domain object is no longer needed.
--
2.32.0
3 years, 4 months
[PATCH v4 0/8] Support for launchSecurity type s390-pv
by Boris Fiuczynski
This patch series introduces the launch security type s390-pv.
Specifying s390-pv as launch security type in an s390 domain prepares for
running the guest in protected virtualization secure mode, also known as
IBM Secure Execution.
diff to v3:
- moved virDomainSEVDef into a union
- improved XML formating for launchSecurity
- use a shared id on the qemu cmd line for confidential-guest-support
- added check for s390-pv host support into XML validation
- changed from ignoring to failing if launchSecuroty child elements are provided for s390-pv
- reduced test to a single failing test
- add availability of s390-pv in domain capabilities
diff to v2:
- Broke up previous patch one into three patches
diff to v1:
- Rebased to current master
- Added verification check for confidential-guest-support capability
Boris Fiuczynski (8):
schemas: Make SEV policy on launch security optional
conf: rework SEV XML parse and format methods
qemu: make KVMSupportsSecureGuest capability available
conf: refactor launch security to allow more types
qemu: add s390-pv-guest capability
conf: add availability of s390-pv in domain capabilities
qemu: use common id lsec0 for launchSecurity
docs: add s390-pv documentation
docs/formatdomain.rst | 7 +
docs/kbase/s390_protected_virt.rst | 55 ++++++-
docs/schemas/domaincaps.rng | 9 ++
docs/schemas/domaincommon.rng | 13 +-
src/conf/domain_capabilities.c | 1 +
src/conf/domain_capabilities.h | 1 +
src/conf/domain_conf.c | 143 +++++++++++++-----
src/conf/domain_conf.h | 17 ++-
src/conf/virconftypes.h | 2 +
src/qemu/qemu_capabilities.c | 24 +++
src/qemu/qemu_capabilities.h | 4 +
src/qemu/qemu_cgroup.c | 4 +-
src/qemu/qemu_command.c | 75 +++++++--
src/qemu/qemu_driver.c | 3 +-
src/qemu/qemu_firmware.c | 33 ++--
src/qemu/qemu_namespace.c | 21 ++-
src/qemu/qemu_process.c | 35 ++++-
src/qemu/qemu_validate.c | 32 +++-
src/security/security_dac.c | 6 +-
tests/domaincapsdata/qemu_2.11.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_2.12.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_3.0.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_4.0.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_4.2.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_5.2.0.s390x.xml | 1 +
tests/domaincapsdata/qemu_6.0.0.s390x.xml | 1 +
tests/domaincapsmock.c | 17 +++
.../launch-security-s390-pv.xml | 18 +++
tests/genericxml2xmltest.c | 1 +
.../qemucapabilitiesdata/caps_6.0.0.s390x.xml | 1 +
...nch-security-s390-pv-fail.s390x-latest.err | 1 +
.../launch-security-s390-pv-fail.xml | 33 ++++
.../launch-security-s390-pv.s390x-latest.args | 35 +++++
.../launch-security-s390-pv.xml | 30 ++++
...v-missing-platform-info.x86_64-2.12.0.args | 4 +-
...urity-sev-missing-policy.x86_64-2.12.0.err | 1 +
.../launch-security-sev-missing-policy.xml | 34 +++++
.../launch-security-sev.x86_64-2.12.0.args | 4 +-
.../launch-security-sev.x86_64-6.0.0.args | 4 +-
tests/qemuxml2argvmock.c | 16 ++
tests/qemuxml2argvtest.c | 4 +
41 files changed, 588 insertions(+), 107 deletions(-)
create mode 100644 tests/genericxml2xmlindata/launch-security-s390-pv.xml
create mode 100644 tests/qemuxml2argvdata/launch-security-s390-pv-fail.s390x-latest.err
create mode 100644 tests/qemuxml2argvdata/launch-security-s390-pv-fail.xml
create mode 100644 tests/qemuxml2argvdata/launch-security-s390-pv.s390x-latest.args
create mode 100644 tests/qemuxml2argvdata/launch-security-s390-pv.xml
create mode 100644 tests/qemuxml2argvdata/launch-security-sev-missing-policy.x86_64-2.12.0.err
create mode 100644 tests/qemuxml2argvdata/launch-security-sev-missing-policy.xml
--
2.31.1
3 years, 4 months
[PATCH] vircgroup: Improve virCgroupControllerAvailable wrt to CGroupsV2
by Michal Privoznik
It all started as a simple bug: trying to move domain memory
between NUMA nodes (e.g. via virsh numatune) did not work. I've
traced the problem to qemuProcessHook() because that's where we
decide whether to rely on CGroups or use numactl APIs to satisfy
<numatune/>. The problem was that virCgroupControllerAvailable()
was telling us that cpuset controller is unavailable. This is
CGroupsV2, and pretty weird because CGroupsV2 definitely do
support cpuset controller and I had them mounted in a standard
way. What I found out (with Pavel's help) was that
virCgroupNewSelf() was looking into the following path to detect
supported controllers:
/sys/fs/cgroup/system.slice/cgroup.controllers
However, if there's no other VM running then the system.slice
only has 'memory' and 'pids' controllers. Therefore, we saw
'cpuset' as not available. The fix is to look at the top most
path, which has the full set of controllers:
/sys/fs/cgroup/cgroup.controllers
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1976690
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
src/util/vircgroup.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/src/util/vircgroup.c b/src/util/vircgroup.c
index 65a81e8d6f..1b3b28342e 100644
--- a/src/util/vircgroup.c
+++ b/src/util/vircgroup.c
@@ -2996,7 +2996,10 @@ virCgroupControllerAvailable(int controller)
{
g_autoptr(virCgroup) cgroup = NULL;
- if (virCgroupNewSelf(&cgroup) < 0)
+ /* Don't use virCgroupNewSelf() - we might be running in a slice that
+ * doesn't have @controller but the domain (for which we will later use
+ * virCgroupHasController()) might have it. */
+ if (virCgroupNew("/", -1, &cgroup) < 0)
return false;
return virCgroupHasController(cgroup, controller);
--
2.31.1
3 years, 4 months
Add SELinux policy for Virt
by Nikola Knazekova
Hi,
I created SELinux policy for Libvirt drivers, as part of Decentralized SELinux Policy (DSP) project.
DSP guidelines is available: https://fedoraproject.org/wiki/SELinux/IndependentPolicy
Discussion about the first version of SELinux policy for Libvirt is available on gitlab:
https://gitlab.com/libvirt/libvirt/-/merge_requests/65
SELinux policy was created for:
Hypervisor drivers:
- virtqemud (QEMU/KVM)
- virtlxcd (LXC)
- virtvboxd (VirtualBox)
Secondary drivers:
- virtstoraged (host storage mgmt)
- virtnetworkd (virtual network mgmt)
- virtinterface (network interface mgmt)
- virtnodedevd (physical device mgmt)
- virtsecretd (security credential mgmt)
- virtnwfilterd (ip[6]tables/ebtables mgmt)
- virtproxyd (proxy daemon)
SELinux policy for virtvxz and virtxend has not been created yet, because I wasn't able to reproduce AVC messages.
These drivers run in unconfined_domain until the AVC messages are reproduced internally and policy for these drivers is made.
Can you please look at it?
Thanks
Nikola
3 years, 4 months
[PATCH] schemas: Allow cache attribute for bandwidth element for HMAT
by Michal Privoznik
Turns out, when introducing HMAT support in v6.6.0-rc1~249
I've forgot to allow "cache" attribute for <bandwidth/> element
in RNG. It's parsed and formatted, but schema does not allow it.
Fixes: a89bbbac86383a10be0cec5a93feb7ed820871eb
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1980162
Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com>
---
docs/schemas/cputypes.rng | 5 +++++
tests/qemuxml2argvdata/numatune-hmat.x86_64-latest.args | 1 +
tests/qemuxml2argvdata/numatune-hmat.xml | 1 +
3 files changed, 7 insertions(+)
diff --git a/docs/schemas/cputypes.rng b/docs/schemas/cputypes.rng
index 77c8fa783b..056e66e1b4 100644
--- a/docs/schemas/cputypes.rng
+++ b/docs/schemas/cputypes.rng
@@ -250,6 +250,11 @@
<attribute name="target">
<ref name="unsignedInt"/>
</attribute>
+ <optional>
+ <attribute name="cache">
+ <ref name="unsignedInt"/>
+ </attribute>
+ </optional>
<attribute name="type">
<choice>
<value>access</value>
diff --git a/tests/qemuxml2argvdata/numatune-hmat.x86_64-latest.args b/tests/qemuxml2argvdata/numatune-hmat.x86_64-latest.args
index 1ec2e15095..54ab91b09c 100644
--- a/tests/qemuxml2argvdata/numatune-hmat.x86_64-latest.args
+++ b/tests/qemuxml2argvdata/numatune-hmat.x86_64-latest.args
@@ -30,6 +30,7 @@ XDG_CONFIG_HOME=/tmp/lib/domain--1-QEMUGuest/.config \
-numa hmat-lb,initiator=0,target=0,hierarchy=memory,data-type=access-latency,latency=5 \
-numa hmat-lb,initiator=0,target=0,hierarchy=first-level,data-type=access-latency,latency=10 \
-numa hmat-lb,initiator=0,target=0,hierarchy=memory,data-type=access-bandwidth,bandwidth=204800K \
+-numa hmat-lb,initiator=0,target=0,hierarchy=first-level,data-type=access-bandwidth,bandwidth=208896K \
-numa hmat-cache,node-id=0,size=10K,level=1,associativity=direct,policy=write-back,line=8 \
-uuid c7a5fdb2-cdaf-9455-926a-d65c16db1809 \
-display none \
diff --git a/tests/qemuxml2argvdata/numatune-hmat.xml b/tests/qemuxml2argvdata/numatune-hmat.xml
index 51ff3c3425..a64d2ef3e2 100644
--- a/tests/qemuxml2argvdata/numatune-hmat.xml
+++ b/tests/qemuxml2argvdata/numatune-hmat.xml
@@ -30,6 +30,7 @@
<latency initiator='0' target='0' type='access' value='5'/>
<latency initiator='0' target='0' cache='1' type='access' value='10'/>
<bandwidth initiator='0' target='0' type='access' value='204800' unit='KiB'/>
+ <bandwidth initiator='0' target='0' cache='1' type='access' value='208896' unit='KiB'/>
</interconnects>
</numa>
</cpu>
--
2.31.1
3 years, 4 months
[PATCH 2/2] qemu-img: Require -F with -b backing image
by Eric Blake
Back in commit d9f059aa6c (qemu-img: Deprecate use of -b without -F),
we deprecated the ability to create a file with a backing image that
requires qemu to perform format probing. Qemu can still probe older
files for backwards compatibility, but it is time to finish off the
ability to create such images, due to the potential security risk they
present. Update a couple of iotests affected by the change.
Signed-off-by: Eric Blake <eblake(a)redhat.com>
---
docs/system/deprecated.rst | 20 -----------------
docs/system/removed-features.rst | 19 ++++++++++++++++
block.c | 37 ++++++++++----------------------
qemu-img.c | 6 ++++--
tests/qemu-iotests/114 | 18 ++++++++--------
tests/qemu-iotests/114.out | 11 ++++------
tests/qemu-iotests/301 | 4 +---
tests/qemu-iotests/301.out | 16 ++------------
8 files changed, 50 insertions(+), 81 deletions(-)
diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
index 9ec1a9d0e03e..aa6f7d84e583 100644
--- a/docs/system/deprecated.rst
+++ b/docs/system/deprecated.rst
@@ -315,26 +315,6 @@ this CPU is also deprecated.
Related binaries
----------------
-qemu-img backing file without format (since 5.1)
-''''''''''''''''''''''''''''''''''''''''''''''''
-
-The use of ``qemu-img create``, ``qemu-img rebase``, or ``qemu-img
-convert`` to create or modify an image that depends on a backing file
-now recommends that an explicit backing format be provided. This is
-for safety: if QEMU probes a different format than what you thought,
-the data presented to the guest will be corrupt; similarly, presenting
-a raw image to a guest allows a potential security exploit if a future
-probe sees a non-raw image based on guest writes.
-
-To avoid the warning message, or even future refusal to create an
-unsafe image, you must pass ``-o backing_fmt=`` (or the shorthand
-``-F`` during create) to specify the intended backing format. You may
-use ``qemu-img rebase -u`` to retroactively add a backing format to an
-existing image. However, be aware that there are already potential
-security risks to blindly using ``qemu-img info`` to probe the format
-of an untrusted backing image, when deciding what format to add into
-an existing image.
-
Backwards compatibility
-----------------------
diff --git a/docs/system/removed-features.rst b/docs/system/removed-features.rst
index 28b5df757d35..1928d8a483c0 100644
--- a/docs/system/removed-features.rst
+++ b/docs/system/removed-features.rst
@@ -466,6 +466,25 @@ backing chain should be performed with ``qemu-img rebase -u`` either
before or after the remaining changes being performed by amend, as
appropriate.
+qemu-img backing file without format (removed in 6.1)
+'''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+The use of ``qemu-img create``, ``qemu-img rebase``, or ``qemu-img
+convert`` to create or modify an image that depends on a backing file
+now requires that an explicit backing format be provided. This is
+for safety: if QEMU probes a different format than what you thought,
+the data presented to the guest will be corrupt; similarly, presenting
+a raw image to a guest allows a potential security exploit if a future
+probe sees a non-raw image based on guest writes.
+
+To avoid creating unsafe backing chains, you must pass ``-o
+backing_fmt=`` (or the shorthand ``-F`` during create) to specify the
+intended backing format. You may use ``qemu-img rebase -u`` to
+retroactively add a backing format to an existing image. However, be
+aware that there are already potential security risks to blindly using
+``qemu-img info`` to probe the format of an untrusted backing image,
+when deciding what format to add into an existing image.
+
Block devices
-------------
diff --git a/block.c b/block.c
index 874c22c43e3d..931e37a8499b 100644
--- a/block.c
+++ b/block.c
@@ -5033,7 +5033,7 @@ int coroutine_fn bdrv_co_check(BlockDriverState *bs,
* -ENOTSUP - format driver doesn't support changing the backing file
*/
int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
- const char *backing_fmt, bool warn)
+ const char *backing_fmt, bool require)
{
BlockDriver *drv = bs->drv;
int ret;
@@ -5047,10 +5047,8 @@ int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
return -EINVAL;
}
- if (warn && backing_file && !backing_fmt) {
- warn_report("Deprecated use of backing file without explicit "
- "backing format, use of this image requires "
- "potentially unsafe format probing");
+ if (require && backing_file && !backing_fmt) {
+ return -EINVAL;
}
if (drv->bdrv_change_backing_file != NULL) {
@@ -6556,24 +6554,11 @@ void bdrv_img_create(const char *filename, const char *fmt,
goto out;
} else {
if (!backing_fmt) {
- warn_report("Deprecated use of backing file without explicit "
- "backing format (detected format of %s)",
- bs->drv->format_name);
- if (bs->drv != &bdrv_raw) {
- /*
- * A probe of raw deserves the most attention:
- * leaving the backing format out of the image
- * will ensure bs->probed is set (ensuring we
- * don't accidentally commit into the backing
- * file), and allow more spots to warn the users
- * to fix their toolchain when opening this image
- * later. For other images, we can safely record
- * the format that we probed.
- */
- backing_fmt = bs->drv->format_name;
- qemu_opt_set(opts, BLOCK_OPT_BACKING_FMT, backing_fmt,
- NULL);
- }
+ error_setg(&local_err,
+ "Backing file specified without backing format");
+ error_append_hint(&local_err, "Detected format of %s.",
+ bs->drv->format_name);
+ goto out;
}
if (size == -1) {
/* Opened BS, have no size */
@@ -6590,9 +6575,9 @@ void bdrv_img_create(const char *filename, const char *fmt,
}
/* (backing_file && !(flags & BDRV_O_NO_BACKING)) */
} else if (backing_file && !backing_fmt) {
- warn_report("Deprecated use of unopened backing file without "
- "explicit backing format, use of this image requires "
- "potentially unsafe format probing");
+ error_setg(&local_err,
+ "Backing file specified without backing format");
+ goto out;
}
if (size == -1) {
diff --git a/qemu-img.c b/qemu-img.c
index a5993682aad4..3cdfcaa23f6b 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -2505,8 +2505,10 @@ static int img_convert(int argc, char **argv)
if (out_baseimg_param) {
if (!qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT)) {
- warn_report("Deprecated use of backing file without explicit "
- "backing format");
+ error_report("Use of backing file requires explicit "
+ "backing format");
+ ret = -1;
+ goto out;
}
}
diff --git a/tests/qemu-iotests/114 b/tests/qemu-iotests/114
index 43cb0bc6c344..3e30b402bc4c 100755
--- a/tests/qemu-iotests/114
+++ b/tests/qemu-iotests/114
@@ -44,16 +44,16 @@ _supported_os Linux
# qcow2.py does not work too well with external data files
_unsupported_imgopts data_file
-# Intentionally specify backing file without backing format; demonstrate
-# the difference in warning messages when backing file could be probed.
-# Note that only a non-raw probe result will affect the resulting image.
+# Older qemu-img could set up backing file without backing format; modern
+# qemu can't but we can use qcow2.py to simulate older files.
truncate -s $((64 * 1024 * 1024)) "$TEST_IMG.orig"
-_make_test_img -b "$TEST_IMG.orig" 64M
+_make_test_img -b "$TEST_IMG.orig" -F raw 64M
+$PYTHON qcow2.py "$TEST_IMG" del-header-ext 0xE2792ACA
TEST_IMG="$TEST_IMG.base" _make_test_img 64M
$QEMU_IMG convert -O qcow2 -B "$TEST_IMG.orig" "$TEST_IMG.orig" "$TEST_IMG"
-_make_test_img -b "$TEST_IMG.base" 64M
-_make_test_img -u -b "$TEST_IMG.base" 64M
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT 64M
+_make_test_img -u -b "$TEST_IMG.base" -F $IMGFMT 64M
# Set an invalid backing file format
$PYTHON qcow2.py "$TEST_IMG" add-header-ext 0xE2792ACA "foo"
@@ -64,9 +64,9 @@ _img_info
$QEMU_IO -c "open $TEST_IMG" -c "read 0 4k" 2>&1 | _filter_qemu_io | _filter_testdir
$QEMU_IO -c "open -o backing.driver=$IMGFMT $TEST_IMG" -c "read 0 4k" | _filter_qemu_io
-# Rebase the image, to show that omitting backing format triggers a warning,
-# but probing now lets us use the backing file.
-$QEMU_IMG rebase -u -b "$TEST_IMG.base" "$TEST_IMG"
+# Rebase the image, to show that backing format is required.
+$QEMU_IMG rebase -u -b "$TEST_IMG.base" "$TEST_IMG" && echo "unexpected pass"
+$QEMU_IMG rebase -u -b "$TEST_IMG.base" -F $IMGFMT "$TEST_IMG"
$QEMU_IO -c "open $TEST_IMG" -c "read 0 4k" 2>&1 | _filter_qemu_io | _filter_testdir
# success, all done
diff --git a/tests/qemu-iotests/114.out b/tests/qemu-iotests/114.out
index 0a37d20c82a9..172454401257 100644
--- a/tests/qemu-iotests/114.out
+++ b/tests/qemu-iotests/114.out
@@ -1,12 +1,9 @@
QA output created by 114
-qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of raw)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.orig
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.orig backing_fmt=raw
Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
-qemu-img: warning: Deprecated use of backing file without explicit backing format
-qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of IMGFMT)
+qemu-img: Use of backing file requires explicit backing format
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
-qemu-img: warning: Deprecated use of unopened backing file without explicit backing format, use of this image requires potentially unsafe format probing
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
image: TEST_DIR/t.IMGFMT
file format: IMGFMT
virtual size: 64 MiB (67108864 bytes)
@@ -17,7 +14,7 @@ qemu-io: can't open device TEST_DIR/t.qcow2: Could not open backing file: Unknow
no file open, try 'help open'
read 4096/4096 bytes at offset 0
4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-qemu-img: warning: Deprecated use of backing file without explicit backing format, use of this image requires potentially unsafe format probing
+qemu-img: Could not change the backing file to '/home/eblake/qemu/build/tests/qemu-iotests/scratch/t.qcow2.base': Invalid argument
read 4096/4096 bytes at offset 0
4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
*** done
diff --git a/tests/qemu-iotests/301 b/tests/qemu-iotests/301
index 9f943cadbe24..220de1043fa5 100755
--- a/tests/qemu-iotests/301
+++ b/tests/qemu-iotests/301
@@ -3,7 +3,7 @@
#
# Test qcow backing file warnings
#
-# Copyright (C) 2020 Red Hat, Inc.
+# Copyright (C) 2020-2021 Red Hat, Inc.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
@@ -46,7 +46,6 @@ echo "== qcow backed by qcow =="
TEST_IMG="$TEST_IMG.base" _make_test_img $size
_make_test_img -b "$TEST_IMG.base" $size
-_img_info
_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $size
_img_info
@@ -71,7 +70,6 @@ echo "== qcow backed by raw =="
rm "$TEST_IMG.base"
truncate --size=$size "$TEST_IMG.base"
_make_test_img -b "$TEST_IMG.base" $size
-_img_info
_make_test_img -b "$TEST_IMG.base" -F raw $size
_img_info
diff --git a/tests/qemu-iotests/301.out b/tests/qemu-iotests/301.out
index 9004dad6392f..e280658191e1 100644
--- a/tests/qemu-iotests/301.out
+++ b/tests/qemu-iotests/301.out
@@ -2,13 +2,7 @@ QA output created by 301
== qcow backed by qcow ==
Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=33554432
-qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of IMGFMT)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
-image: TEST_DIR/t.IMGFMT
-file format: IMGFMT
-virtual size: 32 MiB (33554432 bytes)
-cluster_size: 512
-backing file: TEST_DIR/t.IMGFMT.base
+qemu-img: TEST_DIR/t.IMGFMT: Backing file specified without backing format
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
image: TEST_DIR/t.IMGFMT
file format: IMGFMT
@@ -36,13 +30,7 @@ cluster_size: 512
backing file: TEST_DIR/t.IMGFMT.base
== qcow backed by raw ==
-qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of raw)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base
-image: TEST_DIR/t.IMGFMT
-file format: IMGFMT
-virtual size: 32 MiB (33554432 bytes)
-cluster_size: 512
-backing file: TEST_DIR/t.IMGFMT.base
+qemu-img: TEST_DIR/t.IMGFMT: Backing file specified without backing format
Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=raw
image: TEST_DIR/t.IMGFMT
file format: IMGFMT
--
2.31.1
3 years, 4 months
Re: [PATCH 0/2] Remove deprecated qemu-img backing file without format
by Eric Blake
On Mon, May 03, 2021 at 04:35:58PM -0500, Eric Blake wrote:
> We've gone enough release cycles without noticeable pushback on our
> intentions, so time to make it harder to create images that can form a
> security hole due to a need for format probing rather than an explicit
> format.
>
> Eric Blake (2):
> qcow2: Prohibit backing file changes in 'qemu-img amend'
> qemu-img: Require -F with -b backing image
Ping.
--
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3266
Virtualization: qemu.org | libvirt.org
3 years, 4 months
