qemu-block
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: Qemu Dirty Bitmap backup to encrypted target


From: Craig Mull
Subject: RE: Qemu Dirty Bitmap backup to encrypted target
Date: Wed, 2 Oct 2019 11:35:15 +0000

Thanks to all who responded on this thread.
 
This bugzills appears to outline a procedure we can try .. https://bugzilla.redhat.com/show_bug.cgi?id=1662412

_______________________________
Craig Mull
VPC Storage Architect
address@hidden
 
 
 
----- Original message -----
From: Peter Krempa <address@hidden>
Sent by: "Qemu-devel" <qemu-devel-bounces+cmull=address@hidden>
To: Kevin Wolf <address@hidden>
Cc: Craig Mull <address@hidden>, John Snow <address@hidden>, address@hidden, Qemu-block <address@hidden>, Leo Luan <address@hidden>
Subject: [EXTERNAL] Re: Qemu Dirty Bitmap backup to encrypted target
Date: Tue, Oct 1, 2019 6:45 AM
 
On Tue, Oct 01, 2019 at 10:45:53 +0200, Kevin Wolf wrote:
> Am 01.10.2019 um 02:24 hat John Snow geschrieben:
> >
> >
> > On 9/30/19 3:26 PM, Craig Mull wrote:
> > > How can have QEMU backup write the output to an encrypted target?
> > >  
> > > Blocks in the dirty bitmap are unencrypted, and as such when I write
> > > them with QEMU backup they are written to the target unencrypted.
> > >  
> > > I've experimented with providing a json string as the target but with no
> > > luck.
> > >  
> > >
> > > transaction='{ "execute": "transaction", 
> > >
> > >   "arguments": { 
> > >
> > >     "actions": [
> > >
> > >       {"type": "block-dirty-bitmap-add", 
> > >
> > >        "data": {"node": "drive-virtio-disk0", "granularity": 2097152,
> > > "name": "mybitmap"} },
> > >
> > >       {"type": "drive-backup",
> > >
> > >        "data": {"device": "drive-virtio-disk0", "target":
> > > "json:{\"encrypt.format\": \"luks\", \"encrypt.key-secret\":
> > > \"virtio-disk0-luks-secret0\", \"driver\": \"qcow2\", \"file\":
> > > {\"driver\": \"file\", \"filename\": \"/tmp/target-encrypt-test.qcow2\"}}",
> > >
> > >                 "sync": "full", "format": "qcow2"} } 
> > >
> > >     ] 
> > >
> > >   } 
> > >
> > > }'
> > >
> > >  
> > >
> > > virsh -c qemu:///system qemu-monitor-command --pretty 28 $transaction
> > >
> > >  
> > >
> > > {
> > >
> > >   "id": "libvirt-45",
> > >
> > >   "error": {
> > >
> > >     "class": "GenericError",
> > >
> > >     "desc": "Unknown protocol 'json'"
> > >
> > >   }
> > >
> > > }
> > >
> > >
> >
> > I'll be honest, I'm not very good at the json specifications and don't
> > really know when they're appropriate to use. At the basic level,
> > drive-backup expects a filename. Sometimes the filename can get fancy,
> > but... I stay away from that.
> >
> > Try using qmp-blockdev-create to create the target node instead, and
> > then using blockdev-backup to backup to that target.
>
> As the actual invocation is a virsh command, I think this is more of a
> libvirt question than a QEMU one.

The above virsh command is a direct (unsupported/experimental) command
passthrough to qemu, thus the syntax is identical to raw QMP.

You must use blockdev-backup as outlined above along with any management
necessary for adding the devices previously. Obviously this may
desynchronize state with libvirt.

> I suspect that libvirt won't support this without -blockdev support
> (which will enable blockdev-backup instead of drive-backup), but even
> then libvirt might not even offer an API for an encrypted target. Not
> sure, though, so CCing Peter.

The current state is that libvirt will support backup only with
-blockdev. In that case everything including encrypted images should be
supported same way as we (will [1]) support them with snapshots or
normal disks.

This is currently being worked on.

[1] All the code for blockdev is in but it's not enabled yet as we are
waiting for the possibility to detect the fix for 'savevm' done
recently. -blockdev will be supported with qemu-4.2.

 
 


reply via email to

[Prev in Thread] Current Thread [Next in Thread]