From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:46226) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1R8zfa-0003Rb-Ck for qemu-devel@nongnu.org; Wed, 28 Sep 2011 15:19:51 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1R8zfZ-0002J9-6J for qemu-devel@nongnu.org; Wed, 28 Sep 2011 15:19:50 -0400 Received: from e5.ny.us.ibm.com ([32.97.182.145]:35350) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1R8zfZ-0002Hv-3e for qemu-devel@nongnu.org; Wed, 28 Sep 2011 15:19:49 -0400 Received: from d01relay05.pok.ibm.com (d01relay05.pok.ibm.com [9.56.227.237]) by e5.ny.us.ibm.com (8.14.4/8.13.1) with ESMTP id p8SImisX015151 for ; Wed, 28 Sep 2011 14:48:44 -0400 Received: from d01av02.pok.ibm.com (d01av02.pok.ibm.com [9.56.224.216]) by d01relay05.pok.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id p8SJJjxs174954 for ; Wed, 28 Sep 2011 15:19:45 -0400 Received: from d01av02.pok.ibm.com (loopback [127.0.0.1]) by d01av02.pok.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id p8SJJjuQ004801 for ; Wed, 28 Sep 2011 16:19:45 -0300 Message-ID: <4E837351.7060309@linux.vnet.ibm.com> Date: Wed, 28 Sep 2011 15:19:45 -0400 From: Stefan Berger MIME-Version: 1.0 References: <20110915122842.GA6302@redhat.com> <4E720CA9.9050208@linux.vnet.ibm.com> <20110916144443.GB20933@redhat.com> <4E737D70.8030801@linux.vnet.ibm.com> <20110917192857.GB6127@redhat.com> <4E776C2A.5020006@linux.vnet.ibm.com> <20110919190412.GA9062@redhat.com> <4E7A9305.909@linux.vnet.ibm.com> <20110922063744.GB29819@redhat.com> <4E8341C3.8000104@linux.vnet.ibm.com> <20110928155031.GV21102@redhat.com> In-Reply-To: <20110928155031.GV21102@redhat.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] blobstore disk format (was Re: Design of the blobstore) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Daniel P. Berrange" , Anthony Liguori , "Michael S. Tsirkin" Cc: Markus Armbruster , qemu-devel@nongnu.org On 09/28/2011 11:50 AM, Daniel P. Berrange wrote: > On Wed, Sep 28, 2011 at 11:48:19AM -0400, Stefan Berger wrote: >> On 09/22/2011 02:37 AM, Michael S. Tsirkin wrote: >>> >>> I'm guessing that if we find a correct ber structure in the file, this >>> most likely means the key is correct. >> [I still would add at least a CRC32 (or maybe even a SHA1) for >> detection of corruption of the ASN.1 encoded blob without having to >> hunt the data through a ASN.1 decoder.] >> >> If we now say that data should be encryptable even if QCoW2 wasn't >> used, then is a command line option >> >> -nvram id=,key=,... >> >> something we should support to make the key applicable to the whole NVRAM? > Try to avoid requiring secret keys to be set on the command line... > At least allow setting them via a monitor command > Hm, this brings me back to the previous problem of the ordering of things that ended up being problematic: In the case of encrypted QCoW2 the monitor queries for the password when the use types 'c' for continue. That happens *after* device's 'init' function was called and also *after* their 'reset' handler was invoked, so not being able to decrypt encrypted state blobs and not being able to feed devices with their persistent state even until the 'reset' handler was invoked. The password comes quite late. The monitor reacts to key typing, which in turn is handled in the main_loop() in vl.c. So, the solution could be that each NVRAM client also registers its reset handler (along with the DeviceState pointer). Each NVRAM client would have to be written in such a way that it ignores previous failed attempts to read its state due to the key coming so late and once the NVRAM has the key it invokes the reset handlers again, which now trigger the reading of the state in the NVRAM that now can be decrypted. Does this sound 'sane' or more like a 'hack' ? Stefan > Daniel