2014-02-21 19:24:08 +04:00
|
|
|
QA output created by 082
|
|
|
|
|
|
|
|
|
|
=== create: Options specified more than once ===
|
|
|
|
|
|
|
|
|
|
Testing: create -f foo -f qcow2 TEST_DIR/t.qcow2 128M
|
2017-06-23 19:24:06 +03:00
|
|
|
Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=134217728 cluster_size=65536 lazy_refcounts=off refcount_bits=16
|
2014-09-30 23:31:27 +04:00
|
|
|
image: TEST_DIR/t.IMGFMT
|
|
|
|
|
file format: IMGFMT
|
2014-02-21 19:24:08 +04:00
|
|
|
virtual size: 128M (134217728 bytes)
|
|
|
|
|
cluster_size: 65536
|
|
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o cluster_size=4k -o lazy_refcounts=on TEST_DIR/t.qcow2 128M
|
2017-06-23 19:24:06 +03:00
|
|
|
Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=134217728 cluster_size=4096 lazy_refcounts=on refcount_bits=16
|
2014-11-27 19:28:01 +03:00
|
|
|
image: TEST_DIR/t.IMGFMT
|
|
|
|
|
file format: IMGFMT
|
2014-02-21 19:24:08 +04:00
|
|
|
virtual size: 128M (134217728 bytes)
|
|
|
|
|
cluster_size: 4096
|
|
|
|
|
Format specific information:
|
|
|
|
|
compat: 1.1
|
|
|
|
|
lazy refcounts: true
|
2015-02-10 23:28:44 +03:00
|
|
|
refcount bits: 16
|
2014-09-30 23:31:28 +04:00
|
|
|
corrupt: false
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o cluster_size=4k -o lazy_refcounts=on -o cluster_size=8k TEST_DIR/t.qcow2 128M
|
2017-06-23 19:24:06 +03:00
|
|
|
Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=134217728 cluster_size=8192 lazy_refcounts=on refcount_bits=16
|
2014-11-27 19:28:01 +03:00
|
|
|
image: TEST_DIR/t.IMGFMT
|
|
|
|
|
file format: IMGFMT
|
2014-02-21 19:24:08 +04:00
|
|
|
virtual size: 128M (134217728 bytes)
|
|
|
|
|
cluster_size: 8192
|
|
|
|
|
Format specific information:
|
|
|
|
|
compat: 1.1
|
|
|
|
|
lazy refcounts: true
|
2015-02-10 23:28:44 +03:00
|
|
|
refcount bits: 16
|
2014-09-30 23:31:28 +04:00
|
|
|
corrupt: false
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o cluster_size=4k,cluster_size=8k TEST_DIR/t.qcow2 128M
|
2017-06-23 19:24:06 +03:00
|
|
|
Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=134217728 cluster_size=8192 lazy_refcounts=off refcount_bits=16
|
2014-09-30 23:31:27 +04:00
|
|
|
image: TEST_DIR/t.IMGFMT
|
|
|
|
|
file format: IMGFMT
|
2014-02-21 19:24:08 +04:00
|
|
|
virtual size: 128M (134217728 bytes)
|
|
|
|
|
cluster_size: 8192
|
|
|
|
|
|
|
|
|
|
=== create: help for -o ===
|
|
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o help TEST_DIR/t.qcow2 128M
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o ? TEST_DIR/t.qcow2 128M
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o cluster_size=4k,help TEST_DIR/t.qcow2 128M
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o cluster_size=4k,? TEST_DIR/t.qcow2 128M
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o help,cluster_size=4k TEST_DIR/t.qcow2 128M
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o ?,cluster_size=4k TEST_DIR/t.qcow2 128M
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o cluster_size=4k -o help TEST_DIR/t.qcow2 128M
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o cluster_size=4k -o ? TEST_DIR/t.qcow2 128M
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o backing_file=TEST_DIR/t.qcow2,,help TEST_DIR/t.qcow2 128M
|
2017-06-23 19:24:06 +03:00
|
|
|
Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=134217728 backing_file=TEST_DIR/t.qcow2,,help cluster_size=65536 lazy_refcounts=off refcount_bits=16
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o backing_file=TEST_DIR/t.qcow2,,? TEST_DIR/t.qcow2 128M
|
2017-06-23 19:24:06 +03:00
|
|
|
Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=134217728 backing_file=TEST_DIR/t.qcow2,,? cluster_size=65536 lazy_refcounts=off refcount_bits=16
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o backing_file=TEST_DIR/t.qcow2, -o help TEST_DIR/t.qcow2 128M
|
|
|
|
|
qemu-img: Invalid option list: backing_file=TEST_DIR/t.qcow2,
|
|
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o backing_file=TEST_DIR/t.qcow2 -o ,help TEST_DIR/t.qcow2 128M
|
|
|
|
|
qemu-img: Invalid option list: ,help
|
|
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o backing_file=TEST_DIR/t.qcow2 -o ,, -o help TEST_DIR/t.qcow2 128M
|
|
|
|
|
qemu-img: Invalid option list: ,,
|
|
|
|
|
|
|
|
|
|
Testing: create -f qcow2 -o help
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: create -o help
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
|
|
|
|
|
=== convert: Options specified more than once ===
|
|
|
|
|
|
|
|
|
|
Testing: create -f qcow2 TEST_DIR/t.qcow2 128M
|
2017-06-23 19:24:06 +03:00
|
|
|
Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=134217728 cluster_size=65536 lazy_refcounts=off refcount_bits=16
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: convert -f foo -f qcow2 TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
2014-09-30 23:31:27 +04:00
|
|
|
image: TEST_DIR/t.IMGFMT.base
|
2014-02-21 19:24:08 +04:00
|
|
|
file format: raw
|
|
|
|
|
virtual size: 128M (134217728 bytes)
|
|
|
|
|
|
|
|
|
|
Testing: convert -O foo -O qcow2 TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
2014-09-30 23:31:27 +04:00
|
|
|
image: TEST_DIR/t.IMGFMT.base
|
|
|
|
|
file format: IMGFMT
|
2014-02-21 19:24:08 +04:00
|
|
|
virtual size: 128M (134217728 bytes)
|
|
|
|
|
cluster_size: 65536
|
|
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o cluster_size=4k -o lazy_refcounts=on TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
2014-11-27 19:28:01 +03:00
|
|
|
image: TEST_DIR/t.IMGFMT.base
|
|
|
|
|
file format: IMGFMT
|
2014-02-21 19:24:08 +04:00
|
|
|
virtual size: 128M (134217728 bytes)
|
|
|
|
|
cluster_size: 4096
|
|
|
|
|
Format specific information:
|
|
|
|
|
compat: 1.1
|
|
|
|
|
lazy refcounts: true
|
2015-02-10 23:28:44 +03:00
|
|
|
refcount bits: 16
|
2014-09-30 23:31:28 +04:00
|
|
|
corrupt: false
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o cluster_size=4k -o lazy_refcounts=on -o cluster_size=8k TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
2014-11-27 19:28:01 +03:00
|
|
|
image: TEST_DIR/t.IMGFMT.base
|
|
|
|
|
file format: IMGFMT
|
2014-02-21 19:24:08 +04:00
|
|
|
virtual size: 128M (134217728 bytes)
|
|
|
|
|
cluster_size: 8192
|
|
|
|
|
Format specific information:
|
|
|
|
|
compat: 1.1
|
|
|
|
|
lazy refcounts: true
|
2015-02-10 23:28:44 +03:00
|
|
|
refcount bits: 16
|
2014-09-30 23:31:28 +04:00
|
|
|
corrupt: false
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o cluster_size=4k,cluster_size=8k TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
2014-09-30 23:31:27 +04:00
|
|
|
image: TEST_DIR/t.IMGFMT.base
|
|
|
|
|
file format: IMGFMT
|
2014-02-21 19:24:08 +04:00
|
|
|
virtual size: 128M (134217728 bytes)
|
|
|
|
|
cluster_size: 8192
|
|
|
|
|
|
|
|
|
|
=== convert: help for -o ===
|
|
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o help TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o ? TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o cluster_size=4k,help TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o cluster_size=4k,? TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o help,cluster_size=4k TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o ?,cluster_size=4k TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o cluster_size=4k -o help TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o cluster_size=4k -o ? TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o backing_file=TEST_DIR/t.qcow2,,help TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
|
|
|
|
qemu-img: Could not open 'TEST_DIR/t.qcow2.base': Could not open backing file: Could not open 'TEST_DIR/t.qcow2,help': No such file or directory
|
|
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o backing_file=TEST_DIR/t.qcow2,,? TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
|
|
|
|
qemu-img: Could not open 'TEST_DIR/t.qcow2.base': Could not open backing file: Could not open 'TEST_DIR/t.qcow2,?': No such file or directory
|
|
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o backing_file=TEST_DIR/t.qcow2, -o help TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
|
|
|
|
qemu-img: Invalid option list: backing_file=TEST_DIR/t.qcow2,
|
|
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o backing_file=TEST_DIR/t.qcow2 -o ,help TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
|
|
|
|
qemu-img: Invalid option list: ,help
|
|
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o backing_file=TEST_DIR/t.qcow2 -o ,, -o help TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
|
|
|
|
|
qemu-img: Invalid option list: ,,
|
|
|
|
|
|
|
|
|
|
Testing: convert -O qcow2 -o help
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: convert -o help
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
|
|
|
|
|
=== amend: Options specified more than once ===
|
|
|
|
|
|
|
|
|
|
Testing: amend -f foo -f qcow2 -o lazy_refcounts=on TEST_DIR/t.qcow2
|
2014-11-27 19:28:01 +03:00
|
|
|
image: TEST_DIR/t.IMGFMT
|
|
|
|
|
file format: IMGFMT
|
2014-02-21 19:24:08 +04:00
|
|
|
virtual size: 128M (134217728 bytes)
|
|
|
|
|
cluster_size: 65536
|
|
|
|
|
Format specific information:
|
|
|
|
|
compat: 1.1
|
|
|
|
|
lazy refcounts: true
|
2015-02-10 23:28:44 +03:00
|
|
|
refcount bits: 16
|
2014-09-30 23:31:28 +04:00
|
|
|
corrupt: false
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o size=130M -o lazy_refcounts=off TEST_DIR/t.qcow2
|
2014-11-27 19:28:01 +03:00
|
|
|
image: TEST_DIR/t.IMGFMT
|
|
|
|
|
file format: IMGFMT
|
2014-02-21 19:24:08 +04:00
|
|
|
virtual size: 130M (136314880 bytes)
|
|
|
|
|
cluster_size: 65536
|
|
|
|
|
Format specific information:
|
|
|
|
|
compat: 1.1
|
|
|
|
|
lazy refcounts: false
|
2015-02-10 23:28:44 +03:00
|
|
|
refcount bits: 16
|
2014-09-30 23:31:28 +04:00
|
|
|
corrupt: false
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o size=8M -o lazy_refcounts=on -o size=132M TEST_DIR/t.qcow2
|
2014-11-27 19:28:01 +03:00
|
|
|
image: TEST_DIR/t.IMGFMT
|
|
|
|
|
file format: IMGFMT
|
2014-02-21 19:24:08 +04:00
|
|
|
virtual size: 132M (138412032 bytes)
|
|
|
|
|
cluster_size: 65536
|
|
|
|
|
Format specific information:
|
|
|
|
|
compat: 1.1
|
|
|
|
|
lazy refcounts: true
|
2015-02-10 23:28:44 +03:00
|
|
|
refcount bits: 16
|
2014-09-30 23:31:28 +04:00
|
|
|
corrupt: false
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o size=4M,size=148M TEST_DIR/t.qcow2
|
2014-09-30 23:31:27 +04:00
|
|
|
image: TEST_DIR/t.IMGFMT
|
|
|
|
|
file format: IMGFMT
|
2014-02-21 19:24:08 +04:00
|
|
|
virtual size: 148M (155189248 bytes)
|
|
|
|
|
cluster_size: 65536
|
|
|
|
|
|
|
|
|
|
=== amend: help for -o ===
|
|
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o help TEST_DIR/t.qcow2
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o ? TEST_DIR/t.qcow2
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o cluster_size=4k,help TEST_DIR/t.qcow2
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o cluster_size=4k,? TEST_DIR/t.qcow2
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o help,cluster_size=4k TEST_DIR/t.qcow2
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o ?,cluster_size=4k TEST_DIR/t.qcow2
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o cluster_size=4k -o help TEST_DIR/t.qcow2
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o cluster_size=4k -o ? TEST_DIR/t.qcow2
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
qemu-img create: add 'nocow' option
Add 'nocow' option so that users could have a chance to set NOCOW flag to
newly created files. It's useful on btrfs file system to enhance performance.
Btrfs has low performance when hosting VM images, even more when the guest
in those VM are also using btrfs as file system. One way to mitigate this bad
performance is to turn off COW attributes on VM files. Generally, there are
two ways to turn off NOCOW on btrfs: a) by mounting fs with nodatacow, then
all newly created files will be NOCOW. b) per file. Add the NOCOW file
attribute. It could only be done to empty or new files.
This patch tries the second way, according to the option, it could add NOCOW
per file.
For most block drivers, since the create file step is in raw-posix.c, so we
can do setting NOCOW flag ioctl in raw-posix.c only.
But there are some exceptions, like block/vpc.c and block/vdi.c, they are
creating file by calling qemu_open directly. For them, do the same setting
NOCOW flag ioctl work in them separately.
[Fixed up 082.out due to the new 'nocow' creation option
--Stefan]
Signed-off-by: Chunyan Liu <cyliu@suse.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
2014-06-30 10:29:58 +04:00
|
|
|
nocow Turn off copy-on-write (valid only on btrfs)
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o backing_file=TEST_DIR/t.qcow2,,help TEST_DIR/t.qcow2
|
|
|
|
|
|
|
|
|
|
Testing: rebase -u -b -f qcow2 TEST_DIR/t.qcow2
|
|
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o backing_file=TEST_DIR/t.qcow2,,? TEST_DIR/t.qcow2
|
|
|
|
|
|
|
|
|
|
Testing: rebase -u -b -f qcow2 TEST_DIR/t.qcow2
|
|
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o backing_file=TEST_DIR/t.qcow2, -o help TEST_DIR/t.qcow2
|
|
|
|
|
qemu-img: Invalid option list: backing_file=TEST_DIR/t.qcow2,
|
|
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o backing_file=TEST_DIR/t.qcow2 -o ,help TEST_DIR/t.qcow2
|
|
|
|
|
qemu-img: Invalid option list: ,help
|
|
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o backing_file=TEST_DIR/t.qcow2 -o ,, -o help TEST_DIR/t.qcow2
|
|
|
|
|
qemu-img: Invalid option list: ,,
|
|
|
|
|
|
|
|
|
|
Testing: amend -f qcow2 -o help
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
compat Compatibility level (0.10 or 1.1)
|
|
|
|
|
backing_file File name of a base image
|
|
|
|
|
backing_fmt Image format of the base image
|
2017-06-23 19:24:06 +03:00
|
|
|
encryption Encrypt the image with format 'aes'. (Deprecated in favor of encrypt.format=aes)
|
qcow2: add support for LUKS encryption format
This adds support for using LUKS as an encryption format
with the qcow2 file, using the new encrypt.format parameter
to request "luks" format. e.g.
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encrypt.format=luks,encrypt.key-secret=sec0 \
test.qcow2 10G
The legacy "encryption=on" parameter still results in
creation of the old qcow2 AES format (and is equivalent
to the new 'encryption-format=aes'). e.g. the following are
equivalent:
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption=on,encrypt.key-secret=sec0 \
test.qcow2 10G
# qemu-img create --object secret,data=123456,id=sec0 \
-f qcow2 -o encryption-format=aes,encrypt.key-secret=sec0 \
test.qcow2 10G
With the LUKS format it is necessary to store the LUKS
partition header and key material in the QCow2 file. This
data can be many MB in size, so cannot go into the QCow2
header region directly. Thus the spec defines a FDE
(Full Disk Encryption) header extension that specifies
the offset of a set of clusters to hold the FDE headers,
as well as the length of that region. The LUKS header is
thus stored in these extra allocated clusters before the
main image payload.
Aside from all the cryptographic differences implied by
use of the LUKS format, there is one further key difference
between the use of legacy AES and LUKS encryption in qcow2.
For LUKS, the initialiazation vectors are generated using
the host physical sector as the input, rather than the
guest virtual sector. This guarantees unique initialization
vectors for all sectors when qcow2 internal snapshots are
used, thus giving stronger protection against watermarking
attacks.
Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
Message-id: 20170623162419.26068-14-berrange@redhat.com
Reviewed-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Max Reitz <mreitz@redhat.com>
2017-06-23 19:24:12 +03:00
|
|
|
encrypt.format Encrypt the image, format choices: 'aes', 'luks'
|
|
|
|
|
encrypt.key-secret ID of secret providing qcow AES key or LUKS passphrase
|
|
|
|
|
encrypt.cipher-alg Name of encryption cipher algorithm
|
|
|
|
|
encrypt.cipher-mode Name of encryption cipher mode
|
|
|
|
|
encrypt.ivgen-alg Name of IV generator algorithm
|
|
|
|
|
encrypt.ivgen-hash-alg Name of IV generator hash algorithm
|
|
|
|
|
encrypt.hash-alg Name of encryption hash algorithm
|
|
|
|
|
encrypt.iter-time Time to spend in PBKDF in milliseconds
|
2014-02-21 19:24:08 +04:00
|
|
|
cluster_size qcow2 cluster size
|
2014-09-10 13:05:49 +04:00
|
|
|
preallocation Preallocation mode (allowed values: off, metadata, falloc, full)
|
2014-02-21 19:24:08 +04:00
|
|
|
lazy_refcounts Postpone refcount updates
|
2015-02-19 01:40:49 +03:00
|
|
|
refcount_bits Width of a reference count entry in bits
|
2014-02-21 19:24:08 +04:00
|
|
|
|
|
|
|
|
Testing: convert -o help
|
|
|
|
|
Supported options:
|
|
|
|
|
size Virtual disk size
|
|
|
|
|
*** done
|