> On 13 Jul 2026, at 6:49 PM, Peter Krempa <[email protected]> wrote: > > !-------------------------------------------------------------------| > CAUTION: External Email > > |-------------------------------------------------------------------! > > On Tue, Jun 23, 2026 at 06:26:02 +0000, Abhisek Panda wrote: >> Append 'x509' to the function identifiers managing the tls-creds-x509 >> objects. This defines the functions' scope and prevents naming >> conflicts with the introduction of functions related to tls-creds-psk >> in subsequent commits. >> >> Additionally, update the TLS x509 object alias from "obj%s_tls0" to >> "obj%s_tlsx509_0" along with relevant testcase changes. >> >> Suggested-by: Tejus GK <[email protected]> >> Signed-off-by: Abhisek Panda <[email protected]> >> --- >> src/qemu/qemu_alias.c | 8 +- >> src/qemu/qemu_alias.h | 2 +- >> src/qemu/qemu_backup.c | 2 +- >> src/qemu/qemu_command.c | 2 +- >> src/qemu/qemu_domain.c | 2 +- >> src/qemu/qemu_hotplug.c | 76 +++++++++---------- >> src/qemu/qemu_hotplug.h | 26 +++---- >> src/qemu/qemu_migration.c | 24 +++--- >> src/qemu/qemu_migration_params.c | 44 +++++------ >> src/qemu/qemu_migration_params.h | 14 ++-- >> src/qemu/qemu_postparse.c | 2 +- >> tests/qemumigparamsdata/tls-enabled.json | 2 +- >> tests/qemumigparamsdata/tls-enabled.reply | 2 +- >> tests/qemumigparamsdata/tls-enabled.xml | 2 +- >> tests/qemumigparamsdata/tls-hostname.json | 2 +- >> tests/qemumigparamsdata/tls-hostname.reply | 2 +- >> tests/qemumigparamsdata/tls-hostname.xml | 2 +- >> tests/qemumonitorjsontest.c | 4 +- >> tests/qemustatusxml2xmldata/upgrade-out.xml | 2 +- >> .../chardev-backends-json.x86_64-9.1.0.args | 8 +- >> .../chardev-backends-json.x86_64-latest.args | 8 +- >> .../chardev-backends.x86_64-9.1.0.args | 8 +- >> .../chardev-backends.x86_64-latest.args | 8 +- >> ...rk-tlsx509-nbd-hostname.x86_64-latest.args | 6 +- >> ...isk-network-tlsx509-nbd.x86_64-latest.args | 6 +- >> ...-tlsx509-chardev-verify.x86_64-latest.args | 4 +- >> ...ial-tcp-tlsx509-chardev.x86_64-latest.args | 4 +- >> ...-tlsx509-secret-chardev.x86_64-latest.args | 4 +- >> 28 files changed, 138 insertions(+), 138 deletions(-) >> >> diff --git a/src/qemu/qemu_alias.c b/src/qemu/qemu_alias.c >> index 400ce73283..b41794a5fa 100644 >> --- a/src/qemu/qemu_alias.c >> +++ b/src/qemu/qemu_alias.c >> @@ -872,15 +872,15 @@ qemuAliasForSecret(const char *parentalias, >> return g_strdup_printf("%s-secret%zu", parentalias, secret_idx); >> } >> >> -/* qemuAliasTLSObjFromSrcAlias >> +/* qemuAliasTLSx509ObjFromSrcAlias >> * @srcAlias: Pointer to a source alias string >> * >> - * Generate and return a string to be used as the TLS object alias >> + * Generate and return a string to be used as the TLS X.509 object alias >> */ >> char * >> -qemuAliasTLSObjFromSrcAlias(const char *srcAlias) >> +qemuAliasTLSx509ObjFromSrcAlias(const char *srcAlias) >> { >> - return g_strdup_printf("obj%s_tls0", srcAlias); >> + return g_strdup_printf("obj%s_tlsx509_0", srcAlias); >> } > > Since there is only one TLS object possible I don't see a reason for > changing this. Additionally > > >> diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c >> index 5be567b510..d2add3f656 100644 >> --- a/src/qemu/qemu_hotplug.c >> +++ b/src/qemu/qemu_hotplug.c >> @@ -1702,12 +1702,12 @@ void >> qemuDomainDelTLSObjects(virDomainObj *vm, >> virDomainAsyncJob asyncJob, >> const char *secAlias, >> - const char *tlsAlias) >> + const char *tlsx509Alias) >> { >> qemuDomainObjPrivate *priv = vm->privateData; >> virErrorPtr orig_err; >> >> - if (!tlsAlias && !secAlias) >> + if (!tlsx509Alias && !secAlias) >> return; >> >> virErrorPreserveLast(&orig_err); >> @@ -1715,8 +1715,8 @@ qemuDomainDelTLSObjects(virDomainObj *vm, >> if (qemuDomainObjEnterMonitorAsync(vm, asyncJob) < 0) >> goto cleanup; >> >> - if (tlsAlias) >> - ignore_value(qemuMonitorDelObject(priv->mon, tlsAlias, false)); >> + if (tlsx509Alias) >> + ignore_value(qemuMonitorDelObject(priv->mon, tlsx509Alias, false)); >> >> if (secAlias) >> ignore_value(qemuMonitorDelObject(priv->mon, secAlias, false)); > > [...] > > >> @@ -1766,14 +1766,14 @@ qemuDomainAddTLSObjects(virDomainObj *vm, >> >> >> int >> -qemuDomainGetTLSObjects(qemuDomainSecretInfo *secinfo, >> - const char *tlsCertdir, >> - bool tlsListen, >> - bool tlsVerify, >> - const char *tlsPriority, >> - const char *alias, >> - virJSONValue **tlsProps, >> - virJSONValue **secProps) >> +qemuDomainGetTLSx509Objects(qemuDomainSecretInfo *secinfo, >> + const char *tlsCertdir, >> + bool tlsListen, >> + bool tlsVerify, >> + const char *tlsPriority, >> + const char *alias, >> + virJSONValue **tlsProps, >> + virJSONValue **secProps) >> { >> const char *secAlias = NULL; >> >> @@ -1798,7 +1798,7 @@ qemuDomainAddChardevTLSObjects(virQEMUDriver *driver, >> virDomainChrSourceDef *dev, >> char *devAlias, >> char *charAlias, >> - char **tlsAlias, >> + char **tlsx509Alias, >> const char **secAlias) >> { >> g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver); >> @@ -1821,21 +1821,21 @@ qemuDomainAddChardevTLSObjects(virQEMUDriver *driver, >> if (secinfo) >> *secAlias = secinfo->alias; >> >> - if (!(*tlsAlias = qemuAliasTLSObjFromSrcAlias(charAlias))) >> + if (!(*tlsx509Alias = qemuAliasTLSx509ObjFromSrcAlias(charAlias))) >> return -1; >> >> - if (qemuDomainGetTLSObjects(secinfo, >> - cfg->chardevTLSx509certdir, >> - dev->data.tcp.listen, >> - cfg->chardevTLSx509verify, >> - cfg->chardevTLSpriority, >> - *tlsAlias, &tlsProps, &secProps) < 0) >> + if (qemuDomainGetTLSx509Objects(secinfo, >> + cfg->chardevTLSx509certdir, >> + dev->data.tcp.listen, >> + cfg->chardevTLSx509verify, >> + cfg->chardevTLSpriority, >> + *tlsx509Alias, &tlsProps, &secProps) < >> 0) >> return -1; >> >> dev->data.tcp.tlscreds = true; >> >> - if (qemuDomainAddTLSObjects(vm, VIR_ASYNC_JOB_NONE, >> - &secProps, &tlsProps) < 0) >> + if (qemuDomainAddTLSx509Objects(vm, VIR_ASYNC_JOB_NONE, >> + &secProps, &tlsProps) < 0) >> return -1; >> >> return 0; >> @@ -1850,7 +1850,7 @@ qemuDomainDelChardevTLSObjects(virQEMUDriver *driver, >> { >> g_autoptr(virQEMUDriverConfig) cfg = virQEMUDriverGetConfig(driver); >> qemuDomainObjPrivate *priv = vm->privateData; >> - g_autofree char *tlsAlias = NULL; >> + g_autofree char *tlsx509Alias = NULL; >> g_autofree char *secAlias = NULL; >> >> if (dev->type != VIR_DOMAIN_CHR_TYPE_TCP || >> @@ -1858,7 +1858,7 @@ qemuDomainDelChardevTLSObjects(virQEMUDriver *driver, >> return 0; >> } >> >> - if (!(tlsAlias = qemuAliasTLSObjFromSrcAlias(inAlias))) >> + if (!(tlsx509Alias = qemuAliasTLSx509ObjFromSrcAlias(inAlias))) >> return -1; > > qemuDomainDelChardevTLSObjects is used by qemuDomainRemoveChrDevice, > qemuDomainRemoveRNGDevice, qemuDomainRemoveRedirdevDevice. > > None of those seem to store the alias of the TLS backend in the status > XML so unplug of those devices would fail for upgrade of existing VMS > apfter upgrade of libvirt. > > You'll need to preserve the alias in status XML, add code to restore it > and only then you can change the alias itself so that existing VMs keep > working. > > Or just don't change the alias. > > > >> >> /* Best shot at this as the secinfo is destroyed after process launch >> @@ -1871,7 +1871,7 @@ qemuDomainDelChardevTLSObjects(virQEMUDriver *driver, >> >> qemuDomainObjEnterMonitor(vm); >> >> - ignore_value(qemuMonitorDelObject(priv->mon, tlsAlias, false)); >> + ignore_value(qemuMonitorDelObject(priv->mon, tlsx509Alias, false)); >> if (secAlias) >> ignore_value(qemuMonitorDelObject(priv->mon, secAlias, false)); >> > [...] > > >> diff --git a/src/qemu/qemu_migration_params.c >> b/src/qemu/qemu_migration_params.c >> index dd47516742..c91ae89c9b 100644 >> --- a/src/qemu/qemu_migration_params.c >> +++ b/src/qemu/qemu_migration_params.c > > [...] > > >> @@ -1290,7 +1290,7 @@ qemuMigrationParamsResetTLS(virDomainObj *vm, >> qemuMigrationParams *origParams, >> unsigned int apiFlags) >> { >> - g_autofree char *tlsAlias = NULL; >> + g_autofree char *tlsx509Alias = NULL; >> g_autofree char *secAlias = NULL; >> >> /* There's nothing to do if QEMU does not support TLS migration or we >> were >> @@ -1299,10 +1299,10 @@ qemuMigrationParamsResetTLS(virDomainObj *vm, >> !(apiFlags & VIR_MIGRATE_TLS)) >> return; >> >> - tlsAlias = qemuAliasTLSObjFromSrcAlias(QEMU_MIGRATION_TLS_ALIAS_BASE); >> + tlsx509Alias = >> qemuAliasTLSx509ObjFromSrcAlias(QEMU_MIGRATION_TLS_ALIAS_BASE); > > Since you've changed the alias ... > > >> secAlias = qemuAliasForSecret(QEMU_MIGRATION_TLS_ALIAS_BASE, NULL, 0); >> >> - qemuDomainDelTLSObjects(vm, asyncJob, secAlias, tlsAlias); >> + qemuDomainDelTLSObjects(vm, asyncJob, secAlias, tlsx509Alias); > > ... this will break on existing VMs after upgrade of qemu. You'd have to > remember the alias in the status XML rather than re-generate it. > > The status XML addition will need to happen separately if you decide to > go that route ... > > But as noted, since there's just one tls object possible per migration > you can keep the alias as-is and just change the backend since it > serves exactly the same purpose. > > [...] > > >> diff --git a/src/qemu/qemu_postparse.c b/src/qemu/qemu_postparse.c >> index 9eda2f6b99..998d083a3d 100644 >> --- a/src/qemu/qemu_postparse.c >> +++ b/src/qemu/qemu_postparse.c >> @@ -278,7 +278,7 @@ qemuDomainDeviceDiskDefPostParse(virDomainDiskDef *disk, >> if (parseFlags & VIR_DOMAIN_DEF_PARSE_STATUS && >> disk->src->haveTLS == VIR_TRISTATE_BOOL_YES && >> !disk->src->tlsAlias && >> - !(disk->src->tlsAlias = >> qemuAliasTLSObjFromSrcAlias(disk->info.alias))) >> + !(disk->src->tlsAlias = >> qemuAliasTLSx509ObjFromSrcAlias(disk->info.alias))) >> return -1; > > > So this code servers to re-construct status XML of a disk where the TLS > alias was *not* recorded. You can't change that otherwise those configs > would break. > > >> >> diff --git a/tests/qemustatusxml2xmldata/upgrade-out.xml >> b/tests/qemustatusxml2xmldata/upgrade-out.xml >> index c7bc7128df..8d82c83146 100644 >> --- a/tests/qemustatusxml2xmldata/upgrade-out.xml >> +++ b/tests/qemustatusxml2xmldata/upgrade-out.xml >> @@ -414,7 +414,7 @@ >> <host name='example.org' port='9999'/> >> <privateData> >> <objects> >> - <TLSx509 alias='objvirtio-disk6_tls0'/> >> + <TLSx509 alias='objvirtio-disk6_tlsx509_0'/> > > > ^^^^ this must not change. > > >> </objects> >> </privateData> >> </source>
We reuse the same alias name for tls-creds-psk instead of introducing a new one in the v3 patch series.
