kvm icon indicating copy to clipboard operation
kvm copied to clipboard

kvmi-v6: some fields of kvmi_qemu2introspector and kvmi_introspector2qemu are empty

Open Wenzel opened this issue 5 years ago • 5 comments

Hi,

I would like to print the available information in the KVMi handshake callback:

static int cb_handshake(
    const struct kvmi_qemu2introspector *qemu,
    struct kvmi_introspector2qemu *intro,
    void *ctx)
{
    (void)ctx;
    if (!qemu || !intro) {
        errprint("Invalid parameters in KVMi handshake callback");
        return 1;
    }
    char str_time[20] = {0};
    strftime(str_time, 20, "%Y-%m-%d %H:%M:%S", localtime(&qemu->start_time));
    // print name and start time
    dbprint(VMI_DEBUG_KVM, "--KVMi handshake - Domain name: %s, Start time: %s\n", qemu->name, str_time);
    // print UUID
    for (int i = 0; i < 16; i++)
        printf("%.2X ", qemu->uuid[i]);
    printf("\n");
    // print cookie
    for (int i = 0; i < 20; i++)
        printf("%.2X ", intro->cookie_hash[i]);
    printf("\n");
    return 0;
}

However some of the fields are empty: Capture d’écran de 2020-04-08 15-21-39

cc @adlazar, @mdontu is this not implemented yet ?

Wenzel avatar Apr 08 '20 13:04 Wenzel

This QEMU, matching KVM with KVMI-v6 patches, doesn't send the name, nor the VM start time (padding2). see

I've only changed the handshake structure to match KVMI-v6 :(

kvmi_introspector2qemu.cookie is what the introspection app sets, if the guest is configured to authenticate the app. So, it should be empty when that callback is called.

adlazar avatar Apr 08 '20 17:04 adlazar

On KVMi-v7 the name is set now. The VM start time is still empty though

Wenzel avatar Apr 24 '20 15:04 Wenzel

kvmi-test.c shows both fields as non-empty.

adlazar avatar Apr 24 '20 16:04 adlazar

@adlazar my bad, it is my translation to a string date that seem to be incorrect.

--KVMi handshake:
--    VM name: winxp
--    VM start time: 2159253 
--    VM start time: Sun Jan 25 1970

but as I got the same date than on my last attempt, i figured the timestamp was empty and therefore starting at 1970.

this is how I translated

    char date[64] = {'\0'};
    const char *format = "%a %b %d %Y";
    struct tm *tm = NULL;
    tm = localtime(&qemu->start_time);
    if (strftime(date, sizeof(date), format, tm) <= 0) {
        errprint("Failed to convert time to string\n");
    } else {
        dbprint(VMI_DEBUG_KVM, "--    VM start time: %s\n", date);
    }

Wenzel avatar Apr 24 '20 21:04 Wenzel

https://github.com/KVM-VMI/qemu/pull/5/commits/58840c5bbc82005422d997175b7f94df24fa28da fixes the VM start time issue.

adlazar avatar May 04 '20 11:05 adlazar