August 2026 - Devel - libvirt List Archives

[PATCH] bhyve: allow setting eui64 for NVMe disks
by Roman Bogorodskiy 21 Aug '26

21 Aug '26

Bhyve allows to set eui64 for the NVMe disks: eui64 IEEE Extended Unique Identifier (8 byte value). And in a real command line: -s 5:0,nvme,/data/img/10gb.img,ser=BHYVE-NVME01-F000,eui64=0x01000000efbeadde Model that using the <wwn> element: <disk type='file'> <driver name='file' type='raw'/> <source file='/path/to/some.img'/> <target dev='nvme0n1' bus='nvme'/> <wwn>01000000efbeadde</wwn> </disk> As this element does not allow commas, it's not necessary to add additional validation for that. Closes: https://gitlab.com/libvirt/libvirt/-/work_items/901 Signed-off-by: Roman Bogorodskiy <bogorodskiy(a)gmail.com> --- I think there's a bug in bhyve that results in a reversed order value, so I have to use "01000000efbeadde" to get "deadbeef00000001". I'm trying to address that in https://reviews.freebsd.org/D59080. src/bhyve/bhyve_command.c | 4 ++++ .../x86_64/bhyvexml2argv-2-nvme-2-controllers.args | 2 +- .../x86_64/bhyvexml2argv-2-nvme-2-controllers.xml | 1 + .../x86_64/bhyvexml2argv-nvme-explicit-controller.args | 2 +- .../x86_64/bhyvexml2argv-nvme-explicit-controller.xml | 1 + .../x86_64/bhyvexml2xmlout-2-nvme-2-controllers.xml | 1 + .../x86_64/bhyvexml2xmlout-nvme-explicit-controller.xml | 1 + 7 files changed, 10 insertions(+), 2 deletions(-) diff --git a/src/bhyve/bhyve_command.c b/src/bhyve/bhyve_command.c index 956fcab06c..f0a87cffea 100644 --- a/src/bhyve/bhyve_command.c +++ b/src/bhyve/bhyve_command.c @@ -479,6 +479,10 @@ bhyveBuildNVMeControllerArgStr(const virDomainDef *def, virBufferAsprintf(&opt, ",maxq=%d", disk->queues); if (disk->queue_size) virBufferAsprintf(&opt, ",qsz=%d", disk->queue_size); + if (disk->wwn) + virBufferAsprintf(&opt, ",eui64=%s%s", + STRPREFIX(disk->wwn, "0x") ? "" : "0x", + disk->wwn); if (controller->opts.nvmeopts.serial) virBufferAsprintf(&opt, ",ser=%s", controller->opts.nvmeopts.serial); diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.args index 664eec99bc..5be39bda1d 100644 --- a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.args +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.args @@ -5,6 +5,6 @@ bhyve \ -H \ -P \ -s 0:0,hostbridge \ --s 2:0,nvme,/tmp/freebsd.img \ +-s 2:0,nvme,/tmp/freebsd.img,eui64=0xdeadbeef00000001 \ -s 3:0,nvme,/tmp/data.img \ bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.xml index 30f337197e..6a5efd3831 100644 --- a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.xml +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-2-nvme-2-controllers.xml @@ -11,6 +11,7 @@ <driver name='file' type='raw'/> <source file='/tmp/freebsd.img'/> <target dev='nvme0n1' bus='nvme'/> + <wwn>0xdeadbeef00000001</wwn> </disk> <disk type='file'> <driver name='file' type='raw'/> diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.args b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.args index 74dd4baa37..022a4df209 100644 --- a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.args +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.args @@ -5,5 +5,5 @@ bhyve \ -H \ -P \ -s 0:0,hostbridge \ --s 2:0,nvme,/tmp/freebsd.img,maxq=2,qsz=256,ser=BHYVE-NVME0-01234 \ +-s 2:0,nvme,/tmp/freebsd.img,maxq=2,qsz=256,eui64=0x01000000efbeadde,ser=BHYVE-NVME0-01234 \ bhyve diff --git a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.xml b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.xml index 9781d3aaef..fb7ed573c5 100644 --- a/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.xml +++ b/tests/bhyvexml2argvdata/x86_64/bhyvexml2argv-nvme-explicit-controller.xml @@ -14,6 +14,7 @@ <driver name='file' type='raw' queues='2' queue_size='256'/> <source file='/tmp/freebsd.img'/> <target dev='nvme0n1' bus='nvme'/> + <wwn>01000000efbeadde</wwn> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> </devices> diff --git a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-2-nvme-2-controllers.xml b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-2-nvme-2-controllers.xml index d0eb9c7fc8..107beef587 100644 --- a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-2-nvme-2-controllers.xml +++ b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-2-nvme-2-controllers.xml @@ -17,6 +17,7 @@ <driver name='file' type='raw'/> <source file='/tmp/freebsd.img'/> <target dev='nvme0n1' bus='nvme'/> + <wwn>0xdeadbeef00000001</wwn> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> <disk type='file' device='disk'> diff --git a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-nvme-explicit-controller.xml b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-nvme-explicit-controller.xml index f646267ec5..7c4dd2cdb3 100644 --- a/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-nvme-explicit-controller.xml +++ b/tests/bhyvexml2xmloutdata/x86_64/bhyvexml2xmlout-nvme-explicit-controller.xml @@ -17,6 +17,7 @@ <driver name='file' type='raw' queues='2' queue_size='256'/> <source file='/tmp/freebsd.img'/> <target dev='nvme0n1' bus='nvme'/> + <wwn>01000000efbeadde</wwn> <address type='drive' controller='0' bus='0' target='0' unit='0'/> </disk> <controller type='nvme' index='0'> -- 2.52.0

1 0

[libvirt PATCH] storage: logical: don't write past buffer bounds
by Ján Tomko 21 Aug '26

21 Aug '26

From: Ján Tomko <jtomko(a)redhat.com> If parsed number of extents is 0, the calculated buffer size won't hold the first regex_unit. Closes: https://gitlab.com/libvirt/libvirt/-/work_items/913 Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/storage/storage_backend_logical.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/storage/storage_backend_logical.c b/src/storage/storage_backend_logical.c index 51e9337820..81f9d62d8b 100644 --- a/src/storage/storage_backend_logical.c +++ b/src/storage/storage_backend_logical.c @@ -161,12 +161,12 @@ virStorageBackendLogicalParseVolExtents(virStorageVolDef *vol, /* Allocate space for 'nextents' regex_unit strings plus a comma for each */ regex = g_new0(char, nextents * (strlen(regex_unit) + 1) + 1); - strcat(regex, regex_unit); - for (i = 1; i < nextents; i++) { + for (i = 0; i < nextents; i++) { /* "," is the separator of "devices" field */ - strcat(regex, ","); strcat(regex, regex_unit); + strcat(regex, ","); } + regex[strlen(regex) - 1] = '\0'; re = g_regex_new(regex, 0, 0, &err); if (!re) { -- 2.55.0

1 0

[RFC PATCH v1 0/2] fix: don't add SELinux MCS categories to IOMMU device
by Omar Elghoul 21 Aug '26

21 Aug '26

Hi, This patchset proposes a fix for what I believe is a bug in libvirt when using iommufd under SELinux enforcing. It is an RFC because I cannot yet vouch for its correctness -- the goal is not to merge this code as is, but rather start a discussion on how we should go about things. When using iommufd, libvirt opens the vfio cdev corresponding to the device (e.g. /dev/vfio/devices/{n}) and the IOMMU device (/dev/iommu) and passes the file descriptors to qemu. The cdev is a device-specific resource, and thus a per-domain resource. The IOMMU on the other hand is a shared resource between all domains. Using the SELinux driver, libvirt relabels and assigns MCS categories to domain-specific devices to isolate from other domains. However, it also incorrectly assigns these categories to the IOMMU device. This can make subsequent domains unable to create DMA mappings. On my s390x host, I've repeatedly observed this problem showing up as PCI error events that show a DMA attempt to a non-present page. This problem is reproducible by running `setenforce 1` and then starting two domains, each with a PCI passthrough device using iommufd, and then performing actions that initiate PCI DMA transactions from within the guests. Launching qemu manually from the command-line does not produce these errors. There is also an additional cleanup problem that is not addressed in libvirt today, nor in my patches. When libvirt relabels a device, it doesn't restore the default label after the domain is destroyed. This is fine for the vfio cdevs, because they will disappear anyway as they get unbound from the vfio driver and rebind their default driver, but again is problematic for /dev/iommu because the inode is never unlinked. For example, the good state before starting a domain: root in ~/libvirt λ matchpathcon /dev/iommu /dev/iommu system_u:object_r:iommu_device_t:s0 root in ~/libvirt λ ls -Z /dev/iommu system_u:object_r:iommu_device_t:s0 /dev/iommu After starting and ending all domains (without my patches): root in ~/libvirt λ ls -Z /dev/iommu system_u:object_r:svirt_image_t:s0:c614,c980 /dev/iommu My patches remove the per-domain MCS categories (i.e., c614,c980) from the IOMMU, but they do NOT clean up the inode relabel. For the domain's lifetime, a relabel from iommu_device_t to svirt_image_t is correct. But I'm skeptical of whether we should clean that up at all when no domains are running, so that's another point I hope to get sorted out. I'd be happy to hear any feedback or thoughts on resolving this issue. If there's more questions or anyone needs more details, I'm available to answer those too. Thanks in advance. Omar Elghoul (2): security: add SetSharedImageFDLabel() for shared image FDs qemu: drop per-domain MCS categories from IOMMU device src/libvirt_private.syms | 1 + src/qemu/qemu_process.c | 4 +- src/qemu/qemu_security.h | 1 + src/security/security_apparmor.c | 1 + src/security/security_dac.c | 1 + src/security/security_driver.h | 4 ++ src/security/security_manager.c | 16 ++++++++ src/security/security_manager.h | 3 ++ src/security/security_nop.c | 1 + src/security/security_selinux.c | 63 ++++++++++++++++++++++++++++++++ src/security/security_stack.c | 18 +++++++++ 11 files changed, 111 insertions(+), 2 deletions(-) -- 2.55.0

2 5

[libvirt PATCH] qemu: agent: clear stale pointer in qemuAgentGetDisks
by Ján Tomko 21 Aug '26

21 Aug '26

From: Ján Tomko <jtomko(a)redhat.com> CVE-2026-77158 In case of hitting the cleanup label, the disks array was freed but the pointer was not cleared, leading to a possible double free. Fixes: 0cb2d9f05d00497a715352f6ea28cf8fb6921731 (v6.10.0-9-g0cb2d9f05d) Closes: https://gitlab.com/libvirt/libvirt/-/work_items/910 Reported-by: David Korczynski (Ada Logics) Found-by: Claude Signed-off-by: Ján Tomko <jtomko(a)redhat.com> --- src/hypervisor/qemu_agent.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/hypervisor/qemu_agent.c b/src/hypervisor/qemu_agent.c index f5f50e3c92..431407b68e 100644 --- a/src/hypervisor/qemu_agent.c +++ b/src/hypervisor/qemu_agent.c @@ -2562,7 +2562,7 @@ int qemuAgentGetDisks(qemuAgent *agent, for (i = 0; i < ndata; i++) { qemuAgentDiskInfoFree((*disks)[i]); } - g_free(*disks); + g_clear_pointer(disks, g_free); return -1; } -- 2.55.0

1 0

[PATCH v2 0/7] qemu: add poll-weight support for iothreads
by Jaehoon Kim 21 Aug '26

21 Aug '26

This series adds support for the QEMU iothread poll-weight property, which controls the weight of the most recent event interval in the adaptive polling duration calculation. The valid range is [0, 63]; a value of 0 lets QEMU use its default weight. Changes in v2: - Move the formatdomain docs patch right after the XML parser/formatter patch - Fix the docs description: "If omitted, the value is not changed" rather than "If omitted or set to 0, the hypervisor selects a default" - Split the getter/stats path (patch 4) from the setter/cmdline path (patch 5), and drop the qemuBuildIOThreadCommandLine qemuCaps parameter since CAPS validation is handled by qemuValidateDomainDefIOThreads - Separate the test driver changes into its own patch (patch 6) with the corresponding iothreads.out updates split accordingly - Move the domstats documentation hunk into the stats patch (patch 4) - Add a qemuxmlconf parse-error test for out-of-range weight values - Fix Since version: 12.6.0 -> 12.7.0 (Peter Krempa) - Drop the docs: fix typos patch (already applied upstream) The series was validated with: meson test -C build virschematest meson test -C build qemucapabilitiestest meson test -C build qemuxmlconftest meson test -C build virshtest meson test -C build genericxml2xmltest QEMU commits: 9fea80ddf0 qapi/iothread: introduce poll-weight parameter for aio-poll 9563d0b5e2 aio-poll: refine iothread polling using weighted handler intervals ed21d9d65c aio-poll: avoid unnecessary polling time computation Jaehoon Kim (7): conf: add iothread poll-weight XML support docs: formatdomain: document iothread poll-weight qemu: capabilities: add capability for iothread poll-weight qemu: add poll-weight getter and stats support qemu: support iothread poll-weight test: add poll-weight support to the test driver virsh: add iothreadset --poll-weight support docs/formatdomain.rst | 8 ++- docs/manpages/virsh.rst | 18 ++++-- include/libvirt/libvirt-domain.h | 25 ++++++++ src/conf/domain_conf.c | 14 ++++- src/conf/domain_conf.h | 2 + src/conf/domain_validate.c | 7 +++ src/conf/schemas/domaincommon.rng | 5 ++ src/qemu/qemu_capabilities.c | 2 + src/qemu/qemu_capabilities.h | 1 + src/qemu/qemu_command.c | 6 ++ src/qemu/qemu_driver.c | 38 ++++++++++++ src/qemu/qemu_monitor.h | 2 + src/qemu/qemu_monitor_json.c | 18 ++++++ src/qemu/qemu_validate.c | 10 +++- src/test/test_driver.c | 12 ++++ tests/genericxml2xmlindata/iothreadids.xml | 2 +- .../caps_11.1.0_aarch64.xml | 1 + .../caps_11.1.0_x86_64.xml | 1 + ...s-poll-weight-outofrange.x86_64-latest.err | 1 + .../iothreads-ids-poll-weight-outofrange.xml | 58 +++++++++++++++++++ ...threads-ids-poll-weight.x86_64-latest.args | 40 +++++++++++++ ...othreads-ids-poll-weight.x86_64-latest.xml | 58 +++++++++++++++++++ .../iothreads-ids-poll-weight.xml | 58 +++++++++++++++++++ tests/qemuxmlconftest.c | 2 + tests/virshtestdata/iothreads.in | 2 + tests/virshtestdata/iothreads.out | 18 ++++++ tools/virsh-domain.c | 17 ++++++ 27 files changed, 415 insertions(+), 11 deletions(-) create mode 100644 tests/qemuxmlconfdata/iothreads-ids-poll-weight-outofrange.x86_64-latest.err create mode 100644 tests/qemuxmlconfdata/iothreads-ids-poll-weight-outofrange.xml create mode 100644 tests/qemuxmlconfdata/iothreads-ids-poll-weight.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/iothreads-ids-poll-weight.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/iothreads-ids-poll-weight.xml -- 2.54.0

3 16

[PATCH 0/4] bhyve: live/transient domain handling fixes
by Roman Bogorodskiy 21 Aug '26

21 Aug '26

I was doing pre-merge testing of the "bhyve: implement virDomainSetLifecycleAction() API" series and spotted a few issues related to the live/transient domain definitions handling (and in the original series as well, so will likely send a v2 later). This area has quite a few nuances, so I extended the TCK test: https://gitlab.com/libvirt/libvirt-tck/-/merge_requests/92 TCK also helped to catch the issue with the firmware data filling with the scripts/domain/405-ovmf-nvram-efi.t test. It is fixed in the final patch of the series. I think I plan to add more TCK tests for that, but decided to send this series first to make sure I'm on the right track. Roman Bogorodskiy (4): bhyve: process: do not leak live changes to persistent XML bhyve: process: discard stale live definition on reconnect failure bhyve: honor VIR_DOMAIN_XML_INACTIVE in virDomainGetXMLDesc() bhyve: domain: fix filling of firmware data src/bhyve/bhyve_domain.c | 11 ++++++++++- src/bhyve/bhyve_driver.c | 18 ++++++++++++++---- src/bhyve/bhyve_firmware.c | 12 ++++++------ src/bhyve/bhyve_firmware.h | 2 +- src/bhyve/bhyve_process.c | 9 ++++++++- .../three_firmwares/BHYVE_UEFI_VARS.fd | 0 .../x86_64/bhyvexml2xmlout-numa.xml | 2 ++ tests/bhyvexml2xmltest.c | 10 +++++++++- 8 files changed, 50 insertions(+), 14 deletions(-) create mode 100644 tests/bhyvefirmwaredata/three_firmwares/BHYVE_UEFI_VARS.fd -- 2.52.0

1 4

[PATCH 0/6] various fixes for 11.2 (gitlab, tests, char-fe, fdc, deprecations)
by Alex Bennée 20 Aug '26

20 Aug '26

This is a rather random selection of fixes that didn't quite make it to 11.1 although we have some qemu-stable material in here. The CFLAGS tweak allow another target to be built and tested on MacOS. There are also riscv64 compilers which could be enabled via brew but I don't have time to look at those. The CFLAGS changes are also subsumed into Pierrick's check-tcg meson updates which might hit first. The char-fe clean-up removes a code smell of device models reaching into qemu_chr_fe_get_driver which is poor practice. The fdc fix resolves one of the many security reports for those that still care about floppy controllers in VMs. In my brief excursion into our confidential bugs I did look at fixing virtio-crypto but found it needs some serious love. Therefor I'm taking the other option of deprecating the module. Finally I'm experimenting with using b4's patch series handling so forgive any finger trouble on this series. Alex. Signed-off-by: Alex Bennée <alex.bennee(a)linaro.org> --- Alex Bennée (6): gitlab: use .base_meson_job_template for macOS jobs tests/arm: add explicit CFLAGS for system build gitlab: add arm-softmmu tests to the macOS build char-fe: implement qemu_chr_fe_backend_name hw/block: validate the fdc sector position fits within bounds docs: deprecate virtio-crypto docs/about/deprecated.rst | 14 ++++++++++++++ hw/block/fdc-internal.h | 1 + include/chardev/char-fe.h | 13 ++++++++++++- backends/cryptodev-vhost-user.c | 8 +------- backends/rng-egd.c | 8 +------- backends/vhost-user.c | 8 +------- hw/block/fdc.c | 28 ++++++++++++++++++++++------ hw/char/imx_serial.c | 4 ++-- .gitlab-ci.d/macos.yml | 7 ++++--- tests/tcg/arm/Makefile.softmmu-target | 2 +- 10 files changed, 59 insertions(+), 34 deletions(-) --- base-commit: fa19879df1658f96ac07365fca8835b7decd6995 change-id: 20260819-fixes-for-11-2-f98744b82c12 Best regards, -- Alex Bennée <alex.bennee(a)linaro.org>

5 10

[PATCH] apparmor: Allow vfio-ccw hostdev sysfs access
by Hector Cao 20 Aug '26

20 Aug '26

Attaching a vfio-ccw mediated device as a <hostdev> fails under the libvirt-qemu AppArmor profile because QEMU's channel subsystem code (hw/s390x/css.c) reads several sysfs attributes of the passed-through subchannel when building the guest SCHIB, and the profile does not grant read access to them: css_sch_get_chpids() -> /sys/bus/css/devices/<id>/chpids css_sch_get_path_masks() -> /sys/bus/css/devices/<id>/pimpampom css_sch_get_chpid_type() -> /sys/devices/css<n>/chp0.<chpid>/type The first two are opened via /sys/bus/css/devices/<id> symlinks, which AppArmor resolves to the real device path /sys/devices/css<n>/<id>/ before mediating the access; the CHPID type file is read directly under /sys/devices/. Without these rules the attach (or hotplug) fails with an AppArmor DENIED message and QEMU aborts with: s390_ccw_realize: Failed to build initial schib: Invalid argument Add narrowly-scoped read rules for these three files so vfio-ccw passthrough works without granting broad access to /sys/devices/css*. Signed-off-by: Hector Cao <hector.cao(a)canonical.com> --- src/security/apparmor/libvirt-qemu | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu index e4aceacd70..428f9a9731 100644 --- a/src/security/apparmor/libvirt-qemu +++ b/src/security/apparmor/libvirt-qemu @@ -50,6 +50,16 @@ /run/udev/data/c16[6,7]* r, /run/udev/data/c18[0,8,9]* r, + # For vfio-ccw (s390x channel subsystem) hostdev passthrough. QEMU reads + # the channel-path masks, CHPID list and CHPID type of the passed-through + # subchannel from sysfs when building the guest SCHIB. The chpids and + # pimpampom files are opened via /sys/bus/css/devices/<id>/ symlinks that + # AppArmor resolves to /sys/devices/cssN/<id>/; the CHPID type is read + # directly from /sys/devices/cssN/chp0.<chpid>/. + /sys/devices/css[0-9]*/*/chpids r, + /sys/devices/css[0-9]*/*/pimpampom r, + /sys/devices/css[0-9]*/chp0.*/type r, + # WARNING: this gives the guest direct access to host hardware and specific # portions of shared memory. This is required for sound using ALSA with kvm, # but may constitute a security risk. If your environment does not require -- 2.43.0

2 2

[PATCH v2] Allow slices for block backed NVRAM
by John Levon 20 Aug '26

20 Aug '26

For NVRAM storage specifically, the guest-visible size is critical to correct handling of the OVMF address space. Allow specifying storage slices for NVRAM storage when the underlying block may be larger due to alignment/allocation restrictions. As qemuPrepareNVRAMBlock() does not support it, disallow slices with non-raw formats, and slice offsets. Signed-off-by: John Levon <john.levon(a)nutanix.com> --- src/qemu/qemu_validate.c | 32 ++++++++++---- ...ual-efi-nvram-dev-slice.x86_64-latest.args | 35 ++++++++++++++++ ...nual-efi-nvram-dev-slice.x86_64-latest.xml | 42 +++++++++++++++++++ .../firmware-manual-efi-nvram-dev-slice.xml | 25 +++++++++++ tests/qemuxmlconftest.c | 1 + 5 files changed, 128 insertions(+), 7 deletions(-) create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.args create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.xml create mode 100644 tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.xml diff --git a/src/qemu/qemu_validate.c b/src/qemu/qemu_validate.c index 61f3bd3278..ae70eb89f0 100644 --- a/src/qemu/qemu_validate.c +++ b/src/qemu/qemu_validate.c @@ -707,8 +707,32 @@ qemuValidateDomainDefNvram(const virDomainDef *def, switch (src->type) { case VIR_STORAGE_TYPE_FILE: - case VIR_STORAGE_TYPE_BLOCK: case VIR_STORAGE_TYPE_NETWORK: + if (src->sliceStorage) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("slices are not supported with non-block NVRAM")); + return -1; + } + break; + + case VIR_STORAGE_TYPE_BLOCK: + if (src->sliceStorage) { + if (src->sliceStorage->offset != 0) { + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", + _("offset slices are not supported with NVRAM")); + } + + switch (src->format) { + case VIR_STORAGE_FILE_RAW: + case VIR_STORAGE_FILE_NONE: + break; + + default: + virReportError(VIR_ERR_CONFIG_UNSUPPORTED, + _("NVRAM slices are not supported with format '%1$s'"), + virStorageFileFormatTypeToString(src->format)); + } + } break; case VIR_STORAGE_TYPE_DIR: @@ -728,12 +752,6 @@ qemuValidateDomainDefNvram(const virDomainDef *def, return -1; } - if (src->sliceStorage) { - virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", - _("slices are not supported with NVRAM")); - return -1; - } - if (src->pr) { virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", _("persistent reservations are not supported with NVRAM")); diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.args b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.args new file mode 100644 index 0000000000..bb911d4ae1 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.args @@ -0,0 +1,35 @@ +LC_ALL=C \ +PATH=/bin \ +HOME=/var/lib/libvirt/qemu/domain--1-guest \ +USER=test \ +LOGNAME=test \ +XDG_DATA_HOME=/var/lib/libvirt/qemu/domain--1-guest/.local/share \ +XDG_CACHE_HOME=/var/lib/libvirt/qemu/domain--1-guest/.cache \ +XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \ +/usr/bin/qemu-system-x86_64 \ +-name guest=guest,debug-threads=on \ +-S \ +-object '{"qom-type":"secret","id":"masterKey0","format":"raw","file":"/var/lib/libvirt/qemu/domain--1-guest/master-key.aes"}' \ +-blockdev '{"driver":"file","filename":"/usr/share/edk2/ovmf/OVMF_CODE.fd","node-name":"libvirt-pflash0-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"node-name":"libvirt-pflash0-format","read-only":true,"driver":"raw","file":"libvirt-pflash0-storage"}' \ +-blockdev '{"driver":"host_device","filename":"/dev/lv/guest_VARS.fd","node-name":"libvirt-pflash1-storage","auto-read-only":true,"discard":"unmap"}' \ +-blockdev '{"driver":"raw","file":"libvirt-pflash1-storage","offset":0,"size":540672,"node-name":"libvirt-0-slice-sto","read-only":false}' \ +-machine pc-i440fx-10.0,usb=off,dump-guest-core=off,memory-backend=pc.ram,pflash0=libvirt-pflash0-format,pflash1=libvirt-0-slice-sto,acpi=on \ +-accel tcg \ +-cpu qemu64 \ +-m size=1048576k \ +-object '{"qom-type":"memory-backend-ram","id":"pc.ram","size":1073741824}' \ +-overcommit mem-lock=off \ +-smp 1,sockets=1,cores=1,threads=1 \ +-uuid 63840878-0deb-4095-97e6-fc444d9bc9fa \ +-display none \ +-no-user-config \ +-nodefaults \ +-chardev socket,id=charmonitor,fd=@mon-fd@,server=on,wait=off \ +-object '{"qom-type":"monitor-qmp","id":"monitor","chardev":"charmonitor"}' \ +-rtc base=utc \ +-no-shutdown \ +-boot strict=on \ +-audiodev '{"id":"audio1","driver":"none"}' \ +-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \ +-msg timestamp=on diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.xml b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.xml new file mode 100644 index 0000000000..9409c6a7a6 --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.x86_64-latest.xml @@ -0,0 +1,42 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <currentMemory unit='KiB'>1048576</currentMemory> + <vcpu placement='static'>1</vcpu> + <os firmware='efi'> + <type arch='x86_64' machine='pc-i440fx-10.0'>hvm</type> + <firmware> + <feature enabled='no' name='enrolled-keys'/> + <feature enabled='no' name='secure-boot'/> + </firmware> + <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader> + <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.fd' templateFormat='raw' type='block' format='raw'> + <source dev='/dev/lv/guest_VARS.fd'> + <slices> + <slice type='storage' offset='0' size='540672'/> + </slices> + </source> + </nvram> + <boot dev='hd'/> + </os> + <features> + <acpi/> + </features> + <cpu mode='custom' match='exact' check='none'> + <model fallback='forbid'>qemu64</model> + </cpu> + <clock offset='utc'/> + <on_poweroff>destroy</on_poweroff> + <on_reboot>restart</on_reboot> + <on_crash>destroy</on_crash> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' index='0' model='none'/> + <controller type='pci' index='0' model='pci-root'/> + <input type='mouse' bus='ps2'/> + <input type='keyboard' bus='ps2'/> + <audio id='1' type='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.xml b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.xml new file mode 100644 index 0000000000..31cf086c2a --- /dev/null +++ b/tests/qemuxmlconfdata/firmware-manual-efi-nvram-dev-slice.xml @@ -0,0 +1,25 @@ +<domain type='qemu'> + <name>guest</name> + <uuid>63840878-0deb-4095-97e6-fc444d9bc9fa</uuid> + <memory unit='KiB'>1048576</memory> + <vcpu placement='static'>1</vcpu> + <os> + <type arch='x86_64' machine='pc-i440fx-10.0'>hvm</type> + <loader readonly='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.fd</loader> + <nvram type='block'> + <source dev='/dev/lv/guest_VARS.fd'> + <slices> + <slice type="storage" offset="0" size="540672"/> + </slices> + </source> + </nvram> + </os> + <features> + <acpi/> + </features> + <devices> + <emulator>/usr/bin/qemu-system-x86_64</emulator> + <controller type='usb' model='none'/> + <memballoon model='none'/> + </devices> +</domain> diff --git a/tests/qemuxmlconftest.c b/tests/qemuxmlconftest.c index e0e64c6c38..3b6f97c2b0 100644 --- a/tests/qemuxmlconftest.c +++ b/tests/qemuxmlconftest.c @@ -1442,6 +1442,7 @@ mymain(void) DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-network-iscsi"); DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-network-nbd"); DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-file"); + DO_TEST_CAPS_LATEST("firmware-manual-efi-nvram-dev-slice"); DO_TEST_CAPS_LATEST_PARSE_ERROR("firmware-manual-efi-nvram-stateless"); DO_TEST_CAPS_ARCH_LATEST_FULL("firmware-manual-efi-sev-snp", "x86_64", -- 2.43.0

2 2

[PATCH] storage: check bounds before accessing encryption payload offset
by Sergey Zhidkih 20 Aug '26

20 Aug '26

'virStorageFileGetEncryptionPayloadOffset' expects payloadOffset + 4 to be in buffer bounds which isn't checked anywhere. For example malicious actor may provide LUKS header with just magic and version like: '4c554b53 babe 0001'. This example successefully passes 'virStorageFileHasEncryptionFormat' and leads to OOB read of 4 bytes. So the fix is to add bounds checks. Fixes: b7d44f450c06803df7df3ad380f7a5c97425c1e6 Closes: https://gitlab.com/libvirt/libvirt/-/work_items/906 Signed-off-by: Sergey Zhidkih <rx1513(a)altlinux.org> --- src/storage_file/storage_file_probe.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/storage_file/storage_file_probe.c b/src/storage_file/storage_file_probe.c index cc5854d360..3ac90d698c 100644 --- a/src/storage_file/storage_file_probe.c +++ b/src/storage_file/storage_file_probe.c @@ -938,11 +938,13 @@ virStorageFileHasEncryptionFormat(const struct FileEncryptionInfo *info, static int virStorageFileGetEncryptionPayloadOffset(const struct FileEncryptionInfo *info, - char *buf) + char *buf, + size_t len) { int payload_offset = -1; - if (info->payloadOffset != -1) { + if (info->payloadOffset != -1 && + len >= info->payloadOffset + sizeof(uint32_t)) { if (info->endian == LV_LITTLE_ENDIAN) payload_offset = virReadBufInt32LE(buf + info->payloadOffset); else @@ -999,7 +1001,7 @@ virStorageFileProbeGetMetadata(virStorageSource *meta, } } meta->encryption->payload_offset = - virStorageFileGetEncryptionPayloadOffset(&fileTypeInfo[meta->format].cryptInfo[i], buf); + virStorageFileGetEncryptionPayloadOffset(&fileTypeInfo[meta->format].cryptInfo[i], buf, len); } } } -- 2.50.1

2 1