friedkiwi/qemu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge tag 'firmware-20260519-pull-request' of https://gitlab.com/kraxel/qemu into staging

Browse Source 
- one more uefi-vars bugfix
- add igvm support for microvm

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEEoDKM/7k6F6eZAf59TLbY7tPocTgFAmoMJYAACgkQTLbY7tPo
# cTip6xAAjlRKfUUgaEZwUf1pKpHlIXfHCf1Ubyd+xTOl5+xfCqlNxGErYD6hcBm1
# wDqfp3JG54zYHXMniZvfUiPnn+Q6uXkVe+jh4JPx6LI6id4UY64TOhLV2wuJSv/h
# 0Gs99hfkg4o0/otNYBsaa0ZZH2wwm8UI83rZUbZ3/9LLOuim/2+6/eY7IBd8iJEX
# yrLSzX9vORqFHsK6z8UCJuVEonuV9pgG/a4qmJ88CmT92fchgX1oHbhsHS79URcq
# Qj+gAnCX9gKKdI7Dw/yO68rfvUIXmGUBPBaatbmmT+iV9a0YyGTvVLEehYgqIVHG
# yYY3nld8jM3dx+EwEQVUJIKlMSdv+Z4c3F9eXRNCtal7nUFvj0b7Ojn76Ujz03NO
# iGZ5LQYXBQoQLOvP6isw7TuR/71eAPsnWzNrp5thAPYNOhRsgXzz1oKVhaUXWltL
# 571vZdTsrfq3cu5QtlSirEF1DULsYr1Zqxhd9jaieIc6Svo2YgLBeM0i5kY5Pu70
# vgZylq4v7Q/4ZVpSb89hWnwAP4MWc+MjSE5oeqDs6F/WnYGFIqXi+0Mmg6upcldx
# 8RMxmbkZb5cEFBTWPRvAUXwwXu2yDtdjWLjDqBHd3A5d4MFAa2bfyA5dhf22/Eeh
# nL+xHxl03/8YqROZBEbxuWduPS7ytVsBNFhjuXEa7aSpFVUthwo=
# =2lsY
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 19 May 2026 04:55:28 EDT
# gpg:                using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* tag 'firmware-20260519-pull-request' of https://gitlab.com/kraxel/qemu:
  hw/i386/microvm: Add IGVM support
  hw/uefi: check auth.hdr_length minimum size

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
Stefan Hajnoczi
2026-05-19 09:28:07 -04:00
parent d99c08a46a b25c602ec2
commit 343a88cb02
3 changed files with 22 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
hw/i386/microvm.c
View File

@@ -159,7 +159,6 @@ static int microvm_ioapics(MicrovmMachineState *mms)
static void microvm_devices_init(MicrovmMachineState *mms)
{
const char *default_firmware;
X86MachineState *x86ms = X86_MACHINE(mms);
ISABus *isa_bus;
GSIState *gsi_state;
@@ -276,10 +275,12 @@ static void microvm_devices_init(MicrovmMachineState *mms)
serial_hds_isa_init(isa_bus, 0, 1);
}
default_firmware = x86_machine_is_acpi_enabled(x86ms)
? MICROVM_BIOS_FILENAME
: MICROVM_QBOOT_FILENAME;
x86_bios_rom_init(x86ms, default_firmware, get_system_memory(), true);
if (!x86ms->igvm) {
const char *default_firmware = x86_machine_is_acpi_enabled(x86ms)
? MICROVM_BIOS_FILENAME
: MICROVM_QBOOT_FILENAME;
x86_bios_rom_init(x86ms, default_firmware, get_system_memory(), true);
}
}
static void microvm_memory_init(MicrovmMachineState *mms)
@@ -717,6 +718,16 @@ static void microvm_class_init(ObjectClass *oc, const void *data)
compat_props_add(mc->compat_props, microvm_properties,
G_N_ELEMENTS(microvm_properties));
#if defined(CONFIG_IGVM)
object_class_property_add_link(oc, "igvm-cfg",
TYPE_IGVM_CFG,
offsetof(X86MachineState, igvm),
object_property_allow_set_link,
OBJ_PROP_LINK_STRONG);
object_class_property_set_description(oc, "igvm-cfg",
"Set IGVM configuration");
#endif
}
static const TypeInfo microvm_machine_info = {

5
hw/uefi/var-service-auth.c
View File

@@ -194,7 +194,7 @@ static efi_status uefi_vars_check_auth_2_sb(uefi_vars_state *uv,
return EFI_SUCCESS;
}
if (auth.hdr_length == 24) {
if (auth.hdr_length == (sizeof(auth) - sizeof(auth.timestamp))) {
/* no signature (auth->cert_data is empty) */
return EFI_SECURITY_VIOLATION;
}
@@ -228,6 +228,9 @@ efi_status uefi_vars_check_auth_2(uefi_vars_state *uv, uefi_variable *var,
}
memcpy(&auth, data, sizeof(auth));
if (auth.hdr_length < (sizeof(auth) - sizeof(auth.timestamp))) {
return EFI_SECURITY_VIOLATION;
}
if (uadd64_overflow(sizeof(efi_time), auth.hdr_length, &data_offset)) {
return EFI_SECURITY_VIOLATION;
}

4
hw/uefi/var-service-pkcs7.c
View File

@@ -113,9 +113,9 @@ static gnutls_datum_t *build_pkcs7(void *data)
memcpy(&auth, data, sizeof(auth));
pkcs7 = g_new(gnutls_datum_t, 1);
pkcs7->size = auth.hdr_length - 24;
pkcs7->size = auth.hdr_length - (sizeof(auth) - sizeof(auth.timestamp));
pkcs7->data = g_malloc(pkcs7->size);
memcpy(pkcs7->data, data + 16 + 24, pkcs7->size);
memcpy(pkcs7->data, data + sizeof(auth), pkcs7->size);
wrap_pkcs7(pkcs7);