Add cloud-hypervisor v51.1 with backwards-compatible version flag (CVE-2026-27211)

Makefile

@@ -34,21 +34,21 @@ $(XCADDY): | $(BIN_DIR)
 
 install-tools: $(OAPI_CODEGEN) $(AIR) $(WIRE) $(XCADDY)
 
-# Download Cloud Hypervisor binaries
+# Download Cloud Hypervisor binaries (both v49.0 and v51.1 for backwards-compatible upgrades)
 download-ch-binaries:
 	@echo "Downloading Cloud Hypervisor binaries..."
-	@mkdir -p lib/vmm/binaries/cloud-hypervisor/v48.0/{x86_64,aarch64}
 	@mkdir -p lib/vmm/binaries/cloud-hypervisor/v49.0/{x86_64,aarch64}
-	@echo "Downloading v48.0..."
-	@curl -L -o lib/vmm/binaries/cloud-hypervisor/v48.0/x86_64/cloud-hypervisor \
-		https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/v48.0/cloud-hypervisor-static
-	@curl -L -o lib/vmm/binaries/cloud-hypervisor/v48.0/aarch64/cloud-hypervisor \
-		https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/v48.0/cloud-hypervisor-static-aarch64
+	@mkdir -p lib/vmm/binaries/cloud-hypervisor/v51.1/{x86_64,aarch64}
 	@echo "Downloading v49.0..."
 	@curl -L -o lib/vmm/binaries/cloud-hypervisor/v49.0/x86_64/cloud-hypervisor \
 		https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/v49.0/cloud-hypervisor-static
 	@curl -L -o lib/vmm/binaries/cloud-hypervisor/v49.0/aarch64/cloud-hypervisor \
 		https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/v49.0/cloud-hypervisor-static-aarch64
+	@echo "Downloading v51.1..."
+	@curl -L -o lib/vmm/binaries/cloud-hypervisor/v51.1/x86_64/cloud-hypervisor \
+		https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/v51.1/cloud-hypervisor-static
+	@curl -L -o lib/vmm/binaries/cloud-hypervisor/v51.1/aarch64/cloud-hypervisor \
+		https://github.com/cloud-hypervisor/cloud-hypervisor/releases/download/v51.1/cloud-hypervisor-static-aarch64
 	@chmod +x lib/vmm/binaries/cloud-hypervisor/v*/*/cloud-hypervisor
 	@echo "Binaries downloaded successfully"
 
@@ -112,11 +112,15 @@ build-caddy: $(XCADDY)
 	@echo "Caddy binary built successfully"
 
 # Download Cloud Hypervisor API spec
+# All embedded CH versions currently share the same API spec (v0.3.0).
+# Multiple API versions will only be needed once there are breaking changes
+# introduced. Use version-specific Capabilities when new features are
+# introduced that aren't supported on previous versions.
 download-ch-spec:
 	@echo "Downloading Cloud Hypervisor API spec..."
 	@mkdir -p specs/cloud-hypervisor/api-v0.3.0
 	@curl -L -o specs/cloud-hypervisor/api-v0.3.0/cloud-hypervisor.yaml \
-		https://raw.githubusercontent.com/cloud-hypervisor/cloud-hypervisor/refs/tags/v48.0/vmm/src/api/openapi/cloud-hypervisor.yaml
+		https://raw.githubusercontent.com/cloud-hypervisor/cloud-hypervisor/refs/tags/v51.1/vmm/src/api/openapi/cloud-hypervisor.yaml
 	@echo "API spec downloaded"
 
 # Generate Go code from OpenAPI spec
@@ -168,7 +172,8 @@ ensure-ch-binaries:
 	else \
 		echo "Unsupported architecture: $$ARCH"; exit 1; \
 	fi; \
-	if [ ! -f lib/vmm/binaries/cloud-hypervisor/v48.0/$$CH_ARCH/cloud-hypervisor ]; then \
+	if [ ! -f lib/vmm/binaries/cloud-hypervisor/v49.0/$$CH_ARCH/cloud-hypervisor ] || \
+	   [ ! -f lib/vmm/binaries/cloud-hypervisor/v51.1/$$CH_ARCH/cloud-hypervisor ]; then \
 		echo "Cloud Hypervisor binaries not found, downloading..."; \
 		$(MAKE) download-ch-binaries; \
 	fi

cmd/api/config/config.go

@@ -193,9 +193,10 @@ type CapacityConfig struct {
 
 // HypervisorConfig holds hypervisor settings.
 type HypervisorConfig struct {
-	Default               string                 `koanf:"default"`
-	FirecrackerBinaryPath string                 `koanf:"firecracker_binary_path"`
-	Memory                HypervisorMemoryConfig `koanf:"memory"`
+	Default                       string                 `koanf:"default"`
+	CloudHypervisorDefaultVersion string                 `koanf:"cloud_hypervisor_default_version"`
+	FirecrackerBinaryPath         string                 `koanf:"firecracker_binary_path"`
+	Memory                        HypervisorMemoryConfig `koanf:"memory"`
 }
 
 // HypervisorMemoryConfig holds guest memory management settings.
@@ -403,8 +404,9 @@ func defaultConfig() *Config {
 		},
 
 		Hypervisor: HypervisorConfig{
-			Default:               "cloud-hypervisor",
-			FirecrackerBinaryPath: "",
+			Default:                       "cloud-hypervisor",
+			CloudHypervisorDefaultVersion: "",
+			FirecrackerBinaryPath:         "",
 			Memory: HypervisorMemoryConfig{
 				Enabled:            false,
 				KernelPageInitMode: "hardened",

lib/hypervisor/cloudhypervisor/cloudhypervisor.go

@@ -49,7 +49,14 @@ func (c *CloudHypervisor) Capabilities() hypervisor.Capabilities {
 }
 
 func capabilities() hypervisor.Capabilities {
-	return hypervisor.Capabilities{
+	return CapabilitiesForVersion(vmm.DefaultVersion)
+}
+
+// CapabilitiesForVersion returns capabilities for a specific CH version.
+// Use version-specific capabilities when new features are introduced that
+// aren't supported on previous versions.
+func CapabilitiesForVersion(v vmm.CHVersion) hypervisor.Capabilities {
+	caps := hypervisor.Capabilities{
 		SupportsSnapshot:            true,
 		SupportsHotplugMemory:       true,
 		SupportsBalloonControl:      true,
@@ -60,6 +67,11 @@ func capabilities() hypervisor.Capabilities {
 		SupportsGracefulVMMShutdown: true,
 		SupportsSnapshotBaseReuse:   false,
 	}
+	switch v {
+	case vmm.V51_1:
+		caps.SupportsDiskResize = true
+	}
+	return caps
 }
 
 // DeleteVM removes the VM configuration from Cloud Hypervisor.

lib/hypervisor/cloudhypervisor/config.go

@@ -63,7 +63,8 @@ func ToVMConfig(cfg hypervisor.VMConfig) vmm.VmConfig {
 	disks := make([]vmm.DiskConfig, 0, len(cfg.Disks))
 	for _, d := range cfg.Disks {
 		disk := vmm.DiskConfig{
-			Path: ptr(d.Path),
+			Path:      ptr(d.Path),
+			ImageType: ptr(vmm.Raw),
 		}
 		if d.Readonly {
 			disk.Readonly = ptr(true)

lib/hypervisor/cloudhypervisor/process.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"syscall"
 	"time"
 
@@ -19,6 +20,40 @@ import (
 	"gvisor.dev/gvisor/pkg/cleanup"
 )
 
+var (
+	defaultVersionMu       sync.RWMutex
+	defaultVersionOverride *vmm.CHVersion
+)
+
+// SetDefaultVersion overrides the default Cloud Hypervisor version for new
+// instances. An empty string clears the override (vmm.DefaultVersion is used).
+// Returns an error if the version is non-empty and not in SupportedVersions.
+func SetDefaultVersion(v string) error {
+	defaultVersionMu.Lock()
+	defer defaultVersionMu.Unlock()
+	if v == "" {
+		defaultVersionOverride = nil
+		return nil
+	}
+	chv := vmm.CHVersion(v)
+	if !vmm.IsVersionSupported(chv) {
+		return fmt.Errorf("unsupported cloud-hypervisor version: %q (supported: %v)", v, vmm.SupportedVersions)
+	}
+	defaultVersionOverride = &chv
+	return nil
+}
+
+// GetDefaultVersion returns the configured default, falling back to
+// vmm.DefaultVersion if no override is set.
+func GetDefaultVersion() vmm.CHVersion {
+	defaultVersionMu.RLock()
+	defer defaultVersionMu.RUnlock()
+	if defaultVersionOverride != nil {
+		return *defaultVersionOverride
+	}
+	return vmm.DefaultVersion
+}
+
 func init() {
 	hypervisor.RegisterSocketName(hypervisor.TypeCloudHypervisor, "ch.sock")
 	hypervisor.RegisterCapabilities(hypervisor.TypeCloudHypervisor, capabilities())
@@ -52,10 +87,11 @@ func (s *Starter) GetBinaryPath(p *paths.Paths, version string) (string, error)
 	return vmm.GetBinaryPath(p, chVersion)
 }
 
-// GetVersion returns the latest supported Cloud Hypervisor version.
-// Cloud Hypervisor binaries are embedded, so we return the latest known version.
+// GetVersion returns the configured default Cloud Hypervisor version.
+// This controls which version is used for new instances; existing instances
+// use the version stored in their metadata.
 func (s *Starter) GetVersion(p *paths.Paths) (string, error) {
-	return string(vmm.V49_0), nil
+	return string(GetDefaultVersion()), nil
 }
 
 // StartVM launches Cloud Hypervisor, configures the VM, and boots it.

lib/hypervisor/hypervisor.go

@@ -233,6 +233,10 @@ type Capabilities struct {
 	// SupportsSnapshotBaseReuse indicates snapshots can safely reuse a retained
 	// on-disk base across restore/standby cycles.
 	SupportsSnapshotBaseReuse bool
+
+	// SupportsDiskResize indicates if live disk resizing (/vm.resize-disk) is available.
+	// Cloud Hypervisor v50.0+ only.
+	SupportsDiskResize bool
 }
 
 // VsockDialer provides vsock connectivity to a guest VM.

lib/instances/create.go

@@ -244,11 +244,19 @@ func (m *manager) createInstance(
 		return nil, fmt.Errorf("get vm starter for %s: %w", hvType, err)
 	}
 
-	// Get hypervisor version
-	hvVersion, err := starter.GetVersion(m.paths)
-	if err != nil {
-		log.WarnContext(ctx, "failed to get hypervisor version", "hypervisor", hvType, "error", err)
-		hvVersion = "unknown"
+	// Get hypervisor version: prefer explicit request, then configured default
+	hvVersion := req.HypervisorVersion
+	if hvVersion != "" {
+		if _, err := starter.GetBinaryPath(m.paths, hvVersion); err != nil {
+			return nil, fmt.Errorf("invalid hypervisor version %q: %w", hvVersion, err)
+		}
+	} else {
+		var verErr error
+		hvVersion, verErr = starter.GetVersion(m.paths)
+		if verErr != nil {
+			log.WarnContext(ctx, "failed to get hypervisor version", "hypervisor", hvType, "error", verErr)
+			hvVersion = "unknown"
+		}
 	}
 
 	// 10. Validate, resolve, and auto-bind devices (GPU passthrough)
@@ -508,7 +516,7 @@ func (m *manager) createInstance(
 	}
 
 	// 19. Start VMM and boot VM
-	log.InfoContext(ctx, "starting VMM and booting VM", "instance_id", id)
+	log.InfoContext(ctx, "starting VMM and booting VM", "instance_id", id, "hypervisor", hvType, "version", hvVersion)
 	startVMCtx, startVMSpanEnd := m.startLifecycleStep(ctx, "start_vm",
 		attribute.String("instance_id", id),
 		attribute.String("hypervisor", string(stored.HypervisorType)),
@@ -552,7 +560,7 @@ func (m *manager) createInstance(
 		m.recordDuration(ctx, m.metrics.createDuration, start, "success", hvType)
 		m.recordStateTransition(ctx, string(StateStopped), string(finalInst.State), hvType)
 	}
-	log.InfoContext(ctx, "instance created successfully", "instance_id", id, "name", req.Name, "state", finalInst.State, "hypervisor", hvType)
+	log.InfoContext(ctx, "instance created successfully", "instance_id", id, "name", req.Name, "state", finalInst.State, "hypervisor", hvType, "version", hvVersion)
 	return &finalInst, nil
 }
 

lib/instances/manager_test.go

@@ -1254,7 +1254,7 @@ func TestStorageOperations(t *testing.T) {
 		Env:               map[string]string{"TEST": "value"},
 		CreatedAt:         time.Now(),
 		HypervisorType:    hypervisor.TypeCloudHypervisor,
-		HypervisorVersion: string(vmm.V49_0),
+		HypervisorVersion: string(vmm.V51_1),
 		SocketPath:        "/tmp/test.sock",
 		DataDir:           paths.New(tmpDir).InstanceDir("test-123"),
 	}

lib/instances/snapshot.go

@@ -307,12 +307,14 @@ func (m *manager) restoreSnapshot(ctx context.Context, id string, snapshotID str
 	if err != nil {
 		return nil, fmt.Errorf("get vm starter: %w", err)
 	}
-	hvVersion, err := starter.GetVersion(m.paths)
-	if err != nil {
-		log.WarnContext(ctx, "failed to get hypervisor version", "hypervisor", targetHypervisor, "error", err)
-		hvVersion = "unknown"
+	if targetHypervisor != rec.StoredMetadata.HypervisorType {
+		hvVersion, err := starter.GetVersion(m.paths)
+		if err != nil {
+			log.WarnContext(ctx, "failed to get hypervisor version", "hypervisor", targetHypervisor, "error", err)
+			hvVersion = "unknown"
+		}
+		restored.HypervisorVersion = hvVersion
 	}
-	restored.HypervisorVersion = hvVersion
 	restored.SocketPath = m.paths.InstanceSocket(id, starter.SocketName())
 	restored.VsockSocket = m.paths.InstanceSocket(id, hypervisor.VsockSocketNameForType(targetHypervisor))
 	if rec.Snapshot.Kind == SnapshotKindStopped {
@@ -424,10 +426,6 @@ func (m *manager) forkSnapshot(ctx context.Context, snapshotID string, req ForkS
 	if err != nil {
 		return nil, fmt.Errorf("get vm starter: %w", err)
 	}
-	hvVersion, err := starter.GetVersion(m.paths)
-	if err != nil {
-		hvVersion = "unknown"
-	}
 
 	now := time.Now()
 	forkMeta := cloneStoredMetadataWithoutPendingStandbyCompression(rec.StoredMetadata)
@@ -439,7 +437,13 @@ func (m *manager) forkSnapshot(ctx context.Context, snapshotID string, req ForkS
 	forkMeta.HypervisorPID = nil
 	forkMeta.DataDir = dstDir
 	forkMeta.HypervisorType = targetHypervisor
-	forkMeta.HypervisorVersion = hvVersion
+	if targetHypervisor != rec.StoredMetadata.HypervisorType {
+		hvVersion, err := starter.GetVersion(m.paths)
+		if err != nil {
+			hvVersion = "unknown"
+		}
+		forkMeta.HypervisorVersion = hvVersion
+	}
 	forkMeta.SocketPath = m.paths.InstanceSocket(forkID, starter.SocketName())
 	forkMeta.VsockSocket = m.paths.InstanceSocket(forkID, hypervisor.VsockSocketNameForType(targetHypervisor))
 	forkMeta.ExitCode = nil

lib/instances/types.go

@@ -112,7 +112,7 @@ type StoredMetadata struct {
 
 	// Hypervisor configuration
 	HypervisorType    hypervisor.Type // Hypervisor type (e.g., "cloud-hypervisor")
-	HypervisorVersion string          // Hypervisor version (e.g., "v49.0")
+	HypervisorVersion string          // Hypervisor version (e.g., "v51.1")
 	HypervisorPID     *int            // Hypervisor process ID (may be stale after host restart)
 
 	// Paths
@@ -229,6 +229,7 @@ type CreateInstanceRequest struct {
 	Devices                  []string                    // Device IDs or names to attach (GPU passthrough)
 	Volumes                  []VolumeAttachment          // Volumes to attach at creation time
 	Hypervisor               hypervisor.Type             // Optional: hypervisor type (defaults to config)
+	HypervisorVersion        string                      // Optional: hypervisor version (defaults to configured default)
 	GPU                      *GPUConfig                  // Optional: vGPU configuration
 	Entrypoint               []string                    // Override image entrypoint (nil = use image default)
 	Cmd                      []string                    // Override image cmd (nil = use image default)