From: Stefan Hajnoczi <stefanha@redhat.com>
To: Peter Maydell <peter.maydell@linaro.org>
Cc: qemu-devel@nongnu.org, "Bernhard Beschow" <shentey@gmail.com>,
"Thomas Huth" <thuth@redhat.com>,
"Philippe Mathieu-Daudé" <philmd@linaro.org>,
"Jiaxun Yang" <jiaxun.yang@flygoat.com>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"Michael S . Tsirkin" <mst@redhat.com>,
"Marcel Apfelbaum" <marcel.apfelbaum@gmail.com>,
"Alistair Francis" <Alistair.Francis@wdc.com>,
"Palmer Dabbelt" <palmer@dabbelt.com>,
qemu-riscv@nongnu.org, qemu-ppc@nongnu.org,
"Huacai Chen" <chenhuacai@kernel.org>,
qemu-s390x@nongnu.org, "Halil Pasic" <pasic@linux.ibm.com>,
"Christian Borntraeger" <borntraeger@linux.ibm.com>,
"Song Gao" <gaosong@loongson.cn>,
"Bibo Mao" <maobibo@loongson.cn>
Subject: Re: [RFC PATCH] docs/system/security: Restrict "virtualization use case" to specific machines
Date: Mon, 8 Sep 2025 09:42:21 -0400 [thread overview]
Message-ID: <20250908134221.GB167158@fedora> (raw)
In-Reply-To: <20250908125058.220973-1-peter.maydell@linaro.org>
[-- Attachment #1: Type: text/plain, Size: 640 bytes --]
On Mon, Sep 08, 2025 at 01:50:57PM +0100, Peter Maydell wrote:
> We don't currently restrict the "virtualization use case" to any
> particular set of machine types. This means that we have effectively
> barred ourselves from adding KVM support to any machine type that we
> don't want to put into the "bugs are security issues" category, even
> if it would be useful for users to be able to get better performance
> with a trusted guest by enabling KVM. This seems an unnecessary
> restriction, and in practice the set of machine types it makes
> sense to use for untrusted-guest virtualization is quite small.
Makes sense to me.
Stefan
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
next prev parent reply other threads:[~2025-09-08 13:43 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-08 12:50 [RFC PATCH] docs/system/security: Restrict "virtualization use case" to specific machines Peter Maydell
2025-09-08 13:09 ` Paolo Bonzini
2025-09-08 13:21 ` Thomas Huth
2025-09-24 23:57 ` Philippe Mathieu-Daudé
2025-09-08 13:42 ` Stefan Hajnoczi [this message]
2025-09-08 14:45 ` Michael S. Tsirkin
2025-09-08 15:15 ` Daniel P. Berrangé
2025-09-25 0:05 ` Philippe Mathieu-Daudé
2025-09-25 9:22 ` Daniel P. Berrangé
2025-10-13 10:40 ` Bernhard Beschow
2025-10-13 11:12 ` Michael S. Tsirkin
2025-10-13 11:47 ` Daniel P. Berrangé
2025-10-13 11:59 ` Michael S. Tsirkin
2025-10-13 19:36 ` Bernhard Beschow
2025-10-14 12:20 ` Peter Maydell
2025-10-14 12:38 ` Bibo Mao
2025-10-14 13:22 ` Daniel P. Berrangé
2025-10-14 13:24 ` Peter Maydell
2025-09-08 15:09 ` Daniel P. Berrangé
2025-09-08 15:15 ` Peter Maydell
2025-09-24 18:16 ` Bernhard Beschow
2025-09-25 0:19 ` Philippe Mathieu-Daudé
2025-09-25 9:04 ` Peter Maydell
2025-09-25 0:14 ` Philippe Mathieu-Daudé
2025-10-13 12:09 ` Bernhard Beschow
2025-10-13 11:17 ` Bernhard Beschow
2025-09-09 5:19 ` Bernhard Beschow
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250908134221.GB167158@fedora \
--to=stefanha@redhat.com \
--cc=Alistair.Francis@wdc.com \
--cc=borntraeger@linux.ibm.com \
--cc=chenhuacai@kernel.org \
--cc=gaosong@loongson.cn \
--cc=jiaxun.yang@flygoat.com \
--cc=maobibo@loongson.cn \
--cc=marcel.apfelbaum@gmail.com \
--cc=mst@redhat.com \
--cc=palmer@dabbelt.com \
--cc=pasic@linux.ibm.com \
--cc=pbonzini@redhat.com \
--cc=peter.maydell@linaro.org \
--cc=philmd@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-ppc@nongnu.org \
--cc=qemu-riscv@nongnu.org \
--cc=qemu-s390x@nongnu.org \
--cc=shentey@gmail.com \
--cc=thuth@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.