From: "Daniel P. Berrangé" <berrange@redhat.com>
To: qemu-devel@nongnu.org
Cc: xen-devel@lists.xenproject.org, qemu-riscv@nongnu.org,
qemu-ppc@nongnu.org, qemu-block@nongnu.org,
qemu-s390x@nongnu.org, qemu-arm@nongnu.org,
"Daniel P. Berrangé" <berrange@redhat.com>
Subject: [PATCH 15/28] hw: define most common PCI types as secure
Date: Fri, 11 Sep 2026 15:36:14 +0100 [thread overview]
Message-ID: <20260911143627.2743803-16-berrange@redhat.com> (raw)
In-Reply-To: <20260911143627.2743803-1-berrange@redhat.com>
Essentially all PCI infrastructure is in scope for the virtualization
use case, aside from the niche simba bridge.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/pci-bridge/gen_pcie_root_port.c | 1 +
hw/pci-bridge/i82801b11.c | 1 +
hw/pci-bridge/ioh3420.c | 1 +
hw/pci-bridge/pci_bridge_dev.c | 2 ++
hw/pci-bridge/pci_expander_bridge.c | 8 ++++++++
hw/pci-bridge/pcie_pci_bridge.c | 1 +
hw/pci-bridge/pcie_root_port.c | 1 +
hw/pci-bridge/xio3130_downstream.c | 1 +
hw/pci-bridge/xio3130_upstream.c | 1 +
hw/pci/pci.c | 7 +++++++
hw/pci/pci_bridge.c | 1 +
hw/pci/pci_host.c | 1 +
hw/pci/pcie_host.c | 1 +
hw/pci/pcie_port.c | 1 +
14 files changed, 28 insertions(+)
diff --git a/hw/pci-bridge/gen_pcie_root_port.c b/hw/pci-bridge/gen_pcie_root_port.c
index 5434d693d9..65d29eab38 100644
--- a/hw/pci-bridge/gen_pcie_root_port.c
+++ b/hw/pci-bridge/gen_pcie_root_port.c
@@ -161,6 +161,7 @@ static const TypeInfo gen_rp_dev_info = {
.parent = TYPE_PCIE_ROOT_PORT,
.instance_size = sizeof(GenPCIERootPort),
.class_init = gen_rp_dev_class_init,
+ .secure = true,
};
static void gen_rp_register_types(void)
diff --git a/hw/pci-bridge/i82801b11.c b/hw/pci-bridge/i82801b11.c
index 1d73c14c1f..f702b20bcd 100644
--- a/hw/pci-bridge/i82801b11.c
+++ b/hw/pci-bridge/i82801b11.c
@@ -107,6 +107,7 @@ static const TypeInfo i82801b11_bridge_info = {
.parent = TYPE_PCI_BRIDGE,
.instance_size = sizeof(I82801b11Bridge),
.class_init = i82801b11_bridge_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/pci-bridge/ioh3420.c b/hw/pci-bridge/ioh3420.c
index bba640f495..2c4882c4cf 100644
--- a/hw/pci-bridge/ioh3420.c
+++ b/hw/pci-bridge/ioh3420.c
@@ -120,6 +120,7 @@ static const TypeInfo ioh3420_info = {
.name = "ioh3420",
.parent = TYPE_PCIE_ROOT_PORT,
.class_init = ioh3420_class_init,
+ .secure = true,
};
static void ioh3420_register_types(void)
diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index 0c1383562d..319e6f199a 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -268,6 +268,7 @@ static const TypeInfo pci_bridge_dev_info = {
.instance_size = sizeof(PCIBridgeDev),
.class_init = pci_bridge_dev_class_init,
.instance_finalize = pci_bridge_dev_instance_finalize,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -294,6 +295,7 @@ static const TypeInfo pci_bridge_dev_seat_info = {
.parent = TYPE_PCI_BRIDGE_DEV,
.instance_size = sizeof(PCIBridgeDev),
.class_init = pci_bridge_dev_seat_class_init,
+ .secure = true,
};
static void pci_bridge_dev_register(void)
diff --git a/hw/pci-bridge/pci_expander_bridge.c b/hw/pci-bridge/pci_expander_bridge.c
index 40ffbc4e08..bd5598b639 100644
--- a/hw/pci-bridge/pci_expander_bridge.c
+++ b/hw/pci-bridge/pci_expander_bridge.c
@@ -114,6 +114,7 @@ static const TypeInfo pxb_bus_info = {
.parent = TYPE_PCI_BUS,
.instance_size = sizeof(PXBBus),
.class_init = pxb_bus_class_init,
+ .secure = true,
};
static const TypeInfo pxb_pcie_bus_info = {
@@ -121,6 +122,7 @@ static const TypeInfo pxb_pcie_bus_info = {
.parent = TYPE_PCIE_BUS,
.instance_size = sizeof(PXBBus),
.class_init = pxb_bus_class_init,
+ .secure = true,
};
static const TypeInfo pxb_cxl_bus_info = {
@@ -128,6 +130,7 @@ static const TypeInfo pxb_cxl_bus_info = {
.parent = TYPE_CXL_BUS,
.instance_size = sizeof(PXBBus),
.class_init = pxb_bus_class_init,
+ .secure = true,
};
static const char *pxb_host_root_bus_path(PCIHostState *host_bridge,
@@ -190,6 +193,7 @@ static const TypeInfo pxb_host_info = {
.name = TYPE_PXB_HOST,
.parent = TYPE_PCI_HOST_BRIDGE,
.class_init = pxb_host_class_init,
+ .secure = true,
};
static void pxb_cxl_realize(DeviceState *dev, Error **errp)
@@ -249,6 +253,7 @@ static const TypeInfo cxl_host_info = {
.parent = TYPE_PCI_HOST_BRIDGE,
.instance_size = sizeof(CXLHost),
.class_init = pxb_cxl_host_class_init,
+ .secure = true,
};
/*
@@ -453,6 +458,7 @@ static const TypeInfo pxb_dev_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(PXBDev),
.class_init = pxb_dev_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
@@ -490,6 +496,7 @@ static const TypeInfo pxb_pcie_dev_info = {
.parent = TYPE_PXB_DEV,
.instance_size = sizeof(PXBPCIEDev),
.class_init = pxb_pcie_dev_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
@@ -540,6 +547,7 @@ static const TypeInfo pxb_cxl_dev_info = {
.parent = TYPE_PXB_PCIE_DEV,
.instance_size = sizeof(PXBCXLDev),
.class_init = pxb_cxl_dev_class_init,
+ .secure = true,
.interfaces =
(const InterfaceInfo[]){
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
diff --git a/hw/pci-bridge/pcie_pci_bridge.c b/hw/pci-bridge/pcie_pci_bridge.c
index e826fb2829..03b6b1c0f5 100644
--- a/hw/pci-bridge/pcie_pci_bridge.c
+++ b/hw/pci-bridge/pcie_pci_bridge.c
@@ -162,6 +162,7 @@ static const TypeInfo pcie_pci_bridge_info = {
.parent = TYPE_PCI_BRIDGE,
.instance_size = sizeof(PCIEPCIBridge),
.class_init = pcie_pci_bridge_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ INTERFACE_PCIE_DEVICE },
diff --git a/hw/pci-bridge/pcie_root_port.c b/hw/pci-bridge/pcie_root_port.c
index 7c3e78010b..d829c4b61a 100644
--- a/hw/pci-bridge/pcie_root_port.c
+++ b/hw/pci-bridge/pcie_root_port.c
@@ -186,6 +186,7 @@ static const TypeInfo rp_info = {
.instance_post_init = rp_instance_post_init,
.class_init = rp_class_init,
.abstract = true,
+ .secure = true,
.class_size = sizeof(PCIERootPortClass),
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
diff --git a/hw/pci-bridge/xio3130_downstream.c b/hw/pci-bridge/xio3130_downstream.c
index 0c3fed3053..ded948ebd0 100644
--- a/hw/pci-bridge/xio3130_downstream.c
+++ b/hw/pci-bridge/xio3130_downstream.c
@@ -175,6 +175,7 @@ static const TypeInfo xio3130_downstream_info = {
.name = TYPE_XIO3130_DOWNSTREAM,
.parent = TYPE_PCIE_SLOT,
.class_init = xio3130_downstream_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ }
diff --git a/hw/pci-bridge/xio3130_upstream.c b/hw/pci-bridge/xio3130_upstream.c
index 40057b749b..9d58105f8b 100644
--- a/hw/pci-bridge/xio3130_upstream.c
+++ b/hw/pci-bridge/xio3130_upstream.c
@@ -144,6 +144,7 @@ static const TypeInfo xio3130_upstream_info = {
.name = "x3130-upstream",
.parent = TYPE_PCIE_PORT,
.class_init = xio3130_upstream_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ }
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index c15f2b9f08..20d4942df2 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -319,6 +319,7 @@ static const TypeInfo pci_bus_info = {
.instance_size = sizeof(PCIBus),
.class_size = sizeof(PCIBusClass),
.class_init = pci_bus_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_FW_CFG_DATA_GENERATOR_INTERFACE },
{ }
@@ -328,16 +329,19 @@ static const TypeInfo pci_bus_info = {
static const TypeInfo cxl_interface_info = {
.name = INTERFACE_CXL_DEVICE,
.parent = TYPE_INTERFACE,
+ .secure = true,
};
static const TypeInfo pcie_interface_info = {
.name = INTERFACE_PCIE_DEVICE,
.parent = TYPE_INTERFACE,
+ .secure = true,
};
static const TypeInfo conventional_pci_interface_info = {
.name = INTERFACE_CONVENTIONAL_PCI_DEVICE,
.parent = TYPE_INTERFACE,
+ .secure = true,
};
static void pcie_bus_class_init(ObjectClass *klass, const void *data)
@@ -351,12 +355,14 @@ static const TypeInfo pcie_bus_info = {
.name = TYPE_PCIE_BUS,
.parent = TYPE_PCI_BUS,
.class_init = pcie_bus_class_init,
+ .secure = true,
};
static const TypeInfo cxl_bus_info = {
.name = TYPE_CXL_BUS,
.parent = TYPE_PCIE_BUS,
.class_init = pcie_bus_class_init,
+ .secure = true,
};
static void pci_update_mappings(PCIDevice *d);
@@ -3468,6 +3474,7 @@ static const TypeInfo pci_device_type_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(PCIDevice),
.abstract = true,
+ .secure = true,
.class_size = sizeof(PCIDeviceClass),
.class_init = pci_device_class_init,
.class_base_init = pci_device_class_base_init,
diff --git a/hw/pci/pci_bridge.c b/hw/pci/pci_bridge.c
index e85932e41a..3eb0917fc2 100644
--- a/hw/pci/pci_bridge.c
+++ b/hw/pci/pci_bridge.c
@@ -497,6 +497,7 @@ static const TypeInfo pci_bridge_type_info = {
.instance_size = sizeof(PCIBridge),
.class_init = pci_bridge_class_init,
.abstract = true,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_ACPI_DEV_AML_IF },
{ },
diff --git a/hw/pci/pci_host.c b/hw/pci/pci_host.c
index 2a7fdfa563..5dc9d8493f 100644
--- a/hw/pci/pci_host.c
+++ b/hw/pci/pci_host.c
@@ -262,6 +262,7 @@ static const TypeInfo pci_host_type_info = {
.name = TYPE_PCI_HOST_BRIDGE,
.parent = TYPE_SYS_BUS_DEVICE,
.abstract = true,
+ .secure = true,
.class_size = sizeof(PCIHostBridgeClass),
.instance_size = sizeof(PCIHostState),
.class_init = pci_host_class_init,
diff --git a/hw/pci/pcie_host.c b/hw/pci/pcie_host.c
index 3717e1a086..3cf0769d2a 100644
--- a/hw/pci/pcie_host.c
+++ b/hw/pci/pcie_host.c
@@ -124,6 +124,7 @@ static const TypeInfo pcie_host_type_info = {
.name = TYPE_PCIE_HOST_BRIDGE,
.parent = TYPE_PCI_HOST_BRIDGE,
.abstract = true,
+ .secure = true,
.instance_size = sizeof(PCIExpressHost),
.instance_init = pcie_host_init,
};
diff --git a/hw/pci/pcie_port.c b/hw/pci/pcie_port.c
index dbb6032160..8fce77bcb8 100644
--- a/hw/pci/pcie_port.c
+++ b/hw/pci/pcie_port.c
@@ -200,6 +200,7 @@ static const TypeInfo pcie_port_type_info = {
.parent = TYPE_PCI_BRIDGE,
.instance_size = sizeof(PCIEPort),
.abstract = true,
+ .secure = true,
.class_init = pcie_port_class_init,
};
--
2.55.0
next prev parent reply other threads:[~2026-09-11 14:37 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 01/28] hw: mark secure machines for x86, s390, ppc, arm, loonarch, riscv Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 02/28] accel: mark kvm and xen accelerators as secure Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 03/28] hw: mark all virtio PCI devices " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 04/28] hw: mark all virtio CCW " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 05/28] hw: mark all vhost devices a secure Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 06/28] hw: mark all remaining virtio object types as secure Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 07/28] hw/vfio: mark all VFIO object classes " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 08/28] hw/xen: mark all Xen related object types as being secure Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 09/28] hw/net: mark e1000, e1000e, IGB, rtl8139 & sPAPR VLAN as secure Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 10/28] hw/usb: mark commonly used USB devices/hosts " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 11/28] hw/watchdog: mark some watchdog devices " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 12/28] hw/scsi: mark spapr and vmware SCSI controllers " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 13/28] hw/scsi: mark SCSI disk endpoint devices " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 14/28] hw/ide: mark ICH9 and ide-hd/ide-cd " Daniel P. Berrangé
2026-09-11 14:36 ` Daniel P. Berrangé [this message]
2026-09-11 16:50 ` [PATCH 15/28] hw: define most common PCI types " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 16/28] hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 17/28] hw/display: mark bochs, cirrus, qxl, VGA, ramfb " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 18/28] hw/tpm: mark all TPM implementations " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 19/28] hw/misc: mark pvpanic, vmcoreinfo " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 20/28] hw/audio: mark Intel HDA devices & codecs " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 21/28] hw/char: mark common serial / console devicess a secure Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 22/28] hw/mem: mark nvdimm, pc-dimm & spapr-nvdimm devices as secure Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 23/28] hw/uefi: mark the EFI vars service " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 24/28] hw/acpi: mark erst, vmclock and vmgenid devices " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 25/28] hw: mark KVM clock and RTC " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 26/28] hw: device AMD, Intel and ARM IOMMUs " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 27/28] hw/input: mark PS/2 and PC Keyboard devices " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 28/28] hw/i386: mark vmmouse / vmport " Daniel P. Berrangé
2026-09-28 10:37 ` [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260911143627.2743803-16-berrange@redhat.com \
--to=berrange@redhat.com \
--cc=qemu-arm@nongnu.org \
--cc=qemu-block@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-ppc@nongnu.org \
--cc=qemu-riscv@nongnu.org \
--cc=qemu-s390x@nongnu.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.