* [PATCH v2 01/28] hw: mark all virtio PCI devices as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 02/28] hw: mark all virtio CCW " Daniel P. Berrangé
` (26 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must
provide a security boundary. This can be done for almost all virtio
PCI devices by modifying the common type register helper.
The virtio-gpu-pci-rutabaga device is unusual in not using the common
virtio_pci_types_register() method, so needs marking directly.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/display/virtio-gpu-pci-rutabaga.c | 1 +
hw/virtio/virtio-pci.c | 3 +++
2 files changed, 4 insertions(+)
diff --git a/hw/display/virtio-gpu-pci-rutabaga.c b/hw/display/virtio-gpu-pci-rutabaga.c
index 4db77cb868d..a8e5e1d96cf 100644
--- a/hw/display/virtio-gpu-pci-rutabaga.c
+++ b/hw/display/virtio-gpu-pci-rutabaga.c
@@ -34,6 +34,7 @@ static const TypeInfo virtio_gpu_rutabaga_pci_info[] = {
.parent = TYPE_VIRTIO_GPU_PCI_BASE,
.instance_size = sizeof(VirtIOGPURutabagaPCI),
.instance_init = virtio_gpu_rutabaga_initfn,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index c73f1f546cb..7e372bb8de0 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -2527,6 +2527,7 @@ void virtio_pci_types_register(const VirtioPCIDeviceTypeInfo *t)
.name = t->generic_name,
.parent = base_type_info.name,
.class_init = virtio_pci_generic_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -2562,6 +2563,7 @@ void virtio_pci_types_register(const VirtioPCIDeviceTypeInfo *t)
.name = t->non_transitional_name,
.parent = base_type_info.name,
.instance_init = virtio_pci_non_transitional_instance_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -2576,6 +2578,7 @@ void virtio_pci_types_register(const VirtioPCIDeviceTypeInfo *t)
.name = t->transitional_name,
.parent = base_type_info.name,
.instance_init = virtio_pci_transitional_instance_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
/*
* Transitional virtio devices work only as Conventional PCI
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 02/28] hw: mark all virtio CCW devices as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 01/28] hw: mark all virtio PCI devices as secure Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 03/28] hw: mark all vhost devices a secure Daniel P. Berrangé
` (25 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé, Eric Farman, Cornelia Huck
These are all intended for use in a virtualization scenario and must
provide a security boundary.
Acked-by: Eric Farman <farman@linux.ibm.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/s390x/vhost-scsi-ccw.c | 1 +
hw/s390x/vhost-user-fs-ccw.c | 1 +
hw/s390x/vhost-vsock-ccw.c | 1 +
hw/s390x/virtio-ccw-9p.c | 1 +
hw/s390x/virtio-ccw-balloon.c | 1 +
hw/s390x/virtio-ccw-blk.c | 1 +
hw/s390x/virtio-ccw-crypto.c | 1 +
hw/s390x/virtio-ccw-gpu.c | 1 +
hw/s390x/virtio-ccw-input.c | 3 +++
hw/s390x/virtio-ccw-mem.c | 1 +
hw/s390x/virtio-ccw-net.c | 1 +
hw/s390x/virtio-ccw-rng.c | 1 +
hw/s390x/virtio-ccw-scsi.c | 1 +
hw/s390x/virtio-ccw-serial.c | 1 +
14 files changed, 16 insertions(+)
diff --git a/hw/s390x/vhost-scsi-ccw.c b/hw/s390x/vhost-scsi-ccw.c
index 1e68459eb0e..2bd51a80332 100644
--- a/hw/s390x/vhost-scsi-ccw.c
+++ b/hw/s390x/vhost-scsi-ccw.c
@@ -62,6 +62,7 @@ static const TypeInfo vhost_ccw_scsi = {
.instance_size = sizeof(VHostSCSICcw),
.instance_init = vhost_ccw_scsi_instance_init,
.class_init = vhost_ccw_scsi_class_init,
+ .secure = true,
};
static void virtio_ccw_scsi_register(void)
diff --git a/hw/s390x/vhost-user-fs-ccw.c b/hw/s390x/vhost-user-fs-ccw.c
index 35a77e4cb71..6d341dc5e93 100644
--- a/hw/s390x/vhost-user-fs-ccw.c
+++ b/hw/s390x/vhost-user-fs-ccw.c
@@ -64,6 +64,7 @@ static const TypeInfo vhost_user_fs_ccw = {
.instance_size = sizeof(VHostUserFSCcw),
.instance_init = vhost_user_fs_ccw_instance_init,
.class_init = vhost_user_fs_ccw_class_init,
+ .secure = true,
};
static void vhost_user_fs_ccw_register(void)
diff --git a/hw/s390x/vhost-vsock-ccw.c b/hw/s390x/vhost-vsock-ccw.c
index efdfdeec84c..92b6d177e80 100644
--- a/hw/s390x/vhost-vsock-ccw.c
+++ b/hw/s390x/vhost-vsock-ccw.c
@@ -71,6 +71,7 @@ static const TypeInfo vhost_vsock_ccw_info = {
.instance_size = sizeof(VHostVSockCCWState),
.instance_init = vhost_vsock_ccw_instance_init,
.class_init = vhost_vsock_ccw_class_init,
+ .secure = true,
};
static void vhost_vsock_ccw_register(void)
diff --git a/hw/s390x/virtio-ccw-9p.c b/hw/s390x/virtio-ccw-9p.c
index d8612f7cd13..08d3ee577b4 100644
--- a/hw/s390x/virtio-ccw-9p.c
+++ b/hw/s390x/virtio-ccw-9p.c
@@ -64,6 +64,7 @@ static const TypeInfo virtio_ccw_9p_info = {
.instance_size = sizeof(V9fsCCWState),
.instance_init = virtio_ccw_9p_instance_init,
.class_init = virtio_ccw_9p_class_init,
+ .secure = true,
};
static void virtio_ccw_9p_register(void)
diff --git a/hw/s390x/virtio-ccw-balloon.c b/hw/s390x/virtio-ccw-balloon.c
index 4f67310b693..f7f5640cf12 100644
--- a/hw/s390x/virtio-ccw-balloon.c
+++ b/hw/s390x/virtio-ccw-balloon.c
@@ -69,6 +69,7 @@ static const TypeInfo virtio_ccw_balloon = {
.instance_size = sizeof(VirtIOBalloonCcw),
.instance_init = virtio_ccw_balloon_instance_init,
.class_init = virtio_ccw_balloon_class_init,
+ .secure = true,
};
static void virtio_ccw_balloon_register(void)
diff --git a/hw/s390x/virtio-ccw-blk.c b/hw/s390x/virtio-ccw-blk.c
index 939dcaeed38..dd4ac892b20 100644
--- a/hw/s390x/virtio-ccw-blk.c
+++ b/hw/s390x/virtio-ccw-blk.c
@@ -67,6 +67,7 @@ static const TypeInfo virtio_ccw_blk = {
.instance_size = sizeof(VirtIOBlkCcw),
.instance_init = virtio_ccw_blk_instance_init,
.class_init = virtio_ccw_blk_class_init,
+ .secure = true,
};
static void virtio_ccw_blk_register(void)
diff --git a/hw/s390x/virtio-ccw-crypto.c b/hw/s390x/virtio-ccw-crypto.c
index 2c4ee2ca394..9f274562ac1 100644
--- a/hw/s390x/virtio-ccw-crypto.c
+++ b/hw/s390x/virtio-ccw-crypto.c
@@ -67,6 +67,7 @@ static const TypeInfo virtio_ccw_crypto = {
.instance_size = sizeof(VirtIOCryptoCcw),
.instance_init = virtio_ccw_crypto_instance_init,
.class_init = virtio_ccw_crypto_class_init,
+ .secure = true,
};
static void virtio_ccw_crypto_register(void)
diff --git a/hw/s390x/virtio-ccw-gpu.c b/hw/s390x/virtio-ccw-gpu.c
index 4120c6bcb9f..79c302860f7 100644
--- a/hw/s390x/virtio-ccw-gpu.c
+++ b/hw/s390x/virtio-ccw-gpu.c
@@ -66,6 +66,7 @@ static const TypeInfo virtio_ccw_gpu = {
.instance_size = sizeof(VirtIOGPUCcw),
.instance_init = virtio_ccw_gpu_instance_init,
.class_init = virtio_ccw_gpu_class_init,
+ .secure = true,
};
module_obj(TYPE_VIRTIO_GPU_CCW);
module_kconfig(VIRTIO_CCW);
diff --git a/hw/s390x/virtio-ccw-input.c b/hw/s390x/virtio-ccw-input.c
index a9ec60428ca..532f230617d 100644
--- a/hw/s390x/virtio-ccw-input.c
+++ b/hw/s390x/virtio-ccw-input.c
@@ -110,6 +110,7 @@ static const TypeInfo virtio_ccw_keyboard = {
.parent = TYPE_VIRTIO_INPUT_HID_CCW,
.instance_size = sizeof(VirtIOInputHIDCcw),
.instance_init = virtio_ccw_keyboard_instance_init,
+ .secure = true,
};
static const TypeInfo virtio_ccw_mouse = {
@@ -117,6 +118,7 @@ static const TypeInfo virtio_ccw_mouse = {
.parent = TYPE_VIRTIO_INPUT_HID_CCW,
.instance_size = sizeof(VirtIOInputHIDCcw),
.instance_init = virtio_ccw_mouse_instance_init,
+ .secure = true,
};
static const TypeInfo virtio_ccw_tablet = {
@@ -124,6 +126,7 @@ static const TypeInfo virtio_ccw_tablet = {
.parent = TYPE_VIRTIO_INPUT_HID_CCW,
.instance_size = sizeof(VirtIOInputHIDCcw),
.instance_init = virtio_ccw_tablet_instance_init,
+ .secure = true,
};
static void virtio_ccw_input_register(void)
diff --git a/hw/s390x/virtio-ccw-mem.c b/hw/s390x/virtio-ccw-mem.c
index dea30aacfb3..7014f0f92e6 100644
--- a/hw/s390x/virtio-ccw-mem.c
+++ b/hw/s390x/virtio-ccw-mem.c
@@ -216,6 +216,7 @@ static const TypeInfo virtio_ccw_mem = {
.instance_size = sizeof(VirtIOMEMCcw),
.instance_init = virtio_ccw_mem_instance_init,
.class_init = virtio_ccw_mem_class_init,
+ .secure = true,
};
static void virtio_ccw_mem_register_types(void)
diff --git a/hw/s390x/virtio-ccw-net.c b/hw/s390x/virtio-ccw-net.c
index 30e7055ab2b..d39311a9f01 100644
--- a/hw/s390x/virtio-ccw-net.c
+++ b/hw/s390x/virtio-ccw-net.c
@@ -70,6 +70,7 @@ static const TypeInfo virtio_ccw_net = {
.instance_size = sizeof(VirtIONetCcw),
.instance_init = virtio_ccw_net_instance_init,
.class_init = virtio_ccw_net_class_init,
+ .secure = true,
};
static void virtio_ccw_net_register(void)
diff --git a/hw/s390x/virtio-ccw-rng.c b/hw/s390x/virtio-ccw-rng.c
index 0647621e33d..8b62fd99056 100644
--- a/hw/s390x/virtio-ccw-rng.c
+++ b/hw/s390x/virtio-ccw-rng.c
@@ -66,6 +66,7 @@ static const TypeInfo virtio_ccw_rng = {
.instance_size = sizeof(VirtIORNGCcw),
.instance_init = virtio_ccw_rng_instance_init,
.class_init = virtio_ccw_rng_class_init,
+ .secure = true,
};
static void virtio_ccw_rng_register(void)
diff --git a/hw/s390x/virtio-ccw-scsi.c b/hw/s390x/virtio-ccw-scsi.c
index c181a2b7692..baac329d75c 100644
--- a/hw/s390x/virtio-ccw-scsi.c
+++ b/hw/s390x/virtio-ccw-scsi.c
@@ -76,6 +76,7 @@ static const TypeInfo virtio_ccw_scsi = {
.instance_size = sizeof(VirtIOSCSICcw),
.instance_init = virtio_ccw_scsi_instance_init,
.class_init = virtio_ccw_scsi_class_init,
+ .secure = true,
};
static void virtio_ccw_scsi_register(void)
diff --git a/hw/s390x/virtio-ccw-serial.c b/hw/s390x/virtio-ccw-serial.c
index 7ff07a08412..9a1686a4dc3 100644
--- a/hw/s390x/virtio-ccw-serial.c
+++ b/hw/s390x/virtio-ccw-serial.c
@@ -76,6 +76,7 @@ static const TypeInfo virtio_ccw_serial = {
.instance_size = sizeof(VirtioSerialCcw),
.instance_init = virtio_ccw_serial_instance_init,
.class_init = virtio_ccw_serial_class_init,
+ .secure = true,
};
static void virtio_ccw_serial_register(void)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 03/28] hw: mark all vhost devices a secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 01/28] hw: mark all virtio PCI devices as secure Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 02/28] hw: mark all virtio CCW " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 04/28] hw: mark all remaining virtio object types as secure Daniel P. Berrangé
` (24 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must
provide a security boundary.
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/block/vhost-user-blk.c | 1 +
hw/display/vhost-user-gpu.c | 1 +
hw/scsi/vhost-scsi.c | 1 +
hw/scsi/vhost-user-scsi.c | 1 +
hw/virtio/vhost-user-fs.c | 1 +
hw/virtio/vhost-user-gpio.c | 1 +
hw/virtio/vhost-user-i2c.c | 1 +
hw/virtio/vhost-user-input.c | 1 +
hw/virtio/vhost-user-rng.c | 1 +
hw/virtio/vhost-user-rtc.c | 1 +
hw/virtio/vhost-user-scmi.c | 1 +
hw/virtio/vhost-user-snd.c | 1 +
hw/virtio/vhost-user-spi.c | 1 +
hw/virtio/vhost-user-test-device.c | 1 +
hw/virtio/vhost-user-vsock.c | 1 +
hw/virtio/vhost-vsock.c | 1 +
16 files changed, 16 insertions(+)
diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c
index 1352a0cf578..d1d10427201 100644
--- a/hw/block/vhost-user-blk.c
+++ b/hw/block/vhost-user-blk.c
@@ -697,6 +697,7 @@ static const TypeInfo vhost_user_blk_info = {
.instance_size = sizeof(VHostUserBlk),
.instance_init = vhost_user_blk_instance_init,
.class_init = vhost_user_blk_class_init,
+ .secure = true,
};
static void vhost_user_blk_set_inflight_migration(Object *obj, Visitor *v,
diff --git a/hw/display/vhost-user-gpu.c b/hw/display/vhost-user-gpu.c
index c09aca04113..32e7d9638f6 100644
--- a/hw/display/vhost-user-gpu.c
+++ b/hw/display/vhost-user-gpu.c
@@ -726,6 +726,7 @@ static const TypeInfo vhost_user_gpu_info = {
.instance_init = vhost_user_gpu_instance_init,
.instance_finalize = vhost_user_gpu_instance_finalize,
.class_init = vhost_user_gpu_class_init,
+ .secure = true,
};
module_obj(TYPE_VHOST_USER_GPU);
module_kconfig(VHOST_USER_GPU);
diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index 657403cad01..e1f209fabb3 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -400,6 +400,7 @@ static const TypeInfo vhost_scsi_info = {
.instance_size = sizeof(VHostSCSI),
.class_init = vhost_scsi_class_init,
.instance_init = vhost_scsi_instance_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_FW_PATH_PROVIDER },
{ }
diff --git a/hw/scsi/vhost-user-scsi.c b/hw/scsi/vhost-user-scsi.c
index 7687f2804f8..4374a54962b 100644
--- a/hw/scsi/vhost-user-scsi.c
+++ b/hw/scsi/vhost-user-scsi.c
@@ -426,6 +426,7 @@ static const TypeInfo vhost_user_scsi_info = {
.instance_size = sizeof(VHostUserSCSI),
.class_init = vhost_user_scsi_class_init,
.instance_init = vhost_user_scsi_instance_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_FW_PATH_PROVIDER },
{ }
diff --git a/hw/virtio/vhost-user-fs.c b/hw/virtio/vhost-user-fs.c
index 0d8842817a1..3a97038ee7b 100644
--- a/hw/virtio/vhost-user-fs.c
+++ b/hw/virtio/vhost-user-fs.c
@@ -448,6 +448,7 @@ static const TypeInfo vuf_info = {
.instance_size = sizeof(VHostUserFS),
.instance_init = vuf_instance_init,
.class_init = vuf_class_init,
+ .secure = true,
};
static void vuf_register_types(void)
diff --git a/hw/virtio/vhost-user-gpio.c b/hw/virtio/vhost-user-gpio.c
index d473f870778..cec21106e0b 100644
--- a/hw/virtio/vhost-user-gpio.c
+++ b/hw/virtio/vhost-user-gpio.c
@@ -53,6 +53,7 @@ static const TypeInfo vu_gpio_info = {
.parent = TYPE_VHOST_USER_BASE,
.instance_size = sizeof(VHostUserGPIO),
.class_init = vu_gpio_class_init,
+ .secure = true,
};
static void vu_gpio_register_types(void)
diff --git a/hw/virtio/vhost-user-i2c.c b/hw/virtio/vhost-user-i2c.c
index 152b1f67401..17b0b444139 100644
--- a/hw/virtio/vhost-user-i2c.c
+++ b/hw/virtio/vhost-user-i2c.c
@@ -53,6 +53,7 @@ static const TypeInfo vu_i2c_info = {
.parent = TYPE_VHOST_USER_BASE,
.instance_size = sizeof(VHostUserI2C),
.class_init = vu_i2c_class_init,
+ .secure = true,
};
static void vu_i2c_register_types(void)
diff --git a/hw/virtio/vhost-user-input.c b/hw/virtio/vhost-user-input.c
index 5cfc5bbb564..a850e3770e0 100644
--- a/hw/virtio/vhost-user-input.c
+++ b/hw/virtio/vhost-user-input.c
@@ -47,6 +47,7 @@ static const TypeInfo vhost_input_info = {
.parent = TYPE_VHOST_USER_BASE,
.instance_size = sizeof(VHostUserInput),
.class_init = vhost_input_class_init,
+ .secure = true,
};
static void vhost_input_register_types(void)
diff --git a/hw/virtio/vhost-user-rng.c b/hw/virtio/vhost-user-rng.c
index 106c8f211aa..dc1286559cf 100644
--- a/hw/virtio/vhost-user-rng.c
+++ b/hw/virtio/vhost-user-rng.c
@@ -55,6 +55,7 @@ static const TypeInfo vu_rng_info = {
.parent = TYPE_VHOST_USER_BASE,
.instance_size = sizeof(VHostUserRNG),
.class_init = vu_rng_class_init,
+ .secure = true,
};
static void vu_rng_register_types(void)
diff --git a/hw/virtio/vhost-user-rtc.c b/hw/virtio/vhost-user-rtc.c
index 88b0c70b903..2cb949590ec 100644
--- a/hw/virtio/vhost-user-rtc.c
+++ b/hw/virtio/vhost-user-rtc.c
@@ -54,6 +54,7 @@ static const TypeInfo vu_rtc_info = {
.parent = TYPE_VHOST_USER_BASE,
.instance_size = sizeof(VHostUserRTC),
.class_init = vu_rtc_class_init,
+ .secure = true,
};
static void vu_rtc_register_types(void)
diff --git a/hw/virtio/vhost-user-scmi.c b/hw/virtio/vhost-user-scmi.c
index 29d37716b3c..ad5c176c1e2 100644
--- a/hw/virtio/vhost-user-scmi.c
+++ b/hw/virtio/vhost-user-scmi.c
@@ -311,6 +311,7 @@ static const TypeInfo vu_scmi_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VHostUserSCMI),
.class_init = vu_scmi_class_init,
+ .secure = true,
};
static void vu_scmi_register_types(void)
diff --git a/hw/virtio/vhost-user-snd.c b/hw/virtio/vhost-user-snd.c
index 7129b77d9c0..3695534aa2c 100644
--- a/hw/virtio/vhost-user-snd.c
+++ b/hw/virtio/vhost-user-snd.c
@@ -72,6 +72,7 @@ static const TypeInfo vu_snd_info = {
.parent = TYPE_VHOST_USER_BASE,
.instance_size = sizeof(VHostUserSound),
.class_init = vu_snd_class_init,
+ .secure = true,
};
static void vu_snd_register_types(void)
diff --git a/hw/virtio/vhost-user-spi.c b/hw/virtio/vhost-user-spi.c
index 707f96c2505..58d5fd7b469 100644
--- a/hw/virtio/vhost-user-spi.c
+++ b/hw/virtio/vhost-user-spi.c
@@ -55,6 +55,7 @@ static const TypeInfo vu_spi_info = {
.parent = TYPE_VHOST_USER_BASE,
.instance_size = sizeof(VHostUserSPI),
.class_init = vu_spi_class_init,
+ .secure = true,
};
static void vu_spi_register_types(void)
diff --git a/hw/virtio/vhost-user-test-device.c b/hw/virtio/vhost-user-test-device.c
index a2f963fdf60..73da8af48a8 100644
--- a/hw/virtio/vhost-user-test-device.c
+++ b/hw/virtio/vhost-user-test-device.c
@@ -50,6 +50,7 @@ static const TypeInfo vud_info = {
.name = TYPE_VHOST_USER_TEST_DEVICE,
.parent = TYPE_VHOST_USER_BASE,
.class_init = vud_class_init,
+ .secure = true,
};
static void vu_register_types(void)
diff --git a/hw/virtio/vhost-user-vsock.c b/hw/virtio/vhost-user-vsock.c
index c2cd376e732..e10ceb95cb2 100644
--- a/hw/virtio/vhost-user-vsock.c
+++ b/hw/virtio/vhost-user-vsock.c
@@ -175,6 +175,7 @@ static const TypeInfo vuv_info = {
.parent = TYPE_VHOST_VSOCK_COMMON,
.instance_size = sizeof(VHostUserVSock),
.class_init = vuv_class_init,
+ .secure = true,
};
static void vuv_register_types(void)
diff --git a/hw/virtio/vhost-vsock.c b/hw/virtio/vhost-vsock.c
index da244eb1657..66a17ee15ff 100644
--- a/hw/virtio/vhost-vsock.c
+++ b/hw/virtio/vhost-vsock.c
@@ -225,6 +225,7 @@ static const TypeInfo vhost_vsock_info = {
.parent = TYPE_VHOST_VSOCK_COMMON,
.instance_size = sizeof(VHostVSock),
.class_init = vhost_vsock_class_init,
+ .secure = true,
};
static void vhost_vsock_register_types(void)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 04/28] hw: mark all remaining virtio object types as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (2 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 03/28] hw: mark all vhost devices a secure Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 05/28] hw/vfio: mark all VFIO object classes " Daniel P. Berrangé
` (23 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must
provide a security boundary.
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/9pfs/virtio-9p-device.c | 1 +
hw/audio/virtio-snd.c | 1 +
hw/block/virtio-blk.c | 1 +
hw/char/virtio-console.c | 2 ++
hw/char/virtio-serial-bus.c | 2 ++
hw/display/virtio-gpu-gl.c | 1 +
hw/display/virtio-gpu-rutabaga.c | 1 +
hw/display/virtio-gpu.c | 1 +
hw/input/virtio-input-hid.c | 4 ++++
hw/input/virtio-input-host.c | 1 +
hw/net/virtio-net.c | 1 +
hw/scsi/virtio-scsi.c | 1 +
hw/virtio/vdpa-dev.c | 1 +
hw/virtio/virtio-balloon.c | 1 +
hw/virtio/virtio-crypto.c | 1 +
hw/virtio/virtio-iommu.c | 2 ++
hw/virtio/virtio-mem.c | 1 +
hw/virtio/virtio-mmio.c | 2 ++
hw/virtio/virtio-nsm.c | 1 +
hw/virtio/virtio-pmem.c | 1 +
hw/virtio/virtio-rng.c | 1 +
hw/virtio/virtio-rtc.c | 1 +
22 files changed, 29 insertions(+)
diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
index 2774fc2290a..a4572c851df 100644
--- a/hw/9pfs/virtio-9p-device.c
+++ b/hw/9pfs/virtio-9p-device.c
@@ -288,6 +288,7 @@ static const TypeInfo virtio_device_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(V9fsVirtioState),
.class_init = virtio_9p_class_init,
+ .secure = true,
};
static void virtio_9p_register_types(void)
diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index 6df7ea0eb04..0e3d5ec6aba 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -1536,6 +1536,7 @@ static const TypeInfo virtio_snd_types[] = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIOSound),
.class_init = virtio_snd_class_init,
+ .secure = true,
}
};
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index 536d71a91ad..b15ab8e5450 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -2071,6 +2071,7 @@ static const TypeInfo virtio_blk_info = {
.instance_init = virtio_blk_instance_init,
.class_init = virtio_blk_class_init,
.class_size = sizeof(VirtIOBlkClass),
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/char/virtio-console.c b/hw/char/virtio-console.c
index db9d8ca797f..cd42cbe7646 100644
--- a/hw/char/virtio-console.c
+++ b/hw/char/virtio-console.c
@@ -295,6 +295,7 @@ static const TypeInfo virtconsole_info = {
.name = "virtconsole",
.parent = TYPE_VIRTIO_CONSOLE_SERIAL_PORT,
.class_init = virtconsole_class_init,
+ .secure = true,
};
static const Property virtserialport_properties[] = {
@@ -320,6 +321,7 @@ static const TypeInfo virtserialport_info = {
.parent = TYPE_VIRTIO_SERIAL_PORT,
.instance_size = sizeof(VirtConsole),
.class_init = virtserialport_class_init,
+ .secure = true,
};
static void virtconsole_register_types(void)
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index 882765ac88a..7fe90571249 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -915,6 +915,7 @@ static const TypeInfo virtser_bus_info = {
.parent = TYPE_BUS,
.instance_size = sizeof(VirtIOSerialBus),
.class_init = virtser_bus_class_init,
+ .secure = true,
};
#ifdef CONFIG_HMP
@@ -1250,6 +1251,7 @@ static const TypeInfo virtio_device_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIOSerial),
.class_init = virtio_serial_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
diff --git a/hw/display/virtio-gpu-gl.c b/hw/display/virtio-gpu-gl.c
index 2b7a41c4664..75174b6731f 100644
--- a/hw/display/virtio-gpu-gl.c
+++ b/hw/display/virtio-gpu-gl.c
@@ -233,6 +233,7 @@ static const TypeInfo virtio_gpu_gl_info = {
.parent = TYPE_VIRTIO_GPU,
.instance_size = sizeof(VirtIOGPUGL),
.class_init = virtio_gpu_gl_class_init,
+ .secure = true,
};
module_obj(TYPE_VIRTIO_GPU_GL);
module_kconfig(VIRTIO_GPU);
diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutabaga.c
index 1312a67d701..424f1e3556f 100644
--- a/hw/display/virtio-gpu-rutabaga.c
+++ b/hw/display/virtio-gpu-rutabaga.c
@@ -1169,6 +1169,7 @@ static const TypeInfo virtio_gpu_rutabaga_info[] = {
.parent = TYPE_VIRTIO_GPU,
.instance_size = sizeof(VirtIOGPURutabaga),
.class_init = virtio_gpu_rutabaga_class_init,
+ .secure = true,
},
};
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 5d43ffb9918..d248e50abcb 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1995,6 +1995,7 @@ static const TypeInfo virtio_gpu_info = {
.instance_size = sizeof(VirtIOGPU),
.class_size = sizeof(VirtIOGPUClass),
.class_init = virtio_gpu_class_init,
+ .secure = true,
};
module_obj(TYPE_VIRTIO_GPU);
module_kconfig(VIRTIO_GPU);
diff --git a/hw/input/virtio-input-hid.c b/hw/input/virtio-input-hid.c
index 1019d6b2e53..38c338d836c 100644
--- a/hw/input/virtio-input-hid.c
+++ b/hw/input/virtio-input-hid.c
@@ -315,6 +315,7 @@ static const TypeInfo virtio_keyboard_info = {
.parent = TYPE_VIRTIO_INPUT_HID,
.instance_size = sizeof(VirtIOInputHID),
.instance_init = virtio_keyboard_init,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
@@ -369,6 +370,7 @@ static const TypeInfo virtio_mouse_info = {
.parent = TYPE_VIRTIO_INPUT_HID,
.instance_size = sizeof(VirtIOInputHID),
.instance_init = virtio_mouse_init,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
@@ -442,6 +444,7 @@ static const TypeInfo virtio_tablet_info = {
.parent = TYPE_VIRTIO_INPUT_HID,
.instance_size = sizeof(VirtIOInputHID),
.instance_init = virtio_tablet_init,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
@@ -527,6 +530,7 @@ static const TypeInfo virtio_multitouch_info = {
.parent = TYPE_VIRTIO_INPUT_HID,
.instance_size = sizeof(VirtIOInputHID),
.instance_init = virtio_multitouch_init,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
diff --git a/hw/input/virtio-input-host.c b/hw/input/virtio-input-host.c
index 633547cc4f7..0d01e00cfcb 100644
--- a/hw/input/virtio-input-host.c
+++ b/hw/input/virtio-input-host.c
@@ -248,6 +248,7 @@ static const TypeInfo virtio_input_host_info = {
.instance_size = sizeof(VirtIOInputHost),
.instance_init = virtio_input_host_init,
.class_init = virtio_input_host_class_init,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 19f453fb7df..85472038aca 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -4491,6 +4491,7 @@ static const TypeInfo virtio_net_info = {
.instance_size = sizeof(VirtIONet),
.instance_init = virtio_net_instance_init,
.class_init = virtio_net_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index d7e2662aa73..ef5cc7a6ce8 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -1456,6 +1456,7 @@ static const TypeInfo virtio_scsi_info = {
.parent = TYPE_VIRTIO_SCSI_COMMON,
.instance_size = sizeof(VirtIOSCSI),
.class_init = virtio_scsi_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c
index 7e5cc040e94..50811f79c07 100644
--- a/hw/virtio/vdpa-dev.c
+++ b/hw/virtio/vdpa-dev.c
@@ -392,6 +392,7 @@ static const TypeInfo vhost_vdpa_device_info = {
.instance_size = sizeof(VhostVdpaDevice),
.class_init = vhost_vdpa_device_class_init,
.instance_init = vhost_vdpa_device_instance_init,
+ .secure = true,
};
static void register_vhost_vdpa_device_type(void)
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index 07d519cf6d7..cb9928b16a4 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -1100,6 +1100,7 @@ static const TypeInfo virtio_balloon_info = {
.instance_size = sizeof(VirtIOBalloon),
.instance_init = virtio_balloon_instance_init,
.class_init = virtio_balloon_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
index 85c7279aae2..8968d9f293e 100644
--- a/hw/virtio/virtio-crypto.c
+++ b/hw/virtio/virtio-crypto.c
@@ -1313,6 +1313,7 @@ static const TypeInfo virtio_crypto_info = {
.instance_size = sizeof(VirtIOCrypto),
.instance_init = virtio_crypto_instance_init,
.class_init = virtio_crypto_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index 208815096fc..664d1c0b6b9 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -1749,12 +1749,14 @@ static const TypeInfo virtio_iommu_info = {
.instance_size = sizeof(VirtIOIOMMU),
.instance_init = virtio_iommu_instance_init,
.class_init = virtio_iommu_class_init,
+ .secure = true,
};
static const TypeInfo virtio_iommu_memory_region_info = {
.parent = TYPE_IOMMU_MEMORY_REGION,
.name = TYPE_VIRTIO_IOMMU_MEMORY_REGION,
.class_init = virtio_iommu_memory_region_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index 7130ed852d9..edad9465cb1 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -1668,6 +1668,7 @@ static const TypeInfo virtio_mem_info = {
.instance_finalize = virtio_mem_instance_finalize,
.class_init = virtio_mem_class_init,
.class_size = sizeof(VirtIOMEMClass),
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_RAM_DISCARD_SOURCE },
{ }
diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
index 55ceaeef5fc..f51c8d17b9a 100644
--- a/hw/virtio/virtio-mmio.c
+++ b/hw/virtio/virtio-mmio.c
@@ -779,6 +779,7 @@ static const TypeInfo virtio_mmio_info = {
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(VirtIOMMIOProxy),
.class_init = virtio_mmio_class_init,
+ .secure = true,
};
/* virtio-mmio-bus. */
@@ -848,6 +849,7 @@ static const TypeInfo virtio_mmio_bus_info = {
.parent = TYPE_VIRTIO_BUS,
.instance_size = sizeof(VirtioBusState),
.class_init = virtio_mmio_bus_class_init,
+ .secure = true,
};
static void virtio_mmio_register_types(void)
diff --git a/hw/virtio/virtio-nsm.c b/hw/virtio/virtio-nsm.c
index 3bf5e7009a4..099342f3792 100644
--- a/hw/virtio/virtio-nsm.c
+++ b/hw/virtio/virtio-nsm.c
@@ -1727,6 +1727,7 @@ static const TypeInfo virtio_nsm_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIONSM),
.class_init = virtio_nsm_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-pmem.c b/hw/virtio/virtio-pmem.c
index 6f7271c140a..1a414d7ba29 100644
--- a/hw/virtio/virtio-pmem.c
+++ b/hw/virtio/virtio-pmem.c
@@ -196,6 +196,7 @@ static const TypeInfo virtio_pmem_info = {
.class_size = sizeof(VirtIOPMEMClass),
.class_init = virtio_pmem_class_init,
.instance_size = sizeof(VirtIOPMEM),
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-rng.c b/hw/virtio/virtio-rng.c
index d68d9011953..ba80138179b 100644
--- a/hw/virtio/virtio-rng.c
+++ b/hw/virtio/virtio-rng.c
@@ -282,6 +282,7 @@ static const TypeInfo virtio_rng_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIORNG),
.class_init = virtio_rng_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-rtc.c b/hw/virtio/virtio-rtc.c
index 0dcbe94758a..633bff8ac2c 100644
--- a/hw/virtio/virtio-rtc.c
+++ b/hw/virtio/virtio-rtc.c
@@ -181,6 +181,7 @@ static const TypeInfo virtio_rtc_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIORtc),
.class_init = virtio_rtc_class_init,
+ .secure = true,
};
static void virtio_rtc_register_types(void)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 05/28] hw/vfio: mark all VFIO object classes as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (3 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 04/28] hw: mark all remaining virtio object types as secure Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 06/28] hw/xen: mark all Xen related object types as being secure Daniel P. Berrangé
` (22 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé, Cornelia Huck
The VFIO subsystem is about securely passing host PCI devices
to a guest, so all the classes should be presumed to be offering
a security boundary.
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: Cornelia Huck <cohuck@redhat.com> #s390 types
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/vfio-user/pci.c | 1 +
hw/vfio/ap.c | 1 +
hw/vfio/ccw.c | 1 +
hw/vfio/igd.c | 1 +
hw/vfio/iommufd.c | 2 ++
hw/vfio/pci.c | 2 ++
hw/vfio/spapr.c | 1 +
7 files changed, 9 insertions(+)
diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index 983e1d4ad47..d8965fd02ee 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -487,6 +487,7 @@ static const TypeInfo vfio_user_pci_info = {
.class_init = vfio_user_pci_class_init,
.instance_init = vfio_user_pci_init,
.instance_finalize = vfio_user_pci_finalize,
+ .secure = true,
};
static void register_vfio_user_dev_type(void)
diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
index 2926e04ad49..45d67b8ba70 100644
--- a/hw/vfio/ap.c
+++ b/hw/vfio/ap.c
@@ -356,6 +356,7 @@ static const TypeInfo vfio_ap_info = {
.instance_size = sizeof(VFIOAPDevice),
.instance_init = vfio_ap_instance_init,
.class_init = vfio_ap_class_init,
+ .secure = true,
};
static void vfio_ap_type_init(void)
diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
index 8e29a3ae613..6d71e196ee0 100644
--- a/hw/vfio/ccw.c
+++ b/hw/vfio/ccw.c
@@ -723,6 +723,7 @@ static const TypeInfo vfio_ccw_info = {
.instance_size = sizeof(VFIOCCWDevice),
.instance_init = vfio_ccw_instance_init,
.class_init = vfio_ccw_class_init,
+ .secure = true,
};
static void register_vfio_ccw_type(void)
diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index 4c7d6545924..df70cdd9403 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -313,6 +313,7 @@ static const TypeInfo vfio_pci_igd_lpc_bridge_info = {
.name = "vfio-pci-igd-lpc-bridge",
.parent = TYPE_PCI_DEVICE,
.class_init = vfio_pci_igd_lpc_bridge_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index de482128bf1..ab466b513ec 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -1061,10 +1061,12 @@ static const TypeInfo types[] = {
.parent = TYPE_VFIO_IOMMU,
.instance_size = sizeof(VFIOIOMMUFDContainer),
.class_init = vfio_iommu_iommufd_class_init,
+ .secure = true,
}, {
.name = TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO,
.parent = TYPE_HOST_IOMMU_DEVICE_IOMMUFD,
.class_init = hiod_iommufd_vfio_class_init,
+ .secure = true,
}
};
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 428ab2f0698..03ab5bd0f48 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -4110,6 +4110,7 @@ static const TypeInfo vfio_pci_info = {
.class_init = vfio_pci_class_init,
.instance_init = vfio_pci_init,
.instance_finalize = vfio_pci_finalize,
+ .secure = true,
};
static const Property vfio_pci_nohotplug_properties[] = {
@@ -4146,6 +4147,7 @@ static const TypeInfo vfio_pci_nohotplug_info = {
.parent = TYPE_VFIO_PCI,
.instance_size = sizeof(VFIOPCIDevice),
.class_init = vfio_pci_nohotplug_class_init,
+ .secure = true,
};
static void register_vfio_pci_dev_type(void)
diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index 42690e4323d..1027c434c07 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -544,6 +544,7 @@ static const TypeInfo types[] = {
.parent = TYPE_VFIO_IOMMU_LEGACY,
.instance_size = sizeof(VFIOSpaprContainer),
.class_init = vfio_iommu_spapr_class_init,
+ .secure = true,
},
};
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 06/28] hw/xen: mark all Xen related object types as being secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (4 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 05/28] hw/vfio: mark all VFIO object classes " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 07/28] hw/net: mark e1000, e1000e, IGB, rtl8139 & sPAPR VLAN as secure Daniel P. Berrangé
` (21 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
All Xen paravirtualized devices are intended to provide a host /
guest security barrier, so mark all Xen object types as scure.
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/block/xen-block.c | 2 ++
hw/char/xen_console.c | 1 +
hw/i386/xen/xen-hvm.c | 1 +
hw/i386/xen/xen_platform.c | 1 +
hw/i386/xen/xen_pvdevice.c | 1 +
hw/net/xen_nic.c | 1 +
hw/xen/xen-bus.c | 2 ++
hw/xen/xen-legacy-backend.c | 3 +++
hw/xen/xen_pt.c | 1 +
9 files changed, 13 insertions(+)
diff --git a/hw/block/xen-block.c b/hw/block/xen-block.c
index 474c12fe4ac..6e5ae2b52d9 100644
--- a/hw/block/xen-block.c
+++ b/hw/block/xen-block.c
@@ -740,6 +740,7 @@ static const TypeInfo xen_disk_type_info = {
.parent = TYPE_XEN_BLOCK_DEVICE,
.instance_size = sizeof(XenDiskDevice),
.class_init = xen_disk_class_init,
+ .secure = true,
};
static void xen_cdrom_unrealize(XenBlockDevice *blockdev)
@@ -787,6 +788,7 @@ static const TypeInfo xen_cdrom_type_info = {
.parent = TYPE_XEN_BLOCK_DEVICE,
.instance_size = sizeof(XenCDRomDevice),
.class_init = xen_cdrom_class_init,
+ .secure = true,
};
static void xen_block_register_types(void)
diff --git a/hw/char/xen_console.c b/hw/char/xen_console.c
index bdeb76dc870..df6a708494d 100644
--- a/hw/char/xen_console.c
+++ b/hw/char/xen_console.c
@@ -513,6 +513,7 @@ static const TypeInfo xen_console_type_info = {
.parent = TYPE_XEN_DEVICE,
.instance_size = sizeof(XenConsole),
.class_init = xen_console_class_init,
+ .secure = true,
};
static void xen_console_register_types(void)
diff --git a/hw/i386/xen/xen-hvm.c b/hw/i386/xen/xen-hvm.c
index b2378fe3f05..f7a154b8307 100644
--- a/hw/i386/xen/xen-hvm.c
+++ b/hw/i386/xen/xen-hvm.c
@@ -792,6 +792,7 @@ static const TypeInfo xen_i8259_type_infos[] = {
.name = TYPE_XEN_I8259_PIC,
.parent = TYPE_DEVICE,
.instance_init = xen_i8259_pic_init,
+ .secure = true,
},
};
diff --git a/hw/i386/xen/xen_platform.c b/hw/i386/xen/xen_platform.c
index c8b852be0cc..ec0084d6fb8 100644
--- a/hw/i386/xen/xen_platform.c
+++ b/hw/i386/xen/xen_platform.c
@@ -604,6 +604,7 @@ static const TypeInfo xen_platform_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(PCIXenPlatformState),
.class_init = xen_platform_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/i386/xen/xen_pvdevice.c b/hw/i386/xen/xen_pvdevice.c
index fab26a06af1..74636046d0c 100644
--- a/hw/i386/xen/xen_pvdevice.c
+++ b/hw/i386/xen/xen_pvdevice.c
@@ -139,6 +139,7 @@ static const TypeInfo xen_pv_type_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(XenPVDevice),
.class_init = xen_pv_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/net/xen_nic.c b/hw/net/xen_nic.c
index f4d0b060130..e615303da6a 100644
--- a/hw/net/xen_nic.c
+++ b/hw/net/xen_nic.c
@@ -579,6 +579,7 @@ static const TypeInfo xen_net_type_info = {
.parent = TYPE_XEN_DEVICE,
.instance_size = sizeof(XenNetDev),
.class_init = xen_netdev_class_init,
+ .secure = true,
};
static void xen_net_register_types(void)
diff --git a/hw/xen/xen-bus.c b/hw/xen/xen-bus.c
index 8def3bb68bc..17bbbe2ea71 100644
--- a/hw/xen/xen-bus.c
+++ b/hw/xen/xen-bus.c
@@ -404,6 +404,7 @@ static const TypeInfo xen_bus_type_info = {
.instance_size = sizeof(XenBus),
.class_size = sizeof(XenBusClass),
.class_init = xen_bus_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
@@ -1141,6 +1142,7 @@ static const TypeInfo xen_bridge_type_info = {
.name = TYPE_XEN_BRIDGE,
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(XenBridge),
+ .secure = true,
};
static void xen_register_types(void)
diff --git a/hw/xen/xen-legacy-backend.c b/hw/xen/xen-legacy-backend.c
index 7977b527127..75f8ac7efde 100644
--- a/hw/xen/xen-legacy-backend.c
+++ b/hw/xen/xen-legacy-backend.c
@@ -648,6 +648,7 @@ static const TypeInfo xendev_type_info = {
.parent = TYPE_DYNAMIC_SYS_BUS_DEVICE,
.class_init = xendev_class_init,
.instance_size = sizeof(XenLegacyDevice),
+ .secure = true,
};
static void xen_sysbus_class_init(ObjectClass *klass, const void *data)
@@ -661,6 +662,7 @@ static const TypeInfo xensysbus_info = {
.name = TYPE_XENSYSBUS,
.parent = TYPE_BUS,
.class_init = xen_sysbus_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
@@ -670,6 +672,7 @@ static const TypeInfo xensysbus_info = {
static const TypeInfo xensysdev_info = {
.name = TYPE_XENSYSDEV,
.parent = TYPE_SYS_BUS_DEVICE,
+ .secure = true,
};
static void xenbe_register_types(void)
diff --git a/hw/xen/xen_pt.c b/hw/xen/xen_pt.c
index 0fe9c0aada8..504c5593188 100644
--- a/hw/xen/xen_pt.c
+++ b/hw/xen/xen_pt.c
@@ -1079,6 +1079,7 @@ static const TypeInfo xen_pci_passthrough_info = {
.instance_finalize = xen_pci_passthrough_finalize,
.class_init = xen_pci_passthrough_class_init,
.class_size = sizeof(XenPTDeviceClass),
+ .secure = true,
.instance_init = xen_pci_passthrough_instance_init,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 07/28] hw/net: mark e1000, e1000e, IGB, rtl8139 & sPAPR VLAN as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (5 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 06/28] hw/xen: mark all Xen related object types as being secure Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 08/28] hw/usb: mark commonly used USB devices/hosts " Daniel P. Berrangé
` (20 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
Historically most NICs are only interesting for non-virtualization
use cases and have not been written with malicious guests in mind.
As a general rule either virtio-net or xen-net should be used in
all virtualized guests requiring a security boundary.
There are a handful of exceptions resulting from historical usage
in the x86 world, to support virtualized guests lacking virtio
support.
Thus the rtl8139, e1000, e1000e & IGB NICs are declared to provide
a security boundary.
The PPC sPAPR Virtual LAN device is also marked secure.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/net/e1000.c | 1 +
hw/net/e1000e.c | 1 +
hw/net/igb.c | 1 +
hw/net/rtl8139.c | 1 +
hw/net/spapr_llan.c | 1 +
5 files changed, 5 insertions(+)
diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index 202ad404013..2f540dbb417 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -1759,6 +1759,7 @@ static void e1000_register_types(void)
type_info.parent = TYPE_E1000_BASE;
type_info.class_data = info;
type_info.class_init = e1000_class_init;
+ type_info.secure = true;
type_register_static(&type_info);
}
diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
index 9faf0c74c3d..96737ddb51a 100644
--- a/hw/net/e1000e.c
+++ b/hw/net/e1000e.c
@@ -721,6 +721,7 @@ static const TypeInfo e1000e_info = {
.instance_size = sizeof(E1000EState),
.class_init = e1000e_class_init,
.instance_init = e1000e_instance_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ }
diff --git a/hw/net/igb.c b/hw/net/igb.c
index c076807e711..0bd03efea0c 100644
--- a/hw/net/igb.c
+++ b/hw/net/igb.c
@@ -635,6 +635,7 @@ static const TypeInfo igb_info = {
.instance_size = sizeof(IGBState),
.class_init = igb_class_init,
.instance_init = igb_instance_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ }
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index 16479284eea..38bc16f312f 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -3450,6 +3450,7 @@ static const TypeInfo rtl8139_info = {
.instance_size = sizeof(RTL8139State),
.class_init = rtl8139_class_init,
.instance_init = rtl8139_instance_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
index a5b8906849c..784e46f57d4 100644
--- a/hw/net/spapr_llan.c
+++ b/hw/net/spapr_llan.c
@@ -891,6 +891,7 @@ static const TypeInfo spapr_vlan_info = {
.class_init = spapr_vlan_class_init,
.instance_init = spapr_vlan_instance_init,
.instance_finalize = spapr_vlan_instance_finalize,
+ .secure = true,
};
static void spapr_vlan_register_types(void)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 08/28] hw/usb: mark commonly used USB devices/hosts as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (6 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 07/28] hw/net: mark e1000, e1000e, IGB, rtl8139 & sPAPR VLAN as secure Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 09/28] hw/watchdog: mark some watchdog devices " Daniel P. Berrangé
` (19 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
Modern virtualized guests are expected to be deployed with the
XHCI controller which supports all of USB 1, 2 and 3, so should
be declared secure.
The "NEC" XHCI variant is slightly non-standard, but since it is
a trivial sub-class of the generic XHCI, there's no reason to
exclude it.
The set of devices that are expected to be used is HID (mouse,
tablet, keyboard), host passthrough, CCID (smartcard), hub,
storage and the redirect tunnelling.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/usb/ccid-card-emulated.c | 1 +
hw/usb/ccid-card-passthru.c | 1 +
hw/usb/dev-hid.c | 3 +++
hw/usb/dev-hub.c | 1 +
hw/usb/dev-smartcard-reader.c | 2 ++
hw/usb/dev-storage-bot.c | 1 +
hw/usb/dev-storage-classic.c | 1 +
hw/usb/hcd-xhci-nec.c | 1 +
hw/usb/hcd-xhci-pci.c | 1 +
hw/usb/hcd-xhci-sysbus.c | 3 ++-
hw/usb/hcd-xhci.c | 1 +
hw/usb/host-libusb.c | 1 +
hw/usb/redirect.c | 1 +
13 files changed, 17 insertions(+), 1 deletion(-)
diff --git a/hw/usb/ccid-card-emulated.c b/hw/usb/ccid-card-emulated.c
index 6c8eec39faa..4083cf8f4be 100644
--- a/hw/usb/ccid-card-emulated.c
+++ b/hw/usb/ccid-card-emulated.c
@@ -612,6 +612,7 @@ static const TypeInfo emulated_card_info = {
.parent = TYPE_CCID_CARD,
.instance_size = sizeof(EmulatedState),
.class_init = emulated_class_initfn,
+ .secure = true,
};
module_obj(TYPE_EMULATED_CCID);
module_kconfig(USB);
diff --git a/hw/usb/ccid-card-passthru.c b/hw/usb/ccid-card-passthru.c
index 3f4052ec82e..b951a544ef7 100644
--- a/hw/usb/ccid-card-passthru.c
+++ b/hw/usb/ccid-card-passthru.c
@@ -413,6 +413,7 @@ static const TypeInfo passthru_card_info = {
.parent = TYPE_CCID_CARD,
.instance_size = sizeof(PassthruState),
.class_init = passthru_class_initfn,
+ .secure = true,
};
module_obj(TYPE_CCID_PASSTHRU);
module_kconfig(USB);
diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
index ae19d60203f..f363449f53e 100644
--- a/hw/usb/dev-hid.c
+++ b/hw/usb/dev-hid.c
@@ -815,6 +815,7 @@ static const TypeInfo usb_tablet_info = {
.name = "usb-tablet",
.parent = TYPE_USB_HID,
.class_init = usb_tablet_class_initfn,
+ .secure = true,
};
static const Property usb_mouse_properties[] = {
@@ -837,6 +838,7 @@ static const TypeInfo usb_mouse_info = {
.name = "usb-mouse",
.parent = TYPE_USB_HID,
.class_init = usb_mouse_class_initfn,
+ .secure = true,
};
static const Property usb_keyboard_properties[] = {
@@ -860,6 +862,7 @@ static const TypeInfo usb_keyboard_info = {
.name = "usb-kbd",
.parent = TYPE_USB_HID,
.class_init = usb_keyboard_class_initfn,
+ .secure = true,
};
static void usb_hid_register_types(void)
diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c
index b45d571fa83..7017b4fbc75 100644
--- a/hw/usb/dev-hub.c
+++ b/hw/usb/dev-hub.c
@@ -694,6 +694,7 @@ static const TypeInfo hub_info = {
.parent = TYPE_USB_DEVICE,
.instance_size = sizeof(USBHubState),
.class_init = usb_hub_class_initfn,
+ .secure = true,
};
static void usb_hub_register_types(void)
diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index 752571043ee..d6d684c27c4 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -1405,6 +1405,7 @@ static const TypeInfo ccid_bus_info = {
.name = TYPE_CCID_BUS,
.parent = TYPE_BUS,
.instance_size = sizeof(CCIDBus),
+ .secure = true,
};
void ccid_card_send_apdu_to_guest(CCIDCardState *card,
@@ -1779,6 +1780,7 @@ static const TypeInfo ccid_info = {
.parent = TYPE_USB_DEVICE,
.instance_size = sizeof(USBCCIDState),
.class_init = ccid_class_initfn,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
diff --git a/hw/usb/dev-storage-bot.c b/hw/usb/dev-storage-bot.c
index a7f8d80c17a..b156f1c5c9a 100644
--- a/hw/usb/dev-storage-bot.c
+++ b/hw/usb/dev-storage-bot.c
@@ -52,6 +52,7 @@ static const TypeInfo bot_info = {
.name = "usb-bot",
.parent = TYPE_USB_STORAGE,
.class_init = usb_msd_class_bot_initfn,
+ .secure = true,
};
static void register_types(void)
diff --git a/hw/usb/dev-storage-classic.c b/hw/usb/dev-storage-classic.c
index 977151c4a08..7e0699cb518 100644
--- a/hw/usb/dev-storage-classic.c
+++ b/hw/usb/dev-storage-classic.c
@@ -133,6 +133,7 @@ static const TypeInfo msd_info = {
.parent = TYPE_USB_STORAGE,
.class_init = usb_msd_class_storage_initfn,
.instance_init = usb_msd_instance_init,
+ .secure = true,
};
static void register_types(void)
diff --git a/hw/usb/hcd-xhci-nec.c b/hw/usb/hcd-xhci-nec.c
index 46839911f3f..070732be9a6 100644
--- a/hw/usb/hcd-xhci-nec.c
+++ b/hw/usb/hcd-xhci-nec.c
@@ -67,6 +67,7 @@ static const TypeInfo nec_xhci_info = {
.instance_size = sizeof(XHCINecState),
.instance_init = nec_xhci_instance_init,
.class_init = nec_xhci_class_init,
+ .secure = true,
};
static void nec_xhci_register_types(void)
diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
index b124251ae33..a3615b29fbd 100644
--- a/hw/usb/hcd-xhci-pci.c
+++ b/hw/usb/hcd-xhci-pci.c
@@ -298,6 +298,7 @@ static const TypeInfo qemu_xhci_info = {
.parent = TYPE_XHCI_PCI,
.class_init = qemu_xhci_class_init,
.instance_init = qemu_xhci_instance_init,
+ .secure = true,
};
static void xhci_register_types(void)
diff --git a/hw/usb/hcd-xhci-sysbus.c b/hw/usb/hcd-xhci-sysbus.c
index bbdd5fd64ab..8dd50fbbf13 100644
--- a/hw/usb/hcd-xhci-sysbus.c
+++ b/hw/usb/hcd-xhci-sysbus.c
@@ -112,7 +112,8 @@ static const TypeInfo xhci_sysbus_info = {
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(XHCISysbusState),
.class_init = xhci_sysbus_class_init,
- .instance_init = xhci_sysbus_instance_init
+ .instance_init = xhci_sysbus_instance_init,
+ .secure = true,
};
static void xhci_sysbus_register_types(void)
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index 5d7a77b8bcf..cf49d5ae759 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -3705,6 +3705,7 @@ static const TypeInfo xhci_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(XHCIState),
.class_init = xhci_class_init,
+ .secure = true,
};
static void xhci_register_types(void)
diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index 8f7ced95cfe..b207320d481 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -1839,6 +1839,7 @@ static const TypeInfo usb_host_dev_info = {
.instance_size = sizeof(USBHostDevice),
.class_init = usb_host_class_initfn,
.instance_init = usb_host_instance_init,
+ .secure = true,
};
module_obj(TYPE_USB_HOST_DEVICE);
module_kconfig(USB);
diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index a666b1e8d7d..401c6f5767b 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -2655,6 +2655,7 @@ static const TypeInfo usbredir_dev_info = {
.instance_size = sizeof(USBRedirDevice),
.class_init = usbredir_class_initfn,
.instance_init = usbredir_instance_init,
+ .secure = true,
};
module_obj(TYPE_USB_REDIR);
module_kconfig(USB);
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 09/28] hw/watchdog: mark some watchdog devices as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (7 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 08/28] hw/usb: mark commonly used USB devices/hosts " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 10/28] hw/scsi: mark spapr SCSI controller " Daniel P. Berrangé
` (18 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé, Cornelia Huck
The ib700, i6300esb, gwdt, spapr and diag288 watchdog devices are marked
as secure since they have traditionally been, or are intended to be,
used in virtualization use cases on x86, arm, ppc and s390x architectures
respectively. Other watchdogs are primarily for emulation.
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: Cornelia Huck <cohuck@redhat.com> #diag288
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/watchdog/sbsa_gwdt.c | 1 +
hw/watchdog/spapr_watchdog.c | 1 +
hw/watchdog/wdt_diag288.c | 1 +
hw/watchdog/wdt_i6300esb.c | 1 +
hw/watchdog/wdt_ib700.c | 1 +
5 files changed, 5 insertions(+)
diff --git a/hw/watchdog/sbsa_gwdt.c b/hw/watchdog/sbsa_gwdt.c
index 1834dc8db83..671eb26365f 100644
--- a/hw/watchdog/sbsa_gwdt.c
+++ b/hw/watchdog/sbsa_gwdt.c
@@ -340,6 +340,7 @@ static const TypeInfo wdt_sbsa_gwdt_info = {
.parent = TYPE_SYS_BUS_DEVICE,
.name = TYPE_WDT_SBSA,
.instance_size = sizeof(SBSA_GWDTState),
+ .secure = true,
};
static void wdt_sbsa_gwdt_register_types(void)
diff --git a/hw/watchdog/spapr_watchdog.c b/hw/watchdog/spapr_watchdog.c
index 5a72896066e..0e45e9b4a6a 100644
--- a/hw/watchdog/spapr_watchdog.c
+++ b/hw/watchdog/spapr_watchdog.c
@@ -269,6 +269,7 @@ static const TypeInfo spapr_wdt_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(SpaprWatchdog),
.class_init = spapr_wdt_class_init,
+ .secure = true,
};
static void spapr_watchdog_register_types(void)
diff --git a/hw/watchdog/wdt_diag288.c b/hw/watchdog/wdt_diag288.c
index 1275353e8e5..85e4f56e1db 100644
--- a/hw/watchdog/wdt_diag288.c
+++ b/hw/watchdog/wdt_diag288.c
@@ -129,6 +129,7 @@ static const TypeInfo wdt_diag288_info = {
.name = TYPE_WDT_DIAG288,
.instance_size = sizeof(DIAG288State),
.class_size = sizeof(DIAG288Class),
+ .secure = true,
};
static void wdt_diag288_register_types(void)
diff --git a/hw/watchdog/wdt_i6300esb.c b/hw/watchdog/wdt_i6300esb.c
index 3aa01b8d68f..05aa20fab13 100644
--- a/hw/watchdog/wdt_i6300esb.c
+++ b/hw/watchdog/wdt_i6300esb.c
@@ -480,6 +480,7 @@ static const TypeInfo i6300esb_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(I6300State),
.class_init = i6300esb_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/watchdog/wdt_ib700.c b/hw/watchdog/wdt_ib700.c
index 51a26a4cbbc..8bf2b2fbf90 100644
--- a/hw/watchdog/wdt_ib700.c
+++ b/hw/watchdog/wdt_ib700.c
@@ -144,6 +144,7 @@ static const TypeInfo wdt_ib700_info = {
.parent = TYPE_ISA_DEVICE,
.instance_size = sizeof(IB700State),
.class_init = wdt_ib700_class_init,
+ .secure = true,
};
static void wdt_ib700_register_types(void)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 10/28] hw/scsi: mark spapr SCSI controller as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (8 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 09/28] hw/watchdog: mark some watchdog devices " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 11/28] hw/scsi: mark SCSI disk endpoint devices " Daniel P. Berrangé
` (17 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
The spapr vscsi controller is used by default with spapr machines
in a virtualization use case.
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/scsi/spapr_vscsi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index 7ec780da79e..eedae00273e 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -1312,6 +1312,7 @@ static const TypeInfo spapr_vscsi_info = {
.parent = TYPE_VIO_SPAPR_DEVICE,
.instance_size = sizeof(VSCSIState),
.class_init = spapr_vscsi_class_init,
+ .secure = true,
};
static void spapr_vscsi_register_types(void)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 11/28] hw/scsi: mark SCSI disk endpoint devices as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (9 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 10/28] hw/scsi: mark spapr SCSI controller " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 12/28] hw/ide: mark ICH9 and ide-hd/ide-cd " Daniel P. Berrangé
` (16 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
All these devices can be used together with supported SCSI controllers
in a virtualization use case, so must be treated as secure.
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/scsi/scsi-disk.c | 3 +++
hw/scsi/scsi-generic.c | 1 +
2 files changed, 4 insertions(+)
diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index 6341089ddf2..f546e5b67fc 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -3370,6 +3370,7 @@ static const TypeInfo scsi_hd_info = {
.name = "scsi-hd",
.parent = TYPE_SCSI_DISK_BASE,
.class_init = scsi_hd_class_initfn,
+ .secure = true,
};
static const Property scsi_cd_properties[] = {
@@ -3413,6 +3414,7 @@ static const TypeInfo scsi_cd_info = {
.name = "scsi-cd",
.parent = TYPE_SCSI_DISK_BASE,
.class_init = scsi_cd_class_initfn,
+ .secure = true,
};
#ifdef __linux__
@@ -3455,6 +3457,7 @@ static const TypeInfo scsi_block_info = {
.name = "scsi-block",
.parent = TYPE_SCSI_DISK_BASE,
.class_init = scsi_block_class_initfn,
+ .secure = true,
};
#endif
diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
index e48fcb926f1..747a0aa61be 100644
--- a/hw/scsi/scsi-generic.c
+++ b/hw/scsi/scsi-generic.c
@@ -1259,6 +1259,7 @@ static const TypeInfo scsi_generic_info = {
.parent = TYPE_SCSI_DEVICE,
.instance_size = sizeof(SCSIDevice),
.class_init = scsi_generic_class_initfn,
+ .secure = true,
};
static void scsi_generic_register_types(void)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 12/28] hw/ide: mark ICH9 and ide-hd/ide-cd as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (10 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 11/28] hw/scsi: mark SCSI disk endpoint devices " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 13/28] hw: define most common PCI types " Daniel P. Berrangé
` (15 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
These have a long history of usage in virtualization scenarios on
x86, for OS which lack modern virtio drivers for storage, and thus
must be considered secure.
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/ide/ich.c | 1 +
hw/ide/ide-dev.c | 2 ++
hw/ide/piix.c | 2 ++
3 files changed, 5 insertions(+)
diff --git a/hw/ide/ich.c b/hw/ide/ich.c
index b00987f08d4..c7d50a15c1a 100644
--- a/hw/ide/ich.c
+++ b/hw/ide/ich.c
@@ -198,6 +198,7 @@ static const TypeInfo ich_ahci_info = {
.instance_size = sizeof(AHCIPCIState),
.instance_init = pci_ich9_ahci_init,
.class_init = ich_ahci_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/ide/ide-dev.c b/hw/ide/ide-dev.c
index 5d478588c61..da7b6aa5bcc 100644
--- a/hw/ide/ide-dev.c
+++ b/hw/ide/ide-dev.c
@@ -214,6 +214,7 @@ static const TypeInfo ide_hd_info = {
.parent = TYPE_IDE_DEVICE,
.instance_size = sizeof(IDEDrive),
.class_init = ide_hd_class_init,
+ .secure = true,
};
static const Property ide_cd_properties[] = {
@@ -236,6 +237,7 @@ static const TypeInfo ide_cd_info = {
.parent = TYPE_IDE_DEVICE,
.instance_size = sizeof(IDEDrive),
.class_init = ide_cd_class_init,
+ .secure = true,
};
static void ide_device_class_init(ObjectClass *klass, const void *data)
diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index a8472f3e581..9b7b5e98c8c 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -198,6 +198,7 @@ static const TypeInfo piix3_ide_info = {
.name = TYPE_PIIX3_IDE,
.parent = TYPE_PCI_IDE,
.class_init = piix3_ide_class_init,
+ .secure = true,
};
/* NOTE: for the PIIX4, the IRQs and IOports are hardcoded */
@@ -221,6 +222,7 @@ static const TypeInfo piix4_ide_info = {
.name = TYPE_PIIX4_IDE,
.parent = TYPE_PCI_IDE,
.class_init = piix4_ide_class_init,
+ .secure = true,
};
static void piix_ide_register_types(void)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 13/28] hw: define most common PCI types as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (11 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 12/28] hw/ide: mark ICH9 and ide-hd/ide-cd " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 14/28] hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts " Daniel P. Berrangé
` (14 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
Essentially all PCI infrastructure is in scope for the virtualization
use case, aside from the niche simba bridge and the CXL related pieces.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/pci-bridge/gen_pcie_root_port.c | 1 +
hw/pci-bridge/i82801b11.c | 1 +
hw/pci-bridge/ioh3420.c | 1 +
hw/pci-bridge/pci_bridge_dev.c | 2 ++
hw/pci-bridge/pci_expander_bridge.c | 5 +++++
hw/pci-bridge/pcie_pci_bridge.c | 1 +
hw/pci-bridge/xio3130_downstream.c | 1 +
hw/pci-bridge/xio3130_upstream.c | 1 +
hw/pci/pci.c | 4 ++++
9 files changed, 17 insertions(+)
diff --git a/hw/pci-bridge/gen_pcie_root_port.c b/hw/pci-bridge/gen_pcie_root_port.c
index 5434d693d92..65d29eab38e 100644
--- a/hw/pci-bridge/gen_pcie_root_port.c
+++ b/hw/pci-bridge/gen_pcie_root_port.c
@@ -161,6 +161,7 @@ static const TypeInfo gen_rp_dev_info = {
.parent = TYPE_PCIE_ROOT_PORT,
.instance_size = sizeof(GenPCIERootPort),
.class_init = gen_rp_dev_class_init,
+ .secure = true,
};
static void gen_rp_register_types(void)
diff --git a/hw/pci-bridge/i82801b11.c b/hw/pci-bridge/i82801b11.c
index 1d73c14c1f8..f702b20bcd5 100644
--- a/hw/pci-bridge/i82801b11.c
+++ b/hw/pci-bridge/i82801b11.c
@@ -107,6 +107,7 @@ static const TypeInfo i82801b11_bridge_info = {
.parent = TYPE_PCI_BRIDGE,
.instance_size = sizeof(I82801b11Bridge),
.class_init = i82801b11_bridge_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/pci-bridge/ioh3420.c b/hw/pci-bridge/ioh3420.c
index bba640f495b..2c4882c4cf1 100644
--- a/hw/pci-bridge/ioh3420.c
+++ b/hw/pci-bridge/ioh3420.c
@@ -120,6 +120,7 @@ static const TypeInfo ioh3420_info = {
.name = "ioh3420",
.parent = TYPE_PCIE_ROOT_PORT,
.class_init = ioh3420_class_init,
+ .secure = true,
};
static void ioh3420_register_types(void)
diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index bc53bcb69d8..86e8daaa068 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -268,6 +268,7 @@ static const TypeInfo pci_bridge_dev_info = {
.instance_size = sizeof(PCIBridgeDev),
.class_init = pci_bridge_dev_class_init,
.instance_finalize = pci_bridge_dev_instance_finalize,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -294,6 +295,7 @@ static const TypeInfo pci_bridge_dev_seat_info = {
.parent = TYPE_PCI_BRIDGE_DEV,
.instance_size = sizeof(PCIBridgeDev),
.class_init = pci_bridge_dev_seat_class_init,
+ .secure = true,
};
static void pci_bridge_dev_register(void)
diff --git a/hw/pci-bridge/pci_expander_bridge.c b/hw/pci-bridge/pci_expander_bridge.c
index 40ffbc4e082..b6df3f89ca4 100644
--- a/hw/pci-bridge/pci_expander_bridge.c
+++ b/hw/pci-bridge/pci_expander_bridge.c
@@ -114,6 +114,7 @@ static const TypeInfo pxb_bus_info = {
.parent = TYPE_PCI_BUS,
.instance_size = sizeof(PXBBus),
.class_init = pxb_bus_class_init,
+ .secure = true,
};
static const TypeInfo pxb_pcie_bus_info = {
@@ -121,6 +122,7 @@ static const TypeInfo pxb_pcie_bus_info = {
.parent = TYPE_PCIE_BUS,
.instance_size = sizeof(PXBBus),
.class_init = pxb_bus_class_init,
+ .secure = true,
};
static const TypeInfo pxb_cxl_bus_info = {
@@ -190,6 +192,7 @@ static const TypeInfo pxb_host_info = {
.name = TYPE_PXB_HOST,
.parent = TYPE_PCI_HOST_BRIDGE,
.class_init = pxb_host_class_init,
+ .secure = true,
};
static void pxb_cxl_realize(DeviceState *dev, Error **errp)
@@ -453,6 +456,7 @@ static const TypeInfo pxb_dev_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(PXBDev),
.class_init = pxb_dev_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
@@ -490,6 +494,7 @@ static const TypeInfo pxb_pcie_dev_info = {
.parent = TYPE_PXB_DEV,
.instance_size = sizeof(PXBPCIEDev),
.class_init = pxb_pcie_dev_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/pci-bridge/pcie_pci_bridge.c b/hw/pci-bridge/pcie_pci_bridge.c
index e826fb2829f..03b6b1c0f54 100644
--- a/hw/pci-bridge/pcie_pci_bridge.c
+++ b/hw/pci-bridge/pcie_pci_bridge.c
@@ -162,6 +162,7 @@ static const TypeInfo pcie_pci_bridge_info = {
.parent = TYPE_PCI_BRIDGE,
.instance_size = sizeof(PCIEPCIBridge),
.class_init = pcie_pci_bridge_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ INTERFACE_PCIE_DEVICE },
diff --git a/hw/pci-bridge/xio3130_downstream.c b/hw/pci-bridge/xio3130_downstream.c
index 0c3fed3053b..ded948ebd0f 100644
--- a/hw/pci-bridge/xio3130_downstream.c
+++ b/hw/pci-bridge/xio3130_downstream.c
@@ -175,6 +175,7 @@ static const TypeInfo xio3130_downstream_info = {
.name = TYPE_XIO3130_DOWNSTREAM,
.parent = TYPE_PCIE_SLOT,
.class_init = xio3130_downstream_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ }
diff --git a/hw/pci-bridge/xio3130_upstream.c b/hw/pci-bridge/xio3130_upstream.c
index 40057b749bf..9d58105f8bd 100644
--- a/hw/pci-bridge/xio3130_upstream.c
+++ b/hw/pci-bridge/xio3130_upstream.c
@@ -144,6 +144,7 @@ static const TypeInfo xio3130_upstream_info = {
.name = "x3130-upstream",
.parent = TYPE_PCIE_PORT,
.class_init = xio3130_upstream_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ }
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 0efb4eb4bb0..f5af3e743d9 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -319,6 +319,7 @@ static const TypeInfo pci_bus_info = {
.instance_size = sizeof(PCIBus),
.class_size = sizeof(PCIBusClass),
.class_init = pci_bus_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_FW_CFG_DATA_GENERATOR_INTERFACE },
{ }
@@ -333,11 +334,13 @@ static const TypeInfo cxl_interface_info = {
static const TypeInfo pcie_interface_info = {
.name = INTERFACE_PCIE_DEVICE,
.parent = TYPE_INTERFACE,
+ .secure = true,
};
static const TypeInfo conventional_pci_interface_info = {
.name = INTERFACE_CONVENTIONAL_PCI_DEVICE,
.parent = TYPE_INTERFACE,
+ .secure = true,
};
static void pcie_bus_class_init(ObjectClass *klass, const void *data)
@@ -351,6 +354,7 @@ static const TypeInfo pcie_bus_info = {
.name = TYPE_PCIE_BUS,
.parent = TYPE_PCI_BUS,
.class_init = pcie_bus_class_init,
+ .secure = true,
};
static const TypeInfo cxl_bus_info = {
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 14/28] hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (12 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 13/28] hw: define most common PCI types " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 15/28] hw/display: mark bochs, ramfb and VGA " Daniel P. Berrangé
` (13 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé, Cornelia Huck
Mark the PCI hosts secure if they are used from machine types
that are considered for the virtualization use case.
There is also a special case for the 'remote' type and the
Xen passthrough type.
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: Cornelia Huck <cohuck@redhat.com> #s390
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/pci-host/gpex.c | 2 ++
hw/pci-host/i440fx.c | 2 ++
hw/pci-host/pnv_phb.c | 2 ++
hw/pci-host/pnv_phb3.c | 3 +++
hw/pci-host/pnv_phb3_msi.c | 1 +
hw/pci-host/pnv_phb3_pbcq.c | 1 +
hw/pci-host/pnv_phb4.c | 4 +++-
hw/pci-host/pnv_phb4_pec.c | 1 +
hw/pci-host/q35.c | 2 ++
hw/pci-host/remote.c | 1 +
hw/pci-host/xen_igd_pt.c | 1 +
hw/ppc/spapr_pci.c | 1 +
hw/s390x/s390-pci-bus.c | 4 ++++
13 files changed, 24 insertions(+), 1 deletion(-)
diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index e66784ce516..38197a89454 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -220,6 +220,7 @@ static const TypeInfo gpex_host_info = {
.instance_size = sizeof(GPEXHost),
.instance_init = gpex_host_initfn,
.class_init = gpex_host_class_init,
+ .secure = true,
};
/****************************************************************************
@@ -259,6 +260,7 @@ static const TypeInfo gpex_root_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(GPEXRootState),
.class_init = gpex_root_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
index c1982f7962a..1c5a4aba1b3 100644
--- a/hw/pci-host/i440fx.c
+++ b/hw/pci-host/i440fx.c
@@ -352,6 +352,7 @@ static const TypeInfo i440fx_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(PCII440FXState),
.class_init = i440fx_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
@@ -410,6 +411,7 @@ static const TypeInfo i440fx_pcihost_info = {
.instance_size = sizeof(I440FXState),
.instance_init = i440fx_pcihost_initfn,
.class_init = i440fx_pcihost_class_init,
+ .secure = true,
};
static void i440fx_register_types(void)
diff --git a/hw/pci-host/pnv_phb.c b/hw/pci-host/pnv_phb.c
index 0b556d1bf5c..bc8313d2cd0 100644
--- a/hw/pci-host/pnv_phb.c
+++ b/hw/pci-host/pnv_phb.c
@@ -333,6 +333,7 @@ static const TypeInfo pnv_phb_type_info = {
.parent = TYPE_PCIE_HOST_BRIDGE,
.instance_size = sizeof(PnvPHB),
.class_init = pnv_phb_class_init,
+ .secure = true,
};
static const TypeInfo pnv_phb_root_port_info = {
@@ -340,6 +341,7 @@ static const TypeInfo pnv_phb_root_port_info = {
.parent = TYPE_PCIE_ROOT_PORT,
.instance_size = sizeof(PnvPHBRootPort),
.class_init = pnv_phb_root_port_class_init,
+ .secure = true,
};
static void pnv_phb_register_types(void)
diff --git a/hw/pci-host/pnv_phb3.c b/hw/pci-host/pnv_phb3.c
index db061c134e9..abf43e3226d 100644
--- a/hw/pci-host/pnv_phb3.c
+++ b/hw/pci-host/pnv_phb3.c
@@ -910,6 +910,7 @@ static const TypeInfo pnv_phb3_iommu_memory_region_info = {
.parent = TYPE_IOMMU_MEMORY_REGION,
.name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
.class_init = pnv_phb3_iommu_memory_region_class_init,
+ .secure = true,
};
/*
@@ -1123,6 +1124,7 @@ static const TypeInfo pnv_phb3_type_info = {
.instance_size = sizeof(PnvPHB3),
.class_init = pnv_phb3_class_init,
.instance_init = pnv_phb3_instance_init,
+ .secure = true,
};
static void pnv_phb3_root_bus_get_prop(Object *obj, Visitor *v,
@@ -1186,6 +1188,7 @@ static const TypeInfo pnv_phb3_root_bus_info = {
.parent = TYPE_PCIE_BUS,
.instance_size = sizeof(PnvPHB3RootBus),
.class_init = pnv_phb3_root_bus_class_init,
+ .secure = true,
};
static void pnv_phb3_register_types(void)
diff --git a/hw/pci-host/pnv_phb3_msi.c b/hw/pci-host/pnv_phb3_msi.c
index 66ba7b79134..5edc0d43eb0 100644
--- a/hw/pci-host/pnv_phb3_msi.c
+++ b/hw/pci-host/pnv_phb3_msi.c
@@ -306,6 +306,7 @@ static const TypeInfo phb3_msi_info = {
.class_init = phb3_msi_class_init,
.class_size = sizeof(ICSStateClass),
.instance_init = phb3_msi_instance_init,
+ .secure = true,
};
static void pnv_phb3_msi_register_types(void)
diff --git a/hw/pci-host/pnv_phb3_pbcq.c b/hw/pci-host/pnv_phb3_pbcq.c
index 1f7a149580d..687c8325158 100644
--- a/hw/pci-host/pnv_phb3_pbcq.c
+++ b/hw/pci-host/pnv_phb3_pbcq.c
@@ -354,6 +354,7 @@ static const TypeInfo pnv_pbcq_type_info = {
.instance_size = sizeof(PnvPBCQState),
.instance_init = phb3_pbcq_instance_init,
.class_init = pnv_pbcq_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_PNV_XSCOM_INTERFACE },
{ }
diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c
index ac09a0b034d..1a652110f5d 100644
--- a/hw/pci-host/pnv_phb4.c
+++ b/hw/pci-host/pnv_phb4.c
@@ -1388,6 +1388,7 @@ static const TypeInfo pnv_phb4_iommu_memory_region_info = {
.parent = TYPE_IOMMU_MEMORY_REGION,
.name = TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
.class_init = pnv_phb4_iommu_memory_region_class_init,
+ .secure = true,
};
/*
@@ -1729,13 +1730,13 @@ static const TypeInfo pnv_phb4_type_info = {
.instance_init = pnv_phb4_instance_init,
.instance_size = sizeof(PnvPHB4),
.class_init = pnv_phb4_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_XIVE_NOTIFIER },
{ },
}
};
-
static void pnv_phb4_root_bus_get_prop(Object *obj, Visitor *v,
const char *name,
void *opaque, Error **errp)
@@ -1797,6 +1798,7 @@ static const TypeInfo pnv_phb4_root_bus_info = {
.parent = TYPE_PCIE_BUS,
.instance_size = sizeof(PnvPHB4RootBus),
.class_init = pnv_phb4_root_bus_class_init,
+ .secure = true,
};
static void pnv_phb4_register_types(void)
diff --git a/hw/pci-host/pnv_phb4_pec.c b/hw/pci-host/pnv_phb4_pec.c
index ee5cdc3e450..280a15e8df1 100644
--- a/hw/pci-host/pnv_phb4_pec.c
+++ b/hw/pci-host/pnv_phb4_pec.c
@@ -388,6 +388,7 @@ static const TypeInfo pnv_pec_type_info = {
.instance_size = sizeof(PnvPhb4PecState),
.class_init = pnv_pec_class_init,
.class_size = sizeof(PnvPhb4PecClass),
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_PNV_XSCOM_INTERFACE },
{ }
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index f4556ad03a0..be38841df9e 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -268,6 +268,7 @@ static const TypeInfo q35_host_info = {
.instance_size = sizeof(Q35PCIHost),
.instance_init = q35_host_initfn,
.class_init = q35_host_class_init,
+ .secure = true,
};
/****************************************************************************
@@ -718,6 +719,7 @@ static const TypeInfo mch_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(MCHPCIState),
.class_init = mch_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/pci-host/remote.c b/hw/pci-host/remote.c
index 9ea95fac6e6..a58fc39bded 100644
--- a/hw/pci-host/remote.c
+++ b/hw/pci-host/remote.c
@@ -63,6 +63,7 @@ static const TypeInfo remote_pcihost_info = {
.parent = TYPE_PCIE_HOST_BRIDGE,
.instance_size = sizeof(RemotePCIHost),
.class_init = remote_pcihost_class_init,
+ .secure = true,
};
static void remote_pcihost_register(void)
diff --git a/hw/pci-host/xen_igd_pt.c b/hw/pci-host/xen_igd_pt.c
index f6016f2cd53..abc68849b9e 100644
--- a/hw/pci-host/xen_igd_pt.c
+++ b/hw/pci-host/xen_igd_pt.c
@@ -110,6 +110,7 @@ static const TypeInfo igd_passthrough_i440fx_info = {
.parent = TYPE_I440FX_PCI_DEVICE,
.instance_size = sizeof(PCII440FXState),
.class_init = igd_passthrough_i440fx_class_init,
+ .secure = true,
};
static void igd_pt_i440fx_register_types(void)
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index f7fc544d35c..ea323fa0989 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -2174,6 +2174,7 @@ static const TypeInfo spapr_phb_info = {
.instance_size = sizeof(SpaprPhbState),
.instance_finalize = spapr_phb_finalizefn,
.class_init = spapr_phb_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
index cdd75cdfd2f..7c64397c33c 100644
--- a/hw/s390x/s390-pci-bus.c
+++ b/hw/s390x/s390-pci-bus.c
@@ -1678,6 +1678,7 @@ static const TypeInfo s390_pcihost_info = {
.parent = TYPE_PCI_HOST_BRIDGE,
.instance_size = sizeof(S390pciState),
.class_init = s390_pcihost_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
@@ -1711,6 +1712,7 @@ static const TypeInfo s390_pcibus_info = {
* if a device is unplugged and plugged back, preventing migration.
*/
.class_init = s390_pcibus_class_init,
+ .secure = true,
};
static uint16_t s390_pci_generate_uid(S390pciState *s)
@@ -2033,12 +2035,14 @@ static const TypeInfo s390_pci_device_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(S390PCIBusDevice),
.class_init = s390_pci_device_class_init,
+ .secure = true,
};
static const TypeInfo s390_pci_iommu_info = {
.name = TYPE_S390_PCI_IOMMU,
.parent = TYPE_OBJECT,
.instance_size = sizeof(S390PCIIOMMU),
+ .secure = true,
};
static void s390_iommu_memory_region_class_init(ObjectClass *klass,
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 15/28] hw/display: mark bochs, ramfb and VGA as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (13 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 14/28] hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 16/28] hw/tpm: mark all TPM implementations " Daniel P. Berrangé
` (12 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
Most of the display adapters are emulating old hardware which is not
relevant to virtualization use cases.
The clear exceptions are the generic, simple devices that should be
considered secure: Bochs, RAMFB, VGA (PCI, not MMIO / ISA).
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/display/bochs-display.c | 1 +
hw/display/ramfb-standalone.c | 1 +
hw/display/vga-pci.c | 2 ++
3 files changed, 4 insertions(+)
diff --git a/hw/display/bochs-display.c b/hw/display/bochs-display.c
index 64e669429c4..5f3ba80f990 100644
--- a/hw/display/bochs-display.c
+++ b/hw/display/bochs-display.c
@@ -374,6 +374,7 @@ static const TypeInfo bochs_display_type_info = {
.instance_size = sizeof(BochsDisplayState),
.instance_init = bochs_display_init,
.class_init = bochs_display_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
diff --git a/hw/display/ramfb-standalone.c b/hw/display/ramfb-standalone.c
index 8e8ba37514a..9427009acc8 100644
--- a/hw/display/ramfb-standalone.c
+++ b/hw/display/ramfb-standalone.c
@@ -85,6 +85,7 @@ static const TypeInfo ramfb_info = {
.parent = TYPE_DYNAMIC_SYS_BUS_DEVICE,
.instance_size = sizeof(RAMFBStandaloneState),
.class_init = ramfb_class_initfn,
+ .secure = true,
};
static void ramfb_register_types(void)
diff --git a/hw/display/vga-pci.c b/hw/display/vga-pci.c
index d089847bdae..8559d7aa8f0 100644
--- a/hw/display/vga-pci.c
+++ b/hw/display/vga-pci.c
@@ -407,6 +407,7 @@ static const TypeInfo vga_info = {
.name = "VGA",
.parent = TYPE_PCI_VGA,
.class_init = vga_class_init,
+ .secure = true,
};
static const TypeInfo secondary_info = {
@@ -414,6 +415,7 @@ static const TypeInfo secondary_info = {
.parent = TYPE_PCI_VGA,
.instance_init = pci_secondary_vga_init,
.class_init = secondary_class_init,
+ .secure = true,
};
static void vga_register_types(void)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 16/28] hw/tpm: mark all TPM implementations as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (14 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 15/28] hw/display: mark bochs, ramfb and VGA " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 17/28] hw/misc: mark pvpanic, vmcoreinfo " Daniel P. Berrangé
` (11 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
All of the TPM implementations are in scope of virtualization
usage, so mark them all as secure.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/ppc/spapr_tpm_proxy.c | 1 +
hw/tpm/tpm_crb.c | 1 +
hw/tpm/tpm_spapr.c | 1 +
hw/tpm/tpm_tis_i2c.c | 1 +
hw/tpm/tpm_tis_isa.c | 1 +
hw/tpm/tpm_tis_sysbus.c | 1 +
6 files changed, 6 insertions(+)
diff --git a/hw/ppc/spapr_tpm_proxy.c b/hw/ppc/spapr_tpm_proxy.c
index 19889e80bc1..bb6efec20c9 100644
--- a/hw/ppc/spapr_tpm_proxy.c
+++ b/hw/ppc/spapr_tpm_proxy.c
@@ -166,6 +166,7 @@ static const TypeInfo spapr_tpm_proxy_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(SpaprTpmProxy),
.class_init = spapr_tpm_proxy_class_init,
+ .secure = true,
};
static void spapr_tpm_proxy_register_types(void)
diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c
index 78db2205207..ab6121ed9e6 100644
--- a/hw/tpm/tpm_crb.c
+++ b/hw/tpm/tpm_crb.c
@@ -558,6 +558,7 @@ static const TypeInfo tpm_crb_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(CRBState),
.class_init = tpm_crb_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_TPM_IF },
{ }
diff --git a/hw/tpm/tpm_spapr.c b/hw/tpm/tpm_spapr.c
index 19075d1f012..3957c5268b7 100644
--- a/hw/tpm/tpm_spapr.c
+++ b/hw/tpm/tpm_spapr.c
@@ -414,6 +414,7 @@ static const TypeInfo tpm_spapr_info = {
.parent = TYPE_VIO_SPAPR_DEVICE,
.instance_size = sizeof(SpaprTpmState),
.class_init = tpm_spapr_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_TPM_IF },
{ }
diff --git a/hw/tpm/tpm_tis_i2c.c b/hw/tpm/tpm_tis_i2c.c
index b4f258c7bcb..302296affb6 100644
--- a/hw/tpm/tpm_tis_i2c.c
+++ b/hw/tpm/tpm_tis_i2c.c
@@ -551,6 +551,7 @@ static const TypeInfo tpm_tis_i2c_info = {
.name = TYPE_TPM_TIS_I2C,
.parent = TYPE_I2C_SLAVE,
.instance_size = sizeof(TPMStateI2C),
+ .secure = true,
.class_init = tpm_tis_i2c_class_init,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_TPM_IF },
diff --git a/hw/tpm/tpm_tis_isa.c b/hw/tpm/tpm_tis_isa.c
index 2b1267133ac..da3a932b033 100644
--- a/hw/tpm/tpm_tis_isa.c
+++ b/hw/tpm/tpm_tis_isa.c
@@ -187,6 +187,7 @@ static const TypeInfo tpm_tis_isa_info = {
.instance_size = sizeof(TPMStateISA),
.instance_init = tpm_tis_isa_initfn,
.class_init = tpm_tis_isa_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_TPM_IF },
{ TYPE_ACPI_DEV_AML_IF },
diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
index a7b0002d826..0afb52c3be3 100644
--- a/hw/tpm/tpm_tis_sysbus.c
+++ b/hw/tpm/tpm_tis_sysbus.c
@@ -167,6 +167,7 @@ static const TypeInfo tpm_tis_sysbus_info = {
.instance_init = tpm_tis_sysbus_initfn,
.instance_finalize = tpm_tis_sysbus_finalize,
.class_init = tpm_tis_sysbus_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_TPM_IF },
{ }
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 17/28] hw/misc: mark pvpanic, vmcoreinfo as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (15 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 16/28] hw/tpm: mark all TPM implementations " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 18/28] hw/audio: mark Intel HDA devices & codecs " Daniel P. Berrangé
` (10 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
These devices are common debug aids for virtualized
guests so must be marked secure.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/misc/pvpanic-isa.c | 1 +
hw/misc/pvpanic-mmio.c | 1 +
hw/misc/pvpanic-pci.c | 1 +
hw/misc/vmcoreinfo.c | 1 +
4 files changed, 4 insertions(+)
diff --git a/hw/misc/pvpanic-isa.c b/hw/misc/pvpanic-isa.c
index 85fb7da5e5c..bb0a7ff6f8e 100644
--- a/hw/misc/pvpanic-isa.c
+++ b/hw/misc/pvpanic-isa.c
@@ -121,6 +121,7 @@ static const TypeInfo pvpanic_isa_info = {
.instance_size = sizeof(PVPanicISAState),
.instance_init = pvpanic_isa_initfn,
.class_init = pvpanic_isa_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_ACPI_DEV_AML_IF },
{ },
diff --git a/hw/misc/pvpanic-mmio.c b/hw/misc/pvpanic-mmio.c
index a173a1a9a58..161e8fc59b4 100644
--- a/hw/misc/pvpanic-mmio.c
+++ b/hw/misc/pvpanic-mmio.c
@@ -50,6 +50,7 @@ static const TypeInfo pvpanic_mmio_info = {
.instance_size = sizeof(PVPanicMMIOState),
.instance_init = pvpanic_mmio_initfn,
.class_init = pvpanic_mmio_class_init,
+ .secure = true,
};
static void pvpanic_register_types(void)
diff --git a/hw/misc/pvpanic-pci.c b/hw/misc/pvpanic-pci.c
index 5509f70a3e5..7d1f99d564b 100644
--- a/hw/misc/pvpanic-pci.c
+++ b/hw/misc/pvpanic-pci.c
@@ -80,6 +80,7 @@ static const TypeInfo pvpanic_pci_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(PVPanicPCIState),
.class_init = pvpanic_pci_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ }
diff --git a/hw/misc/vmcoreinfo.c b/hw/misc/vmcoreinfo.c
index 9c2e9005ad3..90f361b05f1 100644
--- a/hw/misc/vmcoreinfo.c
+++ b/hw/misc/vmcoreinfo.c
@@ -101,6 +101,7 @@ static const TypeInfo vmcoreinfo_types[] = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(VMCoreInfoState),
.class_init = vmcoreinfo_device_class_init,
+ .secure = true,
}
};
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 18/28] hw/audio: mark Intel HDA devices & codecs as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (16 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 17/28] hw/misc: mark pvpanic, vmcoreinfo " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 19/28] hw/char: mark common serial / console devices " Daniel P. Berrangé
` (9 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
This is traditionally the primary audio backend for x86 as
virtio-snd is a relatively new invention.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/audio/hda-codec.c | 3 +++
hw/audio/intel-hda.c | 3 +++
2 files changed, 6 insertions(+)
diff --git a/hw/audio/hda-codec.c b/hw/audio/hda-codec.c
index 173fe56bea3..ee0d18c4caa 100644
--- a/hw/audio/hda-codec.c
+++ b/hw/audio/hda-codec.c
@@ -873,6 +873,7 @@ static const TypeInfo hda_audio_output_info = {
.name = "hda-output",
.parent = TYPE_HDA_AUDIO,
.class_init = hda_audio_output_class_init,
+ .secure = true,
};
static void hda_audio_duplex_class_init(ObjectClass *klass, const void *data)
@@ -888,6 +889,7 @@ static const TypeInfo hda_audio_duplex_info = {
.name = "hda-duplex",
.parent = TYPE_HDA_AUDIO,
.class_init = hda_audio_duplex_class_init,
+ .secure = true,
};
static void hda_audio_micro_class_init(ObjectClass *klass, const void *data)
@@ -903,6 +905,7 @@ static const TypeInfo hda_audio_micro_info = {
.name = "hda-micro",
.parent = TYPE_HDA_AUDIO,
.class_init = hda_audio_micro_class_init,
+ .secure = true,
};
static void hda_audio_register_types(void)
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index 3d361a4976c..b4695981e47 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -45,6 +45,7 @@ static const TypeInfo hda_codec_bus_info = {
.name = TYPE_HDA_BUS,
.parent = TYPE_BUS,
.instance_size = sizeof(HDACodecBus),
+ .secure = true,
};
void hda_codec_bus_init(DeviceState *dev, HDACodecBus *bus, size_t bus_size,
@@ -1275,12 +1276,14 @@ static const TypeInfo intel_hda_info_ich6 = {
.name = "intel-hda",
.parent = TYPE_INTEL_HDA_GENERIC,
.class_init = intel_hda_class_init_ich6,
+ .secure = true,
};
static const TypeInfo intel_hda_info_ich9 = {
.name = "ich9-intel-hda",
.parent = TYPE_INTEL_HDA_GENERIC,
.class_init = intel_hda_class_init_ich9,
+ .secure = true,
};
static void hda_codec_device_class_init(ObjectClass *klass, const void *data)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 19/28] hw/char: mark common serial / console devices as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (17 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 18/28] hw/audio: mark Intel HDA devices & codecs " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 20/28] hw/mem: mark nvdimm, pc-dimm & spapr-nvdimm " Daniel P. Berrangé
` (8 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé, Cornelia Huck
These are needed as a baseline feature for many virtualization use
cases on x86, PPC64 and s390x.
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: Cornelia Huck <cohuck@redhat.com> #sclpconsole(-lm)
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/char/debugcon.c | 1 +
hw/char/sclpconsole-lm.c | 1 +
hw/char/sclpconsole.c | 1 +
hw/char/serial-isa.c | 1 +
hw/char/serial-pci.c | 1 +
hw/char/serial.c | 1 +
hw/char/spapr_vty.c | 1 +
7 files changed, 7 insertions(+)
diff --git a/hw/char/debugcon.c b/hw/char/debugcon.c
index a1b370b90be..f38ce7b765e 100644
--- a/hw/char/debugcon.c
+++ b/hw/char/debugcon.c
@@ -134,6 +134,7 @@ static const TypeInfo debugcon_isa_info = {
.parent = TYPE_ISA_DEVICE,
.instance_size = sizeof(ISADebugconState),
.class_init = debugcon_isa_class_initfn,
+ .secure = true,
};
static void debugcon_register_types(void)
diff --git a/hw/char/sclpconsole-lm.c b/hw/char/sclpconsole-lm.c
index f6ed282f1bc..42616527356 100644
--- a/hw/char/sclpconsole-lm.c
+++ b/hw/char/sclpconsole-lm.c
@@ -363,6 +363,7 @@ static const TypeInfo sclp_console_info = {
.instance_size = sizeof(SCLPConsoleLM),
.class_init = console_class_init,
.class_size = sizeof(SCLPEventClass),
+ .secure = true,
};
static void register_types(void)
diff --git a/hw/char/sclpconsole.c b/hw/char/sclpconsole.c
index 12033e1e466..b938cc3c677 100644
--- a/hw/char/sclpconsole.c
+++ b/hw/char/sclpconsole.c
@@ -346,6 +346,7 @@ static const TypeInfo sclp_console_info = {
.instance_size = sizeof(SCLPConsole),
.class_init = console_class_init,
.class_size = sizeof(SCLPEventClass),
+ .secure = true,
};
static void register_types(void)
diff --git a/hw/char/serial-isa.c b/hw/char/serial-isa.c
index eaa4e843c02..5df87590b73 100644
--- a/hw/char/serial-isa.c
+++ b/hw/char/serial-isa.c
@@ -147,6 +147,7 @@ static const TypeInfo serial_isa_info = {
.instance_size = sizeof(ISASerialState),
.instance_init = serial_isa_initfn,
.class_init = serial_isa_class_initfn,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_ACPI_DEV_AML_IF },
{ },
diff --git a/hw/char/serial-pci.c b/hw/char/serial-pci.c
index d8cacc90859..183091ea41a 100644
--- a/hw/char/serial-pci.c
+++ b/hw/char/serial-pci.c
@@ -109,6 +109,7 @@ static const TypeInfo serial_pci_info = {
.instance_size = sizeof(PCISerialState),
.instance_init = serial_pci_init,
.class_init = serial_pci_class_initfn,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/char/serial.c b/hw/char/serial.c
index 4339562ab00..fefd2cf9fcb 100644
--- a/hw/char/serial.c
+++ b/hw/char/serial.c
@@ -984,6 +984,7 @@ static const TypeInfo serial_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(SerialState),
.class_init = serial_class_init,
+ .secure = true,
};
static void serial_register_types(void)
diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
index 1dd9fb155cb..96a4e58ad9d 100644
--- a/hw/char/spapr_vty.c
+++ b/hw/char/spapr_vty.c
@@ -201,6 +201,7 @@ static const TypeInfo spapr_vty_info = {
.parent = TYPE_VIO_SPAPR_DEVICE,
.instance_size = sizeof(SpaprVioVty),
.class_init = spapr_vty_class_init,
+ .secure = true,
};
SpaprVioDevice *spapr_vty_get_default(SpaprVioBus *bus)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 20/28] hw/mem: mark nvdimm, pc-dimm & spapr-nvdimm devices as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (18 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 19/28] hw/char: mark common serial / console devices " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 21/28] hw/uefi: mark the EFI vars service " Daniel P. Berrangé
` (7 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
These devices are used in virutalization scenarios to support memory
hotplug and other uses cases.
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/mem/nvdimm.c | 1 +
hw/mem/pc-dimm.c | 1 +
hw/ppc/spapr_nvdimm.c | 1 +
3 files changed, 3 insertions(+)
diff --git a/hw/mem/nvdimm.c b/hw/mem/nvdimm.c
index cf8a4d8c5f2..9a575798452 100644
--- a/hw/mem/nvdimm.c
+++ b/hw/mem/nvdimm.c
@@ -275,6 +275,7 @@ static const TypeInfo nvdimm_info = {
.instance_size = sizeof(NVDIMMDevice),
.instance_init = nvdimm_init,
.instance_finalize = nvdimm_finalize,
+ .secure = true,
};
static void nvdimm_register_types(void)
diff --git a/hw/mem/pc-dimm.c b/hw/mem/pc-dimm.c
index 68862926ee2..89fd06724ca 100644
--- a/hw/mem/pc-dimm.c
+++ b/hw/mem/pc-dimm.c
@@ -301,6 +301,7 @@ static const TypeInfo pc_dimm_info = {
.instance_init = pc_dimm_init,
.class_init = pc_dimm_class_init,
.class_size = sizeof(PCDIMMDeviceClass),
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_MEMORY_DEVICE },
{ }
diff --git a/hw/ppc/spapr_nvdimm.c b/hw/ppc/spapr_nvdimm.c
index 542ed79497a..ae270168500 100644
--- a/hw/ppc/spapr_nvdimm.c
+++ b/hw/ppc/spapr_nvdimm.c
@@ -916,6 +916,7 @@ static TypeInfo spapr_nvdimm_info = {
.class_size = sizeof(SPAPRNVDIMMClass),
.instance_size = sizeof(SpaprNVDIMMDevice),
.instance_init = spapr_nvdimm_init,
+ .secure = true,
};
static void spapr_nvdimm_register_types(void)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 21/28] hw/uefi: mark the EFI vars service as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (19 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 20/28] hw/mem: mark nvdimm, pc-dimm & spapr-nvdimm " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 22/28] hw/acpi: mark erst, vmclock and vmgenid devices " Daniel P. Berrangé
` (6 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
This is used to persist EFI variables when NVRAM is not available
or undesirable.
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/uefi/var-service-sysbus.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/hw/uefi/var-service-sysbus.c b/hw/uefi/var-service-sysbus.c
index e5e0441e16f..656496317b5 100644
--- a/hw/uefi/var-service-sysbus.c
+++ b/hw/uefi/var-service-sysbus.c
@@ -86,6 +86,7 @@ static const TypeInfo uefi_vars_sysbus_info = {
.instance_size = sizeof(uefi_vars_sysbus_state),
.instance_init = uefi_vars_sysbus_init,
.class_init = uefi_vars_sysbus_class_init,
+ .secure = true,
};
module_obj(TYPE_UEFI_VARS_SYSBUS);
@@ -115,6 +116,7 @@ static const TypeInfo uefi_vars_x64_info = {
.name = TYPE_UEFI_VARS_X64,
.parent = TYPE_UEFI_VARS_SYSBUS,
.class_init = uefi_vars_x64_class_init,
+ .secure = true,
};
module_obj(TYPE_UEFI_VARS_X64);
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 22/28] hw/acpi: mark erst, vmclock and vmgenid devices as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (20 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 21/28] hw/uefi: mark the EFI vars service " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 23/28] hw: mark KVM clock and RTC " Daniel P. Berrangé
` (5 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
These are all used in virtualization scenarios so must be
declare to provide a security boundary
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/acpi/erst.c | 1 +
hw/acpi/vmclock.c | 1 +
hw/acpi/vmgenid.c | 1 +
3 files changed, 3 insertions(+)
diff --git a/hw/acpi/erst.c b/hw/acpi/erst.c
index b6c1942e308..44560004a53 100644
--- a/hw/acpi/erst.c
+++ b/hw/acpi/erst.c
@@ -1044,6 +1044,7 @@ static const TypeInfo erst_type_info = {
.parent = TYPE_PCI_DEVICE,
.class_init = erst_class_init,
.instance_size = sizeof(ERSTDeviceState),
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ }
diff --git a/hw/acpi/vmclock.c b/hw/acpi/vmclock.c
index d51cab2e20a..b5453546006 100644
--- a/hw/acpi/vmclock.c
+++ b/hw/acpi/vmclock.c
@@ -169,6 +169,7 @@ static const TypeInfo vmclock_device_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(VmclockState),
.class_init = vmclock_device_class_init,
+ .secure = true,
};
static void vmclock_register_types(void)
diff --git a/hw/acpi/vmgenid.c b/hw/acpi/vmgenid.c
index 27cc0128d11..67f815d8a1e 100644
--- a/hw/acpi/vmgenid.c
+++ b/hw/acpi/vmgenid.c
@@ -236,6 +236,7 @@ static const TypeInfo vmgenid_device_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(VmGenIdState),
.class_init = vmgenid_device_class_init,
+ .secure = true,
};
static void vmgenid_register_types(void)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 23/28] hw: mark KVM clock and RTC devices as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (21 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 22/28] hw/acpi: mark erst, vmclock and vmgenid devices " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 24/28] hw: device AMD, Intel and ARM IOMMUs " Daniel P. Berrangé
` (4 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
These are core infrastructure in virtualization cases so must
provide a security boundary.
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/i386/kvm/clock.c | 1 +
hw/rtc/mc146818rtc.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/hw/i386/kvm/clock.c b/hw/i386/kvm/clock.c
index e3dad136d31..d3e23013114 100644
--- a/hw/i386/kvm/clock.c
+++ b/hw/i386/kvm/clock.c
@@ -366,6 +366,7 @@ static const TypeInfo kvmclock_info = {
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(KVMClockState),
.class_init = kvmclock_class_init,
+ .secure = true,
};
/* Note: Must be called after VCPU initialization. */
diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
index ba396435d1a..66f8b177e7f 100644
--- a/hw/rtc/mc146818rtc.c
+++ b/hw/rtc/mc146818rtc.c
@@ -1027,6 +1027,7 @@ static const TypeInfo mc146818rtc_info = {
.parent = TYPE_ISA_DEVICE,
.instance_size = sizeof(MC146818RtcState),
.class_init = rtc_class_initfn,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_ACPI_DEV_AML_IF },
{ },
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 24/28] hw: device AMD, Intel and ARM IOMMUs as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (22 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 23/28] hw: mark KVM clock and RTC " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 25/28] hw/input: mark PS/2 and PC Keyboard devices " Daniel P. Berrangé
` (3 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
These are needed in virtualization use cases to support PCI device
assignment use cases so must provide a security boundary.
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/arm/smmuv3.c | 2 ++
hw/i386/amd_iommu.c | 4 +++-
hw/i386/intel_iommu.c | 1 +
3 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index ed19536a4dc..2a9721b87e7 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -2272,12 +2272,14 @@ static const TypeInfo smmuv3_type_info = {
.instance_init = smmuv3_instance_init,
.class_size = sizeof(SMMUv3Class),
.class_init = smmuv3_class_init,
+ .secure = true,
};
static const TypeInfo smmuv3_iommu_memory_region_info = {
.parent = TYPE_IOMMU_MEMORY_REGION,
.name = TYPE_SMMUV3_IOMMU_MEMORY_REGION,
.class_init = smmuv3_iommu_memory_region_class_init,
+ .secure = true,
};
static void smmuv3_register_types(void)
diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 56e78154126..9c1576d1cee 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -2783,7 +2783,8 @@ static const TypeInfo amdvi_sysbus = {
.name = TYPE_AMD_IOMMU_DEVICE,
.parent = TYPE_X86_IOMMU_DEVICE,
.instance_size = sizeof(AMDVIState),
- .class_init = amdvi_sysbus_class_init
+ .class_init = amdvi_sysbus_class_init,
+ .secure = true,
};
static void amdvi_pci_class_init(ObjectClass *klass, const void *data)
@@ -2805,6 +2806,7 @@ static const TypeInfo amdvi_pci = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(AMDVIPCIState),
.class_init = amdvi_pci_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 350d2b77533..2414d29f716 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -5711,6 +5711,7 @@ static const TypeInfo vtd_info = {
.parent = TYPE_X86_IOMMU_DEVICE,
.instance_size = sizeof(IntelIOMMUState),
.class_init = vtd_class_init,
+ .secure = true,
};
static int vtd_attrs_to_index(IOMMUMemoryRegion *iommu_mr, MemTxAttrs attrs)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 25/28] hw/input: mark PS/2 and PC Keyboard devices as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (23 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 24/28] hw: device AMD, Intel and ARM IOMMUs " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 26/28] hw/i386: mark vmmouse / vmport " Daniel P. Berrangé
` (2 subsequent siblings)
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
These are part of the baseline x86 featureset so required for
virtualization use cases.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/input/pckbd.c | 3 ++-
hw/input/ps2.c | 6 ++++--
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
index b09c3bce933..0250252cd67 100644
--- a/hw/input/pckbd.c
+++ b/hw/input/pckbd.c
@@ -766,7 +766,8 @@ static const TypeInfo i8042_mmio_info = {
.parent = TYPE_SYS_BUS_DEVICE,
.instance_init = i8042_mmio_init,
.instance_size = sizeof(MMIOKBDState),
- .class_init = i8042_mmio_class_init
+ .class_init = i8042_mmio_class_init,
+ .secure = true,
};
void i8042_isa_mouse_fake_event(ISAKBDState *isa)
diff --git a/hw/input/ps2.c b/hw/input/ps2.c
index 01af4350b3b..9d96dddde66 100644
--- a/hw/input/ps2.c
+++ b/hw/input/ps2.c
@@ -1293,7 +1293,8 @@ static const TypeInfo ps2_kbd_info = {
.name = TYPE_PS2_KBD_DEVICE,
.parent = TYPE_PS2_DEVICE,
.instance_size = sizeof(PS2KbdState),
- .class_init = ps2_kbd_class_init
+ .class_init = ps2_kbd_class_init,
+ .secure = true,
};
static void ps2_mouse_class_init(ObjectClass *klass, const void *data)
@@ -1313,7 +1314,8 @@ static const TypeInfo ps2_mouse_info = {
.name = TYPE_PS2_MOUSE_DEVICE,
.parent = TYPE_PS2_DEVICE,
.instance_size = sizeof(PS2MouseState),
- .class_init = ps2_mouse_class_init
+ .class_init = ps2_mouse_class_init,
+ .secure = true,
};
static void ps2_init(Object *obj)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 26/28] hw/i386: mark vmmouse / vmport as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (24 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 25/28] hw/input: mark PS/2 and PC Keyboard devices " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 27/28] hw/display: mark cirrus and QXL " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 28/28] hw/usb: mark UHCI, OCHI & ECHI USB hosts " Daniel P. Berrangé
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
These paravirtualized devices are relevant to virtualization
use cases and used by the i440fx/q35 machine boards.
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/i386/vmmouse.c | 1 +
hw/i386/vmport.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/hw/i386/vmmouse.c b/hw/i386/vmmouse.c
index e289bce8e2e..612e7f7d3b6 100644
--- a/hw/i386/vmmouse.c
+++ b/hw/i386/vmmouse.c
@@ -390,6 +390,7 @@ static const TypeInfo vmmouse_info = {
.parent = TYPE_ISA_DEVICE,
.instance_size = sizeof(VMMouseState),
.class_init = vmmouse_class_initfn,
+ .secure = true,
};
static void vmmouse_register_types(void)
diff --git a/hw/i386/vmport.c b/hw/i386/vmport.c
index 865e0e70db6..24c4fb27a33 100644
--- a/hw/i386/vmport.c
+++ b/hw/i386/vmport.c
@@ -301,6 +301,7 @@ static const TypeInfo vmport_info = {
.parent = TYPE_ISA_DEVICE,
.instance_size = sizeof(VMPortState),
.class_init = vmport_class_initfn,
+ .secure = true,
};
static void vmport_register_types(void)
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 27/28] hw/display: mark cirrus and QXL as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (25 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 26/28] hw/i386: mark vmmouse / vmport " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 28/28] hw/usb: mark UHCI, OCHI & ECHI USB hosts " Daniel P. Berrangé
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
Most of the display adapters are emulating old hardware which is not
relevant to virtualization use cases. The previous commit added the
generic, simple devices.
This proposes two further devices based on their historical widespread
usage in virtualization use cases.
Cirrus (PCI, not ISA) was the recommended default for x86 for an
incredibly long time and while it is now discouraged, it is likely
to still be in common use.
QXL was the recommended default to be used with SPICE, which is designed
to service virtualization use cases and is still commonly shipped by
many distros and often used by default in mgmt apps still.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/display/cirrus_vga.c | 1 +
hw/display/qxl.c | 2 ++
2 files changed, 3 insertions(+)
diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index 0a8c74e1374..8232c5c4687 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -3013,6 +3013,7 @@ static const TypeInfo cirrus_vga_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(PCICirrusVGAState),
.class_init = cirrus_vga_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index d5f9771f5af..a8746d9f5dc 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -2651,6 +2651,7 @@ static const TypeInfo qxl_primary_info = {
.name = "qxl-vga",
.parent = TYPE_PCI_QXL,
.class_init = qxl_primary_class_init,
+ .secure = true,
};
module_obj("qxl-vga");
module_kconfig(QXL);
@@ -2669,6 +2670,7 @@ static const TypeInfo qxl_secondary_info = {
.name = "qxl",
.parent = TYPE_PCI_QXL,
.class_init = qxl_secondary_class_init,
+ .secure = true,
};
module_obj("qxl");
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread* [PATCH v2 28/28] hw/usb: mark UHCI, OCHI & ECHI USB hosts as secure
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (26 preceding siblings ...)
2026-10-29 13:12 ` [PATCH v2 27/28] hw/display: mark cirrus and QXL " Daniel P. Berrangé
@ 2026-10-29 13:12 ` Daniel P. Berrangé
27 siblings, 0 replies; 29+ messages in thread
From: Daniel P. Berrangé @ 2026-10-29 13:12 UTC (permalink / raw)
To: qemu-devel
Cc: qemu-arm, Peter Maydell, Alex Bennée, Paolo Bonzini,
Marc-André Lureau, qemu-ppc, qemu-block, qemu-riscv,
qemu-s390x, Daniel P. Berrangé
Modern virtualized guests are expected to be deployed with the
XHCI controller which supports all of USB 1, 2 and 3. The UHCI
OCHI and ECHI hosts, however, have all been widely used in
virtualization scenarios historically, especially on x86. Indeed
the -usb flag will enable UCHI by default.
So while these are undesirable hosts in general, this marks them
as secure for virtualization use cases.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/usb/hcd-ehci-pci.c | 1 +
hw/usb/hcd-ehci-sysbus.c | 7 +++++++
hw/usb/hcd-ohci-pci.c | 1 +
hw/usb/hcd-ohci-sysbus.c | 1 +
hw/usb/hcd-uhci.c | 1 +
5 files changed, 11 insertions(+)
diff --git a/hw/usb/hcd-ehci-pci.c b/hw/usb/hcd-ehci-pci.c
index fd35d253407..2080ea2913a 100644
--- a/hw/usb/hcd-ehci-pci.c
+++ b/hw/usb/hcd-ehci-pci.c
@@ -219,6 +219,7 @@ static void ehci_pci_register_types(void)
TypeInfo ehci_type_info = {
.parent = TYPE_PCI_EHCI,
.class_init = ehci_data_class_init,
+ .secure = true,
};
int i;
diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index 7f7c7f8a2f1..0af658d2b68 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -247,32 +247,38 @@ static const TypeInfo ehci_sysbus_types[] = {
.name = TYPE_PLATFORM_EHCI,
.parent = TYPE_SYS_BUS_EHCI,
.class_init = ehci_platform_class_init,
+ .secure = true,
},
{
.name = TYPE_EXYNOS4210_EHCI,
.parent = TYPE_SYS_BUS_EHCI,
.class_init = ehci_exynos4210_class_init,
+ .secure = true,
},
{
.name = TYPE_AW_H3_EHCI,
.parent = TYPE_SYS_BUS_EHCI,
.class_init = ehci_aw_h3_class_init,
+ .secure = true,
},
{
.name = TYPE_NPCM7XX_EHCI,
.parent = TYPE_SYS_BUS_EHCI,
.class_init = ehci_npcm7xx_class_init,
+ .secure = true,
},
{
.name = TYPE_TEGRA2_EHCI,
.parent = TYPE_SYS_BUS_EHCI,
.class_init = ehci_tegra2_class_init,
+ .secure = true,
},
{
.name = TYPE_PPC4xx_EHCI,
.parent = TYPE_SYS_BUS_EHCI,
.class_init = ehci_ppc4xx_class_init,
.instance_init = ehci_ppc4xx_init,
+ .secure = true,
},
{
.name = TYPE_FUSBH200_EHCI,
@@ -280,6 +286,7 @@ static const TypeInfo ehci_sysbus_types[] = {
.instance_size = sizeof(FUSBH200EHCIState),
.instance_init = fusbh200_ehci_init,
.class_init = fusbh200_ehci_class_init,
+ .secure = true,
},
};
diff --git a/hw/usb/hcd-ohci-pci.c b/hw/usb/hcd-ohci-pci.c
index 70c9e9ac4f5..cf0746aa00b 100644
--- a/hw/usb/hcd-ohci-pci.c
+++ b/hw/usb/hcd-ohci-pci.c
@@ -148,6 +148,7 @@ static const TypeInfo ohci_pci_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(OHCIPCIState),
.class_init = ohci_pci_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/usb/hcd-ohci-sysbus.c b/hw/usb/hcd-ohci-sysbus.c
index 4f51eebccb2..fd04e918e8a 100644
--- a/hw/usb/hcd-ohci-sysbus.c
+++ b/hw/usb/hcd-ohci-sysbus.c
@@ -80,6 +80,7 @@ static const TypeInfo ohci_sysbus_types[] = {
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(OHCISysBusState),
.class_init = ohci_sysbus_class_init,
+ .secure = true,
},
};
diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
index a7b9fe13175..c6d163aa9f6 100644
--- a/hw/usb/hcd-uhci.c
+++ b/hw/usb/hcd-uhci.c
@@ -1380,6 +1380,7 @@ static void uhci_register_types(void)
TypeInfo uhci_type_info = {
.parent = TYPE_UHCI,
.class_init = uhci_data_class_init,
+ .secure = true,
};
int i;
--
2.56.0
^ permalink raw reply related [flat|nested] 29+ messages in thread