From: "Daniel P. Berrangé" <berrange@redhat.com>
To: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org, "Peter Maydell" <peter.maydell@linaro.org>,
"Alex Bennée" <alex.bennee@linaro.org>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"Marc-André Lureau" <marcandre.lureau@redhat.com>,
qemu-ppc@nongnu.org, qemu-block@nongnu.org,
qemu-riscv@nongnu.org, qemu-s390x@nongnu.org,
"Daniel P. Berrangé" <berrange@redhat.com>
Subject: [PATCH v2 04/28] hw: mark all remaining virtio object types as secure
Date: Thu, 29 Oct 2026 13:12:17 +0000 [thread overview]
Message-ID: <20261029131241.2275706-5-berrange@redhat.com> (raw)
In-Reply-To: <20261029131241.2275706-1-berrange@redhat.com>
These are all intended for use in a virtualization scenario and must
provide a security boundary.
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/9pfs/virtio-9p-device.c | 1 +
hw/audio/virtio-snd.c | 1 +
hw/block/virtio-blk.c | 1 +
hw/char/virtio-console.c | 2 ++
hw/char/virtio-serial-bus.c | 2 ++
hw/display/virtio-gpu-gl.c | 1 +
hw/display/virtio-gpu-rutabaga.c | 1 +
hw/display/virtio-gpu.c | 1 +
hw/input/virtio-input-hid.c | 4 ++++
hw/input/virtio-input-host.c | 1 +
hw/net/virtio-net.c | 1 +
hw/scsi/virtio-scsi.c | 1 +
hw/virtio/vdpa-dev.c | 1 +
hw/virtio/virtio-balloon.c | 1 +
hw/virtio/virtio-crypto.c | 1 +
hw/virtio/virtio-iommu.c | 2 ++
hw/virtio/virtio-mem.c | 1 +
hw/virtio/virtio-mmio.c | 2 ++
hw/virtio/virtio-nsm.c | 1 +
hw/virtio/virtio-pmem.c | 1 +
hw/virtio/virtio-rng.c | 1 +
hw/virtio/virtio-rtc.c | 1 +
22 files changed, 29 insertions(+)
diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
index 2774fc2290a..a4572c851df 100644
--- a/hw/9pfs/virtio-9p-device.c
+++ b/hw/9pfs/virtio-9p-device.c
@@ -288,6 +288,7 @@ static const TypeInfo virtio_device_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(V9fsVirtioState),
.class_init = virtio_9p_class_init,
+ .secure = true,
};
static void virtio_9p_register_types(void)
diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index 6df7ea0eb04..0e3d5ec6aba 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -1536,6 +1536,7 @@ static const TypeInfo virtio_snd_types[] = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIOSound),
.class_init = virtio_snd_class_init,
+ .secure = true,
}
};
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index 536d71a91ad..b15ab8e5450 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -2071,6 +2071,7 @@ static const TypeInfo virtio_blk_info = {
.instance_init = virtio_blk_instance_init,
.class_init = virtio_blk_class_init,
.class_size = sizeof(VirtIOBlkClass),
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/char/virtio-console.c b/hw/char/virtio-console.c
index db9d8ca797f..cd42cbe7646 100644
--- a/hw/char/virtio-console.c
+++ b/hw/char/virtio-console.c
@@ -295,6 +295,7 @@ static const TypeInfo virtconsole_info = {
.name = "virtconsole",
.parent = TYPE_VIRTIO_CONSOLE_SERIAL_PORT,
.class_init = virtconsole_class_init,
+ .secure = true,
};
static const Property virtserialport_properties[] = {
@@ -320,6 +321,7 @@ static const TypeInfo virtserialport_info = {
.parent = TYPE_VIRTIO_SERIAL_PORT,
.instance_size = sizeof(VirtConsole),
.class_init = virtserialport_class_init,
+ .secure = true,
};
static void virtconsole_register_types(void)
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index 882765ac88a..7fe90571249 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -915,6 +915,7 @@ static const TypeInfo virtser_bus_info = {
.parent = TYPE_BUS,
.instance_size = sizeof(VirtIOSerialBus),
.class_init = virtser_bus_class_init,
+ .secure = true,
};
#ifdef CONFIG_HMP
@@ -1250,6 +1251,7 @@ static const TypeInfo virtio_device_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIOSerial),
.class_init = virtio_serial_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
diff --git a/hw/display/virtio-gpu-gl.c b/hw/display/virtio-gpu-gl.c
index 2b7a41c4664..75174b6731f 100644
--- a/hw/display/virtio-gpu-gl.c
+++ b/hw/display/virtio-gpu-gl.c
@@ -233,6 +233,7 @@ static const TypeInfo virtio_gpu_gl_info = {
.parent = TYPE_VIRTIO_GPU,
.instance_size = sizeof(VirtIOGPUGL),
.class_init = virtio_gpu_gl_class_init,
+ .secure = true,
};
module_obj(TYPE_VIRTIO_GPU_GL);
module_kconfig(VIRTIO_GPU);
diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutabaga.c
index 1312a67d701..424f1e3556f 100644
--- a/hw/display/virtio-gpu-rutabaga.c
+++ b/hw/display/virtio-gpu-rutabaga.c
@@ -1169,6 +1169,7 @@ static const TypeInfo virtio_gpu_rutabaga_info[] = {
.parent = TYPE_VIRTIO_GPU,
.instance_size = sizeof(VirtIOGPURutabaga),
.class_init = virtio_gpu_rutabaga_class_init,
+ .secure = true,
},
};
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 5d43ffb9918..d248e50abcb 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1995,6 +1995,7 @@ static const TypeInfo virtio_gpu_info = {
.instance_size = sizeof(VirtIOGPU),
.class_size = sizeof(VirtIOGPUClass),
.class_init = virtio_gpu_class_init,
+ .secure = true,
};
module_obj(TYPE_VIRTIO_GPU);
module_kconfig(VIRTIO_GPU);
diff --git a/hw/input/virtio-input-hid.c b/hw/input/virtio-input-hid.c
index 1019d6b2e53..38c338d836c 100644
--- a/hw/input/virtio-input-hid.c
+++ b/hw/input/virtio-input-hid.c
@@ -315,6 +315,7 @@ static const TypeInfo virtio_keyboard_info = {
.parent = TYPE_VIRTIO_INPUT_HID,
.instance_size = sizeof(VirtIOInputHID),
.instance_init = virtio_keyboard_init,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
@@ -369,6 +370,7 @@ static const TypeInfo virtio_mouse_info = {
.parent = TYPE_VIRTIO_INPUT_HID,
.instance_size = sizeof(VirtIOInputHID),
.instance_init = virtio_mouse_init,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
@@ -442,6 +444,7 @@ static const TypeInfo virtio_tablet_info = {
.parent = TYPE_VIRTIO_INPUT_HID,
.instance_size = sizeof(VirtIOInputHID),
.instance_init = virtio_tablet_init,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
@@ -527,6 +530,7 @@ static const TypeInfo virtio_multitouch_info = {
.parent = TYPE_VIRTIO_INPUT_HID,
.instance_size = sizeof(VirtIOInputHID),
.instance_init = virtio_multitouch_init,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
diff --git a/hw/input/virtio-input-host.c b/hw/input/virtio-input-host.c
index 633547cc4f7..0d01e00cfcb 100644
--- a/hw/input/virtio-input-host.c
+++ b/hw/input/virtio-input-host.c
@@ -248,6 +248,7 @@ static const TypeInfo virtio_input_host_info = {
.instance_size = sizeof(VirtIOInputHost),
.instance_init = virtio_input_host_init,
.class_init = virtio_input_host_class_init,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 19f453fb7df..85472038aca 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -4491,6 +4491,7 @@ static const TypeInfo virtio_net_info = {
.instance_size = sizeof(VirtIONet),
.instance_init = virtio_net_instance_init,
.class_init = virtio_net_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index d7e2662aa73..ef5cc7a6ce8 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -1456,6 +1456,7 @@ static const TypeInfo virtio_scsi_info = {
.parent = TYPE_VIRTIO_SCSI_COMMON,
.instance_size = sizeof(VirtIOSCSI),
.class_init = virtio_scsi_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c
index 7e5cc040e94..50811f79c07 100644
--- a/hw/virtio/vdpa-dev.c
+++ b/hw/virtio/vdpa-dev.c
@@ -392,6 +392,7 @@ static const TypeInfo vhost_vdpa_device_info = {
.instance_size = sizeof(VhostVdpaDevice),
.class_init = vhost_vdpa_device_class_init,
.instance_init = vhost_vdpa_device_instance_init,
+ .secure = true,
};
static void register_vhost_vdpa_device_type(void)
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index 07d519cf6d7..cb9928b16a4 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -1100,6 +1100,7 @@ static const TypeInfo virtio_balloon_info = {
.instance_size = sizeof(VirtIOBalloon),
.instance_init = virtio_balloon_instance_init,
.class_init = virtio_balloon_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
index 85c7279aae2..8968d9f293e 100644
--- a/hw/virtio/virtio-crypto.c
+++ b/hw/virtio/virtio-crypto.c
@@ -1313,6 +1313,7 @@ static const TypeInfo virtio_crypto_info = {
.instance_size = sizeof(VirtIOCrypto),
.instance_init = virtio_crypto_instance_init,
.class_init = virtio_crypto_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index 208815096fc..664d1c0b6b9 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -1749,12 +1749,14 @@ static const TypeInfo virtio_iommu_info = {
.instance_size = sizeof(VirtIOIOMMU),
.instance_init = virtio_iommu_instance_init,
.class_init = virtio_iommu_class_init,
+ .secure = true,
};
static const TypeInfo virtio_iommu_memory_region_info = {
.parent = TYPE_IOMMU_MEMORY_REGION,
.name = TYPE_VIRTIO_IOMMU_MEMORY_REGION,
.class_init = virtio_iommu_memory_region_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index 7130ed852d9..edad9465cb1 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -1668,6 +1668,7 @@ static const TypeInfo virtio_mem_info = {
.instance_finalize = virtio_mem_instance_finalize,
.class_init = virtio_mem_class_init,
.class_size = sizeof(VirtIOMEMClass),
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_RAM_DISCARD_SOURCE },
{ }
diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
index 55ceaeef5fc..f51c8d17b9a 100644
--- a/hw/virtio/virtio-mmio.c
+++ b/hw/virtio/virtio-mmio.c
@@ -779,6 +779,7 @@ static const TypeInfo virtio_mmio_info = {
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(VirtIOMMIOProxy),
.class_init = virtio_mmio_class_init,
+ .secure = true,
};
/* virtio-mmio-bus. */
@@ -848,6 +849,7 @@ static const TypeInfo virtio_mmio_bus_info = {
.parent = TYPE_VIRTIO_BUS,
.instance_size = sizeof(VirtioBusState),
.class_init = virtio_mmio_bus_class_init,
+ .secure = true,
};
static void virtio_mmio_register_types(void)
diff --git a/hw/virtio/virtio-nsm.c b/hw/virtio/virtio-nsm.c
index 3bf5e7009a4..099342f3792 100644
--- a/hw/virtio/virtio-nsm.c
+++ b/hw/virtio/virtio-nsm.c
@@ -1727,6 +1727,7 @@ static const TypeInfo virtio_nsm_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIONSM),
.class_init = virtio_nsm_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-pmem.c b/hw/virtio/virtio-pmem.c
index 6f7271c140a..1a414d7ba29 100644
--- a/hw/virtio/virtio-pmem.c
+++ b/hw/virtio/virtio-pmem.c
@@ -196,6 +196,7 @@ static const TypeInfo virtio_pmem_info = {
.class_size = sizeof(VirtIOPMEMClass),
.class_init = virtio_pmem_class_init,
.instance_size = sizeof(VirtIOPMEM),
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-rng.c b/hw/virtio/virtio-rng.c
index d68d9011953..ba80138179b 100644
--- a/hw/virtio/virtio-rng.c
+++ b/hw/virtio/virtio-rng.c
@@ -282,6 +282,7 @@ static const TypeInfo virtio_rng_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIORNG),
.class_init = virtio_rng_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-rtc.c b/hw/virtio/virtio-rtc.c
index 0dcbe94758a..633bff8ac2c 100644
--- a/hw/virtio/virtio-rtc.c
+++ b/hw/virtio/virtio-rtc.c
@@ -181,6 +181,7 @@ static const TypeInfo virtio_rtc_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIORtc),
.class_init = virtio_rtc_class_init,
+ .secure = true,
};
static void virtio_rtc_register_types(void)
--
2.56.0
next prev parent reply other threads:[~2026-10-29 13:14 UTC|newest]
Thread overview: 29+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-29 13:12 [PATCH v2 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 01/28] hw: mark all virtio PCI devices as secure Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 02/28] hw: mark all virtio CCW " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 03/28] hw: mark all vhost devices a secure Daniel P. Berrangé
2026-10-29 13:12 ` Daniel P. Berrangé [this message]
2026-10-29 13:12 ` [PATCH v2 05/28] hw/vfio: mark all VFIO object classes as secure Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 06/28] hw/xen: mark all Xen related object types as being secure Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 07/28] hw/net: mark e1000, e1000e, IGB, rtl8139 & sPAPR VLAN as secure Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 08/28] hw/usb: mark commonly used USB devices/hosts " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 09/28] hw/watchdog: mark some watchdog devices " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 10/28] hw/scsi: mark spapr SCSI controller " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 11/28] hw/scsi: mark SCSI disk endpoint devices " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 12/28] hw/ide: mark ICH9 and ide-hd/ide-cd " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 13/28] hw: define most common PCI types " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 14/28] hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 15/28] hw/display: mark bochs, ramfb and VGA " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 16/28] hw/tpm: mark all TPM implementations " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 17/28] hw/misc: mark pvpanic, vmcoreinfo " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 18/28] hw/audio: mark Intel HDA devices & codecs " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 19/28] hw/char: mark common serial / console devices " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 20/28] hw/mem: mark nvdimm, pc-dimm & spapr-nvdimm " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 21/28] hw/uefi: mark the EFI vars service " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 22/28] hw/acpi: mark erst, vmclock and vmgenid devices " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 23/28] hw: mark KVM clock and RTC " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 24/28] hw: device AMD, Intel and ARM IOMMUs " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 25/28] hw/input: mark PS/2 and PC Keyboard devices " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 26/28] hw/i386: mark vmmouse / vmport " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 27/28] hw/display: mark cirrus and QXL " Daniel P. Berrangé
2026-10-29 13:12 ` [PATCH v2 28/28] hw/usb: mark UHCI, OCHI & ECHI USB hosts " Daniel P. Berrangé
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261029131241.2275706-5-berrange@redhat.com \
--to=berrange@redhat.com \
--cc=alex.bennee@linaro.org \
--cc=marcandre.lureau@redhat.com \
--cc=pbonzini@redhat.com \
--cc=peter.maydell@linaro.org \
--cc=qemu-arm@nongnu.org \
--cc=qemu-block@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-ppc@nongnu.org \
--cc=qemu-riscv@nongnu.org \
--cc=qemu-s390x@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.