Re: [PATCH v2 08/28] hw/usb: mark commonly used USB devices/hosts as secure

["Daniel P. Berrangé" <berrange@redhat.com>]

On Fri, Nov 06, 2026 at 01:05:05PM +0100, Thomas Huth wrote:
> On 29/10/2026 14.12, Daniel P. Berrangé wrote:
> > Modern virtualized guests are expected to be deployed with the
> > XHCI controller which supports all of USB 1, 2 and 3, so should
> > be declared secure.
> > 
> > The "NEC" XHCI variant is slightly non-standard, but since it is
> > a trivial sub-class of the generic XHCI, there's no reason to
> > exclude it.
> > 
> > The set of devices that are expected to be used is HID (mouse,
> > tablet, keyboard), host passthrough, CCID (smartcard), hub,
> > storage and the redirect tunnelling.
> > 
> > Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> > ---
> >   hw/usb/ccid-card-emulated.c   | 1 +
> >   hw/usb/ccid-card-passthru.c   | 1 +
> >   hw/usb/dev-hid.c              | 3 +++
> >   hw/usb/dev-hub.c              | 1 +
> >   hw/usb/dev-smartcard-reader.c | 2 ++
> >   hw/usb/dev-storage-bot.c      | 1 +
> >   hw/usb/dev-storage-classic.c  | 1 +
> >   hw/usb/hcd-xhci-nec.c         | 1 +
> >   hw/usb/hcd-xhci-pci.c         | 1 +
> >   hw/usb/hcd-xhci-sysbus.c      | 3 ++-
> >   hw/usb/hcd-xhci.c             | 1 +
> >   hw/usb/host-libusb.c          | 1 +
> >   hw/usb/redirect.c             | 1 +
> >   13 files changed, 17 insertions(+), 1 deletion(-)
> ...
> > diff --git a/hw/usb/dev-storage-bot.c b/hw/usb/dev-storage-bot.c
> > index a7f8d80c17a..b156f1c5c9a 100644
> > --- a/hw/usb/dev-storage-bot.c
> > +++ b/hw/usb/dev-storage-bot.c
> > @@ -52,6 +52,7 @@ static const TypeInfo bot_info = {
> >       .name          = "usb-bot",
> >       .parent        = TYPE_USB_STORAGE,
> >       .class_init    = usb_msd_class_bot_initfn,
> > +    .secure        = true,
> >   };
> >   static void register_types(void)
> > diff --git a/hw/usb/dev-storage-classic.c b/hw/usb/dev-storage-classic.c
> > index 977151c4a08..7e0699cb518 100644
> > --- a/hw/usb/dev-storage-classic.c
> > +++ b/hw/usb/dev-storage-classic.c
> > @@ -133,6 +133,7 @@ static const TypeInfo msd_info = {
> >       .parent        = TYPE_USB_STORAGE,
> >       .class_init    = usb_msd_class_storage_initfn,
> >       .instance_init = usb_msd_instance_init,
> > +    .secure        = true,
> >   };
> Can we exclude usb-bot and usb-storage from the secure list? I've never seen
> them really being used for real virtualization installations, and I think
> they are not that well tested?

We've shipped them as part of RHEL essentially forever so from a
downstream POV we're on the hook to support them.

I would see them as a way to provide adhoc removable storage to a
VM which doesn't require any special drivers, since everything
supports USB storage for 20+ years. We don't have a SCSI controller
beyond virtio-scsi that's declared secure, and SCSI isn't
accessible to unprivileged users, so USB is useful for desktop
virtualization use cases IMHO.

> 
> With those two hunks being removed:
> Reviewed-by: Thomas Huth <thuth@redhat.com>
> 

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|