Re: [PATCH v2 14/28] hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts as secure

["Daniel P. Berrangé" <berrange@redhat.com>]

On Fri, Nov 06, 2026 at 01:38:12PM +0100, Thomas Huth wrote:
> On 29/10/2026 14.12, Daniel P. Berrangé wrote:
> > Mark the PCI hosts secure if they are used from machine types
> > that are considered for the virtualization use case.
> > 
> > There is also a special case for the 'remote' type and the
> > Xen passthrough type.
> > 
> > Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
> > Acked-by: Cornelia Huck <cohuck@redhat.com> #s390
> > Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> > ---
> ...
> > diff --git a/hw/pci-host/pnv_phb.c b/hw/pci-host/pnv_phb.c
> > index 0b556d1bf5c..bc8313d2cd0 100644
> > --- a/hw/pci-host/pnv_phb.c
> > +++ b/hw/pci-host/pnv_phb.c
> > @@ -333,6 +333,7 @@ static const TypeInfo pnv_phb_type_info = {
> >       .parent        = TYPE_PCIE_HOST_BRIDGE,
> >       .instance_size = sizeof(PnvPHB),
> >       .class_init    = pnv_phb_class_init,
> > +    .secure        = true,
> >   };
> >   static const TypeInfo pnv_phb_root_port_info = {
> > @@ -340,6 +341,7 @@ static const TypeInfo pnv_phb_root_port_info = {
> >       .parent        = TYPE_PCIE_ROOT_PORT,
> >       .instance_size = sizeof(PnvPHBRootPort),
> >       .class_init    = pnv_phb_root_port_class_init,
> > +    .secure        = true,
> >   };
> >   static void pnv_phb_register_types(void)
> > diff --git a/hw/pci-host/pnv_phb3.c b/hw/pci-host/pnv_phb3.c
> > index db061c134e9..abf43e3226d 100644
> > --- a/hw/pci-host/pnv_phb3.c
> > +++ b/hw/pci-host/pnv_phb3.c
> > @@ -910,6 +910,7 @@ static const TypeInfo pnv_phb3_iommu_memory_region_info = {
> >       .parent = TYPE_IOMMU_MEMORY_REGION,
> >       .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
> >       .class_init = pnv_phb3_iommu_memory_region_class_init,
> > +    .secure = true,
> >   };
> >   /*
> > @@ -1123,6 +1124,7 @@ static const TypeInfo pnv_phb3_type_info = {
> >       .instance_size = sizeof(PnvPHB3),
> >       .class_init    = pnv_phb3_class_init,
> >       .instance_init = pnv_phb3_instance_init,
> > +    .secure        = true,
> >   };
> >   static void pnv_phb3_root_bus_get_prop(Object *obj, Visitor *v,
> > @@ -1186,6 +1188,7 @@ static const TypeInfo pnv_phb3_root_bus_info = {
> >       .parent = TYPE_PCIE_BUS,
> >       .instance_size = sizeof(PnvPHB3RootBus),
> >       .class_init = pnv_phb3_root_bus_class_init,
> > +    .secure = true,
> >   };
> >   static void pnv_phb3_register_types(void)
> > diff --git a/hw/pci-host/pnv_phb3_msi.c b/hw/pci-host/pnv_phb3_msi.c
> > index 66ba7b79134..5edc0d43eb0 100644
> > --- a/hw/pci-host/pnv_phb3_msi.c
> > +++ b/hw/pci-host/pnv_phb3_msi.c
> > @@ -306,6 +306,7 @@ static const TypeInfo phb3_msi_info = {
> >       .class_init = phb3_msi_class_init,
> >       .class_size = sizeof(ICSStateClass),
> >       .instance_init = phb3_msi_instance_init,
> > +    .secure = true,
> >   };
> >   static void pnv_phb3_msi_register_types(void)
> > diff --git a/hw/pci-host/pnv_phb3_pbcq.c b/hw/pci-host/pnv_phb3_pbcq.c
> > index 1f7a149580d..687c8325158 100644
> > --- a/hw/pci-host/pnv_phb3_pbcq.c
> > +++ b/hw/pci-host/pnv_phb3_pbcq.c
> > @@ -354,6 +354,7 @@ static const TypeInfo pnv_pbcq_type_info = {
> >       .instance_size = sizeof(PnvPBCQState),
> >       .instance_init = phb3_pbcq_instance_init,
> >       .class_init    = pnv_pbcq_class_init,
> > +    .secure        = true,
> >       .interfaces    = (const InterfaceInfo[]) {
> >           { TYPE_PNV_XSCOM_INTERFACE },
> >           { }
> > diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c
> > index ac09a0b034d..1a652110f5d 100644
> > --- a/hw/pci-host/pnv_phb4.c
> > +++ b/hw/pci-host/pnv_phb4.c
> > @@ -1388,6 +1388,7 @@ static const TypeInfo pnv_phb4_iommu_memory_region_info = {
> >       .parent = TYPE_IOMMU_MEMORY_REGION,
> >       .name = TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
> >       .class_init = pnv_phb4_iommu_memory_region_class_init,
> > +    .secure = true,
> >   };
> >   /*
> > @@ -1729,13 +1730,13 @@ static const TypeInfo pnv_phb4_type_info = {
> >       .instance_init = pnv_phb4_instance_init,
> >       .instance_size = sizeof(PnvPHB4),
> >       .class_init    = pnv_phb4_class_init,
> > +    .secure        = true,
> >       .interfaces = (const InterfaceInfo[]) {
> >               { TYPE_XIVE_NOTIFIER },
> >               { },
> >       }
> >   };
> > -
> >   static void pnv_phb4_root_bus_get_prop(Object *obj, Visitor *v,
> >                                          const char *name,
> >                                          void *opaque, Error **errp)
> > @@ -1797,6 +1798,7 @@ static const TypeInfo pnv_phb4_root_bus_info = {
> >       .parent = TYPE_PCIE_BUS,
> >       .instance_size = sizeof(PnvPHB4RootBus),
> >       .class_init = pnv_phb4_root_bus_class_init,
> > +    .secure = true,
> >   };
> >   static void pnv_phb4_register_types(void)
> > diff --git a/hw/pci-host/pnv_phb4_pec.c b/hw/pci-host/pnv_phb4_pec.c
> > index ee5cdc3e450..280a15e8df1 100644
> > --- a/hw/pci-host/pnv_phb4_pec.c
> > +++ b/hw/pci-host/pnv_phb4_pec.c
> > @@ -388,6 +388,7 @@ static const TypeInfo pnv_pec_type_info = {
> >       .instance_size = sizeof(PnvPhb4PecState),
> >       .class_init    = pnv_pec_class_init,
> >       .class_size    = sizeof(PnvPhb4PecClass),
> > +    .secure        = true,
> >       .interfaces    = (const InterfaceInfo[]) {
> >           { TYPE_PNV_XSCOM_INTERFACE },
> >           { }
> 
> The changes to the pnv* files are related to the powernv machine - which is
> not covered by the virtualization use case. Please remove these from your
> patch.

Ah, I got misled in my search, as spapr mentions PHB, but its a
different context.


> > diff --git a/hw/pci-host/remote.c b/hw/pci-host/remote.c
> > index 9ea95fac6e6..a58fc39bded 100644
> > --- a/hw/pci-host/remote.c
> > +++ b/hw/pci-host/remote.c
> > @@ -63,6 +63,7 @@ static const TypeInfo remote_pcihost_info = {
> >       .parent = TYPE_PCIE_HOST_BRIDGE,
> >       .instance_size = sizeof(RemotePCIHost),
> >       .class_init = remote_pcihost_class_init,
> > +    .secure = true,
> >   };
> This is part of the "remote" machine, isn't it? I don't think we cover this
> in the virtualization use case, do we? Please remove this, too.

Agreed, a mistake.

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|