From: "Daniel P. Berrangé" <berrange@redhat.com>
To: qemu-devel@nongnu.org
Cc: xen-devel@lists.xenproject.org, qemu-riscv@nongnu.org,
qemu-ppc@nongnu.org, qemu-block@nongnu.org,
qemu-s390x@nongnu.org, qemu-arm@nongnu.org,
"Daniel P. Berrangé" <berrange@redhat.com>
Subject: [PATCH 16/28] hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts as secure
Date: Fri, 11 Sep 2026 15:36:15 +0100 [thread overview]
Message-ID: <20260911143627.2743803-17-berrange@redhat.com> (raw)
In-Reply-To: <20260911143627.2743803-1-berrange@redhat.com>
Mark the PCI hosts secure if they are used from machine types
that are considered for the virtualization use case.
There is also a special case for the 'remote' type and the
Xen passthrough type.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/pci-host/gpex.c | 2 ++
hw/pci-host/i440fx.c | 2 ++
hw/pci-host/pnv_phb.c | 2 ++
hw/pci-host/pnv_phb3.c | 3 +++
hw/pci-host/pnv_phb3_msi.c | 1 +
hw/pci-host/pnv_phb3_pbcq.c | 1 +
hw/pci-host/pnv_phb4.c | 4 +++-
hw/pci-host/pnv_phb4_pec.c | 1 +
hw/pci-host/q35.c | 2 ++
hw/pci-host/remote.c | 1 +
hw/pci-host/xen_igd_pt.c | 1 +
hw/ppc/spapr_pci.c | 1 +
hw/s390x/s390-pci-bus.c | 4 ++++
13 files changed, 24 insertions(+), 1 deletion(-)
diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index e66784ce51..38197a8945 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -220,6 +220,7 @@ static const TypeInfo gpex_host_info = {
.instance_size = sizeof(GPEXHost),
.instance_init = gpex_host_initfn,
.class_init = gpex_host_class_init,
+ .secure = true,
};
/****************************************************************************
@@ -259,6 +260,7 @@ static const TypeInfo gpex_root_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(GPEXRootState),
.class_init = gpex_root_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
index c1982f7962..1c5a4aba1b 100644
--- a/hw/pci-host/i440fx.c
+++ b/hw/pci-host/i440fx.c
@@ -352,6 +352,7 @@ static const TypeInfo i440fx_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(PCII440FXState),
.class_init = i440fx_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
@@ -410,6 +411,7 @@ static const TypeInfo i440fx_pcihost_info = {
.instance_size = sizeof(I440FXState),
.instance_init = i440fx_pcihost_initfn,
.class_init = i440fx_pcihost_class_init,
+ .secure = true,
};
static void i440fx_register_types(void)
diff --git a/hw/pci-host/pnv_phb.c b/hw/pci-host/pnv_phb.c
index 0b556d1bf5..bc8313d2cd 100644
--- a/hw/pci-host/pnv_phb.c
+++ b/hw/pci-host/pnv_phb.c
@@ -333,6 +333,7 @@ static const TypeInfo pnv_phb_type_info = {
.parent = TYPE_PCIE_HOST_BRIDGE,
.instance_size = sizeof(PnvPHB),
.class_init = pnv_phb_class_init,
+ .secure = true,
};
static const TypeInfo pnv_phb_root_port_info = {
@@ -340,6 +341,7 @@ static const TypeInfo pnv_phb_root_port_info = {
.parent = TYPE_PCIE_ROOT_PORT,
.instance_size = sizeof(PnvPHBRootPort),
.class_init = pnv_phb_root_port_class_init,
+ .secure = true,
};
static void pnv_phb_register_types(void)
diff --git a/hw/pci-host/pnv_phb3.c b/hw/pci-host/pnv_phb3.c
index db061c134e..abf43e3226 100644
--- a/hw/pci-host/pnv_phb3.c
+++ b/hw/pci-host/pnv_phb3.c
@@ -910,6 +910,7 @@ static const TypeInfo pnv_phb3_iommu_memory_region_info = {
.parent = TYPE_IOMMU_MEMORY_REGION,
.name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
.class_init = pnv_phb3_iommu_memory_region_class_init,
+ .secure = true,
};
/*
@@ -1123,6 +1124,7 @@ static const TypeInfo pnv_phb3_type_info = {
.instance_size = sizeof(PnvPHB3),
.class_init = pnv_phb3_class_init,
.instance_init = pnv_phb3_instance_init,
+ .secure = true,
};
static void pnv_phb3_root_bus_get_prop(Object *obj, Visitor *v,
@@ -1186,6 +1188,7 @@ static const TypeInfo pnv_phb3_root_bus_info = {
.parent = TYPE_PCIE_BUS,
.instance_size = sizeof(PnvPHB3RootBus),
.class_init = pnv_phb3_root_bus_class_init,
+ .secure = true,
};
static void pnv_phb3_register_types(void)
diff --git a/hw/pci-host/pnv_phb3_msi.c b/hw/pci-host/pnv_phb3_msi.c
index 66ba7b7913..5edc0d43eb 100644
--- a/hw/pci-host/pnv_phb3_msi.c
+++ b/hw/pci-host/pnv_phb3_msi.c
@@ -306,6 +306,7 @@ static const TypeInfo phb3_msi_info = {
.class_init = phb3_msi_class_init,
.class_size = sizeof(ICSStateClass),
.instance_init = phb3_msi_instance_init,
+ .secure = true,
};
static void pnv_phb3_msi_register_types(void)
diff --git a/hw/pci-host/pnv_phb3_pbcq.c b/hw/pci-host/pnv_phb3_pbcq.c
index 1f7a149580..687c832515 100644
--- a/hw/pci-host/pnv_phb3_pbcq.c
+++ b/hw/pci-host/pnv_phb3_pbcq.c
@@ -354,6 +354,7 @@ static const TypeInfo pnv_pbcq_type_info = {
.instance_size = sizeof(PnvPBCQState),
.instance_init = phb3_pbcq_instance_init,
.class_init = pnv_pbcq_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_PNV_XSCOM_INTERFACE },
{ }
diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c
index 9acaf4c0c2..9706208473 100644
--- a/hw/pci-host/pnv_phb4.c
+++ b/hw/pci-host/pnv_phb4.c
@@ -1374,6 +1374,7 @@ static const TypeInfo pnv_phb4_iommu_memory_region_info = {
.parent = TYPE_IOMMU_MEMORY_REGION,
.name = TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
.class_init = pnv_phb4_iommu_memory_region_class_init,
+ .secure = true,
};
/*
@@ -1715,13 +1716,13 @@ static const TypeInfo pnv_phb4_type_info = {
.instance_init = pnv_phb4_instance_init,
.instance_size = sizeof(PnvPHB4),
.class_init = pnv_phb4_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_XIVE_NOTIFIER },
{ },
}
};
-
static void pnv_phb4_root_bus_get_prop(Object *obj, Visitor *v,
const char *name,
void *opaque, Error **errp)
@@ -1783,6 +1784,7 @@ static const TypeInfo pnv_phb4_root_bus_info = {
.parent = TYPE_PCIE_BUS,
.instance_size = sizeof(PnvPHB4RootBus),
.class_init = pnv_phb4_root_bus_class_init,
+ .secure = true,
};
static void pnv_phb4_register_types(void)
diff --git a/hw/pci-host/pnv_phb4_pec.c b/hw/pci-host/pnv_phb4_pec.c
index ee5cdc3e45..280a15e8df 100644
--- a/hw/pci-host/pnv_phb4_pec.c
+++ b/hw/pci-host/pnv_phb4_pec.c
@@ -388,6 +388,7 @@ static const TypeInfo pnv_pec_type_info = {
.instance_size = sizeof(PnvPhb4PecState),
.class_init = pnv_pec_class_init,
.class_size = sizeof(PnvPhb4PecClass),
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_PNV_XSCOM_INTERFACE },
{ }
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index f4556ad03a..be38841df9 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -268,6 +268,7 @@ static const TypeInfo q35_host_info = {
.instance_size = sizeof(Q35PCIHost),
.instance_init = q35_host_initfn,
.class_init = q35_host_class_init,
+ .secure = true,
};
/****************************************************************************
@@ -718,6 +719,7 @@ static const TypeInfo mch_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(MCHPCIState),
.class_init = mch_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/pci-host/remote.c b/hw/pci-host/remote.c
index 9ea95fac6e..a58fc39bde 100644
--- a/hw/pci-host/remote.c
+++ b/hw/pci-host/remote.c
@@ -63,6 +63,7 @@ static const TypeInfo remote_pcihost_info = {
.parent = TYPE_PCIE_HOST_BRIDGE,
.instance_size = sizeof(RemotePCIHost),
.class_init = remote_pcihost_class_init,
+ .secure = true,
};
static void remote_pcihost_register(void)
diff --git a/hw/pci-host/xen_igd_pt.c b/hw/pci-host/xen_igd_pt.c
index f6016f2cd5..abc68849b9 100644
--- a/hw/pci-host/xen_igd_pt.c
+++ b/hw/pci-host/xen_igd_pt.c
@@ -110,6 +110,7 @@ static const TypeInfo igd_passthrough_i440fx_info = {
.parent = TYPE_I440FX_PCI_DEVICE,
.instance_size = sizeof(PCII440FXState),
.class_init = igd_passthrough_i440fx_class_init,
+ .secure = true,
};
static void igd_pt_i440fx_register_types(void)
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index c1d4b7806e..711c37878b 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -2174,6 +2174,7 @@ static const TypeInfo spapr_phb_info = {
.instance_size = sizeof(SpaprPhbState),
.instance_finalize = spapr_phb_finalizefn,
.class_init = spapr_phb_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
index eff980fdfe..5356d13624 100644
--- a/hw/s390x/s390-pci-bus.c
+++ b/hw/s390x/s390-pci-bus.c
@@ -1406,6 +1406,7 @@ static const TypeInfo s390_pcihost_info = {
.parent = TYPE_PCI_HOST_BRIDGE,
.instance_size = sizeof(S390pciState),
.class_init = s390_pcihost_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
@@ -1416,6 +1417,7 @@ static const TypeInfo s390_pcibus_info = {
.name = TYPE_S390_PCI_BUS,
.parent = TYPE_BUS,
.instance_size = sizeof(S390PCIBus),
+ .secure = true,
};
static uint16_t s390_pci_generate_uid(S390pciState *s)
@@ -1588,12 +1590,14 @@ static const TypeInfo s390_pci_device_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(S390PCIBusDevice),
.class_init = s390_pci_device_class_init,
+ .secure = true,
};
static const TypeInfo s390_pci_iommu_info = {
.name = TYPE_S390_PCI_IOMMU,
.parent = TYPE_OBJECT,
.instance_size = sizeof(S390PCIIOMMU),
+ .secure = true,
};
static void s390_iommu_memory_region_class_init(ObjectClass *klass,
--
2.55.0
next prev parent reply other threads:[~2026-09-11 14:48 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 01/28] hw: mark secure machines for x86, s390, ppc, arm, loonarch, riscv Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 02/28] accel: mark kvm and xen accelerators as secure Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 03/28] hw: mark all virtio PCI devices " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 04/28] hw: mark all virtio CCW " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 05/28] hw: mark all vhost devices a secure Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 06/28] hw: mark all remaining virtio object types as secure Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 07/28] hw/vfio: mark all VFIO object classes " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 08/28] hw/xen: mark all Xen related object types as being secure Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 09/28] hw/net: mark e1000, e1000e, IGB, rtl8139 & sPAPR VLAN as secure Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 10/28] hw/usb: mark commonly used USB devices/hosts " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 11/28] hw/watchdog: mark some watchdog devices " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 12/28] hw/scsi: mark spapr and vmware SCSI controllers " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 13/28] hw/scsi: mark SCSI disk endpoint devices " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 14/28] hw/ide: mark ICH9 and ide-hd/ide-cd " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 15/28] hw: define most common PCI types " Daniel P. Berrangé
2026-09-11 16:50 ` Daniel P. Berrangé
2026-09-11 14:36 ` Daniel P. Berrangé [this message]
2026-09-11 14:36 ` [PATCH 17/28] hw/display: mark bochs, cirrus, qxl, VGA, ramfb " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 18/28] hw/tpm: mark all TPM implementations " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 19/28] hw/misc: mark pvpanic, vmcoreinfo " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 20/28] hw/audio: mark Intel HDA devices & codecs " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 21/28] hw/char: mark common serial / console devicess a secure Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 22/28] hw/mem: mark nvdimm, pc-dimm & spapr-nvdimm devices as secure Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 23/28] hw/uefi: mark the EFI vars service " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 24/28] hw/acpi: mark erst, vmclock and vmgenid devices " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 25/28] hw: mark KVM clock and RTC " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 26/28] hw: device AMD, Intel and ARM IOMMUs " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 27/28] hw/input: mark PS/2 and PC Keyboard devices " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 28/28] hw/i386: mark vmmouse / vmport " Daniel P. Berrangé
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260911143627.2743803-17-berrange@redhat.com \
--to=berrange@redhat.com \
--cc=qemu-arm@nongnu.org \
--cc=qemu-block@nongnu.org \
--cc=qemu-devel@nongnu.org \
--cc=qemu-ppc@nongnu.org \
--cc=qemu-riscv@nongnu.org \
--cc=qemu-s390x@nongnu.org \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox