* [PATCH 01/28] hw: mark secure machines for x86, s390, ppc, arm, loonarch, riscv
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 02/28] accel: mark kvm and xen accelerators as secure Daniel P. Berrangé
` (26 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
The versioned machine types are typically present for use in
virtualization use cases and can be expected to provide a security
barrier. The only exceptions are the m68k versioned machine types
which are only used with TCG. There are also a handful of other
machines declared secure in docs/system/security.rst, notably
the Xen machine variants and microvm.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/arm/virt.c | 1 +
hw/arm/xen-pvh.c | 1 +
hw/i386/microvm.c | 1 +
hw/i386/pc_piix.c | 4 ++--
hw/i386/xen/xen-pvh.c | 1 +
hw/loongarch/virt.c | 2 ++
hw/ppc/spapr.c | 1 +
hw/riscv/virt.c | 1 +
hw/s390x/s390-virtio-ccw.c | 1 +
hw/xen/xen-pvh-common.c | 1 +
hw/xenpv/xen_machine_pv.c | 2 +-
include/hw/i386/pc.h | 1 +
12 files changed, 14 insertions(+), 3 deletions(-)
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 0871a35e11..e62cd0055b 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -132,6 +132,7 @@ static void arm_virt_compat_default_set(MachineClass *mc)
.name = MACHINE_VER_TYPE_NAME("virt", __VA_ARGS__), \
.parent = TYPE_VIRT_MACHINE, \
.class_init = MACHINE_VER_SYM(class_init, virt, __VA_ARGS__), \
+ .secure = true, \
}; \
static void MACHINE_VER_SYM(register, virt, __VA_ARGS__)(void) \
{ \
diff --git a/hw/arm/xen-pvh.c b/hw/arm/xen-pvh.c
index f05956c166..6b85eced1b 100644
--- a/hw/arm/xen-pvh.c
+++ b/hw/arm/xen-pvh.c
@@ -95,6 +95,7 @@ static const TypeInfo xen_arm_machine_type = {
.class_init = xen_arm_machine_class_init,
.instance_size = sizeof(XenPVHMachineState),
.instance_init = xen_arm_instance_init,
+ .secure = true,
};
static void xen_arm_machine_register_types(void)
diff --git a/hw/i386/microvm.c b/hw/i386/microvm.c
index e7adab7d2e..9256b31a60 100644
--- a/hw/i386/microvm.c
+++ b/hw/i386/microvm.c
@@ -736,6 +736,7 @@ static const TypeInfo microvm_machine_info = {
.instance_init = microvm_machine_initfn,
.class_size = sizeof(MicrovmMachineClass),
.class_init = microvm_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index a929cc4dec..b6cd6dc5aa 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -672,6 +672,6 @@ static void xenfv_machine_4_2_options(MachineClass *m)
m->default_machine_opts = "accel=xen,suppress-vmdesc=on";
}
-DEFINE_PC_MACHINE(xenfv_4_2, "xenfv-4.2", pc_xen_hvm_init,
- xenfv_machine_4_2_options);
+DEFINE_SECURE_PC_MACHINE(xenfv_4_2, "xenfv-4.2", pc_xen_hvm_init,
+ xenfv_machine_4_2_options);
#endif
diff --git a/hw/i386/xen/xen-pvh.c b/hw/i386/xen/xen-pvh.c
index ab90c83a83..d81575b4c9 100644
--- a/hw/i386/xen/xen-pvh.c
+++ b/hw/i386/xen/xen-pvh.c
@@ -115,6 +115,7 @@ static const TypeInfo xen_pvh_x86_machine_type = {
.class_init = xen_pvh_machine_class_init,
.instance_init = xen_pvh_instance_init,
.instance_size = sizeof(XenPVHx86State),
+ .secure = true,
};
static void xen_pvh_machine_register_types(void)
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index 9cc79929a8..0501512a24 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -1553,6 +1553,7 @@ static void virt_class_init(ObjectClass *oc, const void *data)
.name = MACHINE_VER_TYPE_NAME("virt", __VA_ARGS__), \
.parent = TYPE_LOONGARCH_VIRT_MACHINE, \
.class_init = MACHINE_VER_SYM(class_init, virt, __VA_ARGS__), \
+ .secure = true, \
}; \
static void MACHINE_VER_SYM(register, virt, __VA_ARGS__)(void) \
{ \
@@ -1583,6 +1584,7 @@ static const TypeInfo virt_machine_info = {
.name = TYPE_LOONGARCH_VIRT_MACHINE,
.parent = TYPE_MACHINE,
.abstract = true,
+ .secure = true,
.instance_size = sizeof(LoongArchVirtMachineState),
.class_init = virt_class_init,
.instance_init = virt_initfn,
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 20e024907b..4e05e8b71b 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4750,6 +4750,7 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
.name = MACHINE_VER_TYPE_NAME("pseries", __VA_ARGS__), \
.parent = TYPE_SPAPR_MACHINE, \
.class_init = MACHINE_VER_SYM(class_init, spapr, __VA_ARGS__), \
+ .secure = true, \
}; \
static void MACHINE_VER_SYM(register, spapr, __VA_ARGS__)(void) \
{ \
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index f3a1cc5ba3..9d146205b3 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1200,6 +1200,7 @@ static const TypeInfo virt_machine_typeinfo = {
.name = MACHINE_TYPE_NAME("virt"),
.parent = TYPE_MACHINE,
.class_init = virt_machine_class_init,
+ .secure = true,
.instance_init = virt_machine_instance_init,
.instance_finalize = virt_machine_instance_finalize,
.instance_size = sizeof(RISCVVirtState),
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index 17266779a6..c9a646be8b 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -973,6 +973,7 @@ static const TypeInfo ccw_machine_info = {
.name = MACHINE_VER_TYPE_NAME("s390-ccw-virtio", __VA_ARGS__), \
.parent = TYPE_S390_CCW_MACHINE, \
.class_init = MACHINE_VER_SYM(class_init, ccw, __VA_ARGS__), \
+ .secure = true, \
}; \
static void MACHINE_VER_SYM(register, ccw, __VA_ARGS__)(void) \
{ \
diff --git a/hw/xen/xen-pvh-common.c b/hw/xen/xen-pvh-common.c
index cca37202ff..939e85317d 100644
--- a/hw/xen/xen-pvh-common.c
+++ b/hw/xen/xen-pvh-common.c
@@ -504,6 +504,7 @@ static const TypeInfo xen_pvh_info = {
.name = TYPE_XEN_PVH_MACHINE,
.parent = TYPE_MACHINE,
.abstract = true,
+ .secure = true,
.instance_size = sizeof(XenPVHMachineState),
.instance_init = xen_pvh_instance_init,
.class_size = sizeof(XenPVHMachineClass),
diff --git a/hw/xenpv/xen_machine_pv.c b/hw/xenpv/xen_machine_pv.c
index c406821c34..e0620a096e 100644
--- a/hw/xenpv/xen_machine_pv.c
+++ b/hw/xenpv/xen_machine_pv.c
@@ -69,4 +69,4 @@ static void xenpv_machine_init(MachineClass *mc)
mc->default_machine_opts = "accel=xen";
}
-DEFINE_MACHINE("xenpv", xenpv_machine_init)
+DEFINE_SECURE_MACHINE("xenpv", xenpv_machine_init)
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index d5dc79df17..45b92780d3 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -325,6 +325,7 @@ extern const size_t pc_compat_4_1_len;
.name = MACHINE_VER_TYPE_NAME(namestr, __VA_ARGS__), \
.parent = TYPE_PC_MACHINE, \
.class_init = MACHINE_VER_SYM(class_init, namesym, __VA_ARGS__), \
+ .secure = true, \
}; \
static void MACHINE_VER_SYM(register, namesym, __VA_ARGS__)(void) \
{ \
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 02/28] accel: mark kvm and xen accelerators as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 01/28] hw: mark secure machines for x86, s390, ppc, arm, loonarch, riscv Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 03/28] hw: mark all virtio PCI devices " Daniel P. Berrangé
` (25 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
TCG is too complex to be considered to provide a security boundary
for malicious guest workloads. QTest is only used for functional
testing and thus is not relevant to mark secure.
KVM and Xen are servicing virtualization use cases which must
provide security and actively maintained.
While HVF would be in scope conceptually, it is not sufficiently
mature or maintained to claim a security boundary at this time.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
accel/accel-common.c | 2 ++
accel/accel-system.c | 1 +
accel/kvm/kvm-accel-ops.c | 1 +
accel/kvm/kvm-all.c | 1 +
accel/xen/xen-all.c | 2 ++
5 files changed, 7 insertions(+)
diff --git a/accel/accel-common.c b/accel/accel-common.c
index 00a400243f..1d993f0ad8 100644
--- a/accel/accel-common.c
+++ b/accel/accel-common.c
@@ -125,6 +125,7 @@ static const TypeInfo accel_types[] = {
.class_size = sizeof(AccelClass),
.instance_size = sizeof(AccelState),
.abstract = true,
+ .secure = true,
},
};
@@ -137,6 +138,7 @@ static void register_accel_target_type(void)
.name = name,
.parent = TYPE_OBJECT,
.abstract = true,
+ .secure = true,
.class_size = sizeof(AccelCPUClass),
};
diff --git a/accel/accel-system.c b/accel/accel-system.c
index 1325b23864..f3f31bc666 100644
--- a/accel/accel-system.c
+++ b/accel/accel-system.c
@@ -118,6 +118,7 @@ static const TypeInfo accel_ops_type_info = {
.name = TYPE_ACCEL_OPS,
.parent = TYPE_OBJECT,
.abstract = true,
+ .secure = true,
.class_size = sizeof(AccelOpsClass),
.class_init = accel_ops_class_init,
};
diff --git a/accel/kvm/kvm-accel-ops.c b/accel/kvm/kvm-accel-ops.c
index c8e7aa3870..f05d41a837 100644
--- a/accel/kvm/kvm-accel-ops.c
+++ b/accel/kvm/kvm-accel-ops.c
@@ -119,6 +119,7 @@ static const TypeInfo kvm_accel_ops_type = {
.parent = TYPE_ACCEL_OPS,
.class_init = kvm_accel_ops_class_init,
.abstract = true,
+ .secure = true,
};
static void kvm_accel_ops_register_types(void)
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 83cbd120a8..af886aa28c 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -4328,6 +4328,7 @@ static const TypeInfo kvm_accel_type = {
.instance_finalize = kvm_accel_finalize,
.class_init = kvm_accel_class_init,
.instance_size = sizeof(KVMState),
+ .secure = true,
};
static void kvm_type_init(void)
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index bb2d02cb22..937e0e947d 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -147,6 +147,7 @@ static const TypeInfo xen_accel_type = {
.name = TYPE_XEN_ACCEL,
.parent = TYPE_ACCEL,
.class_init = xen_accel_class_init,
+ .secure = true,
};
static void xen_accel_ops_class_init(ObjectClass *oc, const void *data)
@@ -163,6 +164,7 @@ static const TypeInfo xen_accel_ops_type = {
.parent = TYPE_ACCEL_OPS,
.class_init = xen_accel_ops_class_init,
.abstract = true,
+ .secure = true,
};
static void xen_type_init(void)
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 03/28] hw: mark all virtio PCI devices as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 01/28] hw: mark secure machines for x86, s390, ppc, arm, loonarch, riscv Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 02/28] accel: mark kvm and xen accelerators as secure Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 04/28] hw: mark all virtio CCW " Daniel P. Berrangé
` (24 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must
provide a security boundary. This can be done for almost all virtio
PCI devices by modifying the common type register helper.
The virtio-gpu devices are unusual in not using the common
virtio_pci_types_register() method, so need marking directly.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/display/virtio-gpu-pci-rutabaga.c | 1 +
hw/display/virtio-gpu-pci.c | 3 ++-
hw/virtio/virtio-pci.c | 3 +++
3 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/hw/display/virtio-gpu-pci-rutabaga.c b/hw/display/virtio-gpu-pci-rutabaga.c
index 4db77cb868..a8e5e1d96c 100644
--- a/hw/display/virtio-gpu-pci-rutabaga.c
+++ b/hw/display/virtio-gpu-pci-rutabaga.c
@@ -34,6 +34,7 @@ static const TypeInfo virtio_gpu_rutabaga_pci_info[] = {
.parent = TYPE_VIRTIO_GPU_PCI_BASE,
.instance_size = sizeof(VirtIOGPURutabagaPCI),
.instance_init = virtio_gpu_rutabaga_initfn,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/display/virtio-gpu-pci.c b/hw/display/virtio-gpu-pci.c
index 22659ca196..0b0d926a5b 100644
--- a/hw/display/virtio-gpu-pci.c
+++ b/hw/display/virtio-gpu-pci.c
@@ -75,7 +75,8 @@ static const TypeInfo virtio_gpu_pci_base_info = {
.parent = TYPE_VIRTIO_PCI,
.instance_size = sizeof(VirtIOGPUPCIBase),
.class_init = virtio_gpu_pci_base_class_init,
- .abstract = true
+ .abstract = true,
+ .secure = true,
};
module_obj(TYPE_VIRTIO_GPU_PCI_BASE);
module_kconfig(VIRTIO_PCI);
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 6f5db5fc42..cd5fe8f1d8 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -2520,6 +2520,7 @@ void virtio_pci_types_register(const VirtioPCIDeviceTypeInfo *t)
.name = t->generic_name,
.parent = base_type_info.name,
.class_init = virtio_pci_generic_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -2555,6 +2556,7 @@ void virtio_pci_types_register(const VirtioPCIDeviceTypeInfo *t)
.name = t->non_transitional_name,
.parent = base_type_info.name,
.instance_init = virtio_pci_non_transitional_instance_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -2569,6 +2571,7 @@ void virtio_pci_types_register(const VirtioPCIDeviceTypeInfo *t)
.name = t->transitional_name,
.parent = base_type_info.name,
.instance_init = virtio_pci_transitional_instance_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
/*
* Transitional virtio devices work only as Conventional PCI
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 04/28] hw: mark all virtio CCW devices as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (2 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 03/28] hw: mark all virtio PCI devices " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 05/28] hw: mark all vhost devices a secure Daniel P. Berrangé
` (23 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must
provide a security boundary.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/s390x/vhost-scsi-ccw.c | 1 +
hw/s390x/vhost-user-fs-ccw.c | 1 +
hw/s390x/vhost-vsock-ccw.c | 1 +
hw/s390x/virtio-ccw-9p.c | 1 +
hw/s390x/virtio-ccw-balloon.c | 1 +
hw/s390x/virtio-ccw-blk.c | 1 +
hw/s390x/virtio-ccw-crypto.c | 1 +
hw/s390x/virtio-ccw-gpu.c | 1 +
hw/s390x/virtio-ccw-input.c | 5 +++++
hw/s390x/virtio-ccw-md.c | 1 +
hw/s390x/virtio-ccw-mem.c | 1 +
hw/s390x/virtio-ccw-net.c | 1 +
hw/s390x/virtio-ccw-rng.c | 1 +
hw/s390x/virtio-ccw-scsi.c | 1 +
hw/s390x/virtio-ccw-serial.c | 1 +
hw/s390x/virtio-ccw.c | 1 +
16 files changed, 20 insertions(+)
diff --git a/hw/s390x/vhost-scsi-ccw.c b/hw/s390x/vhost-scsi-ccw.c
index 1e68459eb0..2bd51a8033 100644
--- a/hw/s390x/vhost-scsi-ccw.c
+++ b/hw/s390x/vhost-scsi-ccw.c
@@ -62,6 +62,7 @@ static const TypeInfo vhost_ccw_scsi = {
.instance_size = sizeof(VHostSCSICcw),
.instance_init = vhost_ccw_scsi_instance_init,
.class_init = vhost_ccw_scsi_class_init,
+ .secure = true,
};
static void virtio_ccw_scsi_register(void)
diff --git a/hw/s390x/vhost-user-fs-ccw.c b/hw/s390x/vhost-user-fs-ccw.c
index 35a77e4cb7..6d341dc5e9 100644
--- a/hw/s390x/vhost-user-fs-ccw.c
+++ b/hw/s390x/vhost-user-fs-ccw.c
@@ -64,6 +64,7 @@ static const TypeInfo vhost_user_fs_ccw = {
.instance_size = sizeof(VHostUserFSCcw),
.instance_init = vhost_user_fs_ccw_instance_init,
.class_init = vhost_user_fs_ccw_class_init,
+ .secure = true,
};
static void vhost_user_fs_ccw_register(void)
diff --git a/hw/s390x/vhost-vsock-ccw.c b/hw/s390x/vhost-vsock-ccw.c
index efdfdeec84..92b6d177e8 100644
--- a/hw/s390x/vhost-vsock-ccw.c
+++ b/hw/s390x/vhost-vsock-ccw.c
@@ -71,6 +71,7 @@ static const TypeInfo vhost_vsock_ccw_info = {
.instance_size = sizeof(VHostVSockCCWState),
.instance_init = vhost_vsock_ccw_instance_init,
.class_init = vhost_vsock_ccw_class_init,
+ .secure = true,
};
static void vhost_vsock_ccw_register(void)
diff --git a/hw/s390x/virtio-ccw-9p.c b/hw/s390x/virtio-ccw-9p.c
index d8612f7cd1..08d3ee577b 100644
--- a/hw/s390x/virtio-ccw-9p.c
+++ b/hw/s390x/virtio-ccw-9p.c
@@ -64,6 +64,7 @@ static const TypeInfo virtio_ccw_9p_info = {
.instance_size = sizeof(V9fsCCWState),
.instance_init = virtio_ccw_9p_instance_init,
.class_init = virtio_ccw_9p_class_init,
+ .secure = true,
};
static void virtio_ccw_9p_register(void)
diff --git a/hw/s390x/virtio-ccw-balloon.c b/hw/s390x/virtio-ccw-balloon.c
index 4f67310b69..f7f5640cf1 100644
--- a/hw/s390x/virtio-ccw-balloon.c
+++ b/hw/s390x/virtio-ccw-balloon.c
@@ -69,6 +69,7 @@ static const TypeInfo virtio_ccw_balloon = {
.instance_size = sizeof(VirtIOBalloonCcw),
.instance_init = virtio_ccw_balloon_instance_init,
.class_init = virtio_ccw_balloon_class_init,
+ .secure = true,
};
static void virtio_ccw_balloon_register(void)
diff --git a/hw/s390x/virtio-ccw-blk.c b/hw/s390x/virtio-ccw-blk.c
index 939dcaeed3..dd4ac892b2 100644
--- a/hw/s390x/virtio-ccw-blk.c
+++ b/hw/s390x/virtio-ccw-blk.c
@@ -67,6 +67,7 @@ static const TypeInfo virtio_ccw_blk = {
.instance_size = sizeof(VirtIOBlkCcw),
.instance_init = virtio_ccw_blk_instance_init,
.class_init = virtio_ccw_blk_class_init,
+ .secure = true,
};
static void virtio_ccw_blk_register(void)
diff --git a/hw/s390x/virtio-ccw-crypto.c b/hw/s390x/virtio-ccw-crypto.c
index 2c4ee2ca39..9f274562ac 100644
--- a/hw/s390x/virtio-ccw-crypto.c
+++ b/hw/s390x/virtio-ccw-crypto.c
@@ -67,6 +67,7 @@ static const TypeInfo virtio_ccw_crypto = {
.instance_size = sizeof(VirtIOCryptoCcw),
.instance_init = virtio_ccw_crypto_instance_init,
.class_init = virtio_ccw_crypto_class_init,
+ .secure = true,
};
static void virtio_ccw_crypto_register(void)
diff --git a/hw/s390x/virtio-ccw-gpu.c b/hw/s390x/virtio-ccw-gpu.c
index 4120c6bcb9..79c302860f 100644
--- a/hw/s390x/virtio-ccw-gpu.c
+++ b/hw/s390x/virtio-ccw-gpu.c
@@ -66,6 +66,7 @@ static const TypeInfo virtio_ccw_gpu = {
.instance_size = sizeof(VirtIOGPUCcw),
.instance_init = virtio_ccw_gpu_instance_init,
.class_init = virtio_ccw_gpu_class_init,
+ .secure = true,
};
module_obj(TYPE_VIRTIO_GPU_CCW);
module_kconfig(VIRTIO_CCW);
diff --git a/hw/s390x/virtio-ccw-input.c b/hw/s390x/virtio-ccw-input.c
index a9ec60428c..1ada4caa15 100644
--- a/hw/s390x/virtio-ccw-input.c
+++ b/hw/s390x/virtio-ccw-input.c
@@ -96,6 +96,7 @@ static const TypeInfo virtio_ccw_input = {
.instance_size = sizeof(VirtIOInputCcw),
.class_init = virtio_ccw_input_class_init,
.abstract = true,
+ .secure = true,
};
static const TypeInfo virtio_ccw_input_hid = {
@@ -103,6 +104,7 @@ static const TypeInfo virtio_ccw_input_hid = {
.parent = TYPE_VIRTIO_INPUT_CCW,
.instance_size = sizeof(VirtIOInputHIDCcw),
.abstract = true,
+ .secure = true,
};
static const TypeInfo virtio_ccw_keyboard = {
@@ -110,6 +112,7 @@ static const TypeInfo virtio_ccw_keyboard = {
.parent = TYPE_VIRTIO_INPUT_HID_CCW,
.instance_size = sizeof(VirtIOInputHIDCcw),
.instance_init = virtio_ccw_keyboard_instance_init,
+ .secure = true,
};
static const TypeInfo virtio_ccw_mouse = {
@@ -117,6 +120,7 @@ static const TypeInfo virtio_ccw_mouse = {
.parent = TYPE_VIRTIO_INPUT_HID_CCW,
.instance_size = sizeof(VirtIOInputHIDCcw),
.instance_init = virtio_ccw_mouse_instance_init,
+ .secure = true,
};
static const TypeInfo virtio_ccw_tablet = {
@@ -124,6 +128,7 @@ static const TypeInfo virtio_ccw_tablet = {
.parent = TYPE_VIRTIO_INPUT_HID_CCW,
.instance_size = sizeof(VirtIOInputHIDCcw),
.instance_init = virtio_ccw_tablet_instance_init,
+ .secure = true,
};
static void virtio_ccw_input_register(void)
diff --git a/hw/s390x/virtio-ccw-md.c b/hw/s390x/virtio-ccw-md.c
index 0370f58450..9a0264efda 100644
--- a/hw/s390x/virtio-ccw-md.c
+++ b/hw/s390x/virtio-ccw-md.c
@@ -140,6 +140,7 @@ static const TypeInfo virtio_ccw_md_info = {
.instance_size = sizeof(VirtIOMDCcw),
.class_size = sizeof(VirtIOMDCcwClass),
.abstract = true,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_MEMORY_DEVICE },
{ }
diff --git a/hw/s390x/virtio-ccw-mem.c b/hw/s390x/virtio-ccw-mem.c
index dea30aacfb..7014f0f92e 100644
--- a/hw/s390x/virtio-ccw-mem.c
+++ b/hw/s390x/virtio-ccw-mem.c
@@ -216,6 +216,7 @@ static const TypeInfo virtio_ccw_mem = {
.instance_size = sizeof(VirtIOMEMCcw),
.instance_init = virtio_ccw_mem_instance_init,
.class_init = virtio_ccw_mem_class_init,
+ .secure = true,
};
static void virtio_ccw_mem_register_types(void)
diff --git a/hw/s390x/virtio-ccw-net.c b/hw/s390x/virtio-ccw-net.c
index 30e7055ab2..d39311a9f0 100644
--- a/hw/s390x/virtio-ccw-net.c
+++ b/hw/s390x/virtio-ccw-net.c
@@ -70,6 +70,7 @@ static const TypeInfo virtio_ccw_net = {
.instance_size = sizeof(VirtIONetCcw),
.instance_init = virtio_ccw_net_instance_init,
.class_init = virtio_ccw_net_class_init,
+ .secure = true,
};
static void virtio_ccw_net_register(void)
diff --git a/hw/s390x/virtio-ccw-rng.c b/hw/s390x/virtio-ccw-rng.c
index 0647621e33..8b62fd9905 100644
--- a/hw/s390x/virtio-ccw-rng.c
+++ b/hw/s390x/virtio-ccw-rng.c
@@ -66,6 +66,7 @@ static const TypeInfo virtio_ccw_rng = {
.instance_size = sizeof(VirtIORNGCcw),
.instance_init = virtio_ccw_rng_instance_init,
.class_init = virtio_ccw_rng_class_init,
+ .secure = true,
};
static void virtio_ccw_rng_register(void)
diff --git a/hw/s390x/virtio-ccw-scsi.c b/hw/s390x/virtio-ccw-scsi.c
index c181a2b769..baac329d75 100644
--- a/hw/s390x/virtio-ccw-scsi.c
+++ b/hw/s390x/virtio-ccw-scsi.c
@@ -76,6 +76,7 @@ static const TypeInfo virtio_ccw_scsi = {
.instance_size = sizeof(VirtIOSCSICcw),
.instance_init = virtio_ccw_scsi_instance_init,
.class_init = virtio_ccw_scsi_class_init,
+ .secure = true,
};
static void virtio_ccw_scsi_register(void)
diff --git a/hw/s390x/virtio-ccw-serial.c b/hw/s390x/virtio-ccw-serial.c
index 7ff07a0841..9a1686a4dc 100644
--- a/hw/s390x/virtio-ccw-serial.c
+++ b/hw/s390x/virtio-ccw-serial.c
@@ -76,6 +76,7 @@ static const TypeInfo virtio_ccw_serial = {
.instance_size = sizeof(VirtioSerialCcw),
.instance_init = virtio_ccw_serial_instance_init,
.class_init = virtio_ccw_serial_class_init,
+ .secure = true,
};
static void virtio_ccw_serial_register(void)
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index d82874ed27..bf01e5a7fa 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -1264,6 +1264,7 @@ static const TypeInfo virtio_ccw_device_info = {
.class_init = virtio_ccw_device_class_init,
.class_size = sizeof(VirtIOCCWDeviceClass),
.abstract = true,
+ .secure = true,
};
/* virtio-ccw-bus */
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 05/28] hw: mark all vhost devices a secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (3 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 04/28] hw: mark all virtio CCW " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 06/28] hw: mark all remaining virtio object types as secure Daniel P. Berrangé
` (22 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must
provide a security boundary.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/block/vhost-user-blk.c | 1 +
hw/display/vhost-user-gpu.c | 1 +
hw/scsi/vhost-scsi-common.c | 1 +
hw/scsi/vhost-scsi.c | 1 +
hw/scsi/vhost-user-scsi.c | 1 +
hw/virtio/vhost-user-base.c | 3 ++-
hw/virtio/vhost-user-fs.c | 1 +
hw/virtio/vhost-user-gpio.c | 1 +
hw/virtio/vhost-user-i2c.c | 1 +
hw/virtio/vhost-user-input.c | 1 +
hw/virtio/vhost-user-rng.c | 1 +
hw/virtio/vhost-user-rtc.c | 1 +
hw/virtio/vhost-user-scmi.c | 1 +
hw/virtio/vhost-user-snd.c | 1 +
hw/virtio/vhost-user-spi.c | 1 +
hw/virtio/vhost-user-test-device.c | 1 +
hw/virtio/vhost-user-vsock.c | 1 +
hw/virtio/vhost-vsock-common.c | 1 +
hw/virtio/vhost-vsock.c | 1 +
19 files changed, 20 insertions(+), 1 deletion(-)
diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c
index 2e5b3ae1b1..105d77e543 100644
--- a/hw/block/vhost-user-blk.c
+++ b/hw/block/vhost-user-blk.c
@@ -673,6 +673,7 @@ static const TypeInfo vhost_user_blk_info = {
.instance_size = sizeof(VHostUserBlk),
.instance_init = vhost_user_blk_instance_init,
.class_init = vhost_user_blk_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/display/vhost-user-gpu.c b/hw/display/vhost-user-gpu.c
index cd684d6363..4204cac483 100644
--- a/hw/display/vhost-user-gpu.c
+++ b/hw/display/vhost-user-gpu.c
@@ -727,6 +727,7 @@ static const TypeInfo vhost_user_gpu_info = {
.instance_init = vhost_user_gpu_instance_init,
.instance_finalize = vhost_user_gpu_instance_finalize,
.class_init = vhost_user_gpu_class_init,
+ .secure = true,
};
module_obj(TYPE_VHOST_USER_GPU);
module_kconfig(VHOST_USER_GPU);
diff --git a/hw/scsi/vhost-scsi-common.c b/hw/scsi/vhost-scsi-common.c
index e19800a0bc..7b0007a30e 100644
--- a/hw/scsi/vhost-scsi-common.c
+++ b/hw/scsi/vhost-scsi-common.c
@@ -164,6 +164,7 @@ static const TypeInfo vhost_scsi_common_info = {
.parent = TYPE_VIRTIO_SCSI_COMMON,
.instance_size = sizeof(VHostSCSICommon),
.abstract = true,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index 657403cad0..e1f209fabb 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -400,6 +400,7 @@ static const TypeInfo vhost_scsi_info = {
.instance_size = sizeof(VHostSCSI),
.class_init = vhost_scsi_class_init,
.instance_init = vhost_scsi_instance_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_FW_PATH_PROVIDER },
{ }
diff --git a/hw/scsi/vhost-user-scsi.c b/hw/scsi/vhost-user-scsi.c
index 5070178dc2..8906997051 100644
--- a/hw/scsi/vhost-user-scsi.c
+++ b/hw/scsi/vhost-user-scsi.c
@@ -425,6 +425,7 @@ static const TypeInfo vhost_user_scsi_info = {
.instance_size = sizeof(VHostUserSCSI),
.class_init = vhost_user_scsi_class_init,
.instance_init = vhost_user_scsi_instance_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_FW_PATH_PROVIDER },
{ }
diff --git a/hw/virtio/vhost-user-base.c b/hw/virtio/vhost-user-base.c
index 478ec68f09..682c06f26b 100644
--- a/hw/virtio/vhost-user-base.c
+++ b/hw/virtio/vhost-user-base.c
@@ -426,7 +426,8 @@ static const TypeInfo vub_types[] = {
.instance_size = sizeof(VHostUserBase),
.class_init = vub_class_init,
.class_size = sizeof(VHostUserBaseClass),
- .abstract = true
+ .abstract = true,
+ .secure = true,
}
};
diff --git a/hw/virtio/vhost-user-fs.c b/hw/virtio/vhost-user-fs.c
index 209993918a..9901f84bfb 100644
--- a/hw/virtio/vhost-user-fs.c
+++ b/hw/virtio/vhost-user-fs.c
@@ -448,6 +448,7 @@ static const TypeInfo vuf_info = {
.instance_size = sizeof(VHostUserFS),
.instance_init = vuf_instance_init,
.class_init = vuf_class_init,
+ .secure = true,
};
static void vuf_register_types(void)
diff --git a/hw/virtio/vhost-user-gpio.c b/hw/virtio/vhost-user-gpio.c
index d473f87077..cec21106e0 100644
--- a/hw/virtio/vhost-user-gpio.c
+++ b/hw/virtio/vhost-user-gpio.c
@@ -53,6 +53,7 @@ static const TypeInfo vu_gpio_info = {
.parent = TYPE_VHOST_USER_BASE,
.instance_size = sizeof(VHostUserGPIO),
.class_init = vu_gpio_class_init,
+ .secure = true,
};
static void vu_gpio_register_types(void)
diff --git a/hw/virtio/vhost-user-i2c.c b/hw/virtio/vhost-user-i2c.c
index 152b1f6740..17b0b44413 100644
--- a/hw/virtio/vhost-user-i2c.c
+++ b/hw/virtio/vhost-user-i2c.c
@@ -53,6 +53,7 @@ static const TypeInfo vu_i2c_info = {
.parent = TYPE_VHOST_USER_BASE,
.instance_size = sizeof(VHostUserI2C),
.class_init = vu_i2c_class_init,
+ .secure = true,
};
static void vu_i2c_register_types(void)
diff --git a/hw/virtio/vhost-user-input.c b/hw/virtio/vhost-user-input.c
index 5cfc5bbb56..a850e3770e 100644
--- a/hw/virtio/vhost-user-input.c
+++ b/hw/virtio/vhost-user-input.c
@@ -47,6 +47,7 @@ static const TypeInfo vhost_input_info = {
.parent = TYPE_VHOST_USER_BASE,
.instance_size = sizeof(VHostUserInput),
.class_init = vhost_input_class_init,
+ .secure = true,
};
static void vhost_input_register_types(void)
diff --git a/hw/virtio/vhost-user-rng.c b/hw/virtio/vhost-user-rng.c
index 106c8f211a..dc1286559c 100644
--- a/hw/virtio/vhost-user-rng.c
+++ b/hw/virtio/vhost-user-rng.c
@@ -55,6 +55,7 @@ static const TypeInfo vu_rng_info = {
.parent = TYPE_VHOST_USER_BASE,
.instance_size = sizeof(VHostUserRNG),
.class_init = vu_rng_class_init,
+ .secure = true,
};
static void vu_rng_register_types(void)
diff --git a/hw/virtio/vhost-user-rtc.c b/hw/virtio/vhost-user-rtc.c
index 88b0c70b90..2cb949590e 100644
--- a/hw/virtio/vhost-user-rtc.c
+++ b/hw/virtio/vhost-user-rtc.c
@@ -54,6 +54,7 @@ static const TypeInfo vu_rtc_info = {
.parent = TYPE_VHOST_USER_BASE,
.instance_size = sizeof(VHostUserRTC),
.class_init = vu_rtc_class_init,
+ .secure = true,
};
static void vu_rtc_register_types(void)
diff --git a/hw/virtio/vhost-user-scmi.c b/hw/virtio/vhost-user-scmi.c
index 02dc088ea9..c5f7f0afb0 100644
--- a/hw/virtio/vhost-user-scmi.c
+++ b/hw/virtio/vhost-user-scmi.c
@@ -310,6 +310,7 @@ static const TypeInfo vu_scmi_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VHostUserSCMI),
.class_init = vu_scmi_class_init,
+ .secure = true,
};
static void vu_scmi_register_types(void)
diff --git a/hw/virtio/vhost-user-snd.c b/hw/virtio/vhost-user-snd.c
index 7129b77d9c..3695534aa2 100644
--- a/hw/virtio/vhost-user-snd.c
+++ b/hw/virtio/vhost-user-snd.c
@@ -72,6 +72,7 @@ static const TypeInfo vu_snd_info = {
.parent = TYPE_VHOST_USER_BASE,
.instance_size = sizeof(VHostUserSound),
.class_init = vu_snd_class_init,
+ .secure = true,
};
static void vu_snd_register_types(void)
diff --git a/hw/virtio/vhost-user-spi.c b/hw/virtio/vhost-user-spi.c
index 707f96c250..58d5fd7b46 100644
--- a/hw/virtio/vhost-user-spi.c
+++ b/hw/virtio/vhost-user-spi.c
@@ -55,6 +55,7 @@ static const TypeInfo vu_spi_info = {
.parent = TYPE_VHOST_USER_BASE,
.instance_size = sizeof(VHostUserSPI),
.class_init = vu_spi_class_init,
+ .secure = true,
};
static void vu_spi_register_types(void)
diff --git a/hw/virtio/vhost-user-test-device.c b/hw/virtio/vhost-user-test-device.c
index a2f963fdf6..73da8af48a 100644
--- a/hw/virtio/vhost-user-test-device.c
+++ b/hw/virtio/vhost-user-test-device.c
@@ -50,6 +50,7 @@ static const TypeInfo vud_info = {
.name = TYPE_VHOST_USER_TEST_DEVICE,
.parent = TYPE_VHOST_USER_BASE,
.class_init = vud_class_init,
+ .secure = true,
};
static void vu_register_types(void)
diff --git a/hw/virtio/vhost-user-vsock.c b/hw/virtio/vhost-user-vsock.c
index c2cd376e73..e10ceb95cb 100644
--- a/hw/virtio/vhost-user-vsock.c
+++ b/hw/virtio/vhost-user-vsock.c
@@ -175,6 +175,7 @@ static const TypeInfo vuv_info = {
.parent = TYPE_VHOST_VSOCK_COMMON,
.instance_size = sizeof(VHostUserVSock),
.class_init = vuv_class_init,
+ .secure = true,
};
static void vuv_register_types(void)
diff --git a/hw/virtio/vhost-vsock-common.c b/hw/virtio/vhost-vsock-common.c
index b79f4c9ce6..01f7dea6f5 100644
--- a/hw/virtio/vhost-vsock-common.c
+++ b/hw/virtio/vhost-vsock-common.c
@@ -309,6 +309,7 @@ static const TypeInfo vhost_vsock_common_info = {
.instance_size = sizeof(VHostVSockCommon),
.class_init = vhost_vsock_common_class_init,
.abstract = true,
+ .secure = true,
};
static void vhost_vsock_common_register_types(void)
diff --git a/hw/virtio/vhost-vsock.c b/hw/virtio/vhost-vsock.c
index da244eb165..66a17ee15f 100644
--- a/hw/virtio/vhost-vsock.c
+++ b/hw/virtio/vhost-vsock.c
@@ -225,6 +225,7 @@ static const TypeInfo vhost_vsock_info = {
.parent = TYPE_VHOST_VSOCK_COMMON,
.instance_size = sizeof(VHostVSock),
.class_init = vhost_vsock_class_init,
+ .secure = true,
};
static void vhost_vsock_register_types(void)
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 06/28] hw: mark all remaining virtio object types as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (4 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 05/28] hw: mark all vhost devices a secure Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 07/28] hw/vfio: mark all VFIO object classes " Daniel P. Berrangé
` (21 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must
provide a security boundary.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/9pfs/virtio-9p-device.c | 1 +
hw/audio/virtio-snd.c | 1 +
hw/block/virtio-blk.c | 1 +
hw/char/virtio-console.c | 2 ++
hw/char/virtio-serial-bus.c | 3 +++
hw/display/virtio-gpu-base.c | 3 ++-
hw/display/virtio-gpu-gl.c | 1 +
hw/display/virtio-gpu-rutabaga.c | 1 +
hw/display/virtio-gpu.c | 1 +
hw/input/virtio-input-hid.c | 5 +++++
hw/input/virtio-input-host.c | 1 +
hw/input/virtio-input.c | 1 +
hw/net/virtio-net.c | 1 +
hw/scsi/virtio-scsi.c | 2 ++
hw/virtio/vdpa-dev.c | 1 +
hw/virtio/virtio-balloon.c | 1 +
hw/virtio/virtio-bus.c | 1 +
hw/virtio/virtio-crypto.c | 1 +
hw/virtio/virtio-input-pci.c | 2 ++
hw/virtio/virtio-iommu.c | 2 ++
hw/virtio/virtio-md-pci.c | 1 +
hw/virtio/virtio-mem.c | 1 +
hw/virtio/virtio-mmio.c | 2 ++
hw/virtio/virtio-nsm.c | 1 +
hw/virtio/virtio-pmem.c | 1 +
hw/virtio/virtio-rng.c | 1 +
hw/virtio/virtio-rtc.c | 1 +
27 files changed, 39 insertions(+), 1 deletion(-)
diff --git a/hw/9pfs/virtio-9p-device.c b/hw/9pfs/virtio-9p-device.c
index 2774fc2290..a4572c851d 100644
--- a/hw/9pfs/virtio-9p-device.c
+++ b/hw/9pfs/virtio-9p-device.c
@@ -288,6 +288,7 @@ static const TypeInfo virtio_device_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(V9fsVirtioState),
.class_init = virtio_9p_class_init,
+ .secure = true,
};
static void virtio_9p_register_types(void)
diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index 694bcebb60..eacabca5eb 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -1410,6 +1410,7 @@ static const TypeInfo virtio_snd_types[] = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIOSound),
.class_init = virtio_snd_class_init,
+ .secure = true,
}
};
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index 6b92066aff..bcd252482d 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -1951,6 +1951,7 @@ static const TypeInfo virtio_blk_info = {
.instance_init = virtio_blk_instance_init,
.class_init = virtio_blk_class_init,
.class_size = sizeof(VirtIOBlkClass),
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/char/virtio-console.c b/hw/char/virtio-console.c
index 4737b9a56e..e5798a5f4b 100644
--- a/hw/char/virtio-console.c
+++ b/hw/char/virtio-console.c
@@ -266,6 +266,7 @@ static const TypeInfo virtconsole_info = {
.name = "virtconsole",
.parent = TYPE_VIRTIO_CONSOLE_SERIAL_PORT,
.class_init = virtconsole_class_init,
+ .secure = true,
};
static const Property virtserialport_properties[] = {
@@ -291,6 +292,7 @@ static const TypeInfo virtserialport_info = {
.parent = TYPE_VIRTIO_SERIAL_PORT,
.instance_size = sizeof(VirtConsole),
.class_init = virtserialport_class_init,
+ .secure = true,
};
static void virtconsole_register_types(void)
diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
index 83a033ce85..60ef9c4f10 100644
--- a/hw/char/virtio-serial-bus.c
+++ b/hw/char/virtio-serial-bus.c
@@ -836,6 +836,7 @@ static const TypeInfo virtser_bus_info = {
.parent = TYPE_BUS,
.instance_size = sizeof(VirtIOSerialBus),
.class_init = virtser_bus_class_init,
+ .secure = true,
};
#ifdef CONFIG_HMP
@@ -1091,6 +1092,7 @@ static const TypeInfo virtio_serial_port_type_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(VirtIOSerialPort),
.abstract = true,
+ .secure = true,
.class_size = sizeof(VirtIOSerialPortClass),
.class_init = virtio_serial_port_class_init,
};
@@ -1169,6 +1171,7 @@ static const TypeInfo virtio_device_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIOSerial),
.class_init = virtio_serial_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
diff --git a/hw/display/virtio-gpu-base.c b/hw/display/virtio-gpu-base.c
index 270fbaae10..7a78d1ee83 100644
--- a/hw/display/virtio-gpu-base.c
+++ b/hw/display/virtio-gpu-base.c
@@ -320,7 +320,8 @@ static const TypeInfo virtio_gpu_base_info = {
.instance_size = sizeof(VirtIOGPUBase),
.class_size = sizeof(VirtIOGPUBaseClass),
.class_init = virtio_gpu_base_class_init,
- .abstract = true
+ .abstract = true,
+ .secure = true,
};
module_obj(TYPE_VIRTIO_GPU_BASE);
module_kconfig(VIRTIO_GPU);
diff --git a/hw/display/virtio-gpu-gl.c b/hw/display/virtio-gpu-gl.c
index 2b7a41c466..75174b6731 100644
--- a/hw/display/virtio-gpu-gl.c
+++ b/hw/display/virtio-gpu-gl.c
@@ -233,6 +233,7 @@ static const TypeInfo virtio_gpu_gl_info = {
.parent = TYPE_VIRTIO_GPU,
.instance_size = sizeof(VirtIOGPUGL),
.class_init = virtio_gpu_gl_class_init,
+ .secure = true,
};
module_obj(TYPE_VIRTIO_GPU_GL);
module_kconfig(VIRTIO_GPU);
diff --git a/hw/display/virtio-gpu-rutabaga.c b/hw/display/virtio-gpu-rutabaga.c
index 041216a10d..aba37efec5 100644
--- a/hw/display/virtio-gpu-rutabaga.c
+++ b/hw/display/virtio-gpu-rutabaga.c
@@ -1170,6 +1170,7 @@ static const TypeInfo virtio_gpu_rutabaga_info[] = {
.parent = TYPE_VIRTIO_GPU,
.instance_size = sizeof(VirtIOGPURutabaga),
.class_init = virtio_gpu_rutabaga_class_init,
+ .secure = true,
},
};
diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 55a1c7f80f..b1629a28f1 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1915,6 +1915,7 @@ static const TypeInfo virtio_gpu_info = {
.instance_size = sizeof(VirtIOGPU),
.class_size = sizeof(VirtIOGPUClass),
.class_init = virtio_gpu_class_init,
+ .secure = true,
};
module_obj(TYPE_VIRTIO_GPU);
module_kconfig(VIRTIO_GPU);
diff --git a/hw/input/virtio-input-hid.c b/hw/input/virtio-input-hid.c
index 1019d6b2e5..4854860807 100644
--- a/hw/input/virtio-input-hid.c
+++ b/hw/input/virtio-input-hid.c
@@ -242,6 +242,7 @@ static const TypeInfo virtio_input_hid_info = {
.instance_size = sizeof(VirtIOInputHID),
.class_init = virtio_input_hid_class_init,
.abstract = true,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
@@ -315,6 +316,7 @@ static const TypeInfo virtio_keyboard_info = {
.parent = TYPE_VIRTIO_INPUT_HID,
.instance_size = sizeof(VirtIOInputHID),
.instance_init = virtio_keyboard_init,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
@@ -369,6 +371,7 @@ static const TypeInfo virtio_mouse_info = {
.parent = TYPE_VIRTIO_INPUT_HID,
.instance_size = sizeof(VirtIOInputHID),
.instance_init = virtio_mouse_init,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
@@ -442,6 +445,7 @@ static const TypeInfo virtio_tablet_info = {
.parent = TYPE_VIRTIO_INPUT_HID,
.instance_size = sizeof(VirtIOInputHID),
.instance_init = virtio_tablet_init,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
@@ -527,6 +531,7 @@ static const TypeInfo virtio_multitouch_info = {
.parent = TYPE_VIRTIO_INPUT_HID,
.instance_size = sizeof(VirtIOInputHID),
.instance_init = virtio_multitouch_init,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
diff --git a/hw/input/virtio-input-host.c b/hw/input/virtio-input-host.c
index 633547cc4f..0d01e00cfc 100644
--- a/hw/input/virtio-input-host.c
+++ b/hw/input/virtio-input-host.c
@@ -248,6 +248,7 @@ static const TypeInfo virtio_input_host_info = {
.instance_size = sizeof(VirtIOInputHost),
.instance_init = virtio_input_host_init,
.class_init = virtio_input_host_class_init,
+ .secure = true,
};
/* ----------------------------------------------------------------- */
diff --git a/hw/input/virtio-input.c b/hw/input/virtio-input.c
index 6494cfbbe8..cccbeec1e3 100644
--- a/hw/input/virtio-input.c
+++ b/hw/input/virtio-input.c
@@ -329,6 +329,7 @@ static const TypeInfo virtio_input_info = {
.class_size = sizeof(VirtIOInputClass),
.class_init = virtio_input_class_init,
.abstract = true,
+ .secure = true,
.instance_finalize = virtio_input_finalize,
};
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 814b99a43d..506a0366dc 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -4374,6 +4374,7 @@ static const TypeInfo virtio_net_info = {
.instance_size = sizeof(VirtIONet),
.instance_init = virtio_net_instance_init,
.class_init = virtio_net_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index bf64d1231a..0fa3f11a43 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -1444,6 +1444,7 @@ static const TypeInfo virtio_scsi_common_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIOSCSICommon),
.abstract = true,
+ .secure = true,
.class_init = virtio_scsi_common_class_init,
};
@@ -1452,6 +1453,7 @@ static const TypeInfo virtio_scsi_info = {
.parent = TYPE_VIRTIO_SCSI_COMMON,
.instance_size = sizeof(VirtIOSCSI),
.class_init = virtio_scsi_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c
index 6dc684ab09..bd95467652 100644
--- a/hw/virtio/vdpa-dev.c
+++ b/hw/virtio/vdpa-dev.c
@@ -392,6 +392,7 @@ static const TypeInfo vhost_vdpa_device_info = {
.instance_size = sizeof(VhostVdpaDevice),
.class_init = vhost_vdpa_device_class_init,
.instance_init = vhost_vdpa_device_instance_init,
+ .secure = true,
};
static void register_vhost_vdpa_device_type(void)
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index 4c5f486ba2..4d1c81e7d6 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -1083,6 +1083,7 @@ static const TypeInfo virtio_balloon_info = {
.instance_size = sizeof(VirtIOBalloon),
.instance_init = virtio_balloon_instance_init,
.class_init = virtio_balloon_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-bus.c b/hw/virtio/virtio-bus.c
index 9b545acda3..9bf62a7060 100644
--- a/hw/virtio/virtio-bus.c
+++ b/hw/virtio/virtio-bus.c
@@ -363,6 +363,7 @@ static const TypeInfo virtio_bus_info = {
.parent = TYPE_BUS,
.instance_size = sizeof(VirtioBusState),
.abstract = true,
+ .secure = true,
.class_size = sizeof(VirtioBusClass),
.class_init = virtio_bus_class_init
};
diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
index 79e2acb56c..7d4c944f35 100644
--- a/hw/virtio/virtio-crypto.c
+++ b/hw/virtio/virtio-crypto.c
@@ -1314,6 +1314,7 @@ static const TypeInfo virtio_crypto_info = {
.instance_size = sizeof(VirtIOCrypto),
.instance_init = virtio_crypto_instance_init,
.class_init = virtio_crypto_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-input-pci.c b/hw/virtio/virtio-input-pci.c
index cd35608460..3605f990fd 100644
--- a/hw/virtio/virtio-input-pci.c
+++ b/hw/virtio/virtio-input-pci.c
@@ -117,6 +117,7 @@ static const TypeInfo virtio_input_pci_info = {
.instance_size = sizeof(VirtIOInputPCI),
.class_init = virtio_input_pci_class_init,
.abstract = true,
+ .secure = true,
};
static const TypeInfo virtio_input_hid_pci_info = {
@@ -124,6 +125,7 @@ static const TypeInfo virtio_input_hid_pci_info = {
.parent = TYPE_VIRTIO_INPUT_PCI,
.instance_size = sizeof(VirtIOInputHIDPCI),
.abstract = true,
+ .secure = true,
};
static const VirtioPCIDeviceTypeInfo virtio_keyboard_pci_info = {
diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index 533bd5073f..5f1920253b 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -1734,12 +1734,14 @@ static const TypeInfo virtio_iommu_info = {
.instance_size = sizeof(VirtIOIOMMU),
.instance_init = virtio_iommu_instance_init,
.class_init = virtio_iommu_class_init,
+ .secure = true,
};
static const TypeInfo virtio_iommu_memory_region_info = {
.parent = TYPE_IOMMU_MEMORY_REGION,
.name = TYPE_VIRTIO_IOMMU_MEMORY_REGION,
.class_init = virtio_iommu_memory_region_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-md-pci.c b/hw/virtio/virtio-md-pci.c
index 9278b32cf8..9eefb84daa 100644
--- a/hw/virtio/virtio-md-pci.c
+++ b/hw/virtio/virtio-md-pci.c
@@ -138,6 +138,7 @@ static const TypeInfo virtio_md_pci_info = {
.instance_size = sizeof(VirtIOMDPCI),
.class_size = sizeof(VirtIOMDPCIClass),
.abstract = true,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_MEMORY_DEVICE },
{ }
diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index 7130ed852d..edad9465cb 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -1668,6 +1668,7 @@ static const TypeInfo virtio_mem_info = {
.instance_finalize = virtio_mem_instance_finalize,
.class_init = virtio_mem_class_init,
.class_size = sizeof(VirtIOMEMClass),
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_RAM_DISCARD_SOURCE },
{ }
diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
index 55ceaeef5f..f51c8d17b9 100644
--- a/hw/virtio/virtio-mmio.c
+++ b/hw/virtio/virtio-mmio.c
@@ -779,6 +779,7 @@ static const TypeInfo virtio_mmio_info = {
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(VirtIOMMIOProxy),
.class_init = virtio_mmio_class_init,
+ .secure = true,
};
/* virtio-mmio-bus. */
@@ -848,6 +849,7 @@ static const TypeInfo virtio_mmio_bus_info = {
.parent = TYPE_VIRTIO_BUS,
.instance_size = sizeof(VirtioBusState),
.class_init = virtio_mmio_bus_class_init,
+ .secure = true,
};
static void virtio_mmio_register_types(void)
diff --git a/hw/virtio/virtio-nsm.c b/hw/virtio/virtio-nsm.c
index 3bf5e7009a..099342f379 100644
--- a/hw/virtio/virtio-nsm.c
+++ b/hw/virtio/virtio-nsm.c
@@ -1727,6 +1727,7 @@ static const TypeInfo virtio_nsm_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIONSM),
.class_init = virtio_nsm_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-pmem.c b/hw/virtio/virtio-pmem.c
index 6f7271c140..1a414d7ba2 100644
--- a/hw/virtio/virtio-pmem.c
+++ b/hw/virtio/virtio-pmem.c
@@ -196,6 +196,7 @@ static const TypeInfo virtio_pmem_info = {
.class_size = sizeof(VirtIOPMEMClass),
.class_init = virtio_pmem_class_init,
.instance_size = sizeof(VirtIOPMEM),
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-rng.c b/hw/virtio/virtio-rng.c
index d68d901195..ba80138179 100644
--- a/hw/virtio/virtio-rng.c
+++ b/hw/virtio/virtio-rng.c
@@ -282,6 +282,7 @@ static const TypeInfo virtio_rng_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIORNG),
.class_init = virtio_rng_class_init,
+ .secure = true,
};
static void virtio_register_types(void)
diff --git a/hw/virtio/virtio-rtc.c b/hw/virtio/virtio-rtc.c
index 32de9c1650..08071aadb5 100644
--- a/hw/virtio/virtio-rtc.c
+++ b/hw/virtio/virtio-rtc.c
@@ -180,6 +180,7 @@ static const TypeInfo virtio_rtc_info = {
.parent = TYPE_VIRTIO_DEVICE,
.instance_size = sizeof(VirtIORtc),
.class_init = virtio_rtc_class_init,
+ .secure = true,
};
static void virtio_rtc_register_types(void)
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 07/28] hw/vfio: mark all VFIO object classes as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (5 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 06/28] hw: mark all remaining virtio object types as secure Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 08/28] hw/xen: mark all Xen related object types as being secure Daniel P. Berrangé
` (20 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
The VFIO subsystem is about securely passing host PCI devices
to a guest, so all the classes should be presumed to be offering
a security boundary.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/vfio-user/pci.c | 1 +
hw/vfio/ap.c | 1 +
hw/vfio/ccw.c | 1 +
hw/vfio/container.c | 1 +
hw/vfio/igd.c | 1 +
hw/vfio/iommufd.c | 2 ++
hw/vfio/pci.c | 3 +++
hw/vfio/spapr.c | 1 +
8 files changed, 11 insertions(+)
diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index e7573d4a9f..ae26160f72 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -482,6 +482,7 @@ static const TypeInfo vfio_user_pci_info = {
.class_init = vfio_user_pci_class_init,
.instance_init = vfio_user_pci_init,
.instance_finalize = vfio_user_pci_finalize,
+ .secure = true,
};
static void register_vfio_user_dev_type(void)
diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
index 6e2a1223ea..4b9d522f7b 100644
--- a/hw/vfio/ap.c
+++ b/hw/vfio/ap.c
@@ -352,6 +352,7 @@ static const TypeInfo vfio_ap_info = {
.instance_size = sizeof(VFIOAPDevice),
.instance_init = vfio_ap_instance_init,
.class_init = vfio_ap_class_init,
+ .secure = true,
};
static void vfio_ap_type_init(void)
diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
index c3dc7c1962..7a241aa02a 100644
--- a/hw/vfio/ccw.c
+++ b/hw/vfio/ccw.c
@@ -721,6 +721,7 @@ static const TypeInfo vfio_ccw_info = {
.instance_size = sizeof(VFIOCCWDevice),
.instance_init = vfio_ccw_instance_init,
.class_init = vfio_ccw_class_init,
+ .secure = true,
};
static void register_vfio_ccw_type(void)
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index d09a663732..d4f20c6c81 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -336,6 +336,7 @@ static const TypeInfo types[] = {
.instance_size = sizeof(VFIOContainer),
.class_size = sizeof(VFIOIOMMUClass),
.abstract = true,
+ .secure = true,
},
};
diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index 413a49aae9..e9cef355f9 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -311,6 +311,7 @@ static const TypeInfo vfio_pci_igd_lpc_bridge_info = {
.name = "vfio-pci-igd-lpc-bridge",
.parent = TYPE_PCI_DEVICE,
.class_init = vfio_pci_igd_lpc_bridge_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 242644aa00..64e588fe51 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -1051,10 +1051,12 @@ static const TypeInfo types[] = {
.parent = TYPE_VFIO_IOMMU,
.instance_size = sizeof(VFIOIOMMUFDContainer),
.class_init = vfio_iommu_iommufd_class_init,
+ .secure = true,
}, {
.name = TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO,
.parent = TYPE_HOST_IOMMU_DEVICE_IOMMUFD,
.class_init = hiod_iommufd_vfio_class_init,
+ .secure = true,
}
};
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 428ab2f069..b38877a1a8 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3854,6 +3854,7 @@ static const TypeInfo vfio_pci_device_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(VFIOPCIDevice),
.abstract = true,
+ .secure = true,
.class_init = vfio_pci_device_class_init,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
@@ -4110,6 +4111,7 @@ static const TypeInfo vfio_pci_info = {
.class_init = vfio_pci_class_init,
.instance_init = vfio_pci_init,
.instance_finalize = vfio_pci_finalize,
+ .secure = true,
};
static const Property vfio_pci_nohotplug_properties[] = {
@@ -4146,6 +4148,7 @@ static const TypeInfo vfio_pci_nohotplug_info = {
.parent = TYPE_VFIO_PCI,
.instance_size = sizeof(VFIOPCIDevice),
.class_init = vfio_pci_nohotplug_class_init,
+ .secure = true,
};
static void register_vfio_pci_dev_type(void)
diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index 42690e4323..1027c434c0 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -544,6 +544,7 @@ static const TypeInfo types[] = {
.parent = TYPE_VFIO_IOMMU_LEGACY,
.instance_size = sizeof(VFIOSpaprContainer),
.class_init = vfio_iommu_spapr_class_init,
+ .secure = true,
},
};
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 08/28] hw/xen: mark all Xen related object types as being secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (6 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 07/28] hw/vfio: mark all VFIO object classes " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 09/28] hw/net: mark e1000, e1000e, IGB, rtl8139 & sPAPR VLAN as secure Daniel P. Berrangé
` (19 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
All Xen paravirtualized devices are intended to provide a host /
guest security barrier, so mark all Xen object types as scure.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/block/xen-block.c | 3 +++
hw/char/xen_console.c | 1 +
hw/i386/xen/xen_platform.c | 1 +
hw/i386/xen/xen_pvdevice.c | 1 +
hw/net/xen_nic.c | 1 +
hw/xen/xen-bus.c | 3 +++
hw/xen/xen-legacy-backend.c | 3 +++
hw/xen/xen_pt.c | 1 +
8 files changed, 14 insertions(+)
diff --git a/hw/block/xen-block.c b/hw/block/xen-block.c
index 474c12fe4a..3296e591d4 100644
--- a/hw/block/xen-block.c
+++ b/hw/block/xen-block.c
@@ -699,6 +699,7 @@ static const TypeInfo xen_block_type_info = {
.parent = TYPE_XEN_DEVICE,
.instance_size = sizeof(XenBlockDevice),
.abstract = true,
+ .secure = true,
.class_size = sizeof(XenBlockDeviceClass),
.class_init = xen_block_class_init,
};
@@ -740,6 +741,7 @@ static const TypeInfo xen_disk_type_info = {
.parent = TYPE_XEN_BLOCK_DEVICE,
.instance_size = sizeof(XenDiskDevice),
.class_init = xen_disk_class_init,
+ .secure = true,
};
static void xen_cdrom_unrealize(XenBlockDevice *blockdev)
@@ -787,6 +789,7 @@ static const TypeInfo xen_cdrom_type_info = {
.parent = TYPE_XEN_BLOCK_DEVICE,
.instance_size = sizeof(XenCDRomDevice),
.class_init = xen_cdrom_class_init,
+ .secure = true,
};
static void xen_block_register_types(void)
diff --git a/hw/char/xen_console.c b/hw/char/xen_console.c
index bdeb76dc87..df6a708494 100644
--- a/hw/char/xen_console.c
+++ b/hw/char/xen_console.c
@@ -513,6 +513,7 @@ static const TypeInfo xen_console_type_info = {
.parent = TYPE_XEN_DEVICE,
.instance_size = sizeof(XenConsole),
.class_init = xen_console_class_init,
+ .secure = true,
};
static void xen_console_register_types(void)
diff --git a/hw/i386/xen/xen_platform.c b/hw/i386/xen/xen_platform.c
index c8b852be0c..ec0084d6fb 100644
--- a/hw/i386/xen/xen_platform.c
+++ b/hw/i386/xen/xen_platform.c
@@ -604,6 +604,7 @@ static const TypeInfo xen_platform_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(PCIXenPlatformState),
.class_init = xen_platform_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/i386/xen/xen_pvdevice.c b/hw/i386/xen/xen_pvdevice.c
index fab26a06af..74636046d0 100644
--- a/hw/i386/xen/xen_pvdevice.c
+++ b/hw/i386/xen/xen_pvdevice.c
@@ -139,6 +139,7 @@ static const TypeInfo xen_pv_type_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(XenPVDevice),
.class_init = xen_pv_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/net/xen_nic.c b/hw/net/xen_nic.c
index f4d0b06013..e615303da6 100644
--- a/hw/net/xen_nic.c
+++ b/hw/net/xen_nic.c
@@ -579,6 +579,7 @@ static const TypeInfo xen_net_type_info = {
.parent = TYPE_XEN_DEVICE,
.instance_size = sizeof(XenNetDev),
.class_init = xen_netdev_class_init,
+ .secure = true,
};
static void xen_net_register_types(void)
diff --git a/hw/xen/xen-bus.c b/hw/xen/xen-bus.c
index 1762816bf4..4623995e2c 100644
--- a/hw/xen/xen-bus.c
+++ b/hw/xen/xen-bus.c
@@ -404,6 +404,7 @@ static const TypeInfo xen_bus_type_info = {
.instance_size = sizeof(XenBus),
.class_size = sizeof(XenBusClass),
.class_init = xen_bus_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
@@ -1127,6 +1128,7 @@ static const TypeInfo xen_device_type_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(XenDevice),
.abstract = true,
+ .secure = true,
.class_size = sizeof(XenDeviceClass),
.class_init = xen_device_class_init,
};
@@ -1141,6 +1143,7 @@ static const TypeInfo xen_bridge_type_info = {
.name = TYPE_XEN_BRIDGE,
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(XenBridge),
+ .secure = true,
};
static void xen_register_types(void)
diff --git a/hw/xen/xen-legacy-backend.c b/hw/xen/xen-legacy-backend.c
index 7977b52712..75f8ac7efd 100644
--- a/hw/xen/xen-legacy-backend.c
+++ b/hw/xen/xen-legacy-backend.c
@@ -648,6 +648,7 @@ static const TypeInfo xendev_type_info = {
.parent = TYPE_DYNAMIC_SYS_BUS_DEVICE,
.class_init = xendev_class_init,
.instance_size = sizeof(XenLegacyDevice),
+ .secure = true,
};
static void xen_sysbus_class_init(ObjectClass *klass, const void *data)
@@ -661,6 +662,7 @@ static const TypeInfo xensysbus_info = {
.name = TYPE_XENSYSBUS,
.parent = TYPE_BUS,
.class_init = xen_sysbus_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
@@ -670,6 +672,7 @@ static const TypeInfo xensysbus_info = {
static const TypeInfo xensysdev_info = {
.name = TYPE_XENSYSDEV,
.parent = TYPE_SYS_BUS_DEVICE,
+ .secure = true,
};
static void xenbe_register_types(void)
diff --git a/hw/xen/xen_pt.c b/hw/xen/xen_pt.c
index 0fe9c0aada..504c559318 100644
--- a/hw/xen/xen_pt.c
+++ b/hw/xen/xen_pt.c
@@ -1079,6 +1079,7 @@ static const TypeInfo xen_pci_passthrough_info = {
.instance_finalize = xen_pci_passthrough_finalize,
.class_init = xen_pci_passthrough_class_init,
.class_size = sizeof(XenPTDeviceClass),
+ .secure = true,
.instance_init = xen_pci_passthrough_instance_init,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 09/28] hw/net: mark e1000, e1000e, IGB, rtl8139 & sPAPR VLAN as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (7 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 08/28] hw/xen: mark all Xen related object types as being secure Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 10/28] hw/usb: mark commonly used USB devices/hosts " Daniel P. Berrangé
` (18 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
Historically most NICs are only interesting for non-virtualization
use cases and have not been written with malicious guests in mind.
As a general rule either virtio-net or xen-net should be used in
all virtualized guests requiring a security boundary.
There are a handful of exceptions resulting from historical usage
in the x86 world, to support virtualized guests lacking virtio
support.
Thus the rtl8139, e1000, e1000e & IGB NICs are declared to provide
a security boundary.
The PPC sPAPR Virutal LAN device is also marked secure.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/net/e1000.c | 1 +
hw/net/e1000e.c | 1 +
hw/net/igb.c | 1 +
hw/net/rtl8139.c | 1 +
hw/net/spapr_llan.c | 1 +
5 files changed, 5 insertions(+)
diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index 202ad40401..da0667c40e 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -1759,6 +1759,7 @@ static void e1000_register_types(void)
type_info.parent = TYPE_E1000_BASE;
type_info.class_data = info;
type_info.class_init = e1000_class_init;
+ type_info.secure = true,
type_register_static(&type_info);
}
diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
index 9faf0c74c3..96737ddb51 100644
--- a/hw/net/e1000e.c
+++ b/hw/net/e1000e.c
@@ -721,6 +721,7 @@ static const TypeInfo e1000e_info = {
.instance_size = sizeof(E1000EState),
.class_init = e1000e_class_init,
.instance_init = e1000e_instance_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ }
diff --git a/hw/net/igb.c b/hw/net/igb.c
index c076807e71..0bd03efea0 100644
--- a/hw/net/igb.c
+++ b/hw/net/igb.c
@@ -635,6 +635,7 @@ static const TypeInfo igb_info = {
.instance_size = sizeof(IGBState),
.class_init = igb_class_init,
.instance_init = igb_instance_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ }
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index 16479284ee..38bc16f312 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -3450,6 +3450,7 @@ static const TypeInfo rtl8139_info = {
.instance_size = sizeof(RTL8139State),
.class_init = rtl8139_class_init,
.instance_init = rtl8139_instance_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
index 550848307d..c7ac58273c 100644
--- a/hw/net/spapr_llan.c
+++ b/hw/net/spapr_llan.c
@@ -873,6 +873,7 @@ static const TypeInfo spapr_vlan_info = {
.class_init = spapr_vlan_class_init,
.instance_init = spapr_vlan_instance_init,
.instance_finalize = spapr_vlan_instance_finalize,
+ .secure = true,
};
static void spapr_vlan_register_types(void)
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 10/28] hw/usb: mark commonly used USB devices/hosts as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (8 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 09/28] hw/net: mark e1000, e1000e, IGB, rtl8139 & sPAPR VLAN as secure Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 11/28] hw/watchdog: mark some watchdog devices " Daniel P. Berrangé
` (17 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
Most of the standardized USB1/2/3 host controllers are relevant
for virtualization use cases, so should be declared secure. The
"NEC" XHCI variant is slightly non-standard, but since it is a
trivial sub-class of the generic XHCI, there's no reason to
exclude it.
The set of devices that are expected to be used is HID (mouse,
tablet, keyboard), host passthrough, CCID (smartcard), hub,
storage and the redirect tunnelling.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/usb/ccid-card-emulated.c | 1 +
hw/usb/ccid-card-passthru.c | 1 +
hw/usb/dev-hid.c | 4 ++++
hw/usb/dev-hub.c | 1 +
hw/usb/dev-smartcard-reader.c | 3 +++
hw/usb/dev-storage-bot.c | 1 +
hw/usb/dev-storage-classic.c | 1 +
hw/usb/dev-storage.c | 1 +
hw/usb/hcd-ehci-pci.c | 2 ++
hw/usb/hcd-ehci-sysbus.c | 8 ++++++++
hw/usb/hcd-ohci-pci.c | 1 +
hw/usb/hcd-ohci-sysbus.c | 1 +
hw/usb/hcd-uhci.c | 2 ++
hw/usb/hcd-xhci-nec.c | 1 +
hw/usb/hcd-xhci-pci.c | 2 ++
hw/usb/hcd-xhci-sysbus.c | 3 ++-
hw/usb/hcd-xhci.c | 1 +
hw/usb/host-libusb.c | 1 +
hw/usb/redirect.c | 1 +
19 files changed, 35 insertions(+), 1 deletion(-)
diff --git a/hw/usb/ccid-card-emulated.c b/hw/usb/ccid-card-emulated.c
index 985f21997a..f10295c675 100644
--- a/hw/usb/ccid-card-emulated.c
+++ b/hw/usb/ccid-card-emulated.c
@@ -610,6 +610,7 @@ static const TypeInfo emulated_card_info = {
.parent = TYPE_CCID_CARD,
.instance_size = sizeof(EmulatedState),
.class_init = emulated_class_initfn,
+ .secure = true,
};
module_obj(TYPE_EMULATED_CCID);
module_kconfig(USB);
diff --git a/hw/usb/ccid-card-passthru.c b/hw/usb/ccid-card-passthru.c
index 5ab7855272..b91f32ebd6 100644
--- a/hw/usb/ccid-card-passthru.c
+++ b/hw/usb/ccid-card-passthru.c
@@ -412,6 +412,7 @@ static const TypeInfo passthru_card_info = {
.parent = TYPE_CCID_CARD,
.instance_size = sizeof(PassthruState),
.class_init = passthru_class_initfn,
+ .secure = true,
};
module_obj(TYPE_CCID_PASSTHRU);
module_kconfig(USB);
diff --git a/hw/usb/dev-hid.c b/hw/usb/dev-hid.c
index ae19d60203..7fa9a4b010 100644
--- a/hw/usb/dev-hid.c
+++ b/hw/usb/dev-hid.c
@@ -790,6 +790,7 @@ static const TypeInfo usb_hid_type_info = {
.parent = TYPE_USB_DEVICE,
.instance_size = sizeof(USBHIDState),
.abstract = true,
+ .secure = true,
.class_init = usb_hid_class_initfn,
};
@@ -815,6 +816,7 @@ static const TypeInfo usb_tablet_info = {
.name = "usb-tablet",
.parent = TYPE_USB_HID,
.class_init = usb_tablet_class_initfn,
+ .secure = true,
};
static const Property usb_mouse_properties[] = {
@@ -837,6 +839,7 @@ static const TypeInfo usb_mouse_info = {
.name = "usb-mouse",
.parent = TYPE_USB_HID,
.class_init = usb_mouse_class_initfn,
+ .secure = true,
};
static const Property usb_keyboard_properties[] = {
@@ -860,6 +863,7 @@ static const TypeInfo usb_keyboard_info = {
.name = "usb-kbd",
.parent = TYPE_USB_HID,
.class_init = usb_keyboard_class_initfn,
+ .secure = true,
};
static void usb_hid_register_types(void)
diff --git a/hw/usb/dev-hub.c b/hw/usb/dev-hub.c
index b45d571fa8..7017b4fbc7 100644
--- a/hw/usb/dev-hub.c
+++ b/hw/usb/dev-hub.c
@@ -694,6 +694,7 @@ static const TypeInfo hub_info = {
.parent = TYPE_USB_DEVICE,
.instance_size = sizeof(USBHubState),
.class_init = usb_hub_class_initfn,
+ .secure = true,
};
static void usb_hub_register_types(void)
diff --git a/hw/usb/dev-smartcard-reader.c b/hw/usb/dev-smartcard-reader.c
index 964c142d10..d661c7687f 100644
--- a/hw/usb/dev-smartcard-reader.c
+++ b/hw/usb/dev-smartcard-reader.c
@@ -1178,6 +1178,7 @@ static const TypeInfo ccid_bus_info = {
.name = TYPE_CCID_BUS,
.parent = TYPE_BUS,
.instance_size = sizeof(CCIDBus),
+ .secure = true,
};
void ccid_card_send_apdu_to_guest(CCIDCardState *card,
@@ -1458,6 +1459,7 @@ static const TypeInfo ccid_info = {
.parent = TYPE_USB_DEVICE,
.instance_size = sizeof(USBCCIDState),
.class_init = ccid_class_initfn,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
@@ -1478,6 +1480,7 @@ static const TypeInfo ccid_card_type_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(CCIDCardState),
.abstract = true,
+ .secure = true,
.class_size = sizeof(CCIDCardClass),
.class_init = ccid_card_class_init,
};
diff --git a/hw/usb/dev-storage-bot.c b/hw/usb/dev-storage-bot.c
index a7f8d80c17..b156f1c5c9 100644
--- a/hw/usb/dev-storage-bot.c
+++ b/hw/usb/dev-storage-bot.c
@@ -52,6 +52,7 @@ static const TypeInfo bot_info = {
.name = "usb-bot",
.parent = TYPE_USB_STORAGE,
.class_init = usb_msd_class_bot_initfn,
+ .secure = true,
};
static void register_types(void)
diff --git a/hw/usb/dev-storage-classic.c b/hw/usb/dev-storage-classic.c
index 977151c4a0..7e0699cb51 100644
--- a/hw/usb/dev-storage-classic.c
+++ b/hw/usb/dev-storage-classic.c
@@ -133,6 +133,7 @@ static const TypeInfo msd_info = {
.parent = TYPE_USB_STORAGE,
.class_init = usb_msd_class_storage_initfn,
.instance_init = usb_msd_instance_init,
+ .secure = true,
};
static void register_types(void)
diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index 040cf15051..f964d0c9dc 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -608,6 +608,7 @@ static const TypeInfo usb_storage_dev_type_info = {
.instance_size = sizeof(MSDState),
.abstract = true,
.class_init = usb_msd_class_initfn_common,
+ .secure = true,
};
static void usb_msd_register_types(void)
diff --git a/hw/usb/hcd-ehci-pci.c b/hw/usb/hcd-ehci-pci.c
index fd35d25340..d735d75956 100644
--- a/hw/usb/hcd-ehci-pci.c
+++ b/hw/usb/hcd-ehci-pci.c
@@ -171,6 +171,7 @@ static const TypeInfo ehci_pci_type_info = {
.instance_init = usb_ehci_pci_init,
.instance_finalize = usb_ehci_pci_finalize,
.abstract = true,
+ .secure = true,
.class_init = ehci_class_init,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -219,6 +220,7 @@ static void ehci_pci_register_types(void)
TypeInfo ehci_type_info = {
.parent = TYPE_PCI_EHCI,
.class_init = ehci_data_class_init,
+ .secure = true,
};
int i;
diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index 7f7c7f8a2f..0946d5a004 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -240,6 +240,7 @@ static const TypeInfo ehci_sysbus_types[] = {
.instance_init = ehci_sysbus_init,
.instance_finalize = ehci_sysbus_finalize,
.abstract = true,
+ .secure = true,
.class_init = ehci_sysbus_class_init,
.class_size = sizeof(SysBusEHCIClass),
},
@@ -247,32 +248,38 @@ static const TypeInfo ehci_sysbus_types[] = {
.name = TYPE_PLATFORM_EHCI,
.parent = TYPE_SYS_BUS_EHCI,
.class_init = ehci_platform_class_init,
+ .secure = true,
},
{
.name = TYPE_EXYNOS4210_EHCI,
.parent = TYPE_SYS_BUS_EHCI,
.class_init = ehci_exynos4210_class_init,
+ .secure = true,
},
{
.name = TYPE_AW_H3_EHCI,
.parent = TYPE_SYS_BUS_EHCI,
.class_init = ehci_aw_h3_class_init,
+ .secure = true,
},
{
.name = TYPE_NPCM7XX_EHCI,
.parent = TYPE_SYS_BUS_EHCI,
.class_init = ehci_npcm7xx_class_init,
+ .secure = true,
},
{
.name = TYPE_TEGRA2_EHCI,
.parent = TYPE_SYS_BUS_EHCI,
.class_init = ehci_tegra2_class_init,
+ .secure = true,
},
{
.name = TYPE_PPC4xx_EHCI,
.parent = TYPE_SYS_BUS_EHCI,
.class_init = ehci_ppc4xx_class_init,
.instance_init = ehci_ppc4xx_init,
+ .secure = true,
},
{
.name = TYPE_FUSBH200_EHCI,
@@ -280,6 +287,7 @@ static const TypeInfo ehci_sysbus_types[] = {
.instance_size = sizeof(FUSBH200EHCIState),
.instance_init = fusbh200_ehci_init,
.class_init = fusbh200_ehci_class_init,
+ .secure = true,
},
};
diff --git a/hw/usb/hcd-ohci-pci.c b/hw/usb/hcd-ohci-pci.c
index 70c9e9ac4f..cf0746aa00 100644
--- a/hw/usb/hcd-ohci-pci.c
+++ b/hw/usb/hcd-ohci-pci.c
@@ -148,6 +148,7 @@ static const TypeInfo ohci_pci_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(OHCIPCIState),
.class_init = ohci_pci_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/usb/hcd-ohci-sysbus.c b/hw/usb/hcd-ohci-sysbus.c
index 4f51eebccb..fd04e918e8 100644
--- a/hw/usb/hcd-ohci-sysbus.c
+++ b/hw/usb/hcd-ohci-sysbus.c
@@ -80,6 +80,7 @@ static const TypeInfo ohci_sysbus_types[] = {
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(OHCISysBusState),
.class_init = ohci_sysbus_class_init,
+ .secure = true,
},
};
diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
index a7b9fe1317..cd34680f46 100644
--- a/hw/usb/hcd-uhci.c
+++ b/hw/usb/hcd-uhci.c
@@ -1283,6 +1283,7 @@ static const TypeInfo uhci_pci_type_info = {
.instance_size = sizeof(UHCIState),
.class_size = sizeof(UHCIPCIDeviceClass),
.abstract = true,
+ .secure = true,
.class_init = uhci_class_init,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -1380,6 +1381,7 @@ static void uhci_register_types(void)
TypeInfo uhci_type_info = {
.parent = TYPE_UHCI,
.class_init = uhci_data_class_init,
+ .secure = true,
};
int i;
diff --git a/hw/usb/hcd-xhci-nec.c b/hw/usb/hcd-xhci-nec.c
index 46839911f3..070732be9a 100644
--- a/hw/usb/hcd-xhci-nec.c
+++ b/hw/usb/hcd-xhci-nec.c
@@ -67,6 +67,7 @@ static const TypeInfo nec_xhci_info = {
.instance_size = sizeof(XHCINecState),
.instance_init = nec_xhci_instance_init,
.class_init = nec_xhci_class_init,
+ .secure = true,
};
static void nec_xhci_register_types(void)
diff --git a/hw/usb/hcd-xhci-pci.c b/hw/usb/hcd-xhci-pci.c
index b124251ae3..5d0fd851ca 100644
--- a/hw/usb/hcd-xhci-pci.c
+++ b/hw/usb/hcd-xhci-pci.c
@@ -266,6 +266,7 @@ static const TypeInfo xhci_pci_info = {
.class_init = xhci_class_init,
.instance_init = xhci_instance_init,
.abstract = true,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -298,6 +299,7 @@ static const TypeInfo qemu_xhci_info = {
.parent = TYPE_XHCI_PCI,
.class_init = qemu_xhci_class_init,
.instance_init = qemu_xhci_instance_init,
+ .secure = true,
};
static void xhci_register_types(void)
diff --git a/hw/usb/hcd-xhci-sysbus.c b/hw/usb/hcd-xhci-sysbus.c
index bbdd5fd64a..8dd50fbbf1 100644
--- a/hw/usb/hcd-xhci-sysbus.c
+++ b/hw/usb/hcd-xhci-sysbus.c
@@ -112,7 +112,8 @@ static const TypeInfo xhci_sysbus_info = {
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(XHCISysbusState),
.class_init = xhci_sysbus_class_init,
- .instance_init = xhci_sysbus_instance_init
+ .instance_init = xhci_sysbus_instance_init,
+ .secure = true,
};
static void xhci_sysbus_register_types(void)
diff --git a/hw/usb/hcd-xhci.c b/hw/usb/hcd-xhci.c
index d342aa2739..aa6c8a0fdd 100644
--- a/hw/usb/hcd-xhci.c
+++ b/hw/usb/hcd-xhci.c
@@ -3676,6 +3676,7 @@ static const TypeInfo xhci_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(XHCIState),
.class_init = xhci_class_init,
+ .secure = true,
};
static void xhci_register_types(void)
diff --git a/hw/usb/host-libusb.c b/hw/usb/host-libusb.c
index 564fe9a547..c845778a54 100644
--- a/hw/usb/host-libusb.c
+++ b/hw/usb/host-libusb.c
@@ -1810,6 +1810,7 @@ static const TypeInfo usb_host_dev_info = {
.instance_size = sizeof(USBHostDevice),
.class_init = usb_host_class_initfn,
.instance_init = usb_host_instance_init,
+ .secure = true,
};
module_obj(TYPE_USB_HOST_DEVICE);
module_kconfig(USB);
diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index dfd9e8bb50..2d56ba329a 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -2654,6 +2654,7 @@ static const TypeInfo usbredir_dev_info = {
.instance_size = sizeof(USBRedirDevice),
.class_init = usbredir_class_initfn,
.instance_init = usbredir_instance_init,
+ .secure = true,
};
module_obj(TYPE_USB_REDIR);
module_kconfig(USB);
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 11/28] hw/watchdog: mark some watchdog devices as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (9 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 10/28] hw/usb: mark commonly used USB devices/hosts " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 12/28] hw/scsi: mark spapr and vmware SCSI controllers " Daniel P. Berrangé
` (16 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
The ib700, i6300esb, gwdt, spapr and diag288 watchdog devices are marked
as secure since they have traditionally been, or are intended to be,
used in virtualization use cases on x86, arm, ppc and s390x architectures
respectively. Other watchdogs are primarily for emulation.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/watchdog/sbsa_gwdt.c | 1 +
hw/watchdog/spapr_watchdog.c | 1 +
hw/watchdog/wdt_diag288.c | 1 +
hw/watchdog/wdt_i6300esb.c | 1 +
hw/watchdog/wdt_ib700.c | 1 +
5 files changed, 5 insertions(+)
diff --git a/hw/watchdog/sbsa_gwdt.c b/hw/watchdog/sbsa_gwdt.c
index 330a74798a..8a05b02c4f 100644
--- a/hw/watchdog/sbsa_gwdt.c
+++ b/hw/watchdog/sbsa_gwdt.c
@@ -307,6 +307,7 @@ static const TypeInfo wdt_sbsa_gwdt_info = {
.parent = TYPE_SYS_BUS_DEVICE,
.name = TYPE_WDT_SBSA,
.instance_size = sizeof(SBSA_GWDTState),
+ .secure = true,
};
static void wdt_sbsa_gwdt_register_types(void)
diff --git a/hw/watchdog/spapr_watchdog.c b/hw/watchdog/spapr_watchdog.c
index 5a72896066..0e45e9b4a6 100644
--- a/hw/watchdog/spapr_watchdog.c
+++ b/hw/watchdog/spapr_watchdog.c
@@ -269,6 +269,7 @@ static const TypeInfo spapr_wdt_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(SpaprWatchdog),
.class_init = spapr_wdt_class_init,
+ .secure = true,
};
static void spapr_watchdog_register_types(void)
diff --git a/hw/watchdog/wdt_diag288.c b/hw/watchdog/wdt_diag288.c
index 1275353e8e..85e4f56e1d 100644
--- a/hw/watchdog/wdt_diag288.c
+++ b/hw/watchdog/wdt_diag288.c
@@ -129,6 +129,7 @@ static const TypeInfo wdt_diag288_info = {
.name = TYPE_WDT_DIAG288,
.instance_size = sizeof(DIAG288State),
.class_size = sizeof(DIAG288Class),
+ .secure = true,
};
static void wdt_diag288_register_types(void)
diff --git a/hw/watchdog/wdt_i6300esb.c b/hw/watchdog/wdt_i6300esb.c
index 3aa01b8d68..05aa20fab1 100644
--- a/hw/watchdog/wdt_i6300esb.c
+++ b/hw/watchdog/wdt_i6300esb.c
@@ -480,6 +480,7 @@ static const TypeInfo i6300esb_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(I6300State),
.class_init = i6300esb_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/watchdog/wdt_ib700.c b/hw/watchdog/wdt_ib700.c
index 51a26a4cbb..8bf2b2fbf9 100644
--- a/hw/watchdog/wdt_ib700.c
+++ b/hw/watchdog/wdt_ib700.c
@@ -144,6 +144,7 @@ static const TypeInfo wdt_ib700_info = {
.parent = TYPE_ISA_DEVICE,
.instance_size = sizeof(IB700State),
.class_init = wdt_ib700_class_init,
+ .secure = true,
};
static void wdt_ib700_register_types(void)
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 12/28] hw/scsi: mark spapr and vmware SCSI controllers as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (10 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 11/28] hw/watchdog: mark some watchdog devices " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 13/28] hw/scsi: mark SCSI disk endpoint devices " Daniel P. Berrangé
` (15 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
The spapr vscsi controller is used by default with spapr machines
in a virtualization use case. The vmware SCSI controller supports
a virtualization use case.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/scsi/spapr_vscsi.c | 1 +
hw/scsi/vmw_pvscsi.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index b4c8f94d22..f029a7da93 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -1298,6 +1298,7 @@ static const TypeInfo spapr_vscsi_info = {
.parent = TYPE_VIO_SPAPR_DEVICE,
.instance_size = sizeof(VSCSIState),
.class_init = spapr_vscsi_class_init,
+ .secure = true,
};
static void spapr_vscsi_register_types(void)
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index 05f93171cd..9974930634 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -1355,6 +1355,7 @@ static const TypeInfo pvscsi_info = {
.instance_size = sizeof(PVSCSIState),
.class_init = pvscsi_class_init,
.instance_init = pvscsi_instance_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ INTERFACE_PCIE_DEVICE },
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 13/28] hw/scsi: mark SCSI disk endpoint devices as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (11 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 12/28] hw/scsi: mark spapr and vmware SCSI controllers " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 14/28] hw/ide: mark ICH9 and ide-hd/ide-cd " Daniel P. Berrangé
` (14 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
All these devices can be used together with supported SCSI controllers
in a virtualization use case, so must be treated as secure.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/scsi/scsi-disk.c | 4 ++++
hw/scsi/scsi-generic.c | 1 +
2 files changed, 5 insertions(+)
diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index a42f7d8e77..4474400a38 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -3218,6 +3218,7 @@ static const TypeInfo scsi_disk_base_info = {
.instance_size = sizeof(SCSIDiskState),
.class_size = sizeof(SCSIDiskClass),
.abstract = true,
+ .secure = true,
};
#define DEFINE_SCSI_DISK_PROPERTIES() \
@@ -3338,6 +3339,7 @@ static const TypeInfo scsi_hd_info = {
.name = "scsi-hd",
.parent = TYPE_SCSI_DISK_BASE,
.class_init = scsi_hd_class_initfn,
+ .secure = true,
};
static const Property scsi_cd_properties[] = {
@@ -3381,6 +3383,7 @@ static const TypeInfo scsi_cd_info = {
.name = "scsi-cd",
.parent = TYPE_SCSI_DISK_BASE,
.class_init = scsi_cd_class_initfn,
+ .secure = true,
};
#ifdef __linux__
@@ -3423,6 +3426,7 @@ static const TypeInfo scsi_block_info = {
.name = "scsi-block",
.parent = TYPE_SCSI_DISK_BASE,
.class_init = scsi_block_class_initfn,
+ .secure = true,
};
#endif
diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
index 8999f3b720..5588400b60 100644
--- a/hw/scsi/scsi-generic.c
+++ b/hw/scsi/scsi-generic.c
@@ -1225,6 +1225,7 @@ static const TypeInfo scsi_generic_info = {
.parent = TYPE_SCSI_DEVICE,
.instance_size = sizeof(SCSIDevice),
.class_init = scsi_generic_class_initfn,
+ .secure = true,
};
static void scsi_generic_register_types(void)
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 14/28] hw/ide: mark ICH9 and ide-hd/ide-cd as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (12 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 13/28] hw/scsi: mark SCSI disk endpoint devices " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 15/28] hw: define most common PCI types " Daniel P. Berrangé
` (13 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
These have a long history of usage in virtualization scenarios on
x86, for OS which lack modern virtio drivers for storage, and thus
must be considered secure.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/ide/ich.c | 1 +
hw/ide/ide-dev.c | 3 +++
hw/ide/piix.c | 2 ++
3 files changed, 6 insertions(+)
diff --git a/hw/ide/ich.c b/hw/ide/ich.c
index b00987f08d..c7d50a15c1 100644
--- a/hw/ide/ich.c
+++ b/hw/ide/ich.c
@@ -198,6 +198,7 @@ static const TypeInfo ich_ahci_info = {
.instance_size = sizeof(AHCIPCIState),
.instance_init = pci_ich9_ahci_init,
.class_init = ich_ahci_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/ide/ide-dev.c b/hw/ide/ide-dev.c
index 5d478588c6..f555d0fb04 100644
--- a/hw/ide/ide-dev.c
+++ b/hw/ide/ide-dev.c
@@ -214,6 +214,7 @@ static const TypeInfo ide_hd_info = {
.parent = TYPE_IDE_DEVICE,
.instance_size = sizeof(IDEDrive),
.class_init = ide_hd_class_init,
+ .secure = true,
};
static const Property ide_cd_properties[] = {
@@ -236,6 +237,7 @@ static const TypeInfo ide_cd_info = {
.parent = TYPE_IDE_DEVICE,
.instance_size = sizeof(IDEDrive),
.class_init = ide_cd_class_init,
+ .secure = true,
};
static void ide_device_class_init(ObjectClass *klass, const void *data)
@@ -252,6 +254,7 @@ static const TypeInfo ide_device_type_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(IDEDevice),
.abstract = true,
+ .secure = true,
.class_size = sizeof(IDEDeviceClass),
.class_init = ide_device_class_init,
.instance_init = ide_dev_instance_init,
diff --git a/hw/ide/piix.c b/hw/ide/piix.c
index a8472f3e58..9b7b5e98c8 100644
--- a/hw/ide/piix.c
+++ b/hw/ide/piix.c
@@ -198,6 +198,7 @@ static const TypeInfo piix3_ide_info = {
.name = TYPE_PIIX3_IDE,
.parent = TYPE_PCI_IDE,
.class_init = piix3_ide_class_init,
+ .secure = true,
};
/* NOTE: for the PIIX4, the IRQs and IOports are hardcoded */
@@ -221,6 +222,7 @@ static const TypeInfo piix4_ide_info = {
.name = TYPE_PIIX4_IDE,
.parent = TYPE_PCI_IDE,
.class_init = piix4_ide_class_init,
+ .secure = true,
};
static void piix_ide_register_types(void)
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 15/28] hw: define most common PCI types as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (13 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 14/28] hw/ide: mark ICH9 and ide-hd/ide-cd " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 16:50 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 16/28] hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts " Daniel P. Berrangé
` (12 subsequent siblings)
27 siblings, 1 reply; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
Essentially all PCI infrastructure is in scope for the virtualization
use case, aside from the niche simba bridge.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/pci-bridge/gen_pcie_root_port.c | 1 +
hw/pci-bridge/i82801b11.c | 1 +
hw/pci-bridge/ioh3420.c | 1 +
hw/pci-bridge/pci_bridge_dev.c | 2 ++
hw/pci-bridge/pci_expander_bridge.c | 8 ++++++++
hw/pci-bridge/pcie_pci_bridge.c | 1 +
hw/pci-bridge/pcie_root_port.c | 1 +
hw/pci-bridge/xio3130_downstream.c | 1 +
hw/pci-bridge/xio3130_upstream.c | 1 +
hw/pci/pci.c | 7 +++++++
hw/pci/pci_bridge.c | 1 +
hw/pci/pci_host.c | 1 +
hw/pci/pcie_host.c | 1 +
hw/pci/pcie_port.c | 1 +
14 files changed, 28 insertions(+)
diff --git a/hw/pci-bridge/gen_pcie_root_port.c b/hw/pci-bridge/gen_pcie_root_port.c
index 5434d693d9..65d29eab38 100644
--- a/hw/pci-bridge/gen_pcie_root_port.c
+++ b/hw/pci-bridge/gen_pcie_root_port.c
@@ -161,6 +161,7 @@ static const TypeInfo gen_rp_dev_info = {
.parent = TYPE_PCIE_ROOT_PORT,
.instance_size = sizeof(GenPCIERootPort),
.class_init = gen_rp_dev_class_init,
+ .secure = true,
};
static void gen_rp_register_types(void)
diff --git a/hw/pci-bridge/i82801b11.c b/hw/pci-bridge/i82801b11.c
index 1d73c14c1f..f702b20bcd 100644
--- a/hw/pci-bridge/i82801b11.c
+++ b/hw/pci-bridge/i82801b11.c
@@ -107,6 +107,7 @@ static const TypeInfo i82801b11_bridge_info = {
.parent = TYPE_PCI_BRIDGE,
.instance_size = sizeof(I82801b11Bridge),
.class_init = i82801b11_bridge_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/pci-bridge/ioh3420.c b/hw/pci-bridge/ioh3420.c
index bba640f495..2c4882c4cf 100644
--- a/hw/pci-bridge/ioh3420.c
+++ b/hw/pci-bridge/ioh3420.c
@@ -120,6 +120,7 @@ static const TypeInfo ioh3420_info = {
.name = "ioh3420",
.parent = TYPE_PCIE_ROOT_PORT,
.class_init = ioh3420_class_init,
+ .secure = true,
};
static void ioh3420_register_types(void)
diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index 0c1383562d..319e6f199a 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -268,6 +268,7 @@ static const TypeInfo pci_bridge_dev_info = {
.instance_size = sizeof(PCIBridgeDev),
.class_init = pci_bridge_dev_class_init,
.instance_finalize = pci_bridge_dev_instance_finalize,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -294,6 +295,7 @@ static const TypeInfo pci_bridge_dev_seat_info = {
.parent = TYPE_PCI_BRIDGE_DEV,
.instance_size = sizeof(PCIBridgeDev),
.class_init = pci_bridge_dev_seat_class_init,
+ .secure = true,
};
static void pci_bridge_dev_register(void)
diff --git a/hw/pci-bridge/pci_expander_bridge.c b/hw/pci-bridge/pci_expander_bridge.c
index 40ffbc4e08..bd5598b639 100644
--- a/hw/pci-bridge/pci_expander_bridge.c
+++ b/hw/pci-bridge/pci_expander_bridge.c
@@ -114,6 +114,7 @@ static const TypeInfo pxb_bus_info = {
.parent = TYPE_PCI_BUS,
.instance_size = sizeof(PXBBus),
.class_init = pxb_bus_class_init,
+ .secure = true,
};
static const TypeInfo pxb_pcie_bus_info = {
@@ -121,6 +122,7 @@ static const TypeInfo pxb_pcie_bus_info = {
.parent = TYPE_PCIE_BUS,
.instance_size = sizeof(PXBBus),
.class_init = pxb_bus_class_init,
+ .secure = true,
};
static const TypeInfo pxb_cxl_bus_info = {
@@ -128,6 +130,7 @@ static const TypeInfo pxb_cxl_bus_info = {
.parent = TYPE_CXL_BUS,
.instance_size = sizeof(PXBBus),
.class_init = pxb_bus_class_init,
+ .secure = true,
};
static const char *pxb_host_root_bus_path(PCIHostState *host_bridge,
@@ -190,6 +193,7 @@ static const TypeInfo pxb_host_info = {
.name = TYPE_PXB_HOST,
.parent = TYPE_PCI_HOST_BRIDGE,
.class_init = pxb_host_class_init,
+ .secure = true,
};
static void pxb_cxl_realize(DeviceState *dev, Error **errp)
@@ -249,6 +253,7 @@ static const TypeInfo cxl_host_info = {
.parent = TYPE_PCI_HOST_BRIDGE,
.instance_size = sizeof(CXLHost),
.class_init = pxb_cxl_host_class_init,
+ .secure = true,
};
/*
@@ -453,6 +458,7 @@ static const TypeInfo pxb_dev_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(PXBDev),
.class_init = pxb_dev_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
@@ -490,6 +496,7 @@ static const TypeInfo pxb_pcie_dev_info = {
.parent = TYPE_PXB_DEV,
.instance_size = sizeof(PXBPCIEDev),
.class_init = pxb_pcie_dev_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
@@ -540,6 +547,7 @@ static const TypeInfo pxb_cxl_dev_info = {
.parent = TYPE_PXB_PCIE_DEV,
.instance_size = sizeof(PXBCXLDev),
.class_init = pxb_cxl_dev_class_init,
+ .secure = true,
.interfaces =
(const InterfaceInfo[]){
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
diff --git a/hw/pci-bridge/pcie_pci_bridge.c b/hw/pci-bridge/pcie_pci_bridge.c
index e826fb2829..03b6b1c0f5 100644
--- a/hw/pci-bridge/pcie_pci_bridge.c
+++ b/hw/pci-bridge/pcie_pci_bridge.c
@@ -162,6 +162,7 @@ static const TypeInfo pcie_pci_bridge_info = {
.parent = TYPE_PCI_BRIDGE,
.instance_size = sizeof(PCIEPCIBridge),
.class_init = pcie_pci_bridge_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ INTERFACE_PCIE_DEVICE },
diff --git a/hw/pci-bridge/pcie_root_port.c b/hw/pci-bridge/pcie_root_port.c
index 7c3e78010b..d829c4b61a 100644
--- a/hw/pci-bridge/pcie_root_port.c
+++ b/hw/pci-bridge/pcie_root_port.c
@@ -186,6 +186,7 @@ static const TypeInfo rp_info = {
.instance_post_init = rp_instance_post_init,
.class_init = rp_class_init,
.abstract = true,
+ .secure = true,
.class_size = sizeof(PCIERootPortClass),
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
diff --git a/hw/pci-bridge/xio3130_downstream.c b/hw/pci-bridge/xio3130_downstream.c
index 0c3fed3053..ded948ebd0 100644
--- a/hw/pci-bridge/xio3130_downstream.c
+++ b/hw/pci-bridge/xio3130_downstream.c
@@ -175,6 +175,7 @@ static const TypeInfo xio3130_downstream_info = {
.name = TYPE_XIO3130_DOWNSTREAM,
.parent = TYPE_PCIE_SLOT,
.class_init = xio3130_downstream_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ }
diff --git a/hw/pci-bridge/xio3130_upstream.c b/hw/pci-bridge/xio3130_upstream.c
index 40057b749b..9d58105f8b 100644
--- a/hw/pci-bridge/xio3130_upstream.c
+++ b/hw/pci-bridge/xio3130_upstream.c
@@ -144,6 +144,7 @@ static const TypeInfo xio3130_upstream_info = {
.name = "x3130-upstream",
.parent = TYPE_PCIE_PORT,
.class_init = xio3130_upstream_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ }
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index c15f2b9f08..20d4942df2 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -319,6 +319,7 @@ static const TypeInfo pci_bus_info = {
.instance_size = sizeof(PCIBus),
.class_size = sizeof(PCIBusClass),
.class_init = pci_bus_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_FW_CFG_DATA_GENERATOR_INTERFACE },
{ }
@@ -328,16 +329,19 @@ static const TypeInfo pci_bus_info = {
static const TypeInfo cxl_interface_info = {
.name = INTERFACE_CXL_DEVICE,
.parent = TYPE_INTERFACE,
+ .secure = true,
};
static const TypeInfo pcie_interface_info = {
.name = INTERFACE_PCIE_DEVICE,
.parent = TYPE_INTERFACE,
+ .secure = true,
};
static const TypeInfo conventional_pci_interface_info = {
.name = INTERFACE_CONVENTIONAL_PCI_DEVICE,
.parent = TYPE_INTERFACE,
+ .secure = true,
};
static void pcie_bus_class_init(ObjectClass *klass, const void *data)
@@ -351,12 +355,14 @@ static const TypeInfo pcie_bus_info = {
.name = TYPE_PCIE_BUS,
.parent = TYPE_PCI_BUS,
.class_init = pcie_bus_class_init,
+ .secure = true,
};
static const TypeInfo cxl_bus_info = {
.name = TYPE_CXL_BUS,
.parent = TYPE_PCIE_BUS,
.class_init = pcie_bus_class_init,
+ .secure = true,
};
static void pci_update_mappings(PCIDevice *d);
@@ -3468,6 +3474,7 @@ static const TypeInfo pci_device_type_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(PCIDevice),
.abstract = true,
+ .secure = true,
.class_size = sizeof(PCIDeviceClass),
.class_init = pci_device_class_init,
.class_base_init = pci_device_class_base_init,
diff --git a/hw/pci/pci_bridge.c b/hw/pci/pci_bridge.c
index e85932e41a..3eb0917fc2 100644
--- a/hw/pci/pci_bridge.c
+++ b/hw/pci/pci_bridge.c
@@ -497,6 +497,7 @@ static const TypeInfo pci_bridge_type_info = {
.instance_size = sizeof(PCIBridge),
.class_init = pci_bridge_class_init,
.abstract = true,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_ACPI_DEV_AML_IF },
{ },
diff --git a/hw/pci/pci_host.c b/hw/pci/pci_host.c
index 2a7fdfa563..5dc9d8493f 100644
--- a/hw/pci/pci_host.c
+++ b/hw/pci/pci_host.c
@@ -262,6 +262,7 @@ static const TypeInfo pci_host_type_info = {
.name = TYPE_PCI_HOST_BRIDGE,
.parent = TYPE_SYS_BUS_DEVICE,
.abstract = true,
+ .secure = true,
.class_size = sizeof(PCIHostBridgeClass),
.instance_size = sizeof(PCIHostState),
.class_init = pci_host_class_init,
diff --git a/hw/pci/pcie_host.c b/hw/pci/pcie_host.c
index 3717e1a086..3cf0769d2a 100644
--- a/hw/pci/pcie_host.c
+++ b/hw/pci/pcie_host.c
@@ -124,6 +124,7 @@ static const TypeInfo pcie_host_type_info = {
.name = TYPE_PCIE_HOST_BRIDGE,
.parent = TYPE_PCI_HOST_BRIDGE,
.abstract = true,
+ .secure = true,
.instance_size = sizeof(PCIExpressHost),
.instance_init = pcie_host_init,
};
diff --git a/hw/pci/pcie_port.c b/hw/pci/pcie_port.c
index dbb6032160..8fce77bcb8 100644
--- a/hw/pci/pcie_port.c
+++ b/hw/pci/pcie_port.c
@@ -200,6 +200,7 @@ static const TypeInfo pcie_port_type_info = {
.parent = TYPE_PCI_BRIDGE,
.instance_size = sizeof(PCIEPort),
.abstract = true,
+ .secure = true,
.class_init = pcie_port_class_init,
};
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* Re: [PATCH 15/28] hw: define most common PCI types as secure
2026-09-11 14:36 ` [PATCH 15/28] hw: define most common PCI types " Daniel P. Berrangé
@ 2026-09-11 16:50 ` Daniel P. Berrangé
0 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 16:50 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm
On Fri, Sep 11, 2026 at 03:36:14PM +0100, Daniel P. Berrangé wrote:
> Essentially all PCI infrastructure is in scope for the virtualization
> use case, aside from the niche simba bridge.
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
> hw/pci-bridge/gen_pcie_root_port.c | 1 +
> hw/pci-bridge/i82801b11.c | 1 +
> hw/pci-bridge/ioh3420.c | 1 +
> hw/pci-bridge/pci_bridge_dev.c | 2 ++
> hw/pci-bridge/pci_expander_bridge.c | 8 ++++++++
> hw/pci-bridge/pcie_pci_bridge.c | 1 +
> hw/pci-bridge/pcie_root_port.c | 1 +
> hw/pci-bridge/xio3130_downstream.c | 1 +
> hw/pci-bridge/xio3130_upstream.c | 1 +
> hw/pci/pci.c | 7 +++++++
> hw/pci/pci_bridge.c | 1 +
> hw/pci/pci_host.c | 1 +
> hw/pci/pcie_host.c | 1 +
> hw/pci/pcie_port.c | 1 +
> 14 files changed, 28 insertions(+)
>
> diff --git a/hw/pci-bridge/pci_expander_bridge.c b/hw/pci-bridge/pci_expander_bridge.c
> index 40ffbc4e08..bd5598b639 100644
> --- a/hw/pci-bridge/pci_expander_bridge.c
> +++ b/hw/pci-bridge/pci_expander_bridge.c
snip
> @@ -128,6 +130,7 @@ static const TypeInfo pxb_cxl_bus_info = {
> .parent = TYPE_CXL_BUS,
> .instance_size = sizeof(PXBBus),
> .class_init = pxb_bus_class_init,
> + .secure = true,
> };
>
snip
> static void pxb_cxl_realize(DeviceState *dev, Error **errp)
> @@ -249,6 +253,7 @@ static const TypeInfo cxl_host_info = {
> .parent = TYPE_PCI_HOST_BRIDGE,
> .instance_size = sizeof(CXLHost),
> .class_init = pxb_cxl_host_class_init,
> + .secure = true,
> };
>
> /*
snip
> @@ -540,6 +547,7 @@ static const TypeInfo pxb_cxl_dev_info = {
> .parent = TYPE_PXB_PCIE_DEV,
> .instance_size = sizeof(PXBCXLDev),
> .class_init = pxb_cxl_dev_class_init,
> + .secure = true,
> .interfaces =
> (const InterfaceInfo[]){
> { INTERFACE_CONVENTIONAL_PCI_DEVICE },
These three were a mistake. No CXL code is intended to be classed as
secure at this time.
With regards,
Daniel
--
|: https://berrange.com ~~ https://hachyderm.io/@berrange :|
|: https://libvirt.org ~~ https://entangle-photo.org :|
|: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
^ permalink raw reply [flat|nested] 30+ messages in thread
* [PATCH 16/28] hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (14 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 15/28] hw: define most common PCI types " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 17/28] hw/display: mark bochs, cirrus, qxl, VGA, ramfb " Daniel P. Berrangé
` (11 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
Mark the PCI hosts secure if they are used from machine types
that are considered for the virtualization use case.
There is also a special case for the 'remote' type and the
Xen passthrough type.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/pci-host/gpex.c | 2 ++
hw/pci-host/i440fx.c | 2 ++
hw/pci-host/pnv_phb.c | 2 ++
hw/pci-host/pnv_phb3.c | 3 +++
hw/pci-host/pnv_phb3_msi.c | 1 +
hw/pci-host/pnv_phb3_pbcq.c | 1 +
hw/pci-host/pnv_phb4.c | 4 +++-
hw/pci-host/pnv_phb4_pec.c | 1 +
hw/pci-host/q35.c | 2 ++
hw/pci-host/remote.c | 1 +
hw/pci-host/xen_igd_pt.c | 1 +
hw/ppc/spapr_pci.c | 1 +
hw/s390x/s390-pci-bus.c | 4 ++++
13 files changed, 24 insertions(+), 1 deletion(-)
diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index e66784ce51..38197a8945 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -220,6 +220,7 @@ static const TypeInfo gpex_host_info = {
.instance_size = sizeof(GPEXHost),
.instance_init = gpex_host_initfn,
.class_init = gpex_host_class_init,
+ .secure = true,
};
/****************************************************************************
@@ -259,6 +260,7 @@ static const TypeInfo gpex_root_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(GPEXRootState),
.class_init = gpex_root_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/pci-host/i440fx.c b/hw/pci-host/i440fx.c
index c1982f7962..1c5a4aba1b 100644
--- a/hw/pci-host/i440fx.c
+++ b/hw/pci-host/i440fx.c
@@ -352,6 +352,7 @@ static const TypeInfo i440fx_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(PCII440FXState),
.class_init = i440fx_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
@@ -410,6 +411,7 @@ static const TypeInfo i440fx_pcihost_info = {
.instance_size = sizeof(I440FXState),
.instance_init = i440fx_pcihost_initfn,
.class_init = i440fx_pcihost_class_init,
+ .secure = true,
};
static void i440fx_register_types(void)
diff --git a/hw/pci-host/pnv_phb.c b/hw/pci-host/pnv_phb.c
index 0b556d1bf5..bc8313d2cd 100644
--- a/hw/pci-host/pnv_phb.c
+++ b/hw/pci-host/pnv_phb.c
@@ -333,6 +333,7 @@ static const TypeInfo pnv_phb_type_info = {
.parent = TYPE_PCIE_HOST_BRIDGE,
.instance_size = sizeof(PnvPHB),
.class_init = pnv_phb_class_init,
+ .secure = true,
};
static const TypeInfo pnv_phb_root_port_info = {
@@ -340,6 +341,7 @@ static const TypeInfo pnv_phb_root_port_info = {
.parent = TYPE_PCIE_ROOT_PORT,
.instance_size = sizeof(PnvPHBRootPort),
.class_init = pnv_phb_root_port_class_init,
+ .secure = true,
};
static void pnv_phb_register_types(void)
diff --git a/hw/pci-host/pnv_phb3.c b/hw/pci-host/pnv_phb3.c
index db061c134e..abf43e3226 100644
--- a/hw/pci-host/pnv_phb3.c
+++ b/hw/pci-host/pnv_phb3.c
@@ -910,6 +910,7 @@ static const TypeInfo pnv_phb3_iommu_memory_region_info = {
.parent = TYPE_IOMMU_MEMORY_REGION,
.name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION,
.class_init = pnv_phb3_iommu_memory_region_class_init,
+ .secure = true,
};
/*
@@ -1123,6 +1124,7 @@ static const TypeInfo pnv_phb3_type_info = {
.instance_size = sizeof(PnvPHB3),
.class_init = pnv_phb3_class_init,
.instance_init = pnv_phb3_instance_init,
+ .secure = true,
};
static void pnv_phb3_root_bus_get_prop(Object *obj, Visitor *v,
@@ -1186,6 +1188,7 @@ static const TypeInfo pnv_phb3_root_bus_info = {
.parent = TYPE_PCIE_BUS,
.instance_size = sizeof(PnvPHB3RootBus),
.class_init = pnv_phb3_root_bus_class_init,
+ .secure = true,
};
static void pnv_phb3_register_types(void)
diff --git a/hw/pci-host/pnv_phb3_msi.c b/hw/pci-host/pnv_phb3_msi.c
index 66ba7b7913..5edc0d43eb 100644
--- a/hw/pci-host/pnv_phb3_msi.c
+++ b/hw/pci-host/pnv_phb3_msi.c
@@ -306,6 +306,7 @@ static const TypeInfo phb3_msi_info = {
.class_init = phb3_msi_class_init,
.class_size = sizeof(ICSStateClass),
.instance_init = phb3_msi_instance_init,
+ .secure = true,
};
static void pnv_phb3_msi_register_types(void)
diff --git a/hw/pci-host/pnv_phb3_pbcq.c b/hw/pci-host/pnv_phb3_pbcq.c
index 1f7a149580..687c832515 100644
--- a/hw/pci-host/pnv_phb3_pbcq.c
+++ b/hw/pci-host/pnv_phb3_pbcq.c
@@ -354,6 +354,7 @@ static const TypeInfo pnv_pbcq_type_info = {
.instance_size = sizeof(PnvPBCQState),
.instance_init = phb3_pbcq_instance_init,
.class_init = pnv_pbcq_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_PNV_XSCOM_INTERFACE },
{ }
diff --git a/hw/pci-host/pnv_phb4.c b/hw/pci-host/pnv_phb4.c
index 9acaf4c0c2..9706208473 100644
--- a/hw/pci-host/pnv_phb4.c
+++ b/hw/pci-host/pnv_phb4.c
@@ -1374,6 +1374,7 @@ static const TypeInfo pnv_phb4_iommu_memory_region_info = {
.parent = TYPE_IOMMU_MEMORY_REGION,
.name = TYPE_PNV_PHB4_IOMMU_MEMORY_REGION,
.class_init = pnv_phb4_iommu_memory_region_class_init,
+ .secure = true,
};
/*
@@ -1715,13 +1716,13 @@ static const TypeInfo pnv_phb4_type_info = {
.instance_init = pnv_phb4_instance_init,
.instance_size = sizeof(PnvPHB4),
.class_init = pnv_phb4_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_XIVE_NOTIFIER },
{ },
}
};
-
static void pnv_phb4_root_bus_get_prop(Object *obj, Visitor *v,
const char *name,
void *opaque, Error **errp)
@@ -1783,6 +1784,7 @@ static const TypeInfo pnv_phb4_root_bus_info = {
.parent = TYPE_PCIE_BUS,
.instance_size = sizeof(PnvPHB4RootBus),
.class_init = pnv_phb4_root_bus_class_init,
+ .secure = true,
};
static void pnv_phb4_register_types(void)
diff --git a/hw/pci-host/pnv_phb4_pec.c b/hw/pci-host/pnv_phb4_pec.c
index ee5cdc3e45..280a15e8df 100644
--- a/hw/pci-host/pnv_phb4_pec.c
+++ b/hw/pci-host/pnv_phb4_pec.c
@@ -388,6 +388,7 @@ static const TypeInfo pnv_pec_type_info = {
.instance_size = sizeof(PnvPhb4PecState),
.class_init = pnv_pec_class_init,
.class_size = sizeof(PnvPhb4PecClass),
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_PNV_XSCOM_INTERFACE },
{ }
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index f4556ad03a..be38841df9 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -268,6 +268,7 @@ static const TypeInfo q35_host_info = {
.instance_size = sizeof(Q35PCIHost),
.instance_init = q35_host_initfn,
.class_init = q35_host_class_init,
+ .secure = true,
};
/****************************************************************************
@@ -718,6 +719,7 @@ static const TypeInfo mch_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(MCHPCIState),
.class_init = mch_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/pci-host/remote.c b/hw/pci-host/remote.c
index 9ea95fac6e..a58fc39bde 100644
--- a/hw/pci-host/remote.c
+++ b/hw/pci-host/remote.c
@@ -63,6 +63,7 @@ static const TypeInfo remote_pcihost_info = {
.parent = TYPE_PCIE_HOST_BRIDGE,
.instance_size = sizeof(RemotePCIHost),
.class_init = remote_pcihost_class_init,
+ .secure = true,
};
static void remote_pcihost_register(void)
diff --git a/hw/pci-host/xen_igd_pt.c b/hw/pci-host/xen_igd_pt.c
index f6016f2cd5..abc68849b9 100644
--- a/hw/pci-host/xen_igd_pt.c
+++ b/hw/pci-host/xen_igd_pt.c
@@ -110,6 +110,7 @@ static const TypeInfo igd_passthrough_i440fx_info = {
.parent = TYPE_I440FX_PCI_DEVICE,
.instance_size = sizeof(PCII440FXState),
.class_init = igd_passthrough_i440fx_class_init,
+ .secure = true,
};
static void igd_pt_i440fx_register_types(void)
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index c1d4b7806e..711c37878b 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -2174,6 +2174,7 @@ static const TypeInfo spapr_phb_info = {
.instance_size = sizeof(SpaprPhbState),
.instance_finalize = spapr_phb_finalizefn,
.class_init = spapr_phb_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
index eff980fdfe..5356d13624 100644
--- a/hw/s390x/s390-pci-bus.c
+++ b/hw/s390x/s390-pci-bus.c
@@ -1406,6 +1406,7 @@ static const TypeInfo s390_pcihost_info = {
.parent = TYPE_PCI_HOST_BRIDGE,
.instance_size = sizeof(S390pciState),
.class_init = s390_pcihost_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ }
@@ -1416,6 +1417,7 @@ static const TypeInfo s390_pcibus_info = {
.name = TYPE_S390_PCI_BUS,
.parent = TYPE_BUS,
.instance_size = sizeof(S390PCIBus),
+ .secure = true,
};
static uint16_t s390_pci_generate_uid(S390pciState *s)
@@ -1588,12 +1590,14 @@ static const TypeInfo s390_pci_device_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(S390PCIBusDevice),
.class_init = s390_pci_device_class_init,
+ .secure = true,
};
static const TypeInfo s390_pci_iommu_info = {
.name = TYPE_S390_PCI_IOMMU,
.parent = TYPE_OBJECT,
.instance_size = sizeof(S390PCIIOMMU),
+ .secure = true,
};
static void s390_iommu_memory_region_class_init(ObjectClass *klass,
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 17/28] hw/display: mark bochs, cirrus, qxl, VGA, ramfb as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (15 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 16/28] hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 18/28] hw/tpm: mark all TPM implementations " Daniel P. Berrangé
` (10 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
Most of the display adapters are emulating old hardware which is not
relevant to virtualization use cases.
The exceptions that should be considered secure are Cirrus (PCI, not
ISA), Bochs, QXL, RAMFB, VGA (PCI, MMIO, not ISA) and VMWare VGA.
The Cirrus PCI decision is borderline. It has been heavily used with
virtualization in the past, but these days VGA / RAMFB are strongly
recommended instead. Due to its historical usage though, we should
likely retain it in the set we aim to class as secure.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/display/bochs-display.c | 1 +
hw/display/cirrus_vga.c | 1 +
hw/display/qxl.c | 3 +++
hw/display/ramfb-standalone.c | 1 +
hw/display/vga-mmio.c | 1 +
hw/display/vga-pci.c | 3 +++
6 files changed, 10 insertions(+)
diff --git a/hw/display/bochs-display.c b/hw/display/bochs-display.c
index 64e669429c..5f3ba80f99 100644
--- a/hw/display/bochs-display.c
+++ b/hw/display/bochs-display.c
@@ -374,6 +374,7 @@ static const TypeInfo bochs_display_type_info = {
.instance_size = sizeof(BochsDisplayState),
.instance_init = bochs_display_init,
.class_init = bochs_display_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
diff --git a/hw/display/cirrus_vga.c b/hw/display/cirrus_vga.c
index 0a8c74e137..8232c5c468 100644
--- a/hw/display/cirrus_vga.c
+++ b/hw/display/cirrus_vga.c
@@ -3013,6 +3013,7 @@ static const TypeInfo cirrus_vga_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(PCICirrusVGAState),
.class_init = cirrus_vga_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/display/qxl.c b/hw/display/qxl.c
index 384b8767b8..d673663b3a 100644
--- a/hw/display/qxl.c
+++ b/hw/display/qxl.c
@@ -2566,6 +2566,7 @@ static const TypeInfo qxl_pci_type_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(PCIQXLDevice),
.abstract = true,
+ .secure = true,
.class_init = qxl_pci_class_init,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -2589,6 +2590,7 @@ static const TypeInfo qxl_primary_info = {
.name = "qxl-vga",
.parent = TYPE_PCI_QXL,
.class_init = qxl_primary_class_init,
+ .secure = true,
};
module_obj("qxl-vga");
module_kconfig(QXL);
@@ -2607,6 +2609,7 @@ static const TypeInfo qxl_secondary_info = {
.name = "qxl",
.parent = TYPE_PCI_QXL,
.class_init = qxl_secondary_class_init,
+ .secure = true,
};
module_obj("qxl");
diff --git a/hw/display/ramfb-standalone.c b/hw/display/ramfb-standalone.c
index 8e8ba37514..9427009acc 100644
--- a/hw/display/ramfb-standalone.c
+++ b/hw/display/ramfb-standalone.c
@@ -85,6 +85,7 @@ static const TypeInfo ramfb_info = {
.parent = TYPE_DYNAMIC_SYS_BUS_DEVICE,
.instance_size = sizeof(RAMFBStandaloneState),
.class_init = ramfb_class_initfn,
+ .secure = true,
};
static void ramfb_register_types(void)
diff --git a/hw/display/vga-mmio.c b/hw/display/vga-mmio.c
index 3cd64951c0..65dbbed12d 100644
--- a/hw/display/vga-mmio.c
+++ b/hw/display/vga-mmio.c
@@ -132,6 +132,7 @@ static const TypeInfo vga_mmio_info = {
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(VGAMmioState),
.class_init = vga_mmio_class_initfn,
+ .secure = true,
};
static void vga_mmio_register_types(void)
diff --git a/hw/display/vga-pci.c b/hw/display/vga-pci.c
index d089847bda..bb13eee8a2 100644
--- a/hw/display/vga-pci.c
+++ b/hw/display/vga-pci.c
@@ -367,6 +367,7 @@ static const TypeInfo vga_pci_type_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(PCIVGAState),
.abstract = true,
+ .secure = true,
.class_init = vga_pci_class_init,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -407,6 +408,7 @@ static const TypeInfo vga_info = {
.name = "VGA",
.parent = TYPE_PCI_VGA,
.class_init = vga_class_init,
+ .secure = true,
};
static const TypeInfo secondary_info = {
@@ -414,6 +416,7 @@ static const TypeInfo secondary_info = {
.parent = TYPE_PCI_VGA,
.instance_init = pci_secondary_vga_init,
.class_init = secondary_class_init,
+ .secure = true,
};
static void vga_register_types(void)
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 18/28] hw/tpm: mark all TPM implementations as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (16 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 17/28] hw/display: mark bochs, cirrus, qxl, VGA, ramfb " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 19/28] hw/misc: mark pvpanic, vmcoreinfo " Daniel P. Berrangé
` (9 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
All of the TPM implementations are in scope of virtualization
usage, so mark them all as secure.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/ppc/spapr_tpm_proxy.c | 1 +
hw/tpm/tpm_crb.c | 1 +
hw/tpm/tpm_spapr.c | 1 +
hw/tpm/tpm_tis_i2c.c | 1 +
hw/tpm/tpm_tis_isa.c | 1 +
hw/tpm/tpm_tis_sysbus.c | 1 +
6 files changed, 6 insertions(+)
diff --git a/hw/ppc/spapr_tpm_proxy.c b/hw/ppc/spapr_tpm_proxy.c
index 19889e80bc..bb6efec20c 100644
--- a/hw/ppc/spapr_tpm_proxy.c
+++ b/hw/ppc/spapr_tpm_proxy.c
@@ -166,6 +166,7 @@ static const TypeInfo spapr_tpm_proxy_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(SpaprTpmProxy),
.class_init = spapr_tpm_proxy_class_init,
+ .secure = true,
};
static void spapr_tpm_proxy_register_types(void)
diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c
index 54fa2042b5..2e9445ad79 100644
--- a/hw/tpm/tpm_crb.c
+++ b/hw/tpm/tpm_crb.c
@@ -547,6 +547,7 @@ static const TypeInfo tpm_crb_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(CRBState),
.class_init = tpm_crb_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_TPM_IF },
{ }
diff --git a/hw/tpm/tpm_spapr.c b/hw/tpm/tpm_spapr.c
index 19075d1f01..3957c5268b 100644
--- a/hw/tpm/tpm_spapr.c
+++ b/hw/tpm/tpm_spapr.c
@@ -414,6 +414,7 @@ static const TypeInfo tpm_spapr_info = {
.parent = TYPE_VIO_SPAPR_DEVICE,
.instance_size = sizeof(SpaprTpmState),
.class_init = tpm_spapr_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_TPM_IF },
{ }
diff --git a/hw/tpm/tpm_tis_i2c.c b/hw/tpm/tpm_tis_i2c.c
index b4f258c7bc..302296affb 100644
--- a/hw/tpm/tpm_tis_i2c.c
+++ b/hw/tpm/tpm_tis_i2c.c
@@ -551,6 +551,7 @@ static const TypeInfo tpm_tis_i2c_info = {
.name = TYPE_TPM_TIS_I2C,
.parent = TYPE_I2C_SLAVE,
.instance_size = sizeof(TPMStateI2C),
+ .secure = true,
.class_init = tpm_tis_i2c_class_init,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_TPM_IF },
diff --git a/hw/tpm/tpm_tis_isa.c b/hw/tpm/tpm_tis_isa.c
index 2b1267133a..da3a932b03 100644
--- a/hw/tpm/tpm_tis_isa.c
+++ b/hw/tpm/tpm_tis_isa.c
@@ -187,6 +187,7 @@ static const TypeInfo tpm_tis_isa_info = {
.instance_size = sizeof(TPMStateISA),
.instance_init = tpm_tis_isa_initfn,
.class_init = tpm_tis_isa_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_TPM_IF },
{ TYPE_ACPI_DEV_AML_IF },
diff --git a/hw/tpm/tpm_tis_sysbus.c b/hw/tpm/tpm_tis_sysbus.c
index a7b0002d82..0afb52c3be 100644
--- a/hw/tpm/tpm_tis_sysbus.c
+++ b/hw/tpm/tpm_tis_sysbus.c
@@ -167,6 +167,7 @@ static const TypeInfo tpm_tis_sysbus_info = {
.instance_init = tpm_tis_sysbus_initfn,
.instance_finalize = tpm_tis_sysbus_finalize,
.class_init = tpm_tis_sysbus_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_TPM_IF },
{ }
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 19/28] hw/misc: mark pvpanic, vmcoreinfo as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (17 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 18/28] hw/tpm: mark all TPM implementations " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 20/28] hw/audio: mark Intel HDA devices & codecs " Daniel P. Berrangé
` (8 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
The first two devices are common debug aids for virtualized
guests so must be marked secure.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/misc/pvpanic-isa.c | 1 +
hw/misc/pvpanic-mmio.c | 1 +
hw/misc/pvpanic-pci.c | 1 +
hw/misc/vmcoreinfo.c | 1 +
4 files changed, 4 insertions(+)
diff --git a/hw/misc/pvpanic-isa.c b/hw/misc/pvpanic-isa.c
index 85fb7da5e5..bb0a7ff6f8 100644
--- a/hw/misc/pvpanic-isa.c
+++ b/hw/misc/pvpanic-isa.c
@@ -121,6 +121,7 @@ static const TypeInfo pvpanic_isa_info = {
.instance_size = sizeof(PVPanicISAState),
.instance_init = pvpanic_isa_initfn,
.class_init = pvpanic_isa_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_ACPI_DEV_AML_IF },
{ },
diff --git a/hw/misc/pvpanic-mmio.c b/hw/misc/pvpanic-mmio.c
index a173a1a9a5..161e8fc59b 100644
--- a/hw/misc/pvpanic-mmio.c
+++ b/hw/misc/pvpanic-mmio.c
@@ -50,6 +50,7 @@ static const TypeInfo pvpanic_mmio_info = {
.instance_size = sizeof(PVPanicMMIOState),
.instance_init = pvpanic_mmio_initfn,
.class_init = pvpanic_mmio_class_init,
+ .secure = true,
};
static void pvpanic_register_types(void)
diff --git a/hw/misc/pvpanic-pci.c b/hw/misc/pvpanic-pci.c
index 5509f70a3e..7d1f99d564 100644
--- a/hw/misc/pvpanic-pci.c
+++ b/hw/misc/pvpanic-pci.c
@@ -80,6 +80,7 @@ static const TypeInfo pvpanic_pci_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(PVPanicPCIState),
.class_init = pvpanic_pci_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ }
diff --git a/hw/misc/vmcoreinfo.c b/hw/misc/vmcoreinfo.c
index 9c2e9005ad..90f361b05f 100644
--- a/hw/misc/vmcoreinfo.c
+++ b/hw/misc/vmcoreinfo.c
@@ -101,6 +101,7 @@ static const TypeInfo vmcoreinfo_types[] = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(VMCoreInfoState),
.class_init = vmcoreinfo_device_class_init,
+ .secure = true,
}
};
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 20/28] hw/audio: mark Intel HDA devices & codecs as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (18 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 19/28] hw/misc: mark pvpanic, vmcoreinfo " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 21/28] hw/char: mark common serial / console devicess a secure Daniel P. Berrangé
` (7 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
This is traditionally the primary audio backend for x86 as
virtio-snd is a relatively new invention.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/audio/hda-codec.c | 4 ++++
hw/audio/intel-hda.c | 5 +++++
2 files changed, 9 insertions(+)
diff --git a/hw/audio/hda-codec.c b/hw/audio/hda-codec.c
index 173fe56bea..05bd35700f 100644
--- a/hw/audio/hda-codec.c
+++ b/hw/audio/hda-codec.c
@@ -858,6 +858,7 @@ static const TypeInfo hda_audio_info = {
.instance_size = sizeof(HDAAudioState),
.class_init = hda_audio_base_class_init,
.abstract = true,
+ .secure = true,
};
static void hda_audio_output_class_init(ObjectClass *klass, const void *data)
@@ -873,6 +874,7 @@ static const TypeInfo hda_audio_output_info = {
.name = "hda-output",
.parent = TYPE_HDA_AUDIO,
.class_init = hda_audio_output_class_init,
+ .secure = true,
};
static void hda_audio_duplex_class_init(ObjectClass *klass, const void *data)
@@ -888,6 +890,7 @@ static const TypeInfo hda_audio_duplex_info = {
.name = "hda-duplex",
.parent = TYPE_HDA_AUDIO,
.class_init = hda_audio_duplex_class_init,
+ .secure = true,
};
static void hda_audio_micro_class_init(ObjectClass *klass, const void *data)
@@ -903,6 +906,7 @@ static const TypeInfo hda_audio_micro_info = {
.name = "hda-micro",
.parent = TYPE_HDA_AUDIO,
.class_init = hda_audio_micro_class_init,
+ .secure = true,
};
static void hda_audio_register_types(void)
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index 3d361a4976..34ca1e713c 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -45,6 +45,7 @@ static const TypeInfo hda_codec_bus_info = {
.name = TYPE_HDA_BUS,
.parent = TYPE_BUS,
.instance_size = sizeof(HDACodecBus),
+ .secure = true,
};
void hda_codec_bus_init(DeviceState *dev, HDACodecBus *bus, size_t bus_size,
@@ -1265,6 +1266,7 @@ static const TypeInfo intel_hda_info = {
.instance_size = sizeof(IntelHDAState),
.class_init = intel_hda_class_init,
.abstract = true,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
@@ -1275,12 +1277,14 @@ static const TypeInfo intel_hda_info_ich6 = {
.name = "intel-hda",
.parent = TYPE_INTEL_HDA_GENERIC,
.class_init = intel_hda_class_init_ich6,
+ .secure = true,
};
static const TypeInfo intel_hda_info_ich9 = {
.name = "ich9-intel-hda",
.parent = TYPE_INTEL_HDA_GENERIC,
.class_init = intel_hda_class_init_ich9,
+ .secure = true,
};
static void hda_codec_device_class_init(ObjectClass *klass, const void *data)
@@ -1298,6 +1302,7 @@ static const TypeInfo hda_codec_device_type_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(HDACodecDevice),
.abstract = true,
+ .secure = true,
.class_size = sizeof(HDACodecDeviceClass),
.class_init = hda_codec_device_class_init,
};
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 21/28] hw/char: mark common serial / console devicess a secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (19 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 20/28] hw/audio: mark Intel HDA devices & codecs " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 22/28] hw/mem: mark nvdimm, pc-dimm & spapr-nvdimm devices as secure Daniel P. Berrangé
` (6 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
These are needed as a baseline feature for many virtualization use
cases on x86, PPC64 and s390x.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/char/debugcon.c | 1 +
hw/char/sclpconsole-lm.c | 1 +
hw/char/sclpconsole.c | 1 +
hw/char/serial-isa.c | 1 +
hw/char/serial-pci.c | 1 +
hw/char/serial.c | 1 +
hw/char/spapr_vty.c | 1 +
7 files changed, 7 insertions(+)
diff --git a/hw/char/debugcon.c b/hw/char/debugcon.c
index a1b370b90b..f38ce7b765 100644
--- a/hw/char/debugcon.c
+++ b/hw/char/debugcon.c
@@ -134,6 +134,7 @@ static const TypeInfo debugcon_isa_info = {
.parent = TYPE_ISA_DEVICE,
.instance_size = sizeof(ISADebugconState),
.class_init = debugcon_isa_class_initfn,
+ .secure = true,
};
static void debugcon_register_types(void)
diff --git a/hw/char/sclpconsole-lm.c b/hw/char/sclpconsole-lm.c
index f6ed282f1b..4261652735 100644
--- a/hw/char/sclpconsole-lm.c
+++ b/hw/char/sclpconsole-lm.c
@@ -363,6 +363,7 @@ static const TypeInfo sclp_console_info = {
.instance_size = sizeof(SCLPConsoleLM),
.class_init = console_class_init,
.class_size = sizeof(SCLPEventClass),
+ .secure = true,
};
static void register_types(void)
diff --git a/hw/char/sclpconsole.c b/hw/char/sclpconsole.c
index 179d12745c..04a951089a 100644
--- a/hw/char/sclpconsole.c
+++ b/hw/char/sclpconsole.c
@@ -278,6 +278,7 @@ static const TypeInfo sclp_console_info = {
.instance_size = sizeof(SCLPConsole),
.class_init = console_class_init,
.class_size = sizeof(SCLPEventClass),
+ .secure = true,
};
static void register_types(void)
diff --git a/hw/char/serial-isa.c b/hw/char/serial-isa.c
index eaa4e843c0..5df87590b7 100644
--- a/hw/char/serial-isa.c
+++ b/hw/char/serial-isa.c
@@ -147,6 +147,7 @@ static const TypeInfo serial_isa_info = {
.instance_size = sizeof(ISASerialState),
.instance_init = serial_isa_initfn,
.class_init = serial_isa_class_initfn,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_ACPI_DEV_AML_IF },
{ },
diff --git a/hw/char/serial-pci.c b/hw/char/serial-pci.c
index d8cacc9085..183091ea41 100644
--- a/hw/char/serial-pci.c
+++ b/hw/char/serial-pci.c
@@ -109,6 +109,7 @@ static const TypeInfo serial_pci_info = {
.instance_size = sizeof(PCISerialState),
.instance_init = serial_pci_init,
.class_init = serial_pci_class_initfn,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/char/serial.c b/hw/char/serial.c
index 4339562ab0..fefd2cf9fc 100644
--- a/hw/char/serial.c
+++ b/hw/char/serial.c
@@ -984,6 +984,7 @@ static const TypeInfo serial_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(SerialState),
.class_init = serial_class_init,
+ .secure = true,
};
static void serial_register_types(void)
diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
index 1dd9fb155c..96a4e58ad9 100644
--- a/hw/char/spapr_vty.c
+++ b/hw/char/spapr_vty.c
@@ -201,6 +201,7 @@ static const TypeInfo spapr_vty_info = {
.parent = TYPE_VIO_SPAPR_DEVICE,
.instance_size = sizeof(SpaprVioVty),
.class_init = spapr_vty_class_init,
+ .secure = true,
};
SpaprVioDevice *spapr_vty_get_default(SpaprVioBus *bus)
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 22/28] hw/mem: mark nvdimm, pc-dimm & spapr-nvdimm devices as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (20 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 21/28] hw/char: mark common serial / console devicess a secure Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 23/28] hw/uefi: mark the EFI vars service " Daniel P. Berrangé
` (5 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
These devices are used in virutalization scenarios to support memory
hotplug and other uses cases.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/mem/nvdimm.c | 1 +
hw/mem/pc-dimm.c | 1 +
hw/ppc/spapr_nvdimm.c | 1 +
3 files changed, 3 insertions(+)
diff --git a/hw/mem/nvdimm.c b/hw/mem/nvdimm.c
index cf8a4d8c5f..9a57579845 100644
--- a/hw/mem/nvdimm.c
+++ b/hw/mem/nvdimm.c
@@ -275,6 +275,7 @@ static const TypeInfo nvdimm_info = {
.instance_size = sizeof(NVDIMMDevice),
.instance_init = nvdimm_init,
.instance_finalize = nvdimm_finalize,
+ .secure = true,
};
static void nvdimm_register_types(void)
diff --git a/hw/mem/pc-dimm.c b/hw/mem/pc-dimm.c
index 68862926ee..89fd06724c 100644
--- a/hw/mem/pc-dimm.c
+++ b/hw/mem/pc-dimm.c
@@ -301,6 +301,7 @@ static const TypeInfo pc_dimm_info = {
.instance_init = pc_dimm_init,
.class_init = pc_dimm_class_init,
.class_size = sizeof(PCDIMMDeviceClass),
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_MEMORY_DEVICE },
{ }
diff --git a/hw/ppc/spapr_nvdimm.c b/hw/ppc/spapr_nvdimm.c
index 6647428391..b927cf21b8 100644
--- a/hw/ppc/spapr_nvdimm.c
+++ b/hw/ppc/spapr_nvdimm.c
@@ -916,6 +916,7 @@ static TypeInfo spapr_nvdimm_info = {
.class_size = sizeof(SPAPRNVDIMMClass),
.instance_size = sizeof(SpaprNVDIMMDevice),
.instance_init = spapr_nvdimm_init,
+ .secure = true,
};
static void spapr_nvdimm_register_types(void)
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 23/28] hw/uefi: mark the EFI vars service as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (21 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 22/28] hw/mem: mark nvdimm, pc-dimm & spapr-nvdimm devices as secure Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 24/28] hw/acpi: mark erst, vmclock and vmgenid devices " Daniel P. Berrangé
` (4 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
This is used to persist EFI variables when NVRAM is not available
or undesirable.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/uefi/var-service-sysbus.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/hw/uefi/var-service-sysbus.c b/hw/uefi/var-service-sysbus.c
index 97a96cae6a..6bec14733b 100644
--- a/hw/uefi/var-service-sysbus.c
+++ b/hw/uefi/var-service-sysbus.c
@@ -84,6 +84,7 @@ static const TypeInfo uefi_vars_sysbus_info = {
.instance_size = sizeof(uefi_vars_sysbus_state),
.instance_init = uefi_vars_sysbus_init,
.class_init = uefi_vars_sysbus_class_init,
+ .secure = true,
};
module_obj(TYPE_UEFI_VARS_SYSBUS);
@@ -113,6 +114,7 @@ static const TypeInfo uefi_vars_x64_info = {
.name = TYPE_UEFI_VARS_X64,
.parent = TYPE_UEFI_VARS_SYSBUS,
.class_init = uefi_vars_x64_class_init,
+ .secure = true,
};
module_obj(TYPE_UEFI_VARS_X64);
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 24/28] hw/acpi: mark erst, vmclock and vmgenid devices as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (22 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 23/28] hw/uefi: mark the EFI vars service " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 25/28] hw: mark KVM clock and RTC " Daniel P. Berrangé
` (3 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
These are all used in virtualization scenarios so must be
declare to provide a security boundary
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/acpi/erst.c | 1 +
hw/acpi/vmclock.c | 1 +
hw/acpi/vmgenid.c | 1 +
3 files changed, 3 insertions(+)
diff --git a/hw/acpi/erst.c b/hw/acpi/erst.c
index b6c1942e30..44560004a5 100644
--- a/hw/acpi/erst.c
+++ b/hw/acpi/erst.c
@@ -1044,6 +1044,7 @@ static const TypeInfo erst_type_info = {
.parent = TYPE_PCI_DEVICE,
.class_init = erst_class_init,
.instance_size = sizeof(ERSTDeviceState),
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ }
diff --git a/hw/acpi/vmclock.c b/hw/acpi/vmclock.c
index d51cab2e20..b545354600 100644
--- a/hw/acpi/vmclock.c
+++ b/hw/acpi/vmclock.c
@@ -169,6 +169,7 @@ static const TypeInfo vmclock_device_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(VmclockState),
.class_init = vmclock_device_class_init,
+ .secure = true,
};
static void vmclock_register_types(void)
diff --git a/hw/acpi/vmgenid.c b/hw/acpi/vmgenid.c
index 27cc0128d1..67f815d8a1 100644
--- a/hw/acpi/vmgenid.c
+++ b/hw/acpi/vmgenid.c
@@ -236,6 +236,7 @@ static const TypeInfo vmgenid_device_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(VmGenIdState),
.class_init = vmgenid_device_class_init,
+ .secure = true,
};
static void vmgenid_register_types(void)
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 25/28] hw: mark KVM clock and RTC devices as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (23 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 24/28] hw/acpi: mark erst, vmclock and vmgenid devices " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 26/28] hw: device AMD, Intel and ARM IOMMUs " Daniel P. Berrangé
` (2 subsequent siblings)
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
These are core infrastructure in virtualization cases so must
provide a security boundary.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/i386/kvm/clock.c | 1 +
hw/rtc/mc146818rtc.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/hw/i386/kvm/clock.c b/hw/i386/kvm/clock.c
index e3dad136d3..d3e2301311 100644
--- a/hw/i386/kvm/clock.c
+++ b/hw/i386/kvm/clock.c
@@ -366,6 +366,7 @@ static const TypeInfo kvmclock_info = {
.parent = TYPE_SYS_BUS_DEVICE,
.instance_size = sizeof(KVMClockState),
.class_init = kvmclock_class_init,
+ .secure = true,
};
/* Note: Must be called after VCPU initialization. */
diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
index ba396435d1..66f8b177e7 100644
--- a/hw/rtc/mc146818rtc.c
+++ b/hw/rtc/mc146818rtc.c
@@ -1027,6 +1027,7 @@ static const TypeInfo mc146818rtc_info = {
.parent = TYPE_ISA_DEVICE,
.instance_size = sizeof(MC146818RtcState),
.class_init = rtc_class_initfn,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_ACPI_DEV_AML_IF },
{ },
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 26/28] hw: device AMD, Intel and ARM IOMMUs as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (24 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 25/28] hw: mark KVM clock and RTC " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 27/28] hw/input: mark PS/2 and PC Keyboard devices " Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 28/28] hw/i386: mark vmmouse / vmport " Daniel P. Berrangé
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
These are needed in virtualization use cases to support PCI device
assignment use cases so must provide a security boundary.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/arm/smmu-common.c | 1 +
hw/arm/smmuv3.c | 2 ++
hw/i386/amd_iommu.c | 4 +++-
hw/i386/intel_iommu.c | 1 +
4 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index 8e40ba603d..bca9a32e9f 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -1040,6 +1040,7 @@ static const TypeInfo smmu_base_info = {
.class_size = sizeof(SMMUBaseClass),
.class_init = smmu_base_class_init,
.abstract = true,
+ .secure = true,
};
static void smmu_base_register_types(void)
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index ed19536a4d..2a9721b87e 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -2272,12 +2272,14 @@ static const TypeInfo smmuv3_type_info = {
.instance_init = smmuv3_instance_init,
.class_size = sizeof(SMMUv3Class),
.class_init = smmuv3_class_init,
+ .secure = true,
};
static const TypeInfo smmuv3_iommu_memory_region_info = {
.parent = TYPE_IOMMU_MEMORY_REGION,
.name = TYPE_SMMUV3_IOMMU_MEMORY_REGION,
.class_init = smmuv3_iommu_memory_region_class_init,
+ .secure = true,
};
static void smmuv3_register_types(void)
diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 578c27ccbe..3192609ba0 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -2783,7 +2783,8 @@ static const TypeInfo amdvi_sysbus = {
.name = TYPE_AMD_IOMMU_DEVICE,
.parent = TYPE_X86_IOMMU_DEVICE,
.instance_size = sizeof(AMDVIState),
- .class_init = amdvi_sysbus_class_init
+ .class_init = amdvi_sysbus_class_init,
+ .secure = true,
};
static void amdvi_pci_class_init(ObjectClass *klass, const void *data)
@@ -2805,6 +2806,7 @@ static const TypeInfo amdvi_pci = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(AMDVIPCIState),
.class_init = amdvi_pci_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 82c3c3b2c3..20e44590ca 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -5687,6 +5687,7 @@ static const TypeInfo vtd_info = {
.parent = TYPE_X86_IOMMU_DEVICE,
.instance_size = sizeof(IntelIOMMUState),
.class_init = vtd_class_init,
+ .secure = true,
};
static int vtd_attrs_to_index(IOMMUMemoryRegion *iommu_mr, MemTxAttrs attrs)
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 27/28] hw/input: mark PS/2 and PC Keyboard devices as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (25 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 26/28] hw: device AMD, Intel and ARM IOMMUs " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
2026-09-11 14:36 ` [PATCH 28/28] hw/i386: mark vmmouse / vmport " Daniel P. Berrangé
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
These are part of the baseline x86 featureset so required for
virtualization use cases.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/input/pckbd.c | 3 ++-
hw/input/ps2.c | 9 ++++++---
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/hw/input/pckbd.c b/hw/input/pckbd.c
index b09c3bce93..0250252cd6 100644
--- a/hw/input/pckbd.c
+++ b/hw/input/pckbd.c
@@ -766,7 +766,8 @@ static const TypeInfo i8042_mmio_info = {
.parent = TYPE_SYS_BUS_DEVICE,
.instance_init = i8042_mmio_init,
.instance_size = sizeof(MMIOKBDState),
- .class_init = i8042_mmio_class_init
+ .class_init = i8042_mmio_class_init,
+ .secure = true,
};
void i8042_isa_mouse_fake_event(ISAKBDState *isa)
diff --git a/hw/input/ps2.c b/hw/input/ps2.c
index 01af4350b3..8588f39f99 100644
--- a/hw/input/ps2.c
+++ b/hw/input/ps2.c
@@ -1293,7 +1293,8 @@ static const TypeInfo ps2_kbd_info = {
.name = TYPE_PS2_KBD_DEVICE,
.parent = TYPE_PS2_DEVICE,
.instance_size = sizeof(PS2KbdState),
- .class_init = ps2_kbd_class_init
+ .class_init = ps2_kbd_class_init,
+ .secure = true,
};
static void ps2_mouse_class_init(ObjectClass *klass, const void *data)
@@ -1313,7 +1314,8 @@ static const TypeInfo ps2_mouse_info = {
.name = TYPE_PS2_MOUSE_DEVICE,
.parent = TYPE_PS2_DEVICE,
.instance_size = sizeof(PS2MouseState),
- .class_init = ps2_mouse_class_init
+ .class_init = ps2_mouse_class_init,
+ .secure = true,
};
static void ps2_init(Object *obj)
@@ -1340,7 +1342,8 @@ static const TypeInfo ps2_info = {
.instance_size = sizeof(PS2State),
.class_init = ps2_class_init,
.class_size = sizeof(PS2DeviceClass),
- .abstract = true
+ .abstract = true,
+ .secure = true,
};
static void ps2_register_types(void)
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread* [PATCH 28/28] hw/i386: mark vmmouse / vmport as secure
2026-09-11 14:35 [PATCH 00/28] Mark user creatable devices for secure for virt use case Daniel P. Berrangé
` (26 preceding siblings ...)
2026-09-11 14:36 ` [PATCH 27/28] hw/input: mark PS/2 and PC Keyboard devices " Daniel P. Berrangé
@ 2026-09-11 14:36 ` Daniel P. Berrangé
27 siblings, 0 replies; 30+ messages in thread
From: Daniel P. Berrangé @ 2026-09-11 14:36 UTC (permalink / raw)
To: qemu-devel
Cc: xen-devel, qemu-riscv, qemu-ppc, qemu-block, qemu-s390x, qemu-arm,
Daniel P. Berrangé
These paravirtualized devices are relevant to virtualization
use cases.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/i386/vmmouse.c | 1 +
hw/i386/vmport.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/hw/i386/vmmouse.c b/hw/i386/vmmouse.c
index e289bce8e2..612e7f7d3b 100644
--- a/hw/i386/vmmouse.c
+++ b/hw/i386/vmmouse.c
@@ -390,6 +390,7 @@ static const TypeInfo vmmouse_info = {
.parent = TYPE_ISA_DEVICE,
.instance_size = sizeof(VMMouseState),
.class_init = vmmouse_class_initfn,
+ .secure = true,
};
static void vmmouse_register_types(void)
diff --git a/hw/i386/vmport.c b/hw/i386/vmport.c
index 865e0e70db..24c4fb27a3 100644
--- a/hw/i386/vmport.c
+++ b/hw/i386/vmport.c
@@ -301,6 +301,7 @@ static const TypeInfo vmport_info = {
.parent = TYPE_ISA_DEVICE,
.instance_size = sizeof(VMPortState),
.class_init = vmport_class_initfn,
+ .secure = true,
};
static void vmport_register_types(void)
--
2.55.0
^ permalink raw reply related [flat|nested] 30+ messages in thread