From: "Daniel P. Berrangé" <berrange@redhat.com>
To: qemu-devel@nongnu.org
Cc: "Thomas Huth" <thuth@redhat.com>,
"Stefan Hajnoczi" <stefanha@redhat.com>,
"Philippe Mathieu-Daudé" <philmd@linaro.org>,
"Peter Maydell" <peter.maydell@linaro.org>,
"Markus Armbruster" <armbru@redhat.com>,
"Paolo Bonzini" <pbonzini@redhat.com>,
"Michael S. Tsirkin" <mst@redhat.com>,
"Daniel P. Berrangé" <berrange@redhat.com>
Subject: [PATCH v2 30/32] hw: define most common PCI types as secure
Date: Fri, 26 Sep 2025 15:01:41 +0100 [thread overview]
Message-ID: <20250926140144.1998694-31-berrange@redhat.com> (raw)
In-Reply-To: <20250926140144.1998694-1-berrange@redhat.com>
Everything except for the simba pci-bridge is relevant to use in
a virtualization use case, so must be considered secure.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
hw/pci-bridge/cxl_downstream.c | 1 +
hw/pci-bridge/cxl_root_port.c | 1 +
hw/pci-bridge/cxl_upstream.c | 1 +
hw/pci-bridge/gen_pcie_root_port.c | 1 +
hw/pci-bridge/i82801b11.c | 1 +
hw/pci-bridge/ioh3420.c | 1 +
hw/pci-bridge/pci_bridge_dev.c | 2 ++
hw/pci-bridge/pci_expander_bridge.c | 8 ++++++++
hw/pci-bridge/pcie_pci_bridge.c | 1 +
hw/pci-bridge/pcie_root_port.c | 1 +
hw/pci-bridge/simba.c | 1 +
hw/pci-bridge/xio3130_downstream.c | 1 +
hw/pci-bridge/xio3130_upstream.c | 1 +
hw/pci/pci.c | 7 +++++++
hw/pci/pci_bridge.c | 1 +
hw/pci/pci_host.c | 1 +
hw/pci/pcie_host.c | 1 +
hw/pci/pcie_port.c | 1 +
18 files changed, 32 insertions(+)
diff --git a/hw/pci-bridge/cxl_downstream.c b/hw/pci-bridge/cxl_downstream.c
index 1065245a8b..23f6ece002 100644
--- a/hw/pci-bridge/cxl_downstream.c
+++ b/hw/pci-bridge/cxl_downstream.c
@@ -241,6 +241,7 @@ static const TypeInfo cxl_dsp_info = {
.instance_size = sizeof(CXLDownstreamPort),
.parent = TYPE_PCIE_SLOT,
.class_init = cxl_dsp_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ INTERFACE_CXL_DEVICE },
diff --git a/hw/pci-bridge/cxl_root_port.c b/hw/pci-bridge/cxl_root_port.c
index e6a4035d26..83b34330bc 100644
--- a/hw/pci-bridge/cxl_root_port.c
+++ b/hw/pci-bridge/cxl_root_port.c
@@ -294,6 +294,7 @@ static const TypeInfo cxl_root_port_info = {
.parent = TYPE_PCIE_ROOT_PORT,
.instance_size = sizeof(CXLRootPort),
.class_init = cxl_root_port_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CXL_DEVICE },
{ }
diff --git a/hw/pci-bridge/cxl_upstream.c b/hw/pci-bridge/cxl_upstream.c
index 208e0c6172..eba6fe2482 100644
--- a/hw/pci-bridge/cxl_upstream.c
+++ b/hw/pci-bridge/cxl_upstream.c
@@ -394,6 +394,7 @@ static const TypeInfo cxl_usp_info = {
.parent = TYPE_PCIE_PORT,
.instance_size = sizeof(CXLUpstreamPort),
.class_init = cxl_upstream_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ INTERFACE_CXL_DEVICE },
diff --git a/hw/pci-bridge/gen_pcie_root_port.c b/hw/pci-bridge/gen_pcie_root_port.c
index d9078e783b..d9e1ce8d90 100644
--- a/hw/pci-bridge/gen_pcie_root_port.c
+++ b/hw/pci-bridge/gen_pcie_root_port.c
@@ -173,6 +173,7 @@ static const TypeInfo gen_rp_dev_info = {
.parent = TYPE_PCIE_ROOT_PORT,
.instance_size = sizeof(GenPCIERootPort),
.class_init = gen_rp_dev_class_init,
+ .secure = true,
};
static void gen_rp_register_types(void)
diff --git a/hw/pci-bridge/i82801b11.c b/hw/pci-bridge/i82801b11.c
index 1d73c14c1f..f702b20bcd 100644
--- a/hw/pci-bridge/i82801b11.c
+++ b/hw/pci-bridge/i82801b11.c
@@ -107,6 +107,7 @@ static const TypeInfo i82801b11_bridge_info = {
.parent = TYPE_PCI_BRIDGE,
.instance_size = sizeof(I82801b11Bridge),
.class_init = i82801b11_bridge_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/pci-bridge/ioh3420.c b/hw/pci-bridge/ioh3420.c
index bba640f495..2c4882c4cf 100644
--- a/hw/pci-bridge/ioh3420.c
+++ b/hw/pci-bridge/ioh3420.c
@@ -120,6 +120,7 @@ static const TypeInfo ioh3420_info = {
.name = "ioh3420",
.parent = TYPE_PCIE_ROOT_PORT,
.class_init = ioh3420_class_init,
+ .secure = true,
};
static void ioh3420_register_types(void)
diff --git a/hw/pci-bridge/pci_bridge_dev.c b/hw/pci-bridge/pci_bridge_dev.c
index b328e50ab3..04af66cc35 100644
--- a/hw/pci-bridge/pci_bridge_dev.c
+++ b/hw/pci-bridge/pci_bridge_dev.c
@@ -268,6 +268,7 @@ static const TypeInfo pci_bridge_dev_info = {
.instance_size = sizeof(PCIBridgeDev),
.class_init = pci_bridge_dev_class_init,
.instance_finalize = pci_bridge_dev_instance_finalize,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -294,6 +295,7 @@ static const TypeInfo pci_bridge_dev_seat_info = {
.parent = TYPE_PCI_BRIDGE_DEV,
.instance_size = sizeof(PCIBridgeDev),
.class_init = pci_bridge_dev_seat_class_init,
+ .secure = true,
};
static void pci_bridge_dev_register(void)
diff --git a/hw/pci-bridge/pci_expander_bridge.c b/hw/pci-bridge/pci_expander_bridge.c
index 1bcceddbc4..4a85f62be0 100644
--- a/hw/pci-bridge/pci_expander_bridge.c
+++ b/hw/pci-bridge/pci_expander_bridge.c
@@ -109,6 +109,7 @@ static const TypeInfo pxb_bus_info = {
.parent = TYPE_PCI_BUS,
.instance_size = sizeof(PXBBus),
.class_init = pxb_bus_class_init,
+ .secure = true,
};
static const TypeInfo pxb_pcie_bus_info = {
@@ -116,6 +117,7 @@ static const TypeInfo pxb_pcie_bus_info = {
.parent = TYPE_PCIE_BUS,
.instance_size = sizeof(PXBBus),
.class_init = pxb_bus_class_init,
+ .secure = true,
};
static const TypeInfo pxb_cxl_bus_info = {
@@ -123,6 +125,7 @@ static const TypeInfo pxb_cxl_bus_info = {
.parent = TYPE_CXL_BUS,
.instance_size = sizeof(PXBBus),
.class_init = pxb_bus_class_init,
+ .secure = true,
};
static const char *pxb_host_root_bus_path(PCIHostState *host_bridge,
@@ -185,6 +188,7 @@ static const TypeInfo pxb_host_info = {
.name = TYPE_PXB_HOST,
.parent = TYPE_PCI_HOST_BRIDGE,
.class_init = pxb_host_class_init,
+ .secure = true,
};
static void pxb_cxl_realize(DeviceState *dev, Error **errp)
@@ -244,6 +248,7 @@ static const TypeInfo cxl_host_info = {
.parent = TYPE_PCI_HOST_BRIDGE,
.instance_size = sizeof(CXLHost),
.class_init = pxb_cxl_host_class_init,
+ .secure = true,
};
/*
@@ -448,6 +453,7 @@ static const TypeInfo pxb_dev_info = {
.parent = TYPE_PCI_DEVICE,
.instance_size = sizeof(PXBDev),
.class_init = pxb_dev_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
@@ -485,6 +491,7 @@ static const TypeInfo pxb_pcie_dev_info = {
.parent = TYPE_PXB_DEV,
.instance_size = sizeof(PXBPCIEDev),
.class_init = pxb_pcie_dev_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
@@ -535,6 +542,7 @@ static const TypeInfo pxb_cxl_dev_info = {
.parent = TYPE_PXB_PCIE_DEV,
.instance_size = sizeof(PXBCXLDev),
.class_init = pxb_cxl_dev_class_init,
+ .secure = true,
.interfaces =
(const InterfaceInfo[]){
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
diff --git a/hw/pci-bridge/pcie_pci_bridge.c b/hw/pci-bridge/pcie_pci_bridge.c
index fce292a519..620eb12a64 100644
--- a/hw/pci-bridge/pcie_pci_bridge.c
+++ b/hw/pci-bridge/pcie_pci_bridge.c
@@ -162,6 +162,7 @@ static const TypeInfo pcie_pci_bridge_info = {
.parent = TYPE_PCI_BRIDGE,
.instance_size = sizeof(PCIEPCIBridge),
.class_init = pcie_pci_bridge_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_HOTPLUG_HANDLER },
{ INTERFACE_PCIE_DEVICE },
diff --git a/hw/pci-bridge/pcie_root_port.c b/hw/pci-bridge/pcie_root_port.c
index 22c2fdb71e..c87fb91e5c 100644
--- a/hw/pci-bridge/pcie_root_port.c
+++ b/hw/pci-bridge/pcie_root_port.c
@@ -187,6 +187,7 @@ static const TypeInfo rp_info = {
.instance_post_init = rp_instance_post_init,
.class_init = rp_class_init,
.abstract = true,
+ .secure = true,
.class_size = sizeof(PCIERootPortClass),
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
diff --git a/hw/pci-bridge/simba.c b/hw/pci-bridge/simba.c
index bbae594e11..3dbb5bd9c9 100644
--- a/hw/pci-bridge/simba.c
+++ b/hw/pci-bridge/simba.c
@@ -87,6 +87,7 @@ static const TypeInfo simba_pci_bridge_info = {
.parent = TYPE_PCI_BRIDGE,
.class_init = simba_pci_bridge_class_init,
.instance_size = sizeof(SimbaPCIBridge),
+ .secure = false,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_CONVENTIONAL_PCI_DEVICE },
{ },
diff --git a/hw/pci-bridge/xio3130_downstream.c b/hw/pci-bridge/xio3130_downstream.c
index dc7d1aa7d7..eb217dc7d9 100644
--- a/hw/pci-bridge/xio3130_downstream.c
+++ b/hw/pci-bridge/xio3130_downstream.c
@@ -175,6 +175,7 @@ static const TypeInfo xio3130_downstream_info = {
.name = TYPE_XIO3130_DOWNSTREAM,
.parent = TYPE_PCIE_SLOT,
.class_init = xio3130_downstream_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ }
diff --git a/hw/pci-bridge/xio3130_upstream.c b/hw/pci-bridge/xio3130_upstream.c
index 40057b749b..9d58105f8b 100644
--- a/hw/pci-bridge/xio3130_upstream.c
+++ b/hw/pci-bridge/xio3130_upstream.c
@@ -144,6 +144,7 @@ static const TypeInfo xio3130_upstream_info = {
.name = "x3130-upstream",
.parent = TYPE_PCIE_PORT,
.class_init = xio3130_upstream_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ INTERFACE_PCIE_DEVICE },
{ }
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index c3df9d6656..6ab03074b9 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -289,6 +289,7 @@ static const TypeInfo pci_bus_info = {
.instance_size = sizeof(PCIBus),
.class_size = sizeof(PCIBusClass),
.class_init = pci_bus_class_init,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_FW_CFG_DATA_GENERATOR_INTERFACE },
{ }
@@ -298,16 +299,19 @@ static const TypeInfo pci_bus_info = {
static const TypeInfo cxl_interface_info = {
.name = INTERFACE_CXL_DEVICE,
.parent = TYPE_INTERFACE,
+ .secure = true,
};
static const TypeInfo pcie_interface_info = {
.name = INTERFACE_PCIE_DEVICE,
.parent = TYPE_INTERFACE,
+ .secure = true,
};
static const TypeInfo conventional_pci_interface_info = {
.name = INTERFACE_CONVENTIONAL_PCI_DEVICE,
.parent = TYPE_INTERFACE,
+ .secure = true,
};
static void pcie_bus_class_init(ObjectClass *klass, const void *data)
@@ -321,12 +325,14 @@ static const TypeInfo pcie_bus_info = {
.name = TYPE_PCIE_BUS,
.parent = TYPE_PCI_BUS,
.class_init = pcie_bus_class_init,
+ .secure = true,
};
static const TypeInfo cxl_bus_info = {
.name = TYPE_CXL_BUS,
.parent = TYPE_PCIE_BUS,
.class_init = pcie_bus_class_init,
+ .secure = true,
};
static void pci_update_mappings(PCIDevice *d);
@@ -3336,6 +3342,7 @@ static const TypeInfo pci_device_type_info = {
.parent = TYPE_DEVICE,
.instance_size = sizeof(PCIDevice),
.abstract = true,
+ .secure = true,
.class_size = sizeof(PCIDeviceClass),
.class_init = pci_device_class_init,
.class_base_init = pci_device_class_base_init,
diff --git a/hw/pci/pci_bridge.c b/hw/pci/pci_bridge.c
index 76255c4cd8..703160a338 100644
--- a/hw/pci/pci_bridge.c
+++ b/hw/pci/pci_bridge.c
@@ -497,6 +497,7 @@ static const TypeInfo pci_bridge_type_info = {
.instance_size = sizeof(PCIBridge),
.class_init = pci_bridge_class_init,
.abstract = true,
+ .secure = true,
.interfaces = (const InterfaceInfo[]) {
{ TYPE_ACPI_DEV_AML_IF },
{ },
diff --git a/hw/pci/pci_host.c b/hw/pci/pci_host.c
index 7179d99178..b3bbba3799 100644
--- a/hw/pci/pci_host.c
+++ b/hw/pci/pci_host.c
@@ -251,6 +251,7 @@ static const TypeInfo pci_host_type_info = {
.name = TYPE_PCI_HOST_BRIDGE,
.parent = TYPE_SYS_BUS_DEVICE,
.abstract = true,
+ .secure = true,
.class_size = sizeof(PCIHostBridgeClass),
.instance_size = sizeof(PCIHostState),
.class_init = pci_host_class_init,
diff --git a/hw/pci/pcie_host.c b/hw/pci/pcie_host.c
index 3717e1a086..3cf0769d2a 100644
--- a/hw/pci/pcie_host.c
+++ b/hw/pci/pcie_host.c
@@ -124,6 +124,7 @@ static const TypeInfo pcie_host_type_info = {
.name = TYPE_PCIE_HOST_BRIDGE,
.parent = TYPE_PCI_HOST_BRIDGE,
.abstract = true,
+ .secure = true,
.instance_size = sizeof(PCIExpressHost),
.instance_init = pcie_host_init,
};
diff --git a/hw/pci/pcie_port.c b/hw/pci/pcie_port.c
index f3841a2656..abc1dbd470 100644
--- a/hw/pci/pcie_port.c
+++ b/hw/pci/pcie_port.c
@@ -200,6 +200,7 @@ static const TypeInfo pcie_port_type_info = {
.parent = TYPE_PCI_BRIDGE,
.instance_size = sizeof(PCIEPort),
.abstract = true,
+ .secure = true,
.class_init = pcie_port_class_init,
};
--
2.50.1
next prev parent reply other threads:[~2025-09-26 14:15 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-26 14:01 [PATCH v2 00/32] Encode object type security status in code Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 01/32] qom: replace 'abstract' with 'flags' Daniel P. Berrangé
2025-10-23 10:26 ` Markus Armbruster
2025-10-24 13:39 ` Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 02/32] qom: add tracking of security state of object types Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 03/32] qapi: add 'insecure-types' option for -compat argument Daniel P. Berrangé
2025-10-23 10:38 ` Markus Armbruster
2025-09-26 14:01 ` [PATCH v2 04/32] system: check security for accelerator types Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 05/32] system: report acclerator security status in help output Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 06/32] system: check security for machine types Daniel P. Berrangé
2025-10-23 11:51 ` Markus Armbruster
2025-09-26 14:01 ` [PATCH v2 07/32] system: report machine security status in help output Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 08/32] system: check security of device types Daniel P. Berrangé
2025-10-23 11:54 ` Markus Armbruster
2025-10-24 13:28 ` Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 09/32] system: report device security status in help output Daniel P. Berrangé
2025-10-23 11:57 ` Markus Armbruster
2025-09-26 14:01 ` [PATCH v2 10/32] hw/core: report security status in query-machines Daniel P. Berrangé
2025-10-23 12:17 ` Markus Armbruster
2025-10-24 13:32 ` Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 11/32] qom: report & filter on security status in qom-list-types Daniel P. Berrangé
2025-10-23 10:58 ` Markus Armbruster
2025-10-24 13:38 ` Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 12/32] docs: expand security docs with info about security status Daniel P. Berrangé
2025-10-23 12:22 ` Markus Armbruster
2025-10-24 13:42 ` Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 13/32] machine: add helpers for declaring secure/insecure machine types Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 14/32] hw: mark x86, s390, ppc, arm versioned machine types as secure Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 15/32] hw: declare Xen & microvm machines as secure, isapc as insecure Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 16/32] hw/core: declare 'none' machine to be insecure Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 17/32] accel: mark kvm, xen & hvf as secure; tcg & qtest as insecure Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 18/32] hw: mark all virtio PCI devices as secure Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 19/32] hw: mark all virtio CCW " Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 20/32] hw: mark all vhost devices a secure Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 21/32] hw: mark all remaining virtio object types as secure Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 22/32] hw/vfio: mark all VFIO object classes " Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 23/32] hw/xen: mark all Xen related object types as being secure Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 24/32] hw/net: mark most non-virtio NICs as insecure Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 25/32] hw/usb: mark most USB devices/hosts as secure Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 26/32] hw/watchdog: mark some watchdog devices " Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 27/32] hw/scsi: mark most SCSI controllers as insecure / " Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 28/32] hw/ide: mark ICH9 and ide-hd/ide-cd " Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 29/32] hw: mark test/demo devices as insecure Daniel P. Berrangé
2025-09-26 14:01 ` Daniel P. Berrangé [this message]
2025-09-26 14:01 ` [PATCH v2 31/32] hw/pci-host: define some PCI hosts as secure Daniel P. Berrangé
2025-09-26 14:01 ` [PATCH v2 32/32] hw/display: mark most display adapters as insecure Daniel P. Berrangé
2025-10-23 7:23 ` [PATCH v2 00/32] Encode object type security status in code Markus Armbruster
2025-10-23 9:00 ` Daniel P. Berrangé
2025-10-23 12:38 ` Markus Armbruster
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250926140144.1998694-31-berrange@redhat.com \
--to=berrange@redhat.com \
--cc=armbru@redhat.com \
--cc=mst@redhat.com \
--cc=pbonzini@redhat.com \
--cc=peter.maydell@linaro.org \
--cc=philmd@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=stefanha@redhat.com \
--cc=thuth@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).