Re: [PATCH 00/28] Mark user creatable devices for secure for virt use case

["Daniel P. Berrangé" <berrange@redhat.com>]

Ping, any maintainers have thoughts on this proposal ?

On Fri, Sep 11, 2026 at 03:35:59PM +0100, Daniel P. Berrangé wrote:
> This (largish) series undertakes the task of marking devices
> secure, if they are intended to be used a virtualization
> use case.
> 
> NB, the maintainer CC list was way too huge to include every
> individual, so I've trimmed to just the mailing list CCs.
> 
> The approach taken was iterative as follows
> 
>  * Machines listed in
> 
>     https://www.qemu.org/docs/master/system/security.html#virtualization-use-case
> 
>  * All virtio/vhost/vfio/xen related devices
> 
>  * Most PCI related devices/controllers/bridges
> 
> I then used the RHEL builds of QEMU as an approximation for
> what should be considered "virtualization use case", since
> they cut out a huge pile of devices from the build. IOW,
> more or less everything that RHEL builds for x86_64, ppc64,
> aarch64, s390x gets included. Notably since RHEL does not
> yet ship riscv or loongarch, I've possibly missed some
> devices that ought to be in scope.
> 
> Devices are marked secure *regardless* of their maintainer
> status, if they are relevant to virt. Notably all the USB
> stuff is included despite USB being orphaned. An exception
> is CXL which is arguably relevant to virt, but maintainers
> agreed it is too immature to include so far.
> 
> IOW, the "secure" flag as set in this series mostly avoids
> saying anything about the support status of the object types.
> 
> Over the long term, IMHO, the set of devices we declare as
> providing a security boundary needs to be stable. We should
> not declare a device out of scope for the virt use case simply
> because a maintainer steps aside. The device doesn't become
> instantly less secure. It does mean bug fixes may not be
> timely enough, and rely on the goodwill of other contributors
> or maintainers to step up and fix.
> 
> Or to put it another way. "secure = true" does not guarantee
> that the device is secure, but it states our intent that we
> *want* it to be secure, as opposed to "secure = false" which
> indicates we just don't care either way.
> 
> The intersection of (secure, orphaned) highlights to QEMU
> contributors or corporate sponsors, where they might step
> up their effort / investment.
> 
> Finally this is just user creatable devices. Use of these
> devices implies use of many more non-user creatable devices.
> 
> I don't have a good way to enumerate those yet, and while
> the end user doesn't care at runtime, as maintainers we
> want to be clear if all devices are in scope for CVE
> handling or not.
> 
> Based-on: <20260910103628.2326622-1-berrange@redhat.com>
> 
> Daniel P. Berrangé (28):
>   hw: mark secure machines for x86, s390, ppc, arm, loonarch, riscv
>   accel: mark kvm and xen accelerators as secure
>   hw: mark all virtio PCI devices as secure
>   hw: mark all virtio CCW devices as secure
>   hw: mark all vhost devices a secure
>   hw: mark all remaining virtio object types as secure
>   hw/vfio: mark all VFIO object classes as secure
>   hw/xen: mark all Xen related object types as being secure
>   hw/net: mark e1000, e1000e, IGB, rtl8139 & sPAPR VLAN as secure
>   hw/usb: mark commonly used USB devices/hosts as secure
>   hw/watchdog: mark some watchdog devices as secure
>   hw/scsi: mark spapr and vmware SCSI controllers as secure
>   hw/scsi: mark SCSI disk endpoint devices as secure
>   hw/ide: mark ICH9 and ide-hd/ide-cd as secure
>   hw: define most common PCI types as secure
>   hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts as secure
>   hw/display: mark bochs, cirrus, qxl, VGA, ramfb as secure
>   hw/tpm: mark all TPM implementations as secure
>   hw/misc: mark pvpanic, vmcoreinfo as secure
>   hw/audio: mark Intel HDA devices & codecs as secure
>   hw/char: mark common serial / console devicess a secure
>   hw/mem: mark nvdimm, pc-dimm & spapr-nvdimm devices as secure
>   hw/uefi: mark the EFI vars service as secure
>   hw/acpi: mark erst, vmclock and vmgenid devices as secure
>   hw: mark KVM clock and RTC devices as secure
>   hw: device AMD, Intel and ARM IOMMUs as secure
>   hw/input: mark PS/2 and PC Keyboard devices as secure
>   hw/i386: mark vmmouse / vmport as secure
> 
>  accel/accel-common.c                 | 2 ++
>  accel/accel-system.c                 | 1 +
>  accel/kvm/kvm-accel-ops.c            | 1 +
>  accel/kvm/kvm-all.c                  | 1 +
>  accel/xen/xen-all.c                  | 2 ++
>  hw/9pfs/virtio-9p-device.c           | 1 +
>  hw/acpi/erst.c                       | 1 +
>  hw/acpi/vmclock.c                    | 1 +
>  hw/acpi/vmgenid.c                    | 1 +
>  hw/arm/smmu-common.c                 | 1 +
>  hw/arm/smmuv3.c                      | 2 ++
>  hw/arm/virt.c                        | 1 +
>  hw/arm/xen-pvh.c                     | 1 +
>  hw/audio/hda-codec.c                 | 4 ++++
>  hw/audio/intel-hda.c                 | 5 +++++
>  hw/audio/virtio-snd.c                | 1 +
>  hw/block/vhost-user-blk.c            | 1 +
>  hw/block/virtio-blk.c                | 1 +
>  hw/block/xen-block.c                 | 3 +++
>  hw/char/debugcon.c                   | 1 +
>  hw/char/sclpconsole-lm.c             | 1 +
>  hw/char/sclpconsole.c                | 1 +
>  hw/char/serial-isa.c                 | 1 +
>  hw/char/serial-pci.c                 | 1 +
>  hw/char/serial.c                     | 1 +
>  hw/char/spapr_vty.c                  | 1 +
>  hw/char/virtio-console.c             | 2 ++
>  hw/char/virtio-serial-bus.c          | 3 +++
>  hw/char/xen_console.c                | 1 +
>  hw/display/bochs-display.c           | 1 +
>  hw/display/cirrus_vga.c              | 1 +
>  hw/display/qxl.c                     | 3 +++
>  hw/display/ramfb-standalone.c        | 1 +
>  hw/display/vga-mmio.c                | 1 +
>  hw/display/vga-pci.c                 | 3 +++
>  hw/display/vhost-user-gpu.c          | 1 +
>  hw/display/virtio-gpu-base.c         | 3 ++-
>  hw/display/virtio-gpu-gl.c           | 1 +
>  hw/display/virtio-gpu-pci-rutabaga.c | 1 +
>  hw/display/virtio-gpu-pci.c          | 3 ++-
>  hw/display/virtio-gpu-rutabaga.c     | 1 +
>  hw/display/virtio-gpu.c              | 1 +
>  hw/i386/amd_iommu.c                  | 4 +++-
>  hw/i386/intel_iommu.c                | 1 +
>  hw/i386/kvm/clock.c                  | 1 +
>  hw/i386/microvm.c                    | 1 +
>  hw/i386/pc_piix.c                    | 4 ++--
>  hw/i386/vmmouse.c                    | 1 +
>  hw/i386/vmport.c                     | 1 +
>  hw/i386/xen/xen-pvh.c                | 1 +
>  hw/i386/xen/xen_platform.c           | 1 +
>  hw/i386/xen/xen_pvdevice.c           | 1 +
>  hw/ide/ich.c                         | 1 +
>  hw/ide/ide-dev.c                     | 3 +++
>  hw/ide/piix.c                        | 2 ++
>  hw/input/pckbd.c                     | 3 ++-
>  hw/input/ps2.c                       | 9 ++++++---
>  hw/input/virtio-input-hid.c          | 5 +++++
>  hw/input/virtio-input-host.c         | 1 +
>  hw/input/virtio-input.c              | 1 +
>  hw/loongarch/virt.c                  | 2 ++
>  hw/mem/nvdimm.c                      | 1 +
>  hw/mem/pc-dimm.c                     | 1 +
>  hw/misc/pvpanic-isa.c                | 1 +
>  hw/misc/pvpanic-mmio.c               | 1 +
>  hw/misc/pvpanic-pci.c                | 1 +
>  hw/misc/vmcoreinfo.c                 | 1 +
>  hw/net/e1000.c                       | 1 +
>  hw/net/e1000e.c                      | 1 +
>  hw/net/igb.c                         | 1 +
>  hw/net/rtl8139.c                     | 1 +
>  hw/net/spapr_llan.c                  | 1 +
>  hw/net/virtio-net.c                  | 1 +
>  hw/net/xen_nic.c                     | 1 +
>  hw/pci-bridge/gen_pcie_root_port.c   | 1 +
>  hw/pci-bridge/i82801b11.c            | 1 +
>  hw/pci-bridge/ioh3420.c              | 1 +
>  hw/pci-bridge/pci_bridge_dev.c       | 2 ++
>  hw/pci-bridge/pci_expander_bridge.c  | 8 ++++++++
>  hw/pci-bridge/pcie_pci_bridge.c      | 1 +
>  hw/pci-bridge/pcie_root_port.c       | 1 +
>  hw/pci-bridge/xio3130_downstream.c   | 1 +
>  hw/pci-bridge/xio3130_upstream.c     | 1 +
>  hw/pci-host/gpex.c                   | 2 ++
>  hw/pci-host/i440fx.c                 | 2 ++
>  hw/pci-host/pnv_phb.c                | 2 ++
>  hw/pci-host/pnv_phb3.c               | 3 +++
>  hw/pci-host/pnv_phb3_msi.c           | 1 +
>  hw/pci-host/pnv_phb3_pbcq.c          | 1 +
>  hw/pci-host/pnv_phb4.c               | 4 +++-
>  hw/pci-host/pnv_phb4_pec.c           | 1 +
>  hw/pci-host/q35.c                    | 2 ++
>  hw/pci-host/remote.c                 | 1 +
>  hw/pci-host/xen_igd_pt.c             | 1 +
>  hw/pci/pci.c                         | 7 +++++++
>  hw/pci/pci_bridge.c                  | 1 +
>  hw/pci/pci_host.c                    | 1 +
>  hw/pci/pcie_host.c                   | 1 +
>  hw/pci/pcie_port.c                   | 1 +
>  hw/ppc/spapr.c                       | 1 +
>  hw/ppc/spapr_nvdimm.c                | 1 +
>  hw/ppc/spapr_pci.c                   | 1 +
>  hw/ppc/spapr_tpm_proxy.c             | 1 +
>  hw/riscv/virt.c                      | 1 +
>  hw/rtc/mc146818rtc.c                 | 1 +
>  hw/s390x/s390-pci-bus.c              | 4 ++++
>  hw/s390x/s390-virtio-ccw.c           | 1 +
>  hw/s390x/vhost-scsi-ccw.c            | 1 +
>  hw/s390x/vhost-user-fs-ccw.c         | 1 +
>  hw/s390x/vhost-vsock-ccw.c           | 1 +
>  hw/s390x/virtio-ccw-9p.c             | 1 +
>  hw/s390x/virtio-ccw-balloon.c        | 1 +
>  hw/s390x/virtio-ccw-blk.c            | 1 +
>  hw/s390x/virtio-ccw-crypto.c         | 1 +
>  hw/s390x/virtio-ccw-gpu.c            | 1 +
>  hw/s390x/virtio-ccw-input.c          | 5 +++++
>  hw/s390x/virtio-ccw-md.c             | 1 +
>  hw/s390x/virtio-ccw-mem.c            | 1 +
>  hw/s390x/virtio-ccw-net.c            | 1 +
>  hw/s390x/virtio-ccw-rng.c            | 1 +
>  hw/s390x/virtio-ccw-scsi.c           | 1 +
>  hw/s390x/virtio-ccw-serial.c         | 1 +
>  hw/s390x/virtio-ccw.c                | 1 +
>  hw/scsi/scsi-disk.c                  | 4 ++++
>  hw/scsi/scsi-generic.c               | 1 +
>  hw/scsi/spapr_vscsi.c                | 1 +
>  hw/scsi/vhost-scsi-common.c          | 1 +
>  hw/scsi/vhost-scsi.c                 | 1 +
>  hw/scsi/vhost-user-scsi.c            | 1 +
>  hw/scsi/virtio-scsi.c                | 2 ++
>  hw/scsi/vmw_pvscsi.c                 | 1 +
>  hw/tpm/tpm_crb.c                     | 1 +
>  hw/tpm/tpm_spapr.c                   | 1 +
>  hw/tpm/tpm_tis_i2c.c                 | 1 +
>  hw/tpm/tpm_tis_isa.c                 | 1 +
>  hw/tpm/tpm_tis_sysbus.c              | 1 +
>  hw/uefi/var-service-sysbus.c         | 2 ++
>  hw/usb/ccid-card-emulated.c          | 1 +
>  hw/usb/ccid-card-passthru.c          | 1 +
>  hw/usb/dev-hid.c                     | 4 ++++
>  hw/usb/dev-hub.c                     | 1 +
>  hw/usb/dev-smartcard-reader.c        | 3 +++
>  hw/usb/dev-storage-bot.c             | 1 +
>  hw/usb/dev-storage-classic.c         | 1 +
>  hw/usb/dev-storage.c                 | 1 +
>  hw/usb/hcd-ehci-pci.c                | 2 ++
>  hw/usb/hcd-ehci-sysbus.c             | 8 ++++++++
>  hw/usb/hcd-ohci-pci.c                | 1 +
>  hw/usb/hcd-ohci-sysbus.c             | 1 +
>  hw/usb/hcd-uhci.c                    | 2 ++
>  hw/usb/hcd-xhci-nec.c                | 1 +
>  hw/usb/hcd-xhci-pci.c                | 2 ++
>  hw/usb/hcd-xhci-sysbus.c             | 3 ++-
>  hw/usb/hcd-xhci.c                    | 1 +
>  hw/usb/host-libusb.c                 | 1 +
>  hw/usb/redirect.c                    | 1 +
>  hw/vfio-user/pci.c                   | 1 +
>  hw/vfio/ap.c                         | 1 +
>  hw/vfio/ccw.c                        | 1 +
>  hw/vfio/container.c                  | 1 +
>  hw/vfio/igd.c                        | 1 +
>  hw/vfio/iommufd.c                    | 2 ++
>  hw/vfio/pci.c                        | 3 +++
>  hw/vfio/spapr.c                      | 1 +
>  hw/virtio/vdpa-dev.c                 | 1 +
>  hw/virtio/vhost-user-base.c          | 3 ++-
>  hw/virtio/vhost-user-fs.c            | 1 +
>  hw/virtio/vhost-user-gpio.c          | 1 +
>  hw/virtio/vhost-user-i2c.c           | 1 +
>  hw/virtio/vhost-user-input.c         | 1 +
>  hw/virtio/vhost-user-rng.c           | 1 +
>  hw/virtio/vhost-user-rtc.c           | 1 +
>  hw/virtio/vhost-user-scmi.c          | 1 +
>  hw/virtio/vhost-user-snd.c           | 1 +
>  hw/virtio/vhost-user-spi.c           | 1 +
>  hw/virtio/vhost-user-test-device.c   | 1 +
>  hw/virtio/vhost-user-vsock.c         | 1 +
>  hw/virtio/vhost-vsock-common.c       | 1 +
>  hw/virtio/vhost-vsock.c              | 1 +
>  hw/virtio/virtio-balloon.c           | 1 +
>  hw/virtio/virtio-bus.c               | 1 +
>  hw/virtio/virtio-crypto.c            | 1 +
>  hw/virtio/virtio-input-pci.c         | 2 ++
>  hw/virtio/virtio-iommu.c             | 2 ++
>  hw/virtio/virtio-md-pci.c            | 1 +
>  hw/virtio/virtio-mem.c               | 1 +
>  hw/virtio/virtio-mmio.c              | 2 ++
>  hw/virtio/virtio-nsm.c               | 1 +
>  hw/virtio/virtio-pci.c               | 3 +++
>  hw/virtio/virtio-pmem.c              | 1 +
>  hw/virtio/virtio-rng.c               | 1 +
>  hw/virtio/virtio-rtc.c               | 1 +
>  hw/watchdog/sbsa_gwdt.c              | 1 +
>  hw/watchdog/spapr_watchdog.c         | 1 +
>  hw/watchdog/wdt_diag288.c            | 1 +
>  hw/watchdog/wdt_i6300esb.c           | 1 +
>  hw/watchdog/wdt_ib700.c              | 1 +
>  hw/xen/xen-bus.c                     | 3 +++
>  hw/xen/xen-legacy-backend.c          | 3 +++
>  hw/xen/xen-pvh-common.c              | 1 +
>  hw/xen/xen_pt.c                      | 1 +
>  hw/xenpv/xen_machine_pv.c            | 2 +-
>  include/hw/i386/pc.h                 | 1 +
>  203 files changed, 304 insertions(+), 13 deletions(-)
> 
> -- 
> 2.55.0
> 

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|