Date: Fri, 6 Nov 2026 12:21:06 +0000
From: Daniel =?utf-8?B?UC4gQmVycmFuZ8Op?= <berrange@redhat.com>
To: Thomas Huth <thuth@redhat.com>
Cc: qemu-devel@nongnu.org, qemu-arm@nongnu.org,
 Peter Maydell <peter.maydell@linaro.org>,
 Alex =?utf-8?Q?Benn=C3=A9e?= <alex.bennee@linaro.org>,
 Paolo Bonzini <pbonzini@redhat.com>,
 =?utf-8?Q?Marc-Andr=C3=A9?= Lureau <marcandre.lureau@redhat.com>,
 qemu-ppc@nongnu.org, qemu-block@nongnu.org, qemu-riscv@nongnu.org,
 qemu-s390x@nongnu.org
Subject: Re: [PATCH v2 08/28] hw/usb: mark commonly used USB devices/hosts as
 secure
Message-ID: <au3GMul0v2BSPP5M@redhat.com>
References: <20261029131241.2275706-1-berrange@redhat.com>
 <20261029131241.2275706-9-berrange@redhat.com>
 <31de7814-4be9-4224-9659-854cdffe409f@redhat.com>
MIME-Version: 1.0
In-Reply-To: <31de7814-4be9-4224-9659-854cdffe409f@redhat.com>
User-Agent: Mutt/2.4.3 (2026-10-09)
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Received-SPF: pass client-ip=170.10.129.124; envelope-from=berrange@redhat.com;
 helo=us-smtp-delivery-124.mimecast.com
X-Spam_score_int: 5
X-Spam_score: 0.5
X-Spam_bar: /
X-Spam_report: (0.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001,
 DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,
 RCVD_IN_DNSWL_LOW=-0.7, RCVD_IN_MSPIKE_H5=0.001, RCVD_IN_MSPIKE_WL=0.001,
 RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001,
 SPF_PASS=-0.001 autolearn=no autolearn_force=no
X-Spam_action: no action
X-BeenThere: qemu-arm@nongnu.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: <qemu-arm.nongnu.org>
List-Archive: <https://lists.nongnu.org/archive/html/qemu-arm>
List-Post: <mailto:qemu-arm@nongnu.org>
List-Help: <mailto:qemu-arm-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-arm>,
 <mailto:qemu-arm-request@nongnu.org?subject=subscribe>
Reply-To: Daniel =?utf-8?B?UC4gQmVycmFuZ8Op?= <berrange@redhat.com>
Sender: qemu-arm-bounces+qemu-arm=archiver.kernel.org@nongnu.org
X-Spam-Status: No, score=-17.3 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH,
	DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_PASS,
	SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no
	version=4.0.1
X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on
	aws-us-west-2-korg-listserv-alma10-1

On Fri, Nov 06, 2026 at 01:05:05PM +0100, Thomas Huth wrote:
> On 29/10/2026 14.12, Daniel P. Berrangé wrote:
> > Modern virtualized guests are expected to be deployed with the
> > XHCI controller which supports all of USB 1, 2 and 3, so should
> > be declared secure.
> > 
> > The "NEC" XHCI variant is slightly non-standard, but since it is
> > a trivial sub-class of the generic XHCI, there's no reason to
> > exclude it.
> > 
> > The set of devices that are expected to be used is HID (mouse,
> > tablet, keyboard), host passthrough, CCID (smartcard), hub,
> > storage and the redirect tunnelling.
> > 
> > Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> > ---
> >   hw/usb/ccid-card-emulated.c   | 1 +
> >   hw/usb/ccid-card-passthru.c   | 1 +
> >   hw/usb/dev-hid.c              | 3 +++
> >   hw/usb/dev-hub.c              | 1 +
> >   hw/usb/dev-smartcard-reader.c | 2 ++
> >   hw/usb/dev-storage-bot.c      | 1 +
> >   hw/usb/dev-storage-classic.c  | 1 +
> >   hw/usb/hcd-xhci-nec.c         | 1 +
> >   hw/usb/hcd-xhci-pci.c         | 1 +
> >   hw/usb/hcd-xhci-sysbus.c      | 3 ++-
> >   hw/usb/hcd-xhci.c             | 1 +
> >   hw/usb/host-libusb.c          | 1 +
> >   hw/usb/redirect.c             | 1 +
> >   13 files changed, 17 insertions(+), 1 deletion(-)
> ...
> > diff --git a/hw/usb/dev-storage-bot.c b/hw/usb/dev-storage-bot.c
> > index a7f8d80c17a..b156f1c5c9a 100644
> > --- a/hw/usb/dev-storage-bot.c
> > +++ b/hw/usb/dev-storage-bot.c
> > @@ -52,6 +52,7 @@ static const TypeInfo bot_info = {
> >       .name          = "usb-bot",
> >       .parent        = TYPE_USB_STORAGE,
> >       .class_init    = usb_msd_class_bot_initfn,
> > +    .secure        = true,
> >   };
> >   static void register_types(void)
> > diff --git a/hw/usb/dev-storage-classic.c b/hw/usb/dev-storage-classic.c
> > index 977151c4a08..7e0699cb518 100644
> > --- a/hw/usb/dev-storage-classic.c
> > +++ b/hw/usb/dev-storage-classic.c
> > @@ -133,6 +133,7 @@ static const TypeInfo msd_info = {
> >       .parent        = TYPE_USB_STORAGE,
> >       .class_init    = usb_msd_class_storage_initfn,
> >       .instance_init = usb_msd_instance_init,
> > +    .secure        = true,
> >   };
> Can we exclude usb-bot and usb-storage from the secure list? I've never seen
> them really being used for real virtualization installations, and I think
> they are not that well tested?

We've shipped them as part of RHEL essentially forever so from a
downstream POV we're on the hook to support them.

I would see them as a way to provide adhoc removable storage to a
VM which doesn't require any special drivers, since everything
supports USB storage for 20+ years. We don't have a SCSI controller
beyond virtio-scsi that's declared secure, and SCSI isn't
accessible to unprivileged users, so USB is useful for desktop
virtualization use cases IMHO.

> 
> With those two hunks being removed:
> Reviewed-by: Thomas Huth <thuth@redhat.com>
> 

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|