Mark user creatable devices for secure for virt use case
v2 cover Mark user creatable devices for secure for virt use case
This (largish) series undertakes the task of marking devices secure, if they are intended to be used a virtualization use case.
NB, this is only tagging leaf types in the QOM tree. This implicitly means their parents are also secure, as well as any child devices they are hardcoded to create internally, but those are not (yet) tagged. Tagging parents and implicit created devices is future work.
NB, the maintainer CC list was way too huge to include every individual, so I've trimmed to just the mailing list CCs.
The marking of machine types / accelerators was split off to
https://lists.gnu.org/archive/html/qemu-devel/2026-10/msg07775.html
I used the docs/system/security.txt along with the RHEL builds of QEMU as an approximation for what should be considered "virtualization use case". The latter cuts out a huge pile of devices from the build. IOW, more or less everything that RHEL builds for x86_64, ppc64, aarch64, s390x gets included. Notably since RHEL does not yet ship riscv or loongarch, I've possibly missed some devices that ought to be in scope.
Devices are marked secure *regardless* of their maintainer status, if they are relevant to virt. Notably all the USB stuff is included despite USB being orphaned. An exception is CXL which is arguably relevant to virt, but maintainers agreed it is too immature to include so far, and we've been explicitly excluding from CVE triage since the AI flood.
IOW, the "secure" flag as set in this series mostly avoids saying anything about the support status of the object types.
Over the long term, IMHO, the set of devices we declare as providing a security boundary needs to be stable. We should not declare a device out of scope for the virt use case simply because a maintainer steps aside. The device doesn't become instantly less secure. It does mean bug fixes may not be timely enough, and rely on the goodwill of other contributors or maintainers to step up and fix.
Or to put it another way. "secure = true" does not guarantee that the device is secure, but it states our intent that we *want* it to be secure, as opposed to "secure = false" / unset which indicates we just don't care either way.
The intersection of (secure, orphaned) highlights to QEMU contributors or corporate sponsors, where they might step up their effort / investment.
Changed in v2:
- Split off setting of UHCI, OCHI, ECHI to separate patch since it is debatable whether to include these
- Split off Cirrus and QXL to seaprate patch since it is debatable whether to include these
- Split off accelerators/machines to a seplarate (already postd) series.
- Dropped annotations accidentally included on some parent (abstract) types. This will be dealt with in the next release cycle
- Really dropped annotations for CXL
- Dropped vmware SCSI device
Daniel P. Berrangé (28):
hw: mark all virtio PCI devices as secure
hw: mark all virtio CCW devices as secure
hw: mark all vhost devices a secure
hw: mark all remaining virtio object types as secure hw/vfio: mark all VFIO object classes as secure
hw/xen: mark all Xen related object types as being secure hw/net: mark e1000, e1000e, IGB, rtl8139 & sPAPR VLAN as secure hw/usb: mark commonly used USB devices/hosts as secure hw/watchdog: mark some watchdog devices as secure hw/scsi: mark spapr SCSI controller as secure
hw/scsi: mark SCSI disk endpoint devices as secure hw/ide: mark ICH9 and ide-hd/ide-cd as secure
hw: define most common PCI types as secure
hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts as secure hw/display: mark bochs, ramfb and VGA as secure
hw/tpm: mark all TPM implementations as secure
hw/misc: mark pvpanic, vmcoreinfo as secure
hw/audio: mark Intel HDA devices & codecs as secure hw/char: mark common serial / console devices as secure hw/mem: mark nvdimm, pc-dimm & spapr-nvdimm devices as secure hw/uefi: mark the EFI vars service as secure
hw/acpi: mark erst, vmclock and vmgenid devices as secure
hw: mark KVM clock and RTC devices as secure
hw: device AMD, Intel and ARM IOMMUs as secure
hw/input: mark PS/2 and PC Keyboard devices as secure hw/i386: mark vmmouse / vmport as secure
hw/display: mark cirrus and QXL as secure
hw/usb: mark UHCI, OCHI & ECHI USB hosts as secure
hw/9pfs/virtio-9p-device.c | 1 + hw/acpi/erst.c | 1 + hw/acpi/vmclock.c | 1 + hw/acpi/vmgenid.c | 1 + hw/arm/smmuv3.c | 2 ++ hw/audio/hda-codec.c | 3 +++ hw/audio/intel-hda.c | 3 +++ hw/audio/virtio-snd.c | 1 + hw/block/vhost-user-blk.c | 1 + hw/block/virtio-blk.c | 1 + hw/block/xen-block.c | 2 ++ hw/char/debugcon.c | 1 + hw/char/sclpconsole-lm.c | 1 + hw/char/sclpconsole.c | 1 + hw/char/serial-isa.c | 1 + hw/char/serial-pci.c | 1 + hw/char/serial.c | 1 + hw/char/spapr_vty.c | 1 + hw/char/virtio-console.c | 2 ++ hw/char/virtio-serial-bus.c | 2 ++ hw/char/xen_console.c | 1 + hw/display/bochs-display.c | 1 + hw/display/cirrus_vga.c | 1 + hw/display/qxl.c | 2 ++ hw/display/ramfb-standalone.c | 1 + hw/display/vga-pci.c | 2 ++ hw/display/vhost-user-gpu.c | 1 + hw/display/virtio-gpu-gl.c | 1 + hw/display/virtio-gpu-pci-rutabaga.c | 1 + hw/display/virtio-gpu-rutabaga.c | 1 + hw/display/virtio-gpu.c | 1 + hw/i386/amd_iommu.c | 4 +++- hw/i386/intel_iommu.c | 1 + hw/i386/kvm/clock.c | 1 + hw/i386/vmmouse.c | 1 + hw/i386/vmport.c | 1 + hw/i386/xen/xen-hvm.c | 1 + hw/i386/xen/xen_platform.c | 1 + hw/i386/xen/xen_pvdevice.c | 1 + hw/ide/ich.c | 1 + hw/ide/ide-dev.c | 2 ++ hw/ide/piix.c | 2 ++ hw/input/pckbd.c | 3 ++- hw/input/ps2.c | 6 ++++-- hw/input/virtio-input-hid.c | 4 ++++ hw/input/virtio-input-host.c | 1 + hw/mem/nvdimm.c | 1 + hw/mem/pc-dimm.c | 1 + hw/misc/pvpanic-isa.c | 1 + hw/misc/pvpanic-mmio.c | 1 + hw/misc/pvpanic-pci.c | 1 + hw/misc/vmcoreinfo.c | 1 + hw/net/e1000.c | 1 + hw/net/e1000e.c | 1 + hw/net/igb.c | 1 + hw/net/rtl8139.c | 1 + hw/net/spapr_llan.c | 1 + hw/net/virtio-net.c | 1 + hw/net/xen_nic.c | 1 + hw/pci-bridge/gen_pcie_root_port.c | 1 + hw/pci-bridge/i82801b11.c | 1 + hw/pci-bridge/ioh3420.c | 1 + hw/pci-bridge/pci_bridge_dev.c | 2 ++ hw/pci-bridge/pci_expander_bridge.c | 5 +++++ hw/pci-bridge/pcie_pci_bridge.c | 1 + hw/pci-bridge/xio3130_downstream.c | 1 + hw/pci-bridge/xio3130_upstream.c | 1 + hw/pci-host/gpex.c | 2 ++ hw/pci-host/i440fx.c | 2 ++ hw/pci-host/pnv_phb.c | 2 ++ hw/pci-host/pnv_phb3.c | 3 +++ hw/pci-host/pnv_phb3_msi.c | 1 + hw/pci-host/pnv_phb3_pbcq.c | 1 + hw/pci-host/pnv_phb4.c | 4 +++- hw/pci-host/pnv_phb4_pec.c | 1 + hw/pci-host/q35.c | 2 ++ hw/pci-host/remote.c | 1 + hw/pci-host/xen_igd_pt.c | 1 + hw/pci/pci.c | 4 ++++ hw/ppc/spapr_nvdimm.c | 1 + hw/ppc/spapr_pci.c | 1 + hw/ppc/spapr_tpm_proxy.c | 1 + hw/rtc/mc146818rtc.c | 1 + hw/s390x/s390-pci-bus.c | 4 ++++ hw/s390x/vhost-scsi-ccw.c | 1 + hw/s390x/vhost-user-fs-ccw.c | 1 + hw/s390x/vhost-vsock-ccw.c | 1 + hw/s390x/virtio-ccw-9p.c | 1 + hw/s390x/virtio-ccw-balloon.c | 1 + hw/s390x/virtio-ccw-blk.c | 1 + hw/s390x/virtio-ccw-crypto.c | 1 + hw/s390x/virtio-ccw-gpu.c | 1 + hw/s390x/virtio-ccw-input.c | 3 +++ hw/s390x/virtio-ccw-mem.c | 1 + hw/s390x/virtio-ccw-net.c | 1 + hw/s390x/virtio-ccw-rng.c | 1 + hw/s390x/virtio-ccw-scsi.c | 1 + hw/s390x/virtio-ccw-serial.c | 1 + hw/scsi/scsi-disk.c | 3 +++ hw/scsi/scsi-generic.c | 1 + hw/scsi/spapr_vscsi.c | 1 + hw/scsi/vhost-scsi.c | 1 + hw/scsi/vhost-user-scsi.c | 1 + hw/scsi/virtio-scsi.c | 1 + hw/tpm/tpm_crb.c | 1 + hw/tpm/tpm_spapr.c | 1 + hw/tpm/tpm_tis_i2c.c | 1 + hw/tpm/tpm_tis_isa.c | 1 + hw/tpm/tpm_tis_sysbus.c | 1 + hw/uefi/var-service-sysbus.c | 2 ++ hw/usb/ccid-card-emulated.c | 1 + hw/usb/ccid-card-passthru.c | 1 + hw/usb/dev-hid.c | 3 +++ hw/usb/dev-hub.c | 1 + hw/usb/dev-smartcard-reader.c | 2 ++ hw/usb/dev-storage-bot.c | 1 + hw/usb/dev-storage-classic.c | 1 + hw/usb/hcd-ehci-pci.c | 1 + hw/usb/hcd-ehci-sysbus.c | 7 +++++++ hw/usb/hcd-ohci-pci.c | 1 + hw/usb/hcd-ohci-sysbus.c | 1 + hw/usb/hcd-uhci.c | 1 + hw/usb/hcd-xhci-nec.c | 1 + hw/usb/hcd-xhci-pci.c | 1 + hw/usb/hcd-xhci-sysbus.c | 3 ++- hw/usb/hcd-xhci.c | 1 + hw/usb/host-libusb.c | 1 + hw/usb/redirect.c | 1 + hw/vfio-user/pci.c | 1 + hw/vfio/ap.c | 1 + hw/vfio/ccw.c | 1 + hw/vfio/igd.c | 1 + hw/vfio/iommufd.c | 2 ++ hw/vfio/pci.c | 2 ++ hw/vfio/spapr.c | 1 + hw/virtio/vdpa-dev.c | 1 + hw/virtio/vhost-user-fs.c | 1 + hw/virtio/vhost-user-gpio.c | 1 + hw/virtio/vhost-user-i2c.c | 1 + hw/virtio/vhost-user-input.c | 1 + hw/virtio/vhost-user-rng.c | 1 + hw/virtio/vhost-user-rtc.c | 1 + hw/virtio/vhost-user-scmi.c | 1 + hw/virtio/vhost-user-snd.c | 1 + hw/virtio/vhost-user-spi.c | 1 + hw/virtio/vhost-user-test-device.c | 1 + hw/virtio/vhost-user-vsock.c | 1 + hw/virtio/vhost-vsock.c | 1 + hw/virtio/virtio-balloon.c | 1 + hw/virtio/virtio-crypto.c | 1 + hw/virtio/virtio-iommu.c | 2 ++ hw/virtio/virtio-mem.c | 1 + hw/virtio/virtio-mmio.c | 2 ++ hw/virtio/virtio-nsm.c | 1 + hw/virtio/virtio-pci.c | 3 +++ hw/virtio/virtio-pmem.c | 1 + hw/virtio/virtio-rng.c | 1 + hw/virtio/virtio-rtc.c | 1 + hw/watchdog/sbsa_gwdt.c | 1 + hw/watchdog/spapr_watchdog.c | 1 + hw/watchdog/wdt_diag288.c | 1 + hw/watchdog/wdt_i6300esb.c | 1 + hw/watchdog/wdt_ib700.c | 1 + hw/xen/xen-bus.c | 2 ++ hw/xen/xen-legacy-backend.c | 3 +++ hw/xen/xen_pt.c | 1 + 166 files changed, 230 insertions(+), 6 deletions(-)
Signature · 1 line
2.56.0
PATCH v2 1/28 hw: mark all virtio PCI devices as secure
These are all intended for use in a virtualization scenario and must provide a security boundary. This can be done for almost all virtio PCI devices by modifying the common type register helper.
The virtio-gpu-pci-rutabaga device is unusual in not using the common virtio_pci_types_register() method, so needs marking directly.
--- hw/display/virtio-gpu-pci-rutabaga.c | 1 + hw/virtio/virtio-pci.c | 3 +++ 2 files changed, 4 insertions(+)
hw/display/virtio-gpu-pci-rutabaga.c +1 -0
@@ -34,6 +34,7 @@ static const TypeInfo virtio_gpu_rutabaga_pci_info[] = { .parent = TYPE_VIRTIO_GPU_PCI_BASE, .instance_size = sizeof(VirtIOGPURutabagaPCI), .instance_init = virtio_gpu_rutabaga_initfn, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
hw/virtio/virtio-pci.c +3 -0
@@ -2527,6 +2527,7 @@ void virtio_pci_types_register(const VirtioPCIDeviceTypeInfo *t) .name = t->generic_name, .parent = base_type_info.name, .class_init = virtio_pci_generic_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_PCIE_DEVICE }, {INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -2562,6 +2563,7 @@ void virtio_pci_types_register(const VirtioPCIDeviceTypeInfo *t) .name = t->non_transitional_name, .parent = base_type_info.name, .instance_init = virtio_pci_non_transitional_instance_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_PCIE_DEVICE }, {INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -2576,6 +2578,7 @@ void virtio_pci_types_register(const VirtioPCIDeviceTypeInfo *t) .name = t->transitional_name, .parent = base_type_info.name, .instance_init = virtio_pci_transitional_instance_init, + .secure = true, .interfaces = (const InterfaceInfo []) {/* * Transitional virtio devices work only as Conventional PCI
Signature · 1 line
2.56.0
Re: [PATCH v2 01/28] hw: mark all virtio PCI devices as secure
Quoted 4 lines · Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must provide a security boundary. This can be done for almost all virtio PCI devices by modifying the common type register helper.
Quoted 8 lines
The virtio-gpu-pci-rutabaga device is unusual in not using the common
virtio_pci_types_register()method, so needs marking directly.Signed-off-by Daniel P. Berrangé <[email protected]>--- hw/display/virtio-gpu-pci-rutabaga.c | 1 + hw/virtio/virtio-pci.c | 3 +++ 2 files changed, 4 insertions(+)
PATCH v2 2/28 hw: mark all virtio CCW devices as secure
In reply to Daniel P. BerrangéThese are all intended for use in a virtualization scenario and must provide a security boundary.
--- hw/s390x/vhost-scsi-ccw.c | 1 + hw/s390x/vhost-user-fs-ccw.c | 1 + hw/s390x/vhost-vsock-ccw.c | 1 + hw/s390x/virtio-ccw-9p.c | 1 + hw/s390x/virtio-ccw-balloon.c | 1 + hw/s390x/virtio-ccw-blk.c | 1 + hw/s390x/virtio-ccw-crypto.c | 1 + hw/s390x/virtio-ccw-gpu.c | 1 + hw/s390x/virtio-ccw-input.c | 3 +++ hw/s390x/virtio-ccw-mem.c | 1 + hw/s390x/virtio-ccw-net.c | 1 + hw/s390x/virtio-ccw-rng.c | 1 + hw/s390x/virtio-ccw-scsi.c | 1 + hw/s390x/virtio-ccw-serial.c | 1 + 14 files changed, 16 insertions(+)
hw/s390x/vhost-scsi-ccw.c +1 -0
@@ -62,6 +62,7 @@ static const TypeInfo vhost_ccw_scsi = { .instance_size = sizeof(VHostSCSICcw), .instance_init = vhost_ccw_scsi_instance_init, .class_init = vhost_ccw_scsi_class_init, + .secure = true, };static void virtio_ccw_scsi_register (void )
hw/s390x/vhost-user-fs-ccw.c +1 -0
@@ -64,6 +64,7 @@ static const TypeInfo vhost_user_fs_ccw = { .instance_size = sizeof(VHostUserFSCcw), .instance_init = vhost_user_fs_ccw_instance_init, .class_init = vhost_user_fs_ccw_class_init, + .secure = true, };static void vhost_user_fs_ccw_register (void )
hw/s390x/vhost-vsock-ccw.c +1 -0
@@ -71,6 +71,7 @@ static const TypeInfo vhost_vsock_ccw_info = { .instance_size = sizeof(VHostVSockCCWState), .instance_init = vhost_vsock_ccw_instance_init, .class_init = vhost_vsock_ccw_class_init, + .secure = true, };static void vhost_vsock_ccw_register (void )
hw/s390x/virtio-ccw-9p.c +1 -0
@@ -64,6 +64,7 @@ static const TypeInfo virtio_ccw_9p_info = { .instance_size = sizeof(V9fsCCWState), .instance_init = virtio_ccw_9p_instance_init, .class_init = virtio_ccw_9p_class_init, + .secure = true, };static void virtio_ccw_9p_register (void )
hw/s390x/virtio-ccw-balloon.c +1 -0
@@ -69,6 +69,7 @@ static const TypeInfo virtio_ccw_balloon = { .instance_size = sizeof(VirtIOBalloonCcw), .instance_init = virtio_ccw_balloon_instance_init, .class_init = virtio_ccw_balloon_class_init, + .secure = true, };static void virtio_ccw_balloon_register (void )
hw/s390x/virtio-ccw-blk.c +1 -0
@@ -67,6 +67,7 @@ static const TypeInfo virtio_ccw_blk = { .instance_size = sizeof(VirtIOBlkCcw), .instance_init = virtio_ccw_blk_instance_init, .class_init = virtio_ccw_blk_class_init, + .secure = true, };static void virtio_ccw_blk_register (void )
hw/s390x/virtio-ccw-crypto.c +1 -0
@@ -67,6 +67,7 @@ static const TypeInfo virtio_ccw_crypto = { .instance_size = sizeof(VirtIOCryptoCcw), .instance_init = virtio_ccw_crypto_instance_init, .class_init = virtio_ccw_crypto_class_init, + .secure = true, };static void virtio_ccw_crypto_register (void )
hw/s390x/virtio-ccw-gpu.c +1 -0
@@ -66,6 +66,7 @@ static const TypeInfo virtio_ccw_gpu = { .instance_size = sizeof(VirtIOGPUCcw), .instance_init = virtio_ccw_gpu_instance_init, .class_init = virtio_ccw_gpu_class_init, + .secure = true, };module_obj (TYPE_VIRTIO_GPU_CCW );module_kconfig (VIRTIO_CCW );
hw/s390x/virtio-ccw-input.c +3 -0
@@ -110,6 +110,7 @@ static const TypeInfo virtio_ccw_keyboard = { .parent = TYPE_VIRTIO_INPUT_HID_CCW, .instance_size = sizeof(VirtIOInputHIDCcw), .instance_init = virtio_ccw_keyboard_instance_init, + .secure = true, };static const TypeInfo virtio_ccw_mouse = {
@@ -117,6 +118,7 @@ static const TypeInfo virtio_ccw_mouse = { .parent = TYPE_VIRTIO_INPUT_HID_CCW, .instance_size = sizeof(VirtIOInputHIDCcw), .instance_init = virtio_ccw_mouse_instance_init, + .secure = true, };static const TypeInfo virtio_ccw_tablet = {
@@ -124,6 +126,7 @@ static const TypeInfo virtio_ccw_tablet = { .parent = TYPE_VIRTIO_INPUT_HID_CCW, .instance_size = sizeof(VirtIOInputHIDCcw), .instance_init = virtio_ccw_tablet_instance_init, + .secure = true, };static void virtio_ccw_input_register (void )
hw/s390x/virtio-ccw-mem.c +1 -0
@@ -216,6 +216,7 @@ static const TypeInfo virtio_ccw_mem = { .instance_size = sizeof(VirtIOMEMCcw), .instance_init = virtio_ccw_mem_instance_init, .class_init = virtio_ccw_mem_class_init, + .secure = true, };static void virtio_ccw_mem_register_types (void )
hw/s390x/virtio-ccw-net.c +1 -0
@@ -70,6 +70,7 @@ static const TypeInfo virtio_ccw_net = { .instance_size = sizeof(VirtIONetCcw), .instance_init = virtio_ccw_net_instance_init, .class_init = virtio_ccw_net_class_init, + .secure = true, };static void virtio_ccw_net_register (void )
hw/s390x/virtio-ccw-rng.c +1 -0
@@ -66,6 +66,7 @@ static const TypeInfo virtio_ccw_rng = { .instance_size = sizeof(VirtIORNGCcw), .instance_init = virtio_ccw_rng_instance_init, .class_init = virtio_ccw_rng_class_init, + .secure = true, };static void virtio_ccw_rng_register (void )
hw/s390x/virtio-ccw-scsi.c +1 -0
@@ -76,6 +76,7 @@ static const TypeInfo virtio_ccw_scsi = { .instance_size = sizeof(VirtIOSCSICcw), .instance_init = virtio_ccw_scsi_instance_init, .class_init = virtio_ccw_scsi_class_init, + .secure = true, };static void virtio_ccw_scsi_register (void )
hw/s390x/virtio-ccw-serial.c +1 -0
@@ -76,6 +76,7 @@ static const TypeInfo virtio_ccw_serial = { .instance_size = sizeof(VirtioSerialCcw), .instance_init = virtio_ccw_serial_instance_init, .class_init = virtio_ccw_serial_class_init, + .secure = true, };static void virtio_ccw_serial_register (void )
Signature · 1 line
2.56.0
Re: [PATCH v2 02/28] hw: mark all virtio CCW devices as secure
Quoted 8 lines · Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must provide a security boundary.
Acked-by Eric Farman <[email protected]>Acked-by Cornelia Huck <[email protected]>Signed-off-by Daniel P. Berrangé <[email protected]>---
...
hw/s390x/virtio-ccw-9p.c static const TypeInfo virtio_ccw_9p_info = { · line 68
Quoted 10 lines
hw/s390x/virtio-ccw-9p.c +1
-0@@ -64,6 +64,7 @@ static const TypeInfo virtio_ccw_9p_info = { .instance_size = sizeof(V9fsCCWState), .instance_init = virtio_ccw_9p_instance_init, .class_init = virtio_ccw_9p_class_init, + .secure = true, };
I wonder whether we really want to include virtio-9p in the list of secure devices ... but in case we reconsider, I guess that can be refined later, so:
Re: [PATCH v2 02/28] hw: mark all virtio CCW devices as secure
Quoted 10 lines · Thomas Huth
Quoted 8 lines · Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must provide a security boundary.
Acked-by Eric Farman <[email protected]>Acked-by Cornelia Huck <[email protected]>Signed-off-by Daniel P. Berrangé <[email protected]>---
...
Quoted 13 lines
hw/s390x/virtio-ccw-9p.c static const TypeInfo virtio_ccw_9p_info = { · line 68
Quoted 10 lines
hw/s390x/virtio-ccw-9p.c +1
-0@@ -64,6 +64,7 @@ static const TypeInfo virtio_ccw_9p_info = { .instance_size = sizeof(V9fsCCWState), .instance_init = virtio_ccw_9p_instance_init, .class_init = virtio_ccw_9p_class_init, + .secure = true, };I wonder whether we really want to include virtio-9p in the list of secure devices ... but in case we reconsider, I guess that can be refined later, so:
In terms of what we've documented about "virtualization use case" being the criteria for security triage, I consider everything related to virtio- to be already in-scope and not up for debate. No one reading our current docs would expect anything "virtio" to fall under the non-virtualization use case.
Now we have this explicit marker though, we can consider being more fine grained in what we cover though. The question is how / when we move a device from the "secure" to "not secure" bucket.
That direction should be very rare, because users need to have long term certainty about what's treated secure. Our machine type guarantees last for 6 years, 3 years of new VM deployments and 3 years deprecated where they should only be used for incoming migrations/restores from saved state. Virtualization users / vendors will expect security coverage for this kind of timeframe.
When we have maintainership problems with certain devices, if they are marked secure, those are something we need to flag as priority to various vendors like Red Hat who provide resource/investment to QEMU. They're shipping this stuff and promising CVE fixes to their paying customers and that needs to translate to investment in QEMU upstream, though in the 9p case Red Hat does not actually ship this particular device.
With regards,
Daniel
Signature · 3 lines
|: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
PATCH v2 3/28 hw: mark all vhost devices a secure
In reply to Daniel P. BerrangéThese are all intended for use in a virtualization scenario and must provide a security boundary.
--- hw/block/vhost-user-blk.c | 1 + hw/display/vhost-user-gpu.c | 1 + hw/scsi/vhost-scsi.c | 1 + hw/scsi/vhost-user-scsi.c | 1 + hw/virtio/vhost-user-fs.c | 1 + hw/virtio/vhost-user-gpio.c | 1 + hw/virtio/vhost-user-i2c.c | 1 + hw/virtio/vhost-user-input.c | 1 + hw/virtio/vhost-user-rng.c | 1 + hw/virtio/vhost-user-rtc.c | 1 + hw/virtio/vhost-user-scmi.c | 1 + hw/virtio/vhost-user-snd.c | 1 + hw/virtio/vhost-user-spi.c | 1 + hw/virtio/vhost-user-test-device.c | 1 + hw/virtio/vhost-user-vsock.c | 1 + hw/virtio/vhost-vsock.c | 1 + 16 files changed, 16 insertions(+)
hw/block/vhost-user-blk.c +1 -0
@@ -697,6 +697,7 @@ static const TypeInfo vhost_user_blk_info = { .instance_size = sizeof(VHostUserBlk), .instance_init = vhost_user_blk_instance_init, .class_init = vhost_user_blk_class_init, + .secure = true, }; static void vhost_user_blk_set_inflight_migration(Object *obj, Visitor *v,
hw/display/vhost-user-gpu.c +1 -0
@@ -726,6 +726,7 @@ static const TypeInfo vhost_user_gpu_info = { .instance_init = vhost_user_gpu_instance_init, .instance_finalize = vhost_user_gpu_instance_finalize, .class_init = vhost_user_gpu_class_init, + .secure = true, };module_obj (TYPE_VHOST_USER_GPU );module_kconfig (VHOST_USER_GPU );
hw/scsi/vhost-scsi.c +1 -0
@@ -400,6 +400,7 @@ static const TypeInfo vhost_scsi_info = { .instance_size = sizeof(VHostSCSI), .class_init = vhost_scsi_class_init, .instance_init = vhost_scsi_instance_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_FW_PATH_PROVIDER }, { }
hw/scsi/vhost-user-scsi.c +1 -0
@@ -426,6 +426,7 @@ static const TypeInfo vhost_user_scsi_info = { .instance_size = sizeof(VHostUserSCSI), .class_init = vhost_user_scsi_class_init, .instance_init = vhost_user_scsi_instance_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_FW_PATH_PROVIDER }, { }
hw/virtio/vhost-user-fs.c +1 -0
@@ -448,6 +448,7 @@ static const TypeInfo vuf_info = { .instance_size = sizeof(VHostUserFS), .instance_init = vuf_instance_init, .class_init = vuf_class_init, + .secure = true, };static void vuf_register_types (void )
hw/virtio/vhost-user-gpio.c +1 -0
@@ -53,6 +53,7 @@ static const TypeInfo vu_gpio_info = { .parent = TYPE_VHOST_USER_BASE, .instance_size = sizeof(VHostUserGPIO), .class_init = vu_gpio_class_init, + .secure = true, };static void vu_gpio_register_types (void )
hw/virtio/vhost-user-i2c.c +1 -0
@@ -53,6 +53,7 @@ static const TypeInfo vu_i2c_info = { .parent = TYPE_VHOST_USER_BASE, .instance_size = sizeof(VHostUserI2C), .class_init = vu_i2c_class_init, + .secure = true, };static void vu_i2c_register_types (void )
hw/virtio/vhost-user-input.c +1 -0
@@ -47,6 +47,7 @@ static const TypeInfo vhost_input_info = { .parent = TYPE_VHOST_USER_BASE, .instance_size = sizeof(VHostUserInput), .class_init = vhost_input_class_init, + .secure = true, };static void vhost_input_register_types (void )
hw/virtio/vhost-user-rng.c +1 -0
@@ -55,6 +55,7 @@ static const TypeInfo vu_rng_info = { .parent = TYPE_VHOST_USER_BASE, .instance_size = sizeof(VHostUserRNG), .class_init = vu_rng_class_init, + .secure = true, };static void vu_rng_register_types (void )
hw/virtio/vhost-user-rtc.c +1 -0
@@ -54,6 +54,7 @@ static const TypeInfo vu_rtc_info = { .parent = TYPE_VHOST_USER_BASE, .instance_size = sizeof(VHostUserRTC), .class_init = vu_rtc_class_init, + .secure = true, };static void vu_rtc_register_types (void )
hw/virtio/vhost-user-scmi.c +1 -0
@@ -311,6 +311,7 @@ static const TypeInfo vu_scmi_info = { .parent = TYPE_VIRTIO_DEVICE, .instance_size = sizeof(VHostUserSCMI), .class_init = vu_scmi_class_init, + .secure = true, };static void vu_scmi_register_types (void )
hw/virtio/vhost-user-snd.c +1 -0
@@ -72,6 +72,7 @@ static const TypeInfo vu_snd_info = { .parent = TYPE_VHOST_USER_BASE, .instance_size = sizeof(VHostUserSound), .class_init = vu_snd_class_init, + .secure = true, };static void vu_snd_register_types (void )
hw/virtio/vhost-user-spi.c +1 -0
@@ -55,6 +55,7 @@ static const TypeInfo vu_spi_info = { .parent = TYPE_VHOST_USER_BASE, .instance_size = sizeof(VHostUserSPI), .class_init = vu_spi_class_init, + .secure = true, };static void vu_spi_register_types (void )
hw/virtio/vhost-user-test-device.c +1 -0
@@ -50,6 +50,7 @@ static const TypeInfo vud_info = { .name = TYPE_VHOST_USER_TEST_DEVICE, .parent = TYPE_VHOST_USER_BASE, .class_init = vud_class_init, + .secure = true, };static void vu_register_types (void )
hw/virtio/vhost-user-vsock.c +1 -0
@@ -175,6 +175,7 @@ static const TypeInfo vuv_info = { .parent = TYPE_VHOST_VSOCK_COMMON, .instance_size = sizeof(VHostUserVSock), .class_init = vuv_class_init, + .secure = true, };static void vuv_register_types (void )
hw/virtio/vhost-vsock.c +1 -0
@@ -225,6 +225,7 @@ static const TypeInfo vhost_vsock_info = { .parent = TYPE_VHOST_VSOCK_COMMON, .instance_size = sizeof(VHostVSock), .class_init = vhost_vsock_class_init, + .secure = true, };static void vhost_vsock_register_types (void )
Signature · 1 line
2.56.0
Re: [PATCH v2 03/28] hw: mark all vhost devices a secure
Quoted 6 lines · Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must provide a security boundary.
Signed-off-by Daniel P. Berrangé <[email protected]>---
PATCH v2 4/28 hw: mark all remaining virtio object types as secure
In reply to Daniel P. BerrangéThese are all intended for use in a virtualization scenario and must provide a security boundary.
--- hw/9pfs/virtio-9p-device.c | 1 + hw/audio/virtio-snd.c | 1 + hw/block/virtio-blk.c | 1 + hw/char/virtio-console.c | 2 ++ hw/char/virtio-serial-bus.c | 2 ++ hw/display/virtio-gpu-gl.c | 1 + hw/display/virtio-gpu-rutabaga.c | 1 + hw/display/virtio-gpu.c | 1 + hw/input/virtio-input-hid.c | 4 ++++ hw/input/virtio-input-host.c | 1 + hw/net/virtio-net.c | 1 + hw/scsi/virtio-scsi.c | 1 + hw/virtio/vdpa-dev.c | 1 + hw/virtio/virtio-balloon.c | 1 + hw/virtio/virtio-crypto.c | 1 + hw/virtio/virtio-iommu.c | 2 ++ hw/virtio/virtio-mem.c | 1 + hw/virtio/virtio-mmio.c | 2 ++ hw/virtio/virtio-nsm.c | 1 + hw/virtio/virtio-pmem.c | 1 + hw/virtio/virtio-rng.c | 1 + hw/virtio/virtio-rtc.c | 1 + 22 files changed, 29 insertions(+)
hw/9pfs/virtio-9p-device.c +1 -0
@@ -288,6 +288,7 @@ static const TypeInfo virtio_device_info = { .parent = TYPE_VIRTIO_DEVICE, .instance_size = sizeof(V9fsVirtioState), .class_init = virtio_9p_class_init, + .secure = true, };static void virtio_9p_register_types (void )
hw/audio/virtio-snd.c +1 -0
@@ -1536,6 +1536,7 @@ static const TypeInfo virtio_snd_types[] = { .parent = TYPE_VIRTIO_DEVICE, .instance_size = sizeof(VirtIOSound), .class_init = virtio_snd_class_init, + .secure = true, } };
hw/block/virtio-blk.c +1 -0
@@ -2071,6 +2071,7 @@ static const TypeInfo virtio_blk_info = { .instance_init = virtio_blk_instance_init, .class_init = virtio_blk_class_init, .class_size = sizeof(VirtIOBlkClass), + .secure = true, };static void virtio_register_types (void )
hw/char/virtio-console.c +2 -0
@@ -295,6 +295,7 @@ static const TypeInfo virtconsole_info = { .name = "virtconsole", .parent = TYPE_VIRTIO_CONSOLE_SERIAL_PORT, .class_init = virtconsole_class_init, + .secure = true, };static const Property virtserialport_properties[] = {
@@ -320,6 +321,7 @@ static const TypeInfo virtserialport_info = { .parent = TYPE_VIRTIO_SERIAL_PORT, .instance_size = sizeof(VirtConsole), .class_init = virtserialport_class_init, + .secure = true, };static void virtconsole_register_types (void )
hw/char/virtio-serial-bus.c +2 -0
@@ -915,6 +915,7 @@ static const TypeInfo virtser_bus_info = { .parent = TYPE_BUS, .instance_size = sizeof(VirtIOSerialBus), .class_init = virtser_bus_class_init, + .secure = true, };#ifdef CONFIG_HMP
@@ -1250,6 +1251,7 @@ static const TypeInfo virtio_device_info = { .parent = TYPE_VIRTIO_DEVICE, .instance_size = sizeof(VirtIOSerial), .class_init = virtio_serial_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_HOTPLUG_HANDLER }, { }
hw/display/virtio-gpu-gl.c +1 -0
@@ -233,6 +233,7 @@ static const TypeInfo virtio_gpu_gl_info = { .parent = TYPE_VIRTIO_GPU, .instance_size = sizeof(VirtIOGPUGL), .class_init = virtio_gpu_gl_class_init, + .secure = true, };module_obj (TYPE_VIRTIO_GPU_GL );module_kconfig (VIRTIO_GPU );
hw/display/virtio-gpu-rutabaga.c +1 -0
@@ -1169,6 +1169,7 @@ static const TypeInfo virtio_gpu_rutabaga_info[] = { .parent = TYPE_VIRTIO_GPU, .instance_size = sizeof(VirtIOGPURutabaga), .class_init = virtio_gpu_rutabaga_class_init, + .secure = true, }, };
hw/display/virtio-gpu.c +1 -0
@@ -1995,6 +1995,7 @@ static const TypeInfo virtio_gpu_info = { .instance_size = sizeof(VirtIOGPU), .class_size = sizeof(VirtIOGPUClass), .class_init = virtio_gpu_class_init, + .secure = true, };module_obj (TYPE_VIRTIO_GPU );module_kconfig (VIRTIO_GPU );
hw/input/virtio-input-hid.c +4 -0
@@ -315,6 +315,7 @@ static const TypeInfo virtio_keyboard_info = { .parent = TYPE_VIRTIO_INPUT_HID, .instance_size = sizeof(VirtIOInputHID), .instance_init = virtio_keyboard_init, + .secure = true, };/* ----------------------------------------------------------------- */
@@ -369,6 +370,7 @@ static const TypeInfo virtio_mouse_info = { .parent = TYPE_VIRTIO_INPUT_HID, .instance_size = sizeof(VirtIOInputHID), .instance_init = virtio_mouse_init, + .secure = true, };/* ----------------------------------------------------------------- */
@@ -442,6 +444,7 @@ static const TypeInfo virtio_tablet_info = { .parent = TYPE_VIRTIO_INPUT_HID, .instance_size = sizeof(VirtIOInputHID), .instance_init = virtio_tablet_init, + .secure = true, };/* ----------------------------------------------------------------- */
@@ -527,6 +530,7 @@ static const TypeInfo virtio_multitouch_info = { .parent = TYPE_VIRTIO_INPUT_HID, .instance_size = sizeof(VirtIOInputHID), .instance_init = virtio_multitouch_init, + .secure = true, };/* ----------------------------------------------------------------- */
hw/input/virtio-input-host.c +1 -0
@@ -248,6 +248,7 @@ static const TypeInfo virtio_input_host_info = { .instance_size = sizeof(VirtIOInputHost), .instance_init = virtio_input_host_init, .class_init = virtio_input_host_class_init, + .secure = true, };/* ----------------------------------------------------------------- */
hw/net/virtio-net.c +1 -0
@@ -4491,6 +4491,7 @@ static const TypeInfo virtio_net_info = { .instance_size = sizeof(VirtIONet), .instance_init = virtio_net_instance_init, .class_init = virtio_net_class_init, + .secure = true, };static void virtio_register_types (void )
hw/scsi/virtio-scsi.c +1 -0
@@ -1456,6 +1456,7 @@ static const TypeInfo virtio_scsi_info = { .parent = TYPE_VIRTIO_SCSI_COMMON, .instance_size = sizeof(VirtIOSCSI), .class_init = virtio_scsi_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_HOTPLUG_HANDLER }, { }
hw/virtio/vdpa-dev.c +1 -0
@@ -392,6 +392,7 @@ static const TypeInfo vhost_vdpa_device_info = { .instance_size = sizeof(VhostVdpaDevice), .class_init = vhost_vdpa_device_class_init, .instance_init = vhost_vdpa_device_instance_init, + .secure = true, };static void register_vhost_vdpa_device_type (void )
hw/virtio/virtio-balloon.c +1 -0
@@ -1100,6 +1100,7 @@ static const TypeInfo virtio_balloon_info = { .instance_size = sizeof(VirtIOBalloon), .instance_init = virtio_balloon_instance_init, .class_init = virtio_balloon_class_init, + .secure = true, };static void virtio_register_types (void )
hw/virtio/virtio-crypto.c +1 -0
@@ -1313,6 +1313,7 @@ static const TypeInfo virtio_crypto_info = { .instance_size = sizeof(VirtIOCrypto), .instance_init = virtio_crypto_instance_init, .class_init = virtio_crypto_class_init, + .secure = true, };static void virtio_register_types (void )
hw/virtio/virtio-iommu.c +2 -0
@@ -1749,12 +1749,14 @@ static const TypeInfo virtio_iommu_info = { .instance_size = sizeof(VirtIOIOMMU), .instance_init = virtio_iommu_instance_init, .class_init = virtio_iommu_class_init, + .secure = true, };static const TypeInfo virtio_iommu_memory_region_info = { .parent =TYPE_IOMMU_MEMORY_REGION , .name =TYPE_VIRTIO_IOMMU_MEMORY_REGION , .class_init = virtio_iommu_memory_region_class_init, + .secure = true, };static void virtio_register_types (void )
hw/virtio/virtio-mem.c +1 -0
@@ -1668,6 +1668,7 @@ static const TypeInfo virtio_mem_info = { .instance_finalize = virtio_mem_instance_finalize, .class_init = virtio_mem_class_init, .class_size = sizeof(VirtIOMEMClass), + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_RAM_DISCARD_SOURCE }, { }
hw/virtio/virtio-mmio.c +2 -0
@@ -779,6 +779,7 @@ static const TypeInfo virtio_mmio_info = { .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(VirtIOMMIOProxy), .class_init = virtio_mmio_class_init, + .secure = true, };/* virtio-mmio-bus. */
@@ -848,6 +849,7 @@ static const TypeInfo virtio_mmio_bus_info = { .parent = TYPE_VIRTIO_BUS, .instance_size = sizeof(VirtioBusState), .class_init = virtio_mmio_bus_class_init, + .secure = true, };static void virtio_mmio_register_types (void )
hw/virtio/virtio-nsm.c +1 -0
@@ -1727,6 +1727,7 @@ static const TypeInfo virtio_nsm_info = { .parent = TYPE_VIRTIO_DEVICE, .instance_size = sizeof(VirtIONSM), .class_init = virtio_nsm_class_init, + .secure = true, };static void virtio_register_types (void )
hw/virtio/virtio-pmem.c +1 -0
@@ -196,6 +196,7 @@ static const TypeInfo virtio_pmem_info = { .class_size = sizeof(VirtIOPMEMClass), .class_init = virtio_pmem_class_init, .instance_size = sizeof(VirtIOPMEM), + .secure = true, };static void virtio_register_types (void )
hw/virtio/virtio-rng.c +1 -0
@@ -282,6 +282,7 @@ static const TypeInfo virtio_rng_info = { .parent = TYPE_VIRTIO_DEVICE, .instance_size = sizeof(VirtIORNG), .class_init = virtio_rng_class_init, + .secure = true, };static void virtio_register_types (void )
hw/virtio/virtio-rtc.c +1 -0
@@ -181,6 +181,7 @@ static const TypeInfo virtio_rtc_info = { .parent = TYPE_VIRTIO_DEVICE, .instance_size = sizeof(VirtIORtc), .class_init = virtio_rtc_class_init, + .secure = true, };static void virtio_rtc_register_types (void )
Signature · 1 line
2.56.0
Re: [PATCH v2 04/28] hw: mark all remaining virtio object types as secure
Quoted 6 lines · Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must provide a security boundary.
Signed-off-by Daniel P. Berrangé <[email protected]>---
Re: [PATCH v2 04/28] hw: mark all remaining virtio object types as secure
Hi
Quoted 10 lines · Thomas Huth
Quoted 6 lines · Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must provide a security boundary.
Signed-off-by Daniel P. Berrangé <[email protected]>---
Reviewed-by Thomas Huth <[email protected]>
I have a second thought about this, I'd like to exclude all gpu-accelerated paths for now. virgl/mesa/rutabaga expose a very large attack surface, so I'd like to drop them from the secure boundary
thanks
Re: [PATCH v2 04/28] hw: mark all remaining virtio object types as secure
Quoted 11 lines · Marc-André Lureau
Hi
Quoted 8 lines · Thomas Huth
Quoted 6 lines · Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must provide a security boundary.
Signed-off-by Daniel P. Berrangé <[email protected]>---
Quoted 6 lines
Quoted 2 lines
Reviewed-by Thomas Huth <[email protected]>I have a second thought about this, I'd like to exclude all gpu-accelerated paths for now. virgl/mesa/rutabaga expose a very large attack surface, so I'd like to drop them from the secure boundary
Rather than repost, please see my response for patch 2:
https://lists.gnu.org/archive/html/qemu-devel/2026-11/msg01530.html
TL;DR: we have already promised anything virtio related is in scope for security handling for a long time, as they are all unambiguously "virtualization use case".
With regards,
Daniel
Signature · 3 lines
|: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
Re: [PATCH v2 04/28] hw: mark all remaining virtio object types as secure
Hi
Quoted 20 lines · Daniel P. Berrangé
Quoted 11 lines · Marc-André Lureau
Hi
Quoted 8 lines · Thomas Huth
Quoted 6 lines · Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must provide a security boundary.
Signed-off-by Daniel P. Berrangé <[email protected]>---
Quoted 6 lines
Quoted 2 lines
Reviewed-by Thomas Huth <[email protected]>I have a second thought about this, I'd like to exclude all gpu-accelerated paths for now. virgl/mesa/rutabaga expose a very large attack surface, so I'd like to drop them from the secure boundary
Quoted 8 lines
Rather than repost, please see my response for patch 2:
https://lists.gnu.org/archive/html/qemu-devel/2026-11/msg01530.html
TL;DR: we have already promised anything virtio related is in scope for security handling for a long time, as they are all unambiguously "virtualization use case".
the value of a secure policy enforcement is low if we know those devices are unsecure and don't have the resources to make them secure.
Quoted 7 lines
With regards,
Daniel
--|: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
Re: [PATCH v2 04/28] hw: mark all remaining virtio object types as secure
Quoted 27 lines · Marc-André Lureau
Hi
Quoted 24 lines · Daniel P. Berrangé
Quoted 11 lines · Marc-André Lureau
Hi
Quoted 8 lines · Thomas Huth
Quoted 6 lines · Daniel P. Berrangé
These are all intended for use in a virtualization scenario and must provide a security boundary.
Signed-off-by Daniel P. Berrangé <[email protected]>---
Quoted 6 lines
Quoted 2 lines
Reviewed-by Thomas Huth <[email protected]>I have a second thought about this, I'd like to exclude all gpu-accelerated paths for now. virgl/mesa/rutabaga expose a very large attack surface, so I'd like to drop them from the secure boundary
Rather than repost, please see my response for patch 2:
https://lists.gnu.org/archive/html/qemu-devel/2026-11/msg01530.html
Quoted 7 lines
Quoted 4 lines
TL;DR: we have already promised anything virtio related is in scope for security handling for a long time, as they are all unambiguously "virtualization use case".
the value of a secure policy enforcement is low if we know those devices are unsecure and don't have the resources to make them secure.
It isn't a great situation to be in, but we're already there for any virtio devices based on our existing policies for bug handling and security triage. We can't promise we'll get fixes for all CVEs quickly, but we will at least assign CVEs so that users are aware when there are known problems.
This contrasts to other devices where problems will remain largely hidden for view, as we treat them as normal bugs and never call our security concerns when committing changes.
With regards,
Daniel
Signature · 3 lines
|: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
PATCH v2 5/28 hw/vfio: mark all VFIO object classes as secure
In reply to Daniel P. BerrangéThe VFIO subsystem is about securely passing host PCI devices to a guest, so all the classes should be presumed to be offering a security boundary.
--- hw/vfio-user/pci.c | 1 + hw/vfio/ap.c | 1 + hw/vfio/ccw.c | 1 + hw/vfio/igd.c | 1 + hw/vfio/iommufd.c | 2 ++ hw/vfio/pci.c | 2 ++ hw/vfio/spapr.c | 1 + 7 files changed, 9 insertions(+)
hw/vfio-user/pci.c +1 -0
@@ -487,6 +487,7 @@ static const TypeInfo vfio_user_pci_info = { .class_init = vfio_user_pci_class_init, .instance_init = vfio_user_pci_init, .instance_finalize = vfio_user_pci_finalize, + .secure = true, };static void register_vfio_user_dev_type (void )
hw/vfio/ap.c +1 -0
@@ -356,6 +356,7 @@ static const TypeInfo vfio_ap_info = { .instance_size = sizeof(VFIOAPDevice), .instance_init = vfio_ap_instance_init, .class_init = vfio_ap_class_init, + .secure = true, };static void vfio_ap_type_init (void )
hw/vfio/ccw.c +1 -0
@@ -723,6 +723,7 @@ static const TypeInfo vfio_ccw_info = { .instance_size = sizeof(VFIOCCWDevice), .instance_init = vfio_ccw_instance_init, .class_init = vfio_ccw_class_init, + .secure = true, };static void register_vfio_ccw_type (void )
hw/vfio/igd.c +1 -0
@@ -313,6 +313,7 @@ static const TypeInfo vfio_pci_igd_lpc_bridge_info = { .name = "vfio-pci-igd-lpc-bridge", .parent = TYPE_PCI_DEVICE, .class_init = vfio_pci_igd_lpc_bridge_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
hw/vfio/iommufd.c +2 -0
@@ -1061,10 +1061,12 @@ static const TypeInfo types[] = { .parent = TYPE_VFIO_IOMMU, .instance_size = sizeof(VFIOIOMMUFDContainer), .class_init = vfio_iommu_iommufd_class_init, + .secure = true, }, { .name = TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO, .parent = TYPE_HOST_IOMMU_DEVICE_IOMMUFD, .class_init = hiod_iommufd_vfio_class_init, + .secure = true, } };
hw/vfio/pci.c +2 -0
@@ -4110,6 +4110,7 @@ static const TypeInfo vfio_pci_info = { .class_init = vfio_pci_class_init, .instance_init = vfio_pci_init, .instance_finalize = vfio_pci_finalize, + .secure = true, };static const Property vfio_pci_nohotplug_properties[] = {
@@ -4146,6 +4147,7 @@ static const TypeInfo vfio_pci_nohotplug_info = { .parent = TYPE_VFIO_PCI, .instance_size = sizeof(VFIOPCIDevice), .class_init = vfio_pci_nohotplug_class_init, + .secure = true, };static void register_vfio_pci_dev_type (void )
hw/vfio/spapr.c +1 -0
@@ -544,6 +544,7 @@ static const TypeInfo types[] = { .parent = TYPE_VFIO_IOMMU_LEGACY, .instance_size = sizeof(VFIOSpaprContainer), .class_init = vfio_iommu_spapr_class_init, + .secure = true, }, };
Signature · 1 line
2.56.0
Re: [PATCH v2 05/28] hw/vfio: mark all VFIO object classes as secure
Quoted 8 lines · Daniel P. Berrangé
The VFIO subsystem is about securely passing host PCI devices to a guest, so all the classes should be presumed to be offering a security boundary.
Signed-off-by Daniel P. Berrangé <[email protected]>---
Re: [PATCH v2 05/28] hw/vfio: mark all VFIO object classes as secure
In reply to Daniel P. BerrangéQuoted 107 lines · Daniel P. Berrangé
The VFIO subsystem is about securely passing host PCI devices to a guest, so all the classes should be presumed to be offering a security boundary.
Signed-off-by Daniel P. Berrangé <[email protected]>--- hw/vfio-user/pci.c | 1 + hw/vfio/ap.c | 1 + hw/vfio/ccw.c | 1 + hw/vfio/igd.c | 1 + hw/vfio/iommufd.c | 2 ++ hw/vfio/pci.c | 2 ++ hw/vfio/spapr.c | 1 + 7 files changed, 9 insertions(+)hw/vfio-user/pci.c +1
-0@@ -487,6 +487,7 @@ static const TypeInfo vfio_user_pci_info = { .class_init = vfio_user_pci_class_init, .instance_init = vfio_user_pci_init, .instance_finalize = vfio_user_pci_finalize, + .secure = true, };static void register_vfio_user_dev_type (void )hw/vfio/ap.c +1
-0@@ -356,6 +356,7 @@ static const TypeInfo vfio_ap_info = { .instance_size = sizeof(VFIOAPDevice), .instance_init = vfio_ap_instance_init, .class_init = vfio_ap_class_init, + .secure = true, };static void vfio_ap_type_init (void )hw/vfio/ccw.c +1
-0@@ -723,6 +723,7 @@ static const TypeInfo vfio_ccw_info = { .instance_size = sizeof(VFIOCCWDevice), .instance_init = vfio_ccw_instance_init, .class_init = vfio_ccw_class_init, + .secure = true, };static void register_vfio_ccw_type (void )hw/vfio/igd.c +1
-0@@ -313,6 +313,7 @@ static const TypeInfo vfio_pci_igd_lpc_bridge_info = { .name = "vfio-pci-igd-lpc-bridge", .parent = TYPE_PCI_DEVICE, .class_init = vfio_pci_igd_lpc_bridge_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },hw/vfio/iommufd.c +2
-0@@ -1061,10 +1061,12 @@ static const TypeInfo types[] = { .parent = TYPE_VFIO_IOMMU, .instance_size = sizeof(VFIOIOMMUFDContainer), .class_init = vfio_iommu_iommufd_class_init, + .secure = true, }, { .name = TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO, .parent = TYPE_HOST_IOMMU_DEVICE_IOMMUFD, .class_init = hiod_iommufd_vfio_class_init, + .secure = true, } };hw/vfio/pci.c +2
-0@@ -4110,6 +4110,7 @@ static const TypeInfo vfio_pci_info = { .class_init = vfio_pci_class_init, .instance_init = vfio_pci_init, .instance_finalize = vfio_pci_finalize, + .secure = true, };static const Property vfio_pci_nohotplug_properties[] = {@@ -4146,6 +4147,7 @@ static const TypeInfo vfio_pci_nohotplug_info = { .parent = TYPE_VFIO_PCI, .instance_size = sizeof(VFIOPCIDevice), .class_init = vfio_pci_nohotplug_class_init, + .secure = true, };static void register_vfio_pci_dev_type (void )hw/vfio/spapr.c +0
-0
hw/vfio/spapr.c static const TypeInfo types[] = { · line 550
Quoted 7 lines
hw/vfio/spapr.c +1
-0@@ -544,6 +544,7 @@ static const TypeInfo types[] = { .parent = TYPE_VFIO_IOMMU_LEGACY, .instance_size = sizeof(VFIOSpaprContainer), .class_init = vfio_iommu_spapr_class_init, + .secure = true, }, };
Thanks,
C.
PATCH v2 6/28 hw/xen: mark all Xen related object types as being secure
In reply to Daniel P. BerrangéAll Xen paravirtualized devices are intended to provide a host / guest security barrier, so mark all Xen object types as scure.
--- hw/block/xen-block.c | 2 ++ hw/char/xen_console.c | 1 + hw/i386/xen/xen-hvm.c | 1 + hw/i386/xen/xen_platform.c | 1 + hw/i386/xen/xen_pvdevice.c | 1 + hw/net/xen_nic.c | 1 + hw/xen/xen-bus.c | 2 ++ hw/xen/xen-legacy-backend.c | 3 +++ hw/xen/xen_pt.c | 1 + 9 files changed, 13 insertions(+)
hw/block/xen-block.c +2 -0
@@ -740,6 +740,7 @@ static const TypeInfo xen_disk_type_info = { .parent = TYPE_XEN_BLOCK_DEVICE, .instance_size = sizeof(XenDiskDevice), .class_init = xen_disk_class_init, + .secure = true, };static void xen_cdrom_unrealize (XenBlockDevice *blockdev)
@@ -787,6 +788,7 @@ static const TypeInfo xen_cdrom_type_info = { .parent = TYPE_XEN_BLOCK_DEVICE, .instance_size = sizeof(XenCDRomDevice), .class_init = xen_cdrom_class_init, + .secure = true, };static void xen_block_register_types (void )
hw/char/xen_console.c +1 -0
@@ -513,6 +513,7 @@ static const TypeInfo xen_console_type_info = { .parent = TYPE_XEN_DEVICE, .instance_size = sizeof(XenConsole), .class_init = xen_console_class_init, + .secure = true, };static void xen_console_register_types (void )
hw/i386/xen/xen-hvm.c +1 -0
@@ -792,6 +792,7 @@ static const TypeInfo xen_i8259_type_infos[] = { .name = TYPE_XEN_I8259_PIC, .parent = TYPE_DEVICE, .instance_init = xen_i8259_pic_init, + .secure = true, }, };
hw/i386/xen/xen_platform.c +1 -0
@@ -604,6 +604,7 @@ static const TypeInfo xen_platform_info = { .parent = TYPE_PCI_DEVICE, .instance_size = sizeof(PCIXenPlatformState), .class_init = xen_platform_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
hw/i386/xen/xen_pvdevice.c +1 -0
@@ -139,6 +139,7 @@ static const TypeInfo xen_pv_type_info = { .parent = TYPE_PCI_DEVICE, .instance_size = sizeof(XenPVDevice), .class_init = xen_pv_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
hw/net/xen_nic.c +1 -0
@@ -579,6 +579,7 @@ static const TypeInfo xen_net_type_info = { .parent = TYPE_XEN_DEVICE, .instance_size = sizeof(XenNetDev), .class_init = xen_netdev_class_init, + .secure = true, };static void xen_net_register_types (void )
hw/xen/xen-bus.c +2 -0
@@ -404,6 +404,7 @@ static const TypeInfo xen_bus_type_info = { .instance_size = sizeof(XenBus), .class_size = sizeof(XenBusClass), .class_init = xen_bus_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_HOTPLUG_HANDLER }, { }
@@ -1141,6 +1142,7 @@ static const TypeInfo xen_bridge_type_info = { .name = TYPE_XEN_BRIDGE, .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(XenBridge), + .secure = true, };static void xen_register_types (void )
hw/xen/xen-legacy-backend.c +3 -0
@@ -648,6 +648,7 @@ static const TypeInfo xendev_type_info = { .parent = TYPE_DYNAMIC_SYS_BUS_DEVICE, .class_init = xendev_class_init, .instance_size = sizeof(XenLegacyDevice), + .secure = true, };static void xen_sysbus_class_init (ObjectClass *klass,const void *data)
@@ -661,6 +662,7 @@ static const TypeInfo xensysbus_info = { .name = TYPE_XENSYSBUS, .parent = TYPE_BUS, .class_init = xen_sysbus_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_HOTPLUG_HANDLER }, { }
@@ -670,6 +672,7 @@ static const TypeInfo xensysbus_info = {static const TypeInfo xensysdev_info = { .name =TYPE_XENSYSDEV , .parent =TYPE_SYS_BUS_DEVICE , + .secure = true, };static void xenbe_register_types (void )
hw/xen/xen_pt.c +1 -0
@@ -1079,6 +1079,7 @@ static const TypeInfo xen_pci_passthrough_info = { .instance_finalize = xen_pci_passthrough_finalize, .class_init = xen_pci_passthrough_class_init, .class_size = sizeof(XenPTDeviceClass), + .secure = true, .instance_init = xen_pci_passthrough_instance_init, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE },
Signature · 1 line
2.56.0
PATCH v2 7/28 hw/net: mark e1000, e1000e, IGB, rtl8139 & sPAPR VLAN as secure
In reply to Daniel P. BerrangéHistorically most NICs are only interesting for non-virtualization use cases and have not been written with malicious guests in mind.
As a general rule either virtio-net or xen-net should be used in all virtualized guests requiring a security boundary.
There are a handful of exceptions resulting from historical usage in the x86 world, to support virtualized guests lacking virtio support.
Thus the rtl8139, e1000, e1000e & IGB NICs are declared to provide a security boundary.
The PPC sPAPR Virtual LAN device is also marked secure.
--- hw/net/e1000.c | 1 + hw/net/e1000e.c | 1 + hw/net/igb.c | 1 + hw/net/rtl8139.c | 1 + hw/net/spapr_llan.c | 1 + 5 files changed, 5 insertions(+)
hw/net/e1000.c +1 -0
@@ -1759,6 +1759,7 @@ static void e1000_register_types(void) type_info.parent =TYPE_E1000_BASE ; type_info.class_data = info; type_info.class_init = e1000_class_init; + type_info.secure = true;type_register_static (&type_info); }
hw/net/e1000e.c +1 -0
@@ -721,6 +721,7 @@ static const TypeInfo e1000e_info = { .instance_size = sizeof(E1000EState), .class_init = e1000e_class_init, .instance_init = e1000e_instance_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_PCIE_DEVICE }, { }
hw/net/igb.c +1 -0
@@ -635,6 +635,7 @@ static const TypeInfo igb_info = { .instance_size = sizeof(IGBState), .class_init = igb_class_init, .instance_init = igb_instance_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_PCIE_DEVICE }, { }
hw/net/rtl8139.c +1 -0
@@ -3450,6 +3450,7 @@ static const TypeInfo rtl8139_info = { .instance_size = sizeof(RTL8139State), .class_init = rtl8139_class_init, .instance_init = rtl8139_instance_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
hw/net/spapr_llan.c +1 -0
@@ -891,6 +891,7 @@ static const TypeInfo spapr_vlan_info = { .class_init = spapr_vlan_class_init, .instance_init = spapr_vlan_instance_init, .instance_finalize = spapr_vlan_instance_finalize, + .secure = true, };static void spapr_vlan_register_types (void )
Signature · 1 line
2.56.0
Re: [PATCH v2 07/28] hw/net: mark e1000, e1000e, IGB, rtl8139 & sPAPR VLAN as secure
Quoted 15 lines · Daniel P. Berrangé
Historically most NICs are only interesting for non-virtualization use cases and have not been written with malicious guests in mind.
As a general rule either virtio-net or xen-net should be used in all virtualized guests requiring a security boundary.
There are a handful of exceptions resulting from historical usage in the x86 world, to support virtualized guests lacking virtio support.
Thus the rtl8139, e1000, e1000e & IGB NICs are declared to provide a security boundary.
The PPC sPAPR Virtual LAN device is also marked secure.
Quoted 8 lines
Signed-off-by Daniel P. Berrangé <[email protected]>--- hw/net/e1000.c | 1 + hw/net/e1000e.c | 1 + hw/net/igb.c | 1 + hw/net/rtl8139.c | 1 + hw/net/spapr_llan.c | 1 + 5 files changed, 5 insertions(+)
I'd maybe drop rtl8139 from the list, AFAIK most old operating systems should support e1000 just fine?
Anyway,
PATCH v2 8/28 hw/usb: mark commonly used USB devices/hosts as secure
In reply to Daniel P. BerrangéModern virtualized guests are expected to be deployed with the XHCI controller which supports all of USB 1, 2 and 3, so should be declared secure.
The "NEC" XHCI variant is slightly non-standard, but since it is a trivial sub-class of the generic XHCI, there's no reason to exclude it.
The set of devices that are expected to be used is HID (mouse, tablet, keyboard), host passthrough, CCID (smartcard), hub, storage and the redirect tunnelling.
--- hw/usb/ccid-card-emulated.c | 1 + hw/usb/ccid-card-passthru.c | 1 + hw/usb/dev-hid.c | 3 +++ hw/usb/dev-hub.c | 1 + hw/usb/dev-smartcard-reader.c | 2 ++ hw/usb/dev-storage-bot.c | 1 + hw/usb/dev-storage-classic.c | 1 + hw/usb/hcd-xhci-nec.c | 1 + hw/usb/hcd-xhci-pci.c | 1 + hw/usb/hcd-xhci-sysbus.c | 3 ++- hw/usb/hcd-xhci.c | 1 + hw/usb/host-libusb.c | 1 + hw/usb/redirect.c | 1 + 13 files changed, 17 insertions(+), 1 deletion(-)
hw/usb/ccid-card-emulated.c +1 -0
@@ -612,6 +612,7 @@ static const TypeInfo emulated_card_info = { .parent = TYPE_CCID_CARD, .instance_size = sizeof(EmulatedState), .class_init = emulated_class_initfn, + .secure = true, };module_obj (TYPE_EMULATED_CCID );module_kconfig (USB );
hw/usb/ccid-card-passthru.c +1 -0
@@ -413,6 +413,7 @@ static const TypeInfo passthru_card_info = { .parent = TYPE_CCID_CARD, .instance_size = sizeof(PassthruState), .class_init = passthru_class_initfn, + .secure = true, };module_obj (TYPE_CCID_PASSTHRU );module_kconfig (USB );
hw/usb/dev-hid.c +3 -0
@@ -815,6 +815,7 @@ static const TypeInfo usb_tablet_info = { .name = "usb-tablet", .parent = TYPE_USB_HID, .class_init = usb_tablet_class_initfn, + .secure = true, };static const Property usb_mouse_properties[] = {
@@ -837,6 +838,7 @@ static const TypeInfo usb_mouse_info = { .name = "usb-mouse", .parent = TYPE_USB_HID, .class_init = usb_mouse_class_initfn, + .secure = true, };static const Property usb_keyboard_properties[] = {
@@ -860,6 +862,7 @@ static const TypeInfo usb_keyboard_info = { .name = "usb-kbd", .parent = TYPE_USB_HID, .class_init = usb_keyboard_class_initfn, + .secure = true, };static void usb_hid_register_types (void )
hw/usb/dev-hub.c +1 -0
@@ -694,6 +694,7 @@ static const TypeInfo hub_info = { .parent = TYPE_USB_DEVICE, .instance_size = sizeof(USBHubState), .class_init = usb_hub_class_initfn, + .secure = true, };static void usb_hub_register_types (void )
hw/usb/dev-smartcard-reader.c +2 -0
@@ -1405,6 +1405,7 @@ static const TypeInfo ccid_bus_info = { .name = TYPE_CCID_BUS, .parent = TYPE_BUS, .instance_size = sizeof(CCIDBus), + .secure = true, }; void ccid_card_send_apdu_to_guest(CCIDCardState *card,
@@ -1779,6 +1780,7 @@ static const TypeInfo ccid_info = { .parent = TYPE_USB_DEVICE, .instance_size = sizeof(USBCCIDState), .class_init = ccid_class_initfn, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_HOTPLUG_HANDLER }, { }
hw/usb/dev-storage-bot.c +1 -0
@@ -52,6 +52,7 @@ static const TypeInfo bot_info = { .name = "usb-bot", .parent = TYPE_USB_STORAGE, .class_init = usb_msd_class_bot_initfn, + .secure = true, };static void register_types (void )
hw/usb/dev-storage-classic.c +1 -0
@@ -133,6 +133,7 @@ static const TypeInfo msd_info = { .parent = TYPE_USB_STORAGE, .class_init = usb_msd_class_storage_initfn, .instance_init = usb_msd_instance_init, + .secure = true, };static void register_types (void )
hw/usb/hcd-xhci-nec.c +1 -0
@@ -67,6 +67,7 @@ static const TypeInfo nec_xhci_info = { .instance_size = sizeof(XHCINecState), .instance_init = nec_xhci_instance_init, .class_init = nec_xhci_class_init, + .secure = true, };static void nec_xhci_register_types (void )
hw/usb/hcd-xhci-pci.c +1 -0
@@ -298,6 +298,7 @@ static const TypeInfo qemu_xhci_info = { .parent = TYPE_XHCI_PCI, .class_init = qemu_xhci_class_init, .instance_init = qemu_xhci_instance_init, + .secure = true, };static void xhci_register_types (void )
hw/usb/hcd-xhci-sysbus.c +2 -1
@@ -112,7 +112,8 @@ static const TypeInfo xhci_sysbus_info = { .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(XHCISysbusState), .class_init = xhci_sysbus_class_init, - .instance_init = xhci_sysbus_instance_init + .instance_init = xhci_sysbus_instance_init, + .secure = true, };static void xhci_sysbus_register_types (void )
hw/usb/hcd-xhci.c +1 -0
@@ -3705,6 +3705,7 @@ static const TypeInfo xhci_info = { .parent = TYPE_DEVICE, .instance_size = sizeof(XHCIState), .class_init = xhci_class_init, + .secure = true, };static void xhci_register_types (void )
hw/usb/host-libusb.c +1 -0
@@ -1839,6 +1839,7 @@ static const TypeInfo usb_host_dev_info = { .instance_size = sizeof(USBHostDevice), .class_init = usb_host_class_initfn, .instance_init = usb_host_instance_init, + .secure = true, };module_obj (TYPE_USB_HOST_DEVICE );module_kconfig (USB );
hw/usb/redirect.c +1 -0
@@ -2655,6 +2655,7 @@ static const TypeInfo usbredir_dev_info = { .instance_size = sizeof(USBRedirDevice), .class_init = usbredir_class_initfn, .instance_init = usbredir_instance_init, + .secure = true, };module_obj (TYPE_USB_REDIR );module_kconfig (USB );
Signature · 1 line
2.56.0
Re: [PATCH v2 08/28] hw/usb: mark commonly used USB devices/hosts as secure
Quoted 28 lines · Daniel P. Berrangé
Modern virtualized guests are expected to be deployed with the XHCI controller which supports all of USB 1, 2 and 3, so should be declared secure.
The "NEC" XHCI variant is slightly non-standard, but since it is a trivial sub-class of the generic XHCI, there's no reason to exclude it.
The set of devices that are expected to be used is HID (mouse, tablet, keyboard), host passthrough, CCID (smartcard), hub, storage and the redirect tunnelling.
Signed-off-by Daniel P. Berrangé <[email protected]>--- hw/usb/ccid-card-emulated.c | 1 + hw/usb/ccid-card-passthru.c | 1 + hw/usb/dev-hid.c | 3 +++ hw/usb/dev-hub.c | 1 + hw/usb/dev-smartcard-reader.c | 2 ++ hw/usb/dev-storage-bot.c | 1 + hw/usb/dev-storage-classic.c | 1 + hw/usb/hcd-xhci-nec.c | 1 + hw/usb/hcd-xhci-pci.c | 1 + hw/usb/hcd-xhci-sysbus.c | 3 ++- hw/usb/hcd-xhci.c | 1 + hw/usb/host-libusb.c | 1 + hw/usb/redirect.c | 1 + 13 files changed, 17 insertions(+), 1 deletion(-)
...
Quoted 17 lines
hw/usb/dev-storage-bot.c +1
-0@@ -52,6 +52,7 @@ static const TypeInfo bot_info = { .name = "usb-bot", .parent = TYPE_USB_STORAGE, .class_init = usb_msd_class_bot_initfn, + .secure = true, };static void register_types (void )hw/usb/dev-storage-classic.c +0
-0
hw/usb/dev-storage-classic.c static const TypeInfo msd_info = { · line 137
Quoted 5 lines
hw/usb/dev-storage-classic.c +1
-0@@ -133,6 +133,7 @@ static const TypeInfo msd_info = { .parent = TYPE_USB_STORAGE, .class_init = usb_msd_class_storage_initfn, .instance_init = usb_msd_instance_init, + .secure = true, };
Can we exclude usb-bot and usb-storage from the secure list? I've never seen them really being used for real virtualization installations, and I think they are not that well tested?
With those two hunks being removed:
Re: [PATCH v2 08/28] hw/usb: mark commonly used USB devices/hosts as secure
Quoted 46 lines · Thomas Huth
Quoted 28 lines · Daniel P. Berrangé
Modern virtualized guests are expected to be deployed with the XHCI controller which supports all of USB 1, 2 and 3, so should be declared secure.
The "NEC" XHCI variant is slightly non-standard, but since it is a trivial sub-class of the generic XHCI, there's no reason to exclude it.
The set of devices that are expected to be used is HID (mouse, tablet, keyboard), host passthrough, CCID (smartcard), hub, storage and the redirect tunnelling.
Signed-off-by Daniel P. Berrangé <[email protected]>--- hw/usb/ccid-card-emulated.c | 1 + hw/usb/ccid-card-passthru.c | 1 + hw/usb/dev-hid.c | 3 +++ hw/usb/dev-hub.c | 1 + hw/usb/dev-smartcard-reader.c | 2 ++ hw/usb/dev-storage-bot.c | 1 + hw/usb/dev-storage-classic.c | 1 + hw/usb/hcd-xhci-nec.c | 1 + hw/usb/hcd-xhci-pci.c | 1 + hw/usb/hcd-xhci-sysbus.c | 3 ++- hw/usb/hcd-xhci.c | 1 + hw/usb/host-libusb.c | 1 + hw/usb/redirect.c | 1 + 13 files changed, 17 insertions(+), 1 deletion(-)...
Quoted 16 lines
hw/usb/dev-storage-bot.c +1
-0@@ -52,6 +52,7 @@ static const TypeInfo bot_info = { .name = "usb-bot", .parent = TYPE_USB_STORAGE, .class_init = usb_msd_class_bot_initfn, + .secure = true, };static void register_types (void )hw/usb/dev-storage-classic.c +0
-0@@ -133,6 +133,7 @@ static const TypeInfo msd_info = {
Quoted 8 lines
hw/usb/dev-storage-classic.c static const TypeInfo msd_info = { · line 137
Quoted 5 lines
hw/usb/dev-storage-classic.c +1
-0.parent = TYPE_USB_STORAGE, .class_init = usb_msd_class_storage_initfn, .instance_init = usb_msd_instance_init, + .secure = true, };Can we exclude usb-bot and usb-storage from the secure list? I've never seen them really being used for real virtualization installations, and I think they are not that well tested?
We've shipped them as part of RHEL essentially forever so from a downstream POV we're on the hook to support them.
I would see them as a way to provide adhoc removable storage to a VM which doesn't require any special drivers, since everything supports USB storage for 20+ years. We don't have a SCSI controller beyond virtio-scsi that's declared secure, and SCSI isn't accessible to unprivileged users, so USB is useful for desktop virtualization use cases IMHO.
Quoted 4 lines
With those two hunks being removed:
Reviewed-by Thomas Huth <[email protected]>
With regards,
Daniel
Signature · 3 lines
|: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
PATCH v2 9/28 hw/watchdog: mark some watchdog devices as secure
In reply to Daniel P. BerrangéThe ib700, i6300esb, gwdt, spapr and diag288 watchdog devices are marked as secure since they have traditionally been, or are intended to be, used in virtualization use cases on x86, arm, ppc and s390x architectures respectively. Other watchdogs are primarily for emulation.
--- hw/watchdog/sbsa_gwdt.c | 1 + hw/watchdog/spapr_watchdog.c | 1 + hw/watchdog/wdt_diag288.c | 1 + hw/watchdog/wdt_i6300esb.c | 1 + hw/watchdog/wdt_ib700.c | 1 + 5 files changed, 5 insertions(+)
hw/watchdog/sbsa_gwdt.c +1 -0
@@ -340,6 +340,7 @@ static const TypeInfo wdt_sbsa_gwdt_info = { .parent = TYPE_SYS_BUS_DEVICE, .name = TYPE_WDT_SBSA, .instance_size = sizeof(SBSA_GWDTState), + .secure = true, };static void wdt_sbsa_gwdt_register_types (void )
hw/watchdog/spapr_watchdog.c +1 -0
@@ -269,6 +269,7 @@ static const TypeInfo spapr_wdt_info = { .parent = TYPE_DEVICE, .instance_size = sizeof(SpaprWatchdog), .class_init = spapr_wdt_class_init, + .secure = true, };static void spapr_watchdog_register_types (void )
hw/watchdog/wdt_diag288.c +1 -0
@@ -129,6 +129,7 @@ static const TypeInfo wdt_diag288_info = { .name = TYPE_WDT_DIAG288, .instance_size = sizeof(DIAG288State), .class_size = sizeof(DIAG288Class), + .secure = true, };static void wdt_diag288_register_types (void )
hw/watchdog/wdt_i6300esb.c +1 -0
@@ -480,6 +480,7 @@ static const TypeInfo i6300esb_info = { .parent = TYPE_PCI_DEVICE, .instance_size = sizeof(I6300State), .class_init = i6300esb_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
hw/watchdog/wdt_ib700.c +1 -0
@@ -144,6 +144,7 @@ static const TypeInfo wdt_ib700_info = { .parent = TYPE_ISA_DEVICE, .instance_size = sizeof(IB700State), .class_init = wdt_ib700_class_init, + .secure = true, };static void wdt_ib700_register_types (void )
Signature · 1 line
2.56.0
Re: [PATCH v2 09/28] hw/watchdog: mark some watchdog devices as secure
Quoted 8 lines · Daniel P. Berrangé
The ib700, i6300esb, gwdt, spapr and diag288 watchdog devices are marked as secure since they have traditionally been, or are intended to be, used in virtualization use cases on x86, arm, ppc and s390x architectures respectively. Other watchdogs are primarily for emulation.
Signed-off-by Daniel P. Berrangé <[email protected]>
Quoted 7 lines
--- hw/watchdog/sbsa_gwdt.c | 1 + hw/watchdog/spapr_watchdog.c | 1 + hw/watchdog/wdt_diag288.c | 1 + hw/watchdog/wdt_i6300esb.c | 1 + hw/watchdog/wdt_ib700.c | 1 + 5 files changed, 5 insertions(+)
PATCH v2 10/28 hw/scsi: mark spapr SCSI controller as secure
In reply to Daniel P. BerrangéThe spapr vscsi controller is used by default with spapr machines in a virtualization use case.
--- hw/scsi/spapr_vscsi.c | 1 + 1 file changed, 1 insertion(+)
hw/scsi/spapr_vscsi.c +1 -0
@@ -1312,6 +1312,7 @@ static const TypeInfo spapr_vscsi_info = { .parent = TYPE_VIO_SPAPR_DEVICE, .instance_size = sizeof(VSCSIState), .class_init = spapr_vscsi_class_init, + .secure = true, };static void spapr_vscsi_register_types (void )
Signature · 1 line
2.56.0
Re: [PATCH v2 10/28] hw/scsi: mark spapr SCSI controller as secure
Quoted 14 lines · Daniel P. Berrangé
The spapr vscsi controller is used by default with spapr machines in a virtualization use case.
Signed-off-by Daniel P. Berrangé <[email protected]>--- hw/scsi/spapr_vscsi.c | 1 + 1 file changed, 1 insertion(+)hw/scsi/spapr_vscsi.c +0
-0
hw/scsi/spapr_vscsi.c static const TypeInfo spapr_vscsi_info = { · line 1318
Quoted 7 lines
hw/scsi/spapr_vscsi.c +1
-0@@ -1312,6 +1312,7 @@ static const TypeInfo spapr_vscsi_info = { .parent = TYPE_VIO_SPAPR_DEVICE, .instance_size = sizeof(VSCSIState), .class_init = spapr_vscsi_class_init, + .secure = true, };static void spapr_vscsi_register_types (void )
PATCH v2 11/28 hw/scsi: mark SCSI disk endpoint devices as secure
In reply to Daniel P. BerrangéAll these devices can be used together with supported SCSI controllers in a virtualization use case, so must be treated as secure.
--- hw/scsi/scsi-disk.c | 3 +++ hw/scsi/scsi-generic.c | 1 + 2 files changed, 4 insertions(+)
hw/scsi/scsi-disk.c +3 -0
@@ -3370,6 +3370,7 @@ static const TypeInfo scsi_hd_info = { .name = "scsi-hd", .parent = TYPE_SCSI_DISK_BASE, .class_init = scsi_hd_class_initfn, + .secure = true, };static const Property scsi_cd_properties[] = {
@@ -3413,6 +3414,7 @@ static const TypeInfo scsi_cd_info = { .name = "scsi-cd", .parent = TYPE_SCSI_DISK_BASE, .class_init = scsi_cd_class_initfn, + .secure = true, };#ifdef __linux__
@@ -3455,6 +3457,7 @@ static const TypeInfo scsi_block_info = { .name = "scsi-block", .parent = TYPE_SCSI_DISK_BASE, .class_init = scsi_block_class_initfn, + .secure = true, };#endif
hw/scsi/scsi-generic.c +1 -0
@@ -1259,6 +1259,7 @@ static const TypeInfo scsi_generic_info = { .parent = TYPE_SCSI_DEVICE, .instance_size = sizeof(SCSIDevice), .class_init = scsi_generic_class_initfn, + .secure = true, };static void scsi_generic_register_types (void )
Signature · 1 line
2.56.0
Re: [PATCH v2 11/28] hw/scsi: mark SCSI disk endpoint devices as secure
Quoted 9 lines · Daniel P. Berrangé
All these devices can be used together with supported SCSI controllers in a virtualization use case, so must be treated as secure.
Signed-off-by Daniel P. Berrangé <[email protected]>--- hw/scsi/scsi-disk.c | 3 +++ hw/scsi/scsi-generic.c | 1 + 2 files changed, 4 insertions(+)
PATCH v2 12/28 hw/ide: mark ICH9 and ide-hd/ide-cd as secure
In reply to Daniel P. BerrangéThese have a long history of usage in virtualization scenarios on x86, for OS which lack modern virtio drivers for storage, and thus must be considered secure.
--- hw/ide/ich.c | 1 + hw/ide/ide-dev.c | 2 ++ hw/ide/piix.c | 2 ++ 3 files changed, 5 insertions(+)
hw/ide/ich.c +1 -0
@@ -198,6 +198,7 @@ static const TypeInfo ich_ahci_info = { .instance_size = sizeof(AHCIPCIState), .instance_init = pci_ich9_ahci_init, .class_init = ich_ahci_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
hw/ide/ide-dev.c +2 -0
@@ -214,6 +214,7 @@ static const TypeInfo ide_hd_info = { .parent = TYPE_IDE_DEVICE, .instance_size = sizeof(IDEDrive), .class_init = ide_hd_class_init, + .secure = true, };static const Property ide_cd_properties[] = {
@@ -236,6 +237,7 @@ static const TypeInfo ide_cd_info = { .parent = TYPE_IDE_DEVICE, .instance_size = sizeof(IDEDrive), .class_init = ide_cd_class_init, + .secure = true, };static void ide_device_class_init (ObjectClass *klass,const void *data)
hw/ide/piix.c +2 -0
@@ -198,6 +198,7 @@ static const TypeInfo piix3_ide_info = { .name = TYPE_PIIX3_IDE, .parent = TYPE_PCI_IDE, .class_init = piix3_ide_class_init, + .secure = true, };/* NOTE: for the PIIX4, the IRQs and IOports are hardcoded */
@@ -221,6 +222,7 @@ static const TypeInfo piix4_ide_info = { .name = TYPE_PIIX4_IDE, .parent = TYPE_PCI_IDE, .class_init = piix4_ide_class_init, + .secure = true, };static void piix_ide_register_types (void )
Signature · 1 line
2.56.0
Re: [PATCH v2 12/28] hw/ide: mark ICH9 and ide-hd/ide-cd as secure
Quoted 11 lines · Daniel P. Berrangé
These have a long history of usage in virtualization scenarios on x86, for OS which lack modern virtio drivers for storage, and thus must be considered secure.
Signed-off-by Daniel P. Berrangé <[email protected]>--- hw/ide/ich.c | 1 + hw/ide/ide-dev.c | 2 ++ hw/ide/piix.c | 2 ++ 3 files changed, 5 insertions(+)
PATCH v2 13/28 hw: define most common PCI types as secure
In reply to Daniel P. BerrangéEssentially all PCI infrastructure is in scope for the virtualization use case, aside from the niche simba bridge and the CXL related pieces.
--- hw/pci-bridge/gen_pcie_root_port.c | 1 + hw/pci-bridge/i82801b11.c | 1 + hw/pci-bridge/ioh3420.c | 1 + hw/pci-bridge/pci_bridge_dev.c | 2 ++ hw/pci-bridge/pci_expander_bridge.c | 5 +++++ hw/pci-bridge/pcie_pci_bridge.c | 1 + hw/pci-bridge/xio3130_downstream.c | 1 + hw/pci-bridge/xio3130_upstream.c | 1 + hw/pci/pci.c | 4 ++++ 9 files changed, 17 insertions(+)
hw/pci-bridge/gen_pcie_root_port.c +1 -0
@@ -161,6 +161,7 @@ static const TypeInfo gen_rp_dev_info = { .parent = TYPE_PCIE_ROOT_PORT, .instance_size = sizeof(GenPCIERootPort), .class_init = gen_rp_dev_class_init, + .secure = true, };static void gen_rp_register_types (void )
hw/pci-bridge/i82801b11.c +1 -0
@@ -107,6 +107,7 @@ static const TypeInfo i82801b11_bridge_info = { .parent = TYPE_PCI_BRIDGE, .instance_size = sizeof(I82801b11Bridge), .class_init = i82801b11_bridge_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
hw/pci-bridge/ioh3420.c +1 -0
@@ -120,6 +120,7 @@ static const TypeInfo ioh3420_info = { .name = "ioh3420", .parent = TYPE_PCIE_ROOT_PORT, .class_init = ioh3420_class_init, + .secure = true, };static void ioh3420_register_types (void )
hw/pci-bridge/pci_bridge_dev.c +2 -0
@@ -268,6 +268,7 @@ static const TypeInfo pci_bridge_dev_info = { .instance_size = sizeof(PCIBridgeDev), .class_init = pci_bridge_dev_class_init, .instance_finalize = pci_bridge_dev_instance_finalize, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_HOTPLUG_HANDLER }, {INTERFACE_CONVENTIONAL_PCI_DEVICE },
@@ -294,6 +295,7 @@ static const TypeInfo pci_bridge_dev_seat_info = { .parent = TYPE_PCI_BRIDGE_DEV, .instance_size = sizeof(PCIBridgeDev), .class_init = pci_bridge_dev_seat_class_init, + .secure = true, };static void pci_bridge_dev_register (void )
hw/pci-bridge/pci_expander_bridge.c +5 -0
@@ -114,6 +114,7 @@ static const TypeInfo pxb_bus_info = { .parent = TYPE_PCI_BUS, .instance_size = sizeof(PXBBus), .class_init = pxb_bus_class_init, + .secure = true, };static const TypeInfo pxb_pcie_bus_info = {
@@ -121,6 +122,7 @@ static const TypeInfo pxb_pcie_bus_info = { .parent = TYPE_PCIE_BUS, .instance_size = sizeof(PXBBus), .class_init = pxb_bus_class_init, + .secure = true, };static const TypeInfo pxb_cxl_bus_info = {
@@ -190,6 +192,7 @@ static const TypeInfo pxb_host_info = { .name = TYPE_PXB_HOST, .parent = TYPE_PCI_HOST_BRIDGE, .class_init = pxb_host_class_init, + .secure = true, };static void pxb_cxl_realize (DeviceState *dev,Error **errp)
@@ -453,6 +456,7 @@ static const TypeInfo pxb_dev_info = { .parent = TYPE_PCI_DEVICE, .instance_size = sizeof(PXBDev), .class_init = pxb_dev_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
@@ -490,6 +494,7 @@ static const TypeInfo pxb_pcie_dev_info = { .parent = TYPE_PXB_DEV, .instance_size = sizeof(PXBPCIEDev), .class_init = pxb_pcie_dev_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
hw/pci-bridge/pcie_pci_bridge.c +1 -0
@@ -162,6 +162,7 @@ static const TypeInfo pcie_pci_bridge_info = { .parent = TYPE_PCI_BRIDGE, .instance_size = sizeof(PCIEPCIBridge), .class_init = pcie_pci_bridge_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_HOTPLUG_HANDLER }, {INTERFACE_PCIE_DEVICE },
hw/pci-bridge/xio3130_downstream.c +1 -0
@@ -175,6 +175,7 @@ static const TypeInfo xio3130_downstream_info = { .name = TYPE_XIO3130_DOWNSTREAM, .parent = TYPE_PCIE_SLOT, .class_init = xio3130_downstream_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_PCIE_DEVICE }, { }
hw/pci-bridge/xio3130_upstream.c +1 -0
@@ -144,6 +144,7 @@ static const TypeInfo xio3130_upstream_info = { .name = "x3130-upstream", .parent = TYPE_PCIE_PORT, .class_init = xio3130_upstream_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_PCIE_DEVICE }, { }
hw/pci/pci.c +4 -0
@@ -319,6 +319,7 @@ static const TypeInfo pci_bus_info = { .instance_size = sizeof(PCIBus), .class_size = sizeof(PCIBusClass), .class_init = pci_bus_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_FW_CFG_DATA_GENERATOR_INTERFACE }, { }
@@ -333,11 +334,13 @@ static const TypeInfo cxl_interface_info = {static const TypeInfo pcie_interface_info = { .name =INTERFACE_PCIE_DEVICE , .parent =TYPE_INTERFACE , + .secure = true, };static const TypeInfo conventional_pci_interface_info = { .name =INTERFACE_CONVENTIONAL_PCI_DEVICE , .parent =TYPE_INTERFACE , + .secure = true, };static void pcie_bus_class_init (ObjectClass *klass,const void *data)
@@ -351,6 +354,7 @@ static const TypeInfo pcie_bus_info = { .name = TYPE_PCIE_BUS, .parent = TYPE_PCI_BUS, .class_init = pcie_bus_class_init, + .secure = true, };static const TypeInfo cxl_bus_info = {
Signature · 1 line
2.56.0
Re: [PATCH v2 13/28] hw: define most common PCI types as secure
Quoted 4 lines · Daniel P. Berrangé
Essentially all PCI infrastructure is in scope for the virtualization use case, aside from the niche simba bridge and the CXL related pieces.
Signed-off-by Daniel P. Berrangé <[email protected]>
Quoted 11 lines
--- hw/pci-bridge/gen_pcie_root_port.c | 1 + hw/pci-bridge/i82801b11.c | 1 + hw/pci-bridge/ioh3420.c | 1 + hw/pci-bridge/pci_bridge_dev.c | 2 ++ hw/pci-bridge/pci_expander_bridge.c | 5 +++++ hw/pci-bridge/pcie_pci_bridge.c | 1 + hw/pci-bridge/xio3130_downstream.c | 1 + hw/pci-bridge/xio3130_upstream.c | 1 + hw/pci/pci.c | 4 ++++ 9 files changed, 17 insertions(+)
Re: [PATCH v2 13/28] hw: define most common PCI types as secure
In reply to Daniel P. BerrangéQuoted 4 lines · Daniel P. Berrangé
Essentially all PCI infrastructure is in scope for the virtualization use case, aside from the niche simba bridge and the CXL related pieces.
Signed-off-by Daniel P. Berrangé <[email protected]>
Quoted 11 lines
--- hw/pci-bridge/gen_pcie_root_port.c | 1 + hw/pci-bridge/i82801b11.c | 1 + hw/pci-bridge/ioh3420.c | 1 + hw/pci-bridge/pci_bridge_dev.c | 2 ++ hw/pci-bridge/pci_expander_bridge.c | 5 +++++ hw/pci-bridge/pcie_pci_bridge.c | 1 + hw/pci-bridge/xio3130_downstream.c | 1 + hw/pci-bridge/xio3130_upstream.c | 1 + hw/pci/pci.c | 4 ++++ 9 files changed, 17 insertions(+)
PATCH v2 14/28 hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts as secure
In reply to Daniel P. BerrangéMark the PCI hosts secure if they are used from machine types that are considered for the virtualization use case.
There is also a special case for the 'remote' type and the Xen passthrough type.
--- hw/pci-host/gpex.c | 2 ++ hw/pci-host/i440fx.c | 2 ++ hw/pci-host/pnv_phb.c | 2 ++ hw/pci-host/pnv_phb3.c | 3 +++ hw/pci-host/pnv_phb3_msi.c | 1 + hw/pci-host/pnv_phb3_pbcq.c | 1 + hw/pci-host/pnv_phb4.c | 4 +++- hw/pci-host/pnv_phb4_pec.c | 1 + hw/pci-host/q35.c | 2 ++ hw/pci-host/remote.c | 1 + hw/pci-host/xen_igd_pt.c | 1 + hw/ppc/spapr_pci.c | 1 + hw/s390x/s390-pci-bus.c | 4 ++++ 13 files changed, 24 insertions(+), 1 deletion(-)
hw/pci-host/gpex.c +2 -0
@@ -220,6 +220,7 @@ static const TypeInfo gpex_host_info = { .instance_size = sizeof(GPEXHost), .instance_init = gpex_host_initfn, .class_init = gpex_host_class_init, + .secure = true, };/****************************************************************************
@@ -259,6 +260,7 @@ static const TypeInfo gpex_root_info = { .parent = TYPE_PCI_DEVICE, .instance_size = sizeof(GPEXRootState), .class_init = gpex_root_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
hw/pci-host/i440fx.c +2 -0
@@ -352,6 +352,7 @@ static const TypeInfo i440fx_info = { .parent = TYPE_PCI_DEVICE, .instance_size = sizeof(PCII440FXState), .class_init = i440fx_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
@@ -410,6 +411,7 @@ static const TypeInfo i440fx_pcihost_info = { .instance_size = sizeof(I440FXState), .instance_init = i440fx_pcihost_initfn, .class_init = i440fx_pcihost_class_init, + .secure = true, };static void i440fx_register_types (void )
hw/pci-host/pnv_phb.c +2 -0
@@ -333,6 +333,7 @@ static const TypeInfo pnv_phb_type_info = { .parent = TYPE_PCIE_HOST_BRIDGE, .instance_size = sizeof(PnvPHB), .class_init = pnv_phb_class_init, + .secure = true, };static const TypeInfo pnv_phb_root_port_info = {
@@ -340,6 +341,7 @@ static const TypeInfo pnv_phb_root_port_info = { .parent = TYPE_PCIE_ROOT_PORT, .instance_size = sizeof(PnvPHBRootPort), .class_init = pnv_phb_root_port_class_init, + .secure = true, };static void pnv_phb_register_types (void )
hw/pci-host/pnv_phb3.c +3 -0
@@ -910,6 +910,7 @@ static const TypeInfo pnv_phb3_iommu_memory_region_info = { .parent = TYPE_IOMMU_MEMORY_REGION, .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION, .class_init = pnv_phb3_iommu_memory_region_class_init, + .secure = true, };/*
@@ -1123,6 +1124,7 @@ static const TypeInfo pnv_phb3_type_info = { .instance_size = sizeof(PnvPHB3), .class_init = pnv_phb3_class_init, .instance_init = pnv_phb3_instance_init, + .secure = true, }; static void pnv_phb3_root_bus_get_prop(Object *obj, Visitor *v,
@@ -1186,6 +1188,7 @@ static const TypeInfo pnv_phb3_root_bus_info = { .parent = TYPE_PCIE_BUS, .instance_size = sizeof(PnvPHB3RootBus), .class_init = pnv_phb3_root_bus_class_init, + .secure = true, };static void pnv_phb3_register_types (void )
hw/pci-host/pnv_phb3_msi.c +1 -0
@@ -306,6 +306,7 @@ static const TypeInfo phb3_msi_info = { .class_init = phb3_msi_class_init, .class_size = sizeof(ICSStateClass), .instance_init = phb3_msi_instance_init, + .secure = true, };static void pnv_phb3_msi_register_types (void )
hw/pci-host/pnv_phb3_pbcq.c +1 -0
@@ -354,6 +354,7 @@ static const TypeInfo pnv_pbcq_type_info = { .instance_size = sizeof(PnvPBCQState), .instance_init = phb3_pbcq_instance_init, .class_init = pnv_pbcq_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_PNV_XSCOM_INTERFACE }, { }
hw/pci-host/pnv_phb4.c +3 -1
@@ -1388,6 +1388,7 @@ static const TypeInfo pnv_phb4_iommu_memory_region_info = { .parent = TYPE_IOMMU_MEMORY_REGION, .name = TYPE_PNV_PHB4_IOMMU_MEMORY_REGION, .class_init = pnv_phb4_iommu_memory_region_class_init, + .secure = true, };/*
@@ -1729,13 +1730,13 @@ static const TypeInfo pnv_phb4_type_info = { .instance_init = pnv_phb4_instance_init, .instance_size = sizeof(PnvPHB4), .class_init = pnv_phb4_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_XIVE_NOTIFIER }, { }, } }; -static void pnv_phb4_root_bus_get_prop (Object *obj,Visitor *v,const char *name,void *opaque,Error **errp)
@@ -1797,6 +1798,7 @@ static const TypeInfo pnv_phb4_root_bus_info = { .parent = TYPE_PCIE_BUS, .instance_size = sizeof(PnvPHB4RootBus), .class_init = pnv_phb4_root_bus_class_init, + .secure = true, };static void pnv_phb4_register_types (void )
hw/pci-host/pnv_phb4_pec.c +1 -0
@@ -388,6 +388,7 @@ static const TypeInfo pnv_pec_type_info = { .instance_size = sizeof(PnvPhb4PecState), .class_init = pnv_pec_class_init, .class_size = sizeof(PnvPhb4PecClass), + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_PNV_XSCOM_INTERFACE }, { }
hw/pci-host/q35.c +2 -0
@@ -268,6 +268,7 @@ static const TypeInfo q35_host_info = { .instance_size = sizeof(Q35PCIHost), .instance_init = q35_host_initfn, .class_init = q35_host_class_init, + .secure = true, };/****************************************************************************
@@ -718,6 +719,7 @@ static const TypeInfo mch_info = { .parent = TYPE_PCI_DEVICE, .instance_size = sizeof(MCHPCIState), .class_init = mch_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
hw/pci-host/remote.c +1 -0
@@ -63,6 +63,7 @@ static const TypeInfo remote_pcihost_info = { .parent = TYPE_PCIE_HOST_BRIDGE, .instance_size = sizeof(RemotePCIHost), .class_init = remote_pcihost_class_init, + .secure = true, };static void remote_pcihost_register (void )
hw/pci-host/xen_igd_pt.c +1 -0
@@ -110,6 +110,7 @@ static const TypeInfo igd_passthrough_i440fx_info = { .parent = TYPE_I440FX_PCI_DEVICE, .instance_size = sizeof(PCII440FXState), .class_init = igd_passthrough_i440fx_class_init, + .secure = true, };static void igd_pt_i440fx_register_types (void )
hw/ppc/spapr_pci.c +1 -0
@@ -2174,6 +2174,7 @@ static const TypeInfo spapr_phb_info = { .instance_size = sizeof(SpaprPhbState), .instance_finalize = spapr_phb_finalizefn, .class_init = spapr_phb_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_HOTPLUG_HANDLER }, { }
hw/s390x/s390-pci-bus.c +4 -0
@@ -1678,6 +1678,7 @@ static const TypeInfo s390_pcihost_info = { .parent = TYPE_PCI_HOST_BRIDGE, .instance_size = sizeof(S390pciState), .class_init = s390_pcihost_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_HOTPLUG_HANDLER }, { }
@@ -1711,6 +1712,7 @@ static const TypeInfo s390_pcibus_info = {* if a device is unplugged and plugged back, preventing migration. */ .class_init = s390_pcibus_class_init, + .secure = true, };static uint16_t s390_pci_generate_uid (S390pciState *s)
@@ -2033,12 +2035,14 @@ static const TypeInfo s390_pci_device_info = { .parent = TYPE_DEVICE, .instance_size = sizeof(S390PCIBusDevice), .class_init = s390_pci_device_class_init, + .secure = true, };static const TypeInfo s390_pci_iommu_info = { .name =TYPE_S390_PCI_IOMMU , .parent =TYPE_OBJECT , .instance_size =sizeof (S390PCIIOMMU ), + .secure = true, }; static void s390_iommu_memory_region_class_init(ObjectClass *klass,
Signature · 1 line
2.56.0
Re: [PATCH v2 14/28] hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts as secure
Quoted 10 lines · Daniel P. Berrangé
Mark the PCI hosts secure if they are used from machine types that are considered for the virtualization use case.
There is also a special case for the 'remote' type and the Xen passthrough type.
Signed-off-by Daniel P. Berrangé <[email protected]>---
...
Quoted 112 lines
hw/pci-host/pnv_phb.c +2
-0@@ -333,6 +333,7 @@ static const TypeInfo pnv_phb_type_info = { .parent = TYPE_PCIE_HOST_BRIDGE, .instance_size = sizeof(PnvPHB), .class_init = pnv_phb_class_init, + .secure = true, };static const TypeInfo pnv_phb_root_port_info = {@@ -340,6 +341,7 @@ static const TypeInfo pnv_phb_root_port_info = { .parent = TYPE_PCIE_ROOT_PORT, .instance_size = sizeof(PnvPHBRootPort), .class_init = pnv_phb_root_port_class_init, + .secure = true, };static void pnv_phb_register_types (void )hw/pci-host/pnv_phb3.c +3
-0@@ -910,6 +910,7 @@ static const TypeInfo pnv_phb3_iommu_memory_region_info = { .parent = TYPE_IOMMU_MEMORY_REGION, .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION, .class_init = pnv_phb3_iommu_memory_region_class_init, + .secure = true, };/* @@ -1123,6 +1124,7 @@ static const TypeInfo pnv_phb3_type_info = { .instance_size = sizeof(PnvPHB3), .class_init = pnv_phb3_class_init, .instance_init = pnv_phb3_instance_init, + .secure = true, }; static void pnv_phb3_root_bus_get_prop(Object *obj, Visitor *v,@@ -1186,6 +1188,7 @@ static const TypeInfo pnv_phb3_root_bus_info = { .parent = TYPE_PCIE_BUS, .instance_size = sizeof(PnvPHB3RootBus), .class_init = pnv_phb3_root_bus_class_init, + .secure = true, };static void pnv_phb3_register_types (void )hw/pci-host/pnv_phb3_msi.c +1
-0@@ -306,6 +306,7 @@ static const TypeInfo phb3_msi_info = { .class_init = phb3_msi_class_init, .class_size = sizeof(ICSStateClass), .instance_init = phb3_msi_instance_init, + .secure = true, };static void pnv_phb3_msi_register_types (void )hw/pci-host/pnv_phb3_pbcq.c +1
-0@@ -354,6 +354,7 @@ static const TypeInfo pnv_pbcq_type_info = { .instance_size = sizeof(PnvPBCQState), .instance_init = phb3_pbcq_instance_init, .class_init = pnv_pbcq_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_PNV_XSCOM_INTERFACE }, { }hw/pci-host/pnv_phb4.c +3
-1@@ -1388,6 +1388,7 @@ static const TypeInfo pnv_phb4_iommu_memory_region_info = { .parent = TYPE_IOMMU_MEMORY_REGION, .name = TYPE_PNV_PHB4_IOMMU_MEMORY_REGION, .class_init = pnv_phb4_iommu_memory_region_class_init, + .secure = true, };/* @@ -1729,13 +1730,13 @@ static const TypeInfo pnv_phb4_type_info = { .instance_init = pnv_phb4_instance_init, .instance_size = sizeof(PnvPHB4), .class_init = pnv_phb4_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_XIVE_NOTIFIER }, { }, } }; -static void pnv_phb4_root_bus_get_prop (Object *obj,Visitor *v,const char *name,void *opaque,Error **errp)@@ -1797,6 +1798,7 @@ static const TypeInfo pnv_phb4_root_bus_info = { .parent = TYPE_PCIE_BUS, .instance_size = sizeof(PnvPHB4RootBus), .class_init = pnv_phb4_root_bus_class_init, + .secure = true, };static void pnv_phb4_register_types (void )hw/pci-host/pnv_phb4_pec.c +0
-0
hw/pci-host/pnv_phb4_pec.c static const TypeInfo pnv_pec_type_info = { · line 394
Quoted 7 lines
hw/pci-host/pnv_phb4_pec.c +1
-0@@ -388,6 +388,7 @@ static const TypeInfo pnv_pec_type_info = { .instance_size = sizeof(PnvPhb4PecState), .class_init = pnv_pec_class_init, .class_size = sizeof(PnvPhb4PecClass), + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_PNV_XSCOM_INTERFACE }, { }
The changes to the pnv* files are related to the powernv machine - which is not covered by the virtualization use case. Please remove these from your patch.
hw/pci-host/remote.c static const TypeInfo remote_pcihost_info = { · line 67
Quoted 10 lines
hw/pci-host/remote.c +1
-0@@ -63,6 +63,7 @@ static const TypeInfo remote_pcihost_info = { .parent = TYPE_PCIE_HOST_BRIDGE, .instance_size = sizeof(RemotePCIHost), .class_init = remote_pcihost_class_init, + .secure = true, };
This is part of the "remote" machine, isn't it? I don't think we cover this in the virtualization use case, do we? Please remove this, too.
Thomas
Re: [PATCH v2 14/28] hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts as secure
Quoted 118 lines · Thomas Huth
Quoted 10 lines · Daniel P. Berrangé
Mark the PCI hosts secure if they are used from machine types that are considered for the virtualization use case.
There is also a special case for the 'remote' type and the Xen passthrough type.
Signed-off-by Daniel P. Berrangé <[email protected]>---
...
Quoted 106 lines
hw/pci-host/pnv_phb.c +2
-0@@ -333,6 +333,7 @@ static const TypeInfo pnv_phb_type_info = { .parent = TYPE_PCIE_HOST_BRIDGE, .instance_size = sizeof(PnvPHB), .class_init = pnv_phb_class_init, + .secure = true, };static const TypeInfo pnv_phb_root_port_info = {@@ -340,6 +341,7 @@ static const TypeInfo pnv_phb_root_port_info = { .parent = TYPE_PCIE_ROOT_PORT, .instance_size = sizeof(PnvPHBRootPort), .class_init = pnv_phb_root_port_class_init, + .secure = true, };static void pnv_phb_register_types (void )hw/pci-host/pnv_phb3.c +3
-0@@ -910,6 +910,7 @@ static const TypeInfo pnv_phb3_iommu_memory_region_info = { .parent = TYPE_IOMMU_MEMORY_REGION, .name = TYPE_PNV_PHB3_IOMMU_MEMORY_REGION, .class_init = pnv_phb3_iommu_memory_region_class_init, + .secure = true, };/* @@ -1123,6 +1124,7 @@ static const TypeInfo pnv_phb3_type_info = { .instance_size = sizeof(PnvPHB3), .class_init = pnv_phb3_class_init, .instance_init = pnv_phb3_instance_init, + .secure = true, }; static void pnv_phb3_root_bus_get_prop(Object *obj, Visitor *v,@@ -1186,6 +1188,7 @@ static const TypeInfo pnv_phb3_root_bus_info = { .parent = TYPE_PCIE_BUS, .instance_size = sizeof(PnvPHB3RootBus), .class_init = pnv_phb3_root_bus_class_init, + .secure = true, };static void pnv_phb3_register_types (void )hw/pci-host/pnv_phb3_msi.c +1
-0@@ -306,6 +306,7 @@ static const TypeInfo phb3_msi_info = { .class_init = phb3_msi_class_init, .class_size = sizeof(ICSStateClass), .instance_init = phb3_msi_instance_init, + .secure = true, };static void pnv_phb3_msi_register_types (void )hw/pci-host/pnv_phb3_pbcq.c +1
-0@@ -354,6 +354,7 @@ static const TypeInfo pnv_pbcq_type_info = { .instance_size = sizeof(PnvPBCQState), .instance_init = phb3_pbcq_instance_init, .class_init = pnv_pbcq_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_PNV_XSCOM_INTERFACE }, { }hw/pci-host/pnv_phb4.c +3
-1@@ -1388,6 +1388,7 @@ static const TypeInfo pnv_phb4_iommu_memory_region_info = { .parent = TYPE_IOMMU_MEMORY_REGION, .name = TYPE_PNV_PHB4_IOMMU_MEMORY_REGION, .class_init = pnv_phb4_iommu_memory_region_class_init, + .secure = true, };/* @@ -1729,13 +1730,13 @@ static const TypeInfo pnv_phb4_type_info = { .instance_init = pnv_phb4_instance_init, .instance_size = sizeof(PnvPHB4), .class_init = pnv_phb4_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_XIVE_NOTIFIER }, { }, } }; -static void pnv_phb4_root_bus_get_prop (Object *obj,Visitor *v,const char *name,void *opaque,Error **errp)@@ -1797,6 +1798,7 @@ static const TypeInfo pnv_phb4_root_bus_info = { .parent = TYPE_PCIE_BUS, .instance_size = sizeof(PnvPHB4RootBus), .class_init = pnv_phb4_root_bus_class_init, + .secure = true, };static void pnv_phb4_register_types (void )hw/pci-host/pnv_phb4_pec.c +0
-0@@ -388,6 +388,7 @@ static const TypeInfo pnv_pec_type_info = { .instance_size = sizeof(PnvPhb4PecState), .class_init = pnv_pec_class_init, .class_size = sizeof(PnvPhb4PecClass),
Quoted 8 lines
hw/pci-host/pnv_phb4_pec.c static const TypeInfo pnv_pec_type_info = { · line 394
Quoted 4 lines
hw/pci-host/pnv_phb4_pec.c +1
-0+ .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_PNV_XSCOM_INTERFACE }, { }The changes to the pnv* files are related to the powernv machine - which is not covered by the virtualization use case. Please remove these from your patch.
Ah, I got misled in my search, as spapr mentions PHB, but its a different context.
Quoted 4 lines
Quoted 4 lines
hw/pci-host/remote.c +0
-0
Quoted 8 lines
hw/pci-host/remote.c static const TypeInfo remote_pcihost_info = { · line 67
Quoted 6 lines
hw/pci-host/remote.c +1
-0@@ -63,6 +63,7 @@ static const TypeInfo remote_pcihost_info = { .parent = TYPE_PCIE_HOST_BRIDGE, .instance_size = sizeof(RemotePCIHost), .class_init = remote_pcihost_class_init, + .secure = true, };This is part of the "remote" machine, isn't it? I don't think we cover this in the virtualization use case, do we? Please remove this, too.
Agreed, a mistake.
With regards,
Daniel
Signature · 3 lines
|: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|
PATCH v2 15/28 hw/display: mark bochs, ramfb and VGA as secure
In reply to Daniel P. BerrangéMost of the display adapters are emulating old hardware which is not relevant to virtualization use cases.
The clear exceptions are the generic, simple devices that should be considered secure: Bochs, RAMFB, VGA (PCI, not MMIO / ISA).
--- hw/display/bochs-display.c | 1 + hw/display/ramfb-standalone.c | 1 + hw/display/vga-pci.c | 2 ++ 3 files changed, 4 insertions(+)
hw/display/bochs-display.c +1 -0
@@ -374,6 +374,7 @@ static const TypeInfo bochs_display_type_info = { .instance_size = sizeof(BochsDisplayState), .instance_init = bochs_display_init, .class_init = bochs_display_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_PCIE_DEVICE }, {INTERFACE_CONVENTIONAL_PCI_DEVICE },
hw/display/ramfb-standalone.c +1 -0
@@ -85,6 +85,7 @@ static const TypeInfo ramfb_info = { .parent = TYPE_DYNAMIC_SYS_BUS_DEVICE, .instance_size = sizeof(RAMFBStandaloneState), .class_init = ramfb_class_initfn, + .secure = true, };static void ramfb_register_types (void )
hw/display/vga-pci.c +2 -0
@@ -407,6 +407,7 @@ static const TypeInfo vga_info = { .name = "VGA", .parent = TYPE_PCI_VGA, .class_init = vga_class_init, + .secure = true, };static const TypeInfo secondary_info = {
@@ -414,6 +415,7 @@ static const TypeInfo secondary_info = { .parent = TYPE_PCI_VGA, .instance_init = pci_secondary_vga_init, .class_init = secondary_class_init, + .secure = true, };static void vga_register_types (void )
Signature · 1 line
2.56.0
Re: [PATCH v2 15/28] hw/display: mark bochs, ramfb and VGA as secure
Quoted 6 lines · Daniel P. Berrangé
Most of the display adapters are emulating old hardware which is not relevant to virtualization use cases.
The clear exceptions are the generic, simple devices that should be considered secure: Bochs, RAMFB, VGA (PCI, not MMIO / ISA).
Quoted 6 lines
Signed-off-by Daniel P. Berrangé <[email protected]>--- hw/display/bochs-display.c | 1 + hw/display/ramfb-standalone.c | 1 + hw/display/vga-pci.c | 2 ++ 3 files changed, 4 insertions(+)
PATCH v2 16/28 hw/tpm: mark all TPM implementations as secure
In reply to Daniel P. BerrangéAll of the TPM implementations are in scope of virtualization usage, so mark them all as secure.
--- hw/ppc/spapr_tpm_proxy.c | 1 + hw/tpm/tpm_crb.c | 1 + hw/tpm/tpm_spapr.c | 1 + hw/tpm/tpm_tis_i2c.c | 1 + hw/tpm/tpm_tis_isa.c | 1 + hw/tpm/tpm_tis_sysbus.c | 1 + 6 files changed, 6 insertions(+)
hw/ppc/spapr_tpm_proxy.c +1 -0
@@ -166,6 +166,7 @@ static const TypeInfo spapr_tpm_proxy_info = { .parent = TYPE_DEVICE, .instance_size = sizeof(SpaprTpmProxy), .class_init = spapr_tpm_proxy_class_init, + .secure = true, };static void spapr_tpm_proxy_register_types (void )
hw/tpm/tpm_crb.c +1 -0
@@ -558,6 +558,7 @@ static const TypeInfo tpm_crb_info = { .parent = TYPE_DEVICE, .instance_size = sizeof(CRBState), .class_init = tpm_crb_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_TPM_IF }, { }
hw/tpm/tpm_spapr.c +1 -0
@@ -414,6 +414,7 @@ static const TypeInfo tpm_spapr_info = { .parent = TYPE_VIO_SPAPR_DEVICE, .instance_size = sizeof(SpaprTpmState), .class_init = tpm_spapr_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_TPM_IF }, { }
hw/tpm/tpm_tis_i2c.c +1 -0
@@ -551,6 +551,7 @@ static const TypeInfo tpm_tis_i2c_info = { .name = TYPE_TPM_TIS_I2C, .parent = TYPE_I2C_SLAVE, .instance_size = sizeof(TPMStateI2C), + .secure = true, .class_init = tpm_tis_i2c_class_init, .interfaces = (const InterfaceInfo []) { {TYPE_TPM_IF },
hw/tpm/tpm_tis_isa.c +1 -0
@@ -187,6 +187,7 @@ static const TypeInfo tpm_tis_isa_info = { .instance_size = sizeof(TPMStateISA), .instance_init = tpm_tis_isa_initfn, .class_init = tpm_tis_isa_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_TPM_IF }, {TYPE_ACPI_DEV_AML_IF },
hw/tpm/tpm_tis_sysbus.c +1 -0
@@ -167,6 +167,7 @@ static const TypeInfo tpm_tis_sysbus_info = { .instance_init = tpm_tis_sysbus_initfn, .instance_finalize = tpm_tis_sysbus_finalize, .class_init = tpm_tis_sysbus_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_TPM_IF }, { }
Signature · 1 line
2.56.0
PATCH v2 17/28 hw/misc: mark pvpanic, vmcoreinfo as secure
In reply to Daniel P. BerrangéThese devices are common debug aids for virtualized guests so must be marked secure.
--- hw/misc/pvpanic-isa.c | 1 + hw/misc/pvpanic-mmio.c | 1 + hw/misc/pvpanic-pci.c | 1 + hw/misc/vmcoreinfo.c | 1 + 4 files changed, 4 insertions(+)
hw/misc/pvpanic-isa.c +1 -0
@@ -121,6 +121,7 @@ static const TypeInfo pvpanic_isa_info = { .instance_size = sizeof(PVPanicISAState), .instance_init = pvpanic_isa_initfn, .class_init = pvpanic_isa_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_ACPI_DEV_AML_IF }, { },
hw/misc/pvpanic-mmio.c +1 -0
@@ -50,6 +50,7 @@ static const TypeInfo pvpanic_mmio_info = { .instance_size = sizeof(PVPanicMMIOState), .instance_init = pvpanic_mmio_initfn, .class_init = pvpanic_mmio_class_init, + .secure = true, };static void pvpanic_register_types (void )
hw/misc/pvpanic-pci.c +1 -0
@@ -80,6 +80,7 @@ static const TypeInfo pvpanic_pci_info = { .parent = TYPE_PCI_DEVICE, .instance_size = sizeof(PVPanicPCIState), .class_init = pvpanic_pci_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { }
hw/misc/vmcoreinfo.c +1 -0
@@ -101,6 +101,7 @@ static const TypeInfo vmcoreinfo_types[] = { .parent = TYPE_DEVICE, .instance_size = sizeof(VMCoreInfoState), .class_init = vmcoreinfo_device_class_init, + .secure = true, } };
Signature · 1 line
2.56.0
PATCH v2 18/28 hw/audio: mark Intel HDA devices & codecs as secure
In reply to Daniel P. BerrangéThis is traditionally the primary audio backend for x86 as virtio-snd is a relatively new invention.
--- hw/audio/hda-codec.c | 3 +++ hw/audio/intel-hda.c | 3 +++ 2 files changed, 6 insertions(+)
hw/audio/hda-codec.c +3 -0
@@ -873,6 +873,7 @@ static const TypeInfo hda_audio_output_info = { .name = "hda-output", .parent = TYPE_HDA_AUDIO, .class_init = hda_audio_output_class_init, + .secure = true, };static void hda_audio_duplex_class_init (ObjectClass *klass,const void *data)
@@ -888,6 +889,7 @@ static const TypeInfo hda_audio_duplex_info = { .name = "hda-duplex", .parent = TYPE_HDA_AUDIO, .class_init = hda_audio_duplex_class_init, + .secure = true, };static void hda_audio_micro_class_init (ObjectClass *klass,const void *data)
@@ -903,6 +905,7 @@ static const TypeInfo hda_audio_micro_info = { .name = "hda-micro", .parent = TYPE_HDA_AUDIO, .class_init = hda_audio_micro_class_init, + .secure = true, };static void hda_audio_register_types (void )
hw/audio/intel-hda.c +3 -0
@@ -45,6 +45,7 @@ static const TypeInfo hda_codec_bus_info = { .name = TYPE_HDA_BUS, .parent = TYPE_BUS, .instance_size = sizeof(HDACodecBus), + .secure = true, }; void hda_codec_bus_init(DeviceState *dev, HDACodecBus *bus, size_t bus_size,
@@ -1275,12 +1276,14 @@ static const TypeInfo intel_hda_info_ich6 = { .name = "intel-hda", .parent = TYPE_INTEL_HDA_GENERIC, .class_init = intel_hda_class_init_ich6, + .secure = true, };static const TypeInfo intel_hda_info_ich9 = { .name ="ich9-intel-hda" , .parent =TYPE_INTEL_HDA_GENERIC , .class_init = intel_hda_class_init_ich9, + .secure = true, };static void hda_codec_device_class_init (ObjectClass *klass,const void *data)
Signature · 1 line
2.56.0
PATCH v2 19/28 hw/char: mark common serial / console devices as secure
In reply to Daniel P. BerrangéThese are needed as a baseline feature for many virtualization use cases on x86, PPC64 and s390x.
--- hw/char/debugcon.c | 1 + hw/char/sclpconsole-lm.c | 1 + hw/char/sclpconsole.c | 1 + hw/char/serial-isa.c | 1 + hw/char/serial-pci.c | 1 + hw/char/serial.c | 1 + hw/char/spapr_vty.c | 1 + 7 files changed, 7 insertions(+)
hw/char/debugcon.c +1 -0
@@ -134,6 +134,7 @@ static const TypeInfo debugcon_isa_info = { .parent = TYPE_ISA_DEVICE, .instance_size = sizeof(ISADebugconState), .class_init = debugcon_isa_class_initfn, + .secure = true, };static void debugcon_register_types (void )
hw/char/sclpconsole-lm.c +1 -0
@@ -363,6 +363,7 @@ static const TypeInfo sclp_console_info = { .instance_size = sizeof(SCLPConsoleLM), .class_init = console_class_init, .class_size = sizeof(SCLPEventClass), + .secure = true, };static void register_types (void )
hw/char/sclpconsole.c +1 -0
@@ -346,6 +346,7 @@ static const TypeInfo sclp_console_info = { .instance_size = sizeof(SCLPConsole), .class_init = console_class_init, .class_size = sizeof(SCLPEventClass), + .secure = true, };static void register_types (void )
hw/char/serial-isa.c +1 -0
@@ -147,6 +147,7 @@ static const TypeInfo serial_isa_info = { .instance_size = sizeof(ISASerialState), .instance_init = serial_isa_initfn, .class_init = serial_isa_class_initfn, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_ACPI_DEV_AML_IF }, { },
hw/char/serial-pci.c +1 -0
@@ -109,6 +109,7 @@ static const TypeInfo serial_pci_info = { .instance_size = sizeof(PCISerialState), .instance_init = serial_pci_init, .class_init = serial_pci_class_initfn, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
hw/char/serial.c +1 -0
@@ -984,6 +984,7 @@ static const TypeInfo serial_info = { .parent = TYPE_DEVICE, .instance_size = sizeof(SerialState), .class_init = serial_class_init, + .secure = true, };static void serial_register_types (void )
hw/char/spapr_vty.c +1 -0
@@ -201,6 +201,7 @@ static const TypeInfo spapr_vty_info = { .parent = TYPE_VIO_SPAPR_DEVICE, .instance_size = sizeof(SpaprVioVty), .class_init = spapr_vty_class_init, + .secure = true, };SpaprVioDevice *spapr_vty_get_default (SpaprVioBus *bus)
Signature · 1 line
2.56.0
PATCH v2 20/28 hw/mem: mark nvdimm, pc-dimm & spapr-nvdimm devices as secure
In reply to Daniel P. BerrangéThese devices are used in virutalization scenarios to support memory hotplug and other uses cases.
--- hw/mem/nvdimm.c | 1 + hw/mem/pc-dimm.c | 1 + hw/ppc/spapr_nvdimm.c | 1 + 3 files changed, 3 insertions(+)
hw/mem/nvdimm.c +1 -0
@@ -275,6 +275,7 @@ static const TypeInfo nvdimm_info = { .instance_size = sizeof(NVDIMMDevice), .instance_init = nvdimm_init, .instance_finalize = nvdimm_finalize, + .secure = true, };static void nvdimm_register_types (void )
hw/mem/pc-dimm.c +1 -0
@@ -301,6 +301,7 @@ static const TypeInfo pc_dimm_info = { .instance_init = pc_dimm_init, .class_init = pc_dimm_class_init, .class_size = sizeof(PCDIMMDeviceClass), + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_MEMORY_DEVICE }, { }
hw/ppc/spapr_nvdimm.c +1 -0
@@ -916,6 +916,7 @@ static TypeInfo spapr_nvdimm_info = { .class_size = sizeof(SPAPRNVDIMMClass), .instance_size = sizeof(SpaprNVDIMMDevice), .instance_init = spapr_nvdimm_init, + .secure = true, };static void spapr_nvdimm_register_types (void )
Signature · 1 line
2.56.0
Re: [PATCH v2 20/28] hw/mem: mark nvdimm, pc-dimm & spapr-nvdimm devices as secure
Quoted 10 lines · Daniel P. Berrangé
These devices are used in virutalization scenarios to support memory hotplug and other uses cases.
Signed-off-by Daniel P. Berrangé <[email protected]>--- hw/mem/nvdimm.c | 1 + hw/mem/pc-dimm.c | 1 + hw/ppc/spapr_nvdimm.c | 1 + 3 files changed, 3 insertions(+)
PATCH v2 21/28 hw/uefi: mark the EFI vars service as secure
In reply to Daniel P. BerrangéThis is used to persist EFI variables when NVRAM is not available or undesirable.
--- hw/uefi/var-service-sysbus.c | 2 ++ 1 file changed, 2 insertions(+)
hw/uefi/var-service-sysbus.c +2 -0
@@ -86,6 +86,7 @@ static const TypeInfo uefi_vars_sysbus_info = { .instance_size = sizeof(uefi_vars_sysbus_state), .instance_init = uefi_vars_sysbus_init, .class_init = uefi_vars_sysbus_class_init, + .secure = true, };module_obj (TYPE_UEFI_VARS_SYSBUS );
@@ -115,6 +116,7 @@ static const TypeInfo uefi_vars_x64_info = { .name = TYPE_UEFI_VARS_X64, .parent = TYPE_UEFI_VARS_SYSBUS, .class_init = uefi_vars_x64_class_init, + .secure = true, };module_obj (TYPE_UEFI_VARS_X64 );
Signature · 1 line
2.56.0
PATCH v2 22/28 hw/acpi: mark erst, vmclock and vmgenid devices as secure
In reply to Daniel P. BerrangéThese are all used in virtualization scenarios so must be declare to provide a security boundary
--- hw/acpi/erst.c | 1 + hw/acpi/vmclock.c | 1 + hw/acpi/vmgenid.c | 1 + 3 files changed, 3 insertions(+)
hw/acpi/erst.c +1 -0
@@ -1044,6 +1044,7 @@ static const TypeInfo erst_type_info = { .parent = TYPE_PCI_DEVICE, .class_init = erst_class_init, .instance_size = sizeof(ERSTDeviceState), + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { }
hw/acpi/vmclock.c +1 -0
@@ -169,6 +169,7 @@ static const TypeInfo vmclock_device_info = { .parent = TYPE_DEVICE, .instance_size = sizeof(VmclockState), .class_init = vmclock_device_class_init, + .secure = true, };static void vmclock_register_types (void )
hw/acpi/vmgenid.c +1 -0
@@ -236,6 +236,7 @@ static const TypeInfo vmgenid_device_info = { .parent = TYPE_DEVICE, .instance_size = sizeof(VmGenIdState), .class_init = vmgenid_device_class_init, + .secure = true, };static void vmgenid_register_types (void )
Signature · 1 line
2.56.0
PATCH v2 23/28 hw: mark KVM clock and RTC devices as secure
In reply to Daniel P. BerrangéThese are core infrastructure in virtualization cases so must provide a security boundary.
--- hw/i386/kvm/clock.c | 1 + hw/rtc/mc146818rtc.c | 1 + 2 files changed, 2 insertions(+)
hw/i386/kvm/clock.c +1 -0
@@ -366,6 +366,7 @@ static const TypeInfo kvmclock_info = { .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(KVMClockState), .class_init = kvmclock_class_init, + .secure = true, };/* Note: Must be called after VCPU initialization. */
hw/rtc/mc146818rtc.c +1 -0
@@ -1027,6 +1027,7 @@ static const TypeInfo mc146818rtc_info = { .parent = TYPE_ISA_DEVICE, .instance_size = sizeof(MC146818RtcState), .class_init = rtc_class_initfn, + .secure = true, .interfaces = (const InterfaceInfo []) { {TYPE_ACPI_DEV_AML_IF }, { },
Signature · 1 line
2.56.0
Re: [PATCH v2 23/28] hw: mark KVM clock and RTC devices as secure
Quoted 9 lines · Daniel P. Berrangé
These are core infrastructure in virtualization cases so must provide a security boundary.
Signed-off-by Daniel P. Berrangé <[email protected]>--- hw/i386/kvm/clock.c | 1 + hw/rtc/mc146818rtc.c | 1 + 2 files changed, 2 insertions(+)
PATCH v2 24/28 hw: device AMD, Intel and ARM IOMMUs as secure
In reply to Daniel P. BerrangéThese are needed in virtualization use cases to support PCI device assignment use cases so must provide a security boundary.
--- hw/arm/smmuv3.c | 2 ++ hw/i386/amd_iommu.c | 4 +++- hw/i386/intel_iommu.c | 1 + 3 files changed, 6 insertions(+), 1 deletion(-)
hw/arm/smmuv3.c +2 -0
@@ -2272,12 +2272,14 @@ static const TypeInfo smmuv3_type_info = { .instance_init = smmuv3_instance_init, .class_size = sizeof(SMMUv3Class), .class_init = smmuv3_class_init, + .secure = true, };static const TypeInfo smmuv3_iommu_memory_region_info = { .parent =TYPE_IOMMU_MEMORY_REGION , .name =TYPE_SMMUV3_IOMMU_MEMORY_REGION , .class_init = smmuv3_iommu_memory_region_class_init, + .secure = true, };static void smmuv3_register_types (void )
hw/i386/amd_iommu.c +3 -1
@@ -2783,7 +2783,8 @@ static const TypeInfo amdvi_sysbus = { .name = TYPE_AMD_IOMMU_DEVICE, .parent = TYPE_X86_IOMMU_DEVICE, .instance_size = sizeof(AMDVIState), - .class_init = amdvi_sysbus_class_init + .class_init = amdvi_sysbus_class_init, + .secure = true, };static void amdvi_pci_class_init (ObjectClass *klass,const void *data)
@@ -2805,6 +2806,7 @@ static const TypeInfo amdvi_pci = { .parent = TYPE_PCI_DEVICE, .instance_size = sizeof(AMDVIPCIState), .class_init = amdvi_pci_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
hw/i386/intel_iommu.c +1 -0
@@ -5711,6 +5711,7 @@ static const TypeInfo vtd_info = { .parent = TYPE_X86_IOMMU_DEVICE, .instance_size = sizeof(IntelIOMMUState), .class_init = vtd_class_init, + .secure = true, };static int vtd_attrs_to_index (IOMMUMemoryRegion *iommu_mr,MemTxAttrs attrs)
Signature · 1 line
2.56.0
PATCH v2 25/28 hw/input: mark PS/2 and PC Keyboard devices as secure
In reply to Daniel P. BerrangéThese are part of the baseline x86 featureset so required for virtualization use cases.
--- hw/input/pckbd.c | 3 ++- hw/input/ps2.c | 6 ++++-- 2 files changed, 6 insertions(+), 3 deletions(-)
hw/input/pckbd.c +2 -1
@@ -766,7 +766,8 @@ static const TypeInfo i8042_mmio_info = { .parent = TYPE_SYS_BUS_DEVICE, .instance_init = i8042_mmio_init, .instance_size = sizeof(MMIOKBDState), - .class_init = i8042_mmio_class_init + .class_init = i8042_mmio_class_init, + .secure = true, };void i8042_isa_mouse_fake_event (ISAKBDState *isa)
hw/input/ps2.c +4 -2
@@ -1293,7 +1293,8 @@ static const TypeInfo ps2_kbd_info = { .name = TYPE_PS2_KBD_DEVICE, .parent = TYPE_PS2_DEVICE, .instance_size = sizeof(PS2KbdState), - .class_init = ps2_kbd_class_init + .class_init = ps2_kbd_class_init, + .secure = true, };static void ps2_mouse_class_init (ObjectClass *klass,const void *data)
@@ -1313,7 +1314,8 @@ static const TypeInfo ps2_mouse_info = { .name = TYPE_PS2_MOUSE_DEVICE, .parent = TYPE_PS2_DEVICE, .instance_size = sizeof(PS2MouseState), - .class_init = ps2_mouse_class_init + .class_init = ps2_mouse_class_init, + .secure = true, };static void ps2_init (Object *obj)
Signature · 1 line
2.56.0
PATCH v2 26/28 hw/i386: mark vmmouse / vmport as secure
In reply to Daniel P. BerrangéThese paravirtualized devices are relevant to virtualization use cases and used by the i440fx/q35 machine boards.
--- hw/i386/vmmouse.c | 1 + hw/i386/vmport.c | 1 + 2 files changed, 2 insertions(+)
hw/i386/vmmouse.c +1 -0
@@ -390,6 +390,7 @@ static const TypeInfo vmmouse_info = { .parent = TYPE_ISA_DEVICE, .instance_size = sizeof(VMMouseState), .class_init = vmmouse_class_initfn, + .secure = true, };static void vmmouse_register_types (void )
hw/i386/vmport.c +1 -0
@@ -301,6 +301,7 @@ static const TypeInfo vmport_info = { .parent = TYPE_ISA_DEVICE, .instance_size = sizeof(VMPortState), .class_init = vmport_class_initfn, + .secure = true, };static void vmport_register_types (void )
Signature · 1 line
2.56.0
PATCH v2 27/28 hw/display: mark cirrus and QXL as secure
In reply to Daniel P. BerrangéMost of the display adapters are emulating old hardware which is not relevant to virtualization use cases. The previous commit added the generic, simple devices.
This proposes two further devices based on their historical widespread usage in virtualization use cases.
Cirrus (PCI, not ISA) was the recommended default for x86 for an incredibly long time and while it is now discouraged, it is likely to still be in common use.
QXL was the recommended default to be used with SPICE, which is designed to service virtualization use cases and is still commonly shipped by many distros and often used by default in mgmt apps still.
--- hw/display/cirrus_vga.c | 1 + hw/display/qxl.c | 2 ++ 2 files changed, 3 insertions(+)
hw/display/cirrus_vga.c +1 -0
@@ -3013,6 +3013,7 @@ static const TypeInfo cirrus_vga_info = { .parent = TYPE_PCI_DEVICE, .instance_size = sizeof(PCICirrusVGAState), .class_init = cirrus_vga_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
hw/display/qxl.c +2 -0
@@ -2651,6 +2651,7 @@ static const TypeInfo qxl_primary_info = { .name = "qxl-vga", .parent = TYPE_PCI_QXL, .class_init = qxl_primary_class_init, + .secure = true, };module_obj ("qxl-vga" );module_kconfig (QXL );
@@ -2669,6 +2670,7 @@ static const TypeInfo qxl_secondary_info = { .name = "qxl", .parent = TYPE_PCI_QXL, .class_init = qxl_secondary_class_init, + .secure = true, };module_obj ("qxl" );
Signature · 1 line
2.56.0
Re: [PATCH v2 27/28] hw/display: mark cirrus and QXL as secure
Quoted 26 lines · Daniel P. Berrangé
Most of the display adapters are emulating old hardware which is not relevant to virtualization use cases. The previous commit added the generic, simple devices.
This proposes two further devices based on their historical widespread usage in virtualization use cases.
Cirrus (PCI, not ISA) was the recommended default for x86 for an incredibly long time and while it is now discouraged, it is likely to still be in common use.
QXL was the recommended default to be used with SPICE, which is designed to service virtualization use cases and is still commonly shipped by many distros and often used by default in mgmt apps still.
Signed-off-by Daniel P. Berrangé <[email protected]>--- hw/display/cirrus_vga.c | 1 + hw/display/qxl.c | 2 ++ 2 files changed, 3 insertions(+)hw/display/cirrus_vga.c +0
-0
hw/display/cirrus_vga.c static const TypeInfo cirrus_vga_info = { · line 3019
Quoted 7 lines
hw/display/cirrus_vga.c +1
-0@@ -3013,6 +3013,7 @@ static const TypeInfo cirrus_vga_info = { .parent = TYPE_PCI_DEVICE, .instance_size = sizeof(PCICirrusVGAState), .class_init = cirrus_vga_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
Considering that the cirrus card also had a bunch of security-related bugs already and nobody is really in the mood of maintaining this anymore, I'd rather not mark this as secure. I'd recommend to rather drop this patch.
With regards to qxl, maybe better also omit this for now 'til we've got a proper maintainer for this again.
Thomas
Re: [PATCH v2 27/28] hw/display: mark cirrus and QXL as secure
Hi
Quoted 39 lines · Thomas Huth
Quoted 26 lines · Daniel P. Berrangé
Most of the display adapters are emulating old hardware which is not relevant to virtualization use cases. The previous commit added the generic, simple devices.
This proposes two further devices based on their historical widespread usage in virtualization use cases.
Cirrus (PCI, not ISA) was the recommended default for x86 for an incredibly long time and while it is now discouraged, it is likely to still be in common use.
QXL was the recommended default to be used with SPICE, which is designed to service virtualization use cases and is still commonly shipped by many distros and often used by default in mgmt apps still.
Signed-off-by Daniel P. Berrangé <[email protected]>--- hw/display/cirrus_vga.c | 1 + hw/display/qxl.c | 2 ++ 2 files changed, 3 insertions(+)hw/display/cirrus_vga.c +0
-0hw/display/cirrus_vga.c static const TypeInfo cirrus_vga_info = { · line 3019
Quoted 7 lines
hw/display/cirrus_vga.c +1
-0@@ -3013,6 +3013,7 @@ static const TypeInfo cirrus_vga_info = { .parent = TYPE_PCI_DEVICE, .instance_size = sizeof(PCICirrusVGAState), .class_init = cirrus_vga_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },Considering that the cirrus card also had a bunch of security-related bugs already and nobody is really in the mood of maintaining this anymore, I'd rather not mark this as secure. I'd recommend to rather drop this patch.
Quoted 2 lines
With regards to qxl, maybe better also omit this for now 'til we've got a proper maintainer for this again.
+1
PATCH v2 28/28 hw/usb: mark UHCI, OCHI & ECHI USB hosts as secure
In reply to Daniel P. BerrangéModern virtualized guests are expected to be deployed with the XHCI controller which supports all of USB 1, 2 and 3. The UHCI OCHI and ECHI hosts, however, have all been widely used in virtualization scenarios historically, especially on x86. Indeed the -usb flag will enable UCHI by default.
So while these are undesirable hosts in general, this marks them as secure for virtualization use cases.
--- hw/usb/hcd-ehci-pci.c | 1 + hw/usb/hcd-ehci-sysbus.c | 7 +++++++ hw/usb/hcd-ohci-pci.c | 1 + hw/usb/hcd-ohci-sysbus.c | 1 + hw/usb/hcd-uhci.c | 1 + 5 files changed, 11 insertions(+)
hw/usb/hcd-ehci-pci.c +1 -0
@@ -219,6 +219,7 @@ static void ehci_pci_register_types(void)TypeInfo ehci_type_info = { .parent =TYPE_PCI_EHCI , .class_init = ehci_data_class_init, + .secure = true, };int i;
hw/usb/hcd-ehci-sysbus.c +7 -0
@@ -247,32 +247,38 @@ static const TypeInfo ehci_sysbus_types[] = { .name = TYPE_PLATFORM_EHCI, .parent = TYPE_SYS_BUS_EHCI, .class_init = ehci_platform_class_init, + .secure = true, }, { .name = TYPE_EXYNOS4210_EHCI, .parent = TYPE_SYS_BUS_EHCI, .class_init = ehci_exynos4210_class_init, + .secure = true, }, { .name = TYPE_AW_H3_EHCI, .parent = TYPE_SYS_BUS_EHCI, .class_init = ehci_aw_h3_class_init, + .secure = true, }, { .name = TYPE_NPCM7XX_EHCI, .parent = TYPE_SYS_BUS_EHCI, .class_init = ehci_npcm7xx_class_init, + .secure = true, }, { .name = TYPE_TEGRA2_EHCI, .parent = TYPE_SYS_BUS_EHCI, .class_init = ehci_tegra2_class_init, + .secure = true, }, { .name = TYPE_PPC4xx_EHCI, .parent = TYPE_SYS_BUS_EHCI, .class_init = ehci_ppc4xx_class_init, .instance_init = ehci_ppc4xx_init, + .secure = true, }, { .name = TYPE_FUSBH200_EHCI,
@@ -280,6 +286,7 @@ static const TypeInfo ehci_sysbus_types[] = { .instance_size = sizeof(FUSBH200EHCIState), .instance_init = fusbh200_ehci_init, .class_init = fusbh200_ehci_class_init, + .secure = true, }, };
hw/usb/hcd-ohci-pci.c +1 -0
@@ -148,6 +148,7 @@ static const TypeInfo ohci_pci_info = { .parent = TYPE_PCI_DEVICE, .instance_size = sizeof(OHCIPCIState), .class_init = ohci_pci_class_init, + .secure = true, .interfaces = (const InterfaceInfo []) { {INTERFACE_CONVENTIONAL_PCI_DEVICE }, { },
hw/usb/hcd-ohci-sysbus.c +1 -0
@@ -80,6 +80,7 @@ static const TypeInfo ohci_sysbus_types[] = { .parent = TYPE_SYS_BUS_DEVICE, .instance_size = sizeof(OHCISysBusState), .class_init = ohci_sysbus_class_init, + .secure = true, }, };
hw/usb/hcd-uhci.c +1 -0
@@ -1380,6 +1380,7 @@ static void uhci_register_types(void)TypeInfo uhci_type_info = { .parent =TYPE_UHCI , .class_init = uhci_data_class_init, + .secure = true, };int i;
Signature · 1 line
2.56.0
Re: [PATCH v2 28/28] hw/usb: mark UHCI, OCHI & ECHI USB hosts as secure
Quoted 9 lines · Daniel P. Berrangé
Modern virtualized guests are expected to be deployed with the XHCI controller which supports all of USB 1, 2 and 3. The UHCI OCHI and ECHI hosts, however, have all been widely used in virtualization scenarios historically, especially on x86. Indeed the -usb flag will enable UCHI by default.
So while these are undesirable hosts in general, this marks them as secure for virtualization use cases.
Quoted 8 lines
Signed-off-by Daniel P. Berrangé <[email protected]>--- hw/usb/hcd-ehci-pci.c | 1 + hw/usb/hcd-ehci-sysbus.c | 7 +++++++ hw/usb/hcd-ohci-pci.c | 1 + hw/usb/hcd-ohci-sysbus.c | 1 + hw/usb/hcd-uhci.c | 1 + 5 files changed, 11 insertions(+)
I'd also rather drop this patch until we've got a proper USB maintainer again. Otherwise we promise that these devices are secure, but nobody really takes care of security related issues in the end. (It's already exhausting enough to get XHCI into a proper shape again)
Thomas