Historically most NICs are only interesting for non-virtualization use cases and have not been written with malicious guests in mind.
As a general rule either virtio-net or xen-net should be used in all virtualized guests requiring a security boundary. There are a handful of exceptions resulting from historical usage in the x86 world, to support virtualized guests lacking virtio support. Thus the rtl8139, e1000, e1000e & IGB NICs are declared to provide a security boundary. The PPC sPAPR Virutal LAN device is also marked secure. Signed-off-by: Daniel P. Berrangé <[email protected]> --- hw/net/e1000.c | 1 + hw/net/e1000e.c | 1 + hw/net/igb.c | 1 + hw/net/rtl8139.c | 1 + hw/net/spapr_llan.c | 1 + 5 files changed, 5 insertions(+) diff --git a/hw/net/e1000.c b/hw/net/e1000.c index 202ad40401..da0667c40e 100644 --- a/hw/net/e1000.c +++ b/hw/net/e1000.c @@ -1759,6 +1759,7 @@ static void e1000_register_types(void) type_info.parent = TYPE_E1000_BASE; type_info.class_data = info; type_info.class_init = e1000_class_init; + type_info.secure = true, type_register_static(&type_info); } diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c index 9faf0c74c3..96737ddb51 100644 --- a/hw/net/e1000e.c +++ b/hw/net/e1000e.c @@ -721,6 +721,7 @@ static const TypeInfo e1000e_info = { .instance_size = sizeof(E1000EState), .class_init = e1000e_class_init, .instance_init = e1000e_instance_init, + .secure = true, .interfaces = (const InterfaceInfo[]) { { INTERFACE_PCIE_DEVICE }, { } diff --git a/hw/net/igb.c b/hw/net/igb.c index c076807e71..0bd03efea0 100644 --- a/hw/net/igb.c +++ b/hw/net/igb.c @@ -635,6 +635,7 @@ static const TypeInfo igb_info = { .instance_size = sizeof(IGBState), .class_init = igb_class_init, .instance_init = igb_instance_init, + .secure = true, .interfaces = (const InterfaceInfo[]) { { INTERFACE_PCIE_DEVICE }, { } diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c index 16479284ee..38bc16f312 100644 --- a/hw/net/rtl8139.c +++ b/hw/net/rtl8139.c @@ -3450,6 +3450,7 @@ static const TypeInfo rtl8139_info = { .instance_size = sizeof(RTL8139State), .class_init = rtl8139_class_init, .instance_init = rtl8139_instance_init, + .secure = true, .interfaces = (const InterfaceInfo[]) { { INTERFACE_CONVENTIONAL_PCI_DEVICE }, { }, diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c index 550848307d..c7ac58273c 100644 --- a/hw/net/spapr_llan.c +++ b/hw/net/spapr_llan.c @@ -873,6 +873,7 @@ static const TypeInfo spapr_vlan_info = { .class_init = spapr_vlan_class_init, .instance_init = spapr_vlan_instance_init, .instance_finalize = spapr_vlan_instance_finalize, + .secure = true, }; static void spapr_vlan_register_types(void) -- 2.55.0
