This (largish) series undertakes the task of marking devices secure, if they are intended to be used a virtualization use case.
NB, this is only tagging leaf types in the QOM tree. This implicitly means their parents are also secure, as well as any child devices they are hardcoded to create internally, but those are not (yet) tagged. Tagging parents and implicit created devices is future work. NB, the maintainer CC list was way too huge to include every individual, so I've trimmed to just the mailing list CCs. The marking of machine types / accelerators was split off to https://lists.gnu.org/archive/html/qemu-devel/2026-10/msg07775.html I used the docs/system/security.txt along with the RHEL builds of QEMU as an approximation for what should be considered "virtualization use case". The latter cuts out a huge pile of devices from the build. IOW, more or less everything that RHEL builds for x86_64, ppc64, aarch64, s390x gets included. Notably since RHEL does not yet ship riscv or loongarch, I've possibly missed some devices that ought to be in scope. Devices are marked secure *regardless* of their maintainer status, if they are relevant to virt. Notably all the USB stuff is included despite USB being orphaned. An exception is CXL which is arguably relevant to virt, but maintainers agreed it is too immature to include so far, and we've been explicitly excluding from CVE triage since the AI flood. IOW, the "secure" flag as set in this series mostly avoids saying anything about the support status of the object types. Over the long term, IMHO, the set of devices we declare as providing a security boundary needs to be stable. We should not declare a device out of scope for the virt use case simply because a maintainer steps aside. The device doesn't become instantly less secure. It does mean bug fixes may not be timely enough, and rely on the goodwill of other contributors or maintainers to step up and fix. Or to put it another way. "secure = true" does not guarantee that the device is secure, but it states our intent that we *want* it to be secure, as opposed to "secure = false" / unset which indicates we just don't care either way. The intersection of (secure, orphaned) highlights to QEMU contributors or corporate sponsors, where they might step up their effort / investment. Changed in v2: - Split off setting of UHCI, OCHI, ECHI to separate patch since it is debatable whether to include these - Split off Cirrus and QXL to seaprate patch since it is debatable whether to include these - Split off accelerators/machines to a seplarate (already postd) series. - Dropped annotations accidentally included on some parent (abstract) types. This will be dealt with in the next release cycle - Really dropped annotations for CXL - Dropped vmware SCSI device Daniel P. Berrangé (28): hw: mark all virtio PCI devices as secure hw: mark all virtio CCW devices as secure hw: mark all vhost devices a secure hw: mark all remaining virtio object types as secure hw/vfio: mark all VFIO object classes as secure hw/xen: mark all Xen related object types as being secure hw/net: mark e1000, e1000e, IGB, rtl8139 & sPAPR VLAN as secure hw/usb: mark commonly used USB devices/hosts as secure hw/watchdog: mark some watchdog devices as secure hw/scsi: mark spapr SCSI controller as secure hw/scsi: mark SCSI disk endpoint devices as secure hw/ide: mark ICH9 and ide-hd/ide-cd as secure hw: define most common PCI types as secure hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts as secure hw/display: mark bochs, ramfb and VGA as secure hw/tpm: mark all TPM implementations as secure hw/misc: mark pvpanic, vmcoreinfo as secure hw/audio: mark Intel HDA devices & codecs as secure hw/char: mark common serial / console devices as secure hw/mem: mark nvdimm, pc-dimm & spapr-nvdimm devices as secure hw/uefi: mark the EFI vars service as secure hw/acpi: mark erst, vmclock and vmgenid devices as secure hw: mark KVM clock and RTC devices as secure hw: device AMD, Intel and ARM IOMMUs as secure hw/input: mark PS/2 and PC Keyboard devices as secure hw/i386: mark vmmouse / vmport as secure hw/display: mark cirrus and QXL as secure hw/usb: mark UHCI, OCHI & ECHI USB hosts as secure hw/9pfs/virtio-9p-device.c | 1 + hw/acpi/erst.c | 1 + hw/acpi/vmclock.c | 1 + hw/acpi/vmgenid.c | 1 + hw/arm/smmuv3.c | 2 ++ hw/audio/hda-codec.c | 3 +++ hw/audio/intel-hda.c | 3 +++ hw/audio/virtio-snd.c | 1 + hw/block/vhost-user-blk.c | 1 + hw/block/virtio-blk.c | 1 + hw/block/xen-block.c | 2 ++ hw/char/debugcon.c | 1 + hw/char/sclpconsole-lm.c | 1 + hw/char/sclpconsole.c | 1 + hw/char/serial-isa.c | 1 + hw/char/serial-pci.c | 1 + hw/char/serial.c | 1 + hw/char/spapr_vty.c | 1 + hw/char/virtio-console.c | 2 ++ hw/char/virtio-serial-bus.c | 2 ++ hw/char/xen_console.c | 1 + hw/display/bochs-display.c | 1 + hw/display/cirrus_vga.c | 1 + hw/display/qxl.c | 2 ++ hw/display/ramfb-standalone.c | 1 + hw/display/vga-pci.c | 2 ++ hw/display/vhost-user-gpu.c | 1 + hw/display/virtio-gpu-gl.c | 1 + hw/display/virtio-gpu-pci-rutabaga.c | 1 + hw/display/virtio-gpu-rutabaga.c | 1 + hw/display/virtio-gpu.c | 1 + hw/i386/amd_iommu.c | 4 +++- hw/i386/intel_iommu.c | 1 + hw/i386/kvm/clock.c | 1 + hw/i386/vmmouse.c | 1 + hw/i386/vmport.c | 1 + hw/i386/xen/xen-hvm.c | 1 + hw/i386/xen/xen_platform.c | 1 + hw/i386/xen/xen_pvdevice.c | 1 + hw/ide/ich.c | 1 + hw/ide/ide-dev.c | 2 ++ hw/ide/piix.c | 2 ++ hw/input/pckbd.c | 3 ++- hw/input/ps2.c | 6 ++++-- hw/input/virtio-input-hid.c | 4 ++++ hw/input/virtio-input-host.c | 1 + hw/mem/nvdimm.c | 1 + hw/mem/pc-dimm.c | 1 + hw/misc/pvpanic-isa.c | 1 + hw/misc/pvpanic-mmio.c | 1 + hw/misc/pvpanic-pci.c | 1 + hw/misc/vmcoreinfo.c | 1 + hw/net/e1000.c | 1 + hw/net/e1000e.c | 1 + hw/net/igb.c | 1 + hw/net/rtl8139.c | 1 + hw/net/spapr_llan.c | 1 + hw/net/virtio-net.c | 1 + hw/net/xen_nic.c | 1 + hw/pci-bridge/gen_pcie_root_port.c | 1 + hw/pci-bridge/i82801b11.c | 1 + hw/pci-bridge/ioh3420.c | 1 + hw/pci-bridge/pci_bridge_dev.c | 2 ++ hw/pci-bridge/pci_expander_bridge.c | 5 +++++ hw/pci-bridge/pcie_pci_bridge.c | 1 + hw/pci-bridge/xio3130_downstream.c | 1 + hw/pci-bridge/xio3130_upstream.c | 1 + hw/pci-host/gpex.c | 2 ++ hw/pci-host/i440fx.c | 2 ++ hw/pci-host/pnv_phb.c | 2 ++ hw/pci-host/pnv_phb3.c | 3 +++ hw/pci-host/pnv_phb3_msi.c | 1 + hw/pci-host/pnv_phb3_pbcq.c | 1 + hw/pci-host/pnv_phb4.c | 4 +++- hw/pci-host/pnv_phb4_pec.c | 1 + hw/pci-host/q35.c | 2 ++ hw/pci-host/remote.c | 1 + hw/pci-host/xen_igd_pt.c | 1 + hw/pci/pci.c | 4 ++++ hw/ppc/spapr_nvdimm.c | 1 + hw/ppc/spapr_pci.c | 1 + hw/ppc/spapr_tpm_proxy.c | 1 + hw/rtc/mc146818rtc.c | 1 + hw/s390x/s390-pci-bus.c | 4 ++++ hw/s390x/vhost-scsi-ccw.c | 1 + hw/s390x/vhost-user-fs-ccw.c | 1 + hw/s390x/vhost-vsock-ccw.c | 1 + hw/s390x/virtio-ccw-9p.c | 1 + hw/s390x/virtio-ccw-balloon.c | 1 + hw/s390x/virtio-ccw-blk.c | 1 + hw/s390x/virtio-ccw-crypto.c | 1 + hw/s390x/virtio-ccw-gpu.c | 1 + hw/s390x/virtio-ccw-input.c | 3 +++ hw/s390x/virtio-ccw-mem.c | 1 + hw/s390x/virtio-ccw-net.c | 1 + hw/s390x/virtio-ccw-rng.c | 1 + hw/s390x/virtio-ccw-scsi.c | 1 + hw/s390x/virtio-ccw-serial.c | 1 + hw/scsi/scsi-disk.c | 3 +++ hw/scsi/scsi-generic.c | 1 + hw/scsi/spapr_vscsi.c | 1 + hw/scsi/vhost-scsi.c | 1 + hw/scsi/vhost-user-scsi.c | 1 + hw/scsi/virtio-scsi.c | 1 + hw/tpm/tpm_crb.c | 1 + hw/tpm/tpm_spapr.c | 1 + hw/tpm/tpm_tis_i2c.c | 1 + hw/tpm/tpm_tis_isa.c | 1 + hw/tpm/tpm_tis_sysbus.c | 1 + hw/uefi/var-service-sysbus.c | 2 ++ hw/usb/ccid-card-emulated.c | 1 + hw/usb/ccid-card-passthru.c | 1 + hw/usb/dev-hid.c | 3 +++ hw/usb/dev-hub.c | 1 + hw/usb/dev-smartcard-reader.c | 2 ++ hw/usb/dev-storage-bot.c | 1 + hw/usb/dev-storage-classic.c | 1 + hw/usb/hcd-ehci-pci.c | 1 + hw/usb/hcd-ehci-sysbus.c | 7 +++++++ hw/usb/hcd-ohci-pci.c | 1 + hw/usb/hcd-ohci-sysbus.c | 1 + hw/usb/hcd-uhci.c | 1 + hw/usb/hcd-xhci-nec.c | 1 + hw/usb/hcd-xhci-pci.c | 1 + hw/usb/hcd-xhci-sysbus.c | 3 ++- hw/usb/hcd-xhci.c | 1 + hw/usb/host-libusb.c | 1 + hw/usb/redirect.c | 1 + hw/vfio-user/pci.c | 1 + hw/vfio/ap.c | 1 + hw/vfio/ccw.c | 1 + hw/vfio/igd.c | 1 + hw/vfio/iommufd.c | 2 ++ hw/vfio/pci.c | 2 ++ hw/vfio/spapr.c | 1 + hw/virtio/vdpa-dev.c | 1 + hw/virtio/vhost-user-fs.c | 1 + hw/virtio/vhost-user-gpio.c | 1 + hw/virtio/vhost-user-i2c.c | 1 + hw/virtio/vhost-user-input.c | 1 + hw/virtio/vhost-user-rng.c | 1 + hw/virtio/vhost-user-rtc.c | 1 + hw/virtio/vhost-user-scmi.c | 1 + hw/virtio/vhost-user-snd.c | 1 + hw/virtio/vhost-user-spi.c | 1 + hw/virtio/vhost-user-test-device.c | 1 + hw/virtio/vhost-user-vsock.c | 1 + hw/virtio/vhost-vsock.c | 1 + hw/virtio/virtio-balloon.c | 1 + hw/virtio/virtio-crypto.c | 1 + hw/virtio/virtio-iommu.c | 2 ++ hw/virtio/virtio-mem.c | 1 + hw/virtio/virtio-mmio.c | 2 ++ hw/virtio/virtio-nsm.c | 1 + hw/virtio/virtio-pci.c | 3 +++ hw/virtio/virtio-pmem.c | 1 + hw/virtio/virtio-rng.c | 1 + hw/virtio/virtio-rtc.c | 1 + hw/watchdog/sbsa_gwdt.c | 1 + hw/watchdog/spapr_watchdog.c | 1 + hw/watchdog/wdt_diag288.c | 1 + hw/watchdog/wdt_i6300esb.c | 1 + hw/watchdog/wdt_ib700.c | 1 + hw/xen/xen-bus.c | 2 ++ hw/xen/xen-legacy-backend.c | 3 +++ hw/xen/xen_pt.c | 1 + 166 files changed, 230 insertions(+), 6 deletions(-) -- 2.56.0
