|
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [PATCH 00/29] Mark user creatable devices for secure for virt use case
This (largish) series undertakes the task of marking devices
secure, if they are intended to be used a virtualization
use case.
NB, the maintainer CC list was way too huge to include every
individual, so I've trimmed to just the mailing list CCs.
The approach taken was iterative as follows
* Machines listed in
https://www.qemu.org/docs/master/system/security.html#virtualization-use-case
* All virtio/vhost/vfio/xen related devices
* Most PCI related devices/controllers/bridges
I then used the RHEL builds of QEMU as an approximation for
what should be considered "virtualization use case", since
they cut out a huge pile of devices from the build. IOW,
more or less everything that RHEL builds for x86_64, ppc64,
aarch64, s390x gets included. Notably since RHEL does not
yet ship riscv or loongarch, I've possibly missed some
devices that ought to be in scope.
Devices are marked secure *regardless* of their maintainer
status, if they are relevant to virt. Notably all the USB
stuff is included despite USB being orphaned. An exception
is CXL which is arguably relevant to virt, but maintainers
agreed it is too immature to include so far.
IOW, the "secure" flag as set in this series mostly avoids
saying anything about the support status of the object types.
Over the long term, IMHO, the set of devices we declare as
providing a security boundary needs to be stable. We should
not declare a device out of scope for the virt use case simply
because a maintainer steps aside. The device doesn't become
instantly less secure. It does mean bug fixes may not be
timely enough, and rely on the goodwill of other contributors
or maintainers to step up and fix.
Or to put it another way. "secure = true" does not guarantee
that the device is secure, but it states our intent that we
*want* it to be secure, as opposed to "secure = false" which
indicates we just don't care either way.
The intersection of (secure, orphaned) highlights to QEMU
contributors or corporate sponsors, where they might step
up their effort / investment.
Finally this is just user creatable devices. Use of these
devices implies use of many more non-user creatable devices.
I don't have a good way to enumerate those yet, and while
the end user doesn't care at runtime, as maintainers we
want to be clear if all devices are in scope for CVE
handling or not.
Based-on: <20260910103628.2326622-1-berrange@xxxxxxxxxx>
Daniel P. Berrangé (29):
hw: mark secure machines for x86, s390, ppc, arm, loonarch, riscv
accel: mark kvm and xen accelerators as secure
hw: mark all virtio PCI devices as secure
hw: mark all virtio CCW devices as secure
hw: mark all vhost devices a secure
hw: mark all remaining virtio object types as secure
hw/vfio: mark all VFIO object classes as secure
hw/xen: mark all Xen related object types as being secure
hw/net: mark e1000, e1000e, IGB, rtl8139 & sPAPR VLAN as secure
hw/usb: mark commonly used USB devices/hosts as secure
hw/watchdog: mark some watchdog devices as secure
hw/scsi: mark spapr and vmware SCSI controllers as secure
hw/scsi: mark SCSI disk endpoint devices as secure
hw/ide: mark ICH9 and ide-hd/ide-cd as secure
hw: define most common PCI types as secure
hw/pci-host: mark common x86, ppc, arm and s390 PCI hosts as secure
hw/display: mark bochs, cirrus, qxl, VGA, ramfb as secure
hw/tpm: mark all TPM implementations as secure
hw/misc: mark pvpanic, vmcoreinfo as secure
hw/audio: mark Intel HDA devices & codecs as secure
hw/char: mark common serial / console devicess a secure
hw/mem: mark nvdimm, pc-dimm & spapr-nvdimm devices as secure
hw/uefi: mark the EFI vars service as secure
hw/acpi: mark erst, vmclock and vmgenid devices as secure
hw: mark KVM clock and RTC devices as secure
hw: device AMD, Intel and ARM IOMMUs as secure
hw/input: mark PS/2 and PC Keyboard devices as secure
hw/i386: mark vmmouse / vmport as secure
tests/tcg: improve check for working cross compilers
accel/accel-common.c | 2 ++
accel/accel-system.c | 1 +
accel/kvm/kvm-accel-ops.c | 1 +
accel/kvm/kvm-all.c | 1 +
accel/xen/xen-all.c | 2 ++
hw/9pfs/virtio-9p-device.c | 1 +
hw/acpi/erst.c | 1 +
hw/acpi/vmclock.c | 1 +
hw/acpi/vmgenid.c | 1 +
hw/arm/smmu-common.c | 1 +
hw/arm/smmuv3.c | 2 ++
hw/arm/virt.c | 1 +
hw/arm/xen-pvh.c | 1 +
hw/audio/hda-codec.c | 4 ++++
hw/audio/intel-hda.c | 5 +++++
hw/audio/virtio-snd.c | 1 +
hw/block/vhost-user-blk.c | 1 +
hw/block/virtio-blk.c | 1 +
hw/block/xen-block.c | 3 +++
hw/char/debugcon.c | 1 +
hw/char/sclpconsole-lm.c | 1 +
hw/char/sclpconsole.c | 1 +
hw/char/serial-isa.c | 1 +
hw/char/serial-pci.c | 1 +
hw/char/serial.c | 1 +
hw/char/spapr_vty.c | 1 +
hw/char/virtio-console.c | 2 ++
hw/char/virtio-serial-bus.c | 3 +++
hw/char/xen_console.c | 1 +
hw/display/bochs-display.c | 1 +
hw/display/cirrus_vga.c | 1 +
hw/display/qxl.c | 3 +++
hw/display/ramfb-standalone.c | 1 +
hw/display/vga-mmio.c | 1 +
hw/display/vga-pci.c | 3 +++
hw/display/vhost-user-gpu.c | 1 +
hw/display/virtio-gpu-base.c | 3 ++-
hw/display/virtio-gpu-gl.c | 1 +
hw/display/virtio-gpu-pci-rutabaga.c | 1 +
hw/display/virtio-gpu-pci.c | 3 ++-
hw/display/virtio-gpu-rutabaga.c | 1 +
hw/display/virtio-gpu.c | 1 +
hw/i386/amd_iommu.c | 4 +++-
hw/i386/intel_iommu.c | 1 +
hw/i386/kvm/clock.c | 1 +
hw/i386/microvm.c | 1 +
hw/i386/pc_piix.c | 4 ++--
hw/i386/vmmouse.c | 1 +
hw/i386/vmport.c | 1 +
hw/i386/xen/xen-pvh.c | 1 +
hw/i386/xen/xen_platform.c | 1 +
hw/i386/xen/xen_pvdevice.c | 1 +
hw/ide/ich.c | 1 +
hw/ide/ide-dev.c | 3 +++
hw/ide/piix.c | 2 ++
hw/input/pckbd.c | 3 ++-
hw/input/ps2.c | 9 ++++++---
hw/input/virtio-input-hid.c | 5 +++++
hw/input/virtio-input-host.c | 1 +
hw/input/virtio-input.c | 1 +
hw/loongarch/virt.c | 2 ++
hw/mem/nvdimm.c | 1 +
hw/mem/pc-dimm.c | 1 +
hw/misc/pvpanic-isa.c | 1 +
hw/misc/pvpanic-mmio.c | 1 +
hw/misc/pvpanic-pci.c | 1 +
hw/misc/vmcoreinfo.c | 1 +
hw/net/e1000.c | 1 +
hw/net/e1000e.c | 1 +
hw/net/igb.c | 1 +
hw/net/rtl8139.c | 1 +
hw/net/spapr_llan.c | 1 +
hw/net/virtio-net.c | 1 +
hw/net/xen_nic.c | 1 +
hw/pci-bridge/gen_pcie_root_port.c | 1 +
hw/pci-bridge/i82801b11.c | 1 +
hw/pci-bridge/ioh3420.c | 1 +
hw/pci-bridge/pci_bridge_dev.c | 2 ++
hw/pci-bridge/pci_expander_bridge.c | 8 ++++++++
hw/pci-bridge/pcie_pci_bridge.c | 1 +
hw/pci-bridge/pcie_root_port.c | 1 +
hw/pci-bridge/xio3130_downstream.c | 1 +
hw/pci-bridge/xio3130_upstream.c | 1 +
hw/pci-host/gpex.c | 2 ++
hw/pci-host/i440fx.c | 2 ++
hw/pci-host/pnv_phb.c | 2 ++
hw/pci-host/pnv_phb3.c | 3 +++
hw/pci-host/pnv_phb3_msi.c | 1 +
hw/pci-host/pnv_phb3_pbcq.c | 1 +
hw/pci-host/pnv_phb4.c | 4 +++-
hw/pci-host/pnv_phb4_pec.c | 1 +
hw/pci-host/q35.c | 2 ++
hw/pci-host/remote.c | 1 +
hw/pci-host/xen_igd_pt.c | 1 +
hw/pci/pci.c | 7 +++++++
hw/pci/pci_bridge.c | 1 +
hw/pci/pci_host.c | 1 +
hw/pci/pcie_host.c | 1 +
hw/pci/pcie_port.c | 1 +
hw/ppc/spapr.c | 1 +
hw/ppc/spapr_nvdimm.c | 1 +
hw/ppc/spapr_pci.c | 1 +
hw/ppc/spapr_tpm_proxy.c | 1 +
hw/riscv/virt.c | 1 +
hw/rtc/mc146818rtc.c | 1 +
hw/s390x/s390-pci-bus.c | 4 ++++
hw/s390x/s390-virtio-ccw.c | 1 +
hw/s390x/vhost-scsi-ccw.c | 1 +
hw/s390x/vhost-user-fs-ccw.c | 1 +
hw/s390x/vhost-vsock-ccw.c | 1 +
hw/s390x/virtio-ccw-9p.c | 1 +
hw/s390x/virtio-ccw-balloon.c | 1 +
hw/s390x/virtio-ccw-blk.c | 1 +
hw/s390x/virtio-ccw-crypto.c | 1 +
hw/s390x/virtio-ccw-gpu.c | 1 +
hw/s390x/virtio-ccw-input.c | 5 +++++
hw/s390x/virtio-ccw-md.c | 1 +
hw/s390x/virtio-ccw-mem.c | 1 +
hw/s390x/virtio-ccw-net.c | 1 +
hw/s390x/virtio-ccw-rng.c | 1 +
hw/s390x/virtio-ccw-scsi.c | 1 +
hw/s390x/virtio-ccw-serial.c | 1 +
hw/s390x/virtio-ccw.c | 1 +
hw/scsi/scsi-disk.c | 4 ++++
hw/scsi/scsi-generic.c | 1 +
hw/scsi/spapr_vscsi.c | 1 +
hw/scsi/vhost-scsi-common.c | 1 +
hw/scsi/vhost-scsi.c | 1 +
hw/scsi/vhost-user-scsi.c | 1 +
hw/scsi/virtio-scsi.c | 2 ++
hw/scsi/vmw_pvscsi.c | 1 +
hw/tpm/tpm_crb.c | 1 +
hw/tpm/tpm_spapr.c | 1 +
hw/tpm/tpm_tis_i2c.c | 1 +
hw/tpm/tpm_tis_isa.c | 1 +
hw/tpm/tpm_tis_sysbus.c | 1 +
hw/uefi/var-service-sysbus.c | 2 ++
hw/usb/ccid-card-emulated.c | 1 +
hw/usb/ccid-card-passthru.c | 1 +
hw/usb/dev-hid.c | 4 ++++
hw/usb/dev-hub.c | 1 +
hw/usb/dev-smartcard-reader.c | 3 +++
hw/usb/dev-storage-bot.c | 1 +
hw/usb/dev-storage-classic.c | 1 +
hw/usb/dev-storage.c | 1 +
hw/usb/hcd-ehci-pci.c | 2 ++
hw/usb/hcd-ehci-sysbus.c | 8 ++++++++
hw/usb/hcd-ohci-pci.c | 1 +
hw/usb/hcd-ohci-sysbus.c | 1 +
hw/usb/hcd-uhci.c | 2 ++
hw/usb/hcd-xhci-nec.c | 1 +
hw/usb/hcd-xhci-pci.c | 2 ++
hw/usb/hcd-xhci-sysbus.c | 3 ++-
hw/usb/hcd-xhci.c | 1 +
hw/usb/host-libusb.c | 1 +
hw/usb/redirect.c | 1 +
hw/vfio-user/pci.c | 1 +
hw/vfio/ap.c | 1 +
hw/vfio/ccw.c | 1 +
hw/vfio/container.c | 1 +
hw/vfio/igd.c | 1 +
hw/vfio/iommufd.c | 2 ++
hw/vfio/pci.c | 3 +++
hw/vfio/spapr.c | 1 +
hw/virtio/vdpa-dev.c | 1 +
hw/virtio/vhost-user-base.c | 3 ++-
hw/virtio/vhost-user-fs.c | 1 +
hw/virtio/vhost-user-gpio.c | 1 +
hw/virtio/vhost-user-i2c.c | 1 +
hw/virtio/vhost-user-input.c | 1 +
hw/virtio/vhost-user-rng.c | 1 +
hw/virtio/vhost-user-rtc.c | 1 +
hw/virtio/vhost-user-scmi.c | 1 +
hw/virtio/vhost-user-snd.c | 1 +
hw/virtio/vhost-user-spi.c | 1 +
hw/virtio/vhost-user-test-device.c | 1 +
hw/virtio/vhost-user-vsock.c | 1 +
hw/virtio/vhost-vsock-common.c | 1 +
hw/virtio/vhost-vsock.c | 1 +
hw/virtio/virtio-balloon.c | 1 +
hw/virtio/virtio-bus.c | 1 +
hw/virtio/virtio-crypto.c | 1 +
hw/virtio/virtio-input-pci.c | 2 ++
hw/virtio/virtio-iommu.c | 2 ++
hw/virtio/virtio-md-pci.c | 1 +
hw/virtio/virtio-mem.c | 1 +
hw/virtio/virtio-mmio.c | 2 ++
hw/virtio/virtio-nsm.c | 1 +
hw/virtio/virtio-pci.c | 3 +++
hw/virtio/virtio-pmem.c | 1 +
hw/virtio/virtio-rng.c | 1 +
hw/virtio/virtio-rtc.c | 1 +
hw/watchdog/sbsa_gwdt.c | 1 +
hw/watchdog/spapr_watchdog.c | 1 +
hw/watchdog/wdt_diag288.c | 1 +
hw/watchdog/wdt_i6300esb.c | 1 +
hw/watchdog/wdt_ib700.c | 1 +
hw/xen/xen-bus.c | 3 +++
hw/xen/xen-legacy-backend.c | 3 +++
hw/xen/xen-pvh-common.c | 1 +
hw/xen/xen_pt.c | 1 +
hw/xenpv/xen_machine_pv.c | 2 +-
include/hw/i386/pc.h | 1 +
tests/tcg/test_cc.c | 6 +++++-
204 files changed, 309 insertions(+), 14 deletions(-)
--
2.55.0
|
 |
Lists.xenproject.org is hosted with RackSpace, monitoring our |