[PATCH 02/28] accel: mark kvm and xen accelerators as secure

[Daniel P. Berrangé <berrange@xxxxxxxxxx>]

TCG is too complex to be considered to provide a security boundary
for malicious guest workloads. QTest is only used for functional
testing and thus is not relevant to mark secure.

KVM and Xen are servicing virtualization use cases which must
provide security and actively maintained.

While HVF would be in scope conceptually, it is not sufficiently
mature or maintained to claim a security boundary at this time.

Signed-off-by: Daniel P. Berrangé <berrange@xxxxxxxxxx>
---
 accel/accel-common.c      | 2 ++
 accel/accel-system.c      | 1 +
 accel/kvm/kvm-accel-ops.c | 1 +
 accel/kvm/kvm-all.c       | 1 +
 accel/xen/xen-all.c       | 2 ++
 5 files changed, 7 insertions(+)

diff --git a/accel/accel-common.c b/accel/accel-common.c
index 00a400243f..1d993f0ad8 100644
--- a/accel/accel-common.c
+++ b/accel/accel-common.c
@@ -125,6 +125,7 @@ static const TypeInfo accel_types[] = {
         .class_size     = sizeof(AccelClass),
         .instance_size  = sizeof(AccelState),
         .abstract       = true,
+        .secure         = true,
     },
 };
 
@@ -137,6 +138,7 @@ static void register_accel_target_type(void)
         .name = name,
         .parent = TYPE_OBJECT,
         .abstract = true,
+        .secure = true,
         .class_size = sizeof(AccelCPUClass),
     };
 
diff --git a/accel/accel-system.c b/accel/accel-system.c
index 1325b23864..f3f31bc666 100644
--- a/accel/accel-system.c
+++ b/accel/accel-system.c
@@ -118,6 +118,7 @@ static const TypeInfo accel_ops_type_info = {
     .name = TYPE_ACCEL_OPS,
     .parent = TYPE_OBJECT,
     .abstract = true,
+    .secure = true,
     .class_size = sizeof(AccelOpsClass),
     .class_init = accel_ops_class_init,
 };
diff --git a/accel/kvm/kvm-accel-ops.c b/accel/kvm/kvm-accel-ops.c
index c8e7aa3870..f05d41a837 100644
--- a/accel/kvm/kvm-accel-ops.c
+++ b/accel/kvm/kvm-accel-ops.c
@@ -119,6 +119,7 @@ static const TypeInfo kvm_accel_ops_type = {
     .parent = TYPE_ACCEL_OPS,
     .class_init = kvm_accel_ops_class_init,
     .abstract = true,
+    .secure = true,
 };
 
 static void kvm_accel_ops_register_types(void)
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 83cbd120a8..af886aa28c 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -4328,6 +4328,7 @@ static const TypeInfo kvm_accel_type = {
     .instance_finalize = kvm_accel_finalize,
     .class_init = kvm_accel_class_init,
     .instance_size = sizeof(KVMState),
+    .secure = true,
 };
 
 static void kvm_type_init(void)
diff --git a/accel/xen/xen-all.c b/accel/xen/xen-all.c
index bb2d02cb22..937e0e947d 100644
--- a/accel/xen/xen-all.c
+++ b/accel/xen/xen-all.c
@@ -147,6 +147,7 @@ static const TypeInfo xen_accel_type = {
     .name = TYPE_XEN_ACCEL,
     .parent = TYPE_ACCEL,
     .class_init = xen_accel_class_init,
+    .secure = true,
 };
 
 static void xen_accel_ops_class_init(ObjectClass *oc, const void *data)
@@ -163,6 +164,7 @@ static const TypeInfo xen_accel_ops_type = {
     .parent = TYPE_ACCEL_OPS,
     .class_init = xen_accel_ops_class_init,
     .abstract = true,
+    .secure = true,
 };
 
 static void xen_type_init(void)
-- 
2.55.0