Re: [PATCH 03/28] hw: mark all virtio PCI devices as secure

[marcandre.lureau@xxxxxxxxxx]

> These are all intended for use in a virtualization scenario and must
> provide a security boundary. This can be done for almost all virtio
> PCI devices by modifying the common type register helper.
> 
> The virtio-gpu devices are unusual in not using the common
> virtio_pci_types_register() method, so need marking directly.
> 
> Signed-off-by: Daniel P. Berrangé <berrange@xxxxxxxxxx>
> Message-ID: <20260911143627.2743803-4-berrange@xxxxxxxxxx>
>
> diff --git a/hw/display/virtio-gpu-pci-rutabaga.c 
> b/hw/display/virtio-gpu-pci-rutabaga.c
> index 4db77cb868db..a8e5e1d96cf3 100644
> --- a/hw/display/virtio-gpu-pci-rutabaga.c
> +++ b/hw/display/virtio-gpu-pci-rutabaga.c
> @@ -34,6 +34,7 @@ static const TypeInfo virtio_gpu_rutabaga_pci_info[] = {
>          .parent = TYPE_VIRTIO_GPU_PCI_BASE,
>          .instance_size = sizeof(VirtIOGPURutabagaPCI),
>          .instance_init = virtio_gpu_rutabaga_initfn,
> +        .secure = true,

This is unusual, I wonder why it's not using the VirtioPCIDeviceTypeInfo

>          .interfaces = (const InterfaceInfo[]) {
>              { INTERFACE_CONVENTIONAL_PCI_DEVICE },
>              { },
> diff --git a/hw/display/virtio-gpu-pci.c b/hw/display/virtio-gpu-pci.c
> index 22659ca196b5..0b0d926a5b95 100644
> --- a/hw/display/virtio-gpu-pci.c
> +++ b/hw/display/virtio-gpu-pci.c
> @@ -75,7 +75,8 @@ static const TypeInfo virtio_gpu_pci_base_info = {
>      .parent = TYPE_VIRTIO_PCI,
>      .instance_size = sizeof(VirtIOGPUPCIBase),
>      .class_init = virtio_gpu_pci_base_class_init,
> -    .abstract = true
> +    .abstract = true,
> +    .secure = true,

This is a base class, probably doesn't need marking.

>  };
>  module_obj(TYPE_VIRTIO_GPU_PCI_BASE);
>  module_kconfig(VIRTIO_PCI);
> diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
> index 6f5db5fc42b7..cd5fe8f1d8d8 100644
> --- a/hw/virtio/virtio-pci.c
> +++ b/hw/virtio/virtio-pci.c
> @@ -2520,6 +2520,7 @@ void virtio_pci_types_register(const 
> VirtioPCIDeviceTypeInfo *t)
>          .name = t->generic_name,
>          .parent = base_type_info.name,
>          .class_init = virtio_pci_generic_class_init,
> +        .secure = true,
>          .interfaces = (const InterfaceInfo[]) {
>              { INTERFACE_PCIE_DEVICE },
>              { INTERFACE_CONVENTIONAL_PCI_DEVICE },
> @@ -2555,6 +2556,7 @@ void virtio_pci_types_register(const 
> VirtioPCIDeviceTypeInfo *t)
>              .name          = t->non_transitional_name,
>              .parent        = base_type_info.name,
>              .instance_init = virtio_pci_non_transitional_instance_init,
> +            .secure = true,
>              .interfaces = (const InterfaceInfo[]) {
>                  { INTERFACE_PCIE_DEVICE },
>                  { INTERFACE_CONVENTIONAL_PCI_DEVICE },
> @@ -2569,6 +2571,7 @@ void virtio_pci_types_register(const 
> VirtioPCIDeviceTypeInfo *t)
>              .name          = t->transitional_name,
>              .parent        = base_type_info.name,
>              .instance_init = virtio_pci_transitional_instance_init,
> +            .secure = true,
>              .interfaces = (const InterfaceInfo[]) {
>                  /*
>                   * Transitional virtio devices work only as Conventional PCI

otherwise lgtm

-- 
Marc-André Lureau <marcandre.lureau@xxxxxxxxxx>