> Historically most NICs are only interesting for non-virtualization
> use cases and have not been written with malicious guests in mind.
>
> As a general rule either virtio-net or xen-net should be used in
> all virtualized guests requiring a security boundary.
>
> There are a handful of exceptions resulting from historical usage
> in the x86 world, to support virtualized guests lacking virtio
> support.
>
> Thus the rtl8139, e1000 & e1000e NICs are declared to provide a
> security boundary.
>
> Signed-off-by: Daniel P. Berrangé <[email protected]>
> Message-ID: <[email protected]>
>
> diff --git a/hw/net/allwinner-sun8i-emac.c b/hw/net/allwinner-sun8i-emac.c
> index 30a81576b4ce..b03a917aa3ae 100644
> --- a/hw/net/allwinner-sun8i-emac.c
> +++ b/hw/net/allwinner-sun8i-emac.c
> @@ -892,6 +892,7 @@ static const TypeInfo allwinner_sun8i_emac_info = {
> .instance_size = sizeof(AwSun8iEmacState),
> .instance_init = allwinner_sun8i_emac_init,
> .class_init = allwinner_sun8i_emac_class_init,
> + .secure = false,
> };
>
> static void allwinner_sun8i_emac_register_types(void)
> diff --git a/hw/net/allwinner_emac.c b/hw/net/allwinner_emac.c
> index 77d089d9887a..836138bba370 100644
> --- a/hw/net/allwinner_emac.c
> +++ b/hw/net/allwinner_emac.c
> @@ -528,8 +528,9 @@ static const TypeInfo aw_emac_info = {
> .name = TYPE_AW_EMAC,
> .parent = TYPE_SYS_BUS_DEVICE,
> .instance_size = sizeof(AwEmacState),
> - .instance_init = aw_emac_init,
> + .instance_init = aw_emac_init,
> .class_init = aw_emac_class_init,
> + .secure = false,
> };
>
> static void aw_emac_register_types(void)
> diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
> index 44446666deb2..760e0d5e9985 100644
> --- a/hw/net/cadence_gem.c
> +++ b/hw/net/cadence_gem.c
> @@ -1833,6 +1833,7 @@ static const TypeInfo gem_info = {
> .instance_size = sizeof(CadenceGEMState),
> .instance_init = gem_init,
> .class_init = gem_class_init,
> + .secure = false,
> };
>
> static void gem_register_types(void)
> diff --git a/hw/net/can/can_kvaser_pci.c b/hw/net/can/can_kvaser_pci.c
> index be16769de29c..7764c29ced6e 100644
> --- a/hw/net/can/can_kvaser_pci.c
> +++ b/hw/net/can/can_kvaser_pci.c
> @@ -305,6 +305,7 @@ static const TypeInfo kvaser_pci_info = {
> .instance_size = sizeof(KvaserPCIState),
> .class_init = kvaser_pci_class_init,
> .instance_init = kvaser_pci_instance_init,
> + .secure = false,
> .interfaces = (const InterfaceInfo[]) {
> { INTERFACE_CONVENTIONAL_PCI_DEVICE },
> { },
> diff --git a/hw/net/can/can_mioe3680_pci.c b/hw/net/can/can_mioe3680_pci.c
> index 44f3ba370dc2..3e1c5eda1981 100644
> --- a/hw/net/can/can_mioe3680_pci.c
> +++ b/hw/net/can/can_mioe3680_pci.c
> @@ -248,6 +248,7 @@ static const TypeInfo mioe3680_pci_info = {
> .instance_size = sizeof(Mioe3680PCIState),
> .class_init = mioe3680_pci_class_init,
> .instance_init = mioe3680_pci_instance_init,
> + .secure = false,
> .interfaces = (const InterfaceInfo[]) {
> { INTERFACE_CONVENTIONAL_PCI_DEVICE },
> { },
> diff --git a/hw/net/can/can_pcm3680_pci.c b/hw/net/can/can_pcm3680_pci.c
> index 7296d63be794..964e074a3699 100644
> --- a/hw/net/can/can_pcm3680_pci.c
> +++ b/hw/net/can/can_pcm3680_pci.c
> @@ -249,6 +249,7 @@ static const TypeInfo pcm3680i_pci_info = {
> .instance_size = sizeof(Pcm3680iPCIState),
> .class_init = pcm3680i_pci_class_init,
> .instance_init = pcm3680i_pci_instance_init,
> + .secure = false,
> .interfaces = (const InterfaceInfo[]) {
> { INTERFACE_CONVENTIONAL_PCI_DEVICE },
> { },
> diff --git a/hw/net/can/ctucan_pci.c b/hw/net/can/ctucan_pci.c
> index bed6785433e7..1530959ea8c9 100644
> --- a/hw/net/can/ctucan_pci.c
> +++ b/hw/net/can/ctucan_pci.c
> @@ -262,6 +262,7 @@ static const TypeInfo ctucan_pci_info = {
> .instance_size = sizeof(CtuCanPCIState),
> .class_init = ctucan_pci_class_init,
> .instance_init = ctucan_pci_instance_init,
> + .secure = false,
> .interfaces = (const InterfaceInfo[]) {
> { INTERFACE_CONVENTIONAL_PCI_DEVICE },
> { },
> diff --git a/hw/net/can/xlnx-versal-canfd.c b/hw/net/can/xlnx-versal-canfd.c
> index 3eb111949f89..0073812e3c21 100644
> --- a/hw/net/can/xlnx-versal-canfd.c
> +++ b/hw/net/can/xlnx-versal-canfd.c
> @@ -2068,6 +2068,7 @@ static const TypeInfo canfd_info = {
> .instance_size = sizeof(XlnxVersalCANFDState),
> .class_init = canfd_class_init,
> .instance_init = canfd_init,
> + .secure = false,
> };
>
> static void canfd_register_types(void)
> diff --git a/hw/net/can/xlnx-zynqmp-can.c b/hw/net/can/xlnx-zynqmp-can.c
> index ca9edd4a5b88..e859e447af2f 100644
> --- a/hw/net/can/xlnx-zynqmp-can.c
> +++ b/hw/net/can/xlnx-zynqmp-can.c
> @@ -1194,6 +1194,7 @@ static const TypeInfo can_info = {
> .instance_size = sizeof(XlnxZynqMPCANState),
> .class_init = xlnx_zynqmp_can_class_init,
> .instance_init = xlnx_zynqmp_can_init,
> + .secure = false,
> };
>
> static void can_register_types(void)
> diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
> index d49032059bb1..b508b6f77979 100644
> --- a/hw/net/dp8393x.c
> +++ b/hw/net/dp8393x.c
> @@ -956,6 +956,7 @@ static const TypeInfo dp8393x_info = {
> .instance_size = sizeof(dp8393xState),
> .instance_init = dp8393x_instance_init,
> .class_init = dp8393x_class_init,
> + .secure = false,
> };
>
> static void dp8393x_register_types(void)
> diff --git a/hw/net/e1000.c b/hw/net/e1000.c
> index a80a7b0cdb40..684350557f20 100644
> --- a/hw/net/e1000.c
> +++ b/hw/net/e1000.c
> @@ -1759,6 +1759,7 @@ static void e1000_register_types(void)
> type_info.parent = TYPE_E1000_BASE;
> type_info.class_data = info;
> type_info.class_init = e1000_class_init;
> + type_info.secure = true,
, -> ;
>
> type_register_static(&type_info);
> }
> diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
> index 89e6d52ba0f2..83cf3cf643a7 100644
> --- a/hw/net/e1000e.c
> +++ b/hw/net/e1000e.c
> @@ -721,6 +721,7 @@ static const TypeInfo e1000e_info = {
> .instance_size = sizeof(E1000EState),
> .class_init = e1000e_class_init,
> .instance_init = e1000e_instance_init,
> + .secure = true,
> .interfaces = (const InterfaceInfo[]) {
> { INTERFACE_PCIE_DEVICE },
> { }
> diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
> index d47df5a97fd1..3bc232d3c2a6 100644
> --- a/hw/net/eepro100.c
> +++ b/hw/net/eepro100.c
> @@ -2094,6 +2094,7 @@ static void eepro100_register_types(void)
> type_info.class_init = eepro100_class_init;
> type_info.instance_size = sizeof(EEPRO100State);
> type_info.instance_init = eepro100_instance_init;
> + type_info.secure = false,
same
--
Marc-André Lureau <[email protected]>
