[PULL 00/14] QOM security status patches

Daniel P. Berrangé posted 14 patches 1 week, 2 days ago
docs/system/security.rst     | 36 ++++++++++++++++++++++++++++++++++++
hw/arm/bananapi_m2u.c        |  2 +-
hw/arm/cubieboard.c          |  2 +-
hw/arm/imx8mm-evk.c          |  2 +-
hw/arm/integratorcp.c        |  2 +-
hw/arm/mcimx7d-sabre.c       |  2 +-
hw/arm/orangepi.c            |  2 +-
hw/core/machine-qmp-cmds.c   |  1 +
hw/ppc/pegasos.c             |  3 ++-
include/hw/core/boards.h     | 25 ++++++++++++++++++++-----
include/hw/i386/pc.h         | 11 ++++++++++-
include/qapi/compat-policy.h |  5 +++++
include/qom/object.h         | 26 ++++++++++++++++++++++++++
qapi/compat.json             | 23 ++++++++++++++++++++++-
qapi/machine.json            |  8 +++++++-
qapi/qapi-util.c             | 30 ++++++++++++++++++++++++++++++
qapi/qom.json                | 13 +++++++++++--
qom/object.c                 | 16 ++++++++++++++++
qom/qom-qmp-cmds.c           | 35 +++++++++++++++++++++++++++++------
rust/qom/src/qom.rs          |  4 ++++
system/qdev-monitor.c        |  7 +++++++
system/vl.c                  | 30 +++++++++++++++++++++++++-----
tests/qtest/fuzz/qos_fuzz.c  |  3 ++-
23 files changed, 259 insertions(+), 29 deletions(-)
[PULL 00/14] QOM security status patches
Posted by Daniel P. Berrangé 1 week, 2 days ago
The following changes since commit f8296b816fabd370307cd22b0270b610fc0fa279:

  Merge tag 'pull-loongarch-20260917' of https://github.com/bibo-mao/qemu into staging (2026-09-16 18:24:08 -1000)

are available in the Git repository at:

  https://gitlab.com/berrange/qemu tags/misc-fixes-pull-request

for you to fetch changes up to f49f267664ac9a681ab19c1790cc3d75a1723790:

  machine: add helpers for declaring secure/insecure machine types (2026-09-17 17:00:44 +0100)

----------------------------------------------------------------
Merge support for recording & reporting object security status

* '-compat' gains a new option 'insecure-types=reject|warn|accept'
* '-device help', '-accel help' and '-machine help' report
  security status of their objects
* 'qom-list-types' can filter and report on security status of types
* 'query-machines' can report on security status of machines
* Adding macros for defining secure machine types

----------------------------------------------------------------

Daniel P. Berrangé (14):
  qom: add tracking of security state of object types
  qapi: add 'insecure-types' option for -compat argument
  qom: add helper API for checking object class security policy
    compliance
  system: check security for accelerator types
  system: report acclerator security status in help output
  system: check security for machine types
  system: report machine security status in help output
  system: check security of device types
  system: report device security status in help output
  hw/core: report security status in query-machines
  qom: refactor data passing for QOM list filtering
  qom: report & filter on security status in qom-list-types
  docs: expand security docs with info about security status
  machine: add helpers for declaring secure/insecure machine types

 docs/system/security.rst     | 36 ++++++++++++++++++++++++++++++++++++
 hw/arm/bananapi_m2u.c        |  2 +-
 hw/arm/cubieboard.c          |  2 +-
 hw/arm/imx8mm-evk.c          |  2 +-
 hw/arm/integratorcp.c        |  2 +-
 hw/arm/mcimx7d-sabre.c       |  2 +-
 hw/arm/orangepi.c            |  2 +-
 hw/core/machine-qmp-cmds.c   |  1 +
 hw/ppc/pegasos.c             |  3 ++-
 include/hw/core/boards.h     | 25 ++++++++++++++++++++-----
 include/hw/i386/pc.h         | 11 ++++++++++-
 include/qapi/compat-policy.h |  5 +++++
 include/qom/object.h         | 26 ++++++++++++++++++++++++++
 qapi/compat.json             | 23 ++++++++++++++++++++++-
 qapi/machine.json            |  8 +++++++-
 qapi/qapi-util.c             | 30 ++++++++++++++++++++++++++++++
 qapi/qom.json                | 13 +++++++++++--
 qom/object.c                 | 16 ++++++++++++++++
 qom/qom-qmp-cmds.c           | 35 +++++++++++++++++++++++++++++------
 rust/qom/src/qom.rs          |  4 ++++
 system/qdev-monitor.c        |  7 +++++++
 system/vl.c                  | 30 +++++++++++++++++++++++++-----
 tests/qtest/fuzz/qos_fuzz.c  |  3 ++-
 23 files changed, 259 insertions(+), 29 deletions(-)

-- 
2.55.0


Re: [PULL 00/14] QOM security status patches
Posted by Richard Henderson 1 week, 1 day ago
On 9/17/26 06:05, Daniel P. Berrangé wrote:
> The following changes since commit f8296b816fabd370307cd22b0270b610fc0fa279:
> 
>    Merge tag 'pull-loongarch-20260917' ofhttps://github.com/bibo-mao/qemu into staging (2026-09-16 18:24:08 -1000)
> 
> are available in the Git repository at:
> 
>    https://gitlab.com/berrange/qemu tags/misc-fixes-pull-request
> 
> for you to fetch changes up to f49f267664ac9a681ab19c1790cc3d75a1723790:
> 
>    machine: add helpers for declaring secure/insecure machine types (2026-09-17 17:00:44 +0100)
> 
> ----------------------------------------------------------------
> Merge support for recording & reporting object security status
> 
> * '-compat' gains a new option 'insecure-types=reject|warn|accept'
> * '-device help', '-accel help' and '-machine help' report
>    security status of their objects
> * 'qom-list-types' can filter and report on security status of types
> * 'query-machines' can report on security status of machines
> * Adding macros for defining secure machine types

Applied, thanks.

r~