Commit 3cd7c29825 for qemu.org

commit 3cd7c29825d7f3f6686da4f937604f97ac64bb6b
Author: Daniel P. Berrangé <berrange@redhat.com>
Date:   Tue Sep 9 12:36:45 2025 +0100

    qom: add tracking of security state of object types

    This introduces a new flag "secure" against the Type/TypeInfo
    structs, and helpers to check this against the ObjectClass
    struct.

    If an object is considered to provide a security boundary to
    protect against untrusted code, the "secure" flag must be
    explicitly set to true.

    If it is set to false, or left unset, this indicates that
    the object does not intend to provide a security boundary.
    Bugs related to this object class will be ineligible for
    CVE assignment.

    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
    Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

diff --git a/include/qom/object.h b/include/qom/object.h
index 7ecd0f210f..687ceb6bba 100644
--- a/include/qom/object.h
+++ b/include/qom/object.h
@@ -453,6 +453,10 @@ struct Object
  *   function.
  * @abstract: If this field is true, then the class is considered abstract and
  *   cannot be directly instantiated.
+ * @secure: If this field is initialized to true, then the class is considered
+ *   to provide a security boundary. If initialized to false, the class does
+ *   not provide a security boundary. If uninitialized (and thus implicitly
+ *   false) its status is not yet defined.
  * @class_size: The size of the class object (derivative of #ObjectClass)
  *   for this object.  If @class_size is 0, then the size of the class will be
  *   assumed to be the size of the parent class.  This allows a type to avoid
@@ -487,6 +491,7 @@ struct TypeInfo
     void (*instance_finalize)(Object *obj);

     bool abstract;
+    bool secure;
     size_t class_size;

     void (*class_init)(ObjectClass *klass, const void *data);
@@ -1074,6 +1079,14 @@ const char *object_class_get_name(ObjectClass *klass);
  */
 bool object_class_is_abstract(ObjectClass *klass);

+/**
+ * object_class_is_secure:
+ * @klass: The class to check security of
+ *
+ * Returns: %true if @klass is declared to be secure, %false if not declared
+ */
+bool object_class_is_secure(ObjectClass *klass);
+
 /**
  * object_class_by_name:
  * @typename: The QOM typename to obtain the class for.
diff --git a/qom/object.c b/qom/object.c
index b1834a57cc..32736a0111 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -67,6 +67,7 @@ struct TypeImpl
     void (*instance_finalize)(Object *obj);

     bool abstract;
+    bool secure;

     const char *parent;
     TypeImpl *parent_type;
@@ -122,6 +123,7 @@ static TypeImpl *type_new(const TypeInfo *info)
     ti->instance_finalize = info->instance_finalize;

     ti->abstract = info->abstract;
+    ti->secure = info->secure;

     for (i = 0; info->interfaces && info->interfaces[i].type; i++) {
         ti->interfaces[i].typename = g_strdup(info->interfaces[i].type);
@@ -1144,6 +1146,11 @@ bool object_class_is_abstract(ObjectClass *klass)
     return klass->type->abstract;
 }

+bool object_class_is_secure(ObjectClass *klass)
+{
+    return klass->type->secure;
+}
+
 const char *object_class_get_name(ObjectClass *klass)
 {
     return klass->type->name;
diff --git a/rust/qom/src/qom.rs b/rust/qom/src/qom.rs
index bbb485e2cf..81449eeefa 100644
--- a/rust/qom/src/qom.rs
+++ b/rust/qom/src/qom.rs
@@ -651,6 +651,9 @@ pub trait ObjectImpl: ObjectType + IsA<Object> {
     /// Whether the object can be instantiated
     const ABSTRACT: bool = false;

+    /// Whether the object provides a security boundary for untrusted access
+    const SECURE: bool = false;
+
     /// Function that is called to initialize an object.  The parent class will
     /// have already been initialized so the type is only responsible for
     /// initializing its own members.
@@ -687,6 +690,7 @@ pub trait ObjectImpl: ObjectType + IsA<Object> {
         },
         instance_finalize: Some(drop_object::<Self>),
         abstract_: Self::ABSTRACT,
+        secure: Self::SECURE,
         class_size: core::mem::size_of::<Self::Class>(),
         class_init: Some(rust_class_init::<Self>),
         class_base_init: Self::CLASS_BASE_INIT,