diff --git a/repos/ports/run/vbox_win.inc b/repos/ports/run/vbox_win.inc
index 9f56443fc5..0462824fe1 100644
--- a/repos/ports/run/vbox_win.inc
+++ b/repos/ports/run/vbox_win.inc
@@ -92,10 +92,12 @@ append config_of_app {
 		<provides> <service name="Report"/> <service name="ROM"/> </provides>
 		<config>
 			<rom>
-				<policy label="vbox_pointer -> hover" report="nitpicker -> hover"/>
-				<policy label="vbox_pointer -> xray"  report="nitpicker -> xray"/>
-				<policy label="vbox_pointer -> shape" report="vbox -> shape"/>
-				<policy label="vbox -> usb_devices"   report="usb_drv -> devices"/>
+				<policy label="vbox_pointer -> hover"               report="nitpicker -> hover"/>
+				<policy label="vbox_pointer -> xray"                report="nitpicker -> xray"/>
+				<policy label="vbox_pointer -> shape"               report="vbox -> shape"/>
+				<policy label="usb_report_filter -> devices"        report="usb_drv -> devices"/>
+				<policy label="usb_report_filter -> usb_drv_config" report="usb_drv -> config"/>
+				<policy label="vbox -> usb_devices"                 report="usb_report_filter -> usb_devices"/>
 			</rom>
 		</config>
 	</start>
diff --git a/repos/ports/run/virtualbox_auto.inc b/repos/ports/run/virtualbox_auto.inc
index ffcb98f68c..9ca558e6a4 100644
--- a/repos/ports/run/virtualbox_auto.inc
+++ b/repos/ports/run/virtualbox_auto.inc
@@ -9,6 +9,7 @@ append build_components {
 	core init virtualbox 
 	server/part_blk
 	server/rump_fs
+	server/fs_rom
 	drivers/ahci
 	drivers/framebuffer
 	drivers/timer
@@ -16,8 +17,9 @@ append build_components {
 
 lappend_if [expr $use_ps2]    build_components drivers/input
 lappend_if [expr $use_usb]    build_components drivers/usb
+lappend_if [expr $use_usb]    build_components app/usb_report_filter
 lappend_if [have_spec x86]    build_components drivers/rtc
-lappend_if [expr $use_ram_fs] build_components server/ram_fs
+lappend_if [expr $use_ram_fs || $use_usb] build_components server/ram_fs
 
 source ${genode_dir}/repos/base/run/platform_drv.inc
 # override defaults of platform_drv.inc
@@ -110,22 +112,94 @@ append_if [expr $use_ps2] config {
 	</start>}
 
 append_if [expr $use_usb] config {
+	<start name="usb_config_fs" priority="-1">
+		<binary name="ram_fs"/>
+		<resource name="RAM" quantum="1M"/>
+		<provides><service name="File_system"/></provides>
+		<config verbose="yes">
+			<content>
+				<inline name="usb_drv.config">
+<config uhci="yes" ehci="yes" xhci="yes">
+	<hid/>
+	<raw>
+		<report devices="yes"/>
+	</raw>
+</config>
+				</inline>
+				<inline name="usb_report_filter.config">
+<config>
+	<!-- USB device whitelist -->
+	<client label="vbox"/>
+	<device vendor_id="0x13fe" product_id="0x5200"/> <!-- platinum stick -->
+	<device vendor_id="0x148f" product_id="0x2573"/> <!-- ralink wifi -->
+	<device vendor_id="0x1f75" product_id="0x0917"/> <!-- intenso stick -->
+	<device vendor_id="0x04f9" product_id="0x0051"/> <!-- brother printer -->
+	<device vendor_id="0x090c" product_id="0x6000"/> <!-- hama sd/hc reader -->
+	<device vendor_id="0x1b1c" product_id="0x1a09"/> <!-- voyager gt stick -->
+	<device vendor_id="0x1b1c" product_id="0x1a03"/> <!-- voyager stick -->
+	<device vendor_id="0x04b3" product_id="0x310d"/> <!-- lenovo mouse -->
+	<device vendor_id="0x04b3" product_id="0x310c"/> <!-- lenovo mouse -->
+	<device vendor_id="0x04b3" product_id="0x3025"/> <!-- lenovo keyboard -->
+	<device vendor_id="0x046a" product_id="0x0001"/> <!-- cherry keyboard -->
+	<device vendor_id="0x0482" product_id="0x0015"/> <!-- kyo printer -->
+	<device vendor_id="0x04a9" product_id="0x2220"/> <!-- canon scanner -->
+	<device vendor_id="0x067b" product_id="0x2303"/> <!-- prolific serial -->
+	<device vendor_id="0x0583" product_id="0x2060"/> <!-- snes controller -->
+	<device vendor_id="0x045e" product_id="0x028e"/> <!-- x360 controller -->
+	<device vendor_id="0x046d" product_id="0xc00e"/> <!-- logitech mouse -->
+	<device vendor_id="0x0984" product_id="0x0066"/> <!-- lenovo DVDRW -->
+	<device vendor_id="0x174c" product_id="0x5106"/> <!-- delock SATA -->
+</config>
+				</inline>
+			</content>
+			<policy label_prefix="usb_report_filter" root="/" writeable="yes" />
+			<policy label_prefix="usb_config_rom" root="/"/>
+		</config>
+	</start>
+
+	<start name="usb_config_rom" priority="-1">
+		<binary name="fs_rom"/>
+		<resource name="RAM" quantum="1M"/>
+		<provides><service name="ROM"/></provides>
+		<route>
+			<service name="File_system"><child name="usb_config_fs"/></service>
+			<any-service><parent/><any-child/></any-service>
+		</route>
+	</start>
+
+	<start name="usb_report_filter" priority="-1">
+		<resource name="RAM" quantum="1M"/>
+		<configfile name="usb_report_filter.config"/>
+		<route>
+			<service name="Report"><child name="report_rom" /></service>
+			<service name="ROM" label="usb_report_filter.config">
+				<child name="usb_config_rom"/>
+			</service>
+			<service name="ROM" label="devices">
+				<child name="report_rom"/>
+			</service>
+			<service name="ROM" label="usb_drv_config">
+				<child name="report_rom"/>
+			</service>
+			<service name="File_system" label="usb_drv.config">
+				<child name="usb_config_fs"/>
+			</service>
+			<any-service><parent/><any-child /></any-service>
+		</route>
+	</start>
+
 	<start name="usb_drv" priority="-1">
-		<resource name="RAM" quantum="8M"/>
+		<resource name="RAM" quantum="16M"/>
 		<provides>
 			<service name="Input"/>
 			<service name="Usb" />
 		</provides>
-		<config uhci="yes" ehci="yes" xhci="yes">
-			<hid/>
-			<raw>
-				<report devices="yes"/>
-			</raw>
-		</config>
+		<configfile name="usb_drv.config"/>
 		<route>
 			<service name="IRQ"><child name="acpi_drv" /></service>
 			<service name="Report"><child name="report_rom" /></service>
-			<any-service> <parent /> <any-child /></any-service>
+			<service name="ROM" label="usb_drv.config"><child name="usb_config_rom"/></service>
+			<any-service><parent /><any-child /></any-service>
 		</route>
 	</start>
 }
@@ -155,20 +229,21 @@ install_config $config
 
 append boot_modules {
 	core init timer
-	part_blk ahci_drv
+	part_blk ahci_drv fs_rom
 	ld.lib.so libc.lib.so libm.lib.so pthread.lib.so
 	libc_lock_pipe.lib.so libc_terminal.lib.so
 	libiconv.lib.so stdcxx.lib.so
 	rump.lib.so rump_fs.lib.so rump_fs
-	virtualbox
+	virtualbox qemu-usb.lib.so
 }
 
-lappend_if [expr $use_ram_fs]      boot_modules ram_fs
-lappend_if [expr $use_ram_fs]      boot_modules ${overlay_image}
+lappend_if [expr $use_ram_fs || $use_usb] boot_modules ram_fs
+lappend_if [expr $use_ram_fs]             boot_modules ${overlay_image}
 
 # platform-specific modules
 lappend_if [expr         $use_ps2] boot_modules ps2_drv
 lappend_if [expr         $use_usb] boot_modules usb_drv
+lappend_if [expr         $use_usb] boot_modules usb_report_filter
 lappend_if [have_spec framebuffer] boot_modules fb_drv
 lappend_if [have_spec         x86] boot_modules rtc_drv