Re: [PATCH v2 04/32] system: check security for accelerator types

["Daniel P. Berrangé" <berrange@redhat.com>]

On Wed, Aug 19, 2026 at 12:21:49AM +0400, marcandre.lureau@redhat.com wrote:
> > This wires up the accelerator creation code to apply the compat policy
> > security check. When multiple -accel options are given, normal fallback
> > logic applies. IOW, if one is rejected by the security check, it will
> > carry on to try the next accelerator until one passes the security
> > check.
> > 
> > Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> > Message-ID: <20250926140144.1998694-5-berrange@redhat.com>
> >
> > diff --git a/system/vl.c b/system/vl.c
> > index 00f36947257a..6f7fdb866359 100644
> > --- a/system/vl.c
> > +++ b/system/vl.c
> > @@ -2383,12 +2383,21 @@ static int do_configure_accelerator(void *opaque, QemuOpts *opts, Error **errp)
> >      AccelState *accel;
> >      int ret;
> >      bool qtest_with_kvm;
> > +    Error *local_err = NULL;
> >  
> >      if (!acc) {
> >          error_setg(errp, QERR_MISSING_PARAMETER, "accel");
> >          goto bad;
> >      }
> >  
> > +    if (!compat_policy_check_security(&compat_policy,
> > +                                      object_class_get_name(OBJECT_CLASS(ac)),
> > +                                      object_class_is_secure(OBJECT_CLASS(ac)),
> > +                                      &local_err)) {
> > +        error_report_err(local_err);
> > +        goto bad;
> > +    }
> 
> It should handle ac == NULL before

Ah yes, we need to move this check further down.


With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|