Re: [PATCH v2 04/32] system: check security for accelerator types

> This wires up the accelerator creation code to apply the compat policy
> security check. When multiple -accel options are given, normal fallback
> logic applies. IOW, if one is rejected by the security check, it will
> carry on to try the next accelerator until one passes the security
> check.
> 
> Signed-off-by: Daniel P. Berrangé <[email protected]>
> Message-ID: <[email protected]>
>
> diff --git a/system/vl.c b/system/vl.c
> index 00f36947257a..6f7fdb866359 100644
> --- a/system/vl.c
> +++ b/system/vl.c
> @@ -2383,12 +2383,21 @@ static int do_configure_accelerator(void *opaque, QemuOpts *opts, Error **errp)
>      AccelState *accel;
>      int ret;
>      bool qtest_with_kvm;
> +    Error *local_err = NULL;
>  
>      if (!acc) {
>          error_setg(errp, QERR_MISSING_PARAMETER, "accel");
>          goto bad;
>      }
>  
> +    if (!compat_policy_check_security(&compat_policy,
> +                                      object_class_get_name(OBJECT_CLASS(ac)),
> +                                      object_class_is_secure(OBJECT_CLASS(ac)),
> +                                      &local_err)) {
> +        error_report_err(local_err);
> +        goto bad;
> +    }

It should handle ac == NULL before

-- 
Marc-André Lureau <[email protected]>