Commit 8bcd34c40e for qemu.org

commit 8bcd34c40edbe37f5456fb0a5e109578781818b6
Author: Daniel P. Berrangé <berrange@redhat.com>
Date:   Tue Sep 9 12:14:46 2025 +0100

    system: check security for accelerator types

    This wires up the accelerator creation code to apply the compat policy
    security check. When multiple -accel options are given, normal fallback
    logic applies. IOW, if one is rejected by the security check, it will
    carry on to try the next accelerator until one passes the security
    check.

    Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
    Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
    Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

diff --git a/system/vl.c b/system/vl.c
index 9bd7664b85..0c6e44f21c 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -2412,6 +2412,11 @@ static int do_configure_accelerator(void *opaque, QemuOpts *opts, Error **errp)
         }
         goto bad;
     }
+
+    if (!object_class_check_security(OBJECT_CLASS(ac), errp)) {
+        goto bad;
+    }
+
     accel = ACCEL(object_new_with_class(OBJECT_CLASS(ac)));
     object_apply_compat_props(OBJECT(accel));
     qemu_opt_foreach(opts, accelerator_set_property,