Il ven 27 nov 2020, 20:44 Roman Bolshakov <r.bolsha...@yadro.com> ha scritto:
> On Thu, Nov 26, 2020 at 10:50:10PM +0100, Alexander Graf wrote: > > In macOS 11, QEMU only gets access to Hypervisor.framework if it has the > > respective entitlement. Add an entitlement template and automatically > self > > sign and apply the entitlement in the build. > > > > Signed-off-by: Alexander Graf <ag...@csgraf.de> > > --- > > accel/hvf/entitlements.plist | 8 ++++++++ > > meson.build | 30 ++++++++++++++++++++++++++---- > > scripts/entitlement.sh | 11 +++++++++++ > > 3 files changed, 45 insertions(+), 4 deletions(-) > > create mode 100644 accel/hvf/entitlements.plist > > create mode 100755 scripts/entitlement.sh > > Hi, > > I think the patch should go ahead of other changes (with Paolo's fix for > ^C) and land into 5.2 because entitlements are needed for x86_64 hvf too > since Big Sur Beta 3. Ad-hoc signing is very convenient for development. > It's certainly too late for 5.2, but we could include the patch in the release notes and in 5.2.1. Paolo Also, It might be good to have configure/meson option to disable signing > at all. Primarily for homebrew: > > https://discourse.brew.sh/t/code-signing-installed-executables/2131/10 > > There's no established process how to deal with it, e.g. GDB in homebrew > has caveats section for now: > > ==> Caveats > gdb requires special privileges to access Mach ports. > You will need to codesign the binary. For instructions, see: > > https://sourceware.org/gdb/wiki/BuildingOnDarwin > > The discussion on discourse mentions some plans to do signing in > homebrew CI (with real Developer ID) but none of them are implemented > now. > > For now it'd be helpful to provide a way to disable signing and install > the entitlements (if one wants to sign after installation). Similar > issue was raised to fish-shell a while ago: > > https://github.com/fish-shell/fish-shell/issues/6952 > https://github.com/fish-shell/fish-shell/issues/7467 > > > > > diff --git a/accel/hvf/entitlements.plist b/accel/hvf/entitlements.plist > > new file mode 100644 > > index 0000000000..154f3308ef > > --- /dev/null > > +++ b/accel/hvf/entitlements.plist > > @@ -0,0 +1,8 @@ > > +<?xml version="1.0" encoding="UTF-8"?> > > +<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" " > http://www.apple.com/DTDs/PropertyList-1.0.dtd";> > > +<plist version="1.0"> > > +<dict> > > + <key>com.apple.security.hypervisor</key> > > + <true/> > > +</dict> > > +</plist> > > diff --git a/meson.build b/meson.build > > index 5062407c70..2a7ff5560c 100644 > > --- a/meson.build > > +++ b/meson.build > > @@ -1844,9 +1844,14 @@ foreach target : target_dirs > > }] > > endif > > foreach exe: execs > > - emulators += {exe['name']: > > - executable(exe['name'], exe['sources'], > > - install: true, > > + exe_name = exe['name'] > > + exe_sign = 'CONFIG_HVF' in config_target > > I don't have Apple Silicon HW but it may require different kind of > entitlements for CONFIG_TCG: > > > https://developer.apple.com/documentation/apple_silicon/porting_just-in-time_compilers_to_apple_silicon > > Thanks, > Roman > > > + if exe_sign > > + exe_name += '-unsigned' > > + endif > > + > > + emulator = executable(exe_name, exe['sources'], > > + install: not exe_sign, > > c_args: c_args, > > dependencies: arch_deps + deps + exe['dependencies'], > > objects: lib.extract_all_objects(recursive: true), > > @@ -1854,7 +1859,24 @@ foreach target : target_dirs > > link_depends: [block_syms, qemu_syms] + > exe.get('link_depends', []), > > link_args: link_args, > > gui_app: exe['gui']) > > - } > > + > > + if exe_sign > > + exe_full = meson.current_build_dir() / exe['name'] > > + emulators += {exe['name'] : custom_target(exe['name'], > > + install: true, > > + install_dir: get_option('bindir'), > > + depends: emulator, > > + output: exe['name'], > > + command: [ > > + meson.current_source_dir() / > 'scripts/entitlement.sh', > > + meson.current_build_dir() / exe['name'] + > '-unsigned', > > + meson.current_build_dir() / exe['name'], > > + meson.current_source_dir() / > 'accel/hvf/entitlements.plist' > > + ]) > > + } > > + else > > + emulators += {exe['name']: emulator} > > + endif > > > > if 'CONFIG_TRACE_SYSTEMTAP' in config_host > > foreach stp: [ > > diff --git a/scripts/entitlement.sh b/scripts/entitlement.sh > > new file mode 100755 > > index 0000000000..7ed9590bf9 > > --- /dev/null > > +++ b/scripts/entitlement.sh > > @@ -0,0 +1,11 @@ > > +#!/bin/sh -e > > +# > > +# Helper script for the build process to apply entitlements > > + > > +SRC="$1" > > +DST="$2" > > +ENTITLEMENT="$3" > > + > > +rm -f "$2" > > +cp -a "$SRC" "$DST" > > +codesign --entitlements "$ENTITLEMENT" --force -s - "$DST" > > -- > > 2.24.3 (Apple Git-128) > > > > > >
