From: Philippe Mathieu-Daudé <philmd@linaro.org>
Date: Thu, 3 Jul 2025 22:26:05 +0000 (+0200)
Subject: accel/hvf: Report missing com.apple.security.hypervisor entitlement
X-Git-Tag: v10.1.0-rc0~30^2~23
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5f3bfbd8e2453671176e9759b9dc14584cd11e79;p=thirdparty%2Fqemu.git

accel/hvf: Report missing com.apple.security.hypervisor entitlement

We need the QEMU binary signed to be able to use HVF.
Improve the following:

  $ ./qemu-system-aarch64-unsigned -M virt -accel hvf
  qemu-system-aarch64-unsigned: -accel hvf: Error: ret = HV_DENIED (0xfae94007, at ../../accel/hvf/hvf-accel-ops.c:339)
  Abort trap: 6

to:

  $ ./qemu-system-aarch64-unsigned -M virt -accel hvf
  qemu-system-aarch64-unsigned: -accel hvf: Could not access HVF. Is the executable signed with com.apple.security.hypervisor entitlement?

Suggested-by: Shatyuka <shatyuka@qq.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2800
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Message-Id: <20250702185332.43650-29-philmd@linaro.org>
---

diff --git a/accel/hvf/hvf-all.c b/accel/hvf/hvf-all.c
index ddc77e629f5..09fe3f24152 100644
--- a/accel/hvf/hvf-all.c
+++ b/accel/hvf/hvf-all.c
@@ -263,6 +263,11 @@ static int hvf_accel_init(MachineState *ms)
     }
 
     ret = hvf_arch_vm_create(ms, (uint32_t)pa_range);
+    if (ret == HV_DENIED) {
+        error_report("Could not access HVF. Is the executable signed"
+                     " with com.apple.security.hypervisor entitlement?");
+        exit(1);
+    }
     assert_hvf_ok(ret);
 
     s = g_new0(HVFState, 1);