On Mon, Aug 28, 2023 at 09:14:41PM +0800, Xiaoyao Li wrote:
> On 8/21/2023 5:58 PM, Daniel P. Berrangé wrote:
> > On Fri, Aug 18, 2023 at 05:50:30AM -0400, Xiaoyao Li wrote:
> > > Originated-from: Isaku Yamahata <isaku.yamahata@xxxxxxxxx>
> > > Signed-off-by: Xiaoyao Li <xiaoyao.li@xxxxxxxxx>
> > > ---
> > > qapi/run-state.json | 17 +++++++++++++--
> > > softmmu/runstate.c | 49 +++++++++++++++++++++++++++++++++++++++++++
> > > target/i386/kvm/tdx.c | 24 ++++++++++++++++++++-
> > > 3 files changed, 87 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/qapi/run-state.json b/qapi/run-state.json
> > > index f216ba54ec4c..506bbe31541f 100644
> > > --- a/qapi/run-state.json
> > > +++ b/qapi/run-state.json
> > > @@ -499,7 +499,7 @@
> > > # Since: 2.9
> > > ##
> > > { 'enum': 'GuestPanicInformationType',
> > > - 'data': [ 'hyper-v', 's390' ] }
> > > + 'data': [ 'hyper-v', 's390', 'tdx' ] }
>
> > > +#
> > > +# Since: 8.2
> > > +##
> > > +{'struct': 'GuestPanicInformationTdx',
> > > + 'data': {'error-code': 'uint64',
> > > + 'gpa': 'uint64',
> > > + 'message': 'str'}}
> > > +
> > > ##
> > > # @MEMORY_FAILURE:
> > > #
> > > diff --git a/softmmu/runstate.c b/softmmu/runstate.c
> > > index f3bd86281813..cab11484ed7e 100644
> > > --- a/softmmu/runstate.c
> > > +++ b/softmmu/runstate.c
> > > @@ -518,7 +518,56 @@ void qemu_system_guest_panicked(GuestPanicInformation *info)
> > > S390CrashReason_str(info->u.s390.reason),
> > > info->u.s390.psw_mask,
> > > info->u.s390.psw_addr);
> > > + } else if (info->type == GUEST_PANIC_INFORMATION_TYPE_TDX) {
> > > + char *buf = NULL;
> > > + bool printable = false;
> > > +
> > > + /*
> > > + * Although message is defined as a json string, we shouldn't
> > > + * unconditionally treat it as is because the guest generated it and
> > > + * it's not necessarily trustable.
> > > + */
> > > + if (info->u.tdx.message) {
> > > + /* The caller guarantees the NUL-terminated string. */
> > > + int len = strlen(info->u.tdx.message);
> > > + int i;
> > > +
> > > + printable = len > 0;
> > > + for (i = 0; i < len; i++) {
> > > + if (!(0x20 <= info->u.tdx.message[i] &&
> > > + info->u.tdx.message[i] <= 0x7e)) {
> > > + printable = false;
> > > + break;
> > > + }
> > > + }
> > > +
> > > + /* 3 = length of "%02x " */
> > > + buf = g_malloc(len * 3);
> > > + for (i = 0; i < len; i++) {
> > > + if (info->u.tdx.message[i] == '\0') {
> > > + break;
> > > + } else {
> > > + sprintf(buf + 3 * i, "%02x ", info->u.tdx.message[i]);
> > > + }
> > > + }
> > > + if (i > 0)
> > > + /* replace the last ' '(space) to NUL */
> > > + buf[i * 3 - 1] = '\0';
> > > + else
> > > + buf[0] = '\0';
> >
> > You're building this escaped buffer but...
> >
> > > + }
> > > +
> > > + qemu_log_mask(LOG_GUEST_ERROR,
> > > + //" TDX report fatal error:\"%s\" %s",
> > > + " TDX report fatal error:\"%s\""
> > > + "error: 0x%016" PRIx64 " gpa page: 0x%016" PRIx64 "\n",
> > > + printable ? info->u.tdx.message : "",
> > > + //buf ? buf : "",
> >
> > ...then not actually using it
> >
> > Either delete the 'buf' code, or use it.
>
> Sorry for posting some internal testing version.
> Does below look good to you?
>
> @@ -518,7 +518,56 @@ void qemu_system_guest_panicked(GuestPanicInformation
> *info)
> S390CrashReason_str(info->u.s390.reason),
> info->u.s390.psw_mask,
> info->u.s390.psw_addr);
> + } else if (info->type == GUEST_PANIC_INFORMATION_TYPE_TDX) {
> + bool printable = false;
> + char *buf = NULL;
> + int len = 0, i;
> +
> + /*
> + * Although message is defined as a json string, we shouldn't
> + * unconditionally treat it as is because the guest generated
> it and
> + * it's not necessarily trustable.
> + */
> + if (info->u.tdx.message) {
> + /* The caller guarantees the NUL-terminated string. */
> + len = strlen(info->u.tdx.message);
> +
> + printable = len > 0;
> + for (i = 0; i < len; i++) {
> + if (!(0x20 <= info->u.tdx.message[i] &&
> + info->u.tdx.message[i] <= 0x7e)) {
> + printable = false;
> + break;
> + }
> + }
> + }
> +
> + if (!printable && len) {
> + /* 3 = length of "%02x " */
> + buf = g_malloc(len * 3);
> + for (i = 0; i < len; i++) {
> + if (info->u.tdx.message[i] == '\0') {
> + break;
> + } else {
> + sprintf(buf + 3 * i, "%02x ",
> info->u.tdx.message[i]);
> + }
> + }
> + if (i > 0)
> + /* replace the last ' '(space) to NUL */
> + buf[i * 3 - 1] = '\0';
> + else
> + buf[0] = '\0';
> + }
> +
> + qemu_log_mask(LOG_GUEST_ERROR,
> + " TDX guest reports fatal error:\"%s\""
> + " error code: 0x%016" PRIx64 " gpa page: 0x%016"
> PRIx64 "\n",
> + printable ? info->u.tdx.message : buf,
> + info->u.tdx.error_code,
> + info->u.tdx.gpa);
> + g_free(buf);
> }
Ok that makes more sense now. BTW, probably a nice idea to create a
separate helper method that santizes the guest provided JSON into
the safe 'buf' string.
With regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
