Replace the Apple PAC emulation in target/arm with the contract the
vmapple kernel actually uses. Firmware writes the architected PAC keys
once on the boot CPU; the kernel never writes a key register and asks
the hypervisor over SMCCC (0xc100000x, HAS_PARAVIRTUALIZED_PAC).
- target/arm: pauth_helper.c, helper.c, cpu.{c,h}, internals.h and
arm-powerctl.c restored to upstream. The KERNELKEY/APCTL/APCFG
registers, kernel-key mixing, AppleMode, the diversifier and
PAC_INHERIT are gone: no firmware stage or kernel touches them.
- target/arm/smccc.{c,h}: a board handler for non-PSCI SMCCC calls,
offered each call from TCG's PSCI path, KVM and WHPX.
- hw/vmapple/hvc.c: SET_INITIAL_STATE saves the boot CPU's keys and
installs them on each secondary; GET_DEFAULT_KEYS returns random
non-zero pids (zero pids kill launchd); per-process key calls
succeed as no-ops; every call returns 0 (xnu 26 spins otherwise).
On the boot CPU's call, device-tree timebase-frequency is rewritten
to the real counter rate before pe_identify_machine() reads it.
- Timer routed through the GIC as PPI 27 only: xnu's pe_init_fiq()
makes it group 0, which GICv3 signals as FIQ. The FIQ-OR gate and
the out-of-tree KVM_CAP_ARM_APPLE_VM requirement are removed.
- KVM: SMCCC filter forwarding the Apple range, KVM_EXIT_HYPERCALL
handling, and KVM_EXIT_ARM_NISV emulation (target/arm/emulate-ldst)
for pe_init_fiq's pre-indexed GICR_IGROUPR0 store, applied to the
in-kernel vGIC through device attributes.
- WHPX: hypercall exits, ISV=0 MMIO emulation instead of an assert,
and the GIC addresses taken from the machine.
- All ORCHARD_* switches removed.
Tested under TCG on x86-64: Ventura boots to the desktop with 12
vCPUs; guest clock rate 1.0006 with a 19.2 MHz counter (0.801 without
the device-tree fix). KVM code is syntax-checked for arm64 only;
WHPX code is not compiled. Neither has run.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
- Absorb the reims-vgpu submodule as a plain directory with our four GPU changes baked in; remove .gitmodules and the nested vendor/qemu stub
- Delete patches/: the reims-vgpu diffs now live in the tree, the qemu reference diff and the host-kernel patch are gone
- scripts/build.sh no longer inits submodules or applies patches; it fails early if reims-vgpu/ is missing
- arm-wrapper/ is local-only for now: untracked, ignored, files preserved in the working tree
Signed-off-by: Youssef <soosef.youssef@gmail.com>
- hw/vmapple: headless no-gfx stub, KVM_CAP_ARM_APPLE_VM (20306) gating, PMU off and PSCI 1.1 under KVM
- target/arm: log faulting insn on KVM no-syndrome data aborts
- hw/display: pass cargo --target and C compiler/linker on cross builds
- hw/display/reims-vgpu-mmio: gfx_update now returns bool (upstream GraphicHwOps change); report synchronous completion like the PCI shim
Signed-off-by: Youssef <soosef.youssef@gmail.com>
Boots an arm64 macOS guest on QEMU/TCG on Linux through the genuine Apple
chain -- AVPBooter -> iBootStage1 -> iBootStage2 -> stock XNU -- and renders
its desktop on the host's Vulkan.
QEMU (1044 lines over 18 files, 8 new):
* the `apple-vm` machine: Apple-style timer-on-FIQ wiring, the paravirtual
GPU device, a PAC master key installed across CPUs, and GICv2m's
`macos-compat` bit, without which macOS will not use the MSI frame;
* `bdif` NVRAM block writes. Upstream drops them, so a guest could never
persist a boot variable and every install phase repeated forever;
* `cfg`'s guest-visible random seed at its fixed offset;
* Apple pointer authentication under TCG: the register definitions come
from ChefKissInc/Inferno, the per-core key snapshot and the PSCI CPU_ON
key inheritance (restricted to a kernel caller by testing that its pc is
in the TTBR1 half) are ours. Without them secondaries run keyless and the
first cross-core authentication recurses through its own panic path;
* portability work upstream has not needed before: CONFIG_VMAPPLE was gated
on HVF and shipped off, hw/vmapple/aes.c has a VLA that only compiled
under clang, and the architectural op1-to-minimum-EL assertion rejects
Apple's IMPDEF registers.
The GPU is steelbrain/reims-vgpu, carried as a submodule pinned to the commit
this was tested against; the two changes it needs are in patches/reims-vgpu/.
The AVPBooter patch is NyanSatan's, from Virtual-iBoot-Fun.
Nothing Apple ships is in this repository. The macOS image is fetched from a
public tart image, and Apple's VM firmware is extracted from that image, where
Virtualization.framework carries it -- so no Mac is involved in the setup.
Measured on the reference host: desktop in 75 s at 12 vCPUs and 10 GB.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Youssef <soosef.youssef@gmail.com>
