Boots an arm64 macOS guest on QEMU/TCG on Linux through the genuine Apple
chain -- AVPBooter -> iBootStage1 -> iBootStage2 -> stock XNU -- and renders
its desktop on the host's Vulkan.
QEMU (1044 lines over 18 files, 8 new):
* the `apple-vm` machine: Apple-style timer-on-FIQ wiring, the paravirtual
GPU device, a PAC master key installed across CPUs, and GICv2m's
`macos-compat` bit, without which macOS will not use the MSI frame;
* `bdif` NVRAM block writes. Upstream drops them, so a guest could never
persist a boot variable and every install phase repeated forever;
* `cfg`'s guest-visible random seed at its fixed offset;
* Apple pointer authentication under TCG: the register definitions come
from ChefKissInc/Inferno, the per-core key snapshot and the PSCI CPU_ON
key inheritance (restricted to a kernel caller by testing that its pc is
in the TTBR1 half) are ours. Without them secondaries run keyless and the
first cross-core authentication recurses through its own panic path;
* portability work upstream has not needed before: CONFIG_VMAPPLE was gated
on HVF and shipped off, hw/vmapple/aes.c has a VLA that only compiled
under clang, and the architectural op1-to-minimum-EL assertion rejects
Apple's IMPDEF registers.
The GPU is steelbrain/reims-vgpu, carried as a submodule pinned to the commit
this was tested against; the two changes it needs are in patches/reims-vgpu/.
The AVPBooter patch is NyanSatan's, from Virtual-iBoot-Fun.
Nothing Apple ships is in this repository. The macOS image is fetched from a
public tart image, and Apple's VM firmware is extracted from that image, where
Virtualization.framework carries it -- so no Mac is involved in the setup.
Measured on the reference host: desktop in 75 s at 12 vCPUs and 10 GB.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Youssef <soosef.youssef@gmail.com>
26710d37c7