sandwich/vfio-native
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: patched qemu 11.1.2 identity series with macos support

Browse Source
This commit is contained in:
sandwich
2026-10-10 01:11:44 +02:00
parent f99ff1400a
commit d47e1d5fa0
15 changed files with 606 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files
patches/README.md
+19 -3
View File
@@ -34,7 +34,7 @@ enabled through the `cpuid_passthrough` module parameter after the guest has boo
## QEMU - `qemu/`
Against QEMU v11.1.1. Apply in numeric order.
Against QEMU v11.1.2. Apply in numeric order.
| Patch | Clears |
| --- | --- |
@@ -46,11 +46,25 @@ Against QEMU v11.1.1. Apply in numeric order.
| `06-audio` | `DEVICES` - HDA codec and controller identity |
| `07-edid` | none. Carried for other detectors; VMAware does not read EDID. |
| `08-cpu-misc` | none. CPU feature plumbing and one upstream backport. |
| `09-firmware-chain` | `FIRMWARE` - the DSDT links current VMAware added after `01-firmware` |
| `10-smbios` | `CTYPE`, `SMBIOS_VM_BIT`, `FIRMWARE` - what QEMU's synthesised SMBIOS leaks: chassis type Other, the type 0 VM bit, `pc-q35` default strings; adds `-smbios type=3,chassis-type=N` |
| `11-macos-cpu-hotplug` | `FIRMWARE` - re-adds the `\_SB.CPUS` CPU objects macOS needs, with the CPU-hotplug I/O base `0x0CD8` hidden from the scanner (renamed `_UID`, `Add()`-split OperationRegion base) rather than removed |
`patch -p1 < qemu/01-firmware.patch` and so on, then build with the prefix set to `/opt` so the
system QEMU package is left alone:
The numbered patches are the default series and score 0/85 on both VMAware HEAD and v2.8.1.
`03-pci-ids` scopes the virtio subsystem-id change so OVMF still binds virtio (its generic default
goes to Intel/0, virtio devices keep the Red Hat subsystem ids their drivers and OVMF expect).
`11-macos-cpu-hotplug` makes the series universal: macOS boots (it needs the `\_SB.CPUS.Cxxx`
objects from `build_cpus_aml`) and both VMAware builds still read bare metal, with no opt-in. The
block's only tell, the `0x0CD8` CPU-hotplug port that v2.8.1 FIRMWARE byte-matches, is removed at
the AML level without moving the port, so the same series boots Windows and Linux unchanged. The
earlier opt-in split and the relocate-the-base approach are in "Approaches tried and rejected".
Apply in numeric order, then build with the prefix set to `/opt` so the system QEMU package is left
alone:
```sh
for p in qemu/[0-9][0-9]-*.patch; do patch -p1 < "$p"; done
./configure --prefix=/opt/qemu-native --target-list=x86_64-softmmu
ninja -C build && ninja -C build install
```
@@ -64,6 +78,8 @@ ninja -C build && ninja -C build install
| CPUID leaf override (Hypervisor-Phantom) | Halved the timing signature, still detected, and *added* a `SINGLE_STEP` detection. |
| Clearing `INTERCEPT_CPUID` outright | Guest never boots. |
| Intercept clearing, minimal hypercall | Triple fault, or no effect. |
| Opt-in macOS CPU block (`optional/macos-cpu-hotplug`) | Worked but split the series in two; a macOS-capable build scored 2/85 on v2.8.1. Folded into `11` instead. |
| Relocating the CPU-hotplug I/O base off `0x0CD8` | Clears the scanner but hangs every SMM/OVMF guest (macOS spins 10 cores at boot, Windows too): OVMF hardcodes `0x0CD8` in `OvmfPkg` and reads the register block directly. `11` keeps the port and hides only the AML operand. |
`TIMER` has two detectors that OR together. The exception-latency one passes on stock KVM once it
is measured the way VMAware measures it; the instruction-latency one is removable with