feat: patched qemu 11.1.2 identity series with macos support

2026-10-10 01:11:44 +02:00
parent f99ff1400a
commit d47e1d5fa0
15 changed files with 606 additions and 59 deletions
@@ -0,0 +1,91 @@
+Subject: [PATCH] acpi: keep the CPU objects macOS needs without the FIRMWARE tell
+
+Targets VMAware check: FIRMWARE (CPU hotplug I/O signature)
+
+macOS references \_SB.CPUS.Cxxx from its own CpuPlug SSDT, so the guest needs
+QEMU's build_cpus_aml output (the \_SB.PCI0.PRES controller and the \_SB.CPUS
+Processor objects) or it hangs in ACPI namespace init. 01-firmware dropped that
+block because build_cpus_aml emits the CPU-hotplug register region at I/O port
+0x0CD8, which VMAware v2.8.1 FIRMWARE byte-matches as the WordData sequence
+0x0B 0xD8 0x0C and flips to a QEMU verdict. HEAD has no such check.
+
+This re-adds the block for every guest (no opt-in) and removes that one tell at
+the source rather than removing the whole block:
+
+  - the controller _UID is renamed from "CPU Hotplug resources" to "Reserved
+    resources C", clearing the FIRMWARE string match the same way 01-firmware
+    renamed the other reserved-resource devices.
+
+  - the PRST OperationRegion base is emitted as Add(0x0C00, 0xD8) for a SystemIO
+    base. It evaluates to the identical 0x0CD8 at namespace load, so the port
+    QEMU decodes and the port OVMF's SMM code reads directly are both unchanged.
+    Relocating the base instead was tried and breaks every SMM/OVMF guest (macOS
+    hangs at boot, Windows too), because OVMF hardcodes 0x0CD8. Splitting the
+    operand keeps 0x0CD8 live but never places the three matched bytes next to
+    each other in the AML.
+
+The _CRS IO descriptor keeps 0x0CD8 untouched: a small-resource IO descriptor
+encodes its base as 0xD8 0x0C preceded by the 0x47/0x01 descriptor bytes, never
+by 0x0B, so it is not the sequence the scanner matches.
+
+Verified against QEMU 11.1.2: macOS boots to login and powers off via S5;
+VMAware v2.8.1 and HEAD both read bare metal with FIRMWARE clear on the stealth
+guest; Windows and Linux boot unchanged.
+
+Applies to QEMU v11.1.2, on top of 01-firmware. From the source root:
+    patch -p1 < 11-macos-cpu-hotplug.patch
+
+--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
+@@ -1002,6 +1002,16 @@
+     }
+     aml_append(dsdt, scope);
+ 
+    {
+        CPUHotplugFeatures opts = {
+            .acpi_1_compatible = true,
+            .smi_path = pm->smi_on_cpuhp ? "\\_SB.PCI0.SMI0.SMIC" : NULL,
+            .fw_unplugs_cpu = pm->smi_on_cpu_unplug,
+        };
+        build_cpus_aml(dsdt, machine, opts, pc_madt_cpu_entry,
+                       pm->cpu_hp_io_base, "\\_SB.PCI0", "\\_GPE._E02",
+                       AML_SYSTEM_IO);
+    }
+ 
+     crs_range_set_init(&crs_range_set);
+     bus = PC_MACHINE(machine)->pcibus;
+--- a/hw/acpi/cpu.c
+++ b/hw/acpi/cpu.c
+@@ -363,7 +363,7 @@
+         aml_append(cpu_ctrl_dev,
+             aml_name_decl("_HID", aml_eisaid("PNP0A06")));
+         aml_append(cpu_ctrl_dev,
+-            aml_name_decl("_UID", aml_string("CPU Hotplug resources")));
+            aml_name_decl("_UID", aml_string("Reserved resources C")));
+         aml_append(cpu_ctrl_dev, aml_mutex(CPU_LOCK, 0));
+ 
+         assert((rs == AML_SYSTEM_IO) || (rs == AML_SYSTEM_MEMORY));
+@@ -379,9 +379,21 @@
+ 
+         aml_append(cpu_ctrl_dev, aml_name_decl("_CRS", crs));
+ 
+-        /* declare CPU hotplug MMIO region with related access fields */
+        /*
+         * Declare the CPU hotplug register block. The region is at the same
+         * fixed base QEMU decodes and firmware (OVMF SMM) reads directly, so
+         * that is unchanged. Only the base operand's AML encoding is split
+         * across an Add() for a SystemIO base: emitting the 16-bit port as a
+         * single WordData leaks the exact three-byte sequence a VM-detection
+         * scanner byte-matches on. The Add() evaluates to the identical base
+         * at namespace load but never places those bytes contiguously.
+         */
+        Aml *region_base = (rs == AML_SYSTEM_IO)
+            ? aml_add(aml_int(base_addr & 0xff00),
+                      aml_int(base_addr & 0x00ff), NULL)
+            : aml_int(base_addr);
+         aml_append(cpu_ctrl_dev,
+-            aml_operation_region("PRST", rs, aml_int(base_addr),
+            aml_operation_region("PRST", rs, region_base,
+                                  ACPI_CPU_HOTPLUG_REG_LEN));
+ 
+         field = aml_field("PRST", AML_BYTE_ACC, AML_NOLOCK,