[RFC v2 0/4] vmapple: making it work on the latest macOS releaases and Apple M4

[RFC v2 0/4] vmapple: making it work on the latest macOS releaases and Apple M4

[Mohamed Mediouni]

RFC as it's hacky code, especially for the Apple M4 support workaround part.
Support for newer guest OSes isn't part of this series.

v1->v2:
Remove some lines that shouldn't have been present...

Mohamed Mediouni (4):
  hw: vmapple: include missing headers
  hvf: arm64: add workaround for Apple M4 to run older macOS versions
  vmapple: apple-gfx: make it work on the latest macOS release
  Revert "hw/arm: Do not build VMapple machine by default"

 accel/hvf/hvf-accel-ops.c                   |  4 +-
 configs/devices/aarch64-softmmu/default.mak |  1 -
 hw/display/apple-gfx-mmio.m                 | 56 ++++++++++++-----
 hw/display/apple-gfx.h                      | 13 ++++
 hw/display/apple-gfx.m                      | 42 ++++++++++++-
 hw/vmapple/vmapple.c                        |  2 +
 include/system/hvf_int.h                    |  4 ++
 target/arm/hvf/hvf.c                        | 68 +++++++++++++++++++++
 8 files changed, 171 insertions(+), 19 deletions(-)

-- 
2.50.1 (Apple Git-155)

[RFC v2 1/4] hw: vmapple: include missing headers

[Mohamed Mediouni]

Disablement by default led to:

../hw/vmapple/vmapple.c:276:39: error: use of undeclared identifier 'GTIMER_VIRT'
  276 |         qdev_connect_gpio_out(cpudev, GTIMER_VIRT,
      |                                       ^
../hw/vmapple/vmapple.c:479:54: error: use of undeclared identifier 'QEMU_PSCI_CONDUIT_HVC'
  479 |         object_property_set_int(cpu, "psci-conduit", QEMU_PSCI_CONDUIT_HVC,
      |                                                      ^
../hw/vmapple/vmapple.c:556:13: error: call to undeclared function 'arm_build_mp_affinity'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
  556 |             arm_build_mp_affinity(n, GICV3_TARGETLIST_BITS);
      |             ^
3 errors generated.

pretty quickly.

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
 hw/vmapple/vmapple.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/vmapple/vmapple.c b/hw/vmapple/vmapple.c
index 16e6110b68..5928df4411 100644
--- a/hw/vmapple/vmapple.c
+++ b/hw/vmapple/vmapple.c
@@ -51,6 +51,8 @@
 #include "system/reset.h"
 #include "system/runstate.h"
 #include "system/system.h"
+#include "gtimer.h"
+#include "cpu.h"
 
 struct VMAppleMachineState {
     MachineState parent;
-- 
2.50.1 (Apple Git-155)

[RFC v2 2/4] hvf: arm64: add workaround for Apple M4 to run older macOS versions

[Mohamed Mediouni]

Apple M4 removes FEAT_SSBS. However, older macOS releases
do misbehave in such a configuration and do not boot.

Use private API to trap SCTLR_EL1 accesses through FGT.

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
 accel/hvf/hvf-accel-ops.c |  4 +--
 include/system/hvf_int.h  |  4 +++
 target/arm/hvf/hvf.c      | 68 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 74 insertions(+), 2 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 8b794c2d41..64d7afc3bf 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -152,8 +152,8 @@ static int hvf_init_vcpu(CPUState *cpu)
     sigdelset(&cpu->accel->unblock_ipi_mask, SIG_IPI);
 
 #ifdef __aarch64__
-    r = hv_vcpu_create(&cpu->accel->fd,
-                       (hv_vcpu_exit_t **)&cpu->accel->exit, NULL);
+    r = hvf_vcpu_create(&cpu->accel->fd,
+                       (hv_vcpu_exit_t **)&cpu->accel->exit);
 #else
     r = hv_vcpu_create(&cpu->accel->fd, HV_VCPU_DEFAULT);
 #endif
diff --git a/include/system/hvf_int.h b/include/system/hvf_int.h
index a3b06a3e75..baee11d478 100644
--- a/include/system/hvf_int.h
+++ b/include/system/hvf_int.h
@@ -111,4 +111,8 @@ void hvf_arch_update_guest_debug(CPUState *cpu);
  */
 bool hvf_arch_supports_guest_debug(void);
 
+#ifdef __aarch64__
+hv_return_t hvf_vcpu_create(hv_vcpu_t* vcpu_ptr, hv_vcpu_exit_t ** exit);
+#endif
+
 #endif
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 0658a99a2d..f503e1d1b8 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -22,6 +22,7 @@
 #include "cpu-sysregs.h"
 
 #include <mach/mach_time.h>
+#include <sys/sysctl.h>
 
 #include "system/address-spaces.h"
 #include "system/memory.h"
@@ -292,6 +293,8 @@ void hvf_arm_init_debug(void)
 #define SYSREG_DBGWVR15_EL1   SYSREG(2, 0, 0, 15, 6)
 #define SYSREG_DBGWCR15_EL1   SYSREG(2, 0, 0, 15, 7)
 
+#define SYSREG_SCTLR_EL1      SYSREG(3, 0, 1, 0, 0)
+
 #define WFX_IS_WFE (1 << 0)
 
 #define TMR_CTL_ENABLE  (1 << 0)
@@ -1320,6 +1323,9 @@ static int hvf_sysreg_read(CPUState *cpu, uint32_t reg, uint64_t *val)
     case SYSREG_DBGWCR15_EL1:
         *val = env->cp15.dbgwcr[SYSREG_CRM(reg)];
         return 0;
+    case SYSREG_SCTLR_EL1:
+        *val =  env->cp15.sctlr_el[1] | SCTLR_DSSBS_64;
+        return 0;
     default:
         if (is_id_sysreg(reg)) {
             /* ID system registers read as RES0 */
@@ -1643,6 +1649,10 @@ static int hvf_sysreg_write(CPUState *cpu, uint32_t reg, uint64_t val)
     case SYSREG_DBGWCR15_EL1:
         env->cp15.dbgwcr[SYSREG_CRM(reg)] = val;
         return 0;
+    case SYSREG_SCTLR_EL1:
+        env->cp15.sctlr_el[1] = val;
+        assert_hvf_ok(hv_vcpu_set_sys_reg(cpu->accel->fd, HV_SYS_REG_SCTLR_EL1, val & ~SCTLR_DSSBS_64));
+        return 0;
     }
 
     cpu_synchronize_state(cpu);
@@ -2244,3 +2254,61 @@ bool hvf_arch_supports_guest_debug(void)
 {
     return true;
 }
+
+/*
+ * Apple M4 removes FEAT_SSBS. However, older macOS releases
+ * do misbehave in such a configuration and do not boot.
+ *
+ * Using private API to trap SCTLR_EL1 accesses through FGT.
+ */
+
+void _hv_vcpu_config_set_fgt_enabled(hv_vcpu_config_t cfg, bool enabled);
+#define HV_CONTROL_FIELD_HFGRTR 0xb
+#define HV_CONTROL_FIELD_HFGWTR 0xc
+hv_return_t _hv_vcpu_get_control_field(hv_vcpu_t vcpu, int field, uint64_t* value);
+hv_return_t _hv_vcpu_set_control_field(hv_vcpu_t vcpu, int field, uint64_t value);
+
+static bool hvf_is_ssbs_implemented(void) {
+    int has_ssbs = -1;
+    size_t has_ssbs_sz = sizeof(has_ssbs);
+    if (sysctlbyname("hw.optional.arm.FEAT_SSBS", &has_ssbs, &has_ssbs_sz, NULL, 0) == -1) {
+        has_ssbs = 0;
+    }
+    return has_ssbs;
+}
+
+hv_return_t hvf_vcpu_create(hv_vcpu_t* vcpu_ptr, hv_vcpu_exit_t ** exit)
+{
+    hv_return_t r;
+    hv_vcpu_t vcpu;
+    uint64_t hfgwtr_el1, hfgrtr_el1;
+
+    hv_vcpu_config_t config;
+    config = hv_vcpu_config_create();
+    if (!hvf_is_ssbs_implemented()) {
+        _hv_vcpu_config_set_fgt_enabled(config, true);
+    }
+
+    r = hv_vcpu_create(&vcpu, (hv_vcpu_exit_t **)exit, config);
+
+    if (hvf_is_ssbs_implemented()) {
+        return r;
+    }
+
+    assert_hvf_ok(_hv_vcpu_get_control_field(vcpu, HV_CONTROL_FIELD_HFGWTR,&hfgwtr_el1));
+    assert_hvf_ok(_hv_vcpu_set_control_field(vcpu, HV_CONTROL_FIELD_HFGWTR,
+        hfgwtr_el1 | R_HFGWTR_EL2_SCTLR_EL1_MASK));
+    assert_hvf_ok(_hv_vcpu_get_control_field(vcpu, HV_CONTROL_FIELD_HFGWTR,
+        &hfgwtr_el1));
+
+    assert_hvf_ok(_hv_vcpu_get_control_field(vcpu, HV_CONTROL_FIELD_HFGRTR,
+        &hfgrtr_el1));
+    assert_hvf_ok(_hv_vcpu_set_control_field(vcpu, HV_CONTROL_FIELD_HFGRTR,
+        hfgrtr_el1 | R_HFGRTR_EL2_SCTLR_EL1_MASK));
+    assert_hvf_ok(_hv_vcpu_get_control_field(vcpu, HV_CONTROL_FIELD_HFGRTR,
+        &hfgrtr_el1));
+
+    *vcpu_ptr = vcpu;
+
+    return r;
+}
-- 
2.50.1 (Apple Git-155)

[RFC v2 3/4] vmapple: apple-gfx: make it work on the latest macOS release

[Mohamed Mediouni]

Follow changes in memory management, and enable process isolation for a sandboxed GPU process when on a new OS.

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
 hw/display/apple-gfx-mmio.m | 56 +++++++++++++++++++++++++++----------
 hw/display/apple-gfx.h      | 13 +++++++++
 hw/display/apple-gfx.m      | 42 +++++++++++++++++++++++++++-
 3 files changed, 95 insertions(+), 16 deletions(-)

diff --git a/hw/display/apple-gfx-mmio.m b/hw/display/apple-gfx-mmio.m
index b0b6e2993e..728441d490 100644
--- a/hw/display/apple-gfx-mmio.m
+++ b/hw/display/apple-gfx-mmio.m
@@ -19,6 +19,7 @@
 #include "hw/irq.h"
 #include "apple-gfx.h"
 #include "trace.h"
+#include "system/address-spaces.h"
 
 #import <ParavirtualizedGraphics/ParavirtualizedGraphics.h>
 
@@ -34,14 +35,25 @@
 typedef bool(^IOSFCMapMemory)(uint64_t phys, uint64_t len, bool ro, void **va,
                               void *, void *);
 
+@interface PGMemoryMapDescriptor : NSObject
+-(void)addRange:(struct PGGuestPhysicalRange_s) range;
+@end
+
 @interface PGDeviceDescriptor (IOSurfaceMapper)
 @property (readwrite, nonatomic) bool usingIOSurfaceMapper;
+@property (readwrite, nonatomic) bool enableArgumentBuffers;
+@property (readwrite, nonatomic) bool enableProcessIsolation;
+@property (readwrite, nonatomic) bool enableProtectedContent;
+
+@property (readwrite, nonatomic, copy, nullable) PGMemoryMapDescriptor* memoryMapDescriptor;
 @end
 
 @interface PGIOSurfaceHostDeviceDescriptor : NSObject
 -(PGIOSurfaceHostDeviceDescriptor *)init;
 @property (readwrite, nonatomic, copy, nullable) IOSFCMapMemory mapMemory;
 @property (readwrite, nonatomic, copy, nullable) IOSFCUnmapMemory unmapMemory;
+@property (readwrite, nonatomic, copy, nullable) PGMemoryMapDescriptor* memoryMapDescriptor;
+@property (readwrite, nonatomic) unsigned long long mmioLength;
 @property (readwrite, nonatomic, copy, nullable) IOSFCRaiseInterrupt raiseInterrupt;
 @end
 
@@ -182,20 +194,28 @@ static bool apple_gfx_mmio_unmap_surface_memory(void *ptr)
     PGIOSurfaceHostDeviceDescriptor *iosfc_desc =
         [PGIOSurfaceHostDeviceDescriptor new];
     PGIOSurfaceHostDevice *iosfc_host_dev;
-
-    iosfc_desc.mapMemory =
-        ^bool(uint64_t phys, uint64_t len, bool ro, void **va, void *e, void *f) {
-            *va = apple_gfx_mmio_map_surface_memory(phys, len, ro);
-
-            trace_apple_gfx_iosfc_map_memory(phys, len, ro, va, e, f, *va);
-
-            return *va != NULL;
-        };
-
-    iosfc_desc.unmapMemory =
-        ^bool(void *va, void *b, void *c, void *d, void *e, void *f) {
-            return apple_gfx_mmio_unmap_surface_memory(va);
-        };
+    PGMemoryMapDescriptor* memoryMapDescriptor = [PGMemoryMapDescriptor new];
+
+    if (@available(macOS 15.4, *)) {
+        FlatView* fv = address_space_to_flatview(&address_space_memory);
+        flatview_for_each_range(fv, apple_gfx_register_memory_cb, memoryMapDescriptor);
+        iosfc_desc.mmioLength = 0x10000;
+        iosfc_desc.memoryMapDescriptor = memoryMapDescriptor;
+    } else {
+        iosfc_desc.mapMemory =
+            ^bool(uint64_t phys, uint64_t len, bool ro, void **va, void *e, void *f) {
+                *va = apple_gfx_mmio_map_surface_memory(phys, len, ro);
+
+                trace_apple_gfx_iosfc_map_memory(phys, len, ro, va, e, f, *va);
+
+                return *va != NULL;
+            };
+
+        iosfc_desc.unmapMemory =
+            ^bool(void *va, void *b, void *c, void *d, void *e, void *f) {
+                return apple_gfx_mmio_unmap_surface_memory(va);
+            };
+    }
 
     iosfc_desc.raiseInterrupt = ^bool(uint32_t vector) {
         trace_apple_gfx_iosfc_raise_irq(vector);
@@ -223,13 +243,19 @@ static void apple_gfx_mmio_realize(DeviceState *dev, Error **errp)
         };
 
         desc.usingIOSurfaceMapper = true;
-        s->pgiosfc = apple_gfx_prepare_iosurface_host_device(s);
+        desc.enableArgumentBuffers = true;
+        // Process isolation needs to go through PGMemoryMapDescriptor
+        if (@available(macOS 15.4, *)) {
+            desc.enableProcessIsolation = true;
+        }
 
         if (!apple_gfx_common_realize(&s->common, dev, desc, errp)) {
             [s->pgiosfc release];
             s->pgiosfc = nil;
         }
 
+        s->pgiosfc = apple_gfx_prepare_iosurface_host_device(s);
+
         [desc release];
         desc = nil;
     }
diff --git a/hw/display/apple-gfx.h b/hw/display/apple-gfx.h
index a8b1d1efc0..0f7cf33adf 100644
--- a/hw/display/apple-gfx.h
+++ b/hw/display/apple-gfx.h
@@ -23,6 +23,13 @@
 @protocol MTLTexture;
 @protocol MTLCommandQueue;
 
+typedef struct PGGuestPhysicalRange_s
+{
+    uint64_t physicalAddress;
+    uint64_t physicalLength;
+    void *hostAddress;
+} PGGuestPhysicalRange_t;
+
 typedef QTAILQ_HEAD(, PGTask_s) PGTaskList;
 
 typedef struct AppleGFXDisplayMode {
@@ -68,6 +75,12 @@ void *apple_gfx_host_ptr_for_gpa_range(uint64_t guest_physical,
                                        uint64_t length, bool read_only,
                                        MemoryRegion **mapping_in_region);
 
+bool apple_gfx_register_memory_cb(Int128 start,
+                            Int128 len,
+                            const MemoryRegion *mr,
+                            hwaddr offset_in_region,
+                            void *opaque);
+
 extern const PropertyInfo qdev_prop_apple_gfx_display_mode;
 
 #endif
diff --git a/hw/display/apple-gfx.m b/hw/display/apple-gfx.m
index 174d56ae05..238b227176 100644
--- a/hw/display/apple-gfx.m
+++ b/hw/display/apple-gfx.m
@@ -21,6 +21,7 @@
 #include "system/address-spaces.h"
 #include "system/dma.h"
 #include "migration/blocker.h"
+#include "system/memory.h"
 #include "ui/console.h"
 #include "apple-gfx.h"
 #include "trace.h"
@@ -596,6 +597,41 @@ void apple_gfx_common_init(Object *obj, AppleGFXState *s, const char* obj_name)
     /* TODO: PVG framework supports serialising device state: integrate it! */
 }
 
+@interface PGMemoryMapDescriptor : NSObject
+-(void)addRange:(struct PGGuestPhysicalRange_s) range;
+@end
+
+@interface PGDeviceDescriptor (IOSurfaceMapper)
+@property (readwrite, nonatomic, copy, nullable) PGMemoryMapDescriptor* memoryMapDescriptor;
+@end
+
+bool apple_gfx_register_memory_cb(Int128 start,
+                            Int128 len,
+                            const MemoryRegion *mr,
+                            hwaddr offset_in_region,
+                            void *opaque) {
+    PGGuestPhysicalRange_t range;
+    PGMemoryMapDescriptor* memoryMapDescriptor = opaque;
+    if (mr->ram) {
+        range.physicalAddress = start;
+        range.physicalLength = len;
+        range.hostAddress = memory_region_get_ram_ptr(mr);
+        [memoryMapDescriptor addRange:range];
+    }
+    return false;
+}
+
+static void apple_gfx_register_memory(AppleGFXState *s,
+                                                     PGDeviceDescriptor *desc)
+{
+    PGMemoryMapDescriptor* memoryMapDescriptor = [PGMemoryMapDescriptor new];
+
+    FlatView* fv = address_space_to_flatview(&address_space_memory);
+    flatview_for_each_range(fv, apple_gfx_register_memory_cb, memoryMapDescriptor);
+
+    desc.memoryMapDescriptor = memoryMapDescriptor;
+}
+
 static void apple_gfx_register_task_mapping_handlers(AppleGFXState *s,
                                                      PGDeviceDescriptor *desc)
 {
@@ -763,7 +799,11 @@ bool apple_gfx_common_realize(AppleGFXState *s, DeviceState *dev,
 
     desc.device = s->mtl;
 
-    apple_gfx_register_task_mapping_handlers(s, desc);
+    if (@available(macOS 15.4, *)) {
+        apple_gfx_register_memory(s, desc);
+    } else {
+        apple_gfx_register_task_mapping_handlers(s, desc);
+    }
 
     s->cursor_show = true;
 
-- 
2.50.1 (Apple Git-155)

[RFC v2 4/4] Revert "hw/arm: Do not build VMapple machine by default"

[Mohamed Mediouni]

This reverts commit 49551752e860f5e403cdacac11ee1d218141fd3d.

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
 configs/devices/aarch64-softmmu/default.mak | 1 -
 1 file changed, 1 deletion(-)

diff --git a/configs/devices/aarch64-softmmu/default.mak b/configs/devices/aarch64-softmmu/default.mak
index ad8028cfd4..93f4022ad6 100644
--- a/configs/devices/aarch64-softmmu/default.mak
+++ b/configs/devices/aarch64-softmmu/default.mak
@@ -9,4 +9,3 @@ include ../arm-softmmu/default.mak
 # CONFIG_XLNX_VERSAL=n
 # CONFIG_SBSA_REF=n
 # CONFIG_NPCM8XX=n
-CONFIG_VMAPPLE=n
-- 
2.50.1 (Apple Git-155)

Re: [RFC v2 2/4] hvf: arm64: add workaround for Apple M4 to run older macOS versions

[Alexander Graf]

On 07.10.25 22:31, Mohamed Mediouni wrote:
> Apple M4 removes FEAT_SSBS. However, older macOS releases
> do misbehave in such a configuration and do not boot.
>
> Use private API to trap SCTLR_EL1 accesses through FGT.
>
> Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>


These old macOS versions did not include M4 support, correct? So 
wouldn't it make more sense to make more recent macOS work instead?

Alex

Re: [RFC v2 4/4] Revert "hw/arm: Do not build VMapple machine by default"

[Alexander Graf]

On 07.10.25 22:31, Mohamed Mediouni wrote:
> This reverts commit 49551752e860f5e403cdacac11ee1d218141fd3d.


The commit was there for a reason. What is the rationale to revert? Is 
it safe to do so now?

Alex


>
> Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
> ---
>   configs/devices/aarch64-softmmu/default.mak | 1 -
>   1 file changed, 1 deletion(-)
>
> diff --git a/configs/devices/aarch64-softmmu/default.mak b/configs/devices/aarch64-softmmu/default.mak
> index ad8028cfd4..93f4022ad6 100644
> --- a/configs/devices/aarch64-softmmu/default.mak
> +++ b/configs/devices/aarch64-softmmu/default.mak
> @@ -9,4 +9,3 @@ include ../arm-softmmu/default.mak
>   # CONFIG_XLNX_VERSAL=n
>   # CONFIG_SBSA_REF=n
>   # CONFIG_NPCM8XX=n
> -CONFIG_VMAPPLE=n

Re: [RFC v2 3/4] vmapple: apple-gfx: make it work on the latest macOS release

[Alexander Graf]

On 07.10.25 22:31, Mohamed Mediouni wrote:
> Follow changes in memory management, and enable process isolation for a sandboxed GPU process when on a new OS.


Please detail here why this is necessary.


>
> Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
> ---
>   hw/display/apple-gfx-mmio.m | 56 +++++++++++++++++++++++++++----------
>   hw/display/apple-gfx.h      | 13 +++++++++
>   hw/display/apple-gfx.m      | 42 +++++++++++++++++++++++++++-
>   3 files changed, 95 insertions(+), 16 deletions(-)
>
> diff --git a/hw/display/apple-gfx-mmio.m b/hw/display/apple-gfx-mmio.m
> index b0b6e2993e..728441d490 100644
> --- a/hw/display/apple-gfx-mmio.m
> +++ b/hw/display/apple-gfx-mmio.m
> @@ -19,6 +19,7 @@
>   #include "hw/irq.h"
>   #include "apple-gfx.h"
>   #include "trace.h"
> +#include "system/address-spaces.h"
>   
>   #import <ParavirtualizedGraphics/ParavirtualizedGraphics.h>
>   
> @@ -34,14 +35,25 @@
>   typedef bool(^IOSFCMapMemory)(uint64_t phys, uint64_t len, bool ro, void **va,
>                                 void *, void *);
>   
> +@interface PGMemoryMapDescriptor : NSObject
> +-(void)addRange:(struct PGGuestPhysicalRange_s) range;
> +@end
> +
>   @interface PGDeviceDescriptor (IOSurfaceMapper)
>   @property (readwrite, nonatomic) bool usingIOSurfaceMapper;
> +@property (readwrite, nonatomic) bool enableArgumentBuffers;
> +@property (readwrite, nonatomic) bool enableProcessIsolation;
> +@property (readwrite, nonatomic) bool enableProtectedContent;
> +
> +@property (readwrite, nonatomic, copy, nullable) PGMemoryMapDescriptor* memoryMapDescriptor;
>   @end
>   
>   @interface PGIOSurfaceHostDeviceDescriptor : NSObject
>   -(PGIOSurfaceHostDeviceDescriptor *)init;
>   @property (readwrite, nonatomic, copy, nullable) IOSFCMapMemory mapMemory;
>   @property (readwrite, nonatomic, copy, nullable) IOSFCUnmapMemory unmapMemory;
> +@property (readwrite, nonatomic, copy, nullable) PGMemoryMapDescriptor* memoryMapDescriptor;
> +@property (readwrite, nonatomic) unsigned long long mmioLength;
>   @property (readwrite, nonatomic, copy, nullable) IOSFCRaiseInterrupt raiseInterrupt;
>   @end
>   
> @@ -182,20 +194,28 @@ static bool apple_gfx_mmio_unmap_surface_memory(void *ptr)
>       PGIOSurfaceHostDeviceDescriptor *iosfc_desc =
>           [PGIOSurfaceHostDeviceDescriptor new];
>       PGIOSurfaceHostDevice *iosfc_host_dev;
> -
> -    iosfc_desc.mapMemory =
> -        ^bool(uint64_t phys, uint64_t len, bool ro, void **va, void *e, void *f) {
> -            *va = apple_gfx_mmio_map_surface_memory(phys, len, ro);
> -
> -            trace_apple_gfx_iosfc_map_memory(phys, len, ro, va, e, f, *va);
> -
> -            return *va != NULL;
> -        };
> -
> -    iosfc_desc.unmapMemory =
> -        ^bool(void *va, void *b, void *c, void *d, void *e, void *f) {
> -            return apple_gfx_mmio_unmap_surface_memory(va);
> -        };
> +    PGMemoryMapDescriptor* memoryMapDescriptor = [PGMemoryMapDescriptor new];
> +
> +    if (@available(macOS 15.4, *)) {


This needs a big fat comment explaining what this condition is checking 
for, why it's doing that and what the effect of it is. I would also 
recommend to wrap this in something like a static inline bool function 
that gives it a descriptive name.


> +        FlatView* fv = address_space_to_flatview(&address_space_memory);
> +        flatview_for_each_range(fv, apple_gfx_register_memory_cb, memoryMapDescriptor);
> +        iosfc_desc.mmioLength = 0x10000;


Why 0x10000?


> +        iosfc_desc.memoryMapDescriptor = memoryMapDescriptor;
> +    } else {
> +        iosfc_desc.mapMemory =
> +            ^bool(uint64_t phys, uint64_t len, bool ro, void **va, void *e, void *f) {
> +                *va = apple_gfx_mmio_map_surface_memory(phys, len, ro);
> +
> +                trace_apple_gfx_iosfc_map_memory(phys, len, ro, va, e, f, *va);
> +
> +                return *va != NULL;
> +            };
> +
> +        iosfc_desc.unmapMemory =
> +            ^bool(void *va, void *b, void *c, void *d, void *e, void *f) {
> +                return apple_gfx_mmio_unmap_surface_memory(va);
> +            };
> +    }
>   
>       iosfc_desc.raiseInterrupt = ^bool(uint32_t vector) {
>           trace_apple_gfx_iosfc_raise_irq(vector);
> @@ -223,13 +243,19 @@ static void apple_gfx_mmio_realize(DeviceState *dev, Error **errp)
>           };
>   
>           desc.usingIOSurfaceMapper = true;
> -        s->pgiosfc = apple_gfx_prepare_iosurface_host_device(s);
> +        desc.enableArgumentBuffers = true;
> +        // Process isolation needs to go through PGMemoryMapDescriptor
> +        if (@available(macOS 15.4, *)) {
> +            desc.enableProcessIsolation = true;
> +        }
>   
>           if (!apple_gfx_common_realize(&s->common, dev, desc, errp)) {
>               [s->pgiosfc release];
>               s->pgiosfc = nil;
>           }
>   
> +        s->pgiosfc = apple_gfx_prepare_iosurface_host_device(s);
> +
>           [desc release];
>           desc = nil;
>       }
> diff --git a/hw/display/apple-gfx.h b/hw/display/apple-gfx.h
> index a8b1d1efc0..0f7cf33adf 100644
> --- a/hw/display/apple-gfx.h
> +++ b/hw/display/apple-gfx.h
> @@ -23,6 +23,13 @@
>   @protocol MTLTexture;
>   @protocol MTLCommandQueue;
>   
> +typedef struct PGGuestPhysicalRange_s
> +{
> +    uint64_t physicalAddress;
> +    uint64_t physicalLength;
> +    void *hostAddress;
> +} PGGuestPhysicalRange_t;
> +
>   typedef QTAILQ_HEAD(, PGTask_s) PGTaskList;
>   
>   typedef struct AppleGFXDisplayMode {
> @@ -68,6 +75,12 @@ void *apple_gfx_host_ptr_for_gpa_range(uint64_t guest_physical,
>                                          uint64_t length, bool read_only,
>                                          MemoryRegion **mapping_in_region);
>   
> +bool apple_gfx_register_memory_cb(Int128 start,
> +                            Int128 len,
> +                            const MemoryRegion *mr,
> +                            hwaddr offset_in_region,
> +                            void *opaque);
> +
>   extern const PropertyInfo qdev_prop_apple_gfx_display_mode;
>   
>   #endif
> diff --git a/hw/display/apple-gfx.m b/hw/display/apple-gfx.m
> index 174d56ae05..238b227176 100644
> --- a/hw/display/apple-gfx.m
> +++ b/hw/display/apple-gfx.m
> @@ -21,6 +21,7 @@
>   #include "system/address-spaces.h"
>   #include "system/dma.h"
>   #include "migration/blocker.h"
> +#include "system/memory.h"
>   #include "ui/console.h"
>   #include "apple-gfx.h"
>   #include "trace.h"
> @@ -596,6 +597,41 @@ void apple_gfx_common_init(Object *obj, AppleGFXState *s, const char* obj_name)
>       /* TODO: PVG framework supports serialising device state: integrate it! */
>   }
>   
> +@interface PGMemoryMapDescriptor : NSObject
> +-(void)addRange:(struct PGGuestPhysicalRange_s) range;
> +@end
> +
> +@interface PGDeviceDescriptor (IOSurfaceMapper)
> +@property (readwrite, nonatomic, copy, nullable) PGMemoryMapDescriptor* memoryMapDescriptor;
> +@end
> +
> +bool apple_gfx_register_memory_cb(Int128 start,
> +                            Int128 len,
> +                            const MemoryRegion *mr,
> +                            hwaddr offset_in_region,
> +                            void *opaque) {
> +    PGGuestPhysicalRange_t range;
> +    PGMemoryMapDescriptor* memoryMapDescriptor = opaque;
> +    if (mr->ram) {
> +        range.physicalAddress = start;
> +        range.physicalLength = len;
> +        range.hostAddress = memory_region_get_ram_ptr(mr);
> +        [memoryMapDescriptor addRange:range];
> +    }
> +    return false;
> +}


By creating a full external function for the new isolated case, but 
keeping the inline mapMemory function for the non-isolated case this 
creates an awkward asymmetry. Either move both into functions or keep 
both inline.


Alex

> +
> +static void apple_gfx_register_memory(AppleGFXState *s,
> +                                                     PGDeviceDescriptor *desc)
> +{
> +    PGMemoryMapDescriptor* memoryMapDescriptor = [PGMemoryMapDescriptor new];
> +
> +    FlatView* fv = address_space_to_flatview(&address_space_memory);
> +    flatview_for_each_range(fv, apple_gfx_register_memory_cb, memoryMapDescriptor);
> +
> +    desc.memoryMapDescriptor = memoryMapDescriptor;
> +}
> +
>   static void apple_gfx_register_task_mapping_handlers(AppleGFXState *s,
>                                                        PGDeviceDescriptor *desc)
>   {
> @@ -763,7 +799,11 @@ bool apple_gfx_common_realize(AppleGFXState *s, DeviceState *dev,
>   
>       desc.device = s->mtl;
>   
> -    apple_gfx_register_task_mapping_handlers(s, desc);
> +    if (@available(macOS 15.4, *)) {
> +        apple_gfx_register_memory(s, desc);
> +    } else {
> +        apple_gfx_register_task_mapping_handlers(s, desc);
> +    }
>   
>       s->cursor_show = true;
>   

Re: [RFC v2 1/4] hw: vmapple: include missing headers

[Alexander Graf]

On 07.10.25 22:31, Mohamed Mediouni wrote:
> Disablement by default led to:
>
> ../hw/vmapple/vmapple.c:276:39: error: use of undeclared identifier 'GTIMER_VIRT'
>    276 |         qdev_connect_gpio_out(cpudev, GTIMER_VIRT,
>        |                                       ^
> ../hw/vmapple/vmapple.c:479:54: error: use of undeclared identifier 'QEMU_PSCI_CONDUIT_HVC'
>    479 |         object_property_set_int(cpu, "psci-conduit", QEMU_PSCI_CONDUIT_HVC,
>        |                                                      ^
> ../hw/vmapple/vmapple.c:556:13: error: call to undeclared function 'arm_build_mp_affinity'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
>    556 |             arm_build_mp_affinity(n, GICV3_TARGETLIST_BITS);
>        |             ^
> 3 errors generated.
>
> pretty quickly.
>
> Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>


This patch should be stand alone and not RFC.

Alex


> ---
>   hw/vmapple/vmapple.c | 2 ++
>   1 file changed, 2 insertions(+)
>
> diff --git a/hw/vmapple/vmapple.c b/hw/vmapple/vmapple.c
> index 16e6110b68..5928df4411 100644
> --- a/hw/vmapple/vmapple.c
> +++ b/hw/vmapple/vmapple.c
> @@ -51,6 +51,8 @@
>   #include "system/reset.h"
>   #include "system/runstate.h"
>   #include "system/system.h"
> +#include "gtimer.h"
> +#include "cpu.h"
>   
>   struct VMAppleMachineState {
>       MachineState parent;

Re: [RFC v2 3/4] vmapple: apple-gfx: make it work on the latest macOS release

[Philippe Mathieu-Daudé]

On 7/10/25 23:19, Alexander Graf wrote:
> 
> On 07.10.25 22:31, Mohamed Mediouni wrote:
>> Follow changes in memory management, and enable process isolation for 
>> a sandboxed GPU process when on a new OS.
> 
> 
> Please detail here why this is necessary.
> 
> 
>>
>> Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
>> ---
>>   hw/display/apple-gfx-mmio.m | 56 +++++++++++++++++++++++++++----------
>>   hw/display/apple-gfx.h      | 13 +++++++++
>>   hw/display/apple-gfx.m      | 42 +++++++++++++++++++++++++++-
>>   3 files changed, 95 insertions(+), 16 deletions(-)


>> +        FlatView* fv = address_space_to_flatview(&address_space_memory);
>> +        flatview_for_each_range(fv, apple_gfx_register_memory_cb, 
>> memoryMapDescriptor);
>> +        iosfc_desc.mmioLength = 0x10000;
> 
> 
> Why 0x10000?

Maybe we want qemu_real_host_page_size() here?

Re: [RFC v2 2/4] hvf: arm64: add workaround for Apple M4 to run older macOS versions

[Mohamed Mediouni]

> On 7. Oct 2025, at 23:12, Alexander Graf <agraf@csgraf.de> wrote:
> 
> 
> On 07.10.25 22:31, Mohamed Mediouni wrote:
>> Apple M4 removes FEAT_SSBS. However, older macOS releases
>> do misbehave in such a configuration and do not boot.
>> 
>> Use private API to trap SCTLR_EL1 accesses through FGT.
>> 
>> Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
> 
> 
> These old macOS versions did not include M4 support, correct? So wouldn't it make more sense to make more recent macOS work instead?
> 
> Alex
> 
Apple ships such a workaround in Virtualization.framework to allow older macOS VMs to work

Re: [RFC v2 2/4] hvf: arm64: add workaround for Apple M4 to run older macOS versions

[Alexander Graf]

> Am 08.10.2025 um 13:36 schrieb Mohamed Mediouni <mohamed@unpredictable.fr>:
> 
> 
> 
>> On 7. Oct 2025, at 23:12, Alexander Graf <agraf@csgraf.de> wrote:
>> 
>> 
>>> On 07.10.25 22:31, Mohamed Mediouni wrote:
>>> Apple M4 removes FEAT_SSBS. However, older macOS releases
>>> do misbehave in such a configuration and do not boot.
>>> 
>>> Use private API to trap SCTLR_EL1 accesses through FGT.
>>> 
>>> Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
>> 
>> 
>> These old macOS versions did not include M4 support, correct? So wouldn't it make more sense to make more recent macOS work instead?
>> 
>> Alex
>> 
> Apple ships such a workaround in Virtualization.framework to allow older macOS VMs to work

Fair, but we don't have to implement the same hacks :). I think from a user's point of view, running macOS 26 is more important than 12 :)

Alex

Re: [RFC v2 2/4] hvf: arm64: add workaround for Apple M4 to run older macOS versions

[Mohamed Mediouni]

[-- Attachment #1: Type: text/plain, Size: 1754 bytes --]



> On 8. Oct 2025, at 22:00, Alexander Graf <agraf@csgraf.de> wrote:
> 
> 
> 
>> Am 08.10.2025 um 13:36 schrieb Mohamed Mediouni <mohamed@unpredictable.fr>:
>> 
>> 
>> 
>>> On 7. Oct 2025, at 23:12, Alexander Graf <agraf@csgraf.de> wrote:
>>> 
>>> 
>>>> On 07.10.25 22:31, Mohamed Mediouni wrote:
>>>> Apple M4 removes FEAT_SSBS. However, older macOS releases
>>>> do misbehave in such a configuration and do not boot.
>>>> 
>>>> Use private API to trap SCTLR_EL1 accesses through FGT.
>>>> 
>>>> Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
>>> 
>>> 
>>> These old macOS versions did not include M4 support, correct? So wouldn't it make more sense to make more recent macOS work instead?
>>> 
>>> Alex
>>> 
>> Apple ships such a workaround in Virtualization.framework to allow older macOS VMs to work
> 
> Fair, but we don't have to implement the same hacks :). I think from a user's point of view, running macOS 26 is more important than 12 :)
> 
> Alex

There are at least two mean things that newer macOS releases do on vmapples, but I’m pretty sure I’m missing some more:

- an HVC #0 with x0 set to 0xc1000000 - this is not trapped all the way to the VMM but handled by the virtualisation stack.

The value returned is zero if the VM is running with a private ISA level. The guest then checks it straight away and goes in an infinite loop if the value isn’t 0.

Fine, let’s run with private ISA and see what happens, well...

- An access to the GIC memory ranges that doesn’t meet ISV requirements - using pre-indexing with SP as the base register.

That said I got pretty far with handling those two but I’m not sure that any of this is upstreamable really…

-Mohamed


[-- Attachment #2: Type: text/html, Size: 2372 bytes --]

Re: [RFC v2 1/4] hw: vmapple: include missing headers

[Philippe Mathieu-Daudé]

On 7/10/25 22:31, Mohamed Mediouni wrote:
> Disablement by default led to:
> 
> ../hw/vmapple/vmapple.c:276:39: error: use of undeclared identifier 'GTIMER_VIRT'
>    276 |         qdev_connect_gpio_out(cpudev, GTIMER_VIRT,
>        |                                       ^
> ../hw/vmapple/vmapple.c:479:54: error: use of undeclared identifier 'QEMU_PSCI_CONDUIT_HVC'
>    479 |         object_property_set_int(cpu, "psci-conduit", QEMU_PSCI_CONDUIT_HVC,
>        |                                                      ^
> ../hw/vmapple/vmapple.c:556:13: error: call to undeclared function 'arm_build_mp_affinity'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
>    556 |             arm_build_mp_affinity(n, GICV3_TARGETLIST_BITS);
>        |             ^
> 3 errors generated.
> 
> pretty quickly.
> 
> Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
> ---
>   hw/vmapple/vmapple.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/hw/vmapple/vmapple.c b/hw/vmapple/vmapple.c
> index 16e6110b68..5928df4411 100644
> --- a/hw/vmapple/vmapple.c
> +++ b/hw/vmapple/vmapple.c
> @@ -51,6 +51,8 @@
>   #include "system/reset.h"
>   #include "system/runstate.h"
>   #include "system/system.h"
> +#include "gtimer.h"
> +#include "cpu.h"

Queued using instead:

#include "target/arm/gtimer.h"
#include "target/arm/cpu.h"

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>