Skip to content
This repository has been archived by the owner on Apr 14, 2023. It is now read-only.

How to create an iOS VM #2

Closed
qmfrederik opened this issue Feb 23, 2021 · 24 comments
Closed

How to create an iOS VM #2

qmfrederik opened this issue Feb 23, 2021 · 24 comments
Labels
good first issue Good for newcomers

Comments

@qmfrederik
Copy link
Contributor

qmfrederik commented Feb 23, 2021

UPDATE: Check out the latest guide

I'd be grateful if you could provide some instructions on how we can create a VM which can use the xnu kernel using this project.

Do we need to follow the instructions from https://github.com/alephsecurity/xnu-qemu-arm64/wiki/Build-iOS-on-QEMU? Which ipsw / iOS version did you use?

It looks like you're on iOS 14, so I guess that would make iPhone11,8,iPhone12,1_14.4_18D52_Restore.ipsw then, right?
Did you use the kernelcache.release.iphone11b kernel image and the DeviceTree.n104ap.im4p device tree?

PS - I had issues using the Python tools to extract the kernel image & device tree, but https://github.com/blacktop/ipsw seemed to work fine.


Build dependencies

sudo apt-get install -y git libglib2.0-dev libfdt-dev libpixman-1-dev zlib1g-dev ninja-build build-essential cmake gdb

Build script

git clone https://github.com/TrungNguyen1909/qemu-t8030
cd qemu-t8030
mkdir build
cd build
../configure --enable-debug --target-list=aarch64-softmmu --disable-capstone --disable-slirp
make -j$(nproc)

Install lzfse

git clone https://github.com/lzfse/lzfse
cd lzfse
mkdir build
cmake ..
make
sudo make install

Extract disks from IPSW file

wget https://github.com/blacktop/ipsw/releases/download/v20.08.87/ipsw_20.08.87_Linux_x86_64.tar.gz
tar xvzf ipsw_20.08.87_Linux_x86_64.tar.gz
wget -nv -nc http://updates-http.cdn-apple.com/2021WinterFCS/fullrestores/001-98427/9C42F04F-C1B3-41C5-8E0D-0EDCB5087BB5/iPhone11,8,iPhone12,1_14.4_18D52_Restore.ipsw
unzip iPhone11,8,iPhone12,1_14.4_18D52_Restore.ipsw

./ipsw img4 extract kernelcache.research.iphone12b
lzfse -decode -i kernelcache.research.iphone12b.payload -o kernelcache.research.iphone12b.out

./ipsw img4 extract Firmware/all_flash/DeviceTree.n104ap.im4p
lzfse -decode -i Firmware/all_flash/DeviceTree.n104ap.im4p.payload -o Firmware/all_flash/DeviceTree.n104ap.im4p.out

./ipsw img4 extract 038-96262-062.dmg
./ipsw img4 extract Firmware/038-96262-062.dmg.trustcache

Launch script

~/git/qemu-t8030/build/qemu-system-aarch64 -s -M t8030,kernel-filename=kernelcache.research.iphone12b,dtb-filename=DeviceTree.n104ap,kern-cmd-args="debug=0x8 kextlog=0xffff io=0xfff rd=md0 serial=2 -v nvme=0xffff pmgr-debug=0xff",ramdisk-filename=038-96262-062.dmg,xnu-ramfb=on,trustcache-filename=038-96262-062.dmg.trustcache -cpu max -m 4G -serial mon:stdio -monitor telnet:127.0.0.1:1235,server,nowait -smp 6
~/git/qemu-t8030/build/qemu-system-aarch64 -s -M t8030,kernel-filename=kernelcache.research.iphone12b.out,dtb-filename=Firmware/all_flash/DeviceTree.n104ap.im4p.out,kern-cmd-args="debug=0x8 kextlog=0xffff io=0xfff rd=md0 serial=2 -v nvme=0xffff pmgr-debug=0xff",ramdisk-filename=038-96262-062.dmg.payload,xnu-ramfb=on,trustcache-filename=Firmware/038-96262-062.dmg.trustcache.payload -cpu max -m 4G -serial mon:stdio -monitor telnet:127.0.0.1:1235,server,nowait -smp 6
@qmfrederik
Copy link
Contributor Author

So this is what I tried so far:

export kernel_filename=~/ipsw/kernelcache.release.iphone11b.decompressed
export ramdisk_filename=~/ipsw/038-96262-062.dmg.payload
export dtb_filename=~/ipsw/DeviceTree.n104ap.im4p.decompressed
export trustcache_filename=~/ipsw/Firmware/038-96262-062.dmg.trustcache.payload
export kargs=debug=0x8 kextlog=0xfff cpus=1 rd=disk0 serial=2

qemu-system-aarch64 -D log.txt -M t8030,kernel-filename=${kernel_filename},ramdisk-filename=${ramdisk_filename},dtb-filename=${dtb_filename},trustcache-filename=${trustcache_filename},kern-cmd-args="${kargs}",xnu-ramfb=off

This results in:

g_virt_base: 0xfffffff004000000
g_phys_base: 0x0000000800000000
kernel_low: 0xfffffff004004000
kernel_high: 0xfffffff009aa2c08
Failed to find gap of requested size: 18446744073641918464
Aborted (core dumped)

With the following backtrace:

Thread 1 "qemu-system-aar" received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50      ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff7630859 in __GI_abort () at abort.c:79
#2  0x0000555555dfb118 in find_ram_offset (size=18446744073641918464) at ../softmmu/physmem.c:1574
#3  0x0000555555dfbb82 in ram_block_add (new_block=0x555557db1a80, errp=0x7fffffffdac8, shared=false) at ../softmmu/physmem.c:1869
#4  0x0000555555dfc456 in qemu_ram_alloc_internal (size=18446744073641918464, max_size=18446744073641918464, resized=0x0, host=0x0, resizeable=false, share=false, mr=0x555557db1500, errp=0x7fffffffdb60)
    at ../softmmu/physmem.c:2070
#5  0x0000555555dfc539 in qemu_ram_alloc (size=18446744073641918464, share=false, mr=0x555557db1500, errp=0x7fffffffdb60) at ../softmmu/physmem.c:2089
#6  0x0000555555ec77f6 in memory_region_init_ram_shared_nomigrate (mr=0x555557db1500, owner=0x0, name=0x55555622e09f "RAM", size=18446744073641918464, share=false, errp=0x7fffffffdbf8) at ../softmmu/memory.c:1550  
#7  0x0000555555ec7764 in memory_region_init_ram_nomigrate (mr=0x555557db1500, owner=0x0, name=0x55555622e09f "RAM", size=18446744073641918464, errp=0x7fffffffdbf8) at ../softmmu/memory.c:1535
#8  0x0000555555ecc6d7 in memory_region_init_ram (mr=0x555557db1500, owner=0x0, name=0x55555622e09f "RAM", size=18446744073641918464, errp=0x5555567b2be0 <error_fatal>) at ../softmmu/memory.c:3207
#9  0x0000555555bf7a2a in allocate_ram (top=0x5555568ff300, name=0x55555622e09f "RAM", addr=34561589248, size=18446744073641918464) at ../hw/arm/xnu_mem.c:120
#10 0x0000555555c2e915 in T8030_memory_setup (machine=0x555556b00410) at ../hw/arm/t8030.c:593
#11 0x0000555555c307a5 in T8030_machine_init (machine=0x555556b00410) at ../hw/arm/t8030.c:1012
#12 0x0000555555b84944 in machine_run_board_init (machine=0x555556b00410) at ../hw/core/machine.c:1134
#13 0x0000555555e3c63d in qemu_init (argc=5, argv=0x7fffffffe128, envp=0x7fffffffe158) at ../softmmu/vl.c:4369
#14 0x0000555555849e75 in main (argc=5, argv=0x7fffffffe128, envp=0x7fffffffe158) at ../softmmu/main.c:49

@TrungNguyen1909
Copy link
Owner

TrungNguyen1909 commented Feb 24, 2021

UPDATE: Follow this guide

You need to set -M 4G or something like that I believe

qemu-t8030/build/qemu-system-aarch64 -s -M t8030,kernel-filename=kernelcache.research.iphone12b.out,dtb-filename=Firmware/all_flash/DeviceTree.n104ap.im4p.out,kern-cmd-args="debug=0x8 kextlog=0xffff io=0xfff rd=md0 serial=2 -v nvme=0xffff pmgr-debug=0xff",ramdisk-filename=038-44087-125.dmg.out,xnu-ramfb=on,trustcache-filename=Firmware/038-44087-125.dmg.trustcache.out -cpu max -m 4G -serial mon:stdio -monitor telnet:127.0.0.1:1235,server,nowait -smp 6

The tools for unpacking im4p can be found at https://github.com/TrungNguyen1909/xnu-qemu-arm64-tools

The ramdisk FS need to be decompressed. resize it with something like
hdiutil resize -size 512M -imagekey diskimage-class=CRawDiskImage 038-44087-125.dmg.out
attach:
hdiutil attach -imagekey diskimage-class=CRawDiskImage 038-44087-125.dmg.out

To decompress, do sudo afscexpand /path/to/mount/point or do a rsync -av back and forth.

That should get launchd up.

P/s: .out files are extracted using scripts inside xnu-qemu-arm64-tools/bootstrap_scripts/

@qmfrederik
Copy link
Contributor Author

Thanks, @TrungNguyen1909 , I get this far:

BSD root: md0, major 3, minor 0
apfs_vfsop_mountroot:2214: apfs: mountroot called!
apfs_vfsop_mount:1777: unable to root from devvp <ptr> (root_device): 2
apfs_vfsop_mountroot:2218: apfs: mountroot failed, error: 2
hfs: mounted AzulD18D52.arm64eCustomerRamDisk on device b(3, 0)
dyld: setting comm page to 0x0
Attempting to forcibly halt cpu 4
cpu 4 failed to halt with error -5: halt not supported for this configuration
Debugger synchronization timed out; waited 10000000 nanoseconds
IOPlatformPanicAction -> AppleT8030PMGR
Kernel data abort. at pc 0xfffffff008bcad2c, lr 0xfffffff008bcad24 (saved state: 0xffffffe80e4ab2d0)
          x0: 0x0000000000000000  x1:  0x0000000000000014  x2:  0x0000000000000000  x3:  0x0000000000000000
          x4: 0x0000000000000062  x5:  0x000000023b040000  x6:  0xffffffe8001e1d80  x7:  0x0988fff0078f14f0
          x8: 0xffffffe80e4c0048  x9:  0x0000000000000028  x10: 0x00000000fffd8000  x11: 0xffffffe4cda82e10
          x12: 0x000000007fffffff x13: 0x00000000ffffffff  x14: 0x0000000000000000  x15: 0x0000000000000010
          x16: 0xfffffff0078f1148 x17: 0xfffffff0078f1148  x18: 0x0000000000000000  x19: 0xffffffe8001c0000
          x20: 0x0000000000088000 x21: 0xffffffe8001e23a0  x22: 0xcda1ffe8001c0000  x23: 0x000000023b084000
          x24: 0x0000000000084000 x25: 0x000000023d284000  x26: 0x0000000000000001  x27: 0xfffffff11a306a50
          x28: 0xfffffff009aa8000 fp:  0xffffffe80e4ab660  lr:  0xfffffff008bcad24  sp:  0xffffffe80e4ab620
          pc:  0xfffffff008bcad2c cpsr: 0x204003c4         esr: 0x96000010          far: 0xffffffe80e4c0048
panic(cpu 5 caller 0xfffffff008178694):  initproc exited -- exit reason namespace 6 subcode 0x5 description: dyld cache load error: shared cache file open() failed
Library not loaded: /usr/lib/system/libcommonCrypto.dylib
  Referenced from: /usr/lib/libSystem.B.dylib
  Reason: no suitable image found.  Did find:
        /usr/lib/system/libcommonCrypto.dylib: code signature invalid for '/usr/lib/system/libcommonCrypto.dylib'

        /usr/lib/system/libcommonCrypto.dylib: stat() failed with errno=25
        /usr/lib/system/libcommonCrypto.dylib: unknown file type, first eight bytes: 0x01 0x0D 0x01 0xC0 0x0B 0x40 0x01 0x0D

although the exact error message can vary slightly.

@TrungNguyen1909
Copy link
Owner

The ramdisk FS need to be decompressed. resize it with something like
hdiutil resize -size 512M -imagekey diskimage-class=CRawDiskImage 038-44087-125.dmg.out
attach:
hdiutil attach -imagekey diskimage-class=CRawDiskImage 038-44087-125.dmg.out

To decompress, do sudo afscexpand /path/to/mount/point or do a rsync -av back and forth.

For the rsync -av method, you need to erase the HFS+ partition before copy back.

@qmfrederik
Copy link
Contributor Author

Thanks, looks like the disk was too small (I used 128M instead of 512M) and this caused afscexpand to silently fail. Doh!

So this is what I get now:

BSD root: md0, major 3, minor 0
apfs_vfsop_mountroot:2214: apfs: mountroot called!
apfs_vfsop_mount:1777: unable to root from devvp <ptr> (root_device): 2
apfs_vfsop_mountroot:2218: apfs: mountroot failed, error: 2
hfs: mounted AzulD18D52.arm64eCustomerRamDisk on device b(3, 0)
dyld: setting comm page to 0x0
Thu Jan  1 00:05:50 1970  com.apple.xpc.launchd[1] <Notice>: hello
Darwin Bootstrapper Version 7.0.0: Sun Dec 20 17:53:52 PST 2020; root:libxpc_executables-2038.80.3~5/launchd/RELEASE_ARM64E
boot-args = debug=0x8 kextlog=0xffff io=0xfff rd=md0 serial=2 -v nvme=0xffff pmgr-debug=0xff
Thu Jan  1 00:05:50 1970 localhost com.apple.xpc.launchd[1] <Notice>: Restore environment starting.
Thu Jan  1 00:07:20 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: entering ondemand mode
Thu Jan  1 00:07:21 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: fsck
Thu Jan  1 00:07:21 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: mount-phase-1
Thu Jan  1 00:07:21 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: data-protection
Thu Jan  1 00:07:21 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: finish-obliteration
Thu Jan  1 00:07:21 1970 localhost com.apple.xpc.launchd[1] <Notice>: Doing boot task: commit-boot-mode
Thu Jan  1 00:07:21 1970 localhost com.apple.xpc.launchd[1] <Notice>: boot-mode committed: (null)
Thu Jan  1 00:07:21 1970 localhost com.apple.xpc.launchd[1] <Notice>: Doing boot task: restore-datapartition
Thu Jan  1 00:07:23 1970 localhost com.apple.xpc.launchd[1] <Notice>: restore-datapartition: optional boot task not present
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: mount-phase-2
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Doing boot task: init-with-data-volume
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: MSUEarlyBootTask
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: fips
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: keybag
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: usermanagerd
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: init_featureflags
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: fud
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: tzinit
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: finish-restore
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: finish-demo-restore
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: sysstatuscheck
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: prng_seedctl
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Error>: Unable to open /System/Library/xpc/launchd.plist [2:No such file or directory]
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: launchd_cache_loader
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Error>: No MRM cache found
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Warning>: Unable to load cache
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: launchd UUID: 2AA0C171-F3A9-3C91-85B9-AAB0371DAC25
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Early boot complete. Continuing system boot.
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: entering bootstrap mode
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] (com.apple.KeyMaker) <Warning>: Unknown key for Boolean: EnablePressureExit
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.KeyMaker (lint): Unable to find persona with type 6: kpersona_find returned -1
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.PurpleReverseProxy.ramdisk (lint): Unable to find persona with type 6: kpersona_find returned -1
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.diskimagesiod.ram (lint): Unable to find persona with type 6: kpersona_find returned -1
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.restored_external (lint): Unable to find persona with type 6: kpersona_find returned -1
Thu Jan  1 00:07:25 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: Failed to bootstrap path: path = /System/Library/NanoLaunchDaemonsAltAccount, error = 2: No such file or directory
Thu Jan  1 00:07:25 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: Failed to bootstrap path: path = /System/Library/NanoLaunchDaemons, error = 2: No such file or directory
Thu Jan  1 00:07:25 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: Failed to bootstrap path: path = /AppleInternal/Library/LaunchDaemons, error = 2: No such file or directory
Thu Jan  1 00:07:25 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: exiting bootstrap mode
Thu Jan  1 00:07:25 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: exiting ondemand mode
Attempting to forcibly halt cpu 0
cpu 0 failed to halt with error -5: halt not supported for this configuration
Attempting to forcibly halt cpu 1
cpu 1 failed to halt with error -5: halt not supported for this configuration
Attempting to forcibly halt cpu 2
cpu 2 failed to halt with error -5: halt not supported for this configuration
Attempting to forcibly halt cpu 4
cpu 4 failed to halt with error -5: halt not supported for this configuration
Attempting to forcibly halt cpu 5
cpu 5 failed to halt with error -5: halt not supported for this configuration
Debugger synchronization timed out; waited 10000000 nanoseconds
IOPlatformPanicAction -> AppleT8030PMGR
Kernel data abort. at pc 0xfffffff008bcad2c, lr 0xfffffff008bcad24 (saved state: 0xffffffe80de2b3c0)
          x0: 0x0000000000000000  x1:  0x0000000000000014  x2:  0x0000000000000000  x3:  0x0000000000000000
          x4: 0x0000000000000062  x5:  0x000000023b040000  x6:  0xffffffe80070dd80  x7:  0x0988fff0078f14f0
          x8: 0xffffffe80dde0048  x9:  0x0000000000000028  x10: 0x00000000fffd8000  x11: 0xffffffe4cdfad230
          x12: 0x000000007fffffff x13: 0x00000000ffffffff  x14: 0x0000000000000000  x15: 0x0000000000000010
          x16: 0xfffffff0078f1148 x17: 0xfffffff0078f1148  x18: 0x0000000000000000  x19: 0xffffffe8006ec000
          x20: 0x0000000000088000 x21: 0xffffffe80070e3a0  x22: 0xcda1ffe8006ec000  x23: 0x000000023b084000
          x24: 0x0000000000084000 x25: 0x000000023d284000  x26: 0x0000000000000001  x27: 0xfffffff14a30e910
          x28: 0xfffffff009aa8000 fp:  0xffffffe80de2b750  lr:  0xfffffff008bcad24  sp:  0xffffffe80de2b710
          pc:  0xfffffff008bcad2c cpsr: 0x204003c4         esr: 0x96000010          far: 0xffffffe80dde0048
panic(cpu 3 caller 0xfffffff007a7ec68): "Ticket spinlock timeout; start: 0x41871adaf, end: 0x4189f746f, current: 0x418a0628a, lock: 0xfffffff009aa8f80, *lock: 0x12, waiting for 0x15, owner: 0"

Do you get a similar result?

@TrungNguyen1909
Copy link
Owner

It can be workarounded by removing pmgr-debug=0xff boot args.

This is due to the hacky PMGR implementation which I haven't got enough time to work on.

Thanks, looks like the disk was too small (I used 128M instead of 512M) and this caused afscexpand to silently fail. Doh!

So this is what I get now:

BSD root: md0, major 3, minor 0
apfs_vfsop_mountroot:2214: apfs: mountroot called!
apfs_vfsop_mount:1777: unable to root from devvp <ptr> (root_device): 2
apfs_vfsop_mountroot:2218: apfs: mountroot failed, error: 2
hfs: mounted AzulD18D52.arm64eCustomerRamDisk on device b(3, 0)
dyld: setting comm page to 0x0
Thu Jan  1 00:05:50 1970  com.apple.xpc.launchd[1] <Notice>: hello
Darwin Bootstrapper Version 7.0.0: Sun Dec 20 17:53:52 PST 2020; root:libxpc_executables-2038.80.3~5/launchd/RELEASE_ARM64E
boot-args = debug=0x8 kextlog=0xffff io=0xfff rd=md0 serial=2 -v nvme=0xffff pmgr-debug=0xff
Thu Jan  1 00:05:50 1970 localhost com.apple.xpc.launchd[1] <Notice>: Restore environment starting.
Thu Jan  1 00:07:20 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: entering ondemand mode
Thu Jan  1 00:07:21 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: fsck
Thu Jan  1 00:07:21 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: mount-phase-1
Thu Jan  1 00:07:21 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: data-protection
Thu Jan  1 00:07:21 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: finish-obliteration
Thu Jan  1 00:07:21 1970 localhost com.apple.xpc.launchd[1] <Notice>: Doing boot task: commit-boot-mode
Thu Jan  1 00:07:21 1970 localhost com.apple.xpc.launchd[1] <Notice>: boot-mode committed: (null)
Thu Jan  1 00:07:21 1970 localhost com.apple.xpc.launchd[1] <Notice>: Doing boot task: restore-datapartition
Thu Jan  1 00:07:23 1970 localhost com.apple.xpc.launchd[1] <Notice>: restore-datapartition: optional boot task not present
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: mount-phase-2
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Doing boot task: init-with-data-volume
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: MSUEarlyBootTask
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: fips
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: keybag
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: usermanagerd
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: init_featureflags
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: fud
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: tzinit
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: finish-restore
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: finish-demo-restore
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: sysstatuscheck
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: prng_seedctl
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Error>: Unable to open /System/Library/xpc/launchd.plist [2:No such file or directory]
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Skipping boot-task: launchd_cache_loader
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Error>: No MRM cache found
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Warning>: Unable to load cache
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: launchd UUID: 2AA0C171-F3A9-3C91-85B9-AAB0371DAC25
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] <Notice>: Early boot complete. Continuing system boot.
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: entering bootstrap mode
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] (com.apple.KeyMaker) <Warning>: Unknown key for Boolean: EnablePressureExit
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.KeyMaker (lint): Unable to find persona with type 6: kpersona_find returned -1
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.PurpleReverseProxy.ramdisk (lint): Unable to find persona with type 6: kpersona_find returned -1
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.diskimagesiod.ram (lint): Unable to find persona with type 6: kpersona_find returned -1
Thu Jan  1 00:07:24 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.restored_external (lint): Unable to find persona with type 6: kpersona_find returned -1
Thu Jan  1 00:07:25 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: Failed to bootstrap path: path = /System/Library/NanoLaunchDaemonsAltAccount, error = 2: No such file or directory
Thu Jan  1 00:07:25 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: Failed to bootstrap path: path = /System/Library/NanoLaunchDaemons, error = 2: No such file or directory
Thu Jan  1 00:07:25 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: Failed to bootstrap path: path = /AppleInternal/Library/LaunchDaemons, error = 2: No such file or directory
Thu Jan  1 00:07:25 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: exiting bootstrap mode
Thu Jan  1 00:07:25 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: exiting ondemand mode
Attempting to forcibly halt cpu 0
cpu 0 failed to halt with error -5: halt not supported for this configuration
Attempting to forcibly halt cpu 1
cpu 1 failed to halt with error -5: halt not supported for this configuration
Attempting to forcibly halt cpu 2
cpu 2 failed to halt with error -5: halt not supported for this configuration
Attempting to forcibly halt cpu 4
cpu 4 failed to halt with error -5: halt not supported for this configuration
Attempting to forcibly halt cpu 5
cpu 5 failed to halt with error -5: halt not supported for this configuration
Debugger synchronization timed out; waited 10000000 nanoseconds
IOPlatformPanicAction -> AppleT8030PMGR
Kernel data abort. at pc 0xfffffff008bcad2c, lr 0xfffffff008bcad24 (saved state: 0xffffffe80de2b3c0)
          x0: 0x0000000000000000  x1:  0x0000000000000014  x2:  0x0000000000000000  x3:  0x0000000000000000
          x4: 0x0000000000000062  x5:  0x000000023b040000  x6:  0xffffffe80070dd80  x7:  0x0988fff0078f14f0
          x8: 0xffffffe80dde0048  x9:  0x0000000000000028  x10: 0x00000000fffd8000  x11: 0xffffffe4cdfad230
          x12: 0x000000007fffffff x13: 0x00000000ffffffff  x14: 0x0000000000000000  x15: 0x0000000000000010
          x16: 0xfffffff0078f1148 x17: 0xfffffff0078f1148  x18: 0x0000000000000000  x19: 0xffffffe8006ec000
          x20: 0x0000000000088000 x21: 0xffffffe80070e3a0  x22: 0xcda1ffe8006ec000  x23: 0x000000023b084000
          x24: 0x0000000000084000 x25: 0x000000023d284000  x26: 0x0000000000000001  x27: 0xfffffff14a30e910
          x28: 0xfffffff009aa8000 fp:  0xffffffe80de2b750  lr:  0xfffffff008bcad24  sp:  0xffffffe80de2b710
          pc:  0xfffffff008bcad2c cpsr: 0x204003c4         esr: 0x96000010          far: 0xffffffe80dde0048
panic(cpu 3 caller 0xfffffff007a7ec68): "Ticket spinlock timeout; start: 0x41871adaf, end: 0x4189f746f, current: 0x418a0628a, lock: 0xfffffff009aa8f80, *lock: 0x12, waiting for 0x15, owner: 0"

Do you get a similar result?

@TrungNguyen1909 TrungNguyen1909 added the good first issue Good for newcomers label Mar 4, 2021
@qmfrederik
Copy link
Contributor Author

Thanks!

This gets me a step further:

Thu Jan  1 00:07:04 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: entering bootstrap mode
Thu Jan  1 00:07:06 1970 localhost com.apple.xpc.launchd[1] (com.apple.KeyMaker) <Warning>: Unknown key for Boolean: EnablePressureExit
Thu Jan  1 00:07:06 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.KeyMaker (lint): Unable to find persona with type 6: kpersona_find returned -1
Thu Jan  1 00:07:06 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.PurpleReverseProxy.ramdisk (lint): Unable to find persona with type 6: kpersona_find returned -1
Thu Jan  1 00:07:06 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.diskimagesiod.ram (lint): Unable to find persona with type 6: kpersona_find returned -1
Thu Jan  1 00:07:06 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: com.apple.restored_external (lint): Unable to find persona with type 6: kpersona_find returned -1
Thu Jan  1 00:07:06 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: Failed to bootstrap path: path = /System/Library/NanoLaunchDaemonsAltAccount, error = 2: No such file or directory
Thu Jan  1 00:07:06 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: Failed to bootstrap path: path = /System/Library/NanoLaunchDaemons, error = 2: No such file or directory
Thu Jan  1 00:07:06 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Error>: Failed to bootstrap path: path = /AppleInternal/Library/LaunchDaemons, error = 2: No such file or directory
Thu Jan  1 00:07:07 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: exiting bootstrap mode
Thu Jan  1 00:07:07 1970 localhost com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: exiting ondemand mode
Thu Jan  1 00:08:02 1970 localhost com.apple.xpc.launchd[1] (com.apple.KeyMaker.3) <Warning>: Could not find and/or execute program specified by service: 2: No such file or directory: /usr/local/bin/KeyMaker
Thu Jan  1 00:08:02 1970 localhost com.apple.xpc.launchd[1] (com.apple.KeyMaker.3) <Notice>: Service setup event to handle failure and will not launch until it fires.
Thu Jan  1 00:08:02 1970 localhost com.apple.xpc.launchd[1] (com.apple.KeyMaker.3) <Error>: Missing executable detected. Job: 'com.apple.KeyMaker' Executable: '/usr/local/bin/KeyMaker'
Thu Jan  1 00:08:18 1970 localhost com.apple.xpc.launchd[1] (com.apple.KeyMaker.3) <Warning>: Service exited with abnormal code: 78
Thu Jan  1 00:09:13 1970 localhost com.apple.xpc.launchd[1] (com.apple.restored_external.4) <Warning>: Binary is improperly signed.
Thu Jan  1 00:09:13 1970 localhost com.apple.xpc.launchd[1] <Error>: Host-level exception raised: pid = 4, thread = 0x1107, exception type = 0xd, codes = { 12884901890 }, states = { 0 }

Are the errors about the missing files and the improperly signed executable?

Should we be able to interact with the device over USB at this point (once an USB controller is emulated)? I can see the device-tree lists a usb-drd device like this:

      +--usb-drd:
|  |  |  +--clock-gates 8 bytes: (null) 0x67 0x00 0x00 0x00 0xf5 0x00 0x00 0x00
|  |  |  +--AAPL,phandle 4 bytes: (null) 0x8d 0x00 0x00 0x00
|  |  |  +--configuration-string 19 bytes: stdMuxPTPEthValIDA 0x73 0x74 0x64 0x4d 0x75 0x78 0x50 0x54 0x50 0x45 0x74 0x68 0x56 0x61 0x6c 0x49 0x44 0x41 0x00
|  |  |  +--atc-phy-parent 4 bytes: (null) 0x8c 0x00 0x00 0x00
|  |  |  +--function-dock_parent 8 bytes: (null) 0xf3 0x00 0x00 0x00 0x50 0x63 0x63 0x61
|  |  |  +--tunable 80 bytes: (null) 0x00 0x00 0x00 0x00 0x1c 0xc1 0x00 0x00 0xf0 0x00 0xe0 0x00 0x00 0x00 0x40 0x00 0x00 0x00 0x00 0x00 0x2c 0xc1 0x00 0x00 0x00 0x00 0x02 0x00 0x00 0x00 0x02 0x00 0x00 0x00 0x00 0x00 0x64 0xc1 0x00 0x00 0x02 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x0c 0xc6 0x00 0x00 0x00 0x40 0x00 0x00 0x00 0x40 0x00 0x00 0x01 0x00 0x00 0x00 0x18 0x00 0x00 0x00 0xff 0x00 0x00 0x00 0x33 0x00 0x00 0x00
|  |  |  +--iommu-parent 4 bytes: (null) 0x91 0x00 0x00 0x00
|  |  |  +--host-mac-address 40 bytes: (null) 0x6d 0x61 0x63 0x61 0x64 0x64 0x72 0x2f 0x77 0x69 0x66 0x69 0x61 0x64 0x64 0x72 0x2c 0x73 0x79 0x73 0x63 0x66 0x67 0x2f 0x57 0x4d 0x61 0x63 0x2f 0x36 0x2c 0x7a 0x65 0x72 0x6f 0x65 0x73 0x2f 0x36 0x00
|  |  |  +--device-mac-address 39 bytes: macaddr/ethaddr,syscfg/EMac/6,zeroes/6 0x6d 0x61 0x63 0x61 0x64 0x64 0x72 0x2f 0x65 0x74 0x68 0x61 0x64 0x64 0x72 0x2c 0x73 0x79 0x73 0x63 0x66 0x67 0x2f 0x45 0x4d 0x61 0x63 0x2f 0x36 0x2c 0x7a 0x65 0x72 0x6f 0x65 0x73 0x2f 0x36 0x00
|  |  |  +--bus-number 4 bytes: (null) 0x00 0x00 0x00 0x00
|  |  |  +--name 8 bytes: usb-drd
|  |  |  +--interrupt-parent 4 bytes: (null) 0x1a 0x00 0x00 0x00
|  |  |  +--port-type 4 bytes: (null) 0x0c 0x00 0x00 0x00
|  |  |  +--compatible 28 bytes: (null) 0x75 0x73 0x62 0x2d 0x64 0x72 0x64 0x2c 0x74 0x38 0x30 0x33 0x30 0x00 0x75 0x73 0x62 0x2d 0x64 0x72 0x64 0x2c 0x74 0x38 0x30 0x32 0x37 0x00
|  |  |  +--clock-ids 4 bytes: (null) 0x4b 0x01 0x00 0x00
|  |  |  +--interrupts 16 bytes: (null) 0xf1 0x01 0x00 0x00 0xf2 0x01 0x00 0x00 0xf3 0x01 0x00 0x00 0xf4 0x01 0x00 0x00
|  |  |  +--tunable_setting 72 bytes: (null) 0x1c 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0xf0 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x64 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x02 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x07 0x00 0x00 0x00 0x00 0x00 0x00 0x07 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
|  |  |  +--port-number 4 bytes: (null) 0x01 0x00 0x00 0x00
|  |  |  +--device_type 8 bytes: (null) 0x75 0x73 0x62 0x2d 0x64 0x72 0x64 0x00
|  |  |  +--eps-dir-bitmap 4 bytes: (null) 0x64 0x02 0x00 0x00
|  |  |  +--reg 48 bytes: (null) 0x00 0x00 0x01 0x39 0x00 0x00 0x00 0x00 0x00 0x00 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x02 0x39 0x00 0x00 0x00 0x00 0x00 0x00 0x01 0x00 0x00 0x00 0x00 0x00 0x00 0xc0 0x01 0x39 0x00 0x00 0x00 0x00 0x00 0x18 0x00 0x00 0x00 0x00 0x00 0x00
         +--usb-drd-port-hs:
|  |  |  |  +--port 4 bytes: (null) 0x01 0x00 0x00 0x00
|  |  |  |  +--AAPL,phandle 4 bytes: (null) 0x8e 0x00 0x00 0x00
|  |  |  |  +--port-speed 4 bytes: (null) 0x02 0x00 0x00 0x00
|  |  |  |  +--port-current-limit 4 bytes: (null) 0x32 0x00 0x00 0x00
|  |  |  |  +--device_type 16 bytes: (null) 0x75 0x73 0x62 0x2d 0x64 0x72 0x64 0x2d 0x70 0x6f 0x72 0x74 0x2d 0x68 0x73 0x00
|  |  |  |  +--name 16 bytes: usb-drd-port-hs
|  |  |  |  +--port-type 4 bytes: (null) 0x02 0x00 0x00 0x00

which seems to indicate that the USB device is using the 0x390100 - 0x390200, 0x390200 - 0x390300 and 0x3901c0 - 0x39d800 address spaces (the last one overlaps with the first) and using the 0x01f1, 0x1f2, 0x01f3, 0x01f4 interrupts, right?

@TrungNguyen1909
Copy link
Owner

TrungNguyen1909 commented Mar 4, 2021

Are the errors about the missing files and the improperly signed executable?

This is the current status of the project, I haven't gone any further than that.

Should we be able to interact with the device over USB at this point (once an USB controller is emulated)? I can see the device-tree lists a usb-drd device like this:

Hopefully.

which seems to indicate that the USB device is using the 0x390100 - 0x390200, 0x390200 - 0x390300 and 0x3901c0 - 0x39d800 address spaces (the last one overlaps with the first) and using the 0x01f1, 0x1f2, 0x01f3, 0x01f4 interrupts, right?

These are actually offsets from the arm-io SOC base physical address.

@qmfrederik
Copy link
Contributor Author

qmfrederik commented Mar 4, 2021

Thanks. I've made a very naive attempt at registering read/write handlers for the USB address space: https://github.com/qmfrederik/qemu-t8030/commit/5eee15de406ba6a344c4e4b4769b987e7594efee, but it looks like the handlers are not being invoked.

I'm not sure whether this is because there's an obvious bug in my code, or because the interrupts are not registered.

(never mind my comment about the AIC, I can see there's a hw/intc/apple-aic.c file)

Repository owner locked and limited conversation to collaborators Mar 4, 2021
Repository owner unlocked this conversation Mar 8, 2021
@TrungNguyen1909
Copy link
Owner

TrungNguyen1909 commented Mar 8, 2021

UPDATE: You can find the updated tutorial here

@cutesmilee
Copy link

have you tested this on macOS too? i saw a "guide" for compiling this on macOS, but it doesn't work, at least on Big Sur (11.2.2). this is a log with the "macOS guide" (https://github.com/TrungNguyen1909/qemu-t8030/pull/6/checks (i tried both build_aarch64_softmmu_macos, and build_macos_all)), but the same thing happen using you commands.

@TrungNguyen1909
Copy link
Owner

What errors do you get?
I work on a Catalina machine

have you tested this on macOS too? i saw a "guide" for compiling this on macOS, but it doesn't work, at least on Big Sur (11.2.2). this is a log with the "macOS guide" (https://github.com/TrungNguyen1909/qemu-t8030/pull/6/checks (i tried both build_aarch64_softmmu_macos, and build_macos_all)), but the same thing happen using you commands.

@cutesmilee
Copy link

oh seems like i forgot to include the link for the log, here it is https://ghostbin.com/paste/imt1R

@TrungNguyen1909
Copy link
Owner

@cutecodee, you are building on a M1 machine, right?

@qmfrederik
Copy link
Contributor Author

@TrungNguyen1909 Yes, I can get launchd up with the ans-dev branch:

BSD root: disk0s1, major 1, minor 1
virtual bool AppleEmbeddedNVMeController::StartController()::1547:Setting NAND status to Ready
virtual bool AppleEmbeddedNVMeController::StartController()::1547:Setting NAND status to Ready
apfs_vfsop_mountroot:2188: apfs: mountroot called!
dev_init:297: disk0s1 device accelerated crypto: 3 (compiled @ Aug 12 2020 22:19:57)
dev_init:300: disk0s1 device_handle block size 512 block count 15030424 features 6 internal solidstate
nx_kernel_mount:1134: disk0s1 initializing cache w/hash_size 4096 and cache size 10064
nx_kernel_mount:1402: disk0s1 checkpoint search: largest xid 56, best xid 56 @ 3
apfs_vfsop_mount:1848: Promoter has been locked for disk0s1
failed to find root-snapshot-name snapshot
handle_mount:627: vol-uuid: 5133F48D-5D9E-499B-A8BA-45E692E36FD9 block size: 4096 block count: 1878803 (unencrypted; flags: 0x1; features: 8.0.12)
handle_mount:640: setting dev block size to 4096 from 512
nx_volume_group_update:6634: Volume AzulSeed18A5351d.N104N841DeveloperOS is not in a volume group
apfs_vfsop_mount:2171: disk0s1s1:0 mounted volume: AzulSeed18A5351d.N104N841DeveloperOS
void AppleNVMeController::LowPowerTimerEvent()::1188:
void IONVMeController::CheckForTimeout(IOTimerEventSource *)::5214:
dyld: setting comm page to 0x0
Thu Jan  1 00:02:16 1970  com.apple.xpc.launchd[1] <Notice>: hello
Darwin Bootstrapper Version 7.0.0: Mon Aug 10 04:09:14 PDT 2020; root:libxpc_executables-2038.0.13~13/launchd/RELEASE_ARM64E
boot-args = debug=0x8 kextlog=0xffff serial=2 -v nvme=0xffff rd=disk0s1
Thu Jan  1 00:02:17 1970  com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system) <Notice>: entering ondemand mode
Thu Jan  1 00:02:17 1970 localhost com.apple.xpc.launchd[1] <Notice>: Doing boot task: fsck
void IONVMeController::CheckForTimeout(IOTimerEventSource *)::5214:
Attempting to forcibly halt cpu 1
cpu 1 failed to halt with error -5: halt not supported for this configuration
Debugger synchronization timed out; waited 10000000 nanoseconds
IOPlatformPanicAction -> AppleANS2NVMeController
IOPlatformPanicAction -> RTBuddyV2
IOPlatformPanicAction -> RTBuddyV2
IOPlatformPanicAction -> AppleT8030PMGR
Kernel data abort. at pc 0xfffffff008b2e0ec, lr 0xfffffff008b2e0e4 (saved state: 0xffffffe815f82210)
          x0: 0x0000000000000000  x1:  0x0000000000000014  x2:  0x0000000000000000  x3:  0x0000000000000000
          x4: 0x0000000000000062  x5:  0x000000023b040000  x6:  0xffffffe8004c1d48  x7:  0x0988fff0078b70b8
          x8: 0xffffffe80e848048  x9:  0x0000000000000028  x10: 0x00000000fffd8000  x11: 0xffffffe4cdd7af80
          x12: 0x000000007fffffff x13: 0x00000000ffffffff  x14: 0x0000000000000000  x15: 0x0000000000000010
          x16: 0xfffffff0078b6d10 x17: 0xfffffff0078b6d10  x18: 0x0000000000000000  x19: 0xffffffe8004a0000
          x20: 0x0000000000088000 x21: 0xffffffe8004c2368  x22: 0xcda1ffe8004a0000  x23: 0x000000023b084000
          x24: 0x0000000000084000 x25: 0x000000023d284000  x26: 0x0000000000000001  x27: 0xfffffff1482b0a40
          x28: 0xfffffff0099a6000 fp:  0xffffffe815f825a0  lr:  0xfffffff008b2e0e4  sp:  0xffffffe815f82560
          pc:  0xfffffff008b2e0ec cpsr: 0x204003c4         esr: 0x96000010          far: 0xffffffe80e848048
panic(cpu 4 caller 0xfffffff008128350): Kernel data abort. at pc 0xfffffff007a3c458, lr 0xfffffff007a3d3a8 (saved state: 0xffffffe815f82e90)
          x0: 0xfffffff0076c89b8  x1:  0xffffffe80060c000  x2:  0x0000000000000000  x3:  0x0000000000000000
          x4: 0xffffffe19bd74080  x5:  0x0000000000000000  x6:  0x30767aa33a29cd7d  x7:  0xfffffff1482b1080
          x8: 0xffffffe80060c000  x9:  0x0000000000000000  x10: 0x0000000000000003  x11: 0xffffffe80060c008
          x12: 0xfffffff0099abba8 x13: 0x00000000ff866f5d  x14: 0x0000000000000000  x15: 0x0000000000000001
          x16: 0xfffffff0076cb028 x17: 0xffffffe815f83230  x18: 0x0000000000000000  x19: 0xffffffe19b9e5020
          x20: 0xffffffe815f83380 x21: 0x0000000000000001  x22: 0x0000000000050000  x23: 0x0000000000000000
          x24: 0x0000000000020090 x25: 0x000000000000fab0  x26: 0xfffffff009a33000  x27: 0x000000000005ea00
          x28: 0xffffffe19bdbdf80 fp:  0xffffffe815f831e0  lr:  0xfffffff007a3d3a8  sp:  0xffffffe815f831e0
          pc:  0xfffffff007a3c458 cpsr: 0x60400204         esr: 0x96000006          far: 0x0000000000000048

I had some issues preparing the OS disk using your instructions (basically a timeout when running the detach command), so I just attached the original .dmg files to the guest using -drive file=OS.dmg,format=dmg,if=none,id=drive.1.

I'm not sure whether the error is related to that (it may very well be); do you get any further in boot process on your side?

@TrungNguyen1909
Copy link
Owner

@qmfrederik have you decompress the fs?

@qmfrederik
Copy link
Contributor Author

@TrungNguyen1909 No, it's not decompressed; I got a timeout when detaching the disk.

The logs seemed to indicate the kernel could find the disk and mount the file system, which would mean that the ANS/NVMe controller code you added works, so just wanted to share that part of the good news ;-).

@TrungNguyen1909 TrungNguyen1909 pinned this issue Mar 10, 2021
@cutesmilee
Copy link

@cutecodee, you are building on a M1 machine, right?

nope, i'm using an x86 machine

@TrungNguyen1909
Copy link
Owner

@cutecodee, you might want to try to run ./configure again with the correct command, the correct flags are --target-list=aarch64-softmmu --disable-capstone --disable-slirp.

Your build seems to fail while building capstone, but we are not using capstone here.

@cutesmilee
Copy link

https://pastebin.com/mCrxK353 that's the output

@qmfrederik
Copy link
Contributor Author

@cutecodee Looks like you're on Xcode 12.5 beta. Is it possible for you to try this with an earlier Xcode version?

@TrungNguyen1909
Copy link
Owner

https://pastebin.com/mCrxK353 that's the output

@cutecodee, try make it again, please.

@cutesmilee
Copy link

@TrungNguyen1909
Copy link
Owner

Closed. Tutorial

shannon2893 pushed a commit to shannon2893/qemu-t8030 that referenced this issue Jul 25, 2022
In commit 00f05c0 we gave the TYPE_XLNX_CSU_DMA object its
own class struct, but forgot to update the TypeInfo::class_size
accordingly.  This meant that not enough memory was allocated for the
class struct, and the initialization of xcdc->read in the class init
function wrote off the end of the memory. Add the missing line.

Found by running 'check-qtest-aarch64' with a clang
address-sanitizer build, which complains:

==2542634==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61000000ab00 at pc 0x559a20aebc29 bp 0x7fff97df74d0 sp 0x7fff97df74c8
WRITE of size 8 at 0x61000000ab00 thread T0
    #0 0x559a20aebc28 in xlnx_csu_dma_class_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../hw/dma/xlnx_csu_dma.c:722:16
    TrungNguyen1909#1 0x559a21bf297c in type_initialize /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:365:9
    TrungNguyen1909#2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5
    TrungNguyen1909#3 0x7f09bcb641b7 in g_hash_table_foreach (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x401b7)
    TrungNguyen1909#4 0x559a21bf3c27 in object_class_foreach /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1092:5
    TrungNguyen1909#5 0x559a21bf3c27 in object_class_get_list /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1149:5
    TrungNguyen1909#6 0x559a2081a2fd in select_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:1661:24
    TrungNguyen1909#7 0x559a2081a2fd in qemu_create_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:2146:35
    TrungNguyen1909#8 0x559a2081a2fd in qemu_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:3706:5
    TrungNguyen1909#9 0x559a20720ed5 in main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/main.c:49:5
    TrungNguyen1909#10 0x7f09baec00b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
    TrungNguyen1909#11 0x559a2067673d in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xf4b73d)

0x61000000ab00 is located 0 bytes to the right of 192-byte region [0x61000000aa40,0x61000000ab00)
allocated by thread T0 here:
    #0 0x559a206eeff2 in calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xfc3ff2)
    TrungNguyen1909#1 0x7f09bcb7bef0 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ef0)
    TrungNguyen1909#2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5

Fixes: 00f05c0 ("hw/dma/xlnx_csu_dma: Support starting a read transfer through a class method")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220308150207.2546272-1-peter.maydell@linaro.org
shannon2893 pushed a commit to shannon2893/qemu-t8030 that referenced this issue Jul 25, 2022
Include the qtest reproducer provided by Alexander Bulekov
in https://gitlab.com/qemu-project/qemu/-/issues/542.
Without the previous commit, we get:

  $ make check-qtest-i386
  ...
  Running test tests/qtest/intel-hda-test
  AddressSanitizer:DEADLYSIGNAL
  =================================================================
  ==1580408==ERROR: AddressSanitizer: stack-overflow on address 0x7ffc3d566fe0
      #0 0x63d297cf in address_space_translate_internal softmmu/physmem.c:356
      TrungNguyen1909#1 0x63d27260 in flatview_do_translate softmmu/physmem.c:499:15
      TrungNguyen1909#2 0x63d27af5 in flatview_translate softmmu/physmem.c:565:15
      TrungNguyen1909#3 0x63d4ce84 in flatview_write softmmu/physmem.c:2850:10
      TrungNguyen1909#4 0x63d4cb18 in address_space_write softmmu/physmem.c:2950:18
      TrungNguyen1909#5 0x63d4d387 in address_space_rw softmmu/physmem.c:2960:16
      TrungNguyen1909#6 0x62ae12f2 in dma_memory_rw_relaxed include/sysemu/dma.h:89:12
      TrungNguyen1909#7 0x62ae104a in dma_memory_rw include/sysemu/dma.h:132:12
      TrungNguyen1909#8 0x62ae6157 in dma_memory_write include/sysemu/dma.h:173:12
      TrungNguyen1909#9 0x62ae5ec0 in stl_le_dma include/sysemu/dma.h:275:1
      TrungNguyen1909#10 0x62ae5ba2 in stl_le_pci_dma include/hw/pci/pci.h:871:1
      TrungNguyen1909#11 0x62ad59a6 in intel_hda_response hw/audio/intel-hda.c:372:12
      TrungNguyen1909#12 0x62ad2afb in hda_codec_response hw/audio/intel-hda.c:107:5
      TrungNguyen1909#13 0x62aec4e1 in hda_audio_command hw/audio/hda-codec.c:655:5
      TrungNguyen1909#14 0x62ae05d9 in intel_hda_send_command hw/audio/intel-hda.c:307:5
      TrungNguyen1909#15 0x62adff54 in intel_hda_corb_run hw/audio/intel-hda.c:342:9
      TrungNguyen1909#16 0x62adc13b in intel_hda_set_corb_wp hw/audio/intel-hda.c:548:5
      TrungNguyen1909#17 0x62ae5942 in intel_hda_reg_write hw/audio/intel-hda.c:977:9
      TrungNguyen1909#18 0x62ada10a in intel_hda_mmio_write hw/audio/intel-hda.c:1054:5
      TrungNguyen1909#19 0x63d8f383 in memory_region_write_accessor softmmu/memory.c:492:5
      TrungNguyen1909#20 0x63d8ecc1 in access_with_adjusted_size softmmu/memory.c:554:18
      TrungNguyen1909#21 0x63d8d5d6 in memory_region_dispatch_write softmmu/memory.c:1504:16
      TrungNguyen1909#22 0x63d5e85e in flatview_write_continue softmmu/physmem.c:2812:23
      TrungNguyen1909#23 0x63d4d05b in flatview_write softmmu/physmem.c:2854:12
      TrungNguyen1909#24 0x63d4cb18 in address_space_write softmmu/physmem.c:2950:18
      TrungNguyen1909#25 0x63d4d387 in address_space_rw softmmu/physmem.c:2960:16
      TrungNguyen1909#26 0x62ae12f2 in dma_memory_rw_relaxed include/sysemu/dma.h:89:12
      #27 0x62ae104a in dma_memory_rw include/sysemu/dma.h:132:12
      TrungNguyen1909#28 0x62ae6157 in dma_memory_write include/sysemu/dma.h:173:12
      TrungNguyen1909#29 0x62ae5ec0 in stl_le_dma include/sysemu/dma.h:275:1
      TrungNguyen1909#30 0x62ae5ba2 in stl_le_pci_dma include/hw/pci/pci.h:871:1
      TrungNguyen1909#31 0x62ad59a6 in intel_hda_response hw/audio/intel-hda.c:372:12
      TrungNguyen1909#32 0x62ad2afb in hda_codec_response hw/audio/intel-hda.c:107:5
      TrungNguyen1909#33 0x62aec4e1 in hda_audio_command hw/audio/hda-codec.c:655:5
      TrungNguyen1909#34 0x62ae05d9 in intel_hda_send_command hw/audio/intel-hda.c:307:5
      TrungNguyen1909#35 0x62adff54 in intel_hda_corb_run hw/audio/intel-hda.c:342:9
      TrungNguyen1909#36 0x62adc13b in intel_hda_set_corb_wp hw/audio/intel-hda.c:548:5
      TrungNguyen1909#37 0x62ae5942 in intel_hda_reg_write hw/audio/intel-hda.c:977:9
      TrungNguyen1909#38 0x62ada10a in intel_hda_mmio_write hw/audio/intel-hda.c:1054:5
      TrungNguyen1909#39 0x63d8f383 in memory_region_write_accessor softmmu/memory.c:492:5
      TrungNguyen1909#40 0x63d8ecc1 in access_with_adjusted_size softmmu/memory.c:554:18
      TrungNguyen1909#41 0x63d8d5d6 in memory_region_dispatch_write softmmu/memory.c:1504:16
      TrungNguyen1909#42 0x63d5e85e in flatview_write_continue softmmu/physmem.c:2812:23
      TrungNguyen1909#43 0x63d4d05b in flatview_write softmmu/physmem.c:2854:12
      TrungNguyen1909#44 0x63d4cb18 in address_space_write softmmu/physmem.c:2950:18
      TrungNguyen1909#45 0x63d4d387 in address_space_rw softmmu/physmem.c:2960:16
      TrungNguyen1909#46 0x62ae12f2 in dma_memory_rw_relaxed include/sysemu/dma.h:89:12
      TrungNguyen1909#47 0x62ae104a in dma_memory_rw include/sysemu/dma.h:132:12
      TrungNguyen1909#48 0x62ae6157 in dma_memory_write include/sysemu/dma.h:173:12
      ...
  SUMMARY: AddressSanitizer: stack-overflow softmmu/physmem.c:356 in address_space_translate_internal
  ==1580408==ABORTING
  Broken pipe
  Aborted (core dumped)

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20211218160912.1591633-4-philmd@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
shannon2893 pushed a commit to shannon2893/qemu-t8030 that referenced this issue Jul 25, 2022
The issue reported by OSS-Fuzz produces the following backtrace:

  ==447470==ERROR: AddressSanitizer: heap-buffer-overflow
  READ of size 1 at 0x61500002a080 thread T0
      #0 0x71766d47 in sdhci_read_dataport hw/sd/sdhci.c:474:18
      TrungNguyen1909#1 0x7175f139 in sdhci_read hw/sd/sdhci.c:1022:19
      TrungNguyen1909#2 0x721b937b in memory_region_read_accessor softmmu/memory.c:440:11
      TrungNguyen1909#3 0x72171e51 in access_with_adjusted_size softmmu/memory.c:554:18
      TrungNguyen1909#4 0x7216f47c in memory_region_dispatch_read1 softmmu/memory.c:1424:16
      TrungNguyen1909#5 0x7216ebb9 in memory_region_dispatch_read softmmu/memory.c:1452:9
      TrungNguyen1909#6 0x7212db5d in flatview_read_continue softmmu/physmem.c:2879:23
      TrungNguyen1909#7 0x7212f958 in flatview_read softmmu/physmem.c:2921:12
      TrungNguyen1909#8 0x7212f418 in address_space_read_full softmmu/physmem.c:2934:18
      TrungNguyen1909#9 0x721305a9 in address_space_rw softmmu/physmem.c:2962:16
      TrungNguyen1909#10 0x7175a392 in dma_memory_rw_relaxed include/sysemu/dma.h:89:12
      TrungNguyen1909#11 0x7175a0ea in dma_memory_rw include/sysemu/dma.h:132:12
      TrungNguyen1909#12 0x71759684 in dma_memory_read include/sysemu/dma.h:152:12
      TrungNguyen1909#13 0x7175518c in sdhci_do_adma hw/sd/sdhci.c:823:27
      TrungNguyen1909#14 0x7174bf69 in sdhci_data_transfer hw/sd/sdhci.c:935:13
      TrungNguyen1909#15 0x7176aaa7 in sdhci_send_command hw/sd/sdhci.c:376:9
      TrungNguyen1909#16 0x717629ee in sdhci_write hw/sd/sdhci.c:1212:9
      TrungNguyen1909#17 0x72172513 in memory_region_write_accessor softmmu/memory.c:492:5
      TrungNguyen1909#18 0x72171e51 in access_with_adjusted_size softmmu/memory.c:554:18
      TrungNguyen1909#19 0x72170766 in memory_region_dispatch_write softmmu/memory.c:1504:16
      TrungNguyen1909#20 0x721419ee in flatview_write_continue softmmu/physmem.c:2812:23
      TrungNguyen1909#21 0x721301eb in flatview_write softmmu/physmem.c:2854:12
      TrungNguyen1909#22 0x7212fca8 in address_space_write softmmu/physmem.c:2950:18
      TrungNguyen1909#23 0x721d9a53 in qtest_process_command softmmu/qtest.c:727:9

A DMA descriptor is previously filled in RAM. An I/O access to the
device (frames TrungNguyen1909#22 to TrungNguyen1909#16) start the DMA engine (frame TrungNguyen1909#13). The
engine fetch the descriptor and execute the request, which itself
accesses the SDHCI I/O registers (frame TrungNguyen1909#1 and #0), triggering a
re-entrancy issue.

Fix by prohibit transactions from the DMA to devices. The DMA engine
is thus restricted to memories.

Reported-by: OSS-Fuzz (Issue 36391)
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/451
Message-Id: <20211215205656.488940-3-philmd@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
shannon2893 pushed a commit to shannon2893/qemu-t8030 that referenced this issue Jul 25, 2022
Include the qtest reproducer provided by Alexander Bulekov
in https://gitlab.com/qemu-project/qemu/-/issues/451. Without
the previous commit, we get:

  $ make check-qtest-i386
  ...
  Running test qtest-i386/fuzz-sdcard-test
  ==447470==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61500002a080 at pc 0x564c71766d48 bp 0x7ffc126c62b0 sp 0x7ffc126c62a8
  READ of size 1 at 0x61500002a080 thread T0
      #0 0x564c71766d47 in sdhci_read_dataport hw/sd/sdhci.c:474:18
      TrungNguyen1909#1 0x564c7175f139 in sdhci_read hw/sd/sdhci.c:1022:19
      TrungNguyen1909#2 0x564c721b937b in memory_region_read_accessor softmmu/memory.c:440:11
      TrungNguyen1909#3 0x564c72171e51 in access_with_adjusted_size softmmu/memory.c:554:18
      TrungNguyen1909#4 0x564c7216f47c in memory_region_dispatch_read1 softmmu/memory.c:1424:16
      TrungNguyen1909#5 0x564c7216ebb9 in memory_region_dispatch_read softmmu/memory.c:1452:9
      TrungNguyen1909#6 0x564c7212db5d in flatview_read_continue softmmu/physmem.c:2879:23
      TrungNguyen1909#7 0x564c7212f958 in flatview_read softmmu/physmem.c:2921:12
      TrungNguyen1909#8 0x564c7212f418 in address_space_read_full softmmu/physmem.c:2934:18
      TrungNguyen1909#9 0x564c721305a9 in address_space_rw softmmu/physmem.c:2962:16
      TrungNguyen1909#10 0x564c7175a392 in dma_memory_rw_relaxed include/sysemu/dma.h:89:12
      TrungNguyen1909#11 0x564c7175a0ea in dma_memory_rw include/sysemu/dma.h:132:12
      TrungNguyen1909#12 0x564c71759684 in dma_memory_read include/sysemu/dma.h:152:12
      TrungNguyen1909#13 0x564c7175518c in sdhci_do_adma hw/sd/sdhci.c:823:27
      TrungNguyen1909#14 0x564c7174bf69 in sdhci_data_transfer hw/sd/sdhci.c:935:13
      TrungNguyen1909#15 0x564c7176aaa7 in sdhci_send_command hw/sd/sdhci.c:376:9
      TrungNguyen1909#16 0x564c717629ee in sdhci_write hw/sd/sdhci.c:1212:9
      TrungNguyen1909#17 0x564c72172513 in memory_region_write_accessor softmmu/memory.c:492:5
      TrungNguyen1909#18 0x564c72171e51 in access_with_adjusted_size softmmu/memory.c:554:18
      TrungNguyen1909#19 0x564c72170766 in memory_region_dispatch_write softmmu/memory.c:1504:16
      TrungNguyen1909#20 0x564c721419ee in flatview_write_continue softmmu/physmem.c:2812:23
      TrungNguyen1909#21 0x564c721301eb in flatview_write softmmu/physmem.c:2854:12
      TrungNguyen1909#22 0x564c7212fca8 in address_space_write softmmu/physmem.c:2950:18
      TrungNguyen1909#23 0x564c721d9a53 in qtest_process_command softmmu/qtest.c:727:9

  0x61500002a080 is located 0 bytes to the right of 512-byte region [0x615000029e80,0x61500002a080)
  allocated by thread T0 here:
      #0 0x564c708e1737 in __interceptor_calloc (qemu-system-i386+0x1e6a737)
      TrungNguyen1909#1 0x7ff05567b5e0 in g_malloc0 (/lib64/libglib-2.0.so.0+0x5a5e0)
      TrungNguyen1909#2 0x564c71774adb in sdhci_pci_realize hw/sd/sdhci-pci.c:36:5

  SUMMARY: AddressSanitizer: heap-buffer-overflow hw/sd/sdhci.c:474:18 in sdhci_read_dataport
  Shadow bytes around the buggy address:
    0x0c2a7fffd3c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    0x0c2a7fffd3d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0c2a7fffd3e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0c2a7fffd3f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0c2a7fffd400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  =>0x0c2a7fffd410:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    0x0c2a7fffd420: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
    0x0c2a7fffd430: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
    0x0c2a7fffd440: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
    0x0c2a7fffd450: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
    0x0c2a7fffd460: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  Shadow byte legend (one shadow byte represents 8 application bytes):
    Addressable:           00
    Heap left redzone:       fa
    Freed heap region:       fd
  ==447470==ABORTING
  Broken pipe
  ERROR qtest-i386/fuzz-sdcard-test - too few tests run (expected 3, got 2)

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20211215205656.488940-4-philmd@redhat.com>
[thuth: Replaced "-m 4G" with "-m 512M"]
Signed-off-by: Thomas Huth <thuth@redhat.com>
shannon2893 pushed a commit to shannon2893/qemu-t8030 that referenced this issue Jul 25, 2022
Since commit 0439c5a ("block/block-backend.c: assertions for
block-backend") QEMU crashes when using Cocoa on Darwin hosts.

Example on macOS:

  $ qemu-system-i386
  Assertion failed: (qemu_in_main_thread()), function blk_all_next, file block-backend.c, line 552.
  Abort trap: 6

Looking with lldb:

  Assertion failed: (qemu_in_main_thread()), function blk_all_next, file block-backend.c, line 552.
  Process 76914 stopped
  * thread TrungNguyen1909#1, queue = 'com.apple.main-thread', stop reason = hit program assert
     frame TrungNguyen1909#4: 0x000000010057c2d4 qemu-system-i386`blk_all_next.cold.1
  at block-backend.c:552:5 [opt]
      549    */
      550   BlockBackend *blk_all_next(BlockBackend *blk)
      551   {
  --> 552       GLOBAL_STATE_CODE();
      553       return blk ? QTAILQ_NEXT(blk, link)
      554                  : QTAILQ_FIRST(&block_backends);
      555   }
  Target 1: (qemu-system-i386) stopped.

  (lldb) bt
  * thread TrungNguyen1909#1, queue = 'com.apple.main-thread', stop reason = hit program assert
     frame #0: 0x00000001908c99b8 libsystem_kernel.dylib`__pthread_kill + 8
     frame TrungNguyen1909#1: 0x00000001908fceb0 libsystem_pthread.dylib`pthread_kill + 288
     frame TrungNguyen1909#2: 0x000000019083a314 libsystem_c.dylib`abort + 164
     frame TrungNguyen1909#3: 0x000000019083972c libsystem_c.dylib`__assert_rtn + 300
   * frame TrungNguyen1909#4: 0x000000010057c2d4 qemu-system-i386`blk_all_next.cold.1 at block-backend.c:552:5 [opt]
     frame TrungNguyen1909#5: 0x00000001003c00b4 qemu-system-i386`blk_all_next(blk=<unavailable>) at block-backend.c:552:5 [opt]
     frame TrungNguyen1909#6: 0x00000001003d8f04 qemu-system-i386`qmp_query_block(errp=0x0000000000000000) at qapi.c:591:16 [opt]
     frame TrungNguyen1909#7: 0x000000010003ab0c qemu-system-i386`main [inlined] addRemovableDevicesMenuItems at cocoa.m:1756:21 [opt]
     frame TrungNguyen1909#8: 0x000000010003ab04 qemu-system-i386`main(argc=<unavailable>, argv=<unavailable>) at cocoa.m:1980:5 [opt]
     frame TrungNguyen1909#9: 0x00000001012690f4 dyld`start + 520

As we are in passed release 7.0 hard freeze, disable the block
backend assertion which, while being valuable during development,
is not helpful to users. We'll restore this assertion immediately
once 7.0 is released and work on a fix.

Suggested-by: Akihiko Odaki <akihiko.odaki@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Akihiko Odaki <akihiko.odaki@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20220325183707.85733-1-philippe.mathieu.daude@gmail.com>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
good first issue Good for newcomers
Projects
None yet
Development

No branches or pull requests

3 participants