USB pass through in KVM, for iphone recovery...
My iphone was blackrai1ned on my friends windows machine. Recently, I found it's not stable, especially for the backgrounder app, which cause my iphone is total unusable (black screen...). And I have to re-blackrai1n the iphone for each reboot, due to the iphone 3GS fireware 3.1.2, which is a headache for me, as I don't have a Windows machine(blackrai1n only works on windows/Mac)
So what I can do to recovery my iphone from Linux?
Windows virtual Machine...
Why not VirtualBox?
It doesn't work, I can't restore my iphone in itunes, even I can attach iphone to the windows guest (http://news.softpedia.com/news/How-to-Fix-VirtualBox-USB-Support-111715.shtml). I guess it's due to the USB timing isse when emulating USB protocol in VirtualBox.
It's the same for QEMU's usb passthrough[1]
Is there no way to recovery my iphone now?
Hmm, not that bad. There is another way to attach/pass-through/plug devices to a virtual machine: pci device pass-through, which is supported by KVM[2].
What's the pci device pass-through mean?
Unlike the traditional device emulation used by most off-shelf virtual machine, it's a new hardware technology adopted by AMD and Intel in their chipset, which maps a pci device to a virtual machine's address space, guest os or driver can directly access/control the device as it did on native. It's high performance and ease the virtualization implementation for device virtualization. More info can be found at [3]
You need to have a machine, which supports VT-x and VT-d on Intel, or SVM and IOMMU on AMD.
Following is the step by step to pass-through my iphone to guest on KVM:
OS: FC12
HW: ThinkPad T500
1. Turn on vt-x and vt-d in the bios
2. Identify which USB device is used when you plug in the iphone on the laptop
My hw configuration, by lspci:
00:00.0 Host bridge: Intel Corporation Mobile 4 Series Chipset Memory Controller Hub (rev 07)
00:01.0 PCI bridge: Intel Corporation Mobile 4 Series Chipset PCI Express Graphics Port (rev 07)
00:03.0 Communication controller: Intel Corporation Mobile 4 Series Chipset MEI Controller (rev 07)
00:03.2 IDE interface: Intel Corporation Mobile 4 Series Chipset PT IDER Controller (rev 07)
00:03.3 Serial controller: Intel Corporation Mobile 4 Series Chipset AMT SOL Redirection (rev 07)
00:19.0 Ethernet controller: Intel Corporation 82567LM Gigabit Network Connection (rev 03)
00:1a.0 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #4 (rev 03)
00:1a.1 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #5 (rev 03)
00:1a.2 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #6 (rev 03)
00:1a.7 USB Controller: Intel Corporation 82801I (ICH9 Family) USB2 EHCI Controller #2 (rev 03)
00:1b.0 Audio device: Intel Corporation 82801I (ICH9 Family) HD Audio Controller (rev 03)
00:1c.0 PCI bridge: Intel Corporation 82801I (ICH9 Family) PCI Express Port 1 (rev 03)
00:1c.1 PCI bridge: Intel Corporation 82801I (ICH9 Family) PCI Express Port 2 (rev 03)
00:1c.3 PCI bridge: Intel Corporation 82801I (ICH9 Family) PCI Express Port 4 (rev 03)
00:1c.4 PCI bridge: Intel Corporation 82801I (ICH9 Family) PCI Express Port 5 (rev 03)
00:1d.0 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #1 (rev 03)
00:1d.1 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #2 (rev 03)
00:1d.2 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #3 (rev 03)
00:1d.7 USB Controller: Intel Corporation 82801I (ICH9 Family) USB2 EHCI Controller #1 (rev 03)
00:1e.0 PCI bridge: Intel Corporation 82801 Mobile PCI Bridge (rev 93)
00:1f.0 ISA bridge: Intel Corporation ICH9M-E LPC Interface Controller (rev 03)
00:1f.2 SATA controller: Intel Corporation ICH9M/M-E SATA AHCI Controller (rev 03)
00:1f.3 SMBus: Intel Corporation 82801I (ICH9 Family) SMBus Controller (rev 03)
01:00.0 VGA compatible controller: ATI Technologies Inc Mobility Radeon HD 3650
03:00.0 Network controller: Intel Corporation PRO/Wireless 5100 AGN [Shiloh] Network Connection
15:00.0 CardBus bridge: Ricoh Co Ltd RL5c476 II (rev ba)
15:00.1 FireWire (IEEE 1394): Ricoh Co Ltd R5C832 IEEE 1394 Controller (rev 04)
15:00.2 SD Host controller: Ricoh Co Ltd R5C822 SD/SDIO/MMC/MS/MSPro Host Adapter (rev 21)
15:00.3 System peripheral: Ricoh Co Ltd R5C843 MMC Host Controller (rev ff)
15:00.4 System peripheral: Ricoh Co Ltd R5C592 Memory Stick Bus Host Adapter (rev 11)
15:00.5 System peripheral: Ricoh Co Ltd xD-Picture Card Controller (rev 11)
there are eight USB controllers on my system: 00:1a.[0,1,2,7] and 00:1d.[0,1,2,7].
Then let's look at the change of interrupt on this controllers, when we plug in and plug off Iphone:
#: watch --interval=1 cat /proc/interrupts
CPU0 CPU1
0: 13593294 8754105 IO-APIC-edge timer
1: 8443 4765 IO-APIC-edge i8042
8: 0 1 IO-APIC-edge rtc0
9: 7824 14224 IO-APIC-fasteoi acpi
12: 5694290 1142 IO-APIC-edge i8042
16: 0 0 IO-APIC-fasteoi usb, yenta
17: 19441 60 IO-APIC-fasteoi usb, HDA Intel, firewire_ohci
18: 0 0 IO-APIC-fasteoi usb, mmc0
19: 12 14 IO-APIC-fasteoi ehci
20: 14057 14613 IO-APIC-fasteoi usb,
21: 14057 14613 IO-APIC-fasteoi usb,
22: 5 1 IO-APIC-fasteoi usb,
23: 48245 49015 IO-APIC-fasteoi ehci,
24: 0 0 DMAR_MSI-edge dmar1
25: 0 0 DMAR_MSI-edge dmar0
26: 0 0 DMAR_MSI-edge dmar2
16-23 interrupt vector are used by these usb controller, when you plug off your iphone, the interrupt number will be changed, so then you can find which interrupt vector is used by the iphone. And you have to find an interrupt vector which is not shared with other devices, such as vector 16 is shared with usb and yenta, due to the limitation of KVM. You can just change the USB port (I have 3 USB ports), in which iphone plugged.
Then what's the mapping between controller and interrupt vector?
You can find it by "lspci -vvv -s 00:1a.0":
00:1a.0 USB Controller: Intel Corporation 82801I (ICH9 Family) USB UHCI Controller #4 (rev 03) (prog-if 00 [UHCI])
Subsystem: Lenovo Device 20f0
Control: I/O+ Mem- BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx-
Status: Cap+ 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort-
SERR- Interrupt: pin A routed to IRQ 20
Region 4: I/O ports at 1860 [size=32]
Capabilities: [50] PCI Advanced Features
AFCap: TP+ FLR+
AFCtrl: FLR-
AFStatus: TP-
00:1a.0 uses IRQ 20, and so on, you can find which usb device is used by iphone.
For my case, the usb device is 00:1a.7. Then we will start to assign the device to kvm as step 4 and step 6 in [2]
After guest os is booting, lauching itunes, oh, it finds my iphone, and restores it successfully.
[1]http://bitbud.com/2008/08/09/usb-device-passthrough-under-kvm/
[2]http://www.linux-kvm.org/page/How_to_assign_devices_with_VT-d_in_KVM
[3]http://www.ibm.com/developerworks/linux/library/l-pci-passthrough/
Update:
Have an easy way to do:
1. unload usb modules during boot time: adding nousb at the grub kernel line
2. Force pci bars are aligned on 4k address: pci=resource_alignment=00:1d.0;00:1d.1;00:1d.2;00:1d.7;00:1a.0;00:1a.1;00:1a.2;00:1a.7Labels: kvm pci passthrough