Now we can run this on Android

[Sam2159]

By adding some little changes, the ios emulator can start on Android using Termux and Termux:X11. It's laggy and a lot of times crashes on start giving an "Illegal instruction" error, but it's a start for making ios run on phones not made by apple. The phone that i used is a Redmagic 9s pro with the "Diablo mode" and "Acquire wakelock" of Termux enabled. Here's the things that are needed to make it work:

First of all, install Termux and Termux:X11 from github (I don't know if the Google Play version work). Then install all the dependencies required

pkg update && pkg upgrade

pkg install glib cmake pacman git wget autoconf nettle ninja binutils x11-repo mesa git dtc zlib ninja cmake gnutls capstone xorgproto && pkg install sdl2 mesa-dev libtasn1 xorg-server xterm fluxbox libssh attr sdl2 gtk3 libpixman pkg-config texinfo m4 libssh capstone xorgproto automake libtool python termux-x11-nightly xfce4

git clone https://github.com/lzfse/lzfse.git

cd lzfse

cmake -DCMAKE_INSTALL_PREFIX=/data/data/com.termux/files/usr/

make

make install

cd /data/data/com.termux/files/home

Then clone the Repository and build it

git clone https://github.com/ChefKissInc/QEMUAppleSilicon && cd QEMUAppleSilicon

git submodule update --init

mkdir build && cd build

../configure --target-list=aarch64-softmmu,x86_64-softmmu --enable-lzfse --enable-slirp --enable-capstone --enable-curses --enable-libssh --enable-virtfs --enable-zstd --enable-nettle --enable-gnutls --enable-gtk --enable-sdl --disable-werror --disable-guest-agent

The "--disable-guest-agent" flag is used to avoid an error that would have occurred later.

Before the make command, we need to do some changes:

rm /data/data/com.termux/files/usr/include/linux/virtio_ring.h

wget --directory-prefix=/data/data/com.termux/files/usr/include/linux/ https://raw.githubusercontent.com/qemu/qemu/refs/heads/master/include/standard-headers/linux/virtio_ring.h

Open 9p-local.c using nano

nano /data/data/com.termux/files/home/QEMUAppleSilicon/hw/9pfs/9p-local.c

add this on top

#include <sys/mman.h>

find the lines 629-630 using ctrl + f

        sync_file_range(fs->fd, offset, ret,
                        SYNC_FILE_RANGE_WAIT_BEFORE | SYNC_FILE_RANGE_WRITE);

and replace with

#if defined(__linux__) && !defined(__ANDROID__)
        sync_file_range(fs->fd, offset, ret,
                        SYNC_FILE_RANGE_WAIT_BEFORE | SYNC_FILE_RANGE_WRITE);
#else
    (void)fs;
    (void)offset;
    (void)ret;
#endif

Save and close the file using ctrl + x

Open 9p-marshal.h using nano

nano /data/data/com.termux/files/home/QEMUAppleSilicon/fsdev/9p-marshal.h

add this on top

#ifdef st_atime_nsec
#undef st_atime_nsec
#endif
#ifdef st_mtime_nsec
#undef st_mtime_nsec
#endif
#ifdef st_ctime_nsec
#undef st_ctime_nsec
#endif

Save and close the file using ctrl + x

Open file-posix.c using nano

nano /data/data/com.termux/files/home/QEMUAppleSilicon/block/file-posix.c

find the lines 2175-2198 using ctrl + f

    while (bytes) {
        ssize_t ret = copy_file_range(aiocb->aio_fildes, &in_off,
                                      aiocb->copy_range.aio_fd2, &out_off,
                                      bytes, 0);
        trace_file_copy_file_range(aiocb->bs, aiocb->aio_fildes, in_off,
                                   aiocb->copy_range.aio_fd2, out_off, bytes,
                                   0, ret);
        if (ret == 0) {
            /* No progress (e.g. when beyond EOF), let the caller fall back to
             * buffer I/O. */
            return -ENOSPC;
        }
        if (ret < 0) {
            switch (errno) {
            case ENOSYS:
                return -ENOTSUP;
            case EINTR:
                continue;
            default:
                return -errno;
            }
        }
        bytes -= ret;

and replace with

    while (bytes) {
        #ifndef __ANDROID__
        ssize_t ret = copy_file_range(aiocb->aio_fildes, &in_off,
                                      aiocb->copy_range.aio_fd2, &out_off,
                                      bytes, 0);
        trace_file_copy_file_range(aiocb->bs, aiocb->aio_fildes, in_off,
                                   aiocb->copy_range.aio_fd2, out_off, bytes,
                                   0, ret);
        if (ret == 0) {
            /* No progress (e.g. when beyond EOF), let the caller fall back to
             * buffer I/O. */
            return -ENOSPC;
        }
        if (ret < 0) {
            switch (errno) {
            case ENOSYS:
                return -ENOTSUP;
            case EINTR:
                continue;
            default:
                return -errno;
            }
        }
        bytes -= ret;
        #endif

Save and close the file using ctrl + x

Open ivshmem-server.c using nano

nano /data/data/com.termux/files/home/QEMUAppleSilicon/contrib/ivshmem-server/ivshmem-server.c

add this on top

#include <fcntl.h>
#include <sys/mman.h>
#include <unistd.h>
#define SHM_SIZE 4096

find the line 278 using ctrl + f

   server->use_shm_open = use_shm_open;

and set to false

    server->use_shm_open = false;

find the lines 295-306 using ctrl + f

    if (server->use_shm_open) {
        IVSHMEM_SERVER_DEBUG(server, "Using POSIX shared memory: %s\n",
                             server->shm_path);
        shm_fd = shm_open(server->shm_path, O_CREAT | O_RDWR, S_IRWXU);
    } else {
        gchar *filename = g_strdup_printf("%s/ivshmem.XXXXXX", server->shm_path);
        IVSHMEM_SERVER_DEBUG(server, "Using file-backed shared memory: %s\n",
                             server->shm_path);
        shm_fd = mkstemp(filename);
        unlink(filename);
        g_free(filename);
    }

replace with

    gchar *filename = g_strdup_printf("%s/ivshmem.XXXXXX", server->shm_path);
    IVSHMEM_SERVER_DEBUG(server, "Using file-backed shared memory: %s\n", server->shm_path);
    shm_fd = mkstemp(filename);
    if (shm_fd == -1) {
        perror("Failed to create temporary shm file");
        g_free(filename);
        return -1;
    }
    unlink(filename);
    g_free(filename);

    if (ftruncate(shm_fd, SHM_SIZE) == -1) {
        perror("Failed to set size of shared memory");
        close(shm_fd);
        return -1;
    }

    void *shm_ptr = mmap(NULL, SHM_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED, shm_fd, 0);
    if (shm_ptr == MAP_FAILED) {
        perror("Failed to map shared memory");
        close(shm_fd);
        return -1;
    }

find lines 357 and 377 using ctrl + f and add // before shm_unlink, like this

       // shm_unlink(server->shm_path);

Save and close the file using ctrl + x

Open ivshmem-test.c using nano

nano /data/data/com.termux/files/home/QEMUAppleSilicon/tests/qtest/ivshmem-test.c

add this after the #include lines

#if defined(__ANDROID__) || defined(__TERMUX__)
#define NO_SHM
#endif

find the line 438 using ctrl + f

        shm_unlink(tmpshm);

replace with

        #ifndef NO_SHM
        shm_unlink(tmpshm);
        #endif

find the lines 466-467 using ctrl + f

        *fd = shm_open(name, O_CREAT|O_RDWR|O_EXCL,
                       S_IRWXU|S_IRWXG|S_IRWXO);

replace with

        #ifndef NO_SHM
        *fd = shm_open(name, O_CREAT|O_RDWR|O_EXCL,
                       S_IRWXU|S_IRWXG|S_IRWXO);
        #else
            gchar *filename = g_strdup_printf("/data/data/com.termux/files/usr/tmp/%s", name);
            *fd = open(filename, O_CREAT | O_RDWR | O_EXCL, 0600);
            g_free(filename);
        #endif

Save and close the file using ctrl + x

Open libvhost-user.c using nano

nano /data/data/com.termux/files/home/QEMUAppleSilicon/subprojects/libvhost-user/libvhost-user.c

add this on top

#include <sys/stat.h>

find the lines 1878-1888 using ctrl + f

#ifdef MFD_ALLOW_SEALING
static void *
memfd_alloc(const char *name, size_t size, unsigned int flags, int *fd)
{
    void *ptr;
    int ret;

    *fd = memfd_create(name, MFD_ALLOW_SEALING);
    if (*fd < 0) {
        return NULL;
    }

replace with

#ifdef MFD_ALLOW_SEALING
#ifndef __NR_memfd_create
#define __NR_memfd_create 319
#endif

static inline int safe_memfd_create(const char *name, unsigned int flags) {
#if defined(__ANDROID__) || defined(__TERMUX__)
    return syscall(__NR_memfd_create, name, flags);
#else
    return memfd_create(name, flags);
#endif
}

static void *
memfd_alloc(const char *name, size_t size, unsigned flags, int *fd)
{
    void *ptr;
    int ret;

    *fd = safe_memfd_create(name, MFD_ALLOW_SEALING);
    if (*fd < 0) {
#if defined(__ANDROID__) || defined(__TERMUX__)
        char path[] = "/data/data/com.termux/files/usr/tmp/memfd-XXXXXX";
        *fd = mkstemp(path);
        if (*fd < 0)
            return NULL;
        unlink(path);
#else
        return NULL;
#endif
    }

Save and close the file using ctrl + x

Open oslib-posix.c using nano

nano /data/data/com.termux/files/home/QEMUAppleSilicon/util/oslib-posix.c

add this after the #include lines

#ifndef HAVE_CLOSE_RANGE
static int close_range(unsigned int first, unsigned int last, unsigned int flags) {
    int ret = 0;
    for (unsigned int fd = first; fd <= last; fd++) {
        if (close(fd) < 0)
            ret = -1;
    }
    return ret;
}
#endif

find line 978 using ctrl + f

    fd = shm_open(shm_name->str, oflag, mode);

and remove "shm_" from "shm_open"

    fd = open(shm_name->str, oflag, mode);

find line 990 using ctrl + f

    shm_unlink(shm_name->str);

and remove "shm_" from "shm_unlink"

    unlink(shm_name->str); 

Save and close the file using ctrl + x and finally run the make command

make -j$(nproc)

From there, I created the other files (like the disks) using an Ubuntu machine, but you could also try to do it directly from Termux, however I haven't tested it.
For starting the vm, run

termux-x11 :1 -xstartup "xfce4-session"

then open Termux:X11, open the terminal and run

QEMUAppleSilicon/build/qemu-system-aarch64 -M t8030,trustcache=iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/Firmware/038-44135-124.dmg.trustcache,ticket=root_ticket.der,sep-fw=sep-firmware.n104.RELEASE.new.img4,sep-rom=AppleSEPROM-Cebu-B1,kaslr-off=true \
-kernel iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/kernelcache.research.iphone12b -dtb iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/Firmware/all_flash/DeviceTree.n104ap.im4p \
-append "tlto_us=-1 mtxspin=-1 agm-genuine=1 agm-authentic=1 agm-trusted=1 serial=3 launchd_unsecure_cache=1 wdt=-1" \
-smp 7 -m 4G -serial mon:stdio \
-drive file=sep_nvram,if=pflash,format=raw \
-drive file=sep_ssc,if=pflash,format=raw \
-drive file=nvme.1,format=raw,if=none,id=drive.1 -device nvme-ns,drive=drive.1,bus=nvme-bus.0,nsid=1,nstype=1,logical_block_size=4096,physical_block_size=4096 \
-drive file=nvme.2,format=raw,if=none,id=drive.2 -device nvme-ns,drive=drive.2,bus=nvme-bus.0,nsid=2,nstype=2,logical_block_size=4096,physical_block_size=4096 \
-drive file=nvme.3,format=raw,if=none,id=drive.3 -device nvme-ns,drive=drive.3,bus=nvme-bus.0,nsid=3,nstype=3,logical_block_size=4096,physical_block_size=4096 \
-drive file=nvme.4,format=raw,if=none,id=drive.4 -device nvme-ns,drive=drive.4,bus=nvme-bus.0,nsid=4,nstype=4,logical_block_size=4096,physical_block_size=4096 \
-drive file=nvram,if=none,format=raw,id=nvram -device apple-nvram,drive=nvram,bus=nvme-bus.0,nsid=5,nstype=5,id=nvram,logical_block_size=4096,physical_block_size=4096 \
-drive file=nvme.6,format=raw,if=none,id=drive.6 -device nvme-ns,drive=drive.6,bus=nvme-bus.0,nsid=6,nstype=6,logical_block_size=4096,physical_block_size=4096 \
-drive file=nvme.7,format=raw,if=none,id=drive.7 -device nvme-ns,drive=drive.7,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096

If it crash with the "Illegal instruction" error, just wait 30 seconds and retry (it will take some attempts).

[VisualEhrmanntraut]

I've done this already before releasing the emulator

[khanhduytran0]

@Sam2159 FYI, you could export your changes to a .diff file or fork this repo and push your changes so everyone else can apply it with little effort.

git diff > android.diff

[Sam2159]

Sure, I'll do that. Thanks for the tip.