Abstract:

This presentation outlines the technical evolution and reverse-engineering methodology of the Asahi Linux project, which aims to port Linux to Apple Silicon (M-series) platforms. The speaker details how Apple’s intentional "One True Recovery" mechanism allows for unsigned code execution at Exception Level 2 (EL2), providing a legitimate pathway for third-party kernels without requiring hardware exploits. Central to the project's success is the development of m1n1, a multi-purpose tool that functions as a bootloader, a Python-integrated hardware probing shell, and a hypervisor. This hypervisor allows developers to run macOS (XNU) as a guest to trace Memory Mapped I/O (MMIO) accesses in real-time, effectively creating an "strace for hardware" to document proprietary registers.

The talk highlights recent milestones, including the transition from feature-heavy downstream forks to a sustainable "upstream-first" development model for core drivers like USB 3.0 and the system controller. Technical deep dives reveal specific hardware idiosyncrasies, such as the Apple USB controller’s requirement for a full hardware reset upon device disconnection. Finally, the session provides a status update on M3 support—demonstrating initial boot success and basic functionality—while addressing the reverse-engineering challenges posed by M4 and M5 architectures, which restrict certain virtualization instructions previously used for hardware tracing.

Engineering Analysis: Asahi Linux Methodology and Apple Silicon Hardware Parity

• 0:33 Project Credits and Collaboration: The speaker acknowledges the multi-disciplinary effort required to build a conformant user-space stack for unknown GPUs and complex kernel drivers, specifically crediting project founder Hector "Marcan" Martin for initial tooling.
• 3:24 Intentional Boot Architecture: Unlike iOS devices, Apple Silicon Macs provide a "One True Recovery" (1TR) mode that allows users to authorize custom boot objects. This grants full control at EL2 (highest CPU privilege) without management engine interference.
• 7:43 Rapid Prototyping via m1n1: The m1n1 tool provides a Python proxy over a UART-to-USB connection, allowing engineers to poke hardware registers in real-time. This bypasses the traditional "code-compile-reboot" cycle, enabling rapid hardware model verification.
• 10:56 Hypervisor-Based Tracing: By running macOS (XNU) within a specialized VM managed by m1n1, developers can trap and log MMIO accesses. This allows the team to observe how Apple’s proprietary drivers interact with the hardware, facilitating the documentation of undocumented registers.
• 14:52 Technical Debt and Upstreaming: The project has pivoted from maintaining a massive downstream patch set to upstreaming drivers (USB 3, audio, system controllers) into the mainline Linux kernel to ensure long-term sustainability across distributions.
• 20:03 USB Controller Complexity: Apple utilizes a modified Synopsys DesignWare USB3 controller. While registers are similar to version 3.0, the implementation lacks an official data sheet, requiring cross-referencing with other SoC vendors (Intel/Rockchip).
• 24:26 Hardware Idiosyncrasy (Reset Logic): Tracing revealed that the Apple USB controller requires a full hardware reset, port reset, and clock gating upon every device disconnect to allow subsequent re-initialization.
• 27:37 DisplayPort Achievement: The project recently achieved functional DisplayPort output on Linux, involving complex coordination between the display controller and the USB 3.5 PHY for signal serialization.
• 31:21 M3 Platform Progress: Initial support for the M3 architecture is underway, with successful boots and basic storage functionality confirmed by new contributors.
• 32:19 M4/M5 Reverse Engineering Challenges: Newer chips (M4/M5) introduce "Guarded Levels" that restrict certain virtualization instructions. This prevents m1n1 from tracing XNU MMIO accesses, necessitating new, more difficult reverse-engineering strategies.