Domain Analysis: Systems Engineering & Kernel Development
Expert Persona: Senior Systems Architect / Principal Kernel Engineer
Abstract
This technical presentation details the progress and methodology of the Asahi Linux project in porting the Linux kernel to Apple Silicon (M-series) hardware. The speaker outlines the project’s reliance on Apple’s intentional "One True Recovery" boot mechanism, which permits unsigned code execution at EL2 without requiring software exploits. A core focus of the session is the custom reverse-engineering stack, specifically the m1n1 environment, which functions as a thin hypervisor to trace Memory-Mapped I/O (MMIO) accesses from macOS (XNU) to document undocumented hardware. Technical deep dives include the implementation of the Apple Interrupt Controller (AIC) and the complex USB/Type-C subsystem. The latter requires a specific "tear-down and hard-reset" sequence upon device disconnection due to proprietary hardware state limitations. Finally, the presentation addresses the transition to upstream-first development and the emerging challenges of M4/M5 architectures, where changes to "Guarded Levels" (GL2) restrict previous hypervisor-based tracing techniques.
Technical Summary: Porting Linux to Apple Silicon
0:31 Project Contributors & Funding: The project is a collaborative effort led by Hector Martin (Marcan), with specialized contributions from Alyssa Rosenzweig (Graphics/Mesa), Asahi Lina (GPU Kernel), and various others handling audio and downstream maintenance. It is funded primarily through community donations.
3:22 Open Boot Architecture: Contrary to iOS devices, Apple Silicon Macs allow booting custom "Mach-O" binaries via a "One True Recovery" (1TR) mode. This requires physical presence and owner authentication, dropping the system into Exception Level 2 (EL2) with no management engine or Apple firmware oversight on the main cores.
6:22 Initial Boot Requirements: To achieve a minimal Linux boot, the project first identified the Apple Interrupt Controller (AIC) and used the standard ARM timer. Because Apple provides no documentation, register identities were cross-referenced from XNU open-source drops.
7:35 Reverse Engineering Toolchain (m1n1): The project utilizes m1n1, a freestanding C application that provides a Python proxy over UART. This allows developers to poke hardware registers and prototype drivers in Python on a host machine before committing to C code in the Linux kernel.
10:51 Hypervisor-Based MMIO Tracing: For complex blocks like GPUs, the team uses m1n1 as a hypervisor to run XNU as a VM. By setting page table traps on MMIO ranges, the team can log every hardware access XNU performs, creating a "hardware s-trace" to understand proprietary logic without traditional disassembly.
14:07 Upstreaming Strategy: After initially accumulating over 1,000 downstream patches, the project shifted to an "upstream-first" approach. This ensures sustainability and allows standard Linux distributions to support the hardware natively.
15:33 USB/Type-C Complexity: Supporting Type-C involves managing USB 2.0 (differential signaling), USB 3.x (High-Speed lanes), Power Delivery (PD) negotiation via the CC line, and Alternate Modes (DisplayPort/Thunderbolt).
20:04 DWC3 Implementation & Quirks: Apple utilizes a modified Synopsys Designware (DWC3) controller. Reverse engineering revealed a significant hardware quirk: once initialized, the controller cannot be re-used after a disconnect without a full hardware reset and clock gating. The Linux driver was modified to perform a total "tear-down" of the stack upon every unplug event.
27:51 DisplayPort Alt-Mode Success: The project successfully demonstrated functional DisplayPort output on Apple Silicon under Linux. Current development is focused on ironing out bugs in the serialization protocols for general release in early 2025.
M3: Initial support is functional (booting, storage), though GPU acceleration remains in progress.
M4/M5: Apple has introduced "Guarded Levels" (GL2) and disabled specific instructions in EL2. While Linux can still boot via "Raw Boot Objects," these changes break existing hypervisor-based MMIO tracing tools, significantly increasing the difficulty of reverse engineering new hardware iterations.