Apple’s open-source kernel, booted on a laptop Apple never made.

Kernel
xnu-11417.140.69
Silicon
X1-26-100 Oryon
Machine
Lenovo 83N3
Status
Research · not macOS
Fig. 01 — Snapdragon X package, schematicRendered live, 1 char ≈ 5px

MACONDRAGON

QX-BOOT-0048 SMBIOS product ........ LENOVO 83N3✶QX-BOOT-0048 CPU ................... Snapdragon(R) X 10-core X1-26-100✶efi: ExitBootServices ok, map key 0x1f3a✶xnu_loader: jump _start @ EL1✶arm_vm_init: TTBR1 39-bit KVA 0xfffffff007004000✶gic: ISV-safe MMIO accessors armed✶Darwin Kernel Version 24.6.0: DEVELOPMENT_ARM64_QUALCOMM_X1✶pmap: 4 KiB granule, 13.8 GiB managed high bank✶xhci_msc: DWC3 polled, 61440000 sectors✶nvme_poll: Micron 2500 read-only allowlist✶IOStorageFamily: IOMedia published✶hfs: mountroot Apple_HFS ro on disk2s2✶qx_init: exec /sbin/qxhello as PID 1✶qxabi: 33/33 PASS✶qxs17: 122/122 PASS✶pac_sw: scheduler key context selected✶fixups: 3 plain applied, auth rejected atomically✶journal: 39499 bytes, 6 flushes, 0 drops✶QX-BOOT-0048 SMBIOS product ........ LENOVO 83N3✶QX-BOOT-0048 CPU ................... Snapdragon(R) X 10-core X1-26-100✶efi: ExitBootServices ok, map key 0x1f3a✶xnu_loader: jump _start @ EL1✶arm_vm_init: TTBR1 39-bit KVA 0xfffffff007004000✶gic: ISV-safe MMIO accessors armed✶Darwin Kernel Version 24.6.0: DEVELOPMENT_ARM64_QUALCOMM_X1✶pmap: 4 KiB granule, 13.8 GiB managed high bank✶xhci_msc: DWC3 polled, 61440000 sectors✶nvme_poll: Micron 2500 read-only allowlist✶IOStorageFamily: IOMedia published✶hfs: mountroot Apple_HFS ro on disk2s2✶qx_init: exec /sbin/qxhello as PID 1✶qxabi: 33/33 PASS✶qxs17: 122/122 PASS✶pac_sw: scheduler key context selected✶fixups: 3 plain applied, auth rejected atomically✶journal: 39499 bytes, 6 flushes, 0 drops✶
(01)Read this first

This is not macOS. It is Apple’s public XNU kernel, started directly from UEFI on a Snapdragon X laptop, with every driver in between written by hand. Each claim on this page was seen on the physical machine—or it tells you otherwise.

Numbered boot tests01
0
Test-08 → Test-48
Process & IPC assertions02
0/122
Test-45
Bytes of boot journal03
0
Test-48, six flushes
Bytes dropped04
0
No damaged slots, no panic
(02)The ledger

What runs today

(02.b)Read before concluding

What doesn’t

(03)Execution stack

Five layers.
One isn’t ours.

Everything from the UEFI loader up is written or adapted here. The hypervisor underneath belongs to the firmware—and it decides whether native pointer authentication can ever be switched on.

  1. EL0

    Userland

    This project

    Static, ad-hoc-signed ARM64 Mach-O test programs and an own dynamic linker. Direct BSD syscalls, no Apple libSystem.T-39 · T-40 · T-42 · T-45

  2. EL1

    XNU · QUALCOMM_X1

    Apple source, own platform code

    4 KiB pmap with a 39-bit kernel VA window, ISV-safe GICv3 accessors, resized zone budgets, LLVM 19 workarounds.T-15 · T-20 · T-48

  3. I/O

    IOKit storage + HFS+

    Own drivers, Apple families

    Polled xHCI and NVMe drivers published through Apple IOStorageFamily. Apple HFS+ mounts the test stick as /.T-24 · T-25 · T-33

  4. EFI

    Loader + SecureDT

    This project

    Freestanding UEFI loader. Validates the machine, builds an Apple device tree, seeds randomness, writes QX-BOOT reports.QX-BOOT-0005 → 0048

  5. EL2

    Qualcomm hypervisor

    Firmware · not ours

    Owns EL2. Traps GIC MMIO, controls the PAC system registers. Whether a guest may install keys is still unmeasured.S18.8 · outcome B

(04)Boot log, 08 → 48

Every boot,
failures too.

Each number is a physical boot of the Lenovo. Since Test-36 the kernel writes its own log to a checksummed journal on a dedicated USB stick.

TestFAIL
08

First XNU instructions

Stops at MMU enable: kernel linked for a KVA the 39-bit window cannot reach.

TestPASS
09

MMU on

New 39-bit KVA layout. C code runs at kernel addresses.

TestFAIL
11

First readable panic

“no random seed” — fixed with EFI_RNG_PROTOCOL.

TestOBS
14

Hypervisor fault decoded

EL2 cannot emulate writeback MMIO. GIC accessors rewritten.

TestFAIL
15

Darwin banner

First kernel banner on Snapdragon, then a compressor VA overrun.

TestPASS
20

BSD init

Full BSD startup, waits for a root device without panic.

TestPASS
24

USB block reads

First native reads through a polled xHCI driver.

TestPASS
25

NVMe reads

Internal SSD, read-only, GPT checked against Linux.

TestPASS
33

HFS+ as root

Mounted read-only. Five files SHA-256 verified through VFS.

TestPASS
39

First userland

Own PID 1 reads /hello.txt and writes the console.

TestPASS
42

Own dyld

MH_DYLINKER loads a signed shared library. 22/22.

TestPASS
45

Processes & IPC

Threads, fork/COW, exec, signals, Mach IPC. 122/122.

TestPASS
48

Current baseline

Scheduler PAC selection, three plain fixups. Zero drops.

Next →
49

Blocked by guest permissions. Not staged.

(05)Dependency order

The road to launchd

  1. 01

    Native hardware PAC

    Measure whether the EL2 hypervisor lets the guest install keys and enable pointer authentication.

    Blocked
  2. 02

    Shared-cache pager

    Assemble four 4 KiB pages into one atomic 16 KiB chunk for the dyld shared cache.

    Host verified
  3. 03

    Authenticated fixups

    arm64e format-12 chained fixups. 190 host regressions pass; native signing absent.

    Waits on 01
  4. 04

    Original Apple dyld

    A 13-instruction guarded prologue ran under Linux supervision. Nothing yet under this kernel.

    Planned
  5. 05

    Original Apple launchd

    Run the real launchd as PID 1 and begin an Apple system bootstrap.

    Long term