Snapintosh

Snapintosh boots Apple's macOS 27 (build 26A428) on an ASUS Zenbook A16 laptop with a Qualcomm Snapdragon X2 Elite (X2E-96-100). It is an EL2 monitor (hypervisor) and the toolchain around it. The monitor runs Apple's stock kernelcache (the J700/T8140 kernel) unmodified by default. It supplies the platform contracts that the kernel expects from Apple silicon: the SPTM and TXM monitor calls, translation of the kernel's 16 KiB page tables, and the Apple devices the kernel looks for.

Graphics run on the laptop's own Adreno X2-90 GPU through a driver stack written for this project:

• AdrenoMetal.bundle: a Metal driver plug-in.
• AdrenoX2: an IOGPU kernel extension, with AdrenoDisplay driving the internal panel.
• air2ir3: a shader compiler that translates Apple's AIR (Metal's IR) into Mesa's ir3 for the Adreno.

There is no software, CPU or paravirtual rendering path.

The project also includes an I2C-HID keyboard and touchpad driver (SnapI2CHID), native QCC2072 Wi-Fi work, and NVMe storage through an emulated Apple storage controller.

Snapintosh is used together with q1n1, a UEFI EL2 proxy forked from Asahi Linux's m1n1. q1n1 takes the machine at EL2 after UEFI and serves m1n1's proxy protocol over USB-C to a Mac host, which drives Snapintosh from there.

This is experimental software, written for one laptop model.

docs/STATUS.md has the details, the known issues and the roadmap.

• An ASUS Zenbook A16 with the Snapdragon X2 Elite X2E-96-100 (UX3607OA). Nothing else is supported. The monitor, device tables, clocks and register addresses are specific to this machine.
• A Mac host running macOS 27, connected to the A16 over USB-C. q1n1 brings up a USB NCM network link on that cable, and every boot, upload and log capture goes over it.
• AC power is strongly recommended. The tools refuse to boot or write the SSD below a battery threshold.

flowchart TD
    UEFI["A16 UEFI firmware"] --> Q1N1
    Q1N1["q1n1: UEFI EL2 proxy<br/>(USB-C NCM link to the Mac host)"] --> MON
    MON["Snapintosh EL2 monitor<br/>SPTM/TXM call emulation, 16K-to-4K shadow page tables,<br/>Apple device models (AIC, ANS2 NVMe, DART, ...), GPU ring and SMMU mediation"] --> XNU
    XNU["Stock macOS kernel at EL1 + AuxKC<br/>(AdrenoX2 + AdrenoDisplay, SnapI2CHID, ...)"] --> USER
    USER["macOS userspace<br/>WindowServer, Core Animation, apps<br/>AdrenoMetal.bundle + air2ir3 compiler runtime"]
    HOST["Mac host: tools/cycle.py, q1n1 proxy client"] -. USB-C NCM .-> Q1N1

A16 UEFI -> q1n1 (EL2 proxy) -> Snapintosh monitor (EL2) -> XNU + AuxKC (EL1) -> userspace + Metal plug-in (EL0)

docs/ARCHITECTURE.md explains each layer.

Snapintosh is split across the Snapintosh organization. This umbrella repository holds the EL2 monitor, the host tools and the documentation, and mounts the components below as git submodules at the paths they always had, so every relative build path is unchanged. Clone it with its submodules:

git clone --recurse-submodules https://github.com/Snapintosh/Snapintosh.git
git clone https://github.com/Snapintosh/q1n1.git     # next to it, at ../q1n1

A change to a component lands in its own repository first; the umbrella then moves the submodule pointer in a separate commit.

You need:

• a Mac with Xcode (macOS 27 SDK);
• the Kernel Debug Kit for build 26A428, installed at /Library/Developer/KDKs/KDK_27.0_26A428.kdk;
• Python 3;
• Homebrew LLVM, Meson and Ninja for the shader compiler. Its Mesa checkout is fetched and patched by gpu/air2ir3/tools/mesa-setup.sh;
• a q1n1 checkout next to this one (../q1n1).

docs/BUILDING.md has the steps.

This repository ships no Apple, Qualcomm or ASUS binaries or firmware. You supply them yourself:

• The macOS 27 restore image (IPSW). Download it from Apple with python3 tools/fetch-ipsw.py <url> [destination]. Then extract the J700 boot set (kernelcache, device tree, SPTM, TXM and others) with python3 tools/extract-firmware.py <ipsw> j700ap. Nothing runs without it.
• The Kernel Debug Kit for 26A428, from Apple's developer downloads.
• Device firmware. The Adreno GPU's GMU and SQE microcode (gen80100_gmu.bin, gen80100_sqe.fw) and the QCC2072 Wi-Fi firmware come from the linux-firmware project. The Wi-Fi board file (bdwlan_qcc2072_1p0_ncm820A.elf) comes from ASUS's Windows WLAN driver package for this model. The tools check each file against a pinned SHA-256.

The project depends on Apple software that each user must obtain and use under Apple's terms.

Snapintosh is an experimental hypervisor that runs with full control of the machine.

• It writes the internal NVMe SSD. Installing macOS changes the partition table, and the guest writes its own volumes. A bug can corrupt or destroy data on the SSD, including the Windows installation. Back up everything before you start, and keep a way to restore Windows.
• It programs clocks, voltages, the GPU and memory-bandwidth votes directly. The tools refuse to run on low battery and stop the run when the SoC gets too hot (--thermal-guard), but those guards are not a guarantee.
• It is not a supported or stable way to run macOS. Expect panics, hangs and cold reboots.

Use it at your own risk.

Snapintosh is an independent project. It is not affiliated with, endorsed by or sponsored by Apple, Qualcomm, ASUS or Asahi Linux. macOS, Metal and Apple are trademarks of Apple Inc. Snapdragon and Adreno are trademarks of Qualcomm Incorporated. Zenbook is a trademark of ASUSTeK Computer Inc. All other trademarks belong to their owners.

Running macOS on non-Apple hardware may conflict with Apple's macOS software licence agreement. You are responsible for making sure that your use complies with the licences that apply to you.

The project's own code is MIT licensed; see LICENSE. Some components carry other licences. Generated Mesa register tables keep Mesa's MIT notice, and the QEMU tracer patch in tools/qemu-sptm-oracle/ is GPL-2.0-or-later. THIRD_PARTY_NOTICES.md and LICENSES/ list every third-party component and its licence text.

Snapintosh builds on the published work of others:

• Asahi Linux and m1n1. q1n1 is a fork of m1n1, and Snapintosh uses m1n1's proxy protocol, its Apple-silicon constants and its RTKit/mailbox knowledge.
• Mesa and freedreno, for the ir3 compiler that air2ir3 builds on, the Adreno register database and the a6xx/a8xx driver code used as reference.
• The Linux msm/drm, clk/qcom, ath12k, i2c-hid and GENI driver authors. Their drivers were read as hardware references. Snapintosh's drivers are written from the interface facts, and one generated table is derived from Linux's Adreno catalogue (see the notices).
• jprx, for qemu-sptm and darwin-vm, used to observe Apple's real SPTM/TXM as ground truth.
• XNU sources from Apple Open Source, for reading the kernel's side of each contract.

THIRD_PARTY_NOTICES.md has the complete list.