Possible firmware issues for Apple Silicon OpenBSD/ARM64 users | Hacker News Reader

Possible firmware issues for Apple Silicon OpenBSD/ARM64 users

undeadly.org

As the email message says, this is due to a bug in the Asahi M1N1 hypervisor/bootloader (from the Asahi Linux project) which OpenBSD piggybacks on.

https://social.treehouse.systems/@AsahiLinux/112454079096607...

Comments by Asahi Linux on Apple firmware dependency:

  Asahi Linux already depends on a stable firmware interface provided by a fixed version of macOS, so macOS updates generally do not affect it. However, macOS updates can update system-wide firmware in ways that are backwards-compatible. In this case, one such update triggered a bug in our code.

  This is no different from updating firmware on any other machine. It is always possible that a benign, backwards-compatible firmware update will trigger a latent bug by chance. This has only happened twice so far, since the project started, and both times we quickly fixed it.

  Apple's platform/system design requires that they maintain backwards compatibility, in order to be able to run older versions of macOS. Therefore, they cannot break Asahi Linux with updates on purpose, only due to bugs.

 ... If you don't want to trust Apple software and their updates and just want to use Linux, then nobody forces you to. macOS is only used for installation and certain update/recovery scenarios, it's not part of the Linux boot process in any way and It's not going to magically update itself.

An OpenBSD developer has since very early on contributed to m1n1 and the u-boot port, which is also shared by Linux.

https://asahilinux.org/about/#who-is-working-on-asahi-linux

Booting OpenBSD on a Apple silicon Mac requires:

• macOS + m1n1 stage 1 (from the Asahi Linux project)

• m1n1 stage 2 + u-boot (from OpenBSD)

• OpenBSD's EFI bootloader (BOOTAA64.EFI).

A recent macOS update exposed a bug in m1n1 which has been fixed and pushed out by both the Asahi Linux team, and now also OpenBSD.

Is this the result of Apple trying to make installing non-MacOS OSes on the M-series harder, or Apple only caring about the "happy path" of MacOS installing and booting on M-series chips and not caring about whether anyone else can?

The linked announcement pretty clearly implicates a bug in m1n1, the Asahi bootloader, which appears to have been fixed. It’s beyond a stretch to attribute malice here. Nothing indicates the platform is being locked down. Users simply need to update the bootloader before updating the MacOS firmware.

It is result of Apple developers having zero care about Linux support. They could run Linux with updated firmware and report issues to Asahi developers, so they could be fixed before public firmware release.

Of course Apple never promised to support Linux in any way, but it would be nice of them to dedicate a tiny bit of testing for this scenario. I'm pretty sure that good Linux support would result in few more thousands of Macs purchases and lot of developer goodwill.

Apple has really been low key supportive of Asahi.. I suspect a number of Appleites run it

> low key

Not a lingo I expected to see on HN

Wild speculation: Probably the latter; why would Apple go to all this trouble to allow booting non-Darwin OSs and then deliberately break it?

What trouble exactly?

It seems just a minor update your software issue. Obviously Apple could not test software outside theirs. And if there is a beta that can trigger the issue it is up to the software developer to fix it.

We can all have conspiracy theory. And some might even be true. But really has to look and check. If it can be fixed, it is an inconvenience of having frequent update and Apple did break software as its philosophy is very different from Microsoft (which is more IBM way in a sense).

> Obviously Apple could not test software outside theirs.

I mean, they certainly can do that.

Both of them.

I thought OpenBSD people were more security conscious than this madness:

$ curl https://randomwebsite | sh

but alas I was wrong. There is a certain security reality distortion field that accompanies running OpenBSD.

The script is running on macOS and is what the Asahi project recommends when updating or installing m1n1/Linux:

https://asahilinux.org/

It's called out in the OpenBSD/arm64 installation notes, at least:

https://cdn.openbsd.org/pub/OpenBSD/snapshots/arm64/INSTALL....

Search for "Install on Apple Silicon".

That seems to be the installer for Asahi Linux: https://asahilinux.org/

Whatever it is, why do people scream about buffer overflows and insecure passwords and overcomplicate everything in the name of security...

... and after that they run externally sourced scripts without even making a local copy ... let alone give them a cursory look ...

I think this is right. We routinely check the integrity of the packages and installers that we download using cryptographic hashing. OpenBSD even has a dedicated tool for this purpose.[1] It would make sense to take the same approach with curled shell scripts.

[1] http://www.openbsd.cl/papers/bsdcan-signify.html

Reply on news.ycombinator.com