@cb This has nothing to do with the RE approach or clean room. You can't reverse engineer documentation for PHY hardware by decompiling drivers. The drivers themselves are just a bunch of magic register pokes.

We actually already have way more info than usual from the Apple drivers because they have surprisingly verbose debug logs, down to register and field names. There's nothing else to be gained by using a decompiler.

The hard part isn't figuring out what macOS does, it's 1) figuring out what the hardware actually requires, and what invariants have to be maintained, and 2) making it all work in the Linux model.