Apple T1 (iBridge1,1) EmbeddedOS restore support: offering a patch set #800

Hi Nikias,

Per the README's "create a ticket first" ask: I have a working patch set that adds Apple T1 (iBridge1,1) EmbeddedOS restore support to idevicerestore, and I would like to know whether you want it upstream and in what shape before I send a pull request. The two small companion changes are already up as PRs: libimobiledevice/libirecovery#167 (device table entry and a robust iSerialNumber read) and libimobiledevice/usbmuxd#284 (hotplug callback for any device class).

What the T1 is

The T1 is the coprocessor in the 2016 and 2017 Touch Bar MacBook Pros (MacBookPro13,2, 13,3, 14,2, 14,3). It drives the Touch Bar display, the FaceTime camera and the Touch ID sensor, and it runs its own Apple OS, "EmbeddedOS", rather than firmware baked into the host. It identifies as iBridge1,1 / x619ap, ApChipID 0x8002, ApBoardID 0x12; all four machines share that one identity. It hangs off the host's internal USB as 05ac:8600, and appears as 05ac:1281 (Recovery Mode) when it has nothing to boot.

What makes it interesting for this project: the T1 loads its OS from the Mac's EFI System Partition at every boot, from EFI/APPLE/EMBEDDEDOS. A Linux installer that recreates the ESP deletes that folder, and the machine comes back with a dark Touch Bar, no camera and no Touch ID, permanently as far as the usual advice goes ("reinstall macOS"). It turns out the chip can be restored from Linux instead, over Apple's ordinary EmbeddedOS restore protocol, the same protocol idevicerestore already speaks, using Apple's own signing and FDR services, with no macOS involved and no file taken from another Mac.

What already works upstream, and what does not

idevicerestore already has essentially all the machinery: recovery-mode transport, TSS personalisation, the restored client, FDR, ASR, the progress and component plumbing. The T1 needs comparatively little on top, and most of the gaps are "this is not an iPhone with a filesystem" rather than protocol work:

• Apple ships the T1 firmware as iBridge1_1Customer.bundle, not an IPSW, and the bundle has no SupportedProductTypes, which build_manifest_check_compatibility() rejects.
• An EmbeddedOS restore ships OSRamdisk and no OS component, so the OS filesystem lookup/extraction has nothing to find.
• StartRestore needs a different option set, and the restore needs an FDR memory-store round trip that upstream has no notion of.
• (libirecovery and usbmuxd gaps: see the two PRs above.)

What the patch adds

5 files, +782 / -7 against 540c352: new src/t1.c and src/t1.h, one line in src/Makefile.am, and hooks in src/idevicerestore.c and src/restore.c. Every hook is a no-op unless an IDEVICERESTORE_T1_* environment variable is set, so a run without them behaves exactly as it does today. What it adds:

• Firmware-bundle compatibility. In T1 mode, a BuildIdentity matches on the device's ApChipID/ApBoardID instead of SupportedProductTypes.
• No OS filesystem. The OS path lookup and extraction are skipped for an EmbeddedOS restore, which ships OSRamdisk instead.
• StartRestore options for EmbeddedOS: ApBootstrapOnly=0, PersonalizedDuringPreflight=1, FlashNOR=1, SystemImage / ShouldRestoreSystemImage / RootToInstall / UpdateBaseband all 0, plus optional CreateFilesystemPartitions, FDRMemoryStorePath and a RestoreBootArgs override, and a keys-only log of what was sent.
• FDR memory-store round trip. Advertises FDRMemoryCommit in SupportedDataTypes when FDR output is armed, writes the committed store to a 0600 file and acknowledges the commit (first pass); replays a saved store as FDRMemoryStoreData inside the RootTicket message (second pass); optional FDRTrustData key in the trust-data reply.
• Preflight capture. Saves the personalised combined memboot image (OSRamdisk || KernelCache || DeviceTree || SEP, bare concatenation) and the ApImg4Ticket from the same TSS response, both 0600.
• A replay mode that performs no restore at all: it sends a previously captured image + ticket to a T1 sitting in recovery (auto-boot=false, send ticket, upload image, setenv boot-args, blind memboot with bRequest=1).

Nothing identity-bearing is logged anywhere in the new code: sizes and key names only.

The branch, exactly the base commit plus the patch: https://github.com/niconistal/idevicerestore-t1 branch t1 (base 540c352c4c44896f7415abef87a166e8bbaea9b0, 1.0.0-273-g540c352; master has moved three commits since, I will rebase before any PR). The tool that drives it end to end, with docs on the protocol flow: https://github.com/niconistal/t1-revive.

Testing

Tested by me on one MacBookPro14,3 whose EFI/APPLE/EMBEDDEDOS had been erased by a Linux installer: full restore in about four minutes, then Touch Bar, camera and Touch ID working through the t1bridge Linux stack, persisting across reboots, repeated several times including from a fresh install. That is one machine; the other three T1 models are untested with this patch set.

Licence

Offered under the same terms as the files it modifies (LGPL-2.1-or-later per the source headers). No new licence, no CLA needed from my side.

How I would like to proceed

I am happy to split this into individual reviewable commits of a common domain rather than one diff: device/bundle compatibility, the EmbeddedOS StartRestore options, the FDR memory-store round trip, the preflight capture, and the replay mode, each on its own. Real name and a valid email address on every commit, and I will follow the existing code style.

Open questions I would rather settle before writing the PR:

1. Do you want T1/EmbeddedOS support in idevicerestore at all, or is a non-iOS Apple coprocessor out of scope for the project?
2. Is the opt-in environment-variable gating acceptable, or would you prefer explicit command-line options and a device-mode check instead? The env vars were the least invasive thing while developing; they are not what I would choose for upstream.
3. Should the replay mode live in idevicerestore at all, or is it better as a separate small tool?

Thanks for idevicerestore, libirecovery and usbmuxd. The T1 work would not have been possible without them.

Nicolás Nistal

🤖 Generated with Claude Code