T1 Touch Bar on Linux without reinstalling macOS

This document describes the Linux-only method that successfully activated the firmware Touch Bar on a 2016 MacBook Pro with Apple's T1/iBridge coprocessor.

It covers two very different situations:

The T1 already boots as USB device 05ac:8600. Only the Linux driver is needed.
The T1 is stuck in recovery as 05ac:1281, or its EFI EmbeddedOS files are missing. The T1 must be personalized, provisioned, and booted before the driver can work.

Do not run the recovery workflow when the driver-only path is sufficient.

Status and scope

The complete procedure was verified on:

MacBookPro13,2
Apple T1, hardware model x619ap
Ubuntu 24.04.4
Linux 7.0.0-30-generic
Apple's EmbeddedOS 3.0, build 14Y901

The live result was:

T1 stayed in production iBridge mode as 05ac:8600.
USB configuration 1 exposed the webcam and two physical HID interfaces.
apple-ibridge-hid created two virtual Touch Bar HID devices.
apple_touchbar bound and registered a Linux input device.
The firmware display-on command completed without a kernel error.
The successful device-personalized image was installed on the EFI System Partition.

The other Touch Bar T1 models—MacBookPro13,3, MacBookPro14,2, and MacBookPro14,3—use the same general architecture, but this exact activation path has not yet been verified on every model. Do not assume an x619ap identity is correct if the recovery device reports a different hardware model.

The host was not rebooted during the successful test. The EFI files were prepared for persistent boot, but cold-boot persistence remains a separate verification step.

Important safety and privacy rules

Read these before making changes:

Never install another Mac's FDRData, AP ticket, SHSH data, or personalized combined.memboot.
FDRData and all personalized Image4 files are bound to one physical T1. Donor files are not substitutes and contain another machine's provisioning identity.
Never publish raw restore logs. They can contain serials, nonces, signing requests, and device identifiers.
Keep activation files in a root-owned directory with mode 0700; keep each file at mode 0600.
Never run the ACPI method SOCW(1) on these machines. It can hard-freeze the computer.
The only T1-only reset used successfully was FRST, described below.
Do not stage an image on EFI until that exact image has booted successfully as 05ac:8600.
Back up an existing /boot/efi/EFI/APPLE/EMBEDDEDOS directory before changing it.
Do not reboot automatically. Save work and obtain the machine owner's permission first.
The restore workflow flashes only T1/iBridge firmware; it must not be configured to restore the host's macOS or Linux filesystem.

Understand the architecture

The Intel CPU does not directly control the panel:

Touch Bar panel
    |
    v
Apple T1/iBridge -> Apple secure boot -> EmbeddedOS
    |
    v
USB 05ac:8600 -> apple_ibridge -> virtual HID -> apple_touchbar

The Linux driver is useful only after the T1 passes Apple secure boot and exposes 05ac:8600. A driver cannot repair a T1 that is still exposing recovery USB device 05ac:1281.

Choose the correct path

Check the model and the T1 USB state without querying private recovery fields:

cat /sys/class/dmi/id/product_name

lsusb | awk '
  $6 == "05ac:8600" { print "T1 state: production iBridge" }
  $6 == "05ac:1281" { print "T1 state: recovery" }
'

Then follow this decision table:

State	Correct action
`05ac:8600` is present	Install and verify the Linux driver. Stop there.
`05ac:1281` is present	Use the Linux-only activation workflow, then install the driver.
Neither is present, but valid EFI EmbeddedOS files exist	Diagnose power/enumeration first. Do not generate new identity data blindly.
Neither is present and EFI EmbeddedOS files are missing	Treat this as expert recovery. Preserve backups and verify the ACPI path before resetting the T1.

Part 1: install the Linux Touch Bar driver

The tested driver is the kernel-7-compatible T1 fork at:

https://github.com/AJ-dev-i60/t1-touchbar

Prefer cloning and reviewing the installer over piping a network response directly into a root shell:

git clone https://github.com/AJ-dev-i60/t1-touchbar.git
cd t1-touchbar
sudo ./install.sh --yes

The installer:

Builds apple-ib-drv/0.1 through DKMS.
Installs apple_ibridge and apple_touchbar.
Sets options apple_ibridge skip_acpi_power=1 before loading the module.
Forces iBridge USB configuration 1.
Disables USB autosuspend for the iBridge.
Enables module loading at boot.

Prevent usbmuxd from claiming the production iBridge

Ubuntu's packaged 39-usbmuxd.rules can include 05ac:8600. That rule may set configuration 0 and race the Touch Bar driver. Preserve phone/tablet support while removing only the iBridge match.

First inspect the packaged rule:

grep -n '8600' /lib/udev/rules.d/39-usbmuxd.rules

If it contains 5ac/8600/*, create a local override from the packaged rule with only that alternative removed:

sudo sed \
  -e 's/|5ac\/8600\/\*//g' \
  -e 's/5ac\/8600\/\*|//g' \
  /lib/udev/rules.d/39-usbmuxd.rules \
  | sudo tee /etc/udev/rules.d/39-usbmuxd.rules >/dev/null

sudo udevadm control --reload

Confirm that the local override has no 8600 match:

if grep -q '8600' /etc/udev/rules.d/39-usbmuxd.rules; then
  echo 'ERROR: the local usbmuxd override still matches the iBridge'
else
  echo 'OK: usbmuxd no longer claims 05ac:8600'
fi

Do not edit /lib/udev/rules.d directly; package upgrades replace that file.

Secure Boot

If Secure Boot is enabled, the DKMS module must be signed by an enrolled key. On Ubuntu, the installer explains the MOK enrollment step. Check with:

mokutil --sb-state
modinfo apple_ibridge | grep -E '^(filename|signer|vermagic):'

Load and verify the driver

If 05ac:8600 is already present:

sudo modprobe apple_ibridge skip_acpi_power=1
sudo modprobe apple_touchbar

Do not pass skip_acpi_power=0.

Verify the high-level state:

lsusb -d 05ac:8600
lsmod | awk '$1 == "apple_ibridge" || $1 == "apple_touchbar" { print }'
grep -iE 'iBridge Virtual HID|Touch Bar' /proc/bus/input/devices
dkms status | grep apple-ib-drv

The healthy HID topology contains:

Two physical 0003:05AC:8600.* HID devices owned by apple-ibridge-hid.
Virtual 0003:1D6B:0301.* devices owned by apple-touchbar.
A virtual 0003:1D6B:0302.* ambient-light-sensor device.

To keep the bar lit temporarily while testing, locate its runtime attribute and set idle_timeout to -1:

TB_IDLE=$(find /sys/bus/hid/devices -maxdepth 2 -name idle_timeout -print -quit)
if [ -n "$TB_IDLE" ]; then
  printf '%s\n' -1 | sudo tee "$TB_IDLE" >/dev/null
fi

The normal default is 300 seconds; keyboard, trackpad, or Touch Bar input wakes it again.

If this works, do not continue into Part 2.

Part 2: Linux-only T1 activation

This section is for a T1 stuck in recovery or a machine whose device-specific EmbeddedOS data is missing.

Implementation status

The successful activation used research patches that are not part of stock idevicerestore or stock usbmuxd. Stock binaries do not understand the environment variables used below.

Before following the commands, the activation build must provide all of these guarded capabilities:

Capability	Required behavior
T1 EmbeddedOS restore	Starts restored with no host system-image or partition restore.
FDR output	Handles and acknowledges `FDRMemoryCommit`, saving a binary plist atomically at mode `0600`.
FDR input	Adds the existing FDR dictionary to the RootTicket response as `FDRMemoryStoreData`.
Phase-11 options	Uses `ApBootstrapOnly=false`, `PersonalizedDuringPreflight=true`, and no `SystemImage`, `RootToInstall`, or phase-14 `BootImageTagOverride`.
Preflight capture	Before phase 11, saves the personalized OSRamdisk, KernelCache, DeviceTree, and SEP as one bare concatenation, plus the matching AP ticket from the same TSS response.
Phase 14	Sets and saves `auto-boot=false`, sends the saved AP ticket, uploads the saved image, sets `boot-args=rd=md0`, and issues blind `memboot` using USB `bRequest=1`.
Privacy	Does not print raw identifiers, tickets, nonces, or FDR contents.

The tested source bases were:

Project	Commit
libplist	`32428ab`
libimobiledevice-glue	`da770a7`
libtatsu	`60a39f3`
libirecovery	`95dec3a`
libusbmuxd	`93eb168`
libimobiledevice	`fa0f791`
usbmuxd	`3ded00c`
idevicerestore	`540c352`

The libirecovery device table needed an entry for the tested x619ap T1, with CPID 0x8002 and BDID 0x12. The private usbmuxd build changed the libusb hotplug callback's device-class filter to LIBUSB_HOTPLUG_MATCH_ANY, allowing it to see the T1 restored interface.

The tested idevicerestore patch exposes these opt-in controls:

IDEVICERESTORE_T1_EMBEDDEDOS
IDEVICERESTORE_T1_FDR_INPUT
IDEVICERESTORE_T1_FDR_OUTPUT
IDEVICERESTORE_RESTORE_BOOT_ARGS
IDEVICERESTORE_T1_PREFLIGHT_MEMBOOT_SAVE
IDEVICERESTORE_T1_PREFLIGHT_TICKET_SAVE
IDEVICERESTORE_T1_PHASE14
IDEVICERESTORE_MEMBOOT_FILE
IDEVICERESTORE_T1_APTICKET_FILE
IDEVICERESTORE_OSRAMDISK
IDEVICERESTORE_MEMBOOT_OS_IMAGE

Treat this as an expert reproducibility runbook until those activation patches are published and reviewed as a dedicated branch. Do not assume similarly named options in an unrelated binary have the same safety properties.

Why the preflight pair matters

The successful order is:

one TSS/preflight personalization
    |-- phase-11 restore components
    |-- saved phase-14 combined.memboot
    `-- saved matching AP ticket
                |
                v
       Restore Finished
                |
          wait at least 10 s
                |
             T1 FRST
                |
                v
phase 14 replays the same image + same ticket -> 05ac:8600

Requesting a new ticket after FRST produced correctly signed-looking images but consistently returned the T1 to recovery. The image and ticket must come from the preflight transaction used before the successful phase-11 restore.

Prepare private storage

Use durable storage, not /tmp, if a reboot may happen:

sudo install -d -o root -g root -m 700 /var/lib/t1-touchbar
sudo install -d -o root -g root -m 700 /var/lib/t1-touchbar/private

For the examples below:

T1_WORK="$HOME/t1-linux-work"
T1_PREFIX="$T1_WORK/prefix"
T1_PRIVATE=/var/lib/t1-touchbar/private
T1_LIBS="$T1_PREFIX/lib:$T1_PREFIX/lib64"
T1_BIN="$T1_WORK/idevicerestore/src/idevicerestore"
T1_MUX="$T1_WORK/usbmuxd/src/usbmuxd"

Do not put identifiers into filenames.

Back up existing EFI files

Confirm the actual EFI mount instead of assuming a partition number:

findmnt /boot/efi
sudo find /boot/efi/EFI/APPLE/EMBEDDEDOS -maxdepth 1 -type f \
  -printf '%f %s bytes\n' 2>/dev/null

If the directory exists, copy it into root-private storage before doing anything else:

sudo install -d -o root -g root -m 700 /var/lib/t1-touchbar/efi-backup
sudo cp -a /boot/efi/EFI/APPLE/EMBEDDEDOS/. \
  /var/lib/t1-touchbar/efi-backup/
sudo find /var/lib/t1-touchbar/efi-backup -type f -exec chmod 600 {} +

If an existing FDRData validates as a plist, preserve it and use it as the input for the replay pass:

sudo install -m 600 \
  /boot/efi/EFI/APPLE/EMBEDDEDOS/FDRData \
  /var/lib/t1-touchbar/private/FDRData

Never inspect or print its contents.

Obtain the generic Apple firmware

The verified Apple package was:

https://swcdn.apple.com/content/downloads/22/59/001-72525-A_7H83CSQW4K/p9dd3a0vdtdssud9qlxd4i73pn389rxugu/EmbeddedOSFirmware.pkg

Verified SHA-256:

0c97ab746ec635b34b1bdea4e4722cd0173443e2ba6ede54cc6af3b5e220d230

Download and verify it before extraction:

mkdir -p "$T1_WORK/download"
curl -fL \
  'https://swcdn.apple.com/content/downloads/22/59/001-72525-A_7H83CSQW4K/p9dd3a0vdtdssud9qlxd4i73pn389rxugu/EmbeddedOSFirmware.pkg' \
  -o "$T1_WORK/download/EmbeddedOSFirmware.pkg"

printf '%s  %s\n' \
  '0c97ab746ec635b34b1bdea4e4722cd0173443e2ba6ede54cc6af3b5e220d230' \
  "$T1_WORK/download/EmbeddedOSFirmware.pkg" \
  | sha256sum --check

The package is a XAR archive whose Payload is PBZX-compressed. Extract it with a trusted XAR/PBZX toolchain. One suitable parser is Niklas Rosenstein's pbzx; review and build it first, then run:

mkdir -p "$T1_WORK/firmware"
(
  cd "$T1_WORK/firmware"
  pbzx "$T1_WORK/download/EmbeddedOSFirmware.pkg" \
    | cpio -idm --no-absolute-filenames
)

After extraction, the tested paths are:

usr/standalone/firmware/iBridge1_1Customer.bundle/Contents/Resources
usr/standalone/firmware/iBridge1_1Customer.bundle/Contents/version.plist

Set:

T1_BUNDLE="$T1_WORK/firmware/usr/standalone/firmware/iBridge1_1Customer.bundle"
T1_FW="$T1_BUNDLE/Contents/Resources"

Confirm that BuildManifest.plist, Restore.plist, the two DMGs, and the x619 firmware files exist before proceeding.

Build the userspace stack

Build the libimobiledevice projects into a separate prefix so the experimental restore stack does not replace distro libraries.

On Ubuntu, begin with the normal source-build dependencies. Package names vary across distributions:

sudo apt-get update
sudo apt-get install -y \
  build-essential git autoconf automake libtool pkg-config curl cpio \
  libusb-1.0-0-dev libssl-dev libcurl4-openssl-dev libzip-dev \
  libreadline-dev libfuse3-dev libudev-dev libsystemd-dev \
  libjson-c-dev liblzma-dev

Then build in this order:

libplist
libimobiledevice-glue
libtatsu
libirecovery
libusbmuxd
libimobiledevice
usbmuxd
idevicerestore

For each Autotools project, export the private prefix first:

export PATH="$T1_PREFIX/bin:$PATH"
export PKG_CONFIG_PATH="$T1_PREFIX/lib/pkgconfig:$T1_PREFIX/lib64/pkgconfig"
export LD_LIBRARY_PATH="$T1_LIBS"

The tested configuration options were:

libplist:          ./autogen.sh --prefix="$T1_PREFIX" --without-cython
libimobiledevice:  ./autogen.sh --prefix="$T1_PREFIX" --without-cython --enable-debug-code
usbmuxd:           ./autogen.sh --prefix="$T1_PREFIX" --without-systemd
all others:        ./autogen.sh --prefix="$T1_PREFIX"

Then run make -j"$(nproc)" and make install in dependency order. Build the patched usbmuxd and idevicerestore last.

Confirm the activation binary really contains the guarded implementation:

strings "$T1_BIN" | grep -E \
  'T1 preflight-personalized|T1 phase-14|T1 FDR memory store'

Start a private usbmuxd only for restored/FDR

The system usbmuxd must not compete with the patched private instance:

sudo systemctl stop usbmuxd
sudo install -m 600 /dev/null "$T1_PRIVATE/usbmuxd.private.log"

sudo systemd-run --quiet --collect \
  --unit=t1-usbmuxd \
  --property=Type=simple \
  --property=StandardOutput=null \
  --property=StandardError=null \
  env LD_LIBRARY_PATH="$T1_LIBS" \
  "$T1_MUX" -f -v -U root \
  -l "$T1_PRIVATE/usbmuxd.private.log"

Confirm only that the unit and socket exist; do not dump its log:

systemctl is-active t1-usbmuxd.service
sudo test -S /run/usbmuxd && echo 'private usbmuxd socket ready'

Stop this transient service before phase 14:

sudo systemctl stop t1-usbmuxd.service

Enter or confirm T1 recovery

If 05ac:1281 is already present, do not reset it again.

If a T1-only reset is required, first confirm that the ACPI method exists on the target model. The path that worked on the tested MacBookPro13,2 was:

sudo modprobe acpi_call
printf '%s' '\_SB.PCI0.XHC1.RHUB.ASOC.FRST' \
  | sudo tee /proc/acpi/call >/dev/null
printf 'FRST result: '
sudo tr -cd '[:print:]' </proc/acpi/call
printf '\n'

Expected result: 0x0, followed by 05ac:1281.

Never substitute SOCW(1).

Pass A: obtain device-specific FDRData when none exists

Skip Pass A if a valid device-specific FDRData was preserved from this same Mac. Otherwise, with the T1 in 05ac:1281 recovery and the private usbmuxd active:

sudo install -m 600 /dev/null "$T1_PRIVATE/fdr-create.private.log"
sudo install -m 600 /dev/null "$T1_PRIVATE/fdr-create-runner.private.log"

set -o pipefail
sudo env \
  -u IDEVICERESTORE_T1_FDR_INPUT \
  -u IDEVICERESTORE_T1_PREFLIGHT_MEMBOOT_SAVE \
  -u IDEVICERESTORE_T1_PREFLIGHT_TICKET_SAVE \
  -u IDEVICERESTORE_T1_PHASE14 \
  -u IDEVICERESTORE_T1_APTICKET_FILE \
  -u IDEVICERESTORE_MEMBOOT_FILE \
  -u IDEVICERESTORE_MEMBOOT_EXACT \
  -u IDEVICERESTORE_MEMBOOT_SAVE \
  -u IDEVICERESTORE_MEMBOOT_2GMI \
  -u IDEVICERESTORE_OSRAMDISK \
  -u IDEVICERESTORE_OSRAMDISK_SEPARATE \
  LD_LIBRARY_PATH="$T1_LIBS" \
  IDEVICERESTORE_T1_EMBEDDEDOS=1 \
  IDEVICERESTORE_T1_FDR_OUTPUT="$T1_PRIVATE/FDRData" \
  IDEVICERESTORE_RESTORE_BOOT_ARGS='rd=md0 -restore IOUSBDeviceController-configuration=standardMuxOnly' \
  "$T1_BIN" -y --variant 'Customer Boot' \
  --logfile="$T1_PRIVATE/fdr-create.private.log" \
  "$T1_FW" \
  2>&1 | sudo tee "$T1_PRIVATE/fdr-create-runner.private.log" >/dev/null
T1_CREATE_RC=${PIPESTATUS[0]}
printf 'FDR creation restore exit: %s\n' "$T1_CREATE_RC"

Require all of the following before continuing:

The command exits zero.
The private runner log contains Status: Restore Finished and DONE.
FDRData is non-empty, mode 0600, and parses as a binary plist.
There are no unknown restore data requests.

Validate without printing the plist:

sudo test -s "$T1_PRIVATE/FDRData"
sudo env LD_LIBRARY_PATH="$T1_LIBS" \
  "$T1_PREFIX/bin/plistutil" \
  -i "$T1_PRIVATE/FDRData" -o /dev/null
sudo chmod 600 "$T1_PRIVATE/FDRData"

After Restore Finished, wait at least ten seconds, use FRST, and wait for 05ac:1281 before Pass B.

Pass B: replay FDRData and capture the matching phase-14 pair

This is the restore transaction whose personalization must be reused by phase 14:

sudo install -m 600 /dev/null "$T1_PRIVATE/phase11.private.log"
sudo install -m 600 /dev/null "$T1_PRIVATE/phase11-runner.private.log"

set -o pipefail
sudo env \
  -u IDEVICERESTORE_T1_PHASE14 \
  -u IDEVICERESTORE_T1_APTICKET_FILE \
  -u IDEVICERESTORE_MEMBOOT_FILE \
  -u IDEVICERESTORE_MEMBOOT_EXACT \
  -u IDEVICERESTORE_MEMBOOT_SAVE \
  -u IDEVICERESTORE_MEMBOOT_2GMI \
  -u IDEVICERESTORE_OSRAMDISK \
  -u IDEVICERESTORE_OSRAMDISK_SEPARATE \
  LD_LIBRARY_PATH="$T1_LIBS" \
  IDEVICERESTORE_T1_EMBEDDEDOS=1 \
  IDEVICERESTORE_T1_FDR_INPUT="$T1_PRIVATE/FDRData" \
  IDEVICERESTORE_T1_FDR_OUTPUT="$T1_PRIVATE/FDRData.replayed" \
  IDEVICERESTORE_RESTORE_BOOT_ARGS='rd=md0 -restore IOUSBDeviceController-configuration=standardMuxOnly' \
  IDEVICERESTORE_T1_PREFLIGHT_MEMBOOT_SAVE="$T1_PRIVATE/combined.preflight.memboot" \
  IDEVICERESTORE_T1_PREFLIGHT_TICKET_SAVE="$T1_PRIVATE/preflight.apticket" \
  "$T1_BIN" -y --variant 'Customer Boot' \
  --logfile="$T1_PRIVATE/phase11.private.log" \
  "$T1_FW" \
  2>&1 | sudo tee "$T1_PRIVATE/phase11-runner.private.log" >/dev/null
T1_PHASE11_RC=${PIPESTATUS[0]}
printf 'phase-11 restore exit: %s\n' "$T1_PHASE11_RC"

Require:

Exit code zero.
Status: Restore Finished and DONE.
A non-empty combined.preflight.memboot and preflight.apticket, both mode 0600.
FDRData.replayed parses as a plist.
The replayed FDR store is byte-identical to the input.

sudo cmp -s \
  "$T1_PRIVATE/FDRData" \
  "$T1_PRIVATE/FDRData.replayed" \
  && echo 'FDR replay matches'

sudo stat -c '%n %s bytes mode %a' \
  "$T1_PRIVATE/combined.preflight.memboot" \
  "$T1_PRIVATE/preflight.apticket"

For build 14Y901, the successful combined image was 30,667,180 bytes. Treat that as a useful diagnostic, not as permission to reuse somebody else's file.

Reset after phase 11

After Restore Finished:

Wait at least ten seconds.
Stop the private usbmuxd.
Use only FRST to return the T1 to recovery.
Wait until 05ac:1281 is visible.

sleep 10
sudo systemctl stop t1-usbmuxd.service

printf '%s' '\_SB.PCI0.XHC1.RHUB.ASOC.FRST' \
  | sudo tee /proc/acpi/call >/dev/null
sudo tr -cd '[:print:]' </proc/acpi/call
printf '\n'

for attempt in $(seq 1 80); do
  lsusb -d 05ac:1281 2>/dev/null | grep -q 05ac:1281 && break
  sleep 0.25
done

Phase 14: replay the exact preflight image and ticket

Do not request or substitute a new ticket for the payload sent to the device.

sudo install -m 600 /dev/null "$T1_PRIVATE/phase14.private.log"
sudo install -m 600 /dev/null "$T1_PRIVATE/phase14-runner.private.log"

set -o pipefail
sudo env \
  -u IDEVICERESTORE_T1_EMBEDDEDOS \
  -u IDEVICERESTORE_T1_FDR_INPUT \
  -u IDEVICERESTORE_T1_FDR_OUTPUT \
  -u IDEVICERESTORE_T1_PREFLIGHT_MEMBOOT_SAVE \
  -u IDEVICERESTORE_T1_PREFLIGHT_TICKET_SAVE \
  -u IDEVICERESTORE_MEMBOOT_EXACT \
  -u IDEVICERESTORE_MEMBOOT_SAVE \
  -u IDEVICERESTORE_MEMBOOT_2GMI \
  -u IDEVICERESTORE_OSRAMDISK_SEPARATE \
  -u IDEVICERESTORE_IBOOT_LOG \
  LD_LIBRARY_PATH="$T1_LIBS" \
  IDEVICERESTORE_OSRAMDISK=1 \
  IDEVICERESTORE_MEMBOOT_OS_IMAGE=1 \
  IDEVICERESTORE_T1_PHASE14=1 \
  IDEVICERESTORE_MEMBOOT_FILE="$T1_PRIVATE/combined.preflight.memboot" \
  IDEVICERESTORE_T1_APTICKET_FILE="$T1_PRIVATE/preflight.apticket" \
  IDEVICERESTORE_RESTORE_BOOT_ARGS='rd=md0' \
  "$T1_BIN" -y --variant 'Customer Boot' \
  --logfile="$T1_PRIVATE/phase14.private.log" \
  "$T1_FW" \
  2>&1 | sudo tee "$T1_PRIVATE/phase14-runner.private.log" >/dev/null
T1_PHASE14_RC=${PIPESTATUS[0]}
printf 'phase-14 dispatch exit: %s\n' "$T1_PHASE14_RC"

An exit code of zero proves only that the transaction was sent. Observe USB state for at least 30 seconds:

SEEN_8600=0
SEEN_1281=0
SEEN_NONE=0

for sample in $(seq 1 120); do
  if lsusb -d 05ac:8600 2>/dev/null | grep -q 05ac:8600; then
    SEEN_8600=$((SEEN_8600 + 1))
  elif lsusb -d 05ac:1281 2>/dev/null | grep -q 05ac:1281; then
    SEEN_1281=$((SEEN_1281 + 1))
  else
    SEEN_NONE=$((SEEN_NONE + 1))
  fi
  sleep 0.25
done

printf 'samples: iBridge=%s recovery=%s absent=%s\n' \
  "$SEEN_8600" "$SEEN_1281" "$SEEN_NONE"

Success means 05ac:8600 remains present and the device does not return to 05ac:1281. In the verified run, 119 of 120 samples were 05ac:8600; the one remaining sample was the expected re-enumeration gap.

Verify the live Touch Bar before touching EFI

Load the safe driver if it is not already loaded:

sudo modprobe apple_ibridge skip_acpi_power=1
sudo modprobe apple_touchbar

Check configuration 1 and driver ownership:

for dev in /sys/bus/usb/devices/*; do
  [ -r "$dev/idVendor" ] || continue
  [ "$(cat "$dev/idVendor")" = 05ac ] || continue
  [ "$(cat "$dev/idProduct")" = 8600 ] || continue
  printf 'iBridge USB node: %s, configuration %s\n' \
    "${dev##*/}" "$(cat "$dev/bConfigurationValue")"
done

for hid in /sys/bus/hid/devices/*05AC:8600* \
           /sys/bus/hid/devices/*1D6B:0301*; do
  [ -e "$hid" ] || continue
  driver=unbound
  [ -L "$hid/driver" ] \
    && driver=$(basename "$(readlink -f "$hid/driver")")
  printf '%s -> %s\n' "${hid##*/}" "$driver"
done

Expected owners:

0003:05AC:8600.* -> apple-ibridge-hid
0003:1D6B:0301.* -> apple-touchbar

Also verify physically:

The strip lights.
Esc and the special keys appear.
Holding Fn changes the key layout.
At least one Touch Bar press produces an input event.
The webcam remains available.

USB enumeration alone is not sufficient proof.

Install only the proven files on EFI

Proceed only after the exact captured image passed the live phase-14 test.

Set the destination:

T1_ESP=/boot/efi/EFI/APPLE/EMBEDDEDOS
sudo install -d "$T1_ESP"

Back up any current image one more time:

if sudo test -f "$T1_ESP/combined.memboot"; then
  sudo install -m 600 \
    "$T1_ESP/combined.memboot" \
    "$T1_PRIVATE/combined.memboot.before-install"
fi

Stage each file through a temporary name on the same filesystem, flush it, then rename it atomically:

sudo install -m 644 \
  "$T1_PRIVATE/combined.preflight.memboot" \
  "$T1_ESP/.combined.memboot.new"
sudo sync -f "$T1_ESP/.combined.memboot.new"
sudo mv -f \
  "$T1_ESP/.combined.memboot.new" \
  "$T1_ESP/combined.memboot"

sudo install -m 644 \
  "$T1_PRIVATE/FDRData" \
  "$T1_ESP/.FDRData.new"
sudo sync -f "$T1_ESP/.FDRData.new"
sudo mv -f "$T1_ESP/.FDRData.new" "$T1_ESP/FDRData"

sudo install -m 644 \
  "$T1_BUNDLE/Contents/version.plist" \
  "$T1_ESP/.version.plist.new"
sudo sync -f "$T1_ESP/.version.plist.new"
sudo mv -f "$T1_ESP/.version.plist.new" "$T1_ESP/version.plist"

sudo sync /boot/efi

Verify source equality without printing private data:

sudo cmp -s \
  "$T1_PRIVATE/combined.preflight.memboot" \
  "$T1_ESP/combined.memboot" \
  && echo 'combined.memboot verified'

sudo cmp -s "$T1_PRIVATE/FDRData" "$T1_ESP/FDRData" \
  && echo 'FDRData verified'

sudo cmp -s "$T1_BUNDLE/Contents/version.plist" "$T1_ESP/version.plist" \
  && echo 'version.plist verified'

On a VFAT EFI partition, displayed Unix mode bits are determined by mount options. The root-private source copies must still remain mode 0600.

Do not reboot just to finish the guide. The live Touch Bar is already working. A later authorized reboot is the cold-boot persistence test.

The exact successful protocol details

These distinctions prevent several tempting but incorrect implementations.

Phase 11 restore options

The restored session used:

ApBootstrapOnly = false
PersonalizedDuringPreflight = true
FlashNOR = true
ShouldRestoreSystemImage = false
CreateFilesystemPartitions = false
UpdateBaseband = false
RestoreBootArgs = rd=md0 -restore IOUSBDeviceController-configuration=standardMuxOnly

It did not carry phase-14-only keys such as BootImageTagOverride=OSRamdisk, and it did not send a host SystemImage or RootToInstall request.

The observed successful data requests were:

NORData
RootTicket
FDRTrustData
FDRMemoryCommit
FUDData
FDRMemoryCommit

`combined.memboot` format

For the Image4-capable x619ap, the file is a bare concatenation with no 2GMI wrapper, no alignment padding, and no rewritten size fields:

OSRamdisk  (osrd)
KernelCache (krnl)
DeviceTree (dtre)
SEP (sepi)

All four components are personalized IMG4 objects from the same TSS/preflight response.

Phase 14 versus later EFI memboot

These are distinct Apple operations:

Phase 14 is an ApBootstrapOnly recovery operation. It clears auto-boot, sends the matching AP ticket, supplies rd=md0, and uses blind memboot with USB bRequest=1.
Apple's later EFI memboot helper sends an already-staged file with a normal command using bRequest=0 and does not mutate boot arguments.

The successful Linux activation used the phase-14 transaction. Using the EFI helper's bRequest=0 semantics for phase 14 failed.

Known failed approaches

Do not repeat these as guesses:

Installing donor FDRData or donor personalized firmware.
Generating a fresh phase-14 ticket after the restore instead of replaying the preflight ticket.
Using the legacy 2GMI container on this Image4 T1.
Using RestoreRamDisk/RestoreKernelCache/RestoreDeviceTree as the permanent OS image.
Preloading or replacing iBEC during phase 14.
Sending phase-14 memboot as a normal bRequest=0 command.
Omitting auto-boot=false plus saveenv before the phase-14 ticket.
Starting phase 11 with ApBootstrapOnly=true.
Running the system usbmuxd and the private patched usbmuxd at the same time.
Calling SOCW(1).

Most incorrect images disconnected and returned to 05ac:1281 within about two seconds. A zero host-side dispatch exit code does not mean the T1 accepted the image.

Troubleshooting

`05ac:8600` is present but the bar is dark

Check, in order:

USB configuration is 1.
usbmuxd does not have a local 8600 rule.
apple_ibridge loaded with skip_acpi_power=1.
Physical HIDs bind to apple-ibridge-hid.
Virtual 1d6b:0301 HIDs bind to apple-touchbar.
Secure Boot did not reject the DKMS modules.

Do not unload and rebind drivers casually on an unpatched apple-ib-drv; older versions contained teardown bugs.

Phase 11 cannot enter restored

Confirm the T1 starts as 05ac:1281.
Confirm the firmware build identity matches the reported hardware model.
Confirm the private usbmuxd owns /run/usbmuxd and the system instance is stopped.
Confirm the recovery boot arguments contain both -restore and standardMuxOnly.
Keep raw logs private and inspect only whitelisted status lines.

FDR never completes

Internet access to Apple's signing and FDR services is required.
Confirm the patched libimobiledevice reverse-proxy support is in use.
Confirm FDRTrustData and FDRMemoryCommit are handled and acknowledged.
Do not reuse an FDR store from another Mac.

Phase 14 returns to recovery

Do not stage the failed image.
Confirm the AP ticket file and combined image were captured in the same Pass B preflight.
Confirm the Pass B restore finished successfully before FRST.
Confirm the required post-restore wait elapsed.
Confirm phase 14 uses rd=md0 and blind memboot/bRequest=1.
If the preflight pair may be stale or mixed, repeat Pass B; do not mix artifacts from different runs.

Recovery rollback

If EFI was changed and a future cold boot fails, restore the root-private backups to the same three EFI filenames atomically. Linux itself can still boot while the T1 is in recovery, but the Touch Bar and iBridge webcam will be unavailable until EmbeddedOS boots again.

For a driver-related boot issue, edit the GRUB entry temporarily and append:

modprobe.blacklist=apple_ibridge,apple_touchbar

Safe logging practices

Never print an entire irecovery -q, TSS response, restored log, usbmuxd log, or FDR plist in a public terminal or issue report.

Safe status reporting includes:

USB product ID: 1281 or 8600.
Firmware product/build version.
Component names and byte sizes.
Whether two private files compare equal.
Restore status and data-request names.
Driver names and HID IDs.

Unsafe data includes:

Serial numbers and unique chip identifiers.
AP/SEP nonces.
AP tickets and TSS responses.
Raw FDR dictionaries.
Unfiltered debug logs.

References

Apple EmbeddedOS firmware package: https://swcdn.apple.com/content/downloads/22/59/001-72525-A_7H83CSQW4K/p9dd3a0vdtdssud9qlxd4i73pn389rxugu/EmbeddedOSFirmware.pkg
Kernel-7 T1 Touch Bar driver: https://github.com/AJ-dev-i60/t1-touchbar
Original iBridge driver architecture: https://github.com/t2linux/apple-ib-drv
libimobiledevice: https://github.com/libimobiledevice/libimobiledevice
idevicerestore: https://github.com/libimobiledevice/idevicerestore
libirecovery: https://github.com/libimobiledevice/libirecovery
usbmuxd: https://github.com/libimobiledevice/usbmuxd
Background on offline Touch Bar activation: https://onemoreadmin.wordpress.com/2016/11/30/the-untouchables-pt-2-offline-touchbar-activation-with-a-purged-disk/

tigercosmos/touch_bar_linux.md