Apple Generic iDevice (apple-idevice)

Features
Flashing Whether it is possible to flash the device with pmbootstrap flasher.	Partial
USB Networking After connecting the device with USB to your PC, you can connect to it via telnet (initramfs) or SSH (booted system).	Works
Internal storage eMMC, SD cards, UFS...	Partial
Battery Whether charging and battery level reporting work.	Partial
Screen Whether the display works; ideally with sleep mode and brightness control.	Partial
Touchscreen	Broken
Multimedia
3D Acceleration	Broken
Audio Audio playback, microphone, headset and buttons.	Broken
Camera	Broken
Camera Flash	Broken
Connectivity
WiFi	Broken
Bluetooth	Broken
NFC Near Field Communication	Broken
Miscellaneous
FDE Full disk encryption and unlocking with unl0kr.	Broken
USB OTG USB On-The-Go or USB-C Role switching.	Broken
Sensors
Accelerometer Handles automatic screen rotation in many interfaces.	Broken
Magnetometer Sensor to measure the Earth's magnetism	Broken
Ambient Light Measures the light level; used for automatic screen dimming in many interfaces.	Broken
Proximity	Broken
Hall Effect Measures magnetic fields; usually used as a flip cover sensor	Broken
Haptics	Broken
Barometer Sensor to measure air pressure	Broken
Power Sensor Sensor to monitor current, voltage and power. Not fuel gauge!	Broken

Apple Generic iDevice
Manufacturer	Apple
Name	Generic iDevice
Codename	apple-idevice
Type	generic
Hardware
Architecture	aarch64
postmarketOS
Category	testing
Pre-built images Whether pre-built images are available from the postmarketOS Installation page.	no
Mainline Instead of a Linux kernel fork, it is possible to run (Close to) Mainline.	yes
Device package	device-apple-idevice
Kernel package	linux-postmarketos-apple-4k, linux-postmarketos-apple-16k
Initial MR Initial merge request.	pmaports!6733

Apple Generic iDevice is a generic port for most ARM64 Apple devices that are vulnerable to the checkm8 bootROM exploit.

Most devices with SoCs ranging from the Apple A7 to Apple A11 as well as ones with Apple T2 SoC should be supported, with the sole exception of the 1st generation HomePod (with Apple A8 SoC) due to being a different form factor from other devices and lack of testing.

Contributors

Supported devices

Devices that have been tested. Many other devices will most likely boot, but are untested.

Users running a Generic iDevice

Booting

This section describes the boot process from DFU mode as it is relatively uniform across devices.

You can't currently flash via pmbootstrap, but the kernel can be booted via PongoOS.

As with other devices, start by running pmbootstrap init.

Kernel

There are two kernels. One for 4k page size devices, and one for 16k devices.

SoC	Page 4K	Page 16K
Apple A7	Y	N
Apple A8	Y	N
Apple A8X	Y	N
Apple A9	N	Y
Apple A9X	N	Y
Apple A10 Fusion	N	Y
Apple A10X	N	Y
Apple A11	N	Y
Apple T2	N	Y

Prerequisites

WARNING: Compilation of these tools on Alpine is currently broken. You can get some pre-compiled binaries here.

Computer with an Intel CPU (recommended) or AMD CPU (may require using a USB adapter, instructions on how are a todo)
palera1n
PongoOS
pongoterm (You need to compile it yourself, following the steps here)
m1n1-idevice
linux-apple dtbs
- Extracted pre-compiled from the linux-postmarketos-apple package.

Extracting Precompiled dtbs

Instead of compiling your own dtbs, it can be much easier to extract them precompiled from the postmarketos apple kernel

Downloading the compiled kernel

The precompiled packages for aarch64 are stored here: https://mirror.postmarketos.org/postmarketos/v26.06/aarch64/
- Look for linux-postmarketos-apple and download the apk with the same page size as your device

Extracting the dtbs

You may see the following: tar: Ignoring unknown extended header keyword 'APK-TOOLS.checksum.SHA1'
It's ok to ignore
$ tar xf path/to/downloaded.apk

All of the dtbs should be now located in ./boot/dtbs/apple/.

Booting

$ pmbootstrap init
Select 'apple' for vendor, 'idevice' for codename, and the
valid kernel page size for the device's SoC.

Build the installation
$ pmbootstrap install

Optionally enable netboot (highly recommended)
$ pmbootstrap initfs hook_add netboot

Get the linux and initramfs
$ pmbootstrap export

Prep the m1n1 bootloader
$ cat path/to/m1n1.bin \
    path/to/boot/dtbs/apple/*.dtb \
    /tmp/postmarketOS-export/vmlinuz  \
    /tmp/postmarketOS-export/initramfs \
    > m1n1-linux.bin

Use palera1n to boot PongoOS
# PALERA1N_BYPASS_PASSCODE_CHECK=1 palera1n -p -f -k path/to/Pongo.bin

Boot postmarketOS!
# printf '/send path/to/m1n1-linux.bin\nbootm\n' | path/to/pongoterm

After displaying the Asahi Linux logo, your device should begin booting postmarketOS ;)

Netboot

Follow the guide from Netboot page.

m1n1 boot object

After running the usual pmbootstrap install, you can create a boot object that consist of the kernel, m1n1, initramfs, and kernel command line:

$ export ROOTFS="${HOME}/.local/var/pmbootstrap/chroot_rootfs_apple-idevice"
$ export CMDLINE="INSERT YOUR FAVOURITE KENREL COMMAND LINE HERE"

$ cat "${ROOTFS}/usr/share/m1n1/m1n1-idevice.macho" <(INITFS="${ROOTFS}/boot/initramfs"; initramfs_size="$(stat --printf='%s' "$INITFS")"; python3 -c "import os, sys; magic=b'm1n1_initramfs';size = int(${initramfs_size}).to_bytes(4, byteorder='little');os.write(sys.stdout.fileno(), magic + size)"; cat "$INITFS") "${ROOTFS}/boot/vmlinuz" <(cat "${ROOTFS}/boot/dtbs/apple/"{s*,t700*,t80*}.dtb) <(echo chosen.bootargs="${CMDLINE}") > m1n1-linux.macho

remote_boot

A booting method consist of open source software, and, for certain bootloader and firmware stages running on the device, Apple's binaries, which could be downloaded on demand, has been constructed. It has yet been added to pmbootstrap. But for now, the reference implementation remote_boot can be used.

All commands requiring a device start in DFU mode. Refer to "How to Enter Flash mode" from your device-specific page. Some devices don't have a page though, so this external DFU Mode guide may also be used.

Dependencies

You need:

clang
GNU Make
lsusb (from util-linux)
xxd (from vim)
ipsw
irecovery

Start by getting remote_boot:

$ git clone --recursive git@github.com:HoolockLinux/remote_boot

Compile the vendored dependencies:

$ ./remoteboot.sh build

Firmware

There are some firmware that linux may be able to use. Some functionalities may require these firmwares to be added to the initramfs and rootfs.

To download firmware in /lib/firmware layout:

$ ./remoteboot.sh firmware

Device-specific files

Prepare device-specific files (requires root for USB operations):

$ ./remoteboot.sh prep

Boot

Get the prepared m1n1-linux.macho boot object. A mock monitor is also required. (ROOTFS definition from previous section)

Boot (requires root for USB operations):

$ ./remoteboot.sh boot m1n1-linux.macho "${ROOTFS}/usr/share/m1n1/idevice-monitor-stub.macho"

Caveats:

It is possible that after sending iBSS and/or iBEC, the new USB device won't get detected until a manual cable replug.
A7 devices on Linux will require replugging the cable during exploitation (you will be prompted to do so)

After booting

If you see a TTY and a login screen, that means pmOS is working! Now you can go through the usual setup procedures (Using ssh, getting internet, etc.).

Since the checkm8 exploit is tethered, postmarketOS would also be tethered. Repeat the boot section every time the device is restarted.

Following these steps exactly would yield "Boot partition not found" in the initramfs, as postmarketOS was never flashed onto the device. Currently, devices based on Apple A11 has internal storage support, while others do not and would have to use netboot.