Error NVMe interBad ram pointer 0x200

[ghost]

Hi, i tried to install the emulator on my Laptop with Arch Linux. Ive done now the turotial 2 times and watched other people do it but i still can't figure out what i did wrong.
Specs:

OS: Arch Linux x86_64
Host: LIFEBOOK E556 (10601736731)
Kernel: Linux 6.16.0-arch1-1
Shell: bash 5.3.3
Display (BOE0665): 1366x768 @ 60 Hz in 16" [Built-in]
DE: KDE Plasma 6.4.3
WM: KWin (Wayland)
 Terminal: kitty 0.42.2
CPU: Intel(R) Core(TM) i5-6200U (4) @ 2.80 GHz
GPU: Intel HD Graphics 520 @ 1.00 GHz [Integrated]
Memory: 7.66 GiB
Swap: 3.83 GiB

RTBuddy(AOP): start(0xffffffe19bae8000) - (Aug 12 2020@22:50:37)
RTBuddy(ANS2): Boot args override: wdt = -1
RTBuddy(AOP): Boot args override: wdt = -1
RTBuddy(AOP): Resuming...

RTBuddy(ANS2): Resuming...

RTBuddy(SIO): start(0xffffffe19bb08000) - (Aug 12 2020@22:50:37)
RTBuddy(SIO): Boot args override: wdt = -1
RTBuddy(SIO): Resuming...

Starting AppleSMC kext(0xffffffe19b7f86b0) - (Aug 12 2020@22:51:44)
AppleSMCEmbedded::setPowerState(): ENTER powerStateOrdinal=1, _activeKeyCommand=13 newState=1
AppleA7IOPNub: withRegistryEntry, 47: allocated nub 0xffffffe19baa5d60

AppleAuthCPRelay:_sendCommandGated CMD=0x1 _receivedStatus ERROR ( status = 0xe00002e9 )
AppleAuthCPRelay:_getCert failed to send command kAuthCommandIDGetCert
AppleAuthCPRelay:start _getCert() failed (status = 0xe00002e9)
Failed to enable notifications (0x84)!

ERROR: Unable to enable notification interface (kSMCKeyNotFound).

AppleSPU::_handleReadyReport, serviceName (aop-audio) 
LPM state clear
pci (build 22:19:24 Aug 12 2020), flags 0x20c3008
LPM: Log data is NOT valid. 0x0 0x0
AppleDialogSPMIPMU::start: Primary PMU detected
AppleARMRTC started!#####
AppleDialogSPMIPMURTC started!******
Failed to read info-leg_scrpadAppleDialogSPMIPMURTC tick read!&&&&&&&
AppleDialogSPMIPMURTC ending!%%%
AppleSmartIO (RTBuddy-based)::start (0xffffffe19bb3d800) - (Aug 12 2020@22:19:30)
AppleARMRTC registering service!@@@@@@
AppleSPUFirmwareService: found node AOP
AppleARMRTC service registered!$$$$$
AppleARMRTC publishing service!^^^^^^
[ PCI configuration begin ]
[AOPAudio](debug) + Controller::start() {this: 0xffffffe19b86d800} built Aug 12 2020 22:19:38
[AOPAudio](debug) AppleAOPAudioService::create() got service controller 'aop '
[AOPAudio](debug) AppleAOPAudioService::create() service has 3 devices
[AOPAudio](debug) +-Controller::initForPM() -> 0x0
[ PCI configuration end, bridges 3, devices 0 ]
[AOPAudio](debug) + IOReporter::addIOReporters(0xffffffe19bb2a8a0)
[AOPAudio](debug) - IOReporter::addIOReporters(0xffffffe19bb2a8a0) -> 0x0
[AOPAudio](debug) + Controller::_publishBelow(0xffffffe19b98c200)
[AOPAudio](debug) +-DeviceNode::initWithRegistryEntry(from 0xffffffe19b61cf00, provider 0xffffffe19b86d800), IOReturn: 0x0
[AOPAudio](debug)  Controller::_publishBelow() attach and start 0xffffffe19baa4be0 (audio-lp-mic-in), class is AppleAOPAudioDeviceNode
[AOPAudio](debug) +-DeviceNode::initWithRegistryEntry(from 0xffffffe19b61cfa0, provider 0xffffffe19b86d800), IOReturn: 0x0
[AOPAudio](debug)  Controller::_publishBelow() attach and start 0xffffffe19baa4c80 (audio-mca0), class is AppleAOPAudioDeviceNode
[AOPAudio](debug) +-DeviceNode::initWithRegistryEntry(from 0xffffffe19b61d040, provider 0xffffffe19b86d800), IOReturn: 0x0
virtual bool AppleSEPManager::start(IOService *): 
[AOPAudio](debug)  Controller::_publishBelow() attach and start 0xffffffe19baa6620 (audio-mca1), class is AppleAOPAudioDeviceNode
virtual IOService *AppleANS2NVMeController::probe(IOService *, SInt32 *)::194:Found (ANS2) provider, returning score 100000
[AOPAudio](debug) +-DeviceNode::initWithRegistryEntry(from 0xffffffe19b61ea80, provider 0xffffffe19b86d800), IOReturn: 0x0
[AOPAudio](debug)  Controller::_publishBelow() attach and start 0xffffffe19baa7700 (audio-codecmclkmgr), class is AppleAOPAudioDeviceNode
virtual bool AppleSEPManager::start(IOService *): SEP memory IS coherent
[AOPAudio](debug) +-DeviceNode::initWithRegistryEntry(from 0xffffffe19b61f020, provider 0xffffffe19b86d800), IOReturn: 0x0
void AppleEmbeddedNVMeController::GetRestoreEnvironment()::444:Restore Environment!
[AOPAudio](debug)  Controller::_publishBelow() attach and start 0xffffffe19baa6b20 (audio-speaker), class is AppleAOPAudioDeviceNode
[AOPAudio](debug) +-DeviceNode::initWithRegistryEntry(from 0xffffffe19b61ef80, provider 0xffffffe19b86d800), IOReturn: 0x0
[AOPAudio](debug)  Controller::_publishBelow() attach and start 0xffffffe19baa4d20 (audio-hw-pcm-audiomgr), class is AppleAOPAudioDeviceNode
virtual bool AppleSEPManager::start(IOService *): control endpoints created
virtual bool AppleANS2NVMeController::start(IOService *)::394:Found the ANS2Endpoint1
void AppleEmbeddedNVMeController::GetRestoreEnvironment()::444:Restore Environment!
bool AppleEmbeddedNVMeController::SetNamespacesStruct()::186:Obtained 7 namespaces from DT
[AOPAudio](debug) +-DeviceNode::initWithRegistryEntry(from 0xffffffe19b61cd20, provider 0xffffffe19b86d800), IOReturn: 0x0
virtual IOFilterInterruptEventSource *AppleANS2NVMeController::CreateDeviceInterrupt(IOInterruptEventSource::Action, IOFilterInterruptEventSource::Filter, IOService *)::2719:ANS2 NVMe interBad ram pointer 0x200

./ios2.sh: line 28:  3592 Aborted                    (core dumped) QEMUAppleSilicon/build/qemu-system-aarch64 -M t8030,trustcache=iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/Firmware/038-44135-124.dmg.trustcache,ticket=root_ticket.der,sep-fw=sep-firmware.n104.RELEASE.new.img4,sep-rom=AppleSEPROM-Cebu-B1,kaslr-off=true,usb-conn-type=ipv4,usb-conn-addr=127.0.0.1,usb-conn-port=8030 -kernel iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/kernelcache.research.iphone12b -dtb iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/Firmware/all_flash/DeviceTree.n104ap.im4p -append "tlto_us=-1 mtxspin=-1 agm-genuine=1 agm-authentic=1 agm-trusted=1 serial=3 launchd_unsecure_cache=1 wdt=-1 -vm_compressor_wk_sw" -smp 7 -m 4G -serial mon:stdio -drive file=sep_nvram,if=pflash,format=raw -drive file=sep_ssc,if=pflash,format=raw -drive file=root,format=raw,if=none,id=root -device nvme-ns,drive=root,bus=nvme-bus.0,nsid=1,nstype=1,logical_block_size=4096,physical_block_size=4096 -drive file=firmware,format=raw,if=none,id=firmware -device nvme-ns,drive=firmware,bus=nvme-bus.0,nsid=2,nstype=2,logical_block_size=4096,physical_block_size=4096 -drive file=syscfg,format=raw,if=none,id=syscfg -device nvme-ns,drive=syscfg,bus=nvme-bus.0,nsid=3,nstype=3,logical_block_size=4096,physical_block_size=4096 -drive file=ctrl_bits,format=raw,if=none,id=ctrl_bits -device nvme-ns,drive=ctrl_bits,bus=nvme-bus.0,nsid=4,nstype=4,logical_block_size=4096,physical_block_size=4096 -drive file=nvram,if=none,format=raw,id=nvram -device apple-nvram,drive=nvram,bus=nvme-bus.0,nsid=5,nstype=5,id=nvram,logical_block_size=4096,physical_block_size=4096 -drive file=effaceable,format=raw,if=none,id=effaceable -device nvme-ns,drive=effaceable,bus=nvme-bus.0,nsid=6,nstype=6,logical_block_size=4096,physical_block_size=4096 -drive file=panic_log,format=raw,if=none,id=panic_log -device nvme-ns,drive=panic_log,bus=nvme-bus.0,nsid=7,nstype=8,logical_block_size=4096,physical_block_size=4096 -initrd iPhone11_8_iPhone12_1_14.0_18A5351d_Restore/038-44135-124.dmg -display gtk,zoom-to-fit=on,show-cursor=on```

[chris-pcguy]

yeah I tried that as well, not even a window was opened. i think lldb was taking a while to load or something?

Just use gdb then. After you see it crashing, run the bt command.

[gallantcrusader]

AppleS8000AES::start: using DART Mapper: <ptr>
Identified Serial Port uart0 at 0x235200000(<ptr>)
AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>

AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>

RTBuddy(SIO): start(<ptr>) - (Aug 12 2020@22:50:37)
RTBuddy(SIO): Boot args override: wdt = -1
RTBuddy(SIO): Resuming...

AppleDisplayPMU::start: display-pmu _pmuIICNub: <ptr> built 22:19:31 Aug 12 2020
AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>

RTBuddy(SMC): start(<ptr>) - (Aug 12 2020@22:50:37)
RTBuddy(SMC): Boot args override: wdt = -1
virtual bool AppleSEPManager::start(IOService *): 
RTBuddy(SMC): Resuming...

virtual bool AppleSEPManager::start(IOService *): SEP memory IS coherent
AppleSmartIO (RTBuddy-based)::start (<ptr>) - (Aug 12 2020@22:19:30)
virtual bool AppleSEPManager::start(IOService *): control endpoints created
Starting AppleSMC kext(<ptr>) - (Aug 12 2020@22:51:44)
AppleSMCEmbedded::setPowerState(): ENTER powerStateOrdinal=1, _activeKeyCommand=0 newState=1
virtual bool AppleSEPManager::start(IOService *): PM init done
virtual bool AppleSEPManager::start(IOService *): registered
IOReturn AppleSEPManager::_setPowerState(unsigned long *): power state 0 -> 2
Bad ram pointer 0x200
(dart-sep) AppleT8020DART::_fatalException: DART(DART exception ERROR_STATUS 0x80000001 ERROR_ADDRESS 0x00000000

Thread 16 "qemu-system-aar" received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffe727fc6c0 (LWP 180337)]
0x00007ffff4a255df in abort () from /usr/lib/libc.so.6
(gdb) bt all
No symbol "all" in current context.
(gdb) bt
#0  0x00007ffff4a255df in abort () from /usr/lib/libc.so.6
#1  0x0000555555c96c10 in ?? ()
#2  0x0000000000000000 in ?? ()
(gdb) 

[chris-pcguy]

(gdb) bt
#0  0x00007ffff4a255df in abort () from /usr/lib/libc.so.6
#1  0x0000555555c96c10 in ?? ()
#2  0x0000000000000000 in ?? ()

And this time, please use the argument --extra-cflags="-O0" for the configure script.

[gallantcrusader]

Bad ram pointer 0x200
(dart-sep) AppleT8020DART:
Thread 16 "qemu-system-aar" received signal SIGABRT, Aborted.
[Switching to Thread 0x7ffe727fc6c0 (LWP 195465)]
0x00007ffff4a255df in abort () from /usr/lib/libc.so.6
(gdb) bt
#0  0x00007ffff4a255df in abort () from /usr/lib/libc.so.6
#1  0x0000555555e12246 in ?? ()
#2  0x00007ffe727fa1c0 in ?? ()
#3  0x0000000000000200 in ?? ()
#4  0x00007ffe727fa1a0 in ?? ()
#5  0xffffffffffffffff in ?? ()
#6  0x00007ffe727fa1c0 in ?? ()
#7  0x0000555555f1afa7 in ?? ()
#8  0x00000012727fa1a0 in ?? ()
#9  0x0000000000000000 in ?? ()
(gdb) 

[VisualEhrmanntraut]

yeah I tried that as well, not even a window was opened. i think lldb was taking a while to load or something?

did you type r to run the program

[Arbifoxx]

I'm running this project again after stepping away from it for a while, and I'm getting this error too. I've noticed that it appears at random moments. Sometimes the log goes something like this:

...
AppleDialogSPMIPMURTC started!******
Failed to read info-leg_scrpadAppleDialogSPMIPMURTC::handleStart: ro=0 nvram=0 helper=0 AppleDialogSPMIPMU _pmuNub: <ptr> 0x1102:0x9f04-0x9f15 built 22:52:53 Aug 12 2020
RTBuddy(AOP): start(<ptr>) - (Aug 12 2020@22:50:37)
AppleSmartIO (RTBuddy-based)::start (<ptr>) - (Aug 12 2020@22:19:30)
RTBuddy(AOP): Boot args override: wdt = -1
void AppleEmbeddedNVMeController::GetRestoreEnvironment()::444:Restore Environment!
AppleDialogSPMIPMURTC tick read!&&&&&&&
AppleDialogSPMIPMURTC ending!%%%
virtual bool AppleANS2NVMeController::start(IOService *)::394:Found the ANS2Endpoint1
virtual bool AppleANS2NVMeController::start(IOService *)::394:Found the ANS2Endpoint1
virtual bool AppleSEPManager::start(IOService *): SEP memory IS coherent
virtual bool AppleSEPManager::start(IOService *): control endpoints created
void AppleEmbeddedNVMeController::GetRestoreEnvironment()::444:Restore Environment!
AppleARMRTC registering service!@@@@@@
void AppleEmbeddedNVMeController::GetRestoreEnvironment()::444:Restore Environment!
bool AppleEmbeddedNVMeController::SetNamespacesStruct()::186:Obtained 7 namespaces from DT
bool AppleEmbeddedNVMeController::SetNamespacesStruct()::186:Obtained 7 namespaces from DT
RTBuddy(AOP): Resuming...

virtual bool AppleSEPManager::start(IOService *): PM init done
virtual bool AppleSEPManager::start(IOService *): registered
[ PCI configuration end, bridges 3, devices 0 ]
IOReturn AppleSEPManager::_setPowerState(unsigned long *): powerBad ram pointer 0x200 

...and sometimes it goes something like this.:

...
AppleDisplayPMU::start: display-pmu _pmuIICNub: <ptr> built 22:19:31 Aug 12 2020
AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>

AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>

AppleDialogSPMIPMU::start: spmi-pmu _pmuNub: <ptr> built 22:52:54 Aug 12 2020
RTBuddy(SIO): start(<ptr>) - (Aug 12 2020@22:50:37)
RTBuddy(SIO): Boot args override: wdt = -1
virtual bool AppleSEPManager::start(IOService *): 
RTBuddy(ANS2): start(<ptr>) - (Aug 12 2020@22:50:37)
RTBuddy(ANS2): Boot args override: wdt = -1
virtual bool AppleSEPManager::start(IOService *): SEP memory IS coherent
virtual bool AppleSEPManager::start(IOService *): control endpoints created
LPM state clear
RTBuddy(ANS2): Resuming...

AppleA7IOPNub: withRegistryEntry, 47: allocated nub <ptr>

virtual bool AppleSEPManager::start(IOService *): PM init done
virtual bool AppleSEPManager::start(IOService *): registered
IOReturn AppleSEPManager::_setPowerState(unsigned long *): power state 0 -> 2
Bad ram pointer 0x200

You get the idea. It never seems to make it past 10 seconds. I've tried to compile with clang and ninja, and I've tried -O0, -Og, and -g, but nothing seems to change the ultimate outcome. I'm on Tahoe, please let me know what additional information I can provide.

[Arbifoxx]

When I tried to run it again without lldb for no particular reason, I noticed that the in-built macOS problem reporter also gives a backtrace. It has some extra information, so here's that report as well.
report.txt

[VisualEhrmanntraut]

Looks similar to the crash I get sometimes, btw.

[Arbifoxx]

That’s interesting… could it somehow be related?

[Arbifoxx]

I don't know which commit fixed it, but it seems to be working now! I pulled the latest commit, recompiled, and I was able restore, get a bash terminal, and set up networking. Thanks a ton!

EDIT: And after a bit of set up, Cydia is installed! Now it's almost fully like a jailbroken iPhone! Cheers!

[VisualEhrmanntraut]

I don't think any commit fixed it, it's a race condition, :-P but glad you got it working