Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 919417" data-attributes="member: 83059">[CODE]&nbsp; &nbsp; | |&nbsp;&nbsp; +-o ans@77400000&nbsp; &lt;class AppleARMIODevice, id 0x10000018a, registered, matched, active, busy 0 (316 ms), retain 3114&gt;&nbsp; &nbsp; | |&nbsp;&nbsp; | | {&nbsp; &nbsp; &nbsp; &nbsp; | |&nbsp;&nbsp; | +-o AppleASCWrapV4&nbsp; &lt;class AppleASCWrapV4, id 0x10000029a, !registered, !matched, active, busy 0 (177 ms), retain 5&gt;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp;&nbsp; | {&nbsp; &nbsp; &nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp;&nbsp; +-o iop-ans-nub&nbsp; &lt;class AppleA7IOPNub, id 0x10000018b, registered, matched, active, busy 0 (177 ms), retain 9&gt;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp;&nbsp; | {&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp;&nbsp; |&nbsp;&nbsp; &quot;segment-names&quot; = &lt;&quot;__TEXT;__DATA&quot;&gt;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp;&nbsp; |&nbsp;&nbsp; &quot;IOPersonalityPublisher&quot; = &quot;com.apple.driver.RTBuddy&quot;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp;&nbsp; |&nbsp;&nbsp; &quot;role&quot; = &quot;ANS2&quot;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp;&nbsp; |&nbsp;&nbsp; &quot;CFBundleIdentifierKernel&quot; = &quot;com.apple.driver.RTBuddy&quot;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp;&nbsp; | }&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp;&nbsp; |&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp;&nbsp; +-o RTBuddyIOReportingEndpoint&nbsp; &lt;class RTBuddyIOReportingEndpoint, id 0x1000003c9, registered, matched, active, busy 0 (5 ms), retain 6&gt;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp;&nbsp; |&nbsp;&nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp;&nbsp; +-o RTBuddyService&nbsp; &lt;class RTBuddyService, id 0x1000003cf, registered, matched, active, busy 0 (147 ms), retain 7&gt;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; | {&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; |&nbsp;&nbsp; &quot;IOProbeScore&quot; = 0&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; |&nbsp;&nbsp; &quot;CFBundleIdentifier&quot; = &quot;com.apple.driver.RTBuddy&quot;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; |&nbsp;&nbsp; &quot;IOMatchCategory&quot; = &quot;RTBuddyService&quot;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; |&nbsp;&nbsp; &quot;IOClass&quot; = &quot;RTBuddyService&quot;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; |&nbsp;&nbsp; &quot;IOPersonalityPublisher&quot; = &quot;com.apple.driver.RTBuddy&quot;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; |&nbsp;&nbsp; &quot;IOProviderClass&quot; = &quot;RTBuddy&quot;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; |&nbsp;&nbsp; &quot;CFBundleIdentifierKernel&quot; = &quot;com.apple.driver.RTBuddy&quot;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; |&nbsp;&nbsp; &quot;role&quot; = &quot;ANS2&quot;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; | }&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; |&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; +-o AppleANS3NVMeController&nbsp; &lt;class AppleANS3NVMeController, id 0x1000003d7, registered, matched, active, busy 0 (60 ms), retain 20&gt;&nbsp; &nbsp; | |&nbsp;&nbsp; |&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; | {[/CODE]Here&#039;s where the storage device sits on a jailbroken Mac&#039;s T2 chip. It exposes an emulated NVMe controller using a different driver stack, and is not connected to PCIE at all. The &quot;RTBuddy&quot; system is Apple&#039;s coprocessor subsystem, <a href="https://gist.github.com/woachk/943828f37c14563a607a26116435bf27" target="_blank">Apple in 2018: what&#039;s new</a> , and the memory addresses for those CPU cores are inside the T2 chip.This isn&#039;t something off the shelf and doesn&#039;t even appear to be NVMe. And the evidence is even more clear when it crashes:[CODE]panic(cpu 0 caller 0xfffffff00ac4bee4): ANS2 Recoverable Panic - assert failed: [7442],src/drivers/apple/ans2/cmd_accelerator/cmd_accelerator.c:345:cmd fetch error for host 1 I/O SQ, rresp code 2, status_reg: 0x2100 - aspcore timer tick(17)assert failed: [7442],src/drivers/apple/ans2/cmd_accelerator/cmd_accelerator.c:345:cmd fetch error for host 1 I/O SQ, rresp code 2, status_reg: 0x2100RTKit: RTKit_iOS-1264.100.25.release - Client: t8012.release-AppleStorageProcessorANS2-717.120.1~65~717.120.1~65[/CODE]Those are Apple source file names. The build versions are Apple project names and version formats we see stamped on various other Apple projects, and the version numbers are very related to what is seen on reverse engineered iOS all the time.Before T2, Apple used a lot of off-the-shelf rebranded SSDs, but after T2, they are running the iOS style SSD controller on the T2 chip and the NAND modules outside of T2 look a lot like just bare NAND chips without a controller. A controller has a CPU and substantial RAM, and that&#039;s internal to T2 now and running Apple firmware.P.S. More bewildering, on T2 machines that support SATA HDDs, the HDDs are also plugged into the T2 bridge chip, and they also get tunneled up to the Intel side as &quot;NVMe&quot; hard drives by the same AppleANSNVMeController <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite116" alt=":D" title="Big grin&nbsp; &nbsp; :D" loading="lazy" data-shortname=":D" />. Never thought I&#039;d see a NVMe rotating drive!</blockquote>

[QUOTE="MacDefender, post: 919417, member: 83059"] [CODE] | | +-o ans@77400000 <class AppleARMIODevice, id 0x10000018a, registered, matched, active, busy 0 (316 ms), retain 3114> | | | | { | | | +-o AppleASCWrapV4 <class AppleASCWrapV4, id 0x10000029a, !registered, !matched, active, busy 0 (177 ms), retain 5> | | | | { | | | +-o iop-ans-nub <class AppleA7IOPNub, id 0x10000018b, registered, matched, active, busy 0 (177 ms), retain 9> | | | | { | | | | "segment-names" = <"__TEXT;__DATA"> | | | | "IOPersonalityPublisher" = "com.apple.driver.RTBuddy" | | | | "role" = "ANS2" | | | | "CFBundleIdentifierKernel" = "com.apple.driver.RTBuddy" | | | | } | | | | | | | +-o RTBuddyIOReportingEndpoint <class RTBuddyIOReportingEndpoint, id 0x1000003c9, registered, matched, active, busy 0 (5 ms), retain 6> | | | | { | | | +-o RTBuddyService <class RTBuddyService, id 0x1000003cf, registered, matched, active, busy 0 (147 ms), retain 7> | | | | { | | | | "IOProbeScore" = 0 | | | | "CFBundleIdentifier" = "com.apple.driver.RTBuddy" | | | | "IOMatchCategory" = "RTBuddyService" | | | | "IOClass" = "RTBuddyService" | | | | "IOPersonalityPublisher" = "com.apple.driver.RTBuddy" | | | | "IOProviderClass" = "RTBuddy" | | | | "CFBundleIdentifierKernel" = "com.apple.driver.RTBuddy" | | | | "role" = "ANS2" | | | | } | | | | | | | +-o AppleANS3NVMeController <class AppleANS3NVMeController, id 0x1000003d7, registered, matched, active, busy 0 (60 ms), retain 20> | | | | { [/CODE] Here's where the storage device sits on a jailbroken Mac's T2 chip. It exposes an emulated NVMe controller using a different driver stack, and is not connected to PCIE at all. The "RTBuddy" system is Apple's coprocessor subsystem, [URL='https://gist.github.com/woachk/943828f37c14563a607a26116435bf27']Apple in 2018: what's new[/URL] , and the memory addresses for those CPU cores are inside the T2 chip. This isn't something off the shelf and doesn't even appear to be NVMe. And the evidence is even more clear when it crashes: [CODE]panic(cpu 0 caller 0xfffffff00ac4bee4): ANS2 Recoverable Panic - assert failed: [7442],src/drivers/apple/ans2/cmd_accelerator/cmd_accelerator.c:345:cmd fetch error for host 1 I/O SQ, rresp code 2, status_reg: 0x2100 - aspcore timer tick(17) assert failed: [7442],src/drivers/apple/ans2/cmd_accelerator/cmd_accelerator.c:345:cmd fetch error for host 1 I/O SQ, rresp code 2, status_reg: 0x2100 RTKit: RTKit_iOS-1264.100.25.release - Client: t8012.release-AppleStorageProcessorANS2-717.120.1~65~717.120.1~65[/CODE] Those are Apple source file names. The build versions are Apple project names and version formats we see stamped on various other Apple projects, and the version numbers are very related to what is seen on reverse engineered iOS all the time. Before T2, Apple used a lot of off-the-shelf rebranded SSDs, but after T2, they are running the iOS style SSD controller on the T2 chip and the NAND modules outside of T2 look a lot like just bare NAND chips without a controller. A controller has a CPU and substantial RAM, and that's internal to T2 now and running Apple firmware. P.S. More bewildering, on T2 machines that support SATA HDDs, the HDDs are also plugged into the T2 bridge chip, and they also get tunneled up to the Intel side as "NVMe" hard drives by the same AppleANSNVMeController :D. Never thought I'd see a NVMe rotating drive! [/QUOTE]

Verification