[profile] validated ios-27.1-t8160-duo (16 SHA256 pins, 23 byte checks, 0 optional sites)
  ____ _               ____
 / ___| |   __  __    |  _ \ _   _ _ __  _ __   ___ _ __
| |  _| |   \ \/ /____| |_) | | | | '_ \| '_ \ / _ \ '__|
| |_| | |___ >  <_____|  _ <| |_| | | | | | | |  __/ |
 \____|_____/_/\_\    |_| \_\\__,_|_| |_|_| |_|\___|_|
    the guarded-world hypervisor harness · Antid0te
[cpu] 4/6 target CPUs selected; boot MPIDR=0x80000000
[txm-only] patched DT memory-map ranges (TrustCache/TXM/DeviceTree)
plugin: execution order:
[txm-only] profile ios-27.1-t8160-duo -> frame-type shift 3, context layout 217
[txm-only] TXM image: va=0xfffffff017004000 pa=0x4d68000 size=0xa444000 entry_va=0xfffffff017084000
[txm-only] harness allocator starts at gpa 0xf2ac000
[txm-only] frame table: gpa=0xf2ac000 size=0x204000 (2097154 entries)
[txm-only]   seg va=0xfffffff017004000 pa=0x4d68000 size=0x1c000 prot=0x60000000000080 → rwx (idx C)
[txm-only]   seg va=0xfffffff017020000 pa=0x4d84000 size=0x10000 prot=0x60000000000000 → rwx (idx C)
[txm-only]   seg va=0xfffffff017030000 pa=0x4d94000 size=0x50000 prot=0x40000000000080 → rwx (idx C)
[txm-only]   seg va=0xfffffff017080000 pa=0x4de4000 size=0x8000 prot=0x40000000000080 → rwx (idx C)
[txm-only]   seg va=0xfffffff017088000 pa=0xf1a4000 size=0x4000 prot=0x60000000000000 → rwx (idx C)
[txm-only]   seg va=0xfffffff01708c000 pa=0xf1a8000 size=0x4000 prot=0x60000000000080 → rwx (idx C)
[txm-only]   seg va=0xffffff8000000000 pa=0x92cc000 size=0x18000 prot=0x40000000000080 → rwx (idx C)
[txm-only]   seg va=0xffffff8000018000 pa=0x92e4000 size=0x1b20000 prot=0x60000000000080 → rwx (idx C)
[txm-only]   seg va=0xffffff8001b38000 pa=0xf7e0000 size=0x484000 prot=0x60000000000000 → rwx (idx C)
[txm-only] mapped 9 TXM high-VA segments into TTBR1
[txm-only] identity-mapped guest RAM [0x3000000,0x41800000) into TTBR0
[txm-only] mapped PAPT aperture [0x10003000000,0x10041800000) -> PA [0x3000000,0x41800000)
[txm-only] VBAR = 0x1006c000 (BRK-filled vector page)
[txm-only] entering TXM: PC=0xfffffff017084000 X0(args)=0xff38000 SP=0xff34000 ttbr0=0xff4c000 ttbr1=0xff50000
[SPTM] TXM Bootstrap
[SPTM] SPTM Retype (0xf4b0000, 0x0, TXM_LOG)
[SPTM] SPTM Retype (0xf4b4000, 0x0, TXM_LOG)
TXM LOG: setup logging: 32768 bytes (256 | 128)
TXM LOG: system supports DIT feature
TXM LOG: unable to find esdm-fuses property in /chosen
TXM LOG: unable to find vmm-present property in /defaults
TXM LOG: resolved system platform identity: 1
TXM LOG: Code Signing Monitor Image4 Module Version 7.0.0: Sat Aug 15 16:52:24 PDT 2026; root:AppleImage4_txm-374~7220/libimage4_TXM/RELEASE_ARM64E
TXM LOG: libimage4: magazine[pdmg]: failed to read nonce slot data: 2
TXM LOG: libimage4: magazine[cptx]: failed to read nonce slot data: 2
TXM LOG: libimage4: magazine[dvdi]: failed to read nonce slot data: 2
TXM LOG: libimage4: magazine[c1bt]: failed to read nonce slot data: 2
TXM LOG: libimage4: magazine[c1ab]: failed to read nonce slot data: 2
TXM LOG: libimage4: magazine[c1gn]: failed to read nonce slot data: 2
TXM LOG: libimage4: magazine[c1sm]: failed to read nonce slot data: 2
TXM LOG: libimage4: magazine[d1ma]: failed to read nonce slot data: 2
TXM LOG: libimage4: magazine[c1ge]: failed to read nonce slot data: 2
TXM LOG: libimage4: magazine[c1er]: failed to read nonce slot data: 2
TXM LOG: libimage4: magazine[c1ai]: failed to read nonce slot data: 2
TXM LOG: libimage4: magazine[c1al]: failed to read nonce slot data: 2
TXM LOG: libimage4: failed to read from boot manifest: p = love, name = love: 2
TXM LOG: libimage4: failed to read from boot manifest: p = vnum, name = love: 2
TXM LOG: libimage4: no boot uuid set
[SPTM] SPTM Retype (0xf4b8000, 0x0, TXM_MALLOC_PAGE)
[SPTM] SPTM Retype (0xf4bc000, 0x0, TXM_MALLOC_PAGE)
[SPTM] SPTM Retype (0xf4c0000, 0x0, TXM_MALLOC_PAGE)
[SPTM] SPTM Retype (0xf4c4000, 0x0, TXM_MALLOC_PAGE)
[SPTM] SPTM Retype (0xf4c8000, 0x0, TXM_ADDRESS_SPACE_TABLE)
TXM LOG: unable to find sepfw-never-boot property in /chosen
[SPTM] SPTM Retype (0xf4cc000, 0x0, TXM_SEP_SECURE_CHANNEL)
TXM LOG: setup the shared page for the secure channel
TXM LOG: system SecureUI state: 0
TXM LOG: unable to find research-enabled property in /chosen
TXM LOG: unable to find research ERM property in /chosen
TXM LOG: unable to find iboot-build-variant property in /chosen/iBoot
[SPTM] SPTM Retype (0x4dec000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4df0000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4df4000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4df8000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4dfc000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e00000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e04000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e08000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e0c000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e10000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e14000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e18000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e1c000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e20000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e24000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e28000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e2c000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e30000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e34000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e38000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e3c000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e40000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e44000, 0x3c, 0x3c)
[SPTM] SPTM Retype (0x4e48000, 0x3c, 0x3c)
TXM LOG: loaded external trust cache modules: 1/5
TXM LOG: platform code only policy: 0
TXM LOG: restricted execution mode support: 0
TXM LOG: successfully queried the UniqueDeviceIDv2 from the device tree
[SPTM] SPTM Register Callback (0, 0xfffffff01703da24, 2)
[SPTM] SPTM Register Callback (1, 0xfffffff01703d890, 1)
TXM LOG: build variant: txm.iphoneos.release.TrustedExecutionMonitor_Guarded-217.0.2
TXM LOG: fusing: 0x00000000
TXM LOG: virtualized: 0
TXM LOG: build type: 0
TXM LOG: device type: 1
TXM LOG: research configuration: 0
TXM LOG: extended research configuration: 0
[SPTM] TXM boot complete — firing on_txm_ready
[cpu] booting CPU1 MPIDR=0x80000001
[SPTM] SVC #0x26 — Enable Interrupts
[txm-only] CPU1 stack=0xfee8000 GetBuildVariant=txm.iphoneos.release.TrustedExecutionMonitor_Guarded-217.0.2
[cpu] CPU1 booted
[cpu] booting CPU2 MPIDR=0x80000002
[SPTM] SVC #0x26 — Enable Interrupts
[txm-only] CPU2 stack=0xfeec000 GetBuildVariant=txm.iphoneos.release.TrustedExecutionMonitor_Guarded-217.0.2
[cpu] CPU2 booted
[cpu] booting CPU3 MPIDR=0x80000003
[SPTM] SVC #0x26 — Enable Interrupts
[txm-only] CPU3 stack=0xfef0000 GetBuildVariant=txm.iphoneos.release.TrustedExecutionMonitor_Guarded-217.0.2
[cpu] CPU3 booted
[txm-only] dispatching on_txm_ready on CPU0