12 ms·

Apple Silicon Hardware: SPRR and Guarded Exception Levels (GXF)

272 points by mpweiher 6y ago

wly_cdgr 6y ago
What is the point of doing this? Is there practical value for third parties (and if so, what & which?) or is this primarily a skate video? No right answer, just curious
- capableweb 6y ago
  You're questioning the value of reverse-engineering things in general and publishing them on the internet or this specific reverse-engineering? For me the basic value is just having more knowledge published in the open for anyone to read. I might not have any practical value of it, either ever or today, but I did learn a bunch reading it and I'm glad I did.
- svenpeter 6y ago
  Not sure why you're downvoted because I think you ask a legitimate question. To me, it's a combination of various things: I've tried to outline the process I used so that other people can learn how to approach challenges like this. I learned how to develop software and how to reverse engineer by reading posts like this and watching talks from e.g. CCC or DEFCON. Hopefully I can give something back this way. This might also be valuable to other people who want to virtualize macOS or iOS or those who do security research and run into these features while reading XNU code. And then ofc I can finally flex in front of my friends with this because I was the first to pull of a new skate trick ;)
  - wly_cdgr 6y ago
    Thank you for taking the time to give a concrete and illuminating answer, I really appreciate it. Also, rad trick ;)
varispeed 6y ago
This is really cool! However, it breaks my heart that talented people have to spend their time on something like this - companies should be required to release a documentation for consumers so they can fully use their products. Otherwise you don't really buy e.g. a Mac, only a privilege of using whatever Apple cooked up for you. This erosion of ownership should stop. If you bought a computer in the 80s you could get everything you need to write your own operating system etc. you could get schematics, parts and so on. Today you pay a lot of money for an illusion of owning something. I get that many people don't care, but this is not the world I want to live in. Hopefully initiatives like right to repair will change it and companies like Apple will be forced to treat consumers like consumers and not sheep that they can fleece as they please. Apple (and other big corporations) should serve consumers, not shareholders.
- svenpeter 6y ago
  hi, and thanks! I'm the author of this post and I'm a little bit conflicted where I stand in this discussion. In general, I agree that the world would be a better place if corporations would release documentation. But my life would be much less fun then. Reverse engineering scratches a certain itch like nothing else does! So I'm kinda happy that mysteries like this exist and gladly spend my time on something like this :-)
  - rowanG077 6y ago
    Well it's not like you couldn't scratch that itch. Biology and medical sciences are the most hardcore reverse engineering club there is.
  - beckman466 6y ago
    > But my life would be much less fun then. Reverse engineering scratches a certain itch like nothing else does! Totally, yet at the same time I'm worried that knowledge workers aren't aware enough of just how privileged they are to have been able to 'climb the ladder' to be able to do work like that, and how, unless you're 1) well off and 2) living in the global north, gaining such skills has been made nearly impossible because the ladders needed to climb up are often not available, despite humans having been gifted digital technology (and therefore a zero-marginal cost of information reproduction). As an example: I'm not technically skilled enough to reverse engineer the things I'd like to, and because of the way knowledge is controlled by big companies as trade secrets and patent claims [1], it's near impossible to gain these skills in an affordable way. I also cannot take apart the technology I already own since it is not modular, it voids the warranty or is it is damaged (since I'm not skilled because I didn't realize early enough how important technology is). So yes, it sounds super fun for you to reverse engineer this stuff, yet when are we going to seriously admit that this IP system has become a massive problem, and that the people who came before are literally 'kicking away the ladder' they used to climb up themselves? That when people say that the only thing people need to do to succeed is to 'work hard', that that is a lie, since information is made artificially scarce by human systems/institutions, and thus only available to a select few [2]. Edit: I just saw on your twitter that you are a console hacker, thanks for the awesome work! [1] https://www.ipwatchdog.com/2019/02/19/dont-fooled-patent-purge-elon-musk-just-another-hypocritical-tech-billionaire/ https://www.ipwatchdog.com/2019/02/19/dont-fooled-patent-pur... [2] https://tribunemag.co.uk/2019/01/abolish-silicon-valley https://tribunemag.co.uk/2019/01/abolish-silicon-valley
29athrowaway 6y ago
I think the should be more protection levels so the kernel itself could have at least 2 rings.
- saagarjha 6y ago
  The kernel does essentially have two rings: the “regular” exception level and the “guarded” level.
robbiep 6y ago
I only surface level understand this but the eloquence and level of detail is very impressive
- svenpeter 6y ago
  Thanks a lot! I've been trying to improve my technical writing in the past years and I'm happy to hear feedback like this :)
userbinator 6y ago
Alternate title: Destroying General-Purpose Computing, One (Permission) Bit At A Time If I understand correctly, one of the big unsaid implications of this article seems to be that it is now impossible to have RWX, because the hardware completely prevents it. APRR looks more like a general permissions-remapping mechanism, while SPRR appears to go beyond that. While the technical details are certainly interesting, IMHO it's also disturbing in the same way as weapons of mass destruction or DRM. This technology is used by one company to essentially maintain control over its users, under the convincing guise of security. What do SPRR and GXF stand for? Given the functionality, my guess is APRR = Access Permission Remapping Registers, SPRR = Secure Permission Remapping Registers, and GXF = Guarded Execution Feature.
- slimsag 6y ago
  Is this true? Wouldn't it mean any JIT-based language would not work on Apple Silicon? I must be misunderstanding you
  - userbinator 6y ago
    A register in usermode lets you choose rw- and r-x, but rwx is not a choice. JITs will work, but need to swap between the two; SMC/XMC won't.
    - slimsag 6y ago
      Ahh okay, I see, thank you for the explanation!
- judge2020 6y ago
  > This technology is used by one company to essentially maintain control over its users, under the convincing guise of security. Its not a guise of security, it actually accomplishes it. Mac malware now has to operate within the confines of these permissions and nowadays the author has to submit a sample of the malware to Apple before it can be opened without insane prompts (this also means losing $99 and attaching their legal identity to the malware/committing identity fraud). If Apple went full-iOS on MacOS and made it so "everything must go through the App Store" then the possibility of mac malware would effectively disappear overnight into the same realm that iOS malware currently resides: jailbroken iOS devices with shady (mostly piracy-focused) apt repos.
londons_explore 6y ago
Can we sit back and think for a moment about how many hours mpweiher spent figuring all this out, when we (humans) already knew all this? We just let it be locked in the secret document vaults at Apple, and then had to waste effort rediscovering it. That doesn't seem smart.
- judge2020 6y ago
  Is that bad? It's like saying Pepsi shouldn't have to experiment and reverse engineer Coke since the secret formula is sitting in a vault in Atlanta[0]; Apple's IP is theirs and they should be able to share it as freely as they want or not at all. 0: https://www.worldofcoca-cola.com/media-alert/coca-cola-moves-its-secret-formula/ https://www.worldofcoca-cola.com/media-alert/coca-cola-moves...
  - londons_explore 6y ago
    It's pretty rare you see ants in an ant colony saying "I dragged this food all the way back to HQ, so you can't have any". Yet we see the equivalent with humans all the time. Globally less efficient use of time/money/resources for 'fairness'.
    - judge2020 6y ago
      Human society was basically an ant colony before we were able to passively, efficiently take care of our basic needs (food, water) and implemented the barter system so that you can only benefit from society if you also put effort into it. Over thousands of years this philosophy has scaled up to the point where Apple underwent nearly 20 years of R&D effort and spent tens of billions of dollars to create the M1 chip - and thus they are allowed to share it as much or as little as they wish since they put the effort into making it.
- saagarjha 6y ago
  I think 'mpweiher just submitted the post; 'svenpeter wrote it.

272 points by mpweiher 6y ago

What is the point of doing this? Is there practical value for third parties (and if so, what & which?) or is this primarily a skate video? No right answer, just curious

capableweb 6y ago
You're questioning the value of reverse-engineering things in general and publishing them on the internet or this specific reverse-engineering? For me the basic value is just having more knowledge published in the open for anyone to read. I might not have any practical value of it, either ever or today, but I did learn a bunch reading it and I'm glad I did.
svenpeter 6y ago
Not sure why you're downvoted because I think you ask a legitimate question. To me, it's a combination of various things: I've tried to outline the process I used so that other people can learn how to approach challenges like this. I learned how to develop software and how to reverse engineer by reading posts like this and watching talks from e.g. CCC or DEFCON. Hopefully I can give something back this way. This might also be valuable to other people who want to virtualize macOS or iOS or those who do security research and run into these features while reading XNU code. And then ofc I can finally flex in front of my friends with this because I was the first to pull of a new skate trick ;)
- wly_cdgr 6y ago
  Thank you for taking the time to give a concrete and illuminating answer, I really appreciate it. Also, rad trick ;)

varispeed 6y ago

This is really cool! However, it breaks my heart that talented people have to spend their time on something like this - companies should be required to release a documentation for consumers so they can fully use their products. Otherwise you don't really buy e.g. a Mac, only a privilege of using whatever Apple cooked up for you. This erosion of ownership should stop. If you bought a computer in the 80s you could get everything you need to write your own operating system etc. you could get schematics, parts and so on. Today you pay a lot of money for an illusion of owning something. I get that many people don't care, but this is not the world I want to live in. Hopefully initiatives like right to repair will change it and companies like Apple will be forced to treat consumers like consumers and not sheep that they can fleece as they please. Apple (and other big corporations) should serve consumers, not shareholders.

svenpeter 6y ago
hi, and thanks! I'm the author of this post and I'm a little bit conflicted where I stand in this discussion. In general, I agree that the world would be a better place if corporations would release documentation. But my life would be much less fun then. Reverse engineering scratches a certain itch like nothing else does! So I'm kinda happy that mysteries like this exist and gladly spend my time on something like this :-)
- rowanG077 6y ago
  Well it's not like you couldn't scratch that itch. Biology and medical sciences are the most hardcore reverse engineering club there is.
- beckman466 6y ago
  > But my life would be much less fun then. Reverse engineering scratches a certain itch like nothing else does! Totally, yet at the same time I'm worried that knowledge workers aren't aware enough of just how privileged they are to have been able to 'climb the ladder' to be able to do work like that, and how, unless you're 1) well off and 2) living in the global north, gaining such skills has been made nearly impossible because the ladders needed to climb up are often not available, despite humans having been gifted digital technology (and therefore a zero-marginal cost of information reproduction). As an example: I'm not technically skilled enough to reverse engineer the things I'd like to, and because of the way knowledge is controlled by big companies as trade secrets and patent claims [1], it's near impossible to gain these skills in an affordable way. I also cannot take apart the technology I already own since it is not modular, it voids the warranty or is it is damaged (since I'm not skilled because I didn't realize early enough how important technology is). So yes, it sounds super fun for you to reverse engineer this stuff, yet when are we going to seriously admit that this IP system has become a massive problem, and that the people who came before are literally 'kicking away the ladder' they used to climb up themselves? That when people say that the only thing people need to do to succeed is to 'work hard', that that is a lie, since information is made artificially scarce by human systems/institutions, and thus only available to a select few [2]. Edit: I just saw on your twitter that you are a console hacker, thanks for the awesome work! [1] https://www.ipwatchdog.com/2019/02/19/dont-fooled-patent-purge-elon-musk-just-another-hypocritical-tech-billionaire/ https://www.ipwatchdog.com/2019/02/19/dont-fooled-patent-pur... [2] https://tribunemag.co.uk/2019/01/abolish-silicon-valley https://tribunemag.co.uk/2019/01/abolish-silicon-valley

29athrowaway 6y ago

I think the should be more protection levels so the kernel itself could have at least 2 rings.

saagarjha 6y ago
The kernel does essentially have two rings: the “regular” exception level and the “guarded” level.

robbiep 6y ago

I only surface level understand this but the eloquence and level of detail is very impressive

svenpeter 6y ago
Thanks a lot! I've been trying to improve my technical writing in the past years and I'm happy to hear feedback like this :)

userbinator 6y ago

Alternate title: Destroying General-Purpose Computing, One (Permission) Bit At A Time If I understand correctly, one of the big unsaid implications of this article seems to be that it is now impossible to have RWX, because the hardware completely prevents it. APRR looks more like a general permissions-remapping mechanism, while SPRR appears to go beyond that. While the technical details are certainly interesting, IMHO it's also disturbing in the same way as weapons of mass destruction or DRM. This technology is used by one company to essentially maintain control over its users, under the convincing guise of security. What do SPRR and GXF stand for? Given the functionality, my guess is APRR = Access Permission Remapping Registers, SPRR = Secure Permission Remapping Registers, and GXF = Guarded Execution Feature.

slimsag 6y ago
Is this true? Wouldn't it mean any JIT-based language would not work on Apple Silicon? I must be misunderstanding you
- userbinator 6y ago
  A register in usermode lets you choose rw- and r-x, but rwx is not a choice. JITs will work, but need to swap between the two; SMC/XMC won't.
  - slimsag 6y ago
    Ahh okay, I see, thank you for the explanation!
judge2020 6y ago
> This technology is used by one company to essentially maintain control over its users, under the convincing guise of security. Its not a guise of security, it actually accomplishes it. Mac malware now has to operate within the confines of these permissions and nowadays the author has to submit a sample of the malware to Apple before it can be opened without insane prompts (this also means losing $99 and attaching their legal identity to the malware/committing identity fraud). If Apple went full-iOS on MacOS and made it so "everything must go through the App Store" then the possibility of mac malware would effectively disappear overnight into the same realm that iOS malware currently resides: jailbroken iOS devices with shady (mostly piracy-focused) apt repos.

londons_explore 6y ago

Can we sit back and think for a moment about how many hours mpweiher spent figuring all this out, when we (humans) already knew all this? We just let it be locked in the secret document vaults at Apple, and then had to waste effort rediscovering it. That doesn't seem smart.

judge2020 6y ago
Is that bad? It's like saying Pepsi shouldn't have to experiment and reverse engineer Coke since the secret formula is sitting in a vault in Atlanta[0]; Apple's IP is theirs and they should be able to share it as freely as they want or not at all. 0: https://www.worldofcoca-cola.com/media-alert/coca-cola-moves-its-secret-formula/ https://www.worldofcoca-cola.com/media-alert/coca-cola-moves...
- londons_explore 6y ago
  It's pretty rare you see ants in an ant colony saying "I dragged this food all the way back to HQ, so you can't have any". Yet we see the equivalent with humans all the time. Globally less efficient use of time/money/resources for 'fairness'.
  - judge2020 6y ago
    Human society was basically an ant colony before we were able to passively, efficiently take care of our basic needs (food, water) and implemented the barter system so that you can only benefit from society if you also put effort into it. Over thousands of years this philosophy has scaled up to the point where Apple underwent nearly 20 years of R&D effort and spent tens of billions of dollars to create the M1 chip - and thus they are allowed to share it as much or as little as they wish since they put the effort into making it.
saagarjha 6y ago
I think 'mpweiher just submitted the post; 'svenpeter wrote it.