The funny thing is that the M1 has an undocumented but totally used feature called Guarded Execution[0] that lets you separate parts of the kernel (or hyperviso

The funny thing is that the M1 has an undocumented but totally used feature called Guarded Execution[0] that lets you separate parts of the kernel (or hypervisor, if you're in EL2) from one another. Basically, on the M1 each Exception Level now has a regular and a guarded sublevel, with their own page table permissions, and special instructions to enter or exit the guarded execution within the same EL. macOS on the M1 uses this to prohibit most kernel code from touching pagetables. You have to do that from within the guarded sublevel, which kernel extensions can only call into. This is more or less the original intent of x86 rings: to separate an OS kernel out into parts with different permissions and levels of isolation. [0] https://blog.svenpeter.dev/posts/m1_sprr_gxf/ https://blog.svenpeter.dev/posts/m1_sprr_gxf/