Part 1 summary: PPL as we knew it is no longer. TXM, the Trusted eXecution Monitor, runs in GL0, and handles code signing and entitlements, much as PPL u

Part 1 summary: PPL as we knew it is no longer. TXM, the Trusted eXecution Monitor, runs in GL0, and handles code signing and entitlements, much as PPL used to. SPTM, the Secure Page Table Monitor, runs in GL1/2 The refactoring and relocation of this security critical code to GXF makes it far less likely that an attacker with arbitrary kernel r/w privileges could potentially compromise the security posture of the system. Part 2, https://www.df-f.com/blog/ios-17round2 https://www.df-f.com/blog/ios-17round2