Exact behavior of SPTM GXF_entry_point handler on GENTER
Determine the exact operational behavior of the Secure Page Table Monitor (SPTM) handler function GXF_entry_point, which is referenced by the GXF_ENTRY_EL1 vector and invoked when XNU executes GENTER, including how it branches based on ESR_GL1 and how it processes GXF entry events rather than normal exception paths.
References
The exact working of this handling is unclear at present, as we do not expect the function to be called in a normal exception handling path, but rather only on GXF entry via GENTER.
— Modern iOS Security Features -- A Deep Dive into SPTM, TXM, and Exclaves
(2510.09272 - Steffin et al., 10 Oct 2025) in Section “SPTM Request Handling — GENTER” (label: GENTERHandling)