Comment by ajross
3 years ago
If it's the cache hardware, probably not. That's not programmable, you get whatever configuration the designers baked in, and that's it. Though as described you could likely work around this by changing the cache mode to write-through, albeit at a fairly severe performance penalty for the affected accesses.
Apple supports locking down MSR registers for the CPU's.
I would not be surprised if they added the same functionality to the GPU registers.
There are a tremendous number of debug registers in these things.
Apple has >1000 apple-specific MSR's for the CPUs, mostly used for debugging/testing
However, unlike the GPU, they are protected by more than just PPL. But you can use them from m1n1/etc and see what they do.
It is not surprising to find they have the same for GPU processor, the difference is that the GPU has no IOMMU, so forgetting to map a page that contains the register shadows is exploitable in a way that it's not for the CPU
What's PPL?
Edit: Page Protection Layer (https://googleprojectzero.blogspot.com/2020/07/the-core-of-a...)