Mach trap#-88
svc · mach trap -88
_exclaves_ctl_trap
Control trap for communicating with Exclaves, the secure compartments introduced on Apple Silicon.
Prototype
kern_return_t _exclaves_ctl_trap(/* 8 args */);Returns: kern_return_t
Version history
| XNU tag | macOS | # |
|---|---|---|
| xnu-10002.1.13 | macOS 14.0 Sonoma | -88 |
| xnu-11215.1.10 | macOS 15.0 Sequoia | -88 |
| xnu-11417.101.15 | macOS 15.4 Sequoia | -88 |
| xnu-12377.1.9 | macOS 26.0 Tahoe | -88 |
| xnu-10002.41.9 | — | -88 |
| xnu-10002.61.3 | — | -88 |
| xnu-10002.81.5 | — | -88 |
| xnu-10063.101.15 | — | -88 |
| xnu-10063.121.3 | — | -88 |
| xnu-10063.141.1 | — | -88 |
| xnu-11215.41.3 | — | -88 |
| xnu-11215.61.5 | — | -88 |
| xnu-11215.81.4 | — | -88 |
| xnu-11417.121.6 | — | -88 |
| xnu-11417.140.69 | — | -88 |
| xnu-12377.101.15 | — | -88 |
| xnu-12377.41.6 | — | -88 |
| xnu-12377.61.12 | — | -88 |
| xnu-12377.81.4 | — | -88 |
Notes
Exclaves are isolated execution environments hosted by the Secure Page Table Monitor on Apple Silicon, used for things like the Secure Enclave Processor extensions, ML model isolation, and selected XNU subsystems. _exclaves_ctl_trap is the single multiplexed entry point through which user-space and the kernel issue control operations (lookup, invoke, panic) to these enclaves. The surface is private and the operation codes change across releases.
Detection
DTrace mach_trap provider on recent macOS; the kernel logs significant Exclaves activity to the os_log subsystem com.apple.xnu.exclaves.
Related APIs
mach_msg2_traptask_create_suid_crediokit_user_client_trap