hardware privilege levels, interactions with privileged software instructions

Question 1

An operating system is a powerful and usually extensive program that controls and manages the hardware and other software on a computer.

Answer 1

All computers and computer-like devices require operating systems, including your laptop, tablet, desktop, smartphone, smartwatch, and router.

Question 2

hierarchical protection domains/ protection rings

Answer 2

protect data and functionality from faults by improving fault tolerance and malicious behavir by providing computer security.

Question 3

A protection ring is one of two or more hierarchical levels or layers of privilege within the architecture of a computer system. This is generally hardware-enforced by some CPU architectures that provide different CPU modes at the hardware or microcode level. Rings are arranged in a hierarchy from most privileged (most trusted, usually numbered zero) to least privileged (least trusted, usually with the highest ring number).

Answer 3

On most operating systems, Ring 0 is the level with the most privileges and interacts most directly with the physical hardware such as certain CPU functionality (e.g. the control registers) and I/O controllers.

Question 4

Special call gates between rings are provided to allow an outer ring to access an inner ring’s resources in a predefined manner, as opposed to allowing arbitrary usage. Correctly gating access between rings can improve security by preventing programs from one ring or privilege level from misusing resources intended for programs in another.

Answer 4

For example, spyware running as a user program in Ring 3 should be prevented from turning on a web camera without informing the user, since hardware access should be a Ring 1 function reserved for device drivers. Programs such as web browsers running in higher numbered rings must request access to the network, a resource restricted to a lower numbered ring.

Question 5

supervisor mode

Answer 5

hardware-mediated flag that can be changed by code running in system-level software.
System-level tasks or threads may have this flag set while they are running, whereas user-level applications will not. This flag determines whether it would be possible to execute machine code operations such as modifying registers for various descriptor tables, or performing operations such as disabling interrupts. The idea of having two different modes to operate in comes from “with more power comes more responsibility” – a program in supervisor mode is trusted never to fail, since a failure may cause the whole computer system to crash.

Question 6

Supervisor mode is “an execution mode on some processors which enables execution of all instructions, including privileged instructions.

Answer 6

It may also give access to a different address space, to memory management hardware and to other peripherals. This is the mode in which the operating system usually runs.”

Question 7

In a monolithic kernel, the operating system runs in supervisor mode and the applications run in user mode.

Answer 7

Other types of operating systems, like those with an exokernel or microkernel, do not necessarily share this behavior.

Question 8

Most processors have at least two different modes. The x86-processors have four different modes divided into four different rings. Programs that run in Ring 0 can do anything with the system, and code that runs in Ring 3 should be able to fail at any time without impact to the rest of the computer system.

Answer 8

Ring 1 and Ring 2 are rarely used, but could be configured with different levels of access.

Question 9

To gain performance and determinism, some systems place functions that would likely be viewed as application logic, rather than as device drivers, in kernel mode; security applications (access control, firewalls, etc.) and operating system monitors are cited as examples.

Answer 9

At least one embedded database management system, eXtremeDB Kernel Mode, has been developed specifically for kernel mode deployment, to provide a local database for kernel-based application functions, and to eliminate the context switches that would otherwise occur when kernel functions interact with a database system running in user mode

Question 10

Functions are also sometimes moved across rings in the other direction. The Linux kernel, for instance, injects into processes a vDSO section which contains functions that would normally require a system call, i.e. a ring transition. Instead of doing a syscall these functions use static data provided by the kernel.

Answer 10

This avoids the need for a ring transition and so is more lightweight than a syscall. The function gettimeofday can be provided this way.

Question 11

A privilege level in the x86 instruction set controls the access of the program currently running on the processor to resources such as memory regions, I/O ports, and special instructions. There are 4 privilege levels ranging from 0 which is the most privileged, to 3 which is least privileged.

Answer 11

Most modern operating systems use level 0 for the kernel/executive, and use level 3 for application programs. Any resource available to level n is also available to levels 0 to n, so the privilege levels are rings. When a lesser privileged process tries to access a higher privileged process, a general protection fault exception is reported to the OS.

Question 12

It is not necessary to use all four privilege levels. Current operating systems with wide market share including Microsoft Windows, macOS, Linux, iOS and Android mostly use a paging mechanism with only one bit to specify the privilege level as either Supervisor or User (U/S Bit).

Answer 12

Windows NT uses the two-level system. The real mode programs in 8086 are executed at level 0 (highest privilege level) whereas virtual mode in 8086 executes all programs at level 3

Question 13

The IOPL (I/O Privilege level) flag is a flag found on all IA-32 compatible x86 CPUs.

Answer 13

It occupies bits 12 and 13 in the FLAGS register. In protected mode and long mode, it shows the I/O privilege level of the current program or task. The Current Privilege Level (CPL) (CPL0, CPL1, CPL2, CPL3) of the task or program must be less than or equal to the IOPL in order for the task or program to access I/O ports.

The IOPL can be changed using POPF(D) and IRET(D) only when the current privilege level is Ring 0.

Besides IOPL, the I/O Port Permissions in the TSS also take part in determining the ability of a task to access an I/O port.

Question 14

In x86 systems, the x86 hardware virtualization (VT-x and SVM) is referred as

Answer 14

ring - 1

Question 15

the System Management Mode is referred as

Answer 15

ring - 2

Question 16

the Intel Management Engine and AMD Platform Security Processor are sometimes referred as

Answer 16

ring - 3

Question 17

Proper use of complex CPU modes requires very close cooperation between the operating system and the CPU, and thus tends to tie the OS to the CPU architecture.

Answer 17

When the OS and the CPU are specifically designed for each other, this is not a problem (although some hardware features may still be left unexploited), but when the OS is designed to be compatible with multiple, different CPU architectures, a large part of the CPU mode features may be ignored by the OS. For example, the reason Windows uses only two levels (ring 0 and ring 3) is that some hardware architectures that were supported in the past (such as PowerPC or MIPS) implemented only two privilege levels

Question 18

Transitions between modes are at the discretion of the executing thread when the transition is from a level of high privilege to one of low privilege (as from kernel to user modes)

Answer 18

transitions from lower to higher levels of privilege can take place only through secure, hardware-controlled “gates” that are traversed by executing special instructions or when external interrupts are received.

Question 19

Microkernel operating systems attempt to minimize the amount of code running in privileged mode, for purposes of security and elegance, but ultimately sacrificing ________

Answer 19

performance

Question 20

Fault tolerance

Answer 20

property that enables a system to continue operating properly in the event of the failure of one or more faults within some of its components. If its operating quality decreases at all, the decrease is proportional to the severity of the failure, as compared to a naively designed system, in which even a small failure can cause total breakdown.

Question 21

Fault tolerance is particularly sought after in high-availability, mission-critical, or even life-critical systems. The ability of maintaining functionality when portions of a system break down is referred to as

Answer 21

graceful degradation

Question 22

fault-tolerant design

Answer 22

enables a system to continue its intended operation, possibly at a reduced level, rather than failing completely, when some part of the system fails.

Question 23

term most commonly used to describe computer systems designed to continue more or less fully operational with, perhaps, a reduction in throughput or an increase in response time in the event of some partial failure. That is, the system as a whole is not stopped due to problems either in the hardware or the software.

Answer 23

fault-tolerant design

Question 24

Computer security, cyber security , digital security or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, theft of, or damage to hardware, software, or data, as well as from the disruption or misdirection of the services they provide.

Answer 24

The field is significant due to the expanded reliance on computer systems, the Internet, and wireless network standards such as Bluetooth and Wi-Fi. Also, due to the growth of smart devices, including smartphones, televisions, and the various devices that constitute the Internet of things (IoT). Cybersecurity is one of the most significant challenges of the contemporary world, due to both the complexity of information systems and the societies they support. Security is of especially high importance for systems that govern large-scale systems with far-reaching physical effects, such as power distribution, elections, and finance.

Question 25

CPU modes (also called processor modes, CPU states, CPU privilege levels)

Answer 25

operating modes for the central processing unit of some computer architectures that place restrictions on the type and scope of operations that can be performed by certain processes being run by the CPU. This design allows the operating system to run with more privileges than application software.

Question 26

Ideally, only highly trusted kernel code is allowed to execute in the unrestricted mode; everything else (including non-supervisory portions of the operating system) runs in a restricted mode and must use a

Answer 26

system call via interrupt to request the kernel perform on its behalf any operation that could damage or compromise the system or other programs or the computing system

Question 27

system calls take time and can hurt the performance of a computing system, so it is not uncommon for system designers to allow some time-critical software (especially device drivers) to run with full kernel privileges.

Answer 27

Multiple modes can be implemented—allowing a hypervisor to run multiple operating system supervisors beneath it, which is the basic design of many virtual machine systems available today.

Question 28

The unrestricted mode is often called kernel mode, but many other designations exist (master mode, supervisor mode, privileged mode, etc.).

Answer 28

Restricted modes are usually referred to as user modes, but are also known by many other names (slave mode, problem state, etc.).

Question 29

In kernel mode, the CPU may perform any operation allowed by its architecture; any instruction may be executed, any I/O operation initiated, any area of memory accessed, and so on.

Answer 29

In the other CPU modes, certain restrictions on CPU operations are enforced by the hardware. Typically, certain instructions are not permitted (especially those—including I/O operations—that could alter the global state of the machine), some memory areas cannot be accessed, etc. User-mode capabilities of the CPU are typically a subset of those available in kernel mode, but in some cases, such as hardware emulation of non-native architectures, they may be significantly different from those available in standard kernel mode.

Question 30

Mode type: user

Answer 30

Some CPU architectures support multiple user modes, often with a hierarchy of privileges. These architectures are often said to have ring-based security, wherein the hierarchy of privileges resembles a set of concentric rings, with the kernel mode in the center. Multics hardware was the first significant implementation of ring security, but many other hardware platforms have been designed along similar lines, including the Intel 80286 protected mode, and the IA-64 as well, though it is referred to by a different name in these cases.

Question 31

Mode protection may extend to resources beyond the CPU hardware itself. Hardware registers track the current operating mode of the CPU, but additional virtual-memory registers, page-table entries, and other data may track mode identifiers for other resources.

Answer 31

For example, a CPU may be operating in Ring 0 as indicated by a status word in the CPU itself, but every access to memory may additionally be validated against a separate ring number for the virtual-memory segment targeted by the access, and/or against a ring number for the physical page (if any) being targeted. This has been demonstrated with the PSP handheld system.

Question 32

type of computer software, firmware or hardware that creates and runs virtual machines.

Answer 32

hypervisor (also known as a virtual machine monitor, VMM, or virtualizer)

Question 33

computer on which a hypervisor runs one or more virtual machines

Answer 33

host machine

Question 34

each virtual machine is called a __________. he hypervisor presents the guest operating systems with a virtual operating platform and manages the execution of the guest operating systems. Unlike an emulator, the guest executes most instructions on the native hardware

Answer 34

guest machine

Question 35

Multiple instances of a variety of operating systems may share the virtualized hardware resources: for example, Linux, Windows, and macOS instances can all run on a single physical x86 machine.

Answer 35

This contrasts with operating-system–level virtualization, where all instances (usually called containers) must share a single kernel, though the guest operating systems can differ in user space, such as different Linux distributions with the same kernel.

Question 36

Type-1, native or bare-metal hypervisors

Answer 36

These hypervisors run directly on the host’s hardware to control the hardware and to manage guest operating systems. For this reason, they are sometimes called bare-metal hypervisors. The first hypervisors, which IBM developed in the 1960s, were native hypervisors. These included the test software SIMMON and the CP/CMS operating system, the predecessor of IBM’s VM family of virtual machine operating systems.

Question 37

Type-2 or hosted hypervisors

Answer 37

These hypervisors run on a conventional operating system (OS) just as other computer programs do. A virtual machine monitor runs as a process on the host. Type-2 hypervisors abstract guest operating systems from the host operating system.

Question 38

The use of hypervisor technology by malware and rootkits installing themselves as a hypervisor below the operating system, known as hyperjacking, can make them more difficult to detect because the malware could intercept any operations of the operating system (such as someone entering a password) without the anti-malware software necessarily detecting it (since the malware runs below the entire operating system). Implementation of the concept has allegedly occurred in the SubVirt laboratory rootkit (developed jointly by Microsoft and University of Michigan researchers) as well as in the Blue Pill malware package. However, such assertions have been disputed by others who claim that it would be possible to detect the presence of a hypervisor-based rootkit.

Answer 38

security implications

Question 39

Embedded hypervisors, targeting embedded systems and certain real-time operating system (RTOS) environments, are designed with different requirements when compared to desktop and enterprise systems, including robustness, security and real-time capabilities. The resource-constrained nature of many embedded systems, especially battery-powered mobile systems, imposes a further requirement for small memory-size and low overhead. Finally, in contrast to the ubiquity of the x86 architecture in the PC world, the embedded world uses a wider variety of architectures and less standardized environments. Support for virtualization requires memory protection (in the form of a memory management unit or at least a memory protection unit) and a distinction between user mode and privileged mode, which rules out most microcontrollers. This still leaves x86, MIPS, ARM and PowerPC as widely deployed architectures on medium- to high-end embedded systems

Answer 39

As manufacturers of embedded systems usually have the source code to their operating systems, they have less need for full virtualization in this space. Instead, the performance advantages of paravirtualization make this usually the virtualization technology of choice. Nevertheless, ARM and MIPS have recently added full virtualization support as an IP option and has included it in their latest high-end processors and architecture versions, such as ARM Cortex-A15 MPCore and ARMv8 EL2.

Other differences between virtualization in server/desktop and embedded environments include requirements for efficient sharing of resources across virtual machines, high-bandwidth, low-latency inter-VM communication, a global view of scheduling and power management, and fine-grained control of information flows.

Question 40

virtual machine

Answer 40

virtualization or emulation of a computer system. Virtual machines are based on computer architectures and provide the functionality of a physical computer. Their implementations may involve specialized hardware, software, or a combination of the two.

Question 41

virtual machine:
system virtual machine

Answer 41

provide a substitute for a real machine. They provide the functionality needed to execute entire operating systems. A hypervisor uses native execution to share and manage hardware, allowing for multiple environments that are isolated from one another yet exist on the same physical machine. Modern hypervisors use hardware-assisted virtualization, with virtualization-specific hardware features on the host CPUs providing assistance to hypervisors.

Question 42

virtual machine:
Process virtual machines

Answer 42

designed to execute computer programs in a platform-independent environment.

Question 43

call gate

Answer 43

mechanism in Intel’s x86 architecture for changing the privilege level of a process when it executes a predefined function call using a CALL FAR instruction.

Question 44

Real mode or real address mode

Answer 44

operating mode of all x86-compatible CPUs. The mode gets its name from the fact that addresses in real mode always correspond to real locations in memory. Real mode is characterized by a 20-bit segmented memory address space (giving 1 MB of addressable memory) and unlimited direct software access to all addressable memory, I/O addresses and peripheral hardware. Real mode provides no support for memory protection, multitasking, or code privilege levels.

Question 45

protected mode

Answer 45

operational mode of x86-compatible central processing units (CPUs). It allows system software to use features such as segmentation, virtual memory, paging and safe multi-tasking designed to increase an operating system’s control over application software.

Question 46

When a processor that supports x86 protected mode is powered on, it begins executing instructions in real mode, in order to maintain backward compatibility with earlier x86 processors

Answer 46

Protected mode may only be entered after the system software sets up one descriptor table and enables the Protection Enable (PE) bit in the control register 0 (CR0).

Question 47

The kernel is a computer program at the core of a computer’s operating system and generally has complete control over everything in the system

Answer 47

It is the portion of the operating system code that is always resident in memory and facilitates interactions between hardware and software components.

Question 48

A full kernel controls all hardware resources (e.g. I/O, memory, cryptography) via device drivers, arbitrates conflicts between processes concerning such resources, and optimizes the utilization of common resources e.g. CPU & cache usage, file systems, and network sockets.

Answer 48

On most systems, the kernel is one of the first programs loaded on startup (after the bootloader). It handles the rest of startup as well as memory, peripherals, and input/output (I/O) requests from software, translating them into data-processing instructions for the central processing unit.

Question 49

critical code of the kernel is usually loaded into a separate area of memory, which is protected from access by application software or other less critical parts of the operating system. The kernel performs its tasks, such as running processes, managing hardware devices such as the hard disk, and handling interrupts, in this protected kernel space. In contrast, application programs such as browsers, word processors, or audio or video players use a separate area of memory, user space.

Answer 49

This separation prevents user data and kernel data from interfering with each other and causing instability and slowness, as well as preventing malfunctioning applications from affecting other applications or crashing the entire operating system. Even in systems where the kernel is included in application address spaces, memory protection is used to prevent unauthorized applications from modifying the kernel.

Question 50

The kernel’s interface is a low-level abstraction layer. When a process requests a service from the kernel, it must invoke a system call, usually through a wrapper function.
There are different kernel architecture designs. Monolithic kernels run entirely in a single address space with the CPU executing in supervisor mode, mainly for speed. Microkernels run most but not all of their services in user space,[3] like user processes do, mainly for resilience and modularity.

Answer 50

MINIX 3 is a notable example of microkernel design. Instead, the Linux kernel is monolithic, although it is also modular, for it can insert and remove loadable kernel modules at runtime.

This central component of a computer system is responsible for executing programs. The kernel takes responsibility for deciding at any time which of the many running programs should be allocated to the processor or processors.

Question 51

In any Operating System, it is necessary to have a Dual Mode Operation to ensure the protection and security of the System from unauthorized or errant users.

Answer 51

This Dual Mode separates the User Mode from the System Mode or Kernel Mode.

Question 52

In an operating system, instructions are divided into two categories:

Answer 52

privileged and non-privileged instructions

Question 53

Privileged instructions are those that can only be executed by the operating system kernel or a privileged process, such as a device driver. These instructions typically perform operations that require direct access to hardware or other privileged resources, such as setting up memory mappings or accessing I/O devices.

Answer 53

Privileged instructions are executed in kernel mode, which provides unrestricted access to the system resources.

Question 54

Non-privileged instructions are those that can be executed by any process, including user-level processes. These instructions are typically used for performing computations, accessing user-level resources such as files and memory, and managing process control.

Answer 54

Non-privileged instructions are executed in user mode, which provides limited access to system resources and ensures that processes cannot interfere with one another.

Question 55

The operating system employs access control mechanisms to limit access to privileged instructions. These mechanisms are restricted to authorized processes or users with elevated privileges.

Answer 55

This guarantees that privileged instructions can only be executed by trusted processes and thwarts unauthorized access of malicious programs to system resources.

Question 56

By deploying memory protection techniques, the operating system restricts processes from accessing any memory location that belongs to it or other processes. This aids in preventing tampering with the operating system or other processes by ensuring that processes cannot do so.

Answer 56

Furthermore, it hinders malevolent programs from resulting in system crashes or risking the system’s safety.

Question 57

The execution of privileged instructions like system calls or exceptions is handled by the operating system through interrupt handling to ensure safety and accuracy,

Answer 57

so when an interrupt occurs during the execution of a process it’s necessary to save its state before transferring control to a suitable handler and then restoring it on completion.

Question 58

Using virtualization techniques allows the operating system to create a simulated environment where processes can execute privileged instructions without having direct access to the

Answer 58

underlying hardware thus creating a more secure and isolated execution environment for privileged instructions by limiting process access to authorized hardware resources only.

Question 59

differences between privileged and non-privileged instructions:

Access to resources: Privileged instructions have direct access to system resources, while non-privileged instructions have limited access.

Execution mode: Privileged instructions are executed in kernel mode, while non-privileged instructions are executed in user mode.

Execution permissions: Privileged instructions require special permissions to execute, while non-privileged instructions do not.

Answer 59

Purpose: Privileged instructions are typically used for performing low-level system operations, while non-privileged instructions are used for general-purpose computing.

Risks: Because privileged instructions have access to system resources, they pose a higher risk of causing system crashes or security vulnerabilities if not used carefully. Non-privileged instructions are less risky in this regard.

Question 60

Privileged instructions:
Instructions that can run only in Kernel Mode are called Privileged Instructions .

Answer 60

(i) If any attempt is made to execute a Privileged Instruction in User Mode, then it will not be executed and treated as an illegal instruction. The Hardware traps it in the Operating System.

(ii) Before transferring the control to any User Program, it is the responsibility of the Operating System to ensure that the Timer is set to interrupt. Thus, if the timer interrupts then the Operating System regains control.

Thus, any instruction which can modify the contents of the Timer is Privileged Instruction.

(iii) Privileged Instructions are used by the Operating System in order to achieve correct operation.

Question 61

Examples of privileged instructions

Answer 61

I/O instructions and Halt instructions

Turn off all Interrupts

Set the Timer

Context Switching

Clear the Memory or Remove a process from the Memory

Modify entries in the Device-status table

Question 62

Non-privileged instructions

Answer 62

Instructions that can run only in User Mode are called Non-Privileged Instructions .

Question 63

Examples of non-privileged instructions

Answer 63

Reading the status of Processor

Reading the System Time

Generate any Trap Instruction

Sending the final printout of Printer

Question 64

in order to change the mode from Privileged to Non-Privileged, we require a Non-privileged Instruction that does not generate any ______

Answer 64

interrupt

Question 65

Advantages of privileged and non-privileged instructions

Answer 65

Security: Privileged and non-privileged instructions provide a layer of security by preventing unauthorized access to system resources. Privileged instructions can only be executed by the operating system or other privileged processes, while non-privileged instructions can be executed by user programs.

Stability: Privileged and non-privileged instructions can help to ensure system stability by preventing user programs from interfering with critical system functions. Privileged instructions can only be executed by trusted processes, while non-privileged instructions are restricted in their access to system resources.

Flexibility: Privileged and non-privileged instructions allow operating systems to support a wide range of applications and hardware devices. By providing a well-defined interface between user programs and the operating system, it is easier to develop and deploy new applications and hardware.

Debugging: Privileged and non-privileged instructions make it easier to debug and diagnose problems with the operating system and applications. By providing a clear separation between trusted and untrusted processes, developers can identify and fix issues more quickly and easily.

Performance: By providing direct access to hardware resources, privileged instructions can help to improve system performance by minimizing overhead and reducing latency.

Modularity: The use of privileged and non-privileged instructions helps to promote modularity in operating system design by separating low-level system operations from higher-level computing tasks.

Question 66

Disadvantages of privileged and non-privileged instructions

Answer 66

Overhead: Privileged and non-privileged instructions can introduce overhead and reduce system performance. Switching between privileged and non-privileged modes requires a context switch, which can be time-consuming and can impact system performance.

Complexity: Privileged and non-privileged instructions can increase system complexity and make it more difficult to develop and maintain operating systems. The need to support both privileged and non-privileged instructions can make it more challenging to design and implement system features and to ensure system stability.

Compatibility: Privileged and non-privileged instructions can introduce compatibility issues between different hardware platforms or operating systems. Differences in the way that privileged instructions are implemented can make it difficult to develop applications that work across different platforms.

Vulnerabilities: Privileged instructions have direct access to system resources, which can make them a target for attackers seeking to exploit vulnerabilities in the operating system.

Learning curve: Developers and system administrators may need to learn the specifics of how privileged and non-privileged instructions work in a given operating system, which can add a learning curve and increase the time needed to develop and maintain software.