Protection Ring
System Programming
Muhammad Farooq
BS Computer Science, 7th Semester, Fall 2022
Govt. Postgraduate College Charsadda
Protection Ring
In Computer Science, the ordered protection
domains are referred to as Protection Rings.
These mechanisms help in improving fault
tolerance and provide Computer Security.
Operating Systems provide different levels to
access resources.
Rings are hierarchically arranged from most
privileged to least privileged.
Protection Ring 2
Use of Protection Ring
Use of Protection Rings provides logical space for
the levels of permissions and execution. Two
important uses of Protection Rings are:
Improving Fault Tolerance
Provide Computer Security
Protection Ring 3
What are CPU Protection Privilege
Rings?
Your CPU is protected by a system of privilege rings.
But what does that mean? How do protection
privilege rings enhance computer security?
CPU protection rings are structural layers that limit
interaction between installed applications on a
computer and core processes.
They typically range from the outermost layer,
which is Ring 3, to the innermost layer, which is Ring
0, also referred to as the kernel.
4
What are CPU Protection Privilege
Rings?
Ring 0 is at the core of all system processes. Anyone
who can control the kernel can basically control all
aspects of a computer.
To prevent abuse of this core, computer system
architects limit interaction to this zone. As such,
most processes that can be accessed by a computer
user are limited to Ring 3.
So how do privilege rings work?
Levels of Protection Ring
6
Levels of Protection Ring
There are basically 4 levels ranging from 0 which
is the most privileged to 3 which is least
privileged.
Most Operating Systems use level 0 as the kernel
or executive and use level 3 for application
programs.
A resource that is accessible to level n is also
accessible to levels 0 to n and the privilege levels
are rings
How the Privilege Rings Interact
Ring 0 processes operate in supervisor mode and
so do not require any user input.
Interfering with them could cause major system
errors and unresolvable security issues.
This is why they are deliberately designed to be
inaccessible to computer users.
8
How the Privilege Rings Interact
Let's take Windows as an example:
access to Ring 0 by Ring 3 processes is restricted to a
few data instructions.
To access the kernel, applications in Ring 3 have to
make a connection that is handled by virtualized
memory. Even then, very few applications are
allowed to do this.
They include browsers that require network
access and cameras that need to make a
network connection.
9
How the Privilege Rings Interact
Additionally, these data calls are insulated to
prevent them from directly interfering with vital
system processes.
Some earlier Windows versions (like Windows
95/98) had less shielding between privilege Rings.
This is among the main reasons why they were so
unstable and prone to errors.
In modern systems, kernel memory security is
reinforced by specialized hardware chips.
10
Modes of Protection Ring
There are basically two modes:
Supervisor Mode, and Hypervisor Mode. These are
briefly explained as below:
Supervisor Mode :
In computer terms, supervisor mode is a hardware-
mediated flag that can be changed by code running
in system-level software.
System-level tasks or threads will have this flag set
while they are running, whereas user-level
applications will not.
11
Modes of Protection Ring
Supervisor Mode :
This flag determines whether it would be possible
to execute machine code operations such as
modifying registers for various descriptor tables,
or performing operations such as disabling
interrupts.
The idea of having two different modes to operate
in comes from "with more control comes more
responsibility" – a program in supervisor mode is
trusted never to fail, since a failure may cause the
whole computer system to crash.
12
Modes of Protection Ring
Supervisor Mode :
Supervisor Mode is an execution mode in some of
processors which allows execution of all instructions
including privileged instructions.
It also gives access to different address space, to
memory management hardware, and to other
peripherals.
Usually, Operating System runs in this mode.
In a monolithic kernel, the operating system runs in
supervisor mode and the applications run in user
mode.
13
Modes of Protection Ring
Operating Systems, with an exokernel or
microkernel do not necessarily share this behavior.
Most processors have at least two different modes.
The x86-processors have four different modes
divided into four different rings.
Programs that run in Ring 0 can do anything with
the system, and code that runs in Ring 3 should be
able to fail at any time without impact to the rest of
the computer system.
Ring 1 and Ring 2 are rarely used, but could be
configured with different levels of access.
14
Modes of Protection Ring
Hypervisor Mode:
Modern CPUs offer x86 virtualization instructions for
hypervisor to control “Ring 0” hardware access.
In order to help virtualization, Intel VT-x
(codenamed "Vanderpool") and AMD-v (codename
“Pacifica”) insert new privilege level “Ring - 1” below
“Ring 0” so that a guest operating system can run
Ring 0 operations natively without affecting other
guests or the host OS.
15
Modes of Protection Ring
Hypervisor Mode:
Both these Intel VT-x and AMD-v add nine new
“machine code” instructions that only work on
“Ring −1” and intended to be used by hypervisor.
16
Implementation
Protection Rings are combined with processor
modes against rule of slave in some systems.
Operating system running on hardware that
supports such rules can use both methods of
protecting or only one of them.
Efficient use of architecture of Protection Rings
requires close interaction between hardware and
operating system
17
Implementation
The operating system is designed such that they
have worked on a lot of platforms and may have
different implementation mechanism rings on
each platform.
The security model is generally simplified to two
levels of access
first is level of “core” and
second is level of “user”,
even if hardware providing greater granularity of
performance levels.
18
Features of Protection Ring
Protection Ring follows hierarchy.
Protection Ring provides layered architecture.
Protection Ring provides Computer Security.
Protection Ring provides good Fault Tolerance.
19
Privilege Computing
Privilege level
A privilege level in the x86 instruction set controls
the access of the program currently running on the
processor to resources such as memory regions,
I/O ports, and special instructions.
There are 4 privilege levels ranging from 0 which is
the most privileged, to 3 which is least privileged.
Most modern operating systems use level 0 for the
kernel/executive, and use level 3 for application
programs.
20
Privilege Computing
Privilege level
Any resource available to level n is also available to
levels 0 to n, so the privilege levels are rings.
When a lesser privileged process tries to access a
higher privileged process, a general protection
fault exception is reported to the OS.
It is not necessary to use all four privilege levels.
21
Privilege Computing
Privilege level
Current operating system with wide market share
including Microsoft Windows, macOS, Linux, iOS
and Android mostly use a paging mechanism with
only one bit to specify the privilege level as either
Supervisor or User (U/S Bit).
Windows NT uses the two-level system. The real
mode programs in 8086 are executed at level 0
(highest privilege level) whereas virtual mode in
8086 executes all programs at level 3
22
Privilege Computing
Privilege level
Potential future uses for the multiple privilege
levels supported by the x86 Instruction set
architecture (ISA) family include containerization
and virtual machines.
A host operating system kernel could use
instructions with full privilege access(Kernel
mode), whereas applications running on the guest
OS in a virtual machine or container could use the
lowest level of privileges in user mode.
23
Privilege Computing
Privilege level
The virtual machine and guest OS kernel could
themselves use an intermediate level of instruction
privilege to invoke and virtualize kernel-mode
operations such as system calls from the point of
view of the guest operating system
24
Privilege Computing
IOPL (I/O Privilege level)
The IOPL (I/O
I/O Privilege level)
level flag is a flag found on
all IA-32 compatible x86 CPUs. It occupies bits 12
and 13 in the FLAGS register.
In protected mode and long mode, it shows the I/O
privilege level of the current program or task.
The Current Privilege Level (CPL) (CPL0, CPL1,
CPL2, CPL3) of the task or program must be less
than or equal to the IOPL in order for the task or
program to access I/O ports.
25
Privilege Computing
IOPL (I/O Privilege level)
The IOPL can be changed using POPF(D) and IRET(D)
Instructions only when the current privilege level is
Ring 0.
POPF (Pop Flags), POPFD (Pop Flags double)
IRET/IRETD/IRETQ (Returns program control from an
exception or interrupt handler to a program or procedure
interrupted by an exception, an external interrupt, or
software generated interrupt
Besides IOPL, the I/O Port Permissions in the TSS also
take part in determining the ability of a task to access
an I/O port.
26
Current Windows Kernel Memory
Protections Against Intrusions
Microsoft introduced formidable protections to
kernel memory starting from Windows 10 version
1803.
Among the most notable was Kernel DMA Protection;
the holistic feature was designed to protect personal
computers against Direct Memory Access (DMA)
attacks, particularly those implemented via PCI hot
plugs.
Protection coverage was expanded in build 1903 to
cover internal PCIe ports such as M.2 slots.
27
Current Windows Kernel Memory
Protections Against Intrusions
One of the main reasons Microsoft chose to
provide additional protections to these sectors is
because PCI devices are already DMA-capable out
of the box.
This capability allows them to read and write onto
system memory without requiring system
processor permissions. This property is among the
main reasons why PCI devices have a high
performance.
28
Current Windows Kernel Memory
Protections Against Intrusions
Windows utilizes Input/Output Memory
Management Unit (IOMMU) protocols to block
unauthorized peripherals from performing DMA
operations.
There are, however, exceptions to the rule if their
drivers support memory isolation executed using
DMA Remapping.
29
Current Windows Kernel Memory
Protections Against Intrusions
That said, additional permissions are still required.
Typically, the OS administrator will be prompted to
provide DMA authorization.
To further modify and automate related processes,
DmaGuard MDM policies can be changed by IT
specialists to determine how incompatible DMA
Remapping drivers will be handled.
30
Current Windows Kernel Memory
Protections Against Intrusions
To check if your system has Kernel DMA Protection
in place, use Security Center and view the settings in
Core Isolation Details under Memory Access
Protection.
It is important to note that only operating systems
released later than Windows 10 version 1803 have
this feature.
31
Why CPUs Rarely Rely on Ring 1 and
2 Privileges
Rings 1 and 2 are largely used by drivers and guest
operating systems. Most of the code in these
privilege levels have also been semi-repurposed.
As such, the majority of contemporary Windows
programs operate as if the system has only two
levels
the kernel and
user levels.
Virtualization applications such as Virtual Box and
Virtual Machine utilize Ring 1 to operate.
32
A Last Word on Privileges
The multiple privilege rings design came about due
to x86 system architecture.
It is, however, inconvenient to use all Ring privilege
levels all the time.
This would lead to increased latency and
compatibility issues.
33