CPU modes

CPU modes

CPU modes (also called "processor modes" or "CPU privilege levels," and by other names) are operating modes for the central processing unit of some computer architectures that place restrictions on the operations that can be performed by the process currently running in the CPU. This design allows the operating system to run at different privilege levels. These different privilege levels are called rings when referring to their implementation at the OS abstraction level, while CPU modes when referring to their implementation at the cpu firmware abstraction level.

In principle, implementing hardware supported CPU modes correctly in the operating system code and in applications should make it impossible to introduce viruses, spyware, and/or similar malware as only very specific and limited "kernel" code would run unrestricted. Any other software (including portions of the operating system) would run restricted and would have to ask the "kernel" for permission to modify anything that could compromise the system. Multiple mode levels could be designed - including a mode zero which basically would only get control if the operating "kernel" at level 1 would be in trouble. All applications/drivers/etc. should run at a level well above the operating system kernel and be "severely" restricted in what they can do to the hardware and real memory. Real memory locations write access should also belong to a specific mode level - i.e. write access to a lower level memory (higher privilege level) location should be impossible (this should be checked by the hardware).

Mode types

At a minimum, any CPU with this type of architecture will support at least two distinct operating modes, and at least one of the modes will provide completely unrestricted operation of the CPU. The unrestricted mode is usually called "kernel mode," but many other designations exist ("master mode," "supervisor mode," "privileged mode" etc.). Other modes are usually called "user modes," but are occasionally known by other names ("slave mode" etc.).

In kernel mode, the CPU may perform any operation provided for by its architecture. Any instruction may be executed, any I/O operation may be initiated, any area of memory may be accessed, and so on. In the other CPU modes, certain restrictions on CPU operations are enforced by the hardware. Typically certain instructions are not permitted, I/O operations may not be initiated, some areas of memory cannot be accessed etc. Usually the user-mode capabilities of the CPU are a subset of the kernel mode capabilities, but in some cases (such as hardware emulation of non-native architectures), they may be significantly different from kernel capabilities, and not just a subset of them.

At least one user mode is always defined, but some CPU architectures support multiple user modes, often with a hierarchy of privileges. These architectures are often said to have "ring-based security," wherein the hierarchy of privileges resembles a set of concentric rings, with the kernel mode in the central, innermost ring. Multics hardware was the first significant implementation of ring security, but many other hardware platforms have been designed along similar lines, including the Intel 80286 protected mode, and the IA-64 as well, though it is referred to by a different name in these cases.

Mode protection may extend to resources beyond the CPU processing hardware itself. Hardware registers track the current operating mode of the CPU, but additional virtual-memory registers, page-table entries, and other data may track mode identifiers for other resources. For example, a CPU may be operating in Ring 0 as indicated by a status word in the CPU itself, but every access to memory may additionally be validated against a separate ring number for the virtual-memory segment targeted by the access, and/or against a ring number for the physical page (if any) being targeted. This has been demonstrated with the PSP handheld system.

For details about interoperation between CPU and OS levels of abstraction, see the dedicated section in the Ring (computer security) article.

Hardware that supports the Popek and Goldberg virtualization requirements makes writing software to efficiently support a virtual machine much simpler.Such a system can run software that "believes" it is running in supervisor mode, but is actually running in user mode.

Wikimedia Foundation. 2010.

Look at other dictionaries:

  • CPU-Z — CPUID Développeur Franck Delattre …   Wikipédia en Français

  • Idle (CPU) — A computer processor is described as idle when it is not being used by any program.Programs which make use of CPU Idle Time mean that they run at a low priority so as not to impact programs which run at normal priority. Many programs that use CPU …   Wikipedia

  • Ring (computer security) — In computer science, hierarchical protection domains, [Paul A. Karger, Andrew J. Herbert, [http://doi.ieeecomputersociety.org/10.1109/SP.1984.10001 An Augmented Capability Architecture to Support Lattice Security and Traceability of Access] , sp …   Wikipedia

  • Operating system — Operating systems …   Wikipedia

  • Protected mode — This article is about an x86 processor mode. For Internet Explorer Protected Mode, see Mandatory Integrity Control. x86 processor modes Mode First supported Real mode Intel 8086 8080 emulation mode NEC …   Wikipedia

  • Booting — This article is about bootstrapping operating systems. For the general concept, see Bootstrapping. For other uses, see Booting (disambiguation). In computing, booting (also known as booting up) is a process that begins when a user turns on a… …   Wikipedia

  • Process management (computing) — Operating systems …   Wikipedia

  • Memory management unit — This 68451 MMU could be used with the Motorola 68010 A memory management unit (MMU), sometimes called paged memory management unit (PMMU), is a computer hardware component responsible for handling accesses to memory requested by the CPU. Its… …   Wikipedia

  • Microkernel — Structure of monolithic and microkernel based operating systems, respectively In computer science, a microkernel is the near minimum amount of software that can provide the mechanisms needed to implement an operating system (OS). These mechanisms …   Wikipedia

  • Scheduling (computing) — This article is about processes assignment in operating systems. For other uses, see Scheduling (disambiguation). Scheduling is a key concept in computer multitasking, multiprocessing operating system and real time operating system designs.… …   Wikipedia

Share the article and excerpts

Direct link
Do a right-click on the link above
and select “Copy Link”

We are using cookies for the best presentation of our site. Continuing to use this site, you agree with this.