3 ms·

Wait, there are negative rings!? I'd like to learn more about this but it's not a very easy to search term. Any pointers?

by kaoD 2y ago

veltas 2y ago
It's called System Management Mode, it's in official Intel documentation for x86.
BearOso 2y ago
I can't imagine it's a standard thing. On X86 we have ring 0 and 3, with 1 and 2 never used and removed in newer CPUs. ARM has 3 or 4 privilege layers, but they're named differently. They probably just called it ring -2 because it's a couple layers below ring 0.
- okanat 2y ago
  Ring -1 is the host system / virtual machine manager when the ring 0 OS is running as a VM. Ring -2 is more privileged than that since it can interrupt Ring -1 and can affect the execution of VM instructions.
- adrian_b 2y ago
  Arm (Aarch64) Exception Level 0 corresponds to Ring 3 of x86. Arm (Aarch64) Exception Level 1 corresponds to Ring 0 of x86. Arm (Aarch64) Exception Level 2 corresponds to the Hypervisor level a.k.a. Ring -1 of x86. Arm (Aarch64) Exception Level 3 corresponds to the System Management Mode a.k.a. Ring -2 of x86. Fortunately, in Arm EL3 the same instruction set is used as in any other level, unlike in x86, where SMM uses the obsolete 16-bit 8086 ISA, so for compiling programs that will be executed in SMM you have to use a special tool set. Unfortunately, both the Arm EL3 and the x86 SMM allow the manufacturers of computing devices to do things that are either stupid or in direct contradiction with the interests of the owners of the devices and the owners may not be able to do anything to correct this, unless they can exploit vulnerabilities like the one that has now been patched by AMD. There are no valid arguments for the existence of SMM and EL3 and the fact that they are not forbidden by law is a disgrace for the computing industry. Arm EL3 has been created as an imitation of the Intel SMM. The Intel SMM has been created because Microsoft was too lazy to introduce the required power management functions in the Windows and MS-DOS operating systems, so they passed the task to the motherboard or laptop manufacturers, for which Intel has provided SMM, to enable this.
- numpad0 2y ago
  Existing supervisors use 0, so when x86 virtualization was invented they added -1 for hypervisors. and so... are the monitors running on ring -2 ultravisors?
- colejohnson66 2y ago
  Rings 1 and 2 are still very much present in your desktop x86 machine; Your OS just doesn't use them. X86-S will remove them, but no CPUs implement that reduced architecture, and Intel has made no public announcements about future generations that will.
  - deleted 2y ago
    [deleted]
hypeatei 2y ago
Good article on negative rings: https://medium.com/swlh/negative-rings-in-intel-architecture-the-security-threats-youve-probably-never-heard-of-d725a4b6f831 https://medium.com/swlh/negative-rings-in-intel-architecture...
dooglius 2y ago
I don't think there actually are, in the sense that there isn't a register somewhere with these values that gets compared against, the way there is with rings 0-3. I've only heard this in the context of reverse engineers describing the layers of access that undocumented parts of a modern CPU system have, I think it's just a made-up analogy. There is presumably some proprietary documentation out there with more official names.
ngneer 2y ago
Just terminology. Whenever a new higher-privileged entity is created, it is sometimes described as a negative ring. There was a time when people thought if we could put the secure code in a lower ring, then with it we could protect the rest of the system. With virtualization, the hypervisor is in ring -1, which is technically not a ring, but rather a mode called VMX root operation, post-VMXON. This enables things like the blue pill attack, where the hypervisor is itself presented with a false image of the underlying physical hardware, by a malicious layer. You can find the same pattern in ARM TrustZone, where the secure code is repeatedly broken. "if only we had ring -N"
- dwoldrich 2y ago
  Crazy complexity. Mind blown!
  - Dalewyn 2y ago
    It's the same reason that the nominal thrust level on the Space Shuttle Main Engines is 104.5%[1]. No, not 100% (it was originally), 104.5%. Why? Because you don't go back and change all your rules and documentation following subsequent developments in the field, that causes unnecessary confusion and errors down the road. [1]: https://en.wikipedia.org/wiki/RS-25#Engine_throttle/output https://en.wikipedia.org/wiki/RS-25#Engine_throttle/output
  - ngneer 2y ago
    Likewise. Engineers do not idle well.

Wait, there are negative rings!? I'd like to learn more about this but it's not a very easy to search term. Any pointers?

by kaoD 2y ago

Wait, there are negative rings!? I'd like to learn more about this but it's not a very easy to search term. Any pointers?

veltas 2y ago

It's called System Management Mode, it's in official Intel documentation for x86.

BearOso 2y ago

I can't imagine it's a standard thing. On X86 we have ring 0 and 3, with 1 and 2 never used and removed in newer CPUs. ARM has 3 or 4 privilege layers, but they're named differently. They probably just called it ring -2 because it's a couple layers below ring 0.

okanat 2y ago
Ring -1 is the host system / virtual machine manager when the ring 0 OS is running as a VM. Ring -2 is more privileged than that since it can interrupt Ring -1 and can affect the execution of VM instructions.
adrian_b 2y ago
Arm (Aarch64) Exception Level 0 corresponds to Ring 3 of x86. Arm (Aarch64) Exception Level 1 corresponds to Ring 0 of x86. Arm (Aarch64) Exception Level 2 corresponds to the Hypervisor level a.k.a. Ring -1 of x86. Arm (Aarch64) Exception Level 3 corresponds to the System Management Mode a.k.a. Ring -2 of x86. Fortunately, in Arm EL3 the same instruction set is used as in any other level, unlike in x86, where SMM uses the obsolete 16-bit 8086 ISA, so for compiling programs that will be executed in SMM you have to use a special tool set. Unfortunately, both the Arm EL3 and the x86 SMM allow the manufacturers of computing devices to do things that are either stupid or in direct contradiction with the interests of the owners of the devices and the owners may not be able to do anything to correct this, unless they can exploit vulnerabilities like the one that has now been patched by AMD. There are no valid arguments for the existence of SMM and EL3 and the fact that they are not forbidden by law is a disgrace for the computing industry. Arm EL3 has been created as an imitation of the Intel SMM. The Intel SMM has been created because Microsoft was too lazy to introduce the required power management functions in the Windows and MS-DOS operating systems, so they passed the task to the motherboard or laptop manufacturers, for which Intel has provided SMM, to enable this.
numpad0 2y ago
Existing supervisors use 0, so when x86 virtualization was invented they added -1 for hypervisors. and so... are the monitors running on ring -2 ultravisors?
colejohnson66 2y ago
Rings 1 and 2 are still very much present in your desktop x86 machine; Your OS just doesn't use them. X86-S will remove them, but no CPUs implement that reduced architecture, and Intel has made no public announcements about future generations that will.
- deleted 2y ago
  [deleted]

hypeatei 2y ago

Good article on negative rings: https://medium.com/swlh/negative-rings-in-intel-architecture-the-security-threats-youve-probably-never-heard-of-d725a4b6f831 https://medium.com/swlh/negative-rings-in-intel-architecture...

dooglius 2y ago

I don't think there actually are, in the sense that there isn't a register somewhere with these values that gets compared against, the way there is with rings 0-3. I've only heard this in the context of reverse engineers describing the layers of access that undocumented parts of a modern CPU system have, I think it's just a made-up analogy. There is presumably some proprietary documentation out there with more official names.

ngneer 2y ago

Just terminology. Whenever a new higher-privileged entity is created, it is sometimes described as a negative ring. There was a time when people thought if we could put the secure code in a lower ring, then with it we could protect the rest of the system. With virtualization, the hypervisor is in ring -1, which is technically not a ring, but rather a mode called VMX root operation, post-VMXON. This enables things like the blue pill attack, where the hypervisor is itself presented with a false image of the underlying physical hardware, by a malicious layer. You can find the same pattern in ARM TrustZone, where the secure code is repeatedly broken. "if only we had ring -N"

dwoldrich 2y ago
Crazy complexity. Mind blown!
- Dalewyn 2y ago
  It's the same reason that the nominal thrust level on the Space Shuttle Main Engines is 104.5%[1]. No, not 100% (it was originally), 104.5%. Why? Because you don't go back and change all your rules and documentation following subsequent developments in the field, that causes unnecessary confusion and errors down the road. [1]: https://en.wikipedia.org/wiki/RS-25#Engine_throttle/output https://en.wikipedia.org/wiki/RS-25#Engine_throttle/output
- ngneer 2y ago
  Likewise. Engineers do not idle well.