Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I can't imagine it's a standard thing.

On X86 we have ring 0 and 3, with 1 and 2 never used and removed in newer CPUs. ARM has 3 or 4 privilege layers, but they're named differently.

They probably just called it ring -2 because it's a couple layers below ring 0.



Arm (Aarch64) Exception Level 0 corresponds to Ring 3 of x86.

Arm (Aarch64) Exception Level 1 corresponds to Ring 0 of x86.

Arm (Aarch64) Exception Level 2 corresponds to the Hypervisor level a.k.a. Ring -1 of x86.

Arm (Aarch64) Exception Level 3 corresponds to the System Management Mode a.k.a. Ring -2 of x86.

Fortunately, in Arm EL3 the same instruction set is used as in any other level, unlike in x86, where SMM uses the obsolete 16-bit 8086 ISA, so for compiling programs that will be executed in SMM you have to use a special tool set.

Unfortunately, both the Arm EL3 and the x86 SMM allow the manufacturers of computing devices to do things that are either stupid or in direct contradiction with the interests of the owners of the devices and the owners may not be able to do anything to correct this, unless they can exploit vulnerabilities like the one that has now been patched by AMD.

There are no valid arguments for the existence of SMM and EL3 and the fact that they are not forbidden by law is a disgrace for the computing industry.

Arm EL3 has been created as an imitation of the Intel SMM. The Intel SMM has been created because Microsoft was too lazy to introduce the required power management functions in the Windows and MS-DOS operating systems, so they passed the task to the motherboard or laptop manufacturers, for which Intel has provided SMM, to enable this.


Ring -1 is the host system / virtual machine manager when the ring 0 OS is running as a VM. Ring -2 is more privileged than that since it can interrupt Ring -1 and can affect the execution of VM instructions.


Rings 1 and 2 are still very much present in your desktop x86 machine; Your OS just doesn't use them. X86-S will remove them, but no CPUs implement that reduced architecture, and Intel has made no public announcements about future generations that will.


Existing supervisors use 0, so when x86 virtualization was invented they added -1 for hypervisors. and so... are the monitors running on ring -2 ultravisors?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: