Questions 1 and 2 Kindly, please please please provide a clear comprehensive exp

Question

Questions 1 and 2
Kindly, please please please provide a clear comprehensive explanation for the answers wither the answer is true or false. Memory protection mechanisms provided in the x86 architecture help us isolate the trusted computing base (TCB) from untrusted application code. This is achieved because the hardware checks a variety of bits at the time segment selector registers are loaded when the processor executes in the protected mode. These include current privilege level (CPL), descriptor privilege level (DPL) and requestor privilege level (RPL) 1. Answer if the following statements are true or false. Provide a brief explanation to justify your answer. (25 pts., 5 pts. for each part) a. The CPL bits are always the same as the DPL of the currently executing b. The DPL of a data segment accessible to the currently executing code can c. If a non-conforming kernel code segment is being executed currently, CPL d. RPL can be used to ensure that kernel code (e.g, a driver) does not have code segment. be smaller than the CPL may be higher than O. access to a data segment with DPL 2 when the code is being executed on behalf of application code with DPL 3. A single segment contains all code and data. In this case, it is possible to separate user and kernel code/data using the page protection level mechanism of x86. e. soparalte user and kernel cod/datng the page protection level

Explanation / Answer

Question 1:

            We are just doing a rewording of the question to make sure that we have understood it properly.

            The computer hardware somehow splits the TCB (Trusted Computing Base) from the application codes (for example arraySort.c – a small a C program to sort an array written in turbo C ++ compiler – this code could have memory leaks or even un trusted system calls).

            How the above separation is achieved? It is as follows:

The hardware checks many BITS at the time of loading segment sector registers.

During this time, the processor executes at the protected mode. (For example, you might have seen this in your PC running windows OS. If the system crashes, during the next re boot it will ask you the following options:

Whether to start the system in

This is to give a chance for the system to repair)

So, a similar functionality occurs at the time when processor executes in protected mode.

There are references to CPL, DPL and RPL.

CPL = Current Privilege Level.

DPL = Descriptor Privilege Level.

RPL = Requestor Privilege Level.

Which means the processor checks all the 3 above PLs (=Privilege Levels).

To understand whether the above is true or false, let us dissect the CPL and DPL.

The Privilege Level – IOPL = Input / Output Privilege Level may also be called as Requestor Privilege Level (RPL).

There are 4 levels of privileges from 0 to 3

3 = lowest privilege and 0 = highest privilege.

DPL is stored in the descriptor of each segment.

CPL determines the privilege level of CPU that is the level of privilege at that the CPU is presently running at the moment. (Sometimes they call it as a ring – they say that the program is running at this ring now.) This is obvious because the hard disk is divided into sectors.

            Please recollect the following knowledge about the hard disks:

But we are focusing on the segment which is more related to the OS (= Operating System)

It stores base, limit, type and the privilege level. Hence there are 4 bits.

Hence 1.a is true, because the CPL is same as the DPL usually or normally. When the privilege is same the bits must be the same as well.

1. b) Whether DPL can be smaller the CPL? True, yes it is possible some times.

In the case 80386:

            DPL must be > CPL. ( please refer to: http://www.logix.cz/michal/doc/i386/chp06-03.htm )

            Usually CPL will be equal to DPL . But some times DPL can become < CPL provided the confirming bit is set.

Hence 1.b is also true

For 8086:

true because, during stack switching ( section 6.3.4.1 of http://www.logix.cz/michal/doc/i386/chp06-03.htm ) , CPL can be at the PLs of 0 to 2 hence it can be > 0

1 d:

1.e) Can you separate user code and kernel code using page protection level mechanism of x86?

please refer to http://duartes.org/gustavo/blog/post/cpu-rings-privilege-and-protection/ and

http://www3.cs.stonybrook.edu/~porter/courses/cse506/f11/slides/x86-paging.pdf

yes, technically it is possible to split these 2 codes - namely the kernel coe from the user code

Related Questions

Navigate

• Browse (All)
• Browse Q
• Subjects

---

---

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.