Just terminology. Whenever a new higher-privileged entity is created, it is sometimes described as a negative ring.
There was a time when people thought if we could put the secure code in a lower ring, then with it we could protect the rest of the system. With virtualization, the hypervisor is in ring -1, which is technically not a ring, but rather a mode called VMX root operation, post-VMXON. This enables things like the blue pill attack, where the hypervisor is itself presented with a false image of the underlying physical hardware, by a malicious layer. You can find the same pattern in ARM TrustZone, where the secure code is repeatedly broken.
It's the same reason that the nominal thrust level on the Space Shuttle Main Engines is 104.5%[1].
No, not 100% (it was originally), 104.5%. Why? Because you don't go back and change all your rules and documentation following subsequent developments in the field, that causes unnecessary confusion and errors down the road.
I don't think there actually are, in the sense that there isn't a register somewhere with these values that gets compared against, the way there is with rings 0-3. I've only heard this in the context of reverse engineers describing the layers of access that undocumented parts of a modern CPU system have, I think it's just a made-up analogy. There is presumably some proprietary documentation out there with more official names.
Arm (Aarch64) Exception Level 0 corresponds to Ring 3 of x86.
Arm (Aarch64) Exception Level 1 corresponds to Ring 0 of x86.
Arm (Aarch64) Exception Level 2 corresponds to the Hypervisor level a.k.a. Ring -1 of x86.
Arm (Aarch64) Exception Level 3 corresponds to the System Management Mode a.k.a. Ring -2 of x86.
Fortunately, in Arm EL3 the same instruction set is used as in any other level, unlike in x86, where SMM uses the obsolete 16-bit 8086 ISA, so for compiling programs that will be executed in SMM you have to use a special tool set.
Unfortunately, both the Arm EL3 and the x86 SMM allow the manufacturers of computing devices to do things that are either stupid or in direct contradiction with the interests of the owners of the devices and the owners may not be able to do anything to correct this, unless they can exploit vulnerabilities like the one that has now been patched by AMD.
There are no valid arguments for the existence of SMM and EL3 and the fact that they are not forbidden by law is a disgrace for the computing industry.
Arm EL3 has been created as an imitation of the Intel SMM. The Intel SMM has been created because Microsoft was too lazy to introduce the required power management functions in the Windows and MS-DOS operating systems, so they passed the task to the motherboard or laptop manufacturers, for which Intel has provided SMM, to enable this.
Ring -1 is the host system / virtual machine manager when the ring 0 OS is running as a VM. Ring -2 is more privileged than that since it can interrupt Ring -1 and can affect the execution of VM instructions.
Rings 1 and 2 are still very much present in your desktop x86 machine; Your OS just doesn't use them. X86-S will remove them, but no CPUs implement that reduced architecture, and Intel has made no public announcements about future generations that will.
Existing supervisors use 0, so when x86 virtualization was invented they added -1 for hypervisors. and so... are the monitors running on ring -2 ultravisors?
Comments
Wait, there are negative rings!? I'd like to learn more about this but it's not a very easy to search term. Any pointers?
Just terminology. Whenever a new higher-privileged entity is created, it is sometimes described as a negative ring.
There was a time when people thought if we could put the secure code in a lower ring, then with it we could protect the rest of the system. With virtualization, the hypervisor is in ring -1, which is technically not a ring, but rather a mode called VMX root operation, post-VMXON. This enables things like the blue pill attack, where the hypervisor is itself presented with a false image of the underlying physical hardware, by a malicious layer. You can find the same pattern in ARM TrustZone, where the secure code is repeatedly broken.
"if only we had ring -N"
Crazy complexity. Mind blown!
It's the same reason that the nominal thrust level on the Space Shuttle Main Engines is 104.5%[1].
No, not 100% (it was originally), 104.5%. Why? Because you don't go back and change all your rules and documentation following subsequent developments in the field, that causes unnecessary confusion and errors down the road.
[1]: https://en.wikipedia.org/wiki/RS-25#Engine_throttle/output
Likewise. Engineers do not idle well.
Good article on negative rings:
https://medium.com/swlh/negative-rings-in-intel-architecture...
I don't think there actually are, in the sense that there isn't a register somewhere with these values that gets compared against, the way there is with rings 0-3. I've only heard this in the context of reverse engineers describing the layers of access that undocumented parts of a modern CPU system have, I think it's just a made-up analogy. There is presumably some proprietary documentation out there with more official names.
I can't imagine it's a standard thing.
On X86 we have ring 0 and 3, with 1 and 2 never used and removed in newer CPUs. ARM has 3 or 4 privilege layers, but they're named differently.
They probably just called it ring -2 because it's a couple layers below ring 0.
Arm (Aarch64) Exception Level 0 corresponds to Ring 3 of x86.
Arm (Aarch64) Exception Level 1 corresponds to Ring 0 of x86.
Arm (Aarch64) Exception Level 2 corresponds to the Hypervisor level a.k.a. Ring -1 of x86.
Arm (Aarch64) Exception Level 3 corresponds to the System Management Mode a.k.a. Ring -2 of x86.
Fortunately, in Arm EL3 the same instruction set is used as in any other level, unlike in x86, where SMM uses the obsolete 16-bit 8086 ISA, so for compiling programs that will be executed in SMM you have to use a special tool set.
Unfortunately, both the Arm EL3 and the x86 SMM allow the manufacturers of computing devices to do things that are either stupid or in direct contradiction with the interests of the owners of the devices and the owners may not be able to do anything to correct this, unless they can exploit vulnerabilities like the one that has now been patched by AMD.
There are no valid arguments for the existence of SMM and EL3 and the fact that they are not forbidden by law is a disgrace for the computing industry.
Arm EL3 has been created as an imitation of the Intel SMM. The Intel SMM has been created because Microsoft was too lazy to introduce the required power management functions in the Windows and MS-DOS operating systems, so they passed the task to the motherboard or laptop manufacturers, for which Intel has provided SMM, to enable this.
Ring -1 is the host system / virtual machine manager when the ring 0 OS is running as a VM. Ring -2 is more privileged than that since it can interrupt Ring -1 and can affect the execution of VM instructions.
Rings 1 and 2 are still very much present in your desktop x86 machine; Your OS just doesn't use them. X86-S will remove them, but no CPUs implement that reduced architecture, and Intel has made no public announcements about future generations that will.
Existing supervisors use 0, so when x86 virtualization was invented they added -1 for hypervisors. and so... are the monitors running on ring -2 ultravisors?
It's called System Management Mode, it's in official Intel documentation for x86.