保护环与权限
了解 x86 的权限级别（保护环），以及它们如何在操作系统与用户应用程序之间实施隔离和安全保护。
保护环与权限 是 CoddyKit 上的免费 Assembly Language & x86 Low-Level Systems Programming 课时。 这是第 2 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 Assembly Language & x86 Low-Level Systems Programming 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 Assembly Language & x86 Low-Level Systems Programming 课程共包含 4 节课。
本课时的部分内容尚未翻译，以英文显示。
Intro: Protection Rings
Ever wondered how your apps are kept separate from the operating system? Or how a malicious program can't just take over your computer?
The answer lies in privilege rings, a core security feature of x86 processors!
Why Rings? Security!
Privilege rings create a hierarchical structure for software execution. Think of them as security levels.
- Isolation: Prevent user programs from crashing the OS.
- Security: Protect critical system resources.
- Stability: Ensure the system runs reliably.
Ring 0: The Kernel
Ring 0 is the most privileged level. It's where the operating system's kernel resides.
The kernel has direct access to all hardware, memory, and CPU features. It's the ultimate authority, managing everything without restrictions.
Ring 3: User Applications
Ring 3 is the least privileged level. This is where most of your everyday applications run.
User applications have limited access to hardware and memory. They must request services from the kernel (Ring 0) to perform privileged operations.
The x86 Ring Hierarchy
The x86 architecture defines 4 privilege levels: Ring 0, Ring 1, Ring 2, and Ring 3.
However, modern operating systems like Linux and Windows typically only use:
- Ring 0: For the OS kernel.
- Ring 3: For user applications.
Rings 1 and 2 are usually unused, simplifying the model for most systems.
CPL: Current Privilege
The CPU tracks the Current Privilege Level (CPL) of the currently executing code.
The CPL is stored in the Code Segment (CS) register, specifically in the lower two bits. It tells the CPU which ring the program is currently operating in.
DPL: Segment Privilege
Every segment descriptor (which defines memory segments) has a Descriptor Privilege Level (DPL).
The DPL specifies the minimum privilege level required to access that segment. For instance, a Ring 0 code segment would have a DPL of 0.
RPL: Requestor Privilege
The Requestor Privilege Level (RPL) indicates the privilege level of the code that requested access to a segment.
The CPU uses CPL, DPL, and RPL to enforce security rules. For example, a Ring 3 program cannot load a Ring 0 code segment, even if it tries to trick the system.
Ring Transitions: Syscalls
How does a Ring 3 application ask the Ring 0 kernel to do something privileged, like writing to a file?
It uses a controlled mechanism called a system call (or syscall). Syscalls are like "gates" that allow safe, limited transitions to a higher privilege level and back.
IOPL: I/O Port Control
Direct hardware I/O via IN and OUT instructions is highly privileged. A user-mode program (Ring 3) attempting this will typically cause a General Protection Fault.
The CPU checks the I/O Privilege Level (IOPL) in the EFLAGS register. If the Current Privilege Level (CPL) is numerically less than or equal to IOPL, direct I/O is allowed. Otherwise, the operation is blocked.
This example tries to read from an I/O port. On a modern OS, this will likely fail with a protection fault or be terminated. It demonstrates the restriction:
; This example illustrates a privileged I/O attempt.
; It is specific to Linux (using int 0x80 for syscalls).
section .data
msg db "Attempting privileged I/O...", 0xA
len equ $ - msg
section .text
global _start
_start:
; Print message using a system call (Ring 3 -> Ring 0 transition)
mov eax, 4 ; sys_write
mov ebx, 1 ; stdout file descriptor
mov ecx, msg ; address of string
mov edx, len ; length of string
int 0x80 ; Invoke Linux kernel (syscall)
; Attempt to read from I/O port 0x60 (e.g., keyboard data)
; This instruction requires sufficient privilege (IOPL <= CPL)
; In a typical Ring 3 user program, this will cause a fault.
in al, 0x60 ; !!! PRIVILEGED INSTRUCTION !!!
; Exit program using a system call
mov eax, 1 ; sys_exit
xor ebx, ebx ; exit code 0
int 0x80 ; Invoke Linux kernel (syscall)Privilege Ring Check
Let's test your understanding of privilege rings!
Recap: Rings & Security
Great job! You've learned about x86 privilege rings.
- Ring 0: OS Kernel, highest privilege.
- Ring 3: User applications, lowest privilege.
- CPL, DPL, RPL: CPU mechanisms for privilege checking.
- System Calls: Controlled transitions to higher privileges.
- IOPL: Restricts direct I/O access.
These rings are fundamental for system security and stability by isolating different software components.
常见问题解答
「保护环与权限」课时是免费的吗？
是的 — 「保护环与权限」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 Assembly Language & x86 Low-Level Systems Programming 课程的其余内容，请升级到 CoddyKit PRO。 Assembly Language & x86 Low-Level Systems Programming 课程共包含 4 节课。
「保护环与权限」这节课中我会学到什么？
了解 x86 的权限级别（保护环），以及它们如何在操作系统与用户应用程序之间实施隔离和安全保护。 你通过在浏览器中直接运行的动手代码来练习 Assembly Language & x86 Low-Level Systems Programming，全天候 AI 导师会在你学习这节课的过程中回答你的问题。
学习 Assembly Language & x86 Low-Level Systems Programming 需要有经验吗？
无需任何先前经验。CoddyKit 上的 Assembly Language & x86 Low-Level Systems Programming 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 2 节课，共 4 节。
「保护环与权限」课时需要多长时间？
大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。
我能在这节 Assembly Language & x86 Low-Level Systems Programming 课中编写并运行代码吗？
能。每节 Assembly Language & x86 Low-Level Systems Programming 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。