What is kernel mode?

re: What is kernel mode?

Mukesh Modi — Thu, 01 Feb 2007 13:13:43 GMT

Nice article

thank you very much loh

re: What is kernel mode?

TM Ningen — Fri, 02 Feb 2007 11:14:05 GMT

I actually have a question about the safety of 5.0 kernel mode. It looks like when an (untrusted) app makes a system call, e.g., FS_CreateFileW, the thread will execute in kernel mode (or with the premission of a priviledged process) but still uses the user stack. I presume the user stack is writable by the user code, since it lives in the application's "memory slot".

Wouldn't it be possible for the user application to corrupt the stack (using another concurrent user thread) while one of its threads is in a system call? This seems quite scary to me. If you manage to modify a return address, you can start executing in kernel mode (or at least with the permissions of filesys.exe, in the case of FS_CreateFileW).

re: What is kernel mode?

ce_base — Fri, 02 Feb 2007 20:40:53 GMT

Excellent question!

I haven't actually mentioned this fact before, but when a thread "jumps" into a system process to call an API, the kernel actually allocates a new stack inside the system process in order to execute the API call. To prevent the caller from tampering with the stack asynchronously during the API call. It switches back to the caller's stack when the API call returns.

This was not always true. I had to ask Bor-Ming, our primary kernel developer, about it, and he tells me that this stack-switching was added in Windows CE 4.0.

Sue

re: What is kernel mode?

Dean Ramsier — Thu, 08 Feb 2007 23:31:13 GMT

Actually, in CE kernel mode threads do run with elevated processor privileges although you're correct in saying that's not how the term is normally used in CE.

Exactly how kernel mode is implemented is processor architecture dependent. On ARM processors, all processor modes except for the user mode are privileged. The different privileged modes are not more or less privileged than the others, they are just different modes that allow fast switching between different contexts (interrupts, exceptions etc). The privileged modes allow the caller to execute instructions that aren't valid in the normal user mode.

The vast majority of the time we are correct in saying that "kernel mode" just means having privileges in the upper 2GB of memory space, but there really is more to it than that and the differences are cpu architecture specific.

Regards,

Dean

re: What is kernel mode?

ce_base — Fri, 09 Feb 2007 00:07:54 GMT

Fair enough, thanks for the correction Dean!

Sue