Windows kernel memory protection

Question

In Windows the high memory of every process (0x80000000 or 0xc0000000) Is reserved for kernel code, user code cannot access these regions of memory, if it tries so an access violation exception will be thrown.

I wish to know how is the kernel space protected ?

Is it via memory segmentations or via paging ?

I would like to hear a technical explanation.

Thanks a lot, Michael.

Answer 1

Assuming you are talking about x86 and x64 architectures.

Memory protection is achieved using the paging system. Each page table entry on an x86/x64 CPU has a bit to indicate whether it is a user or supervisor page. Accesses to supervisor pages are only permitted for code running with CPL<3, whereas accesses to non supervisor pages are possible regardless of CPL.

CPL is the "Current Privilege Level" which is sometimes referred to as Ring. Windows only uses two rings, although the CPU implements 4. Ring 0 is the CPU mode in which what Windows refers to as "kernel mode" runs. Ring 3 is the CPU mode in which "User mode" runs. Since code running at CPL=3 cannot access supervisor pages, this is how memory protection is implemented.

The answer for ARM is likely to be similar, but different.