Introduction

The Linux Kernel is not just “software.” It is the Hardware Abstraction Layer that prevents your computer from devolving into electrical chaos.

Most developers treat the Kernel as a black box. You call read(), and data appears. But understanding the boundary between your code and the hardware (the line between User Space and Kernel Space) is the difference between a Junior Engineer and a Systems Architect.

This lesson explores the Physics of Privilege: How the CPU physically prevents your code from accessing memory it shouldn’t, and what actually happens when you cross that line.

---

The Physics: Privilege Levels (Ring 0 vs Ring 3)

The concept of “User Space” and “Kernel Space” is not a software abstraction. It is a Hardware Reality.

x86 CPUs track the Current Privilege Level (CPL) in the CS (Code Segment) register. The bottom 2 bits of this register determine the Ring Level.

• Ring 0 (Kernel Mode): Access to ALL memory instructions and hardware ports.
• Ring 3 (User Mode): Restricted. Cannot touch CR3 (Page Table Base), cannot execute HLT (Halt CPU), cannot access hardware IO ports.

The Hardware Enforcer

If your compiled Node.js or Python code attempts to execute a privileged instruction (like disabling interrupts CLI), the CPU hardware itself checks the CPL.

1. CPL is 3.
2. Instruction requires CPL 0.
3. Result: The CPU throws a #GP (General Protection Fault).
4. The Kernel catches this fault and sends SIGSEGV (Segmentation Fault) to your process. You die.

---

The Crossing: The syscall Opcode

How does a Ring 3 application ask the Ring 0 kernel to do something (like read a file)? It cannot just “call” a kernel function. That would require jumping to a memory address in Kernel Space, which causes a Segfault.

It must use a Trap.

The Mechanism

1. User Code: Loads arguments into CPU registers (RAX = Syscall Number, RDI = Arg1, etc.).
2. User Code: Executes the syscall assembly instruction.
3. CPU Hardware:
   • Saves the User Instruction Pointer to RCX.
   • Loads the Kernel Entry Point from MSR_LSTAR (Model Specific Register).
   • Flips CPL from 3 to 0. (This is the magic moment).
   • Jumps to the Kernel’s entry handler.

Visualizing the Cost

Every syscall is a border crossing. It involves:

1. Save State: Saving user registers to the Kernel Stack.
2. Sanitize: Verifying arguments (preventing buffer overflows).
3. Execute: Doing the work.
4. Restore: Restoring registers.
5. Return: sysret opcode (Flips CPL 0 -> 3).

Physics Note: This costs time. About 100-200 nanoseconds on modern CPUs. That sounds fast, but in a tight loop (e.g., reading 1 byte at a time), it destroys throughput.

---

Deep Dive: Monolithic vs Modular

Linux is a Monolithic Kernel. This means the Scheduler, File System, Network Stack, and Drivers all live in the Same Address Space (Ring 0).

• Advantage: Speed. Components talk via function calls (nanoseconds) rather than IPC (microseconds).
• Disadvantage: Fragility. A bug in a WiFi driver can crash the entire system (Kernel Panic).

Modules: The Hybrid Approach

To mitigate this, Linux uses Loadable Kernel Modules (LKM).

• The kernel core is small.
• Drivers are loaded on demand (.ko files).
• lsmod lists currently loaded modules.

$ lsmod | head -5
Module                  Size  Used by
nf_conntrack          172032  1 nf_nat
kvm_intel             376832  0
kvm                  1105920  1 kvm_intel
irqbypass              16384  1 kvm

---

Code: Writing a Kernel Module (The “Hello World” of Ring 0)

This code does not run in your terminal. It runs inside the Kernel. If you make a mistake here (like an infinite loop), your machine freezes completely.

#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Nikhil");
MODULE_DESCRIPTION("A simple Hello World module");

// Called when module is loaded (insmod)
static int __init hello_init(void) {
    // printk writes to the kernel log buffer (dmesg)
    // KERN_INFO is the log level
    printk(KERN_INFO "Hello from Ring 0! I have full control now.\n");
    return 0; // 0 means success
}

// Called when module is unloaded (rmmod)
static void __exit hello_exit(void) {
    printk(KERN_INFO "Goodbye from Ring 0! Returning control.\n");
}

module_init(hello_init);
module_exit(hello_exit);

Compiling and Running

1. Compile: Requires kernel headers.
2. Load: sudo insmod hello.ko (You need Root to touch Ring 0).
3. Check Logs: dmesg | tail.
4. Unload: sudo rmmod hello.

---

Practice Exercises

Exercise 1: The Strace (Beginner)

Task: Run strace ls and spot the write() syscalls. Observation: You will see write(1, "filename", ...) at the end. That is the ls command asking the kernel to put pixels on your screen (via the TTY driver).

Exercise 2: The Kernel Log (Intermediate)

Task: Open a second terminal and run dmesg -w. Action: Plug in a USB device. Observation: Watch the kernel acknowledge the hardware interrupt, load the USB driver, and assign a device node (e.g., /dev/sdb). This is the kernel reacting to physical reality.

Exercise 3: Procfs Exploration (Advanced)

Task: Everything in explicit detail is in /proc.

• /proc/cpuinfo: What flags does your CPU support? (Look for lm - Long Mode, 64-bit).
• /proc/meminfo: Exact memory page counts.
• /proc/interrupts: Count of hardware interrupts per CPU core.

---

Knowledge Check

1. What register stores the Current Privilege Level (CPL)?
2. Why can’t User Space code execute the CLI (Clear Interrupts) instruction?
3. What happens if a Kernel Module crashes?
4. Is a “System Call” a function call?
5. Why is read(buf, 1) in a loop slow?

Answers

1. CS Register (Code Segment), bottom 2 bits.
2. Hardware Enforced. The CPU logic gates check CPL. If != 0, it faults.
3. Kernel Panic. The entire OS halts because the kernel memory space is corrupted.
4. No. It is a CPU Trap / Exception that triggers a privilege context switch.
5. Context Switch Overhead. You are paying the transition tax (Ring 3 -> 0 -> 3) 1000 times instead of once.

---

Summary

• Ring 0: Maximum Privilege (Kernel).
• Ring 3: Restricted Privilege (User).
• Syscall: The bridge between the two.
• Modules: Code loaded into Ring 0 at runtime.

---