Putting the "You" in CPU

Chapter 1: The “Basics”

---

How computers are architected

Key ideas

• The central processing unit (CPU) of the computer is the one in charge of all computation (the shazam alakablam). The instruction they execute are binary data: a byte or two to represent what instruction is being run (the opcode???), followed by whatever data is needed to run the instruction.
• Machine code is basically a series of these binary instructions in a row.
• Assembly is a syntax for reading and writing machine code and it is always compiled to the binary that you cpu knows how to read
  • 

    • instructions aren’t always represented 1:1 in machine code as in the above example. For example, add eax, 512 translates to 05 00 02 00 00.

      The first byte (05) is an opcode specifically representing adding the EAX register to a 32-bit number. The remaining bytes are 512 (0x200) in little-endian byte order.

      Defuse Security created a helpful tool for playing around with the translation between assembly and machine code.

• RAM is the computer’s main memory bank that stores all the data used by programs running in the computer. The CPU always reads machine code directly from RAM, and code can’t be run if it isn’t loaded into RAM
• The CPU stores an instruction pointer which points to the location in the RAM where it’s going to fetch the next instruction. After each instruction, the CPU moves the pointer and repeats. This is the fetch-executes cycle After executing an instruction, the pointer moves forward to immediately after the instruction in RAM so that it now points to the next instruction. That’s why code runs! The instruction pointer just keeps chugging forward, executing machine code in the order in which it has been stored in memory. Some instructions can tell the instruction pointer to jump somewhere else instead, or jump different places depending on a certain condition; this makes reusable code and conditional logic possible.
• The instruction pointer is stored in a register
• Registers are small storage buckets that are extremely fast for the CPU to read and write to. These are use for everything from storing temporary values during computations to configuring the processor.
  • Some registers are directly accesible from machine code, like ebx.
  • Others are only used internally by the CPU, but can often be updated or read using specialized instructions. An example of this is the instruction pointer, which can’t be read directly but can be updated with, for example, a jump instruction.

---

Processors are naive

Key ideas

• The operating system loads the machine code in a file into the RAM and instructs the CPU to jump the instruction pointer to that position in RAM. The CPU continues running its fetch-execute cycle as usual, so the program begins executing.
  • The fetch-execute cycle livro-ECS-2ndEDITION-corrected, page 16
    1. Fetch the instruction from memory and store it into the IR.
    2. Determine the type of instruction.
    3. If a word in memory is used by the instruction, determine its location.
    4. If needed, transfer the word from the memory into a CPU register.
    5. Produce the effects of the instruction, i.e., perform some simple operation dictated by the instruction.
    6. Change the IP to refer to the next instruction.
  • 
• What is a kernel?
  • The kernel is the core of the operating system. The program that starts somewhere when you boot up the computer
  • The kernel has near-full access to your computer’s memory, peripherals, and other resources, and is in charge of running software installed on your computer (known as userland programs)
  • Linux is just a kernel and needs plenty of userland software like shells and display servers to be usable. The kernel in macOS is called XNU and is Unix-like, and the modern Windows kernel is called the NT Kernel.

Questions raised

• If the CPU doesn’t know about multiprocessing and just executes instructions sequentially, why doesn’t it get stuck inside whatever program it’s running? How can multiple programs run at once?

• If programs run directly on the CPU, and the CPU can directly access RAM, why can’t code access memory from other processes, or, god forbid, the kernel?

• Speaking of which, what’s the mechanism that prevents every process from running any instruction and doing anything to your computer? AND WHAT’S A DAMN SYSCALL?

---

Two Rings to Rule Them All

• Modern architectures have at least two options of modes: kernel/supervisor mode and user mode. While an architecture might support more than two modes, only kernel mode and user mode are commonly used these days
• In kernel mode the CPU is allowed to execute any supported instruction and access any memory.
• In user mode, only a subset of instructions is allowed, I/O and memory access is limited, and many CPU settings are locked
• Generally, the kernel and drivers run in kernel mode while applications run in user mode.
• Processors start in kernel mode. Before executing a program, the kernel initiates the switch to user mode
  • 

What Even is a Syscall?

• Programs run in user mode because they can not be trusted with full access to the computer. But the programs need to be able to access I/O, allocate memory, and interact with the operating system. In order to do all of that the program running ins user mode has to ask the operating system kernel for help.
• The operating system then implements its own security protections to prevent programs from doing anything malicious.
• A system call is a especial procedure that lets a program start a transition from user space to kernel space, jumping the program’s code into the OS code.
• User space to kernel space control transfers uses the a processor feature called software interrupts.
  • During the boot process, the operating system stores a table called an interrupt vector table in RAM and registers it with the CPU.
    • 
  • Then, the userland programs can use an instructions like INT which tells the processor to look up the given interrupt number in the IVT, switch to kernel mode, and the jump the instruction pointer to the memory address stored in the IVT.
• When this kernel code finishes, it uses an instruction like IRET (??) to tell the CPU to switch back to user mode and return the instruction pointer to where it was when the interrupt was triggered

to be continued heheh…