Which address space is used in system calls? physical? or virtual?

Question

Explanation

There’s two kind of address space virtual and physical. On the physical model (typically used by the kernel) the memory is bounded and each address correspond to physical ones.

The virtual one is used by processes. There’s no limit (except the one due to pointer size). To get more memory the program simply request it (ignoring what amount can be requested). Each address is mapped to different physical ones.
That’s how process are restricted in what they can read from ram.

The problem

The reasoning is system calls uses ring0, but at the same time (at least on linux) the process state is update to interruptible, suggesting system calls uses the virtual address space.
As far I understand, CPU rings are about privileged instructions, not about address space (as it is MMU related).

So if an out of bound read (due to a vulnerability) occurs during the execution of a system call in kernel code. Can it return memory from other processes ?

Answer 1

Kernel mode code can do pretty much anything it wants to, including snooping the address spaces of various processes.

Yes, kernel mode code uses virtual address space. The kernel manages physical address space but it doesn't run in physical address space.

User mode can't read anything it wants from RAM because it has no way to assert physical addresses.

Since kernel mode runs with address translation enabled, kernel mode code also can only assert virtual addresses. But k-mode code can set up page table entries to define virtual addresses that translate to whatever physical addresses it might care to access.

Answer 2

Those system calls invoked by kernel use physical address space.
Those system calls invoked by processes use virtual address space.