i386/i386.reference/s06_03.htm

   1 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
   2 <HTML>
   3 <HEAD>
   4 <TITLE>80386 Programmer's Reference Manual -- Section 6.3</TITLE>
   5 </HEAD>
   6 <BODY>
   7 <B>up:</B> <A HREF="c06.htm">
   8 Chapter 6 -- Protection</A><BR>
   9 <B>prev:</B> <A HREF="s06_02.htm">6.2  Overview of 80386 Protection Mechanisms</A><BR>
  10 <B>next:</B> <A HREF="s06_04.htm">6.4  Page-Level Protection</A>
  11 <P>
  12 <HR>
  13 <P>
  14 <H1>6.3  Segment-Level Protection</H1>
  15 All five aspects of protection apply to segment translation:
  16 <OL>
  17 <LI> Type checking
  18 <LI> Limit checking
  19 <LI> Restriction of addressable domain
  20 <LI> Restriction of procedure entry points
  21 <LI> Restriction of instruction set
  22 </OL>
  23 The segment is the unit of protection, and segment descriptors store
  24 protection parameters. Protection checks are performed automatically by the
  25 CPU when the selector of a segment descriptor is loaded into a segment
  26 register and with every segment access. Segment registers hold the
  27 protection parameters of the currently addressable segments.
  28
  29 <H2>6.3.1  Descriptors Store Protection Parameters</H2>
  30
  31 <A HREF="#fig6-1">Figure 6-1</A>
  32   highlights the protection-related fields of segment descriptors.
  33 <P>
  34 The protection parameters are placed in the descriptor by systems software
  35 at the time a descriptor is created. In general, applications programmers do
  36 not need to be concerned about protection parameters.
  37 <P>
  38 When a program loads a selector into a segment register, the processor
  39 loads not only the base address of the segment but also protection
  40 information. Each segment register has bits in the invisible portion for
  41 storing base, limit, type, and privilege level; therefore, subsequent
  42 protection checks on the same segment do not consume additional clock
  43 cycles.
  44 <P>
  45 <A NAME="fig6-1">
  46 <IMG align=center SRC="fig6-1.gif" border=0>
  47 <P>
  48 <H3>6.3.1.1  Type Checking</H3>
  49 The TYPE field of a descriptor has two functions:
  50 <OL>
  51 <LI> It distinguishes among different descriptor formats.
  52 <LI> It specifies the intended usage of a segment.
  53 </OL>
  54 Besides the descriptors for data and executable segments commonly used by
  55 applications programs, the 80386 has descriptors for special segments used
  56 by the operating system and for gates. Table 6-1 lists all the types defined
  57 for system segments and gates. Note that not all descriptors define
  58 segments; gate descriptors have a different purpose that is discussed later
  59 in this chapter.
  60 <P>
  61 The type fields of data and executable segment descriptors include bits
  62 which further define the purpose of the segment (refer to
  63 <A HREF="#fig6-1">Figure 6-1</A>
  64   ):
  65 <UL>
  66 <LI> The writable bit in a data-segment descriptor specifies whether
  67 instructions can write into the segment.
  68 <LI> The readable bit in an executable-segment descriptor specifies
  69 whether instructions are allowed to read from the segment (for example,
  70 to access constants that are stored with instructions). A readable,
  71 executable segment may be read in two ways:
  72 <OL>
  73 <LI> Via the CS register, by using a CS override prefix.
  74
  75 <LI> By loading a selector of the descriptor into a data-segment register
  76 (DS, ES, FS,or GS).
  77 </OL>
  78 </UL>
  79 Type checking can be used to detect programming errors that would attempt
  80 to use segments in ways not intended by the programmer. The processor
  81 examines type information on two kinds of occasions:
  82 <OL>
  83 <LI> When a selector of a descriptor is loaded into a segment register.
  84 Certain segment registers can contain only certain descriptor types;
  85 for example:
  86 <UL>
  87 <LI> The CS register can be loaded only with a selector of an executable
  88 segment.
  89 <LI> Selectors of executable segments that are not readable cannot be
  90 loaded into data-segment registers.
  91 <LI> Only selectors of writable data segments can be loaded into SS.
  92 </UL>
  93 <LI> When an instruction refers (implicitly or explicitly) to a segment
  94 register. Certain segments can be used by instructions only in certain
  95 predefined ways; for example:
  96 <UL>
  97 <LI> No instruction may write into an executable segment.
  98 <LI> No instruction may write into a data segment if the writable bit is
  99 not set.
 100 <LI> No instruction may read an executable segment unless the readable bit
 101 is set.
 102 </UL>
 103 </OL>
 104 <P>
 105 <PRE>
 106 Table 6-1. System and Gate Descriptor Types
 107
 108 Code      Type of Segment or Gate
 109
 110 0       -reserved
 111 1       Available 286 TSS
 112 2       LDT
 113 3       Busy 286 TSS
 114 4       Call Gate
 115 5       Task Gate
 116 6       286 Interrupt Gate
 117 7       286 Trap Gate
 118 8       -reserved
 119 9       Available 386 TSS
 120 A       -reserved
 121 B       Busy 386 TSS
 122 C       386 Call Gate
 123 D       -reserved
 124 E       386 Interrupt Gate
 125 F       386 Trap Gate
 126
 127 </PRE>
 128
 129 <H3>6.3.1.2  Limit Checking</H3>
 130 The limit field of a segment descriptor is used by the processor to prevent
 131 programs from addressing outside the segment. The processor's interpretation
 132 of the limit depends on the setting of the G (granularity) bit. For data
 133 segments, the processor's interpretation of the limit depends also on the
 134 E-bit (expansion-direction bit) and the B-bit (big bit) (refer to Table
 135 6-2).
 136 <P>
 137 When G=0, the actual limit is the value of the 20-bit limit field as it
 138 appears in the descriptor. In this case, the limit may range from 0 to
 139 0FFFFFH (2^(20) - 1 or 1 megabyte). When G=1, the processor appends 12
 140 low-order one-bits to the value in the limit field. In this case the actual
 141 limit may range from 0FFFH (2^(12) - 1 or 4 kilobytes) to 0FFFFFFFFH(2^(32)
 142 - 1 or 4 gigabytes).
 143 <P>
 144 For all types of segments except expand-down data segments, the value of
 145 the limit is one less than the size (expressed in bytes) of the segment. The
 146 processor causes a general-protection exception in any of these cases:
 147 <UL>
 148 <LI> Attempt to access a memory byte at an address > limit.
 149 <LI> Attempt to access a memory word at an address >= limit.
 150 <LI> Attempt to access a memory doubleword at an address >= (limit-2).
 151 </UL>
 152 For expand-down data segments, the limit has the same function but is
 153 interpreted differently. In these cases the range of valid addresses is from
 154 limit + 1 to either 64K or 2^(32) - 1 (4 Gbytes) depending on the B-bit. An
 155 expand-down segment has maximum size when the limit is zero.
 156 <P>
 157 The expand-down feature makes it possible to expand the size of a stack by
 158 copying it to a larger segment without needing also to update intrastack
 159 pointers.
 160 <P>
 161 The limit field of descriptors for descriptor tables is used by the
 162 processor to prevent programs from selecting a table entry outside the
 163 descriptor table. The limit of a descriptor table identifies the last valid
 164 byte of the last descriptor in the table. Since each descriptor is eight
 165 bytes long, the limit value is N * 8 - 1 for a table that can contain up to
 166 N descriptors.
 167 <P>
 168 Limit checking catches programming errors such as runaway subscripts and
 169 invalid pointer calculations. Such errors are detected when they occur, so
 170 that identification of the cause is easier. Without limit checking, such
 171 errors could corrupt other modules; the existence of such errors would not
 172 be discovered until later, when the corrupted module behaves incorrectly,
 173 and when identification of the cause is difficult.
 174 <PRE>
 175 Table 6-2. Useful Combinations of E, G, and B Bits
 176
 177 Case:                    1         2         3         4
 178
 179 Expansion Direction      U         U         D         D
 180 G-bit                    0         1         0         1
 181 B-bit                    X         X         0         1
 182
 183 Lower bound is:
 184 0                        X         X
 185 LIMIT+1                                      X
 186 shl(LIMIT,12,1)+1                                      X
 187
 188 Upper bound is:
 189 LIMIT                    X
 190 shl(LIMIT,12,1)                    X
 191 64K-1                                        X
 192 4G-1                                                   X
 193
 194 Max seg size is:
 195 64K                      X
 196 64K-1                              X
 197 4G-4K                                        X
 198 4G                                                     X
 199
 200 Min seg size is:
 201 0                        X         X
 202 4K                                           X         X
 203
 204 shl (X, 12, 1) = shift X left by 12 bits inserting one-bits on the right
 205
 206 </PRE>
 207
 208 <H3>6.3.1.3  Privilege Levels</H3>
 209 The concept of privilege is implemented by assigning a value from zero to
 210 three to key objects recognized by the processor. This value is called the
 211 privilege level. The value zero represents the greatest privilege, the
 212 value three represents the least privilege. The following
 213 processor-recognized objects contain privilege levels:
 214 <UL>
 215 <LI> Descriptors contain a field called the descriptor privilege level
 216 (DPL).
 217 <LI> Selectors contain a field called the requestor's privilege level
 218 (RPL). The RPL is intended to represent the privilege level of
 219 the procedure that originates a selector.
 220 <LI> An internal processor register records the current privilege level
 221 (CPL). Normally the CPL is equal to the DPL of the segment that
 222 the processor is currently executing. CPL changes as control is
 223 transferred to segments with differing DPLs.
 224 </UL>
 225 The processor automatically evaluates the right of a procedure to access
 226 another segment by comparing the CPL to one or more other privilege levels.
 227 The evaluation is performed at the time the selector of a descriptor is
 228 loaded into a segment register. The criteria used for evaluating access to
 229 data differs from that for evaluating transfers of control to executable
 230 segments; therefore, the two types of access are considered separately in
 231 the following sections.
 232 <P>
 233
 234 <A HREF="#fig6-2">Figure 6-2</A>
 235   shows how these levels of privilege can be interpreted as rings
 236 of protection. The center is for the segments containing the most critical
 237 software, usually the kernel of the operating system. Outer rings are for
 238 the segments of less critical software.
 239 <P>
 240 It is not necessary to use all four privilege levels. Existing software
 241 that was designed to use only one or two levels of privilege can simply
 242 ignore the other levels offered by the 80386. A one-level system should use
 243 privilege level zero; a two-level system should use privilege levels zero
 244 and three.
 245 <P>
 246 <A NAME="fig6-2">
 247 <IMG align=center SRC="fig6-2.gif" border=0>
 248 <P>
 249 <H2>6.3.2  Restricting Access to Data</H2>
 250 To address operands in memory, an 80386 program must load the selector of a
 251 data segment into a data-segment register (DS, ES, FS, GS, SS). The
 252 processor automatically evaluates access to a data segment by comparing
 253 privilege levels. The evaluation is performed at the time a selector for the
 254 descriptor of the target segment is loaded into the data-segment register.
 255 As
 256 <A HREF="#fig6-3">Figure 6-3</A>
 257   shows, three different privilege levels enter into this type
 258 of privilege check:
 259 <OL>
 260 <LI> The CPL (current privilege level).
 261 <LI> The RPL (requestor's privilege level) of the selector used to specify
 262 the target segment.
 263 <LI> The DPL of the descriptor of the target segment.
 264 </OL>
 265 Instructions may load a data-segment register (and subsequently use the
 266 target segment) only if the DPL of the target segment is numerically greater
 267 than or equal to the maximum of the CPL and the selector's RPL. In other
 268 words, a procedure can only access data that is at the same or less
 269 privileged level.
 270 <P>
 271 The addressable domain of a task varies as CPL changes. When CPL is zero,
 272 data segments at all privilege levels are accessible; when CPL is one, only
 273 data segments at privilege levels one through three are accessible; when CPL
 274 is three, only data segments at privilege level three are accessible. This
 275 property of the 80386 can be used, for example, to prevent applications
 276 procedures from reading or changing tables of the operating system.
 277 <P>
 278 <A NAME="fig6-3">
 279 <IMG align=center SRC="fig6-3.gif" border=0>
 280 <P>
 281 <H3>6.3.2.1  Accessing Data in Code Segments</H3>
 282 Less common than the use of data segments is the use of code segments to
 283 store data. Code segments may legitimately hold constants; it is not
 284 possible to write to a segment described as a code segment. The following
 285 methods of accessing data in code segments are possible:
 286 <OL>
 287 <LI> Load a data-segment register with a selector of a nonconforming,
 288 readable, executable segment.
 289 <LI> Load a data-segment register with a selector of a conforming,
 290 readable, executable segment.
 291 <LI> Use a CS override prefix to read a readable, executable segment whose
 292 selector is already loaded in the CS register.
 293 </OL>
 294 The same rules as for access to data segments apply to case 1. Case 2 is
 295 always valid because the privilege level of a segment whose conforming bit
 296 is set is effectively the same as CPL regardless of its DPL. Case 3 always
 297 valid because the DPL of the code segment in CS is, by definition, equal to
 298 CPL.
 299
 300 <H2>6.3.3  Restricting Control Transfers</H2>
 301 With the 80386, control transfers are accomplished by the instructions
 302 <A HREF="JMP.htm">JMP</A>,
 303 <A HREF="CALL.htm">CALL</A>,
 304 <A HREF="RET.htm">RET</A>,
 305 <A HREF="INT.htm">INT</A>, and <A HREF="IRET.htm">IRET</A>,
 306 as well as by the exception and interrupt
 307 mechanisms . Exceptions and interrupts are special cases that
 308 <A HREF="c09.htm">Chapter 9</A>
 309 covers. This chapter discusses only <A HREF="JMP.htm">JMP</A>,
 310 <A HREF="CALL.htm">CALL</A>, and <A HREF="RET.htm">RET</A> instructions.
 311 <P>
 312 The "near" forms of <A HREF="JMP.htm">JMP</A>, <A HREF="CALL.htm">CALL</A>, and
 313 <A HREF="RET.htm">RET</A> transfer within the current code
 314 segment, and therefore are subject only to limit checking. The processor
 315 ensures that the destination of the <A HREF="JMP.htm">JMP</A>,
 316 <A HREF="CALL.htm">CALL</A>, or
 317 <A HREF="RET.htm">RET</A> instruction does not
 318 exceed the limit of the current executable segment. This limit is cached in
 319 the CS register; therefore, protection checks for near transfers require no
 320 extra clock cycles.
 321 <P>
 322 The operands of the "far" forms of
 323 <A HREF="JMP.htm">JMP</A> and
 324 <A HREF="CALL.htm">CALL</A> refer to other segments;
 325 therefore, the processor performs privilege checking. There are two ways a
 326 <A HREF="JMP.htm">JMP</A> or
 327 <A HREF="CALL.htm">CALL</A> can refer to another segment:
 328 <OL>
 329 <LI> The operand selects the descriptor of another executable segment.
 330 <LI> The operand selects a call gate descriptor. This gated form of
 331 transfer is discussed in a later section on call gates.
 332 </OL>
 333 As
 334 <A HREF="#fig6-4">Figure 6-4</A>
 335   shows, two different privilege levels enter into a privilege
 336 check for a control transfer that does not use a call gate:
 337 <OL>
 338 <LI> The CPL (current privilege level).
 339
 340 <LI> The DPL of the descriptor of the target segment.
 341 </OL>
 342 Normally the CPL is equal to the DPL of the segment that the processor is
 343 currently executing. CPL may, however, be greater than DPL if the conforming
 344 bit is set in the descriptor of the current executable segment. The
 345 processor keeps a record of the CPL cached in the CS register; this value
 346 can be different from the DPL in the descriptor of the code segment.
 347 <P>
 348 The processor permits a
 349 <A HREF="JMP.htm">JMP</A> or
 350 <A HREF="CALL.htm">CALL</A> directly to another segment only if one
 351 of the following privilege rules is satisfied:
 352 <UL>
 353 <LI> DPL of the target is equal to CPL.
 354 <LI> The conforming bit of the target code-segment descriptor is set, and
 355 the DPL of the target is less than or equal to CPL.
 356 </UL>
 357 An executable segment whose descriptor has the conforming bit set is called
 358 a conforming segment. The conforming-segment mechanism permits sharing of
 359 procedures that may be called from various privilege levels but should
 360 execute at the privilege level of the calling procedure. Examples of such
 361 procedures include math libraries and some exception handlers. When control
 362 is transferred to a conforming segment, the CPL does not change. This is
 363 the only case when CPL may be unequal to the DPL of the current executable
 364 segment.
 365 <P>
 366 Most code segments are not conforming. The basic rules of privilege above
 367 mean that, for nonconforming segments, control can be transferred without a
 368 gate only to executable segments at the same level of privilege. There is a
 369 need, however, to transfer control to (numerically) smaller privilege
 370 levels; this need is met by the
 371 <A HREF="CALL.htm">CALL</A> instruction when used with call-gate
 372 descriptors, which are explained in the next section. The
 373 <A HREF="JMP.htm">JMP</A> instruction
 374 may never transfer control to a nonconforming segment whose DPL does not
 375 equal CPL.
 376 <P>
 377 <A NAME="fig6-4">
 378 <IMG align=center SRC="fig6-4.gif" border=0>
 379 <P>
 380 <H2>6.3.4  Gate Descriptors Guard Procedure Entry Points</H2>
 381 To provide protection for control transfers among executable segments
 382 at different privilege levels, the 80386 uses gate descriptors. There are
 383 four kinds of gate descriptors:
 384 <UL>
 385 <LI> Call gates
 386 <LI> Trap gates
 387 <LI> Interrupt gates
 388 <LI> Task gates
 389 </UL>
 390 This chapter is concerned only with call gates. Task gates are used for
 391 task switching , and therefore are discussed in
 392 <A HREF="c07.htm">Chapter 7</A>.
 393 <A HREF="c09.htm">Chapter 9</A>
 394 explains how trap gates and interrupt gates are used by exceptions and
 395 interrupts.
 396 <A HREF="#fig6-5">Figure 6-5</A>
 397   illustrates the format of a call gate. A call gate
 398 descriptor may reside in the GDT or in an LDT, but not in the IDT.
 399 A call gate has two primary functions:
 400 <OL>
 401 <LI> To define an entry point of a procedure.
 402 <LI> To specify the privilege level of the entry point.
 403 </OL>
 404 Call gate descriptors are used by call and jump instructions in the same
 405 manner as code segment descriptors. When the hardware recognizes that the
 406 destination selector refers to a gate descriptor, the operation of the
 407 instruction is expanded as determined by the contents of the call gate.
 408 <P>
 409 The selector and offset fields of a gate form a pointer to the entry point
 410 of a procedure. A call gate guarantees that all transitions to another
 411 segment go to a valid entry point, rather than possibly into the middle of a
 412 procedure (or worse, into the middle of an instruction). The far pointer
 413 operand of the control transfer instruction does not point to the segment
 414 and offset of the target instruction; rather, the selector part of the
 415 pointer selects a gate, and the offset is not used.
 416 <A HREF="#fig6-6">Figure 6-6</A>
 417   illustrates
 418 this style of addressing.
 419 <P>
 420 As
 421 <A HREF="#fig6-7">Figure 6-7</A>
 422   shows, four different privilege levels are used to check the
 423 validity of a control transfer via a call gate:
 424 <OL>
 425 <LI> The CPL (current privilege level).
 426 <LI> The RPL (requestor's privilege level) of the selector used to specify
 427 the call gate.
 428 <LI> The DPL of the gate descriptor.
 429 <LI> The DPL of the descriptor of the target executable segment.
 430 </OL>
 431 The DPL field of the gate descriptor determines what privilege levels can
 432 use the gate. One code segment can have several procedures that are intended
 433 for use by different privilege levels. For example, an operating system may
 434 have some services that are intended to be used by applications, whereas
 435 others may be intended only for use by other systems software.
 436 <P>
 437 Gates can be used for control transfers to numerically smaller privilege
 438 levels or to the same privilege level (though they are not necessary for
 439 transfers to the same level). Only
 440 <A HREF="CALL.htm">CALL</A> instructions can use gates to
 441 transfer to smaller privilege levels. A gate may be used by a
 442 <A HREF="JMP.htm">JMP</A>
 443 instruction only to transfer to an executable segment with the same
 444 privilege level or to a conforming segment.
 445 <P>
 446 For a
 447 <A HREF="JMP.htm">JMP</A> instruction to a nonconforming segment,
 448 both of the following
 449 privilege rules must be satisfied; otherwise, a general protection exception
 450 results.
 451 <PRE>
 452 MAX (CPL,RPL) <= gate DPL
 453 target segment DPL = CPL
 454 </PRE>
 455 For a <A HREF="CALL.htm">CALL</A> instruction (or for a
 456 <A HREF="JMP.htm">JMP</A> instruction to a conforming segment),
 457 both of the following privilege rules must be satisfied; otherwise, a
 458 general protection exception results.
 459 <PRE>
 460 MAX (CPL,RPL) <= gate DPL
 461 target segment DPL <= CPL
 462 </PRE>
 463 <P>
 464 <A NAME="fig6-5">
 465 <IMG align=center SRC="fig6-5.gif" border=0>
 466 <P>
 467 <HR>
 468 <P>
 469 <A NAME="fig6-6">
 470 <IMG align=center SRC="fig6-6.gif" border=0>
 471 <P>
 472 <HR>
 473 <P>
 474 <A NAME="fig6-7">
 475 <IMG align=center SRC="fig6-7.gif" border=0>
 476 <P>
 477 <H3>6.3.4.1  Stack Switching</H3>
 478 If the destination code segment of the call gate is at a different
 479 privilege level than the CPL, an interlevel transfer is being requested.
 480 <P>
 481 To maintain system integrity, each privilege level has a separate stack.
 482 These stacks assure sufficient stack space to process calls from less
 483 privileged levels. Without them, a trusted procedure would not work
 484 correctly if the calling procedure did not provide sufficient space on the
 485 caller's stack.
 486 <P>
 487 The processor locates these stacks via the task state segment (see
 488 <A HREF="#fig6-8">Figure 6-8</A>).
 489 Each task has a separate TSS, thereby permitting tasks to have
 490 separate stacks. Systems software is responsible for creating TSSs and
 491 placing correct stack pointers in them. The initial stack pointers in the
 492 TSS are strictly read-only values. The processor never changes them during
 493 the course of execution.
 494 <P>
 495 When a call gate is used to change privilege levels, a new stack is
 496 selected by loading a pointer value from the Task State Segment (TSS). The
 497 processor uses the DPL of the target code segment (the new CPL) to index the
 498 initial stack pointer for PL 0, PL 1, or PL 2.
 499 <P>
 500 The DPL of the new stack data segment must equal the new CPL; if it does
 501 not, a stack exception occurs. It is the responsibility of systems software
 502 to create stacks and stack-segment descriptors for all privilege levels that
 503 are used. Each stack must contain enough space to hold the old SS:ESP, the
 504 return address, and all parameters and local variables that may be required
 505 to process a call.
 506 <P>
 507 As with intralevel calls, parameters for the subroutine are placed on the
 508 stack. To make privilege transitions transparent to the called procedure,
 509 the processor copies the parameters to the new stack. The count field of a
 510 call gate tells the processor how many doublewords (up to 31) to copy from
 511 the caller's stack to the new stack. If the count is zero, no parameters are
 512 copied.
 513 <P>
 514 The processor performs the following stack-related steps in executing an
 515 interlevel <A HREF="CALL.htm">CALL</A>.
 516 <OL>
 517 <LI> The new stack is checked to assure that it is large enough to hold
 518 the parameters and linkages; if it is not, a stack fault occurs with
 519 an error code of 0.
 520 <LI> The old value of the stack registers SS:ESP is pushed onto the new
 521 stack as two doublewords.
 522 <LI> The parameters are copied.
 523 <LI> A pointer to the instruction after the
 524 <A HREF="CALL.htm">CALL</A> instruction (the former
 525 value of CS:EIP) is pushed onto the new stack. The final value of
 526 SS:ESP points to this return pointer on the new stack.
 527 </OL>
 528
 529 <A HREF="#fig6-9">Figure 6-9</A>
 530   illustrates the stack contents after a successful interlevel
 531 call.
 532 <P>
 533 The TSS does not have a stack pointer for a privilege level 3 stack,
 534 because privilege level 3 cannot be called by any procedure at any other
 535 privilege level.
 536 <P>
 537 Procedures that may be called from another privilege level and that require
 538 more than the 31 doublewords for parameters must use the saved SS:ESP link
 539 to access all parameters beyond the last doubleword copied.
 540 <P>
 541 A call via a call gate does not check the values of the words copied onto
 542 the new stack. The called procedure should check each parameter for
 543 validity. A later section discusses how the <A HREF="ARPL.htm">ARPL</A>,
 544 <A HREF="VERR.htm">VERR</A>,
 545 <A HREF="VERR.htm">VERW</A>,
 546 <A HREF="LSL.htm">LSL</A>, and
 547 <A HREF="LAR.htm">LAR</A>
 548 instructions can be used to check pointer values.
 549 <P>
 550 <A NAME="fig6-8">
 551 <IMG align=center SRC="fig6-8.gif" border=0>
 552 <P>
 553 <HR>
 554 <P>
 555 <A NAME="fig6-9">
 556 <IMG align=center SRC="fig6-9.gif" border=0>
 557 <P>
 558 <H3>6.3.4.2  Returning from a Procedure</H3>
 559 The "near" forms of the
 560 <A HREF="RET.htm">RET</A> instruction transfer control within the current
 561 code segment and therefore are subject only to limit checking. The offset of
 562 the instruction following the corresponding
 563 <A HREF="CALL.htm">CALL</A>, is popped from the stack.
 564 The processor ensures that this offset does not exceed the limit of the
 565 current executable segment.
 566 <P>
 567 The "far" form of the
 568 <A HREF="RET.htm">RET</A> instruction pops the return pointer that was
 569 pushed onto the stack by a prior far
 570 <A HREF="CALL.htm">CALL</A> instruction. Under normal
 571 conditions, the return pointer is valid, because of its relation to the
 572 prior <A HREF="CALL.htm">CALL</A> or
 573 <A HREF="INT.htm">INT</A>.
 574 Nevertheless, the processor performs privilege checking
 575 because of the possibility that the current procedure altered the pointer or
 576 failed to properly maintain the stack. The RPL of the CS selector popped
 577 off the stack by the return instruction identifies the privilege level of
 578 the calling procedure.
 579 <P>
 580 An intersegment return instruction can change privilege levels, but only
 581 toward procedures of lesser privilege. When the
 582 <A HREF="RET.htm">RET</A> instruction encounters a
 583 saved CS value whose RPL is numerically greater than the CPL, an interlevel
 584 return occurs. Such a return follows these steps:
 585 <OL>
 586 <LI> The checks shown in Table 6-3 are made, and CS:EIP and SS:ESP are
 587 loaded with their former values that were saved on the stack.
 588 <LI> The old SS:ESP (from the top of the current stack) value is adjusted
 589 by the number of bytes indicated in the
 590 <A HREF="RET.htm">RET</A> instruction. The resulting
 591 ESP value is not compared to the limit of the stack segment. If ESP is
 592 beyond the limit, that fact is not recognized until the next stack
 593 operation. (The SS:ESP value of the returning procedure is not
 594 preserved; normally, this value is the same as that contained in the
 595 TSS.)
 596 <LI> The contents of the DS, ES, FS, and GS segment registers are checked.
 597 If any of these registers refer to segments whose DPL is greater than
 598 the new CPL (excluding conforming code segments), the segment register
 599 is loaded with the null selector (INDEX = 0, TI = 0). The
 600 <A HREF="RET.htm">RET</A>
 601 instruction itself does not signal exceptions in these cases;
 602 however, any subsequent memory reference that attempts to use a
 603 segment register that contains the null selector will cause a general
 604 protection exception. This prevents less privileged code from
 605 accessing more privileged segments using selectors left in the
 606 segment registers by the more privileged procedure.
 607 </OL>
 608
 609 <H2>6.3.5  Some Instructions are Reserved for Operating System</H2>
 610 Instructions that have the power to affect the protection mechanism or to
 611 influence general system performance can only be executed by trusted
 612 procedures. The 80386 has two classes of such instructions:
 613 <OL>
 614 <LI> Privileged instructions -- those used for system control.
 615 <LI> Sensitive instructions -- those used for I/O and I/O related
 616 activities.
 617 </OL>
 618 <PRE>
 619 Table 6-3. Interlevel Return Checks
 620
 621 SF = Stack Fault
 622 GP = General Protection Exception
 623 NP = Segment-Not-Present Exception
 624
 625 Type of Check                                  Exception   Error Code
 626
 627 ESP is within current SS segment               SF          0
 628 ESP + 7 is within current SS segment           SF          0
 629 RPL of return CS is greater than CPL           GP          Return CS
 630 Return CS selector is not null                 GP          Return CS
 631 Return CS segment is within descriptor
 632   table limit                                  GP          Return CS
 633 Return CS descriptor is a code segment         GP          Return CS
 634 Return CS segment is present                   NP          Return CS
 635 DPL of return nonconforming code
 636   segment = RPL of return CS, or DPL of
 637   return conforming code segment <= RPL
 638   of return CS                                 GP          Return CS
 639 ESP + N + 15 is within SS segment
 640 N   Immediate Operand of RET N Instruction     SF          Return SS
 641 SS selector at ESP + N + 12 is not null        GP          Return SS
 642 SS selector at ESP + N + 12 is within
 643   descriptor table limit                       GP          Return SS
 644 SS descriptor is writable data segment         GP          Return SS
 645 SS segment is present                          SF          Return SS
 646 Saved SS segment DPL = RPL of saved
 647   CS                                           GP          Return SS
 648 Saved SS selector RPL = Saved SS
 649   segment DPL                                  GP          Return SS
 650 </PRE>
 651
 652 <H3>6.3.5.1  Privileged Instructions</H3>
 653 The instructions that affect system data structures can only be executed
 654 when CPL is zero. If the CPU encounters one of these instructions when CPL
 655 is greater than zero, it signals a general protection exception. These
 656 instructions include:
 657 <UL>
 658 <LI><A HREF="CLTS.htm">CLTS -- Clear Task-Switched Flag</A>
 659 <LI><A HREF="HLT.htm">HLT -- Halt Processor</A>
 660 <LI><A HREF="LGDT.htm">LGDT -- Load GDL Register</A>
 661 <LI><A HREF="LGDT.htm">LIDT -- Load IDT Register</A>
 662 <LI><A HREF="LLDT.htm">LLDT -- Load LDT Register</A>
 663 <LI><A HREF="LMSW.htm">LMSW -- Load Machine Status Word</A>
 664 <LI><A HREF="LTR.htm">LTR -- Load Task Register</A>
 665 <LI><A HREF="MOVRS.htm">MOV to/from CRn -- Move to Control Register n</A>
 666 <LI><A HREF="MOVRS.htm">MOV to /from DRn -- Move to Debug Register n</A>
 667 <LI><A HREF="MOVRS.htm">MOV to/from TRn -- Move to Test Register n</A>
 668 </UL>
 669
 670 <H3>6.3.5.2  Sensitive Instructions</H3>
 671 Instructions that deal with I/O need to be restricted but also need to be
 672 executed by procedures executing at privilege levels other than zero. The
 673 mechanisms for restriction of I/O operations are covered in detail in
 674
 675 <A HREF="c08.htm">Chapter 8</A>, "Input/Output".
 676
 677 <H2>6.3.6  Instructions for Pointer Validation</H2>
 678 Pointer validation is an important part of locating programming errors.
 679 Pointer validation is necessary for maintaining isolation between the
 680 privilege levels. Pointer validation consists of the following steps:
 681 <OL>
 682 <LI> Check if the supplier of the pointer is entitled to access the
 683 segment.
 684 <LI> Check if the segment type is appropriate to its intended use.
 685 <LI> Check if the pointer violates the segment limit.
 686 </OL>
 687 Although the 80386 processor automatically performs checks 2 and 3 during
 688 instruction execution, software must assist in performing the first check.
 689 The unprivileged instruction
 690 <A HREF="ARPL.htm">ARPL</A> is provided for this purpose. Software can
 691 also explicitly perform steps 2 and 3 to check for potential violations
 692 (rather than waiting for an exception). The unprivileged instructions
 693 <A HREF="LAR.htm">LAR</A>,
 694 <A HREF="LSL.htm">LSL</A>,
 695 <A HREF="VERR.htm">VERR</A>, and
 696 <A HREF="VERR.htm">VERW</A> are provided for this purpose.
 697 <P>
 698 <A HREF="LAR.htm">LAR</A> (Load Access Rights) is used to verify that a pointer refers to a
 699 segment of the proper privilege level and type.
 700 <A HREF="LAR.htm">LAR</A> has one operand
 701 selector for a descriptor whose access rights are to be examined. The
 702 descriptor must be visible at the privilege level which is the maximum of
 703 the CPL and the selector's RPL. If the descriptor is visible,
 704 <A HREF="LAR.htm">LAR</A> obtains a
 705 masked form of the second doubleword of the descriptor, masks this value
 706 with 00FxFF00H, stores the result into the specified 32-bit destination
 707 register, and sets the zero flag. (The x indicates that the corresponding
 708 four bits of the stored value are undefined.) Once loaded, the access-rights
 709 bits can be tested. All valid descriptor types can be tested by the
 710 <A HREF="LAR.htm">LAR</A>
 711 instruction. If the RPL or CPL is greater than DPL, or if the selector is
 712 outside the table limit, no access-rights value is returned, and the zero
 713 flag is cleared. Conforming code segments may be accessed from any privilege
 714 level.
 715 <P>
 716 <A HREF="LSL.htm">LSL</A>
 717 (Load Segment Limit) allows software to test the limit of a descriptor.
 718 If the descriptor denoted by the given selector (in memory or a register) is
 719 visible at the CPL,
 720 <A HREF="LSL.htm">LSL</A> loads the specified 32-bit register with a 32-bit,
 721 byte granular, unscrambled limit that is calculated from fragmented limit
 722 fields and the G-bit of that descriptor. This can only be done for segments
 723 (data, code, task state, and local descriptor tables); gate descriptors are
 724 inaccessible. (Table 6-4 lists in detail which types are valid and which
 725 are not.) Interpreting the limit is a function of the segment type. For
 726 example, downward expandable data segments treat the limit differently than
 727 code segments do. For both
 728 <A HREF="LAR.htm">LAR</A> and
 729 <A HREF="LSL.htm">LSL</A>, the zero flag (ZF) is set if the
 730 loading was performed; otherwise, the ZF is cleared.
 731 <PRE>
 732 Table 6-4. Valid Descriptor Types for LSL
 733
 734 Type   Descriptor Type             Valid?
 735 Code
 736
 737 0      (invalid)                   NO
 738 1      Available 286 TSS           YES
 739 2      LDT                         YES
 740 3      Busy 286 TSS                YES
 741 4      286 Call Gate               NO
 742 5      Task Gate                   NO
 743 6      286 Trap Gate               NO
 744 7      286 Interrupt Gate          NO
 745 8      (invalid)                   NO
 746 9      Available 386 TSS           YES
 747 A      (invalid)                   NO
 748 B      Busy 386 TSS                YES
 749 C      386 Call Gate               NO
 750 D      (invalid)                   NO
 751 E      386 Trap Gate               NO
 752 F      386 Interrupt Gate          NO
 753
 754 </PRE>
 755 <H3>6.3.6.1  Descriptor Validation</H3>
 756 The 80386 has two instructions,
 757 <A HREF="VERR.htm">VERR</A> and
 758 <A HREF="VERR.htm">VERW</A>, which determine whether a
 759 selector points to a segment that can be read or written at the current
 760 privilege level. Neither instruction causes a protection fault if the result
 761 is negative.
 762 <P>
 763 <A HREF="VERR.htm">VERR</A> (Verify for Reading)
 764 verifies a segment for reading and loads ZF with
 765 1 if that segment is readable from the current privilege level.
 766 <A HREF="VERR.htm">VERR</A> checks
 767 that:
 768 <UL>
 769 <LI> The selector points to a descriptor within the bounds of the GDT or
 770 LDT.
 771 <LI> It denotes a code or data segment descriptor.
 772 <LI> The segment is readable and of appropriate privilege level.
 773 </UL>
 774 The privilege check for data segments and nonconforming code segments is
 775 that the DPL must be numerically greater than or equal to both the CPL and
 776 the selector's RPL. Conforming segments are not checked for privilege level.
 777 <P>
 778 <A HREF="VERR.htm">VERW</A> (Verify for Writing)
 779 provides the same capability as <A HREF="VERR.htm">VERR</A> for
 780 verifying writability. Like the
 781 <A HREF="VERR.htm">VERR</A> instruction,
 782 <A HREF="VERR.htm">VERW</A> loads ZF if the
 783 result of the writability check is positive. The instruction checks that the
 784 descriptor is within bounds, is a segment descriptor, is writable, and that
 785 its DPL is numerically greater or equal to both the CPL and the selector's
 786 RPL. Code segments are never writable, conforming or not.
 787
 788 <H3>6.3.6.2  Pointer Integrity and RPL</H3>
 789 The Requestor's Privilege Level (RPL) feature can prevent inappropriate use
 790 of pointers that could corrupt the operation of more privileged code or data
 791 from a less privileged level.
 792 <P>
 793 A common example is a file system procedure, FREAD (file_id, n_bytes,
 794 buffer_ptr). This hypothetical procedure reads data from a file into a
 795 buffer, overwriting whatever is there. Normally, FREAD would be available at
 796 the user level, supplying only pointers to the file system procedures and
 797 data located and operating at a privileged level. Normally, such a procedure
 798 prevents user-level procedures from directly changing the file tables.
 799 However, in the absence of a standard protocol for checking pointer
 800 validity, a user-level procedure could supply a pointer into the file tables
 801 in place of its buffer pointer, causing the FREAD procedure to corrupt them
 802 unwittingly.
 803 <P>
 804 Use of RPL can avoid such problems. The RPL field allows a privilege
 805 attribute to be assigned to a selector. This privilege attribute would
 806 normally indicate the privilege level of the code which generated the
 807 selector. The 80386 processor automatically checks the RPL of any selector
 808 loaded into a segment register to determine whether the RPL allows access.
 809 <P>
 810 To take advantage of the processor's checking of RPL, the called procedure
 811 need only ensure that all selectors passed to it have an RPL at least as
 812 high (numerically) as the original caller's CPL. This action guarantees that
 813 selectors are not more trusted than their supplier. If one of the selectors
 814 is used to access a segment that the caller would not be able to access
 815 directly, i.e., the RPL is numerically greater than the DPL, then a
 816 protection fault will result when that selector is loaded into a segment
 817 register.
 818 <P>
 819 <A HREF="ARPL.htm">ARPL</A>
 820 (Adjust Requestor's Privilege Level) adjusts the RPL field of a
 821 selector to become the larger of its original value and the value of the RPL
 822 field in a specified register. The latter is normally loaded from the image
 823 of the caller's CS register which is on the stack. If the adjustment changes
 824 the selector's RPL, ZF (the zero flag) is set; otherwise, ZF is cleared.
 825 <P>
 826 <HR>
 827 <P>
 828 <B>up:</B> <A HREF="c06.htm">
 829 Chapter 6 -- Protection</A><BR>
 830 <B>prev:</B> <A HREF="s06_02.htm">6.2  Overview of 80386 Protection Mechanisms</A><BR>
 831 <B>next:</B> <A HREF="s06_04.htm">6.4  Page-Level Protection</A>
 832 </BODY>