📄 s06_03.htm
字号:
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><HTML><HEAD><TITLE>80386 Programmer's Reference Manual -- Section 6.3</TITLE></HEAD><BODY><B>up:</B> <A HREF="c06.htm">Chapter 6 -- Protection</A><BR><B>prev:</B> <A HREF="s06_02.htm">6.2 Overview of 80386 Protection Mechanisms</A><BR><B>next:</B> <A HREF="s06_04.htm">6.4 Page-Level Protection</A><P><HR><P><H1>6.3 Segment-Level Protection</H1>All five aspects of protection apply to segment translation:<OL><LI> Type checking<LI> Limit checking<LI> Restriction of addressable domain<LI> Restriction of procedure entry points<LI> Restriction of instruction set</OL>The segment is the unit of protection, and segment descriptors storeprotection parameters. Protection checks are performed automatically by theCPU when the selector of a segment descriptor is loaded into a segmentregister and with every segment access. Segment registers hold theprotection parameters of the currently addressable segments.<H2>6.3.1 Descriptors Store Protection Parameters</H2><A HREF="#fig6-1">Figure 6-1</A> highlights the protection-related fields of segment descriptors.<P>The protection parameters are placed in the descriptor by systems softwareat the time a descriptor is created. In general, applications programmers donot need to be concerned about protection parameters.<P>When a program loads a selector into a segment register, the processorloads not only the base address of the segment but also protectioninformation. Each segment register has bits in the invisible portion forstoring base, limit, type, and privilege level; therefore, subsequentprotection checks on the same segment do not consume additional clockcycles.<P><A NAME="fig6-1"><IMG align=center SRC="fig6-1.gif" border=0><P><H3>6.3.1.1 Type Checking</H3>The TYPE field of a descriptor has two functions:<OL><LI> It distinguishes among different descriptor formats.<LI> It specifies the intended usage of a segment.</OL>Besides the descriptors for data and executable segments commonly used byapplications programs, the 80386 has descriptors for special segments usedby the operating system and for gates. Table 6-1 lists all the types definedfor system segments and gates. Note that not all descriptors definesegments; gate descriptors have a different purpose that is discussed laterin this chapter.<P>The type fields of data and executable segment descriptors include bitswhich further define the purpose of the segment (refer to <A HREF="#fig6-1">Figure 6-1</A> ):<UL><LI> The writable bit in a data-segment descriptor specifies whetherinstructions can write into the segment.<LI> The readable bit in an executable-segment descriptor specifieswhether instructions are allowed to read from the segment (for example,to access constants that are stored with instructions). A readable,executable segment may be read in two ways:<OL><LI> Via the CS register, by using a CS override prefix.<LI> By loading a selector of the descriptor into a data-segment register(DS, ES, FS,or GS).</OL></UL>Type checking can be used to detect programming errors that would attemptto use segments in ways not intended by the programmer. The processorexamines type information on two kinds of occasions:<OL><LI> When a selector of a descriptor is loaded into a segment register.Certain segment registers can contain only certain descriptor types;for example:<UL><LI> The CS register can be loaded only with a selector of an executablesegment.<LI> Selectors of executable segments that are not readable cannot beloaded into data-segment registers.<LI> Only selectors of writable data segments can be loaded into SS.</UL><LI> When an instruction refers (implicitly or explicitly) to a segmentregister. Certain segments can be used by instructions only in certainpredefined ways; for example:<UL><LI> No instruction may write into an executable segment.<LI> No instruction may write into a data segment if the writable bit isnot set.<LI> No instruction may read an executable segment unless the readable bitis set.</UL></OL><P><PRE>Table 6-1. System and Gate Descriptor TypesCode Type of Segment or Gate0 -reserved1 Available 286 TSS2 LDT3 Busy 286 TSS4 Call Gate5 Task Gate6 286 Interrupt Gate7 286 Trap Gate8 -reserved9 Available 386 TSSA -reservedB Busy 386 TSSC 386 Call GateD -reservedE 386 Interrupt GateF 386 Trap Gate</PRE><H3>6.3.1.2 Limit Checking</H3>The limit field of a segment descriptor is used by the processor to preventprograms from addressing outside the segment. The processor's interpretationof the limit depends on the setting of the G (granularity) bit. For datasegments, the processor's interpretation of the limit depends also on theE-bit (expansion-direction bit) and the B-bit (big bit) (refer to Table6-2).<P>When G=0, the actual limit is the value of the 20-bit limit field as itappears in the descriptor. In this case, the limit may range from 0 to0FFFFFH (2^(20) - 1 or 1 megabyte). When G=1, the processor appends 12low-order one-bits to the value in the limit field. In this case the actuallimit may range from 0FFFH (2^(12) - 1 or 4 kilobytes) to 0FFFFFFFFH(2^(32)- 1 or 4 gigabytes).<P>For all types of segments except expand-down data segments, the value ofthe limit is one less than the size (expressed in bytes) of the segment. Theprocessor causes a general-protection exception in any of these cases:<UL><LI> Attempt to access a memory byte at an address > limit.<LI> Attempt to access a memory word at an address >= limit.<LI> Attempt to access a memory doubleword at an address >= (limit-2).</UL>For expand-down data segments, the limit has the same function but isinterpreted differently. In these cases the range of valid addresses is fromlimit + 1 to either 64K or 2^(32) - 1 (4 Gbytes) depending on the B-bit. Anexpand-down segment has maximum size when the limit is zero.<P>The expand-down feature makes it possible to expand the size of a stack bycopying it to a larger segment without needing also to update intrastackpointers.<P>The limit field of descriptors for descriptor tables is used by theprocessor to prevent programs from selecting a table entry outside thedescriptor table. The limit of a descriptor table identifies the last validbyte of the last descriptor in the table. Since each descriptor is eightbytes long, the limit value is N * 8 - 1 for a table that can contain up toN descriptors.<P>Limit checking catches programming errors such as runaway subscripts andinvalid pointer calculations. Such errors are detected when they occur, sothat identification of the cause is easier. Without limit checking, sucherrors could corrupt other modules; the existence of such errors would notbe discovered until later, when the corrupted module behaves incorrectly,and when identification of the cause is difficult.<PRE>Table 6-2. Useful Combinations of E, G, and B BitsCase: 1 2 3 4Expansion Direction U U D DG-bit 0 1 0 1B-bit X X 0 1Lower bound is:0 X XLIMIT+1 Xshl(LIMIT,12,1)+1 XUpper bound is:LIMIT Xshl(LIMIT,12,1) X64K-1 X4G-1 XMax seg size is:64K X64K-1 X4G-4K X4G XMin seg size is:0 X X4K X Xshl (X, 12, 1) = shift X left by 12 bits inserting one-bits on the right</PRE><H3>6.3.1.3 Privilege Levels</H3>The concept of privilege is implemented by assigning a value from zero tothree to key objects recognized by the processor. This value is called theprivilege level. The value zero represents the greatest privilege, thevalue three represents the least privilege. The followingprocessor-recognized objects contain privilege levels:<UL><LI> Descriptors contain a field called the descriptor privilege level(DPL).<LI> Selectors contain a field called the requestor's privilege level(RPL). The RPL is intended to represent the privilege level ofthe procedure that originates a selector.<LI> An internal processor register records the current privilege level(CPL). Normally the CPL is equal to the DPL of the segment thatthe processor is currently executing. CPL changes as control istransferred to segments with differing DPLs.</UL>The processor automatically evaluates the right of a procedure to accessanother segment by comparing the CPL to one or more other privilege levels.The evaluation is performed at the time the selector of a descriptor isloaded into a segment register. The criteria used for evaluating access todata differs from that for evaluating transfers of control to executablesegments; therefore, the two types of access are considered separately inthe following sections.<P><A HREF="#fig6-2">Figure 6-2</A> shows how these levels of privilege can be interpreted as ringsof protection. The center is for the segments containing the most criticalsoftware, usually the kernel of the operating system. Outer rings are forthe segments of less critical software.<P>It is not necessary to use all four privilege levels. Existing softwarethat was designed to use only one or two levels of privilege can simplyignore the other levels offered by the 80386. A one-level system should useprivilege level zero; a two-level system should use privilege levels zeroand three.<P><A NAME="fig6-2"><IMG align=center SRC="fig6-2.gif" border=0><P><H2>6.3.2 Restricting Access to Data</H2>To address operands in memory, an 80386 program must load the selector of adata segment into a data-segment register (DS, ES, FS, GS, SS). Theprocessor automatically evaluates access to a data segment by comparingprivilege levels. The evaluation is performed at the time a selector for thedescriptor of the target segment is loaded into the data-segment register.As <A HREF="#fig6-3">Figure 6-3</A> shows, three different privilege levels enter into this typeof privilege check:<OL><LI> The CPL (current privilege level).<LI> The RPL (requestor's privilege level) of the selector used to specifythe target segment.<LI> The DPL of the descriptor of the target segment.</OL>Instructions may load a data-segment register (and subsequently use thetarget segment) only if the DPL of the target segment is numerically greaterthan or equal to the maximum of the CPL and the selector's RPL. In otherwords, a procedure can only access data that is at the same or lessprivileged level.<P>The addressable domain of a task varies as CPL changes. When CPL is zero,data segments at all privilege levels are accessible; when CPL is one, onlydata segments at privilege levels one through three are accessible; when CPLis three, only data segments at privilege level three are accessible. Thisproperty of the 80386 can be used, for example, to prevent applicationsprocedures from reading or changing tables of the operating system.<P><A NAME="fig6-3">⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -