VOGONS


First post, by superfury

User metadata
Rank l33t++
Rank
l33t++

Strangely enough, looking at Bochs' tasking.cc, it doesn;t check CS privilege when it's conforming?

The 80386 programmer's reference manual says this:

- The conforming bit of the target code-segment descriptor is set, and
the DPL of the target is less than or equal to CPL.

So when DPL is greater than CPL(and RPL, when not gated, or just RPL during RETF/IRET), for example a RPL of 0 and DPL of 3, it faults? All other cases are allowed?
The same applies to CS loads during task switches?

Oddly enough, the 80386 programmer's reference manual says that "CS.RPL" must match something called "CS.CPL"? That cannot be right, as conforming segments would incorrectly fault? Also, does it mean CPL or CS.DPL when it says that? CPL is already the case, as it's CS.RPL becoming CPL before any segment is loaded and verified? CPL becomes SS.DPL after the SS descriptor is cached and verified(usually unchanging during V86 mode and Protected mode without faults)?

For a JMP instruction to a nonconforming segment, both of the following privilege rules must be satisfied; otherwise, a general […]
Show full quote

For a JMP instruction to a nonconforming segment, both of the following privilege rules must be satisfied; otherwise, a general protection exception results.

MAX (CPL,RPL) . gate DPL
target segment DPL = CPL
For a CALL instruction (or for a JMP instruction to a conforming segment), both of the following privilege rules must be satisfied; otherwise, a general protection exception results.
MAX (CPL,RPL) . gate DPL
target segment DPL . CPL

I also assume the "." that's in the privilege checks before figure 6.5 means "<=" instead?
Edit: Just found a scanned copy of the online documentation. Those "." are actually mistranslated "<=" symbols. So I was right on those.

Author of the UniPCemu emulator.
UniPCemu Git repository
UniPCemu for Android, Windows, PSP, Vita and Switch on itch.io

Reply 2 of 2, by superfury

User metadata
Rank l33t++
Rank
l33t++
peterferrie wrote:

It's intended to protect against code returning from low privilege to high privilege, so RPL of 0 and DPL of 3 should fault.

Strangely enough, Bochs doesn't seem to check that case(it simply passes said check always with conforming segments during task switches)? In Bochs, having a task with CS.RPL=0, CS.DPL=3 and SS=0(and of course TR.Busy being 0) can be successfully switched to and ran. A real CPU should fault on those settings, but Bochs just starts executing the task like it's unprivileged after a task switch to such an invalid task.

Edit: This is the case for data segments pointing to conforming code segment descriptors. If they're loaded in the CS selector that case is checked properly.

Edit: Hmmmm... Slightly related, the 80286 and 80287 programmer's reference manual seems to imply that loading a non-conforming code segment into a data segment(DS,ES, probably the same for FS&GS) follows the same rule as with data segment descriptors(MAX(CPL,RPL)<=DPL)? Is that true?

Author of the UniPCemu emulator.
UniPCemu Git repository
UniPCemu for Android, Windows, PSP, Vita and Switch on itch.io