【xv6学习之番外篇】保护
本文源自：https://pdos.csail.mit.edu/6.828/2014/readings/i386/s06_01.htm (Intel 80386 Reference Programmer's Manual)
1 Why Protection?
The purpose of the protection features of the 80386 is to help detect and identify bugs.2 Overview of 80386 Protection Mechanisms
Protection in the 80386 has five aspects:
1)Type checking2)Limit checking
3)Restriction of addressable domain
4)Restriction of procedure entry points
5)Restriction of instruction set
The concept of "privilege" is central to several aspects of protection (numbers 3, 4, and 5 in the preceeding list). Applied to procedures, privilege is the degree to which the procedure can be trusted not to make a mistake that might affect other procedures or data. Applied to data, privilege is the degree of protection that a data structure should have from less trusted procedures.
The concept of privilege applies both to segment protection and to page protection.
3 Segment-Level Protection
The segment is the unit of protection, and segment descriptors store protection parameters. Protection checks are performed automatically by the CPU when the selector of a segment descriptor is loaded into a segment register and with every segment access. Segment registers hold the protection parameters of the currently addressable segments.
3.1 Descriptors Store Protection Parameters
The protection parameters are placed in the descriptor by systems software at the time a descriptor is created. In general, applications programmers do not need to be concerned about protection parameters.
3.1.1 Type Checking
The TYPE field of a descriptor has two functions:
1)It distinguishes among different descriptor formats.
2)It specifies the intended usage of a segment.
1)It distinguishes among different descriptor formats.
2)It specifies the intended usage of a segment.
Type checking can be used to detect programming errors that would attempt to use segments in ways not intended by the programmer. The processor examines type information on two kinds of occasions:
1)When a selector of a descriptor is loaded into a segment register. Certain segment registers can contain only certain descriptor types;
2)When an instruction refers (implicitly or explicitly) to a segment register. Certain segments can be used by instructions only in certain predefined ways.
3.1.2 Limit Checking
The limit field of a segment descriptor is used by the processor to prevent programs from addressing outside the segment.
The processor's interpretation of the limit depends on the setting of the G (granularity) bit. When G=0, the actual limit is the value of the 20-bit limit field as it appears in the descriptor. In this case, the limit may range from 0 to 0FFFFFH (2^(20) - 1 or 1 megabyte). When G=1, the processor appends 12 low-order one-bits to the value in the limit field. In this case the actual limit may range from 0FFFH (2^(12) - 1 or 4 kilobytes) to 0FFFFFFFFH(2^(32) - 1 or 4 gigabytes).
3.1.3 Privilege Levels
The concept of privilege is implemented by assigning a value from zero to three to key objects recognized by the processor. This value is called the privilege level. The value zero represents the greatest privilege, the value three represents the least privilege.The following processor-recognized objects contain privilege levels:
1)Descriptors contain a field called the descriptor privilege level (DPL).
2)Selectors contain a field called the requestor's privilege level (RPL). The RPL is intended to represent the privilege level of the procedure that originates a selector.
3)An internal processor register records the current privilege level (CPL). Normally the CPL is equal to the DPL of the segment that the processor is currently executing. CPL changes as control is transferred to segments with differing DPLs.
2)Selectors contain a field called the requestor's privilege level (RPL). The RPL is intended to represent the privilege level of the procedure that originates a selector.
3)An internal processor register records the current privilege level (CPL). Normally the CPL is equal to the DPL of the segment that the processor is currently executing. CPL changes as control is transferred to segments with differing DPLs.
3.2 Restricting Access to Data
To address operands in memory, an 80386 program must load the selector of a data segment into a data-segment register (DS, ES, FS, GS, SS). The processor automatically evaluates access to a data segment by comparing privilege levels. The evaluation is performed at the time a selector for the descriptor of the target segment is loaded into the data-segment register. A procedure can only access data that is at the same or less privileged level.
3.2.1 Accessing Data in Code Segments
Less common than the use of data segments is the use of code segments to store data. Code segments may legitimately hold constants; it is not possible to write to a segment described as a code segment. The following methods of accessing data in code segments are possible:
1)Load a data-segment register with a selector of a nonconforming, readable, executable segment.
2)Load a data-segment register with a selector of a conforming, readable, executable segment.
3)Use a CS override prefix to read a readable, executable segment whose selector is already loaded in the CS register.
2)Load a data-segment register with a selector of a conforming, readable, executable segment.
3)Use a CS override prefix to read a readable, executable segment whose selector is already loaded in the CS register.
3.3 Restricting Control Transfers
With the 80386, control transfers are accomplished by the instructions JMP, CALL, RET, INT, and IRET, as well as by the exception and interrupt mechanisms.
3.4 Gate Descriptors Guard Procedure Entry Points
To provide protection for control
transfers among executable segments at different privilege levels, the 80386 uses gate descriptors. There are four kinds of gate descriptors:
1)Call gates
2)Trap gates
3)Interrupt gates
4)Task gates
2)Trap gates
3)Interrupt gates
4)Task gates
3.5 Some Instructions are Reserved for Operating
System
Instructions that have the power to affect the protection mechanism or to influence general system performance can only be executed by trusted procedures. The 80386 has two classes of such instructions:
1)Privileged instructions -- those used for system control.
2)Sensitive instructions -- those used for I/O and I/O related activities.
1)Privileged instructions -- those used for system control.
2)Sensitive instructions -- those used for I/O and I/O related activities.
3.6 Instructions for Pointer Validation
Pointer validation is an important part of locating programming errors. Pointer validation is necessary for maintaining isolation between the privilege levels. Pointer validation consists of the following steps:
- Check if the supplier of the pointer is entitled to access the segment.
- Check if the segment type is appropriate to its intended use.
- Check if the pointer violates the segment limit.
The 80386 has two instructions, VERR and VERW, which determine whether a selector points to a segment that can be read or written at the current privilege level. Neither instruction causes a protection fault if the result is negative.
3.6.2 Pointer Integrity and RPL
The Requestor's Privilege Level (RPL) feature can prevent inappropriate use of pointers that could corrupt the operation of more privileged code or data from a less privileged level.
4 Page-Level Protection
Two kinds of protection are related to pages:
- Restriction of addressable domain.
- Type checking.
4.1 Page-Table Entries Hold Protection Parameters
It highlights the fields of PDEs and PTEs that control access to pages.
4.1.1 Restricting Addressable Domain
The concept of privilege for pages is implemented by assigning each page to one of two levels:
1、Supervisor level (U/S=0) -- for the operating system and other systems software and related data.
2、User level (U/S=1) -- for applications procedures and data.
The current level (U or S) is related to CPL. If CPL is 0, 1, or 2, the processor is executing at supervisor level. If CPL is 3, the processor is executing at user level.
When the processor is executing at supervisor level, all pages are addressable, but, when the processor is executing at user level, only pages that belong to the user level are addressable.
1、Supervisor level (U/S=0) -- for the operating system and other systems software and related data.
2、User level (U/S=1) -- for applications procedures and data.
The current level (U or S) is related to CPL. If CPL is 0, 1, or 2, the processor is executing at supervisor level. If CPL is 3, the processor is executing at user level.
When the processor is executing at supervisor level, all pages are addressable, but, when the processor is executing at user level, only pages that belong to the user level are addressable.
4.1.2 Type Checking
At the level of page addressing, two types are defined:
Read-only access (R/W=0)
Read/write access (R/W=1)
When the processor is executing at supervisor level, all pages are both readable and writable. When the processor is executing at user level, only pages that belong to user level and are marked for read/write access are writable; pages that belong to supervisor level are neither readable nor writable from user level.
Read-only access (R/W=0)
Read/write access (R/W=1)
When the processor is executing at supervisor level, all pages are both readable and writable. When the processor is executing at user level, only pages that belong to user level and are marked for read/write access are writable; pages that belong to supervisor level are neither readable nor writable from user level.
4.2 Combining Protection of Both Levels of Page Tables
For any one page, the protection attributes of its page directory entry may differ from those of its page table entry. The 80386 computes the effective protection attributes for a page by examining the protection attributes in both the directory and the page table. Table 6-5 shows the effective protection provided by the possible combinations of protection attributes.
Note
S -- Supervisor
R -- Read only
U -- User
W -- Read and Write
x indicates that when the combined U/S attribute is S, the R/W attribute is not checked.
R -- Read only
U -- User
W -- Read and Write
x indicates that when the combined U/S attribute is S, the R/W attribute is not checked.
4.3 Overrides to Page Protection
Certain accesses are checked as if they are privilege-level 0 references, even if CPL = 3:
1)LDT, GDT, TSS, IDT references.
2)Access to inner stack during ring-crossing CALL/INT.
1)LDT, GDT, TSS, IDT references.
2)Access to inner stack during ring-crossing CALL/INT.
5 Combining Page and Segment Protection
When paging is enabled, the 80386 first evaluates segment protection, then evaluates page protection. If the processor detects a protection violation at either the segment or the page level, the requested operation cannot proceed; a protection exception occurs instead.
For example, it is possible to define a large data segment which has some subunits that are read-only and other subunits that are read-write. In this case, the page directory (or page table) entries for the read-only subunits would have the U/S and R/W bits set to x0, indicating no write rights for all the pages described by that directory entry (or for individual pages). This technique might be used, for example, in a UNIX-like system to define a large data segment, part of which is read only (for shared data or ROMmed constants). This enables UNIX-like systems to define a "flat" data space as one large segment, use "flat" pointers to address within this "flat" space, yet be able to protect shared data, shared files mapped into the virtual space, and supervisor areas.