UNIT 3 (IMPORTANT POINTS AND MCQS)

TOPIC 1: NEED OF PROTECTION

why protection - To help debug applications faster and make them more robust in production.

==> Protection applies both to segment translation and to page translation.

==> Invalid attempts to access memory result in an exception.

==> Each segment register has bits in the invisible portion for storing base, limit, type, and privilege level.

==> type checking has 2 funct. --> distnguish among diff descp formats --> specify intended use of segment

==> type field values : 0,A,D -reserved2 LDT4 Call Gate5 Task Gate9 Available 386 TSSB Busy 386 TSSC 386 Call GateE 386 Interrupt GateF 386 Trap Gate

==> The processor causes a general protection exception in any of these cases:

• Attempt to access a memory byte at an address > limit.• Attempt to access a memory word at an address >= limit.

• Attempt to access a memory doubleword at an address >=(limit-2).

==> levels of privilege0- kernel1- system services2- custom services3- applications

==> it is not possible to write to a segment described as a code segment.==> for jmp, call, ret , the processor only check whether limit does not exceeds current executable segment.This limit is cached in the CS register;

==> To provide protection for control transfers among executable segments at different privilege levels, the 80386 uses gate descriptors. There are four kinds of gate descriptors:

• Call gates• Trap gates• Interrupt gates• Task gates

==> call gates functions:• to define entry point in procedure.• specify privilege level of entry point.

==> Only CALL instructions can use gates to transfer to smaller privilege levels

==> JMP instruction only to transfer to an executable segment with the same privilege level or to a conforming segment.

==> The TSS does not have a stack pointer for a privilege level 3 stack

==> privileged instruction work only with cpl-0CLTS -Clear Task-Switched FlagHLT -Halt ProcessorLGDT -Load GDT RegisterLIDT -Load IDT RegisterLLDT -Load LDT RegisterLMSW -Load Machine Status WordLTR -Load Task RegisterMOV to/from CRn -Move to Control Register nMOV to/from DRn -Move to Debug Register nMOV to/from TRn -Move to Test Register n

==> LAR (Load Access Rights) is used to verify that a pointer refers to a segment of the proper privilege level and type.

==> LSL (Load Segment Limit) allows software to test the limit of a descriptor

==> VERR and VERW perform following operations: • The selector points to a descriptor within the bounds of the GDT or LDT.• It denotes a code or data segment descriptor.• The segment is readable/writable and of appropriate privilege level.

==> Code segments are never writable, conforming or not.

==> page level protection :• type checking • rest. of addressable domain

==> rest. of add. domain:u/s = 0 --> OS or sytem soft. related datau/s = 1 --> application related data

==> u/s is related to CPL. --> cpl 0,1,2 == supervisor level

--> cpl 3 == user level

==> type checking r/w = 0 --> read onlyr/w = 1 --> read-write access

==> Certain accesses are checked as if they are privilege-level 0 references, even if CPL = 3:

• LDT, GDT, TSS, IDT references.• Access to inner stack during ring-crossing CALL/INT.

==> table 6-5 , Pg no: 6-22

TOPIC 2: SEGMENT LEVEL PROTECTION

All five aspects of protection apply to segment translation: 1. Type checking 2. Limit checking 3. Restriction of addressable domain 4. Restriction of procedure entry points 5. Restriction of instruction set

The segment is the unit of protection, and segment descriptors store protection parameters. .Segment registers hold the protection parameters of the currently addressable segments.

The TYPE field of a descriptor has two functions:

1. It distinguishes among different descriptor formats. 2. It specifies the intended usage of a segment.

The writable bit in a data-segment descriptor specifies whether instructions can write

into the segment.

A readable, executable segment may be read in two ways:

1. Via the CS register, by using a CS override prefix. 2. By loading a selector of the descriptor into a data-segment register (DS, ES, FS, or GS).

Type checking can be used to detect programming errors that would attempt to use segment in ways not intended by the programmer.

The CS register can be loaded only with a selector of an executable

segment. Selectors of executable segments that are not readable cannot be loaded into data segment registers. Only selectors of writable data segments can be loaded into SS.

: No instruction may write into an executable segment.

No instruction may write into a data segment if the writable bit is not set. No instruction may read an executable segment unless the readable bit is set.

The limit field of a segment descriptor is used by the processor to prevent programs from addressing outside the segment

The processor causes a general protection exception in any of these cases: • Attempt to access a memory byte at an address> limit. • Attempt to access a memory word at an address :> limit. • Attempt to access a memory doubleword at an address :>(limit-2).

Each descriptor is eight bytes long, the limit value is N * 8 - 1 for a table that can contain up to N descriptors.

A one-level system should use privilege level zero; a two-level system should use privilegelevels zero and three.

The following methods of accessing data in code segments are possible: 1. Load a data-segment register with a selector of a nonconforming, readable, executable segment. 2. Load a data-segment register with a selector of a conforming, readable, executable segment. 3. Use a CS override prefix to read a readable, executable segment whose selector is already loaded in the CS register.

The "near" forms of JMP, CALL, and RET transfer within the current code segment, and therefore are subject only to limit checking

The operands of the "far" forms of JMP and CALL refer to other segments;

therefore, the processor performs privilege checking.

There are two ways a JMP or CALL can refer to another segment:

1. The operand selects the descriptor of another executable segment. 2. The operand selects a call gate descriptor

Two different privilege levels enter into a privilege check for a control

transfer that does not use a call gate: 1. The CPL (current privilege level).

2. The DPL of the descriptor of the target segment. TOPIC 3: PAGE LEVEL PROTECTION

1: Protection related to pages are ____________

A.Type checking

b. Limit checking

c .None of the above

d. All of the above

Ans:a

1. For operating system the supervisor level is______________ a. 0b. 1c. 2d. None of the aboveAns: a

2. If CPL is _______ the processor is executing at supervisor level. a. 0 b. 1 c. 2 d. All of the above

Ans : d

3. If CPL is _________ the processor is executing at user level. a. 0 b. 1 c. 2 d. 3

Ans : d

4. If (R/W)=0 ,it means a. Write only acess b. Read only acess c. Read and write acess d. None of both

Ans: b

5. When paging is enabled in 80386 , it first evaluates _______ then _______.a. Page level protection ,segment level protection b. Segment level protection c. None of above d. Segment level protection, page level protection

Ans: d

6. All priviledged instructions are executed at CPL=_________. a. 0

b. 1 c. 2 d. 3

Ans : a

7. Page level protection can be achieved using _____ bits. a. 3 b. 2 c. 1 d. 0

Ans: a

8. If the bit in PDE and PTE causes privilege level violation , an exception ____ is generated.a. 0 b. 13 c. 11 d. None of the above

Ans: b

9. If PTE bit is cleared the PDE bit gets irrevalent. a. True b. False

Ans : b

10.Base address for page level protection is a. 4KB b. 32 bit c. 16 bit

d. None of these

Ans: a

11.Dirty bit status is ___ in page level protection a. Present b. Absent c. Cant say d. Such bit doeasnt exist

Ans: a

12.Size of page level protection is a. 4KB b. 32 bit c. 16 bit d. None of these

Ans: a

13.Page level protection has ______ privilege level a. 1 b. 2 c. 3 d. 4

Ans: b

14.When processor is executing at supervisor level , all pages are a. Readable b. Writable c. Both d. None

Ans: c

15.When PDE is cleared and PTE is irreverent then a. Only supervisor level is granted b. User level is granted c. None d. May be both

Ans : a

16.A bit status is present in page level protection a. true b. False

Ans: a

17.Restriction to addressable domain is type of page level protection a. True b. False

Ans: a

18.For saving address of exception _______ is used A. Cr1 B. Cr2 C. Cr3 D. Cr4

Ans: b

19.When exception 13 is put in stack , ________ exception is called a. 11 b. 12 c. 15 d. 14

Ans :d

TOPIC 4: COMBINING SEGMENT AND PAGE-LEVEL

Two kinds of protection are related to pages:

1. Restriction of addressable domain.

2. Type checking.

Fields of PDEs and PTEs control access to pages.

Supervisor level (U /S = 0 )-for the operating system and other systems software and related data

User level (U /S= 1 )-for applications procedures and data.

The current level (U or S) is related to CPL

If CPL is 0, 1, or 2, the processor is executing at supervisor level. If CPL is 3, the processor is executing at user level.

When the processor is executing at supervisor level, all pages are addressable When the processor is executing at user level, only pages that belong to the

user level are addressable.

At the level of page addressing, two types are defined: 1. Read-only access (R/W=O) 2. Read/write access (R/W = 1)

When the processor is executing at supervisor level, all pages are both readable and writable.

When the processor is executing at user level, only pages that belong to user level and are marked for read/write access are writable.

IF CPL = 3: LDT, GDT, TSS, IDT references are checked.

IF CPL=3 : Access to inner stack during ring-crossing CALL/INT is checked.

When paging is enabled, the 80386 first evaluates segment protection, then evaluates page protection.

S – Supervisor, R - Read only, U – User, W - Read and Write

x indicates that when the combined U/S attribute is S, the R/W attribute is not checked.

TOPIC 5: TASK STATE SEGMENT

i. All the information the processor needs in order to manage a task is stored in a special type of segment _____ .(Task State Segment)

ii. The Fields of a TSS belong to _____ classes. (Two)iii. The First class of the TSS is _____. (Dynamic Set)iv. The Second class of the TSS is _____. (Static Set)v. The dynamic set contains the field’s _____. (The general

registers, The segment registers, The flags register, The instruction pointer, The selector of the TSS of the previously executing task)

vi. The selector of the TSS of the previously executing task_____. (updated only when a return is expected)

vii. The _____ of the TSS of the previously executing task updated only when a return is expected.(Selector)

viii. A static set, the processor _____ but does not change.(Reads)ix. The static set includes the field’s _____.(Selector,

register(PDBR), pointers, debug trap bit, I/O map)x. The register (PDBR) that contains the _____ address of the task's

page directory (read only when paging is _____). (Base, enabled)xi. Pointers to the stacks for privilege levels _____. (0-2)

xii. The T-bit _____. (Debug trap bit)xiii. Task switch exception can be avoided by _____

Strategies. (Two)xiv. The task switch exception can be avoided by two strategies, first

one is _____.( By allocating the TSS so that it does not cross a page boundary)

xv. The task switch exception can be avoided by two strategies, second is _____.(By ensuring that both pages are either both present or both not-present at the time of a task switch)

xvi. If both pages are not-present, then the _____must make both pages present before restarting the instruction.( page-fault handler)

TOPIC 6:TSS DESCRIPTOR

1.The task segment descriptor contains information about a)Location b) Size c)privilege level d)all

of these Ans-d2.The TYPE field is used to indicate

a)The task is currently busy b)The TSS is available

c)on a chain of active tasks d)All of these Ans-d3.The selector in the task register points to

a)current task state segment b)next task state segment

c)global descriptor d)All of these

Ans-a4.The ___ -bit in the TYPE field indicates the task is available

a)A b) B c)P d)G Ans-b

5. The TYPE field of descriptor is used to find thea) descriptor typeb) segment typec) descriptor and segment typed) none Ans-c6. The task state segment descriptor the ‘B’ bit having bit number ___.a) 7                  b) 8                  c) 19                  d) 1Ans-d7. The task state segment descriptor the ‘B’ bit having bit number ___.a) 7                  b) 8                  c) 9                  d) 10Ans-c

8. The TSS with a selector that has TI = 1 ________________ results in an exception.a) Indicating the current LDT             b) Indicating the current IDTc) Indicating the current GDT                        d) Indicating the current IVT Ans-a

9. The SELECTOR field of a task gate must refer to a __________.a) TSS                         b) base address            c) Segment Limit        d) TSS descriptor Ans-d

10.TSS descriptors reside in the a)GDT b)LDT c)IDT d)Task registers

Ans-a

11.A type code of 9 indicates a _______________ a)available                     b) busy c) non

busy d) both a & b Ans-c

12.A type code of 11 indicates a _______________ a)available                     b) busy c)

non busy d) both a & b Ans-b

13.The DPL field of TSS descriptor should be set to ______ so that trusted software has the right to perform task switching.

a)1 b) 0 c) 01 d) all of theseAns-b

14.When a TSS descriptor is loaded to any of the _____________ causes an exception. a) Task register b) segment registerc) task and segment registerd) none Ans-b

15. The task segment descriptor does contains information about a)Location b) Size

c)privilege level d)none of these Ans-d

16. The task state segment descriptor the ‘B’ bit having bit number ___.a) 7                  b) 8                  c) 19                  d) 3Ans-d

17. The limit field of the descriptor is ofa) 10 bitsb) 8 bitsc) 16 bitsd) 20 bits Ans-d

TOPIC 7:TASK REGISTER

1. The _______ identifies the currently executing task by pointing to the TSS.

a. TSS

b. TD

c. TR

d. TP

Ans- c

2. The task register contains____________

a. Visible portion

b. Invisible portion

c. Both (a) and (b)

d. None of these

Ans- c

3. The ____________ in the visible portion in the task register

a. Descriptor

b. Selector

c. Both (a) and (b)

d. None of the above

Ans- b

4. The ___________ can be read and changed by instructions in the task register

a. Invisible portion

b. Visible portion

c. Both (a) and (b)

d. None of the above

Ans- b

5. The ____________ cannot be read by any instructions in the task register.

a. Visible portion

b. Invisible portion

c. Both (a) and (b)

d. None of the above

Ans- b

6. The _________ is maintained by the processor.

a. Invisible portion

b. Visible portion

c. Both (a) and (b)

d. None of the above

Ans- a

7. The selector in the visible portion selects a ____________ in the GDT.

a. TSS Descriptorb. TDc. TPd. None of the above.

Ans- a

8. Size of TR is

a. 48 bits

b. 16 bits

c. 32 bits

d. 24 bits

Ans- b

9. The processor uses the _________ to cache the base and limit values from the TSS descriptor.

a. Invisible portionb. Visible portionc. Bothe (a) and (b)d. None of the above

Ans- a

10. The instructions _____ and ______ are used to modify and read the visible portion of the task register. a. LTR, LIDT b. LTR, STR c. STR, SIDT d. LIDT, SIDT

Ans- b

11. ______ loads the visible portion of the task register with the selectorOperand

a. LIDTb. STRc. LTRd. SIDT

Ans- c

12. ____ is not a privileged instruction.

a. STRb. LTRc. Both (a) and (b)d. None of the above

Ans- a

13. _____ is a privileged instruction.

a. STRb. LTRc. Both (a) and (b)d. None of the above

Ans- b

14. LTR may be executed only when _______is zero.

a. DPLb. RPLc. CPLd. None of the above

Ans- c

15. The invisible part of the task register holds the_______

a. Base b. Limitc. Both (a) and (b)d. None of these

Ans- c

16. The visible part of the task register holds the__________

a. Limit b. Selectorc. Instructiond. Base

Ans- b

17. __________used during system initialization to give an initial value to the task register.

a. STRb. LTRc. Both (a) and (b)d. None of the above

Ans- b

18. ________ also loads the invisible portion with information from the TSS descriptor selected by the operand.

a. LTRb. STRc. Both (a) and (b)d. None of these

Ans-a

19. Selector is a 16 bit ________ register.

a. Visible b. Invisiblec. Partially visibled. None of these

Ans- a

20. In LTR __________ cannot be viewed.

a. Base addressb. Selectorc. Limitd. Both (a) and (c)

Ans- d

TOPIC 8:TASK GATE DESCRIPTOR

1.)Task gate descriptor provides indirect protected reference t o TSS.

2.)The value of RPL in the selector is not used by Processor.

3.)The privilege level rule is max(CPL,RPL)<= task gate DPL.

4.)The Task gate descriptor serves as an interface point between the task state segment a nd the user code.

5.) Task gate are used for task switching

6.)The SELECTOR field of a task gate must refer to a TSS descriptor.

7.)Type field of task gate is 00101

8.)if DPL =0 privilege constraint prevents procedures from causing task switch.

9.)System descriptor and gate descriptor i s a type of System segment descriptor

10.) Call gates are used to alter the privilege level

11.) The descriptor are of 4 types call gates ,task gate,interrupt gate,trap gate.

12.)The gate descriptor contains the information regarding the destination of control transfer, required stack manipulations,privilege level and its type.

13.)Interrupt gates and trap gates are used to specify corresponding service routines.

14.)Current task is permitted to switch to the New task only when Task gate DPL>=max(CPL,RPL)

15.) A procedure that does not have sufficient privilege to use TSS descriptor in the GDT can still switch to another task if it has access to a task gate for that task in its LDT.

TOPIC 9:TASK SWITCHING

Q1) The 80386 switches execution to another task in any of four cases:

1. The current task executes a JMP or CALL that refers to a TSS descriptor.

2. The current task executes a JMP or CALL that refers to a task gate.

3. An interrupt or exception vectors to a task gate in the IDT.

4. The current task executes an IRET when the NT flag is set

Ans: 1,2,3,4

Q2) what distinguishes between the standard mechanism and the variant that causes a task switch?

Ans: Either the type of descriptor referenced or the NT (nested task) bit in the flag word

Q3) When does a task switch does not occur?

Ans: If it vectors to an interrupt or trap gate in the IDT

Q4) what are all ordinary mechanisms of the 80386 that can be used in circumstances that do not require a task switch?

Ans: JMP, CALL, IRET, interrupts, and exceptions

Q5) To cause a task switch, a JMP or CALL instruction can refer to:

Ans: Either TSS descriptor or task gate

Q6) If the NT flag is set in case of interrupt what is the handler?

Ans: interrupt task

Q7) If the NT flag is set IRET switches back to

1. Interrupted task

2. Interrupted procedure in the interrupted task

Ans: 1

Q8)What should be the value of DPL for task switching by JMP or CALL instructions?

Ans: Dpl of the TSS descriptor or task gate must be less than or equal to maximum CPL and RPL of the gate selector

Q9)Which of the following are allowed to switch tasks regardless of the value of DPL?

1.IRET

2.interrupts

3.exceptions

4.all of the above

Ans:4

Q10)Where does the EIP field of TSS point?

Ans:to the instruction after the one that caused the task switch.

Q11)What condition must be checked of the TSS descriptor of the new task before switching?

Ans:it must be marked present and must have valid limit

Q12)What can be a selector?

Ans:either the operand of the control transfer instruction or taken from a task gate

Q13)What bit must be set to indicate that incoming task's TSS descriptor as busy?

Ans:The TS(task switched)bit of MSW(machine status word)

14) Note that the state of the outgoing task is always saved when a task switch occurs.

15) The TS flag is useful to systems software when a coprocessor (such as a numerics coprocessor) is present. The TS bit signals that the context of the coprocessor may not correspond to the current 80386 task.

16) Because the tasks are isolated by their separate address spaces and TSSs and because privilege rules can be used to prevent improper aCCess to a TSS, no privilege rules are needed to constrain the relation between the CPLs of the tasks.

TOPIC 10:TASK LINKING,TASK ADDRESS SPACE

The NT flag indicates whether the back-link field is valid. If NT is set, the 80386 switches back to the task selected by the back-link field.

The B-bit (busy bit) of the TSS descriptor ensures the integrity of the back-link.

TSS is not a reentrable resource. The ability for tasks to have distinct address spaces is an important aspect

of 80386 protection.

When paging is not enabled, this is the only possibility. Without page tables, all linear addresses map to the same physical addresses.

PDBR (page directory base register) is loaded from the TSS with each task switch, eachtask may have a different page directory

The linear space mapped by the GDT should also be mapped to a common physical space.

common linear-to-physical space mapping does not enable sharing of among tasks.

Via the GDT. All tasks have access to the descriptors in the GDT. By sharing LDTs. Two or more tasks can use the same LDT if the LDT

selectors in their TSSs select the same LDT segment.

By descriptor aliases in LDTs. It is possible for certain descriptors of different LDTs to point to the same linear address space.

The new task should return to previous task with the help of an IRET instruction.

CALL instruction to task gates will nest tasks and only IRET would be able to unnest tasks.

The nest task is similar to the nested subroutines . In theory, the linear address spaces of different tasks may map to

completely distinct physical addresses. In practice, some portion of the linear address spaces of all tasks must map

to the same physical addresses. How many ways to create a logical –to- physical address –space