Intel 80286, 80287 manual INTER-LEVEL Control Transfer VIA Call Gates

inter

PROTECTION

If the IP value is not within the limit of the code segment, a general protection fault occurs with an error code of O. If a CALL instruction is used, the return address is saved in the normal manner. The only effect of the call gate is to place a different address into CS:IP than that specified in the desti- nation address of the JMP or CALL instruction. This feature is useful for systems which require that a fixed address be provided to programs, even though the entry address for the routine may change due to different functions, software changes, or segment relocation.

7.5.1.3 INTER-LEVEL CONTROL TRANSFER VIA CALL GATES

If the destination code segment of the call gate is at a different privilege level than the CPL, an inter- level transfer is being requested. However, if the destination code segment DPL > CPL, then a general protection fault occurs with an error code identifying the destination code segment.

The gate guarantees that all transitions to a more privileged level will go to a valid entry point rather than possibly into the middle of a procedure (or worse, into the middle of an instruction). See figure 7-11.

Calls to more privileged levels may be performed only through call gates. A JMP instruction can never cause a privilege change. Any attempt to use a call gate in this manner will cause a general protection fault with an error code identifying the gate. Returns to more privileged levels are also prohibited. Inter-level transitions due to interrupts use a different gate, as discussed in Chapter 9.

The RPL field of the CS selector saved as part of the return address will always identify the caller's CPL. This information is necessary to correctly return to the caller's privilege level during the return instruction. Since the CALL instruction places the CS value on the more privileged stack, and JMP instructions cannot change privilege levels, it is not possible for a program to maliciously place an invalid return address on the caller's stack.

			CALL	OFFSET	SELECTOR		INSTRUCTION
			OPCOOE
						!	c
J				J			J
	COOE					CALL	DESCRIPTOR
	SEG.
						GATE	TABLES
	DESCR.
			_,	c			c
	J	t	J	J	J	!OFFSET
J							J
			ENTER				TARGET
							CODE

SEGMENT

c

J

G3010B

Figure 7-11. Call Gate

7-19