iAPX 286 Operating System Writers Guide 1983

INPUT /OUTPUTOUTOUTSSTIeLILOCKoutputoutput stringset interrupt flag (enable interrupts)clear interrupt flag (disable interrupts)lock busWhen interpreting any of these restricted instructions, the processor compares CPL to IOPL. If CPLex.ceeds IOPL, the processor causes a general protection exception and does not carry out theinstruction.Only a privilege-level 0 (PL-O) procedure (i.e., the operating system) can change IOPL. There is noinstruction that explicitly affects IOPL; however, any of the operations that load the flag word can, insome cases, change 10PL. The. only mechanisms for changing the flag word are• A task switch• The POPF (pop flags) instruction• IRETWhen CPL is greater than zero, the POPF instruction does not change 10PL; even though it changesother flags in the flag word. The processor issues no error indication when this occurs. A task switchloads the flags from the Task State Segment (TSS). As long as the operating system does not makedata-segment aliases for the TSS available to less privileged levels, only the operating system canchange 10PL in the TSS. .For maximum protection, the procedures of an I/O subsystem that run in the calling task should runat a protection level numerically greater than the operating-system kernel but less than applicationsprocedures. 10PL can then include the I/O subsystem but exclude applications procedures. Used thisway, 10PL forces less privileged application procedures to call on I/O subsystem procedures for I/Ofunctions, thereby giving the operating system control over many I/O operations.Tasks that deal primarily with I/O (device drivers, for example) may have an 10PL value as great asthree; If that is the case, all procedures in the task have access to I/O operations, yet all four privilegelevels are available to protect the procedures of the task from one another.Controlling 110 AddressesProtection is incomplete if not applied to memory accesses by I/O operations. 10PL does not apply tomemory-mapped I/O nor to interface with intelligent controllers (because none of the restrictedinstructions are used). The operating system designer must make special provisions to control theseI/O operations, either via the operating system or with the Builder.HARDWARE ADDRESS CHECKINGMemory-mapped I/O is subject to the segment-level protection mechanism of the iAPX 286. A taskcan execute a memory-mapped I/O operation only if it has access to a descriptor for a data segmentthat contains one of the memory addresses reserved for I/O. Giving a task descriptors for only theI/O memory addresses that it has the right to use yields a double benefit:• The task cannot access I/O devices assigned to other tasks.• Within the task, I/O is restricted to those procedures whose privilege level is numerically less thanor equal to the DPL of the I/O memory address segments.8-2 121960-001