iAPX 286 Operating System Writers Guide 1983

EXTENDED PROTECTIONIndirect NamingThe most general approach to naming avoids giving to less privileged procedures any direct links tothe named objects. Instead, names are indexes (or perhaps pointers) into a name table, which is administeredby the operating system at a highly privileged level. Each entry in the name table holds thetype extension code of the object, the selector of the segment in which the object resides, and any otherinformation needed to ensure appropriate use of the object. This approach not only offers the greatestpotential for protection, but also makes it possible to change the naming scheme without affectingprocedures that use the names and provides a consistent way of naming both those objects that residein dedicated segments and those that are packed into a segment with other objects.PARAMETER VALIDATIONThere is one type of privilege violation that the iAPX 286 cannot automatically check for. Consider,for example, procedure A at PL 3 that passes a pointer parameter via the stack to procedure B atPL 1. Procedure A could (accidently or purposely) pass a pointer that refers to a data structure atPL 2. Doing so would violate the intent of the protection features of the iAPX 286 because procedureA does not have sufficient privilege to operate on the data structure. However, the processor does notdetect the violation because procedure B, which actually addresses the data structure, does have sufficientprivilege to do so.The iAPX 286 provides the RPL field in the selector as well as the instructions shown in table 13-1 tohelp software guard against such protection violations.In addition to type checking as mentioned previously, an operating system can provide two levels ofparameter validation:1. Defensive use of ARPL instruction2. Point-of-entry scrutinyDefensive Use of ARPLSimply by applying the ARPL instruction to every pointer parameter it receives, an operating systemprocedure guards against complicity in accessing a segment that the calling procedure has no right toaccess. ARPL has two selector operands, for example:A R P L seLa , seLbTable 13-1. Access Checking InstructionsASM286MnemonicPL/M-286 Built·lnFunctionDescriptionARPL ADJUST$RPL Adjust requested privilege levelVERR SEGMENT$READABLE Verify segment for readingVERW SEGMENT$WRITABLE Verify segment for writingLAR GET$ACCESS$RIGHTS Load access rightsLSL GET$SEGMENT$LlMIT Load segment limit13-2 121960-001