Code selectors and data selectors

[NickJohnson]

Paging and segmentation are not mutually exclusive: in fact, you need both of them for this reason (or at least the x86 does, because its paging isn't powerful enough). You must have two pairs of code/data segments in your GDT: one for ring 0 and one for ring 3. When you want to run code in ring 3, you need to perform an iret on a stack containing the code descriptor for run 3 in the proper position - this will make the processor "return" to running user code (even though it wasn't doing it before).

What about if user code is running when the keyboard IRQ is caught? Where should the stack pointer end up when stuff is being saved? This is the reason for the TSS: it tells the processor what to do about the stack when it is forced to switch to ring 0 from ring 3, because if nothing were changed, the user program could cause a stack overflow in the kernel.

[Neob91]

Thank you for your response. So contrary to the code residing at address CS:EIP, the address in EIP and code descriptor in CS specify the physical address? And when an IRQ occurs, the SP and ESP are saved in the TSS and when IRQ handling is over they are restored? I assume the ESP and SS use physical addressing, not the virtual one, as do EIP and CS. Therefore I believe it's impossible to modify any of them from ring 3, correct? Or is it just that ESP, CS and SS can't be modified, while EIP can?

[NickJohnson]

So contrary to the code residing at address CS:EIP, the address in EIP and code descriptor in CS specify the physical address?

No, the addresses are still virtual. It's just that segmentation is enforced as a layer above paging. My point was that the two together form the x86's permission system.

And when an IRQ occurs, the SP and ESP are saved in the TSS and when IRQ handling is over they are restored? I assume the ESP and SS use physical addressing, not the virtual one, as do EIP and CS. Therefore I believe it's impossible to modify any of them from ring 3, correct? Or is it just that ESP, CS and SS can't be modified, while EIP can?

No - SS and ESP from the user program are saved on the kernel stack, and are reloaded by IRET when the handler is finished. The TSS sets the values of SS and ESP - i.e. it sets up the kernel stack - when an interrupt is received while the processor is in user mode, and only then. The TSS is infrequently modified, at least if you only have one kernel stack per processor. If the TSS did not exist, the processor would not know where the kernel stack is, and therefore where to save the current ESP, CS, and EIP.

[Neob91]

And while the IRQ handler code is executed, it's in physical addressing space? Or do all interrupt handlers have to be mapped in the virtual space?

[gerryg400]

And while the IRQ handler code is executed, it's in physical addressing space? Or do all interrupt handlers have to be mapped in the virtual space?

Once paging is enabled, everything is in virtual address space.