Intel architecture ia-32 User Manual
Vol. 3A 4-5
PROTECTION
4.3
LIMIT CHECKING
The limit field of a segment descriptor prevents programs or procedures from addressing
memory locations outside the segment. The effective value of the limit depends on the setting
of the G (granularity) flag (see Figure 4-1). For data segments, the limit also depends on the
E (expansion direction) flag and the B (default stack pointer size and/or upper bound) flag. The
E flag is one of the bits in the type field when the segment descriptor is for a data-segment type.
memory locations outside the segment. The effective value of the limit depends on the setting
of the G (granularity) flag (see Figure 4-1). For data segments, the limit also depends on the
E (expansion direction) flag and the B (default stack pointer size and/or upper bound) flag. The
E flag is one of the bits in the type field when the segment descriptor is for a data-segment type.
When the G flag is clear (byte granularity), the effective limit is the value of the 20-bit limit field
in the segment descriptor. Here, the limit ranges from 0 to FFFFFH (1 MByte). When the G flag
is set (4-KByte page granularity), the processor scales the value in the limit field by a factor of
2
in the segment descriptor. Here, the limit ranges from 0 to FFFFFH (1 MByte). When the G flag
is set (4-KByte page granularity), the processor scales the value in the limit field by a factor of
2
12
(4 KBytes). In this case, the effective limit ranges from FFFH (4 KBytes) to FFFFFFFFH
(4 GBytes). Note that when scaling is used (G flag is set), the lower 12 bits of a segment offset
(address) are not checked against the limit; for example, note that if the segment limit is 0,
offsets 0 through FFFH are still valid.
(address) are not checked against the limit; for example, note that if the segment limit is 0,
offsets 0 through FFFH are still valid.
For all types of segments except expand-down data segments, the effective limit is the last
address that is allowed to be accessed in the segment, which is one less than the size, in bytes,
of the segment. The processor causes a general-protection exception any time an attempt is made
to access the following addresses in a segment:
address that is allowed to be accessed in the segment, which is one less than the size, in bytes,
of the segment. The processor causes a general-protection exception any time an attempt is made
to access the following addresses in a segment:
•
A byte at an offset greater than the effective limit
•
A word at an offset greater than the (effective-limit – 1)
•
A doubleword at an offset greater than the (effective-limit – 3)
•
A quadword at an offset greater than the (effective-limit – 7)
Figure 4-2. Descriptor Fields with Flags used in IA-32e Mode
31
24 23 22 21 20 19
16 15
13
14
12 11
8 7
0
P
G
D
P
P
L
Type
1
L
4
0
0
A
V
V
L
D
A
R
C
1
Code-Segment Descriptor
31
A
C
D
DPL
D
DPL
Accessed
Conforming
Default
Descriptor Privilege Level
Default
Descriptor Privilege Level
G
R
R
Granularity
Readable
Readable
AVL Available to Sys. Programmer’s
L
64-Bit Flag
P Present