i386/i386.reference/s09_08.htm

   1 <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
   2 <HTML>
   3 <HEAD>
   4 <TITLE>80386 Programmer's Reference Manual -- Section 9.8</TITLE>
   5 </HEAD>
   6 <BODY>
   7 <B>up:</B> <A HREF="c09.htm">
   8 Chapter 9 -- Exceptions and Interrupts</A><BR>
   9 <B>prev:</B> <A HREF="s09_07.htm">9.7  Error Code</A><BR>
  10 <B>next:</B> <A HREF="s09_09.htm">9.9  Exception Summary</A>
  11 <P>
  12 <HR>
  13 <P>
  14 <H1>9.8  Exception Conditions</H1>
  15 The following sections describe each of the possible exception conditions
  16 in detail. Each description classifies the exception as a fault, trap, or
  17 abort. This classification provides information needed by systems
  18 programmers for restarting the procedure in which the exception occurred:
  19 <DL>
  20 <DT>
  21 Faults
  22 <DD>
  23 The CS and EIP values saved when a fault is reported point to the
  24 instruction causing the fault.
  25 <DT>
  26 Traps
  27 <DD>
  28 The CS and EIP values stored when the trap is reported point to the
  29 instruction dynamically after the instruction causing the trap. If
  30 a trap is detected during an instruction that alters program flow,
  31 the reported values of CS and EIP reflect the alteration of program
  32 flow. For example, if a trap is detected in a
  33 <A HREF="JMP.htm">JMP</A> instruction, the
  34 CS and EIP values pushed onto the stack point to the target of the
  35 <A HREF="JMP.htm">JMP</A>, not to the instruction after the
  36 <A HREF="JMP.htm">JMP</A>.
  37 <DT>
  38 Aborts
  39 <DD>
  40 An abort is an exception that permits neither precise location of
  41 the instruction causing the exception nor restart of the program
  42 that caused the exception. Aborts are used to report severe errors,
  43 such as hardware errors and inconsistent or illegal values in
  44 system tables.
  45 </DL>
  46
  47 <H2>9.8.1 Interrupt 0 -- Divide Error</H2>
  48 The divide-error fault occurs during a <A HREF="DIV.htm">DIV</A> or an
  49 <A HREF="IDIV.htm">IDIV</A> instruction when the
  50 divisor is zero.
  51
  52 <H2>9.8.2 Interrupt 1 -- Debug Exceptions</H2>
  53 The processor triggers this interrupt for any of a number of conditions;
  54 whether the exception is a fault or a trap depends on the condition:
  55 <UL>
  56 <LI> Instruction address breakpoint fault.
  57 <LI> Data address breakpoint trap.
  58 <LI> General detect fault.
  59 <LI> Single-step trap.
  60 <LI> Task-switch breakpoint trap.
  61 </UL>
  62 The processor does not push an error code for this exception. An exception
  63 handler can examine the debug registers to determine which condition caused
  64 the exception . Refer to
  65 <A HREF="c12.htm">Chapter 12</A>
  66    for more detailed information about
  67 debugging and the debug registers.
  68
  69 <H2>9.8.3 Interrupt 3 -- Breakpoint</H2>
  70 The <A HREF="INT.htm">INT</A> 3 instruction causes this trap. The
  71 <A HREF="INT.htm">INT</A> 3 instruction is one byte
  72 long, which makes it easy to replace an opcode in an executable segment with
  73 the breakpoint opcode. The operating system or a debugging subsystem can use
  74 a data-segment alias for an executable segment to place an
  75 <A HREF="INT.htm">INT</A> 3 anywhere it
  76 is convenient to arrest normal execution so that some sort of special
  77 processing can be performed. Debuggers typically use breakpoints as a way of
  78 displaying registers, variables, etc., at crucial points in a task.
  79 <P>
  80 The saved CS:EIP value points to the byte following the breakpoint. If a
  81 debugger replaces a planted breakpoint with a valid opcode, it must subtract
  82 one from the saved EIP value before returning . Refer also to
  83 <A HREF="c12.htm">Chapter 12</A>
  84    for
  85 more information on debugging.
  86
  87 <H2>9.8.4 Interrupt 4 -- Overflow</H2>
  88 This trap occurs when the processor encounters an
  89 <A HREF="INT.htm">INTO</A> instruction and the
  90 OF (overflow) flag is set. Since signed arithmetic and unsigned arithmetic
  91 both use the same arithmetic instructions, the processor cannot determine
  92 which is intended and therefore does not cause overflow exceptions
  93 automatically. Instead it merely sets OF when the results, if interpreted as
  94 signed numbers, would be out of range. When doing arithmetic on signed
  95 operands, careful programmers and compilers either test OF directly or use
  96 the <A HREF="INT.htm">INTO</A> instruction.
  97
  98 <H2>9.8.5 Interrupt 5 -- Bounds Check</H2>
  99 This fault occurs when the processor, while executing a
 100 <A HREF="BOUND.htm">BOUND</A> instruction,
 101 finds that the operand exceeds the specified limits. A program can use the
 102 <A HREF="BOUND.htm">BOUND</A>
 103 instruction to check a signed array index against signed limits
 104 defined in a block of memory.
 105
 106 <H2>9.8.6 Interrupt 6 -- Invalid Opcode</H2>
 107 This fault occurs when an invalid opcode is detected by the execution unit.
 108 (The exception is not detected until an attempt is made to execute the
 109 invalid opcode; i.e., prefetching an invalid opcode does not cause this
 110 exception.) No error code is pushed on the stack. The exception can be
 111 handled within the same task.
 112 <P>
 113 This exception also occurs when the type of operand is invalid for the
 114 given opcode. Examples include an intersegment
 115 <A HREF="JMP.htm">JMP</A> referencing a register
 116 operand, or an
 117 <A HREF="LGS.htm">LES</A> instruction with a register source operand.
 118
 119 <H2>9.8.7 Interrupt 7 -- Coprocessor Not Available</H2>
 120 This exception occurs in either of two conditions:
 121 <UL>
 122 <LI> The processor encounters an ESC (escape) instruction, and the EM
 123 (emulate) bit ofCR0 (control register zero) is set.
 124 <LI> The processor encounters either the
 125 <A HREF="WAIT.htm">WAIT</A> instruction or an ESC
 126 instruction, and both the MP (monitor coprocessor) and TS (task
 127 switched) bits of CR0 are set.
 128 </UL>
 129 Refer to
 130 <A HREF="c11.htm">Chapter 11</A>
 131    for information about the coprocessor interface .
 132
 133 <H2>9.8.8 Interrupt 8 -- Double Fault</H2>
 134 Normally, when the processor detects an exception while trying to invoke
 135 the handler for a prior exception, the two exceptions can be handled
 136 serially. If, however, the processor cannot handle them serially, it signals
 137 the double-fault exception instead. To determine when two faults are to be
 138 signalled as a double fault, the 80386 divides the exceptions into three
 139 classes: benign exceptions, contributory exceptions, and page faults.
 140 <A HREF="#Table 9-3">Table 9-3</A> shows this classification.
 141 <P>
 142 <A HREF="#Table 9-4">Table 9-4</A>
 143 shows which combinations of exceptions cause a double fault and
 144 which do not.
 145 <P>
 146 The processor always pushes an error code onto the stack of the
 147 double-fault handler; however, the error code is always zero. The faulting
 148 instruction may not be restarted. If any other exception occurs while
 149 attempting to invoke the double-fault handler, the processor shuts down.
 150
 151 <A NAME="Table 9-3">
 152 <PRE>
 153 Table 9-3. Double-Fault Detection Classes
 154
 155 Class           ID          Description
 156
 157                  1          Debug exceptions
 158                  2          NMI
 159                  3          Breakpoint
 160 Benign           4          Overflow
 161 Exceptions       5          Bounds check
 162                  6          Invalid opcode
 163                  7          Coprocessor not available
 164                 16          Coprocessor error
 165
 166                  0          Divide error
 167                  9          Coprocessor Segment Overrun
 168 Contributory    10          Invalid TSS
 169 Exceptions      11          Segment not present
 170                 12          Stack exception
 171                 13          General protection
 172
 173 Page Faults     14          Page fault
 174 </PRE>
 175 </A>
 176 <HR>
 177 <A NAME="Table 9-4">
 178 <PRE>
 179 Table 9-4. Double-Fault Definition
 180
 181 SECOND EXCEPTION
 182
 183                            Benign       Contributory    Page
 184                            Exception    Exception       Fault
 185
 186            Benign          OK           OK              OK
 187            Exception
 188
 189 FIRST      Contributory    OK           DOUBLE          OK
 190 EXCEPTION  Exception
 191
 192            Page
 193            Fault           OK           DOUBLE          DOUBLE
 194
 195 </PRE>
 196 </A>
 197
 198 <H2>9.8.9 Interrupt 9 -- Coprocessor Segment Overrun</H2>
 199 This exception is raised in protected mode if the 80386 detects a page or
 200 segment violation while transferring the middle portion of a coprocessor
 201 operand to the NPX . This exception is avoidable. Refer to
 202 <A HREF="c11.htm">Chapter 11</A>
 203    for
 204 more information about the coprocessor interface.
 205
 206 <H2>9.8.10 Interrupt 10 -- Invalid TSS</H2>
 207 Interrupt 10 occurs if during a task switch the new TSS is invalid. A TSS
 208 is considered invalid in the cases shown in
 209 <A HREF="#Table 9-5">Table 9-5</A>. An error code is
 210 pushed onto the stack to help identify the cause of the fault. The EXT bit
 211 indicates whether the exception was caused by a condition outside the
 212 control of the program; e.g., an external interrupt via a task gate
 213 triggered a switch to an invalid TSS.
 214 <P>
 215 This fault can occur either in the context of the original task or in the
 216 context of the new task. Until the processor has completely verified the
 217 presence of the new TSS, the exception occurs in the context of the original
 218 task. Once the existence of the new TSS is verified, the task switch is
 219 considered complete; i.e., TR is updated and, if the switch is due to a
 220 <A HREF="CALL.htm">CALL</A>
 221 or interrupt, the backlink of the new TSS is set to the old TSS. Any
 222 errors discovered by the processor after this point are handled in the
 223 context of the new task.
 224 <P>
 225 To insure a proper TSS to process it, the handler for exception 10 must be
 226 a task invoked via a task gate.
 227 <A NAME="Table 9-5">
 228 <PRE>
 229 Table 9-5. Conditions That Invalidate the TSS
 230
 231 Error Code              Condition
 232
 233 TSS id + EXT            The limit in the TSS descriptor is less than 103
 234 LTD id + EXT            Invalid LDT selector or LDT not present
 235 SS id + EXT             Stack segment selector is outside table limit
 236 SS id + EXT             Stack segment is not a writable segment
 237 SS id + EXT             Stack segment DPL does not match new CPL
 238 SS id + EXT             Stack segment selector RPL < >  CPL
 239 CS id + EXT             Code segment selector is outside table limit
 240 CS id + EXT             Code segment selector does not refer to code
 241                         segment
 242 CS id + EXT             DPL of non-conforming code segment < > new CPL
 243 CS id + EXT             DPL of conforming code segment > new CPL
 244 DS/ES/FS/GS id + EXT    DS, ES, FS, or GS segment selector is outside
 245                         table limits
 246 DS/ES/FS/GS id + EXT    DS, ES, FS, or GS is not readable segment
 247
 248 </PRE>
 249 </A>
 250 <H2>9.8.11 Interrupt 11 -- Segment Not Present</H2>
 251 Exception 11 occurs when the processor detects that the present bit of a
 252 descriptor is zero. The processor can trigger this fault in any of these
 253 cases:
 254 <UL>
 255 <LI> While attempting to load the CS, DS, ES, FS, or GS registers; loading
 256 the SS register, however, causes a stack fault.
 257 <LI> While attempting loading the LDT register with an
 258 <A HREF="LLDT.htm">LLDT</A> instruction;
 259 loading the LDT register during a task switch operation, however,
 260 causes the "invalid TSS" exception.
 261 <LI> While attempting to use a gate descriptor that is marked not-present.
 262 </UL>
 263 This fault is restartable. If the exception handler makes the segment
 264 present and returns, the interrupted program will resume execution.
 265 <P>
 266 If a not-present exception occurs during a task switch, not all the steps
 267 of the task switch are complete. During a task switch, the processor first
 268 loads all the segment registers, then checks their contents for validity. If
 269 a not-present exception is discovered, the remaining segment registers have
 270 not been checked and therefore may not be usable for referencing memory. The
 271 not-present handler should not rely on being able to use the values found
 272 in CS, SS, DS, ES, FS, and GS without causing another exception. The
 273 exception handler should check all segment registers before trying to resume
 274 the new task; otherwise, general protection faults may result later under
 275 conditions that make diagnosis more difficult. There are three ways to
 276 handle this case:
 277 <OL>
 278 <LI> Handle the not-present fault with a task. The task switch back to the
 279 interrupted task will cause the processor to check the registers as it
 280 loads them from the TSS.
 281
 282 <LI>
 283 <A HREF="PUSH.htm">PUSH</A> and
 284 <A HREF="POP.htm">POP</A> all segment registers. Each
 285 <A HREF="POP.htm">POP</A> causes the processor to
 286 check the new contents of the segment register.
 287
 288 <LI> Scrutinize the contents of each segment-register image in the TSS,
 289 simulating the test that the processor makes when it loads a segment
 290 register.
 291 </OL>
 292 This exception pushes an error code onto the stack. The EXT bit of the
 293 error code is set if an event external to the program caused an interrupt
 294 that subsequently referenced a not-present segment. The I-bit is set if the
 295 error code refers to an IDT entry, e.g., an
 296 <A HREF="INT.htm">INT</A> instruction referencing a
 297 not-present gate.
 298 <P>
 299 An operating system typically uses the "segment not present" exception to
 300 implement virtual memory at the segment level. A not-present indication in a
 301 gate descriptor, however, usually does not indicate that a segment is not
 302 present (because gates do not necessarily correspond to segments).
 303 Not-present gates may be used by an operating system to trigger exceptions
 304 of special significance to the operating system.
 305
 306 <H2>9.8.12 Interrupt 12 -- Stack Exception</H2>
 307 A stack fault occurs in either of two general conditions:
 308 <UL>
 309 <LI> As a result of a limit violation in any operation that refers to the
 310 SS register. This includes stack-oriented instructions such as
 311 <A HREF="POP.htm">POP</A>,
 312 <A HREF="PUSH.htm">PUSH</A>,
 313 <A HREF="ENTER.htm">ENTER</A>, and
 314 <A HREF="LEAVE.htm">LEAVE</A>, as well as other memory references that
 315 implicitly use SS (for example, <TT><A HREF="MOV.htm">MOV</A> AX, [BP+6]</TT>).
 316 <A HREF="ENTER.htm">ENTER</A> causes this
 317 exception when the stack is too small for the indicated local-variable
 318 space.
 319 <LI> When attempting to load the SS register with a descriptor that is
 320 marked not-present but is otherwise valid. This can occur in a task
 321 switch, an interlevel
 322 <A HREF="CALL.htm">CALL</A>, an interlevel return, an
 323 <A HREF="LGS.htm">LSS</A> instruction,
 324 or a <A HREF="MOV.htm">MOV</A> or <A HREF="POP.htm">POP</A> instruction to SS.
 325 </UL>
 326 When the processor detects a stack exception, it pushes an error code onto
 327 the stack of the exception handler. If the exception is due to a not-present
 328 stack segment or to overflow of the new stack during an interlevel
 329 <A HREF="CALL.htm">CALL</A>, the
 330 error code contains a selector to the segment in question (the exception
 331 handler can test the present bit in the descriptor to determine which
 332 exception occurred); otherwise the error code is zero.
 333 <P>
 334 An instruction that causes this fault is restartable in all cases. The
 335 return pointer pushed onto the exception handler's stack points to the
 336 instruction that needs to be restarted. This instruction is usually the one
 337 that caused the exception; however, in the case of a stack exception due to
 338 loading of a not-present stack-segment descriptor during a task switch, the
 339 indicated instruction is the first instruction of the new task.
 340 <P>
 341 When a stack fault occurs during a task switch, the segment registers may
 342 not be usable for referencing memory. During a task switch, the selector
 343 values are loaded before the descriptors are checked. If a stack fault is
 344 discovered, the remaining segment registers have not been checked and
 345 therefore may not be usable for referencing memory. The stack fault handler
 346 should not rely on being able to use the values found in CS, SS, DS, ES,
 347 FS, and GS without causing another exception. The exception handler should
 348 check all segment registers before trying to resume the new task; otherwise,
 349 general protection faults may result later under conditions that make
 350 diagnosis more difficult.
 351
 352 <H2>9.8.13 Interrupt 13 -- General Protection Exception</H2>
 353 All protection violations that do not cause another exception cause a
 354 general protection exception. This includes (but is not limited to):
 355 <OL>
 356 <LI> Exceeding segment limit when using CS, DS, ES, FS, or GS
 357 <LI> Exceeding segment limit when referencing a descriptor table
 358 <LI> Transferring control to a segment that is not executable
 359 <LI> Writing into a read-only data segment or into a code segment
 360 <LI> Reading from an execute-only segment
 361 <LI> Loading the SS register with a read-only descriptor (unless the
 362 selector comes from the TSS during a task switch, in which case a TSS
 363 exception occurs
 364 <LI> Loading SS, DS, ES, FS, or GS with the descriptor of a system segment
 365 <LI> Loading DS, ES, FS, or GS with the descriptor of an executable
 366 segment that is not also readable
 367 <LI> Loading SS with the descriptor of an executable segment
 368 <LI> Accessing memory via DS, ES, FS, or GS when the segment register
 369 contains a null selector
 370 <LI> Switching to a busy task
 371 <LI> Violating privilege rules
 372 <LI> Loading CR0 with PG=1 and PE=0.
 373 <LI> Interrupt or exception via trap or interrupt gate from V86 mode to
 374 privilege level other than zero.
 375 <LI> Exceeding the instruction length limit of 15 bytes (this can occur
 376 only if redundant prefixes are placed before an instruction)
 377 </OL>
 378 The general protection exception is a fault. In response to a general
 379 protection exception, the processor pushes an error code onto the exception
 380 handler's stack. If loading a descriptor causes the exception, the error
 381 code contains a selector to the descriptor; otherwise, the error code is
 382 null. The source of the selector in an error code may be any of the
 383 following:
 384 <OL>
 385 <LI> An operand of the instruction.
 386 <LI> A selector from a gate that is the operand of the instruction.
 387 <LI> A selector from a TSS involved in a task switch.
 388 </OL>
 389
 390 <H2>9.8.14 Interrupt 14 -- Page Fault</H2>
 391 This exception occurs when paging is enabled (PG=1) and the processor
 392 detects one of the following conditions while translating a linear address
 393 to a physical address:
 394 <UL>
 395 <LI> The page-directory or page-table entry needed for the address
 396 translation has zero in its present bit.
 397 <LI> The current procedure does not have sufficient privilege to access the
 398 indicated page.
 399 </UL>
 400 The processor makes available to the page fault handler two items of
 401 information that aid in diagnosing the exception and recovering from it:
 402 <UL>
 403 <LI> An error code on the stack. The error code for a page fault has a
 404 format different from that for other exceptions (see
 405 <A HREF="#fig9-8">Figure 9-8</A>
 406   ). The
 407 error code tells the exception handler three things:
 408 <OL>
 409 <LI> Whether the exception was due to a not present page or to an access
 410 rights violation.
 411 <LI> Whether the processor was executing at user or supervisor level at
 412 the time of the exception.
 413 <LI> Whether the memory access that caused the exception was a read or
 414 write.
 415 </OL>
 416 <LI> CR2 (control register two). The processor stores in CR2 the linear
 417 address used in the access that caused the exception (see
 418 <A HREF="#fig9-9">Figure 9-9</A>).
 419 The exception handler can use this address to locate the corresponding
 420 page directory and page table entries. If another page fault can occur
 421 during execution of the page fault handler, the handler should push CR2
 422 onto the stack.
 423 </UL>
 424 <P>
 425 <A NAME="fig9-8">
 426 <IMG align=center SRC="fig9-8.gif" border=0>
 427 <P>
 428
 429 <H3>9.8.14.1  Page Fault During Task Switch</H3>
 430 The processor may access any of four segments during a task switch:
 431 <OL>
 432 <LI> Writes the state of the original task in the TSS of that task.
 433 <LI> Reads the GDT to locate the TSS descriptor of the new task.
 434 <LI> Reads the TSS of the new task to check the types of segment
 435 descriptors from the TSS.
 436 <LI> May read the LDT of the new task in order to verify the segment
 437 registers stored in the new TSS.
 438 </OL>
 439 A page fault can result from accessing any of these segments. In the latter
 440 two cases the exception occurs in the context of the new task. The
 441 instruction pointer refers to the next instruction of the new task, not to
 442 the instruction that caused the task switch. If the design of the operating
 443 system permits page faults to occur during task-switches, the page-fault
 444 handler should be invoked via a task gate.
 445 <P>
 446 <A NAME="fig9-9">
 447 <IMG align=center SRC="fig9-9.gif" border=0>
 448
 449 <H3>9.8.14.2  Page Fault with Inconsistent Stack Pointer</H3>
 450 Special care should be taken to ensure that a page fault does not cause the
 451 processor to use an invalid stack pointer (SS:ESP). Software written for
 452 earlier processors in the 8086 family often uses a pair of instructions to
 453 change to a new stack; for example:
 454 <PRE>
 455 <A HREF="MOV.htm">MOV</A> SS, AX
 456 <A HREF="MOV.htm">MOV</A> SP, StackTop
 457 </PRE>
 458 With the 80386, because the second instruction accesses memory, it is
 459 possible to get a page fault after SS has been changed but before SP has
 460 received the corresponding change. At this point, the two parts of the stack
 461 pointer SS:SP (or, for 32-bit programs, SS:ESP) are inconsistent.
 462 <P>
 463 The processor does not use the inconsistent stack pointer if the handling
 464 of the page fault causes a stack switch to a well defined stack (i.e., the
 465 handler is a task or a more privileged procedure). However, if the page
 466 fault handler is invoked by a trap or interrupt gate and the page fault
 467 occurs at the same privilege level as the page fault handler, the processor
 468 will attempt to use the stack indicated by the current (invalid) stack
 469 pointer.
 470 <P>
 471 In systems that implement paging and that handle page faults within the
 472 faulting task (with trap or interrupt gates), software that executes at the
 473 same privilege level as the page fault handler should initialize a new stack
 474 by using the new
 475 <A HREF="LGS.htm">LSS</A> instruction rather than an instruction pair shown
 476 above. When the page fault handler executes at privilege level zero (the
 477 normal case), the scope of the problem is limited to privilege-level zero
 478 code, typically the kernel of the operating system.
 479
 480 <H2>9.8.15 Interrupt 16 -- Coprocessor Error</H2>
 481 The 80386 reports this exception when it detects a signal from the 80287 or
 482 80387 on the 80386's ERROR# input pin. The 80386 tests this pin only at the
 483 beginning of certain ESC instructions and when it encounters a
 484 <A HREF="WAIT.htm">WAIT</A>
 485 instruction while the EM bit of the MSW is zero (no emulation). Refer to
 486 <A HREF="c11.htm">Chapter 11</A>
 487    for more information on the coprocessor interface.
 488 <P>
 489 <HR>
 490 <P>
 491 <B>up:</B> <A HREF="c09.htm">
 492 Chapter 9 -- Exceptions and Interrupts</A><BR>
 493 <B>prev:</B> <A HREF="s09_07.htm">9.7  Error Code</A><BR>
 494 <B>next:</B> <A HREF="s09_09.htm">9.9  Exception Summary</A>
 495 </BODY>