Hello Detlef!

Sunday March 24 1996 17:57, Detlef Engert wrote to Mario Semo, Mike Bilow et
al.:

 DE> Next you have to enter a 32bit ring2 segment. This is the trick, but a
 DE> cheap one since OS/2 already has set up a proper selector equivalent
 DE> to the common 32bit ring3 code selector.

Common 32 bit flat code selector is 5Bh, but it really maps onto ring 2
selector 5Ah which describes a conforming code segment with DPL = 2. OS/2
system
loader invokes user application via far call using this selector and having RPL
set to 3 so the application starts at ring 3 due conforming attribute. If I try
directly modify CPL from ring 3 I get exception. But if I make a far 16->32
call/jump (far jumps within the same ring are allowed) using this selector from
my 16 bit IOPL segment everything will work fine. Do you mean this?

 DE> If not you may set up an selector yourself using other techniques
 DE> (again: you don't have to gain ring0 privileges to do this).

It sounds unbelievable.

 DE> And, since the thunk didn't destroy the data selectors except SS
 DE> (each protection level has it's own stack), all of your data located
 DE> in ring3 memory objects is reachable.

There is a ring 2 data selector which maps on the same address space as the
common ring 3 selector (53h) does. It seems to be freely used from your thunk.

 DE> I have not tested if you may call kernel services from this operation
 DE> mode.

I guess all callgates to the conforming code segments should work.

Bye!
Rinat Sadretdinow                                              [Team OS/2]

--- GoldED/2 2.50.A0715 UNREG