Call gate (Intel)

<h2 id="overview">Overview</h2>
<p>Call gates are intended to allow less privileged code to call code with a higher privilege level. This type of mechanism is essential in modern operating systems that employ <a href="/facts/Memory_protection/3zDwN2SG">memory protection</a> since it allows user applications to use <a href="/facts/Kernel_(operating_system)/uEj4U3Rz">kernel</a> functions and <a href="/facts/System_call/NW44AFJr">system calls</a> in a way that can be controlled by the <a href="/facts/Operating_system/8XTuvMh2">operating system</a>.
</p><p>Call gates use a special selector value to reference a descriptor accessed via the <a href="/facts/Global_Descriptor_Table/2zJXxV66">Global Descriptor Table</a> or the <a href="/facts/Local_Descriptor_Table/2zJXxV66">Local Descriptor Table</a>, which contains the information needed for the call across privilege boundaries. This is similar to the mechanism used for <a href="/facts/Interrupt/Mm6C4rpc">interrupts</a>.
</p>
<h2 id="usage">Usage</h2>
<p>Assuming a call gate has been set up already by the <a href="/facts/Operating_system/8XTuvMh2">operating system</a> <a href="/facts/Kernel_(operating_system)/uEj4U3Rz">kernel</a>, code simply does a CALL FAR with the necessary <a href="/facts/Segment_selector/7yD0VGfy">segment selector</a> (the offset field is ignored). The processor will perform a number of checks to make sure the entry is valid and the code was operating at sufficient privilege to use the gate. Assuming all checks pass, a new CS/<a href="/facts/Instruction_pointer/BxqulBRq">EIP</a> is loaded from the <a href="/facts/Segment_descriptor/kg9whEWn">segment descriptor</a>, and continuation information is pushed onto the stack of the new privilege level (old SS, old ESP, old CS, old EIP, in that order). Parameters may also be copied from the old stack to the new stack if needed. The number of parameters to copy is located in the call gate descriptor.
</p><p>The kernel may return to the user space program by using a RET FAR instruction which pops the continuation information off the stack and returns to the outer privilege level.
</p>
<h2 id="format-of-call-gate-descriptor">Format of call gate descriptor</h2>
typedef struct _CALL_GATE
{
	USHORT OffsetLow;
	USHORT Selector;
	UCHAR NumberOfArguments:5;
	UCHAR Reserved:3;
	UCHAR Type:5; // 01100 in i386, 00100 in i286
	UCHAR Dpl:2;
	UCHAR Present:1;
	USHORT OffsetHigh;
}CALL_GATE,*PCALL_GATE;

<h2 id="previous-use">Previous use</h2>
<p><a href="/facts/Multics/y7A5peyu">Multics</a> was the first user of call gates. The <a href="/facts/Honeywell_6180/Ez1dTEyo">Honeywell 6180</a> had call gates as part of the architecture, but Multics simulated them on the older <a href="/facts/GE_645/dAYNeJwJ">GE 645</a>.
</p><p><a href="/facts/OS/2/uVBl6ItP">OS/2</a> was an early user of Intel call gates to transfer between <a href="/facts/Application_code/gg1KaTN0">application code</a> running in ring 3, privileged code running in ring 2, and kernel code in ring 0.
</p><p>Windows 95 executes drivers and process switching in ring 0, while applications, including API DLL such as kernel32.dll and krnl386.exe are executed in ring 3. Driver VWIN32.VXD provides key operating system primitives at ring 0. It allows calling of driver functions from 16-bit applications (MSDOS and Win16). This address is obtained by calling INT 2Fh, with 1684h in the AX register. To identify which VxD an
entry point is being requested for, the BX register is set to the 16-bit VxD ID. Upon return from the INT instruction, the ES.DI registers contain a far pointer that can be called to transfer control to the VxD running at ring 0. The descriptor pointed by ES is actually a call gate.<a class="footnote-ref" id="fnref:1" href="#fn:1"><sup>1</sup></a> 32-bit applications, however, when they need to access Windows 95 driver code, call undocumented VxDCall function in KERNEL32.DLL which essentially calls INT 30h, which changes ring mode.
</p>
<h2 id="modern-use">Modern use</h2>
<p>Modern x86 operating systems are transitioning away from CALL FAR call gates. With the introduction of x86 instructions for <a href="/facts/System_call/NW44AFJr">system call</a> (SYSENTER/SYSEXIT by Intel and SYSCALL/SYSRET by AMD), a new faster mechanism was introduced for control transfers for x86 programs. As most other architectures do not support call gates, their use was rare even before these new instructions, as software interrupts or <a href="/facts/Trap_(computing)/larfsSWA">traps</a> were preferred for portability, even though call gates are significantly faster than interrupts.
</p><p>Call gates are more flexible than the SYSENTER/SYSEXIT and SYSCALL/SYSRET instructions since unlike the latter two, call gates allow for changing from an arbitrary privilege level to an arbitrary (albeit higher or equal) privilege level. The fast SYS* instructions only allow control transfers from <a href="/facts/Protection_ring/27y4kjHs">ring</a> 3 to 0 and vice versa.
</p>
<h2 id="security-issues">Security issues</h2>
<p>To preserve system security, the Global Descriptor Table must be held in protected memory, otherwise any program will be able to create its own call gate and use it to raise its privilege level. Call gates have been used in software <a href="/facts/Exploit_(computer_security)/EdlqsRJM">security exploits</a>, when ways have been found around this protection.<a class="footnote-ref" id="fnref:2" href="#fn:2"><sup>2</sup></a> One example of this is the e-mail <a href="/facts/Computer_worm/9qKR1Hx5">worm</a> <i>Gurong.A</i>, written to exploit the <a href="/facts/Microsoft_Windows/bwhAhuSL">Microsoft Windows</a> operating system, which uses \Device\PhysicalMemory to install a call gate.<a class="footnote-ref" id="fnref:3" href="#fn:3"><sup>3</sup></a>
</p>
<h2 id="see-also">See also</h2>
<ul><li><a href="/facts/Global_Descriptor_Table/2zJXxV66">Global Descriptor Table</a></li>
<li><a href="/facts/System_call/NW44AFJr">System call</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>Matt Pietrek, Windows 95 System Programming Secrets <a href="/wiki/Matt_Pietrek" target="_blank">/wiki/Matt_Pietrek</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
<li id="fn:2"><p>The Intel SYSRET privilege escalation Xen Project Blog <a href="https://blog.xenproject.org/2012/06/13/the-intel-sysret-privilege-escalation/" target="_blank">https://blog.xenproject.org/2012/06/13/the-intel-sysret-privilege-escalation/</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li>
<li id="fn:3"><p>Worm:W32/Gurong.A Description F-Secure Labs <a href="https://www.f-secure.com/v-descs/gurong_a.shtml" target="_blank">https://www.f-secure.com/v-descs/gurong_a.shtml</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li>
</ol>

Call gate (Intel) open-in-new

Call gate (Intel)