User's Manual

PROTECTION
Task privilege is a dynamic value. It is derived from the code segment currently being executed. Task
privilege can change only when a control transfers to a different code segment.
Descriptor privilege, including code segment privilege,
is assigned when the descriptor (and any associ-
ated segment)
is created. The system designer assigns privilege directly when the system is constructed
with the system builder (see the
80286 Builder User's GUide) or indirectly via a loader.
Each task operates
at only one privilege level at any given moment: namely that of the code segment
being executed. (The conforming segments discussed
in section 11.2 permit some flexibility in this
regard.) However,
as figure 7-6 indicates, the task may contain segments at one, two, three, or four
levels, all of which are to be used
at appropriate times. The privilege level of the task, then, changes
under the carefully enforced rules for transfer of control from one code segment to another.
The descriptor privilege attribute
is stored in the access byte of a descriptor and is called the Descrip-
tor Privilege Level (DPL). Task privilege
is called the Current Privilege Level (CPL). The least signif-
icant
two bits of the CS register specify the CPL.
A
few general rules of privilege can be stated before the detailed discussions of later sections. Data
access
is restricted to those data segments whose privilege level is the same as or less privileged (numer-
ically greater) than the current privilege level (CPL). Direct code access, e.g., via call or jump,
is
restricted to code segments of equal privilege. A gate (section 7.5.1) is required for access to code at
more privileged levels
..
7.4 SEGMENT DESCRIPTOR
Although the format of access control information, discussed below, is similar for both data and code
segment descriptors, the rules for accessing data segments differ from those for transferring control to
code segments.
Data: segments are meant to be accessible from many privilege levels, e.g., from other
programs
at the same level or from deep within the operating system. The main restriction is that they
cannot be accessed by less privileged code.
Code segments, on the other
hand, are meant to be executed at a single privilege level. Transfers of
control that cross privilege boundaries are tightly restricted, requiring the use of gates. Control
trans-
fers wiihin a privilege level can also usc gates, but they are not required. Control transfers are discussed
in section 7.5.
Protection checks are automatically invoked at several points
in selecting and using new segments. The
process
of addressing memory begins when the currently executing program attempts to load a selector
into one of the segment registers.
As discussed in Chapter 6, the selector has the form shown in
figure 7-7.
When a new Sli;;lticiuf is loaded intv a segment regigter, the p!0~eSSOr ~~r.esses the associated descriptor
to perform the necessary loading and privilege checks.
The protection mechanism verifies that the selector points to a valid descriptor type
for" the segment
register (see section 7.4.1). After verifying the descriptor type, the
CPU compares the privilege level
of the task (CPL) to the privilege level in the descriptor (DPL) before loading the descriptor's
infor-
mation into the cache.
The general format of the eight bits in the segment descriptor's access rights byte
is shown in
table 7-1.
7-10