User's Manual

PROTECTION
Three basic kinds of privilege level indicators are used when determining accessibility to a segment for
reading and writing. They are termed Current
Privilege Level (CPL), Descriptor Privilege Level (DPL),
and Requested Privilege Level (RPL). The CPL is simply the privilege level of the code segment that
is executing (except if the current code segment is conforming). The CPL is stored as bits 0 and 1 of
the
CS and SS registers. Bits 0 and 1 of DS and ES are not related to CPL.
DPL is the privilege level of the segment; it is stored in bits 5 and 6 of the access byte of a descriptor.
For data access
to data segments and non-conforming code segments, CPL must be numerically less
than or equal to
DPL (the task must be of equal or greater privilege) for access to be granted. Violation
of this rule during segment load instruction causes a general protection exception with an error code
identifying the selector.
While the enforcement of
DPL protection rules provides the mechanism for the isolation of code and
data
at different privilege levels, it is conceivable that an erroneous pointer passed onto a more trusted
program might result in the illegal modification of data with a higher privilege level. This possibility
is
prevented by the enforcement of effective privilege level protection rules and correct usage of the RPL
value.
The
RPL (requested privilege level) is used for pointer validation. It is the least significant two bits in
the selector value loaded into any segment register.
RPL is intended to indicate the privilege level of
the originator
of that selector. A selector may be passed down through several procedures at different
levels. The
RPL reflects the privilege level of the original supplier of the selector, not the privilege
level of the intermediate supplier. The
RPL must be numerically less than or equal to the DPL of the
descriptor selected, thereby indicating greater or equal privilege of the supplier; otherwise, access
is
denied and a general protection violation occurs.
Pointer validity testing is required in any system concerned with preventing program errors from
destroying system integrity. The
80286 provides hardware support for pointer validity testing. The
RPL field indicates the privilege level of the originator of the pointer to the hardware. Access will be
denied if the originator of the pointer did not have access
to the selected segment even if the CPL is
numerically less than or equal to the DPL. RPL can reduce the effective privilege of a task when using
a particular selector.
RPL never allows access to more privileged segments (CPL must always be
numerically less than or equal to
DPL).
A fourth term is sometimes used: the Effective Privilege Level (EPL). It is defined as the numeric
maximum of the
CPL and the RPL-meaning the one of lesser privilege. Access to a protected entity
is granted only whcn the EPL is numcrically less than or equal to the nPL of that entity. This is simply
another way of saying that both
CPL and RPL must be numerically less than or equal to DPL for
access to be granted.
7.4.4 Pointer Privilege Stamping via ARPL
The ARPL instruction is provided in the 80286 to fill the RPL field of a selector with the minimum
privilege (maximum numeric value)
of the seiector's currcnt RFI., "iid the c,,:lc.'s CPr., (given in an
instruction-specified register). A straight insertion of the caller's CPL would stamp the pointer with
the privilege level of the caller, but not necessarily the ultimate originator of the selector (e.g., Level 3
supplies a selector to a level 2 routine
that calls a level 0 routine with the same selector).
Figure
7-9 shows a program with an example of such a situation. The program at privilege level 3 calls
a routine
at level 2 via a gate. The routine at level 2 uses the ARPL instruction to assure that the
selector's
RPL is 3. When the level 2 routine calls a routine at level 0 and passes the selector, the
ARPL instruction at level 0 leaves the RPL field unchanged.
7-14