User's Manual

5-14 Vol. 3

PROTECTION

• Load a data-segment register with a segment selector for a nonconforming,

readable, code segment.

• Load a data-segment register with a segment selector for a conforming,

readable, code segment.

• Use a code-segment override prefix (CS) to read a readable, code segment

whose selector is already loaded in the CS register.

The same rules for accessing data segments apply to method 1. Method 2 is always

valid because the privilege level of a conforming code segment is effectively the

same as the CPL, regardless of its DPL. Method 3 is always valid because the DPL of

the code segment selected by the CS register is the same as the CPL.

5.7 PRIVILEGE LEVEL CHECKING WHEN LOADING THE SS

Privilege level checking also occurs when the SS register is loaded with the segment

selector for a stack segment. Here all privilege levels related to the stack segment

must match the CPL; that is, the CPL, the RPL of the stack-segment selector, and the

DPL of the stack-segment descriptor must be the same. If the RPL and DPL are not

equal to the CPL, a general-protection exception (#GP) is generated.

5.8 PRIVILEGE LEVEL CHECKING WHEN TRANSFERRING

PROGRAM CONTROL BETWEEN CODE SEGMENTS

To transfer program control from one code segment to another, the segment selector

for the destination code segment must be loaded into the code-segment register

(CS). As part of this loading process, the processor examines the segment descriptor

for the destination code segment and performs various limit, type, and privilege

checks. If these checks are successful, the CS register is loaded, program control is

transferred to the new code segment, and program execution begins at the instruc

tion pointed to by the EIP register.

Program control transfers are carried out with the JMP, CALL, RET, SYSENTER,

SYSEXIT, INT n, and IRET instructions, as well as by the exception and interrupt

mechanisms. Exceptions, interrupts, and the IRET instruction are special cases

discussed in

Chapter 6, “Interrupt and Exception Handling.” This chapter discusses

only the JMP, CALL, RET, SYSENTER, and SYSEXIT instructions.

A JMP or CALL instruction can reference another code segment in any of four ways:

• The target operand contains the segment selector for the target code segment.

• The target operand points to a call-gate descriptor, which contains the segment

selector for the target code segment.