The privilege levels are checked at the time a selector for the target segment is loaded into the data segment register. Three privilege levels enter into privilege checking mechanism CPL of the currently executing task RPL of the selector which specifies target segment DPL of the descriptor of the target segment Instructions may load the DS register only if the DPL of the target segment is numerically greater than or equal to the maximum of the CPL and selectors RPL. i.e. DPL of target segment max (CPL,RPL) ≥ A procedure can only access data that is at the same or less privilege level. Restricting Control Transfer Control transfer (except interrupts) are accomplished by JMP, CALL and RET instructions. The near forms of JMP and CALL transfer within current code segment and requires only limit checking The far forms of JMP and CALL refer to other segments and require privilege checking. The far JMP and CALL can be done in 2 ways: Without Call Gate Descriptor With Call Gate Descriptor Without Call Gate Descriptor The processor permits a JMP or CALL directly to another segment only if DPL of the target segment = CPL of the calling segment Confirming bit of the target code is set and DPL of the target segment CPL ≤
The privilege levels are checked at the time a selector for the target segment is loaded into the data segment register. Three privilege levels enter into privilege checking mechanism CPL of the currently executing task RPL of the selector which specifies target segment DPL of the descriptor of the target segment Instructions may load the DS register only if the DPL of the target segment is numerically greater than or equal to the maximum of the CPL and selectors RPL. i.e. DPL of target segment ≥ max (CPL,RPL) A procedure can only access data that is at the same or less privilege level. Restricting Control Transfer Control transfer (except interrupts) are accomplished by JMP, CALL and RET instructions. The near forms of JMP and CALL transfer within current code segment and requires only limit checking The far forms of JMP and CALL refer to other segments and require privilege checking. The far JMP and CALL can be done in 2 ways: Without Call Gate Descriptor With Call Gate Descriptor Without Call Gate Descriptor The processor permits a JMP or CALL directly to another segment only if DPL of the target segment = CPL of the calling segment Confirming bit of the target code is set and DPL of the target segment ≤ CPL
80386-summary1.docx