| Revision as of 20:21, 26 October 2011 editGauravKeskar (talk | contribs)17 editsNo edit summary← Previous edit | Latest revision as of 21:31, 15 March 2018 edit undoChristian75 (talk | contribs)Extended confirmed users, New page reviewers, Pending changes reviewers, Rollbackers114,655 edits {{R to section}} {{Rwh}} | ||
| (34 intermediate revisions by 19 users not shown) | |||
| Line 1: | Line 1: | ||
| #redirect ] | |||
| A '''privilege level''' in the ] ] controls the access of the program currently running on the processor to resources such as memory regions, I/O ports, and special instructions. There are 4 privilege levels ranging from 0 which is the most privileged, to 3 which is least privileged. Most modern operating systems use level 0 for the kernel/executive, and use level 3 for application programs. Any resource available to level n is also available to level 0..n, so the privilege levels are "]". Privilege levels appear in several places in the x86 architecture, including: | |||
| {{R to section}} | |||
| * The '''Current Privilege Level (CPL)''' is the level the processor is currently operating at. It is stored in the lowest 2 bits of the ] selector (CS). | |||
| {{Rwh}} | |||
| * Every ] has a privilege level called '''Descriptor Privilege Level (DPL)'''. Segment descriptors contain a field corresponding to the descriptor privilege level (DPL). This is the numerically highest level that can access the resource. Thus, if the current privilege level (CPL) is 0 then the task can access all the privilege descriptors and if the current privilege level (CPL) is 3 then only the level 3 descriptors can be accessed. | |||
| * ]s contain a field called the Requested Privilege Level (RPL). This allows a program to request a resource at a lower privilege level than it would otherwise use. This is called as the '''Effective Privilege Level'''. RPL may weaken the privilege level of a task. | |||
| ==Privilege Checks== | |||
| The privilege levels allow the processor to control access to descriptors and hence to the corresponding memory segments. These privilege checks provide data protection and prevent any unauthorized access to data or code. | |||
| ⚫ | ] | ||
| * The processor automatically evaluates the right of a procedure to access another segment by comparing the CPL to the numeric max of the RPL and DPL. If the CPL>](RPL, DPL), then a ] is generated. See ] for more details. | |||
| * The I/O based privileged instructions are executed only if CPL<=IOPL in EFLAGS register. To secure this bit, the POPF/POPFD instructions which load values into the EFLAGS register shall not touch the IOPL bit or IF bit if CPL>0. | |||
| * ] access comes under referring to other data than its own. In this case a selector is loaded into a DS, ES, FS and GS if and only if max(RPL,CPL)<=DPL. | |||
| * A ] can be loaded into stack only if DPL=CPL. | |||
| * Transferring control to code other than its own comes under control transfer access. A CALL or JMP instruction allows us to transfer control to other code segments with DPL of equal or greater privilege than CPL. An executable ] has DPL<CPL, i.e CPL=2 can execute code segment with DPL=0. However CPL=1 is not allowed to invoke code segment with DPL=3. | |||
| It is not necessary to use all four privilege levels. Existing software that was designed to use only one or two levels of privilege can simply ignore the other levels offered by the 80386 and later processors. A one-level system should use privilege level zero; a two-level system should use privilege levels zero | |||
| and three. | |||
| ==Operation== | |||
| All operations on the OS occur by means of tasks. A task is initiated by accessing the Task State Segment, which defines the privilege level of the task to be run. This privilege level is the '''Current Privilege Level'''. Once the CPL is assigned for a task, it cannot be altered for the duration of its execution. | |||
| Once the task begins execution, it may at - various points of time - require to access other blocks of information. This access will be allowed only if the CPL of task satisfies the requirements of the DPL of the concerned block. The requirements are as mentioned above. | |||
| == See also == | |||
| * ] | |||
| * ] | |||
| * ] | |||
| == References == | |||
| * Intel 80386 Programmer's Reference | |||
| * A. K. Ray, K. M. Bhurchandi, "Advanced Microprocessors and Peripherals", Second Edition, Tata McGraw-Hill, 2009 | |||
| ⚫ | ] | ||
| {{Compu-hardware-stub}} | |||
Latest revision as of 21:31, 15 March 2018
Redirect to:
- To a section: This is a redirect from a topic that does not have its own page to a section of a page on the subject. For redirects to embedded anchors on a page, use {{R to anchor}} instead.
- With history: This is a redirect from a page containing substantive page history. This page is kept as a redirect to preserve its former content and attributions. Please do not remove the tag that generates this text (unless the need to recreate content on this page has been demonstrated), nor delete this page.
- This template should not be used for redirects having some edit history but no meaningful content in their previous versions, nor for redirects created as a result of a page merge (use {{R from merge}} instead), nor for redirects from a title that forms a historic part of Misplaced Pages (use {{R with old history}} instead).