▁executes . ▁ ▁It ▁is ▁a ▁further ▁restriction ▁of ▁P P = 1 . ▁ ▁There ▁is ▁also ▁a ▁P P = 3 ▁which ▁further ▁restrict s ▁the ▁instructions ▁a ▁user ▁program ▁can ▁execute , ▁but ▁it ▁is ▁not ▁currently ▁in ▁use ▁as ▁too ▁many ▁existing ▁programs ▁were ▁using ▁some ▁of ▁those ▁instructions . ▁ ▁The ▁intent ▁was ▁to ▁restrict ▁access ▁to ▁instructions ▁that ▁may ▁be ▁system ▁model ▁dependent . ▁ ▁The ▁Domain ▁mechanism ▁is ▁the ▁heart ▁of ▁the ▁protection ▁mechanism . ▁ ▁Each ▁B D ▁( bank ▁des criptor ) ▁has ▁a ▁lock ▁field ▁consisting ▁of ▁a ▁ring ▁number ▁and ▁domain ▁number . ▁ ▁There ▁is ▁also ▁a ▁key ▁field ▁in ▁the ▁state ▁of ▁each ▁activity . ▁ ▁If ▁the ▁key ▁matches ▁the ▁lock ▁or ▁the ▁ring ▁in ▁the ▁key ▁is ▁less ▁than ▁the ▁ring ▁in ▁the ▁lock , ▁the ▁activity ▁has ▁Special ▁Access ▁Perm ission . ▁ ▁Otherwise , ▁the ▁activity ▁has ▁General ▁Access ▁Perm ission . ▁ ▁Ring ▁allows ▁overrid ing ▁the ▁Domain ▁protection ▁mechanism . ▁ ▁User ▁applications ▁run ▁at ▁Ring = 3 . ▁ ▁Prote cted ▁sub system s ▁run ▁at ▁Ring = 2 . ▁ ▁This ▁gives ▁them ▁access ▁to ▁their ▁own ▁data ▁while ▁still ▁allowing ▁them ▁to ▁access ▁parameters ▁and ▁data ▁in ▁the ▁calling ▁user ’ s ▁space . ▁ ▁Note ▁that ▁it ▁is ▁still ▁not ▁possible ▁for ▁a ▁thread ▁to ▁cause ▁the ▁protected ▁sub system ▁to ▁access ▁some ▁other ▁user ’ s ▁space ▁as ▁only ▁this ▁thread ’ s ▁Bank ▁Des criptor ▁T ables ▁are