Protected mode

This article is about an x86 processor mode. For Internet Explorer Protected Mode, see Mandatory Integrity Control.

x86 processor modes
Mode	First supported
Real mode	Intel 8086
8080 emulation mode	NEC V20/V30 only
Protected mode	Intel 80286
Virtual 8086 mode	Intel 80386
Unreal mode	Intel 80386
System Management Mode	Intel 386SL
Long mode	AMD Opteron
Hardware virtualization	AMD Athlon 64, varies

In computing, protected mode, also called protected virtual address mode,^[1] is an operational mode of x86-compatible central processing units (CPU). It allows system software to utilize features such as virtual memory, paging, safe multi-tasking, and other features designed to increase an operating system's control over application software.^[2][3]

When a processor that supports x86 protected mode is powered on, it begins executing instructions in real mode, in order to maintain backwards compatibility with earlier x86 processors.^[4] Protected mode may only be entered after the system software sets up several descriptor tables and enables the Protection Enable (PE) bit in the Control Register 0 (CR0).^[5]

Protected mode was first added to the x86 architecture in 1982,^[6] with the release of Intel's 80286 (286) processor, and later extended with the release of the 80386 (386) in 1985.^[7] Due to the enhancements added by protected mode, it has become widely adopted and has become the foundation for all subsequent enhancements to the x86 architecture.^[8]

History

The 8086, the predecessor to the 286, was originally designed with a 20-bit memory address bus.^[9] This allowed the processor to access 2²⁰ bytes of memory, equivalent to 1 megabyte.^[9] At the time, 1 megabyte was considered a relatively large amount of memory,^[10] so the designers of the IBM Personal Computer reserved the first 640 kilobytes for application and the operating system usage and the remaining 384 kilobytes were reserved for the Basic Input/Output System (BIOS) and memory for add-on devices.^[11]

As time progressed, the cost of memory continuously decreased and utilization increased. The 1 MB limitation eventually became a significant problem. Intel intended to solve this limitation along with others with the release of the 286.^[11]

The 286

For more details on this topic, see Intel 80286.

The initial protected mode, released with the 286, was not widely used.^[11] Several shortcomings such as the inability to access the BIOS and the inability to switch back to real mode without resetting the processor prevented widespread usage.^[12] Widespread acceptance was additionally hampered by the fact that the 286 only allowed memory access in 16 bit segments, meaning only 2¹⁶ bytes, equivalent to 64 kilobytes, could be accessed at a time.^[11]

The 286 maintained backwards compatibility with the previous 8086 by initially entering real mode on power up.^[4] Real mode functioned identically to the 8086, allowing older software to run unmodified on the newer 286. To access the extended functionality of the 286, the operating system would set the processor into protected mode. This enabled 24 bit addressing which allowed the processor to access 2²⁴ bytes of memory, equivalent to 16 megabytes.^[9]

The 386

An Intel 80386 microprocessor

For more details on this topic, see Intel 80386.

With the release of the 386 in 1985,^[7] many of the issues preventing widespread adoption of the previous protected mode were addressed.^[11]

The 386 was released with an address bus size of 32 bits, which allows for 2³² bytes of memory accessing, equivalent to 4 gigabytes.^[13] The segment sizes were also increased to 32 bits, meaning that the full address space of 4 gigabytes could be accessed without the need to switch between multiple segments.^[13] In addition to the increased size of the address bus and segment registers, many other new features were added with the intention of increasing operational security and stability.^[14]

Protected mode is now used in virtually all modern operating systems which run on the x86 architecture, such as Microsoft Windows, Linux, and many others.^[15]

386 additions to protected mode

With the release of the 386, the following additional features were added to protected mode:^[2]

• Paging
• 32-bit physical and virtual address space*
• 32-bit segment offsets
• Ability to switch back to real mode
• Virtual 8086 mode

*The 32-bit physical address space is not present on the 80386SX, and other 386 processor variants which use the older 286 bus.^[16]

Entering and exiting protected mode

Until the release of the 386, protected mode did not offer a direct method to switch back into real mode once protected mode was entered. IBM created a workaround which involved resetting the CPU via the keyboard controller and saving the system registers, stack pointer and often the interrupt mask in the real-time clock chip's RAM. This allowed the BIOS to restore the CPU to a similar state and begin executing code before the reset.^{[clarification needed]} Later, a Triple fault was used to reset the 286 CPU, which was a lot faster and cleaner than the keyboard controller method.

To enter protected mode, the Global Descriptor Table (GDT) must first be created with a minimum of three entries: a null descriptor, a code segment descriptor and data segment descriptor. The 21st address line (A20 line) also must be enabled to allow the use of all the address lines so that the CPU can access beyond 1 megabyte of memory (only the first 20 are allowed to be used after power-up to guarantee compatibility with older software). After performing those two steps, the PE bit must be set in the CR0 register and a far jump must be made to clear the prefetch input queue.

; set PE bit
mov eax, cr0
or eax, 1
mov cr0, eax

; far jump (cs = selector of code segment)
jmp cs:@pm

@pm:
  ; Now we are in PM.

With the release of the 386, protected mode could be exited by loading the segment registers with real mode values, disabling the A20 line and clearing the PE bit in the CR0 register, without the need to perform the initial setup steps required with the 286.

Features

Protected mode has a number of features designed to enhance an operating system's control over application software, in order to increase security and system stability.^[3] These additions allow the operating system to function in a way that would be significantly more difficult or even impossible without proper hardware support.^[17]

Privilege levels

For more details on this topic, see Ring (computer security).

Example of privilege ring usage in an operating system using all rings.

In protected mode, there are four privilege levels or rings, numbered from 0 to 3, with ring 0 being the most privileged and 3 being the least. The use of rings allows for system software to restrict tasks from accessing data, call gates or executing privileged instructions.^[18]

In most environments, the operating system and some device drivers run in ring 0 and applications run in ring 3.^[18]

Real mode application compatibility

According to the Intel 80286 Programmer's Reference Manual, ^[19]

“

...the 80286 remains upwardly compatible with most 8086 and 80186 application programs. Most 8086 applications programs can be re-compiled or re-assembled and executed on the 80286 in Protected Mode.

”

For the most part, the binary compatibility with real-mode code, the ability to access up to 16 MB of physical memory, and 1 GB of virtual memory, were the most apparent changes to application programmers.^[19] This was not without its limitations, if an application utilized or relied on any of the techniques below it wouldn't run:^[20]

• Segment arithmetic
• Privileged instructions
• Direct hardware access
• Writing to a code segment
• Executing data
• Overlapping segments
• Use of BIOS functions, due to the BIOS interrupts being reserved by Intel^[21]

In reality, almost all DOS application programs violated these rules.^[22] Due to these limitations, virtual 8086 mode was created and released with the 386. Despite such potential setbacks, Windows 3.0 and its successors can take advantage of the binary compatibility with real mode to run many Windows 2.x (Windows 2.0 and Windows 2.1x) applications, which run in real mode in Windows 2.x, in protected mode.^[23]

Virtual 8086 mode

Main article: Virtual 8086 mode

With the release of the 386, protected mode offers what the Intel manuals call virtual 8086 mode. Virtual 8086 mode is designed to allow code previously written for the 8086 to run unmodified and concurrently with other tasks, without compromising security or system stability.^[24] Virtual 8086 mode, however, is not completely backwards compatible with all programs. Programs that require segment manipulation, privileged instructions, direct hardware access, or use self-modifying code will generate an exception that must be served by the operating system.^[25] In addition, applications running in virtual 8086 mode generate a trap with the use of instructions that involve input/output (I/O), which can negatively impact performance.^[26]

Due to these limitations, some programs originally designed to run on the 8086 cannot be run in virtual 8086 mode. As a result, system software is forced to either compromise system security or backwards compatibility when dealing with legacy software. An example of such a compromise can be seen with the release of Windows NT, which dropped backwards compatibility for "ill-behaved" DOS applications.^[27]

Segment addressing

virtual segments of 80286

For more details on this topic, see X86 memory segmentation.

In real mode each logical address points directly into physical memory location, every logical address consists of two 16 bit parts:

The segment part of the logical address contains the base address of a segment with a granularity of 16 bytes, i.e. a segments may start at physical address 0, 16, 32, ..., 2²⁰-16.

The offset part of the logical address contains an offset inside the segment, i.e. the physical address can be calculated as
physical_address := segment_part × 16 + offset (if the address line A20 is enabled),
respectively (segment_part × 16 + offset) mod 2²⁰ (if A20 is off)^{[clarification needed]}

Every segment has a size of 2¹⁶ bytes.

Protected mode

In protected mode the segment_part is replaced by a 16 bit selector, the 13 upper bits (bit 3 to bit 15) of the selector contains the index of an entry inside a descriptor table. The lowest two bits define the privilege of the request, from 0 to 3 where 0 has the highest priority and 3 the lowest. The remainder bit specifies if the operation is against the GDT or a LDT.

The descriptor table entry contains

• the real linear address of the segment
• a limit value for the segment size
• some attribute bits (flags)

286

The segment address inside the descriptor table entry has a length of 24 bits so every byte of the physical memory can be defined as bound of the segment.

The limit value inside the descriptor table entry has a length of 16 bits so segment length can be between 1 byte and 2¹⁶ byte.

The calculated linear address equals the physical memory address.

386

The segment address inside the descriptor table entry is expanded to 32 bits so every byte of the physical memory can be defined as bound of the segment.

The limit value inside the descriptor table entry is expanded to 20 bits and completed with a granularity flag (shortly: G-bit):

• if G-bit is zero limit has a granularity of 1 byte, i.e. segment size may be 1, 2, ..., 2²⁰ bytes.
• if G-bit is one limit has a granularity of 2¹² bytes, i.e. segment size may be 1 × 2¹², 2 × 2¹², ..., 2²⁰ × 2¹² bytes.

If paging is off (see below), the calculated linear address equals the physical memory address.

If paging is on, the calculated linear address is used as input of paging.

The 386 processor also uses 32 bit values for the address offset.
For maintaining compatibility with 286 protected mode a new default flag (shortly D-bit) was added. If D-bit of a code segment is off all commands inside this segment will be interpreted as 16 bit commands.

Structure of segment descriptor entry

B	bits	80286	80386	B
0	00..07,0..7	limit	bits 0..15 of limit	0
1	08..15,0..7			1
2	16..23,0..7	base address	bits 0..23 of base address	2
3	24..31,0..7			3
4	32..39,0..7			4
5	40..47,0..7	attribute flags #1		5
6	48..51,0..3	unused	bits 16..19 of limit	6
	52..55,4..7		attribute flags #2
7	56..63,0..7		bits 24..31 of base address	7

Columns B: Byte offset inside entry
Column bits, first range: Bit offset inside entry
Column bits, second range: Bit offset inside byte

attribute flags #2
52	4	unused, available for operating system
53	5	reserved, should be zero
54	6	default flag / D-bit
55	7	granularity flag / G-bit

Paging

Common method of using paging to create a virtual address space.

paging ( intel 80386 ) with page size of 4K

For more details on this topic, see Paging.

In addition to adding virtual 8086 mode, the 386 also added paging to protected mode.^[28] Through paging, system software can restrict and control a task's access to pages, which are sections of memory. In many operating systems, paging is used to create an independent virtual address space for each task. This prevents one task from manipulating the memory of another. Paging also allows for pages to be moved out of primary storage and onto a slower and larger secondary storage, such as a hard disk.^[29] This allows for more memory to be used than physically available in primary storage.^[29] The x86 architecture allows control of pages through two arrays: page directories and page tables.

Originally, a page directory was the size of one page, 4 kilobytes, and contained 1,024 page directory entries (PDE), although subsequent enhancements to the x86 architecture have added the ability to use larger page sizes. Each PDE contained a pointer to a page table. A page table was also originally 4 kilobytes in size and contained 1,024 page table entries (PTE). Each PTE contained a pointer to the actual page's physical address and are only used when 4 kilobyte pages are used. At any given time, only one page directory may be in active use.^[30]

Multitasking

For more details on this topic, see Computer multitasking.

Through the use of the rings, privileged call gates, and the Task State Segment (TSS), introduced with the 286, preemptive multitasking was made possible on the x86 architecture. The TSS allows general-purpose registers, segment selector fields, and stacks to all be modified without affecting those of another task. The TSS also allows a task's privilege level, and I/O port permissions to be independent of another task's.

In many operating systems, the full features of the TSS are not used.^[31] This is commonly due to portability concerns or due to the performance issues created with hardware task switches.^[31] As a result many operating systems use both hardware and software to create a multitasking system.^[32]

Operating systems

Operating systems like OS/2 1.x try to switch the processor between protected and real modes. This is both slow and unsafe, because a real mode program can easily crash a computer. OS/2 1.x defines restrictive programming rules allowing a Family API or bound program to run in either real or protected mode.

Some early Unix operating systems, OS/2 1.x, and Windows used this mode. Windows 3.0 was able to run real mode programs in 16-bit protected mode. Windows 3.0, when switching to protected mode, decided to preserve the single privilege level model that was used in real mode, which is why Windows applications and DLLs can hook interrupts and do direct hardware access. That lasted through the Windows 9x series. If a Windows 1.x or 2.x program is written properly and avoids segment arithmetic, it will run the same way in both real and protected modes. Windows programs generally avoid segment arithmetic because Windows implements a software virtual memory scheme, moving program code and data in memory when programs are not running, so manipulating absolute addresses is dangerous; programs should only keep handles to memory blocks when not running. Starting an old program while Windows 3.0 is running in protected mode triggers a warning dialog, suggesting to either run Windows in real mode or to obtain an updated version of the application. Updating well-behaved programs using the MARK utility with the MEMORY parameter avoids this dialog. It is not possible to have some GUI programs running in 16-bit protected mode and other GUI programs running in real mode. In Windows 3.1 real mode disappeared.

Today, 16-bit protected mode is still used for running applications, e.g. DPMI compatible DOS extender programs (through virtual DOS machines) or Windows 3.x applications (through the Windows on Windows subsystem) and certain classes of device drivers (e.g. for changing the screen-resolution using BIOS functionality) in OS/2 2.0 and later, all under control of a 32-bit kernel.

See also

• Assembly language
• Intel
• Ring (computer security)
• x86 assembly language

External links

• Protected Mode Basics
• Introduction to Protected-Mode
• Overview of the Protected Mode Operations of the Intel Architecture
• Intel 64 and IA-32 Architectures Software Developer's Manuals
• TurboIRC.COM tutorial to enter protected mode from DOS
• Protected Mode Overview and Tutorial
• Code Project Protected Mode Tutorial

References

1. ^ "Memory access control method and system for realizing the same - US Patent 5483646" (Patent). May 23, 1995. http://www.patentstorm.us/patents/5483646-claims.html. Retrieved 2007-07-14. "The memory access control system according to claim 4, wherein said first address mode is a real address mode, and said second address mode is a protected virtual address mode." 
2. ^ ^{a b} "2.1.3 The Intel 386 Processor (1985)". Intel 64 and IA-32 Architectures Software Developer's Manual. Denver, Colorado: Intel. May 2007. p. 35. http://www.intel.com/products/processor/manuals/index.htm. 
3. ^ ^{a b} "Guide: What does protected mode mean?" (Guide). Delorie software. July 14, 2007. http://www.delorie.com/djgpp/doc/ug/basics/protected.html. Retrieved 2007-07-14. "The purpose of protected mode is not to protect your program. The purpose is to protect everyone else (including the operating system) from your program." 
4. ^ ^{a b} "3.2 Modes of Operation". Intel 65 and IA-32 Architectures Software Developer's Manual. Denver, Colorado: Intel. May 2005. p. 59. http://www.intel.com/products/processor/manuals/index.htm. 
5. ^ Collins, Robert (2007). "Protected Mode Basics" (PDF). ftp.utcluj.ro. ftp://ftp.utcluj.ro/pub/users/nedevschi/PMP/protected86/collinsprot.PDF. Retrieved 2009-07-31. 
6. ^ "2.1.2 The Intel 286 Processor (1982)". Intel 64 and IA-32 Architectures Software Developer's Manual. Denver, Colorado: Intel. May 2007. p. 34. http://www.intel.com/products/processor/manuals/index.htm. 
7. ^ ^{a b} "Intel Global Citizenship Report 2003" (Timeline). Archived from the original on 2008-03-22. http://web.archive.org/web/20080322075839/http://www.intel.com/intel/finance/gcr03/39-years_of_innovation.htm. Retrieved 2007-07-14. "1985 Intel launches Intel386 processor" 
8. ^ "2.1 Brief History of the IA-32 Architecture". Intel 64 and IA-32 Architectures Software Developer's Manual. Denver, Colorado: Intel. May 2007. p. 31. http://www.intel.com/products/processor/manuals/index.htm. 
9. ^ ^{a b c} "A+ - Hardware - PC Microprocessor Developments and Features Tutorials" (Tutorial/Guide). BrainBell.com. http://www.brainbell.com/tutors/A+/Hardware/PC_Microprocessor_Developments_and_Features.htm. Retrieved 2007-07-24. 
10. ^ [|Risley, David] (March 23, 2001). "A CPU History" (Article). PCMechanic. Archived from the original on 2008-01-15. http://web.archive.org/web/20080115220724/http://www.pcmech.com/show/processors/35/. Retrieved 2007-07-24. "What is interesting is that the designers of the time never suspected anyone would ever need more than 1 MB of RAM." 
11. ^ ^{a b c d e} Kaplan, Yariv (1997). "Introduction to Protected-Mode" (Article). Internals.com. http://www.internals.com/articles/protmode/introduction.htm. Retrieved 2007-07-24. 
12. ^ [|Mueller, Scott] (March 24, 2006). "P2 (286) Second-Generation Processors" (Book). Upgrading and Repairing PCs, 17th Edition (17 ed.). Que. ISBN 0-7897-3404-4. http://www.informit.com/articles/article.aspx?p=481859&seqNum=13. Retrieved July 2007. 
13. ^ ^{a b} "2.1 Memory Organization and Segmentation" (Manual). Intel 80386 Programmer's Reference Manual 1986. Santa Clara, CA: Intel. 1986. 
14. ^ "3.1 Modes of Operation". Intel 64 and IA-32 Architectures Software Developer's Manual. Denver, Colorado: Intel. May 2007. p. 55. http://www.intel.com/products/processor/manuals/index.htm. 
15. ^ Hyde, Randall (November 2004). "12.10. Protected Mode Operation and Device Drivers". Write Great Code. O'Reilly. ISBN 1-59327-003-8. http://safari.oreilly.com/1593270038/ns1593270038-CHP-12-SECT-10. 
16. ^ Shvets, Gennadiy (June 3, 2007). "Intel 80386 processor family" (Article). http://www.cpu-world.com/CPUs/80386/index.html. Retrieved 2007-07-24. "80386SX - low cost version of the 80386. This processor had 16 bit external data bus and 24-bit external address bus." 
17. ^ "7 Multitasking" (Manual). Intel 80386 Programmer's Reference Manual 1986. Santa Clara, CA: Intel. 1986. 
18. ^ ^{a b} "6.3.5 Calls to Other Privilege Levels". Intel 64 and IA-32 Architectures Software Developer's Manual. Denver, Colorado: Intel. May 2007. p. 162. http://www.intel.com/products/processor/manuals/index.htm. 
19. ^ ^{a b} "1.2 Modes of Operation" (Manual). Intel 80286 Programmer's Reference Manual 1987. Santa Clara, CA: Intel. 1987. 
20. ^ "Appendix C 8086/8088 Compatibility Considerations" (Manual). Intel 80286 Programmer's Reference Manual 1987. Santa Clara, CA: Intel. 1987. 
21. ^ "Memory access control method and system for realizing the same - US Patent 5483646" (Patent). May 6, 1998. http://www.freepatentsonline.com/6105101.html. Retrieved 2007-07-25. "This has been impossible to-date and has forced BIOS development teams to add support into the BIOS for 32 bit function calls from 32 bit applications." 
22. ^ Robinson, Tim (August 26, 2002). "Virtual 8086 Mode" (Guide). berliOS. http://osdev.berlios.de/v86.html. Retrieved 2007-07-25. "...secondly, protected mode was also incompatible with the vast amount of real-mode code around at the time." 
23. ^ Robinson, Tim (August 26, 2002). "Virtual 8086 Mode" (Guide). berliOS. http://osdev.berlios.de/v86.html. Retrieved 2007-07-25. 
24. ^ "15.2 Virtual 8086 Mode". Intel 64 and IA-32 Architectures Software Developer's Manual. Denver, Colorado: Intel. May 2007. p. 560. http://www.intel.com/products/processor/manuals/index.htm. 
25. ^ "15.2.7 Sensitive Instructions". Intel 64 and IA-32 Architectures Software Developer's Manual. Denver, Colorado: Intel. May 2007. p. 568. http://www.intel.com/products/processor/manuals/index.htm. 
26. ^ Robinson, Tim (August 26, 2002). "Virtual 8086 Mode" (Guide). berliOS. http://osdev.berlios.de/v86.html. Retrieved 2007-07-25. "A downside to using V86 mode is speed: every IOPL-sensitive instruction will cause the CPU to trap to kernel mode, as will I/O to ports which are masked out in the TSS." 
27. ^ [|Dabak, Prasad]; Millind Borate (October 1999) (Book). Undocumented Windows NT. Hungry Minds. ISBN 0764545698. Memory Management. 
28. ^ "ProtectedMode overview [deinmeister.de"] (Website). http://www.deinmeister.de/x86modes.htm#c1. Retrieved 2007-07-29. 
29. ^ ^{a b} "What Is PAE X86?" (Article). Microsoft TechNet. May 28, 2003. http://technet2.microsoft.com/windowsserver/en/library/efc41320-713f-4004-bc81-ddddfc8552651033.mspx?mfr=true. Retrieved 2007-07-29. "The paging process allows the operating system to overcome the real physical memory limits. However, it also has a direct impact on performance because of the time necessary to write or retrieve data from disk." 
30. ^ Gareau, Jean. "Advanced Embedded x86 Programming: Paging" (Guide). Embedded.com. http://www.embedded.com/98/9806fe2.htm. Retrieved 2007-07-29. "Only one page directory may be active at a time, indicated by the CR3 register." 
31. ^ ^{a b} "NewOrer - news: Multitasking for x86 explained #1" (Article). NewOrder. May 2, 2004. Archived from the original on 2007-02-12. http://web.archive.org/web/20070212161434/http://neworder.box.sk/newsread.php?newsid=10562. Retrieved 2007-07-29. "The reason why software task switching is so popular is that it can be faster than hardware task switching. Intel never actually developed the hardware task switching, they implemented it, saw that it worked, and just left it there. Advances in multitasking using software have made this form of task switching faster (some say up to 3 times faster) than the hardware method. Another reason is that the Intel way of switching tasks isn't portable at all" 
32. ^ "NewOrer - news: Multitasking for x86 explained #1" (Article). NewOrder. May 2, 2004. Archived from the original on 2007-02-12. http://web.archive.org/web/20070212161434/http://neworder.box.sk/newsread.php?newsid=10562. Retrieved 2007-07-29. "...both rely on the Intel processors ability to switch tasks, they rely on it in different ways."