protectedmode

Protected mode is an operating mode of x86-compatible CPUs that provides hardware-enforced memory protection, privilege levels, and extended addressing. It was introduced with the Intel 80286 and expanded in the 80386 to support 32-bit addressing and paging. In protected mode, memory is managed through segmentation using descriptors stored in the Global Descriptor Table (GDT) or Local Descriptor Tables (LDT). Each descriptor defines a segment’s base address, size (limit), and access rights. Programs access memory via segment selectors, and the CPU enforces protection by checking these rights on every access, enabling isolation between processes and preventing arbitrary code from tampering with kernel or other processes.

Privilege levels, known as rings, range from 0 (most privileged) to 3 (least privileged). This mechanism supports multitasking and kernel-user separation. The Interrupt Descriptor Table (IDT) handles interrupts and exceptions, using gate descriptors to control privilege transitions between different code segments. Task switching and certain system operations may utilize a Task State Segment (TSS) for state management.

Transition into protected mode requires configuring a Global Descriptor Table, loading it with the LGDT instruction, enabling the PE bit in control register CR0, and performing a far jump to flush the prefetch queue. Once in protected mode, linear addresses are formed from the segment base plus an offset; paging may be enabled by setting the PG bit in CR0 and providing page tables for virtual memory. The protected mode environment remains compatible with real-mode software only through careful emulation or switching back, and modern systems rely on protected mode as the foundation for multitasking operating systems and virtualization.