Protected mode - Knowledge (XXG)

1854: 391: 777: 1862: 818:. The next bit (bit 2) specifies whether the operation is used with the GDT or the LDT. The lowest two bits (bit 1 and bit 0) of the selector are combined to define the privilege of the request, where the values of 0 and 3 represent the highest and the lowest privilege, respectively. This means that the byte offset of descriptors in the descriptor table is the same as the 16-bit selector, provided the lower three bits are zeroed. 362:, equivalent to 256 KB, could be accessed at a time. Because changing a segment register in protected mode caused a 6-byte segment descriptor to be loaded into the CPU from memory, the segment register load instruction took many tens of processor cycles, making it much slower than on the 8086; therefore, the strategy of computing segment addresses on-the-fly in order to access data structures larger than 128 4169: 4159: 4149: 4139: 4129: 409:. The segment sizes were also increased to 32 bits, meaning that the full address space of 4 gigabytes could be accessed without the need to switch between multiple segments. In addition to the increased size of the address bus and segment registers, many other new features were added with the intention of increasing operational security and stability. Protected mode is now used in virtually all modern 622: 270:(386) in 1985. Due to the enhancements added by protected mode, it has become widely adopted and has become the foundation for all subsequent enhancements to the x86 (IA-32) architecture, although many of those enhancements, such as added instructions and new registers, also brought benefits to the real mode. 1974:

series. If a Windows 1.x or 2.x program is written properly and avoids segment arithmetic, it will run the same way in both real and protected modes. Windows programs generally avoid segment arithmetic because Windows implements a software virtual memory scheme, moving program code and data in memory

3135:

The reason why software task switching is so popular is that it can be faster than hardware task switching. Intel never actually developed the hardware task switching, they implemented it, saw that it worked, and just left it there. Advances in multitasking using software have made this form of task

377:

to run unmodified on the newer 286. Real mode also served as a more basic mode in which protected mode could be set up, solving a sort of chicken-and-egg problem. To access the extended functionality of the 286, the operating system would set up some tables in memory that controlled memory access in

1979:

to memory blocks when not running. Starting an old program while Windows 3.0 is running in protected mode triggers a warning dialog, suggesting to either run Windows in real mode or to obtain an updated version of the application. Updating well-behaved programs using the MARK utility with the

789:

In real mode each logical address points directly into a physical memory location, every logical address consists of two 16-bit parts: The segment part of the logical address contains the base address of a segment with a granularity of 16 bytes, i.e. a segment may start at physical address 0, 16,

1969:

was able to run real mode programs in 16-bit protected mode; when switching to protected mode, it decided to preserve the single privilege level model that was used in real mode, which is why Windows applications and DLLs can hook interrupts and do direct hardware access. That lasted through the

1869:

In addition to adding virtual 8086 mode, the 386 also added paging to protected mode. Through paging, system software can restrict and control a task's access to pages, which are sections of memory. In many operating systems, paging is used to create an independent virtual address space for each

1897:

to a page table. A page table was also originally four kilobytes in size and contained 1,024 page table entries (PTE). Each PTE contained a pointer to the actual page's physical address and are only used when the four-kilobyte pages are used. At any given time, only one page directory may be in

833:

The segment address inside the descriptor table entry has a length of 24 bits so every byte of the physical memory can be defined as bound of the segment. The limit value inside the descriptor table entry has a length of 16 bits so segment length can be between 1 byte and 2 byte. The calculated

606:

Protected mode has a number of features designed to enhance an operating system's control over application software, in order to increase security and system stability. These additions allow the operating system to function in a way that would be significantly more difficult or even impossible

858:

For maintaining compatibility with 286 protected mode a new default flag (D-bit, for short) was added. If the D-bit of a code segment is off (0) all commands inside this segment will be interpreted as 16-bit commands by default; if it is on (1), they will be interpreted as 32-bit commands.

1924:

was made possible on the x86 architecture. The TSS allows general-purpose registers, segment selector fields, and stacks to all be modified without affecting those of another task. The TSS also allows a task's privilege level, and I/O port permissions to be independent of another task's.

1928:

In many operating systems, the full features of the TSS are not used. This is commonly due to portability concerns or due to the performance issues created with hardware task switches. As a result, many operating systems use both hardware and software to create a multitasking system.

842:

The segment address inside the descriptor table entry is expanded to 32 bits so every byte of the physical memory can be defined as bound of the segment. The limit value inside the descriptor table entry is expanded to 20 bits and completed with a granularity flag (G-bit, for short):

354:. Several shortcomings such as the inability to make BIOS and DOS calls due to inability to switch back to real mode without resetting the processor prevented widespread usage. Acceptance was additionally hampered by the fact that the 286 only allowed memory access in 64 515:(21st address line) also must be enabled to allow the use of all the address lines so that the CPU can access beyond 1 megabyte of memory (Only the first 20 are allowed to be used after power-up, to guarantee compatibility with older software written for the Intel 8088-based 850:

If G-bit is one limit has a granularity of 2 bytes, i.e. segment size may be 1 × 2, 2 × 2, ..., 2 × 2 bytes. If paging is off, the calculated linear address equals the physical memory address. If paging is on, the calculated linear address is used as input of

378:

protected mode, set the addresses of those tables into some special registers of the processor, and then set the processor into protected mode. This enabled 24-bit addressing, which allowed the processor to access 2 bytes of memory, equivalent to 16

597:

With the release of the 386, protected mode could be exited by loading the segment registers with real mode values, disabling the A20 line and clearing the PE bit in the CR0 register, without the need to perform the initial setup steps required with the 286.

404:

With the release of the 386 in 1985, many of the issues preventing widespread adoption of the previous protected mode were addressed. The 386 was released with an address bus size of 32 bits, which allows for 2 bytes of memory accessing, equivalent to 4

1893:. Originally, a page directory was the size of one page, four kilobytes, and contained 1,024 page directory entries (PDE), although subsequent enhancements to the x86 architecture have added the ability to use larger page sizes. Each PDE contained a 753:

Due to these limitations, some programs originally designed to run on the 8086 cannot be run in virtual 8086 mode. As a result, system software is forced to either compromise system security or backward compatibility when dealing with

790:

32, ..., 2 − 16. The offset part of the logical address contains an offset inside the segment, i.e. the physical address can be calculated as physical_address = segment_part × 16 + offset, if the address

3063:

The paging process allows the operating system to overcome the real physical memory limits. However, it also has a direct impact on performance because of the time necessary to write or retrieve data from

504:

was used to reset the 286 CPU, which was a lot faster and cleaner than the keyboard controller method (and does not depend on IBM AT-compatible hardware, but will work on any 80286 CPU in any system).

657:

the 80286 remains upwardly compatible with most 8086 and 80186 application programs. Most 8086 application programs can be re-compiled or re-assembled and executed on the 80286 in Protected Mode.

3044: 665:, were the most apparent changes to application programmers. This was not without its limitations. If an application utilized or relied on any of the techniques below, it would not run: 734:

Virtual 8086 mode, however, is not completely backward compatible with all programs. Programs that require segment manipulation, privileged instructions, direct hardware access, or use

731:. Virtual 8086 mode is designed to allow code previously written for the 8086 to run unmodified and concurrently with other tasks, without compromising security or system stability. 500:

and often the interrupt mask in the real-time clock chip's RAM. This allowed the BIOS to restore the CPU to a similar state and begin executing code before the reset. Later, a

2094:

The memory access control system according to claim 4, wherein said first address mode is a real address mode, and said second address mode is a protected virtual address mode.

2922: 2902: 2693: 2675: 2657: 2639: 511:(GDT) must first be created with a minimum of three entries: a null descriptor, a code segment descriptor and data segment descriptor. In an IBM-compatible machine, the 2962:

A downside to using V86 mode is speed: every IOPL-sensitive instruction will cause the CPU to trap to kernel mode, as will I/O to ports which are masked out in the TSS.

633:, numbered from 0 to 3, with ring 0 being the most privileged and 3 being the least. The use of rings allows for system software to restrict tasks from accessing data, 3296: 2733: 2519: 2272: 2218: 2166: 2109: 1980:

MEMORY parameter avoids this dialog. It is not possible to have some GUI programs running in 16-bit protected mode and other GUI programs running in real mode. In

179: 243:

with earlier x86 processors. Protected mode may only be entered after the system software sets up one descriptor table and enables the Protection Enable (PE)

4193: 4109: 3770: 3243: 2194: 2187: 2151:

The purpose of protected mode is not to protect your program. The purpose is to protect everyone else (including the operating system) from your program.

3136:

switching faster (some say up to 3 times faster) than the hardware method. Another reason is that the Intel way of switching tasks isn't portable at all

2829:

This has been impossible to-date and has forced BIOS development teams to add support into the BIOS for 32 bit function calls from 32 bit applications.

2409: 3818: 2241: 3048: 2791: 2772: 2753: 4162: 3966: 3790: 3572: 3543: 4152: 1853: 488:

Until the release of the 386, protected mode did not offer a direct method to switch back into real mode once protected mode was entered.

3191: 2367: 4172: 2587: 1941:

1.x try to switch the processor between protected and real modes. This is both slow and unsafe, because a real mode program can easily

366:(the combined size of the two data segments) became impractical, even for those few programmers who had mastered it on the 8086/8088. 2711: 2500: 2983: 2552: 2475: 172: 2071: 661:

For the most part, the binary compatibility with real-mode code, the ability to access up to 16 MB of physical memory, and 1 GB of

3347: 3291: 3989: 3763: 3266: 3236: 523:

models). After performing those two steps, the PE bit must be set in the CR0 register and a far jump must be made to clear the

3149: 3112: 2297: 4114: 3459: 3357: 1894: 2694:"Intel 64 and IA-32 Architectures Software Developer's Manual Combined Volumes 3A, 3B, 3C, and 3D: System Programming Guide" 2676:"Intel 64 and IA-32 Architectures Software Developer's Manual Combined Volumes 3A, 3B, 3C, and 3D: System Programming Guide" 2658:"Intel 64 and IA-32 Architectures Software Developer's Manual Combined Volumes 3A, 3B, 3C, and 3D: System Programming Guide" 2640:"Intel 64 and IA-32 Architectures Software Developer's Manual Combined Volumes 3A, 3B, 3C, and 3D: System Programming Guide" 3737: 3286: 3271: 2924:

Intel 64 and IA-32 Architectures Software Developer's Manual Combined Volumes 3A, 3B, 3C, and 3D: System Programming Guide

2904:

Intel 64 and IA-32 Architectures Software Developer's Manual Combined Volumes 3A, 3B, 3C, and 3D: System Programming Guide

2627:

80386SX — low cost version of the 80386. This processor had 16 bit external data bus and 24-bit external address bus.

4198: 3974: 3812: 3332: 3317: 3276: 1992: 165: 2326: 3951: 3498: 3445: 343: 31: 4009: 3077: 4132: 4019: 3999: 3852: 3756: 3513: 3352: 3229: 2345:

What is interesting is that the designers of the time never suspected anyone would ever need more than 1 MB of RAM.

1870:

task, preventing one task from manipulating the memory of another. Paging also allows for pages to be moved out of

2861:... secondly, protected mode was also incompatible with the vast amount of real-mode code around at the time. 4078: 3548: 3367: 3327: 3322: 3281: 373:

on power up. Real mode functioned virtually identically to the 8086, allowing the vast majority of existing 8086

143: 3938: 3591: 3478: 3342: 2440: 2047: 742:

that must be served by the operating system. In addition, applications running in virtual 8086 mode generate a

630: 616: 520: 493: 2943: 2874: 2842: 4142: 4004: 3979: 3885: 3337: 1921: 1693:

bit, and determines which privilege levels can far-jump to this segment (without changing privilege level):

794:

is enabled, or (segment_part × 16 + offset) mod 2, if A20 is off. Every segment has a size of 2 bytes.

771: 508: 324:

As the cost of memory decreased and memory use increased, the 1 MB limitation became a significant problem.

205: 3956: 2416: 390: 3908: 3806: 3725: 3664: 3553: 3533: 3482: 3440: 3201: 1975:

when programs are not running, so manipulating absolute addresses is dangerous; programs should only keep

705:

and its successors can take advantage of the binary compatibility with real mode to run many Windows 2.x (

240: 109: 3508: 3474: 3376: 3312: 2052: 1907: 516: 302: 225: 3984: 2459: 3172:... both rely on the Intel processors ability to switch tasks, they rely on it in different ways. 2245: 301:. At the time, 1 megabyte was considered a relatively large amount of memory, so the designers of the 3705: 3679: 1886: 524: 235:

When a processor that supports x86 protected mode is powered on, it begins executing instructions in

229: 342:

The initial protected mode, released with the 286, was not widely used; for example, it was used by

3862: 3674: 3626: 3503: 2540: 2464: 2000: 735: 678: 213: 4104: 4088: 4014: 3611: 3518: 2004: 1917: 739: 433: 129: 847:

If G-bit is zero limit has a granularity of 1 byte, i.e. segment size may be 1, 2, ..., 2 bytes.

776: 496:) which involved resetting the CPU via the keyboard controller and saving the system registers, 436:

required for virtualizing the protected mode itself, however, had to wait for another 20 years.

3880: 3779: 3720: 3669: 3601: 3558: 3399: 3186: 2979: 2548: 2471: 2371: 2037: 1988: 1942: 1875: 1861: 722: 698: 477: 429: 414: 369:

The 286 maintained backward compatibility with its precursor (the 8086) by initially entering

310: 99: 825:

address of the segment, a limit value for the segment size, and some attribute bits (flags).

444:

With the release of the 386, the following additional features were added to protected mode:

4057: 4052: 3895: 3700: 3252: 2140: 2133: 743: 410: 248: 3004: 424:

Furthermore, learning from the failures of the 286 protected mode to satisfy the needs for

4047: 3946: 3644: 3606: 3577: 2799:. Santa Clara, California: Intel. 1987. Appendix C 8086/8088 Compatibility Considerations. 2567: 1879: 1871: 637:

or executing privileged instructions. In most environments, the operating system and some

290: 209: 133: 2735: