The protected mode of the Intel processors

This document gives an introduction to the use of the protected mode (short pm) of the Intel processor (32 bit). For more informations look for a manual of Intel.

Privilege levels

While in protected mode, the processor runs the tasks on different privilege levels (0 to 3). While in privilege level 0, all instructions, accesses etc. are allowed. The privilege level for user tasks is 3. The access restrictions for each level depend how this is handled by the OS. For example, it's possible to allow I/O operations for all privilege level or allow I/O only for the level 0. A task which runs on privilege level 2 can only access data and code segments with privilege level 2 or 3 (a call to a segment with privilege level 0 or 1causes an exception 0Dh).

The descriptor tables GDT, IDT and LDT

The main difference between real mode and protected mode is, that in pm the stupid idea of segment*16+offset is given up. The segment address is now translated in two stages to get the base address of the segment, the memory is now addressed via selector:offset. The selector is an index to a table of descriptors. This descriptors decribe the access rights of a segment, the segement size and the linear base address of the segment (be careful, there is a difference between a linear and physical address, a linear address is translated by the MMU to a phiscal address). There are three descriptor tables: the GDT and the IDT which are global for all tasks, the LDT which is task specific.

Contents of a selector

Descriptor types

The processor support different types of descriptors, some of these types are only allowed in the LDT or GDT, but not in the IDT.

Code segment descriptors

Data segment and stack segment descriptors

Task state and LDT descriptors

Trap gates and interrupt gates

Call gates

Well, as decribed above, a user program can't call a routine in a segment with super visior privilege level, but how can a user task call the OS? The solution are call gates. Call gates are descriptors which allows to call a segment with a higher privilege. The offset in the destination comes also from the call gate descriptor so it's impossible for the user program to jump to any point in the super visior segment.

Task gate descriptors

The memory management unit (MMU)

Task state segment

The interrupt handling

In the pm the processor distinguish between traps, interrupts and exceptions. A trap is a software interrupt, an interrupt an external interrupt which comes from a device (in rela mode hardware interrupt), an exception is an interrupt genereted by the processor if an error occurs (division by zero, page fault, access violation ....).

Table of exceptions

Error code

This error code is written to stack:

 31      16 

 15      3 

  2  

   1  

    0  

TI: only important if IDT-bit=0
0 : index is selctor of GDT
1: index is selctor of LDT

IDT-bit:
0: Descriptor in the LDT or GDT causes the exception
1: interrupt gate (gate nr. in index)

External bit:
0: error is caused by the program
1: the error is caused by an interrupt

Error code by an exception 0Eh (page fault)

Bit 0:
0: page isn't present in phsical memory
1: page access violation

Bit 1:
0: error while read access
1: error while write acces

Bit 2:
0: program with privilege 0,1 or 2 causes the fault
1: user program (privilege=3) causesa the fault

The virtual 8086 mode

The processor switches to the virtual mode if the VM-flag (bit 17 in EFLAGS) is set while executing an IRETD instruction from a segment with privilge level 0. If this flag is set, the segment registers and ESP are also loaded from the stack. The segment registers are now used like in real mode to create a linear address, this linear address can (it's in most cases nessecary) be translated by the MMU to a physical address. The main difference to the real mode is, that interrupts, exceptions and traps switch the processor back to the real mode and the handler which is specified by the IDT is called.

If the processor leaves the virtual mode, these datas are also on the stack.