Vol. 3A 5-1

CHAPTER 5

PROTECTION

In protected mode, the Intel 64 and IA-32 architectures provide a protection mechanism that operates at both the 
segment level and the page level. This protection mechanism provides the ability to limit access to certain 
segments or pages based on privilege levels (four privilege levels for segments and two privilege levels for pages). 
For example, critical operating-system code and data can be protected by placing them in more privileged 
segments than those that contain applications code. The processor’s protection mechanism will then prevent appli-
cation code from accessing the operating-system code and data in any but a controlled, defined manner.
Segment and page protection can be used at all stages of software development to assist in localizing and detecting 
design problems and bugs. It can also be incorporated into end-products to offer added robustness to operating 
systems, utilities software, and applications software.
When the protection mechanism is used, each memory reference is checked to verify that it satisfies various 
protection checks. All checks are made before the memory cycle is started; any violation results in an exception. 
Because checks are performed in parallel with address translation, there is no performance penalty. The protection 
checks that are performed fall into the following categories:

•

Limit checks.

•

Type checks.

•

Privilege level checks.

•

Restriction of addressable domain.

•

Restriction of procedure entry-points.

•

Restriction of instruction set.

All protection violation results in an exception being generated. See Chapter 6, “Interrupt and Exception Handling,” 
for an explanation of the exception mechanism. This chapter describes the protection mechanism and the viola-
tions which lead to exceptions.
The following sections describe the protection mechanism available in protected mode. See Chapter 20, “8086 
Emulation,” for information on protection in real-address and virtual-8086 mode.

5.1 

ENABLING AND DISABLING SEGMENT AND PAGE PROTECTION

Setting the PE flag in register CR0 causes the processor to switch to protected mode, which in turn enables the 
segment-protection mechanism. Once in protected mode, there is no control bit for turning the protection mecha-
nism on or off. The part of the segment-protection mechanism that is based on privilege levels can essentially be 
disabled while still in protected mode by assigning a privilege level of 0 (most privileged) to all segment selectors 
and segment descriptors. This action disables the privilege level protection barriers between segments, but other 
protection checks such as limit checking and type checking are still carried out.
Page-level protection is automatically enabled when paging is enabled (by setting the PG flag in register CR0). Here 
again there is no mode bit for turning off page-level protection once paging is enabled. However, page-level protec-
tion can be disabled by performing the following operations:

•

Clear the WP flag in control register CR0.

•

Set the read/write (R/W) and user/supervisor (U/S) flags for each page-directory and page-table entry. 

This action makes each page a writable, user page, which in effect disables page-level protection.