protected mode
An operating mode of Intel 80x86 processors. The opposite of real mode. The Intel 8088, Intel 8086, Intel 80188 and Intel 80186 had only real mode, processors beginning with the Intel 80286 feature a second mode called protected mode.
In real mode, addresses are generated by adding an address offset to the value of a segment register shifted left four bits. As the segment register and address offset are 16 bits long this results in a 20-bit address. This is the origin of the one megabyte (2^20) limit in real mode.
There are 4 segment registers on processors before the Intel 80386. The 80386 introduced two more segment registers. Which segment register is used depends on the instruction, on the addressing mode and of an optional instruction prefix which selects the segment register explicitly.
In protected mode, the segment registers contain an index into a table of segment descriptors. Each segment descriptor contains the start address of the segment, to which the offset is added to generate the address. In addition, the segment descriptor contains memory protection information. This includes an offset limit and bits for write and read permission. This allows the processor to prevent memory accesses to certain data. The operating system can use this to protect different processes' memory from each other, hence the name "protected mode".
While the standard register set belongs to the CPU, the segment registers lie "at the boundary" between the CPU and MMU. Each time a new value is loaded into a segment register while in protected mode, the corresponding descriptor is loaded into a descriptor cache in the (Segment-)MMU. On processors before the Pentium this takes longer than just loading the segment register in real mode. Addresses generated by the CPU (which are segment offsets) are passed to the MMU to be checked against the limit in the segment descriptor and are there added to the segment base address in the descriptor to form a linear address.
On a 80386 or later, the linear address is further processed by the paged MMU before the result (the physical address) appears on the chip's address pins. The 80286 doesn't have a paged MMU so the linear address is output directly as the physical address.
The paged MMU allows for arbitrary remapping of four klilobyte memory blocks (pages) through a translation table stored in memory. A few entries of this table are cached in the MMU's Translation Lookaside Buffer to avoid excessive memory accesses.
After processor reset, all processors start in real mode. Protected mode has to be enabled by software. On the 80286 there exists no documented way back to real mode apart from resetting the processor. Later processors allow switching back to real mode by software.
Software which has been written or compiled to run in protected mode must only use segment register values given to it by the operating system. Unfortunately, most application code for MS-DOS, written before the 286, will fail in protected mode because it assumes real mode addressing and writes arbitrary values to segment registers, e.g. in order to perform address calculations.
Such use of segment registers is only really necessary with data structures that are larger than 64 kilobytes and thus don't fit into a single segment. This is usually dealt with by the huge memory model in compilers. In this model, compilers generate address arithmetic involving segment registers. A solution which is portable to protected mode with almost the same efficiency would involve using a table of segments instead of calculating new segment register values ad hoc.
To ease the transition to protected mode, Intel 80386 and later processors provide "virtual 86 mode".