How to tell whether your CPU is running in real mode or protected mode

How to tell whether your CPU is running in real mode or protected mode

The 286 processor was a significant advance for the PC. It set the stage for what would be the standard computer CPU paradigm for years to come. Although subsequent CPUs would add various features and run at a higher speed, by the time the 286 came around, the key features for what was to be considered a standard computer processor had been pretty much settled. Arguably the most important advance that the 286 brought was an innovation called "protected mode".

Prior to protected mode, programs had all run in a single memory space, and any program could do pretty much whatever it wanted with the computer's memory. This was a pretty straightforward and simple model that worked well for computers that only ran one program at a time and which wanted to grant complete control to each program. By contrast, in protected mode, the CPU is actually running several "virtual machines" at once; each virtual machine is an instance of a little sub-computer with its own memory space. Under this system, several programs can be running at the same time, and each program gets its own memory space. Since several programs are trying to use the memory at one time, it becomes critical to implement memory protection rules which dictate what parts of memory each program can access (so that one program doesn't mess up another program's memory because each program thinks it's the only program that exists in the entire computer). The existence and implementation of these memory protection rules led to the name "protected mode".

Protected mode was one of those rare ideas that not only was a good idea, but actually worked like it was supposed to and therefore was capable of revolutionizing how things were done. It wasn't long before many programs were written to take advantage of protected mode; TSRs became possible (programs which ran in the background and allowed you to keep working while doing some function invisibly in the background). In the longer term, whole operating systems were written that acted as protected mode shells, allowing the user to launch many programs at once and switch between them easily. (This is essentially all that Microsoft Windows was in its early stages.)

Protected mode was a revolution in personal computing, but processors (and operating systems) provided users with the option of running in real mode. Not all programs took kindly to protected mode, and if the user wanted to run some program that refused to accept anything but pure, un-virtual, real mode, they should be able to do so. There were and are certain things you just can't do in protected mode; any task requiring the ability to read and write any actual location in memory (not virtual locations, ACTUAL locations) is difficult or impossible when a program is locked into a certain memory space. Basic business applications like word processors and spreadsheets usually do not need to do such low-level memory work, but many types of utilities and software hacks benefit from being able to actually run in a real computer, and not a simulated pseudocomputer.

Today, such practices have been marginalized to the point where they are considered almost mythical. Operating systems typically do not even bother allowing for real mode anymore; they boot automatically into protected mode and stay that way. While this may make things easier for end-users, it also renders it impossible to perform many of the things that low-level programmers do on a daily basis.

Real mode is not well understood by the average present-day user. Many people only vaguely grasp the concept of using a command-line interface at all, and cannot distinguish between opening a simple command prompt window in Windows (which is simply a command shell running on top of Windows) and actual real mode; in real real mode, Windows isn't running at all, and some command-line interface is the only action happening. (Actually, this isn't strictly true; there's no reason why a real mode interface couldn't be a GUI, but most real mode interfaces are command line interfaces, for reasons that are more psychosocial than technological in nature.)

If you want to know whether your computer is running in real mode or not, there is a fairly simple way to check. Processors which support protected mode (in other words, 286s and up) contain a register called the Machine Status Word (MSW). This register contains several pieces of information about the current state that the CPU is running in, but the only one that we're interested in right now is whether the CPU is in protected mode or real mode. This is indicated by the final bit of the MSW (sometimes called the PE or "Protection Enable" bit); if this bit is set to 0, that means that the CPU is in real mode, and if the bit is set to 1, that means the CPU is in protected mode.

So how do you check this bit? You need to store the MSW somewhere and take a look at it. An easy CPU instruction to do this with is SMSW (Store Machine Status Word), which, as you can probably guess, stores the MSW register in some location. Technically, the SMSW CPU instruction is supposed to be only for 286s, and 386+ machines are supposed to MOV the CR0 register (a register specific to 386-and-above CPUs, which partially consists of the MSW) somewhere, but for a simple, small utility, the SMSW instruction works. The three hexadecimal bytes 0F 01 E0 form a machine language instruction for SMSW AX, which would transfer the MSW into register AX. (The MSW is 16 bits, and so is AX; you can't store the MSW in an 8-bit register like AH or AL.)

Once you've stored the MSW in some register, you can AND that register with 1 to zero out all but the last bit on the register. Then, CMP the register to find out what it is; if it's 1, you know the CPU is in protected mode. If it's 0, you know the CPU is in real mode.

The following is a small assembler program to tell you whether your CPU is in real mode or protected mode:

DB 0Fh,01h,0E0h ;SMSW AX

AND AX,1 ;AX is now 1 if CPU is in protected mode, or 0 if CPU is real.

CMP AX,0
JE real

MOV AH,9
MOV DS,SEG protmsg
MOV DX,OFFSET protmsg
INT 21h
JMP ender

real:
MOV AH,9
MOV DS,SEG realmsg
MOV DX,OFFSET realmsg
INT 21h

ender:
MOV AX,4C00h ;terminate program
INT 21h

realmsg: db 'Your CPU is running in real mode.$'
protmsg: db 'Your CPU is running in protected mode.$'

If you're running any version of Windows newer than 3.x when you run this program, chances are excellent that you'll find you're in protected mode; if you run in command prompt mode (which was still an option under Windows 95 and 98), you may find that you're in real mode. However, command line mode is not a guarantee of real mode; your CPU will still be in protected mode if a memory manager like EMM386 is loaded.

If you're on any of the NT-based Windows systems (2000, XP, etc.) then you are almost 100% guaranteed to be in protected mode, without even the option to boot into real mode. (Command-line interfaces were removed from Windows after Windows 98.) This is unfortunate, because it means that you do not have control of your computer. You cannot change a memory location unless Windows allows you to, and rearranging the interrupts and timings on your computer is practically out of the question. What's possibly even more sad than this is the fact that most users don't know and don't care about this fact; they really aren't even aware of the lack of control they have over their own computers.

If you want to experiment with real mode without having to install a new operating system, there is hope, however, in the form of emulators. You can simulate a real-mode computer through the use of an appropriate emulator. Probably the most popular MS-DOS emulator in existence for Windows right now is DOSBox, an open-source project which is impressive for how well it simulates a virtual real-mode machine. It allows you to run programs which, for example, fiddle with the interrupt timings to allow digital sound to be played through the computer's internal speaker, a feat not easily done under protected-mode Windows. (DOSBox actually plays emulated PC speaker sounds through your sound card, so it doesn't actually change your computer's timings, but it does a pretty good job of simulating what would happen if you did.)

As computers become more complicated, end-users who just want to use computers without knowing how they work will continue to be less aware of what's actually going on with their computers. Although that can't necessarily be avoided (since part of the goal of computer programmers is to shield users from actually having to know how their computers really work), technicians and power users should still have the option of doing what they want with their computers; that includes being able to decide what mode their computer is running in. Knowing whether you're in real mode or protected mode is a good place to start.

Back to the main page