Code can write to any address it wants to, and CALL or JMP to any other address. There is no clear separation between MS-DOS and application programs. In real mode, programs commonly modify areas considered the domain of the operating syste m, such as the interrupt vector table. A buggy program can bring the whole system crashing down. The introduction of 286s gave programmers protected mode, with the ability to isolate programs from the operating system and from each other.
Protected mode is based on two fundamental ideas.
The first, segment limit checking, is by now familiar to most programmers who work in Windows. For instance, w hen you GlobalAlloc memory, you must specify a length for the memory block. I won't dwell on this aspect of protection here. That's what I'll focus on. Access protection is based on the idea of four different privilege levels or rings.