What hardware features enable OS isolation and protection?

Question

Accepted Answer

Three hardware features: CPU privilege modes (rings), MMU address translation, and the periodic timer interrupt.

* Three hardware features keep the kernel in control: privilege modes forbid dangerous instructions, the MMU walls off memory, and the timer interrupt always returns the CPU. *
Together these keep the kernel in control: user mode forbids dangerous instructions, per-process page tables wall off memory, and the timer guarantees the kernel regains the CPU even from a program stuck in an infinite loop.
1. CPU Modes (Protection Rings on x86):

Ring 0 (Kernel mode): All instructions allowed
Ring 3 (User mode): Only "safe" instructions

Examples:

Instruction
Ring 3
Ring 0
Purpose

movq $0, %rax
Yes
Yes
Set register

hlt
No
Yes
Halt processor

wbinvd
No
Yes
Flush caches

2. Memory System:

MMU performs address translation
Each process has its own page table
Invalid access -> page fault -> OS handles

3. Timer Interrupt:

Hardware timer fires periodically
Forces return to kernel
Enables preemptive multitasking

Modern additions: Virtualization support (VT-x, nested paging).
Go deeper:

Protection ring (Wikipedia) — the CPU mode bit that gates privileged instructions.
 Memory management unit (Wikipedia) — hardware address translation that isolates address spaces.
 System call (Wikipedia) — the trap mechanism that lets user code cross the boundary only through the kernel.

Instruction	Ring 3	Ring 0	Purpose
`movq $0, %rax`	Yes	Yes	Set register
`hlt`	No	Yes	Halt processor
`wbinvd`	No	Yes	Flush caches