In fact there isn't any hardware to speak of (3 bits worth of architectural registers and bunch of trivial logic related to that?) to support vm86 mode, and tha

In fact there isn't any hardware to speak of (3 bits worth of architectural registers and bunch of trivial logic related to that?) to support vm86 mode, and that is to some extent the consequence of how true real mode is implemented. The combination of paging enabled (which is not strictly necessary), protected mode enabled, 16b code segment and real mode style segment loads gets you vm86 mode (complete with weird stuff on stack of exception handler vectors), in fact when you look at vm86 entry gate descriptor, this is exactly what it does. The microarchitecture essentially does not care about that. edit: there is no documented direct way to flip the segment/selector bit, which is the reason why you need documented vm86 mode. The hardware always calculate the linear address according to whatever is in shadow descriptor of segment/selector register, difference between real/vm86 and protected mode is what happens when you store something into there.