Modes of Memory Addressing on x86

CIS-77 Home http://www.c-jump.com/CIS77/CIS77syllabus.htm

Modes of Memory Addressing on x86

Two Real modes of addressing on 80x86
Segment Registers
Real Mode Segmented Model
Real Mode Segmented Model, Cont.
Problems Related to Segmentation
Address Space in Real Mode
Collective Terms for Memory
Memory Paragraphs in Real Mode
Segment of Memory in Real Mode
Memory Access in Real Mode
Segment Registers in Real Mode
Segment Register Names
Segment Register Names, Cont.
Segment Positions in Real Mode
General-Purpose Registers in Real mode
Segmentation Models Summary
Real Mode Flat Model Summary
Real Mode Flat Model Diagram
Real Mode Segmented Model
Real Mode Segmented Model, Cont.
Real Mode Segmented Model, Cont.
x86 Protected Mode Flat Memory Model
Advantages of Flat Memory Model
The Protected Mode Flat Model Diagram
The Protected Mode Flat Model Diagram, Cont.
The Protected Mode Flat Model Diagram, Cont.
Protected Mode Flat Model Summary
Console Applications
Segment Registers in Protected Mode
Protected Mode Architecture
Rings of protection, four levels of security
Three types of segment descriptor tables
Flat vs. Segmented Memory Model
Differences between 16-bit and 32-bit Memory Modes
Differences, cont.
Differences, cont.
Older OS and Addressing Modes Compared

1. Two Real modes of addressing on 80x86

Real mode flat model means
- strictly converting one address value into a physically meaningful location in the RAM.
Real mode segmented model means
- strictly converting two address values into a physically meaningful memory location.
- gives access to one megabyte (1,048,576 bytes) of directly addressable memory, known as real mode memory.

2. Segment Registers

Segment registers are basically memory pointers located inside the CPU.
Segment registers point to a place in memory where one of the following things begin:
1. Data storage
2. Code execution.

Example: code segment register CS points to a 64K region of memory:

3. Real Mode Segmented Model

Segmented organization
- 16-bit wide segments
Two components
- Base (16 bits)
- Offset (16 bits)
Two-component specification is called logical address, also called effective address.
Logical address translates to a 20-bit physical address.

4. Real Mode Segmented Model, Cont.

Addresses are limited to 20 bits:
- 2²⁰=1,048,576 bytes.
Physical address is generated by adding a
- 16-bit segment register, shifted left four bits
- plus a 16 bit-offset.

Generating 20-bit physical address in Real Mode:

5. Problems Related to Segmentation

Segmentation often caused grief for programmers who tried to access large data structures:
- Since an offset cannot exceed 16 bits, you cannot increment beyond 64k.
- Instead, program must watch out for a 64k boundary and then play games with the segment register.
This nightmare was originally created to support CP/M-80 programs ported from 8080 chip to 8086.
- Successful short-term thinking;
- Catastrophically bad long-term thinking that resulted in never-ending Windows 9x problems!

6. Address Space in Real Mode

Address space in real mode segmented model runs from
- 00000h to 0FFFFFh,
within one megabyte of memory.
For compatibility reasons, Pentium CPU is capable of switching itself into real mode segmented model, is effectively becoming a good old 8086 chip!

7. Collective Terms for Memory

Size	Decimal	Hex
Byte	1	01H
Word	2	02H
Double word	4	04H
Quad word	8	08H
Ten byte	10	0AH
Paragraph (*)	16	10H
Page, or page frame, (almost never used)	256	100H
Segment	65,536	10000H

______________

(*) Paragraphs are almost never used, except in connection with the places where segments may begin.

8. Memory Paragraphs in Real Mode

Any memory address evenly divisible by 16 is called a paragraph boundary.
- The first paragraph boundary is address 0.
- The second is address 10H (10H is equal to decimal 16.)
- The third address is 20H, and so on.
Any paragraph boundary may be considered the start of a segment.
There are 64K different paragraph boundaries where a segment may begin.
Each paragraph boundary has a number.
The numbers range from 0 to 64K minus one (decimal 65,535 or hex 0FFFFh.)
Any segment may begin at any paragraph boundary.
The number of the paragraph boundary is called the segment address.
Assembly language program can have up to four or five segments.
Segment address is 16 bytes in size.

9. Segment of Memory in Real Mode

Every byte of memory, accessible by program, is assumed to reside in a segment.
Segment size varies and can range from 1 byte to 64 Kbytes.
Nothing is protected within a segment in Real Mode.
Segments can overlap.
Initializing the data segment register in 16-bit real mode:
Numerical (immediate) values cannot be moved directly into the segment register. It is a 2-step process:
```
    mov ax, 1000h
    mov ds, ax
```

Initializing the data segment register:

10. Memory Access in Real Mode

Recall that 8086 and 8088 CPUs had 20 address pins, limiting a program to 1 megabyte of memory.
To express a 20-bit address, two 16-bit registers are used:
- segment address in one 16-bit register,
- and the offset address in another 16-bit register.
The memory location of a particular byte from one megabyte of memory is calculated as
- segment start address
- plus distance between the byte and the segment start.
The byte's distance from the start of the segment is referred to as the byte's offset address.
SEGMENT:OFFSET addresses are always written in hexadecimal notation.
- For example, an address of one byte of data MyByte is given as 0001:001D.
- This means that MyByte is in segment 0001H and is located 001DH bytes from the start of that segment.
Since segments can overlap, same byte could also be located by SEGMENT:OFFSET combinations 0002:000D or 0001:001D.

11. Segment Registers in Real Mode

The 8088, 8086, and 80286 CPUs have four segment registers to hold segment addresses.
The 386 and later CPUs have two more, also available in real mode.
Note: the 386 and later Intel x86 CPUs still use 16-bit size segment registers.
Each segment register is 16-bit in size.
No matter how location in memory is accessed, the segment address of that location must be present in one of the six segment registers:
- CS, DS, SS, ES, FS and GS.

12. Segment Register Names

All x86 segment registers are 16 bits in size, irrespective of the CPU:
- CS, code segment. Machine instructions exist at some offset into a code segment. The segment address of the code segment of the currently executing instruction is contained in CS.
- DS, data segment. Variables and other data exist at some offset into a data segment. There may be many data segments, but the CPU may only use one at a time, by placing the segment address of that segment in register DS.
- SS, stack segment. The stack is a very important component of the CPU used for temporary storage of data and addresses. Therefore, the stack has a segment address, which is contained in register SS.
- ES, extra segment. The extra segment is exactly that: a spare segment that may be used for specifying a location in memory.

13. Segment Register Names, Cont.

FS and GS are clones of ES, the extra segment.
FS and GS both are just additional segments, no specialty here.
Names FS and GS come from the fact that they were created after ES: E, F, G.
They exist only in the 386 and later x86 CPUs.
Extra segments ES, FS, and GS can be used for both data or code.

The six segments of the memory system:

14. Segment Positions in Real Mode

15. General-Purpose Registers in Real mode

General-purpose registers may hold
- data values
- offset addresses that must be paired with segment addresses to locate data in memory.
The customary notation is to separate the segment register and the offset register by a colon. For example:
```
    DS : AX
    SS : SP
    SS : BP
    ES : DI
    DS : SI
    CS : BX
```

16. Segmentation Models Summary

Pentium can turn off segmentation.
Flat model
- Consists of one segment of 4GB
- Used by linux
Multisegment model
- Up to six active segments
- Can have more than six segments (all segment descriptors are in the descriptor table.)
- A segment becomes active by loading its descriptor into one of the segment registers.

17. Real Mode Flat Model Summary

CPU can see only 1 megabyte (1,048,576) of memory.
segment:offset pairs form a 20-bit addresses out of two 16-bit addresses.
In real mode flat model a program and all its data must exist within a single 64K block of memory.
The real mode flat model is similar to protected mode flat model, the code model used on Linux and Windows XP/Vista.

18. Real Mode Flat Model Diagram

The segment registers are all set to point to the beginning of the 64K block of memory.
The operating system sets segment registers when it loads the program.
All segment registers point to that same place.
Physical segment assignments never change as long as the program is running.
The segment registers are still functioning, but no work with segments is required.

19. Real Mode Segmented Model

Real mode segmented model was mainstream programming model throughout the MS-DOS era.
Used when Windows 9x machine is booted into MS-DOS mode.
Good choice to write code to run under MS-DOS.
Program has access to 1MB of memory.
The CPU handles transformations of segment:offset combinations into a full 20-bit address.
CS always points to the current code segment

20. Real Mode Segmented Model, Cont.

The next instruction to be executed is pointed to by the CS:IP register pair.
Machine instructions called jumps can change CS to another code segment if necessary.
The program can span several code segments.
There is no direct CS manipulation to change from one code segment to another:
- when a jump instruction needs to take execution into a different code segment, it changes CS value for you.

21. Real Mode Segmented Model, Cont.

There is only one stack segment for any single program.
A program has potential to destroy portions of memory that does not belong to its process.
Careless use of segment registers will cause the operating system to crash.

22. x86 Protected Mode Flat Memory Model

On 32-bit processors, Windows and Linux use the so-called protected mode flat memory model.
Under flat memory model,
- entire address space is described by a 32-bit segment, which provides 2³² = 4 gigabytes of address space.
- program can (in theory) access up to 4 gigabytes of virtual or physical memory.
In protected mode,
- segment registers contain selector values rather than actual physical segment addresses.
- Selector values cannot be calculated by the program; they must be obtained by calling the operating system.
- Programs that update segment values or attempt to address memory directly do not work in protected mode.

23. Advantages of Flat Memory Model

32-bit Protected Mode supports much larger data structures than Real mode.
Because code, data, and stack reside in the same segment, each segment register can hold the same value that never needs to change.
Rather than using a formula (such as CS:IP) to determine the physical address, protected mode processors use a look up table.
Segment registers simply point to OS data structures that contain the information needed to access a location.
Protected mode uses privilege levels to maintain system integrity and security.
Programs cannot access data or code that is in a higher privilege level.
- (Segment value exchanges at the same privilege level are allowed.)

24. The Protected Mode Flat Model Diagram

The instruction pointer is 32 bits in size
EIP can indicate any machine instruction anywhere in the 4 GB of memory.
The segment registers still exists and define where 4 GB of program-accessible memory resides in physical or virtual memory
The segment registers are now considered part of the operating system, you can neither read nor change them directly.

25. The Protected Mode Flat Model Diagram, Cont.

When 32-bit program executes, it has access to 4-gig address space.
Any general-purpose register by itself can specify any memory location in the entire memory address space of the 4 billion memory locations
- (except certain operating system-specific parts of the program that belong to the operating system.)

26. The Protected Mode Flat Model Diagram, Cont.

Attempting to actually read or write certain locations in your own program can be forbidden by the OS and will trigger an error.
Challenges in programming for protected mode flat model are based on understanding the operating system, its requirements, and restrictions.

27. Protected Mode Flat Model Summary

Application programs cannot make use of protected mode by themselves.
The operating system must set up and manage a protected mode.
Capability provided by Linux and Windows NT/2000/XP/Vista systems.
Each address is a 32-bit quantity.
All of the general-purpose registers are 32 bits in size.

28. Console Applications

An easiest way to write protected mode assembly program under Windows is to create console application.
Console application is text-mode program that runs in a text-mode window called a console.
The console is controlled by a user through a command line interface,
- (almost identical to the MS-DOS command window.)
Console applications use protected mode flat model and are fairly straightforward.
The default memory mode for text console app under Linux is also protected mode.

29. Segment Registers in Protected Mode

Segment registers are called selectors when operating in protected mode.

In protected mode, segment registers simply point to data structures called segment descriptors that contain the information needed to access a physical memory location.

Segment selector is a segment register, containing the selector value:

13-bit index field selects one of 8,192 segment descriptors.
TI (table indicator) specifies segment descriptor, which can be in
- GDT - global descriptor table (one for all programs)
- LDT - local descriptor table (typically one for each program, more can exist.)
- IDT - interrupt descriptor table.

RPL requestor privilege level - 2-bit field, specifies if the access to the segment is allowed.

30. Protected Mode Architecture

Segment register (segment selector) -> segment descriptor -> physical memory

31. Rings of protection, four levels of security

The 2-bit requestor privilege level field, the RPL, specifies segment protection level:

Segment register (segment selector)
Some instructions that directly access ports or affect interrupts (such as CLI, STI, IN, and OUT) are available at privilege levels normally used only by systems programs.

32. Three types of segment descriptor tables

1. Global descriptor table GDT
- Only one in the system
- Contains OS code and data
- Available to all tasks
2. Local descriptor table LDT
- Several LDTs may exist for a program.
- Contains descriptors of a program

Segment descriptor format:

3. Interrupt descriptor table IDT, used by interrupt processing.

33. Flat vs. Segmented Memory Model

32 and 64-bit Intel systems using a flat memory model:

Segmented memory is preferred model on 16-bit systems as it allows for flexibility in memory allocation and can also prevent buffer overruns:

34. Differences between 16-bit and 32-bit Memory Modes

Understanding segments is an essential part of programming in assembly language.
In the family of 8086-based processors, the term segment has two meanings:
1. A block of memory of discrete size, called a physical segment. The number of bytes in a physical memory segment is
  - (a) 64K for 16-bit processors
  - (b) 4 gigabytes for 32-bit processors.
2. A variable-sized block of memory, called a logical segment occupied by a program's code or data.

35. Differences, cont.

Segmented architecture presents certain hurdles for 16-bit assembly-language program.
For small 16-bit flat model programs, the limitations lose importance:
- code and data each occupy less than 64K and reside in individual segments.
- a simple offset locates each variable or instruction within a segment.

36. Differences, cont.

Larger 16-bit programs, however, must contend with problems of segmented memory areas:
- If data occupies two or more segments, the program must specify both segment and offset to access a variable.
- When the data forms a continuous stream across segments, such as the text in a word processor's workspace, the problems become more acute.
- Whenever it adds or deletes text in the first segment, the word processor must seamlessly move data back and forth over the boundaries of each following segment.
The problem of segment boundaries disappears in flat address space of 32-bit protected mode:
- Although segments still exist, they easily hold all the code and data of the largest programs.
- Even a very large program becomes, in effect, a small application, capable to reach all code and all data with a single offset address.

37. Older OS and Addressing Modes Compared

The MS-DOS and Older Windows Operating Systems
Operating System	System Access	Available Active Processes	Addressable Memory	Contents of Segment Register	Word Length
MS-DOS and Windows real mode	Direct to hardware and OS call	One	1 megabyte	Actual address	16 bits
Windows 3.x virtual-86 mode	Operating system call	Multiple	1 megabyte	Segment selectors	16 bits
Windows 3.x protected mode	Operating system call	Multiple	16 megabytes	Segment selectors	16 bits
Windows NT 3.x	Operating system call	Multiple	512 megabytes	Segment selectors	32 bits