College of Engineering and Architecture

BS Computer Engineering
Microprocessors

3rd
Year

Lecture Notes 5 & 6

How its memory space is addressed?
 Microprocessors
Memory Modes of Operation
Lecture
Notes 5&6

Contents
How its memory space is addressed? 
Real mode of operation
Protected mode of operation 
Flat mode of operation

Real mode of operation

Overlapped Segments
An application program containing a code,
data, and stack segment loaded into a DOS
system memory
The side view of the segments clearly
shows the overlap.
It also shows how segments can be moved
over any area of memory by changing the
segment starting address.
Fortunately, the DOS program loader
calculates and assigns segment starting
addresses

16-bit Default Segment and Offset Registers

CpE 3 | CSU Carig 1

Microprocessors
Memory Modes of Operation
Lecture
Notes 5&6
32-bit Default Segment and Offset Registers

Examples of real mode segment addresses

Examples 2
The segment address is 4000H
The offset address is specified as the sum of F000H plus 3000H
What is the memory location that will be accessed?
Solution
Start Address: 40000H
Offset Address: F000H + 3000H = 12000H
This will access memory location 42000H instead of location 52000H (Why?)
When the F000H and 3000H are added, they form a l6-bit (modulo 16) sum
of 2000H used as the offset address; not 12000H, the true sum.
Note that the carry of 1 (F000H + 3000H = 12000H) is dropped for this
addition to form the offset address of 2000H. The address is generated as
4000:2000 or 42000H.

CpE 3 | CSU Carig 2

 Microprocessors
Memory Modes of Operation
Lecture
Notes 5&6
Protected mode of operation

Protected Mode Addressing

Protected mode is where Windows operates.
Allow the processor to perform multi-tasking: system protect each
task in the memory from each other task
Supports segmentation (real mode) and paging
Supports virtual real mode: read address mode software in a protected-
multitasking environment
Allows access to data and programs located within (real mode) & above the first
1M byte of memory (protected mode).

Protected Mode Application

Operating systems operate in a 16- or 32-bit environment.
DOS uses a 16-bit environment.
Most Windows applications use a 32-bit environment called WIN32.
MSDOS/PCDOS & Windows 3.1 operating systems require 16-bit instruction
mode.
oInstruction mode is accessible only in a protected mode system such as
Windows Vista.

Protected Mode Addressing: the segment register contains a selector

In place of a segment address, the segment register
contains a selector that selects a descriptor from a
descriptor table.
The descriptor describes the memory segment’s Contains a selectors:
location, length, and access rights Job: select a descriptor
from a descriptor table

Protected Mode Addressing: the segment register contains a selector

Offset address be 16 bit or 32 bit 

In real mode only 16 bit is allowed
In case of a 32 bit offset, this allows the microprocessor to access data within a segment
that can be up to 4G bytes in length
In real mode the size of the segment is only 64k byte

CpE 3 | CSU Carig 3

Microprocessors
Memory Modes of Operation
Lecture
Notes 5&6
Selectors and Descriptors
The descriptor is located in the segment register & describes the location,
length, and access rights of the segment of memory.
it selects one of 8192 (8k: need 13 bits to select which one) descriptors from
one of two tables of descriptors
In protected mode, this segment number can address any memory location in the
system for the code segment.
Indirectly, the register still selects a memory segment, but not directly as in real
mode

Global and Local Descriptors

There are two descriptor tables used with the segment registers
1. Global descriptors contain segment definitions that apply to all programs.
2. Local descriptors are usually unique to an application.
a global descriptor might be called a system descriptor, and local descriptor
an application descriptor
Each descriptor table contains 8192 descriptors, so a total of 16,384
descriptors

How many memory segments can be accessed in Protected mode?

There are two descriptor tables (local and global) used with the segment
registers
Each descriptor table contains 8192 (8k) descriptors, so a total of 16,384 (16k)
descriptors
Because the descriptor describes a memory segment, this allows up to 16,384
memory segments to be described for each application.
Since a memory segment can be up to 4G bytes in length, this means that an
application could have access to 4G x 16k bytes of memory or 64T bytes.

CpE 3 | CSU Carig 4

Microprocessors
Memory Modes of Operation
Lecture
Notes 5&6
Protected Mode Addressing

1. Using the DS register to select a description

from the global descriptor table.
In this example, the DS register accesses
memory locations 00100000H–
001000FFH as a data segment.
2. The entry in the global descriptor table
selects a segment in the memory system

Windows Mode
Allows access to data and programs located
anywhere in the memory
Variable Segment size
Using the segment register to select a
description from the global descriptor table.
In this example, the DS register accesses
memory locations 00100000H–
001000FFH as a data segment.
The entry in the global descriptor table
selects a segment in the memory system.

CpE 3 | CSU Carig 5

Microprocessors
Memory Modes of Operation
Lecture
Notes 5&6
Selector Format

The contents of a segment register during protected mode operation of the 80286 through Core2
microprocessors.

The highest privilege level is 00 and the lowest is 11.

If the requested privilege level matches or is higher in priority than the privilege level set
by the access rights byte, access is granted.
For example, if the requested privilege level is 10 and the access rights byte sets the
segment privilege level at 11, access is granted because 10 is higher in priority than
privilege level 11
If privilege levels are violated, the system normally indicates an application or privilege
level violation

CpE 3 | CSU Carig 6

Microprocessors
Memory Modes of Operation
Lecture
Notes 5&6
Selector Format

13-bit selector field: selects one of 8192 (8k) descriptors from one of two tables
(global or local) of descriptors
Each descriptor table contains 8192 descriptors, so a total of 16,384 total
descriptors 16,384 total descriptors
The TI bit (table selector bit) selects either the global or the local descriptor table.
Requested Privilege Level (RPL) requests the access privilege level of a memory
segment.
If privilege levels are violated, system normally indicates an application or privilege
level violation

Format of a descriptor for the 80286 through the Core2.

Each descriptor is 8 bytes in

length
global and local descriptor
tables are a maximum of
64K bytes in length
The base address of the
descriptor indicates the
starting location of the
memory segment
(24 bit)-->16 Mega byte,
32 bit-->4Gbyte
The segment limit contains
the last offset address
found in a segment
(16 bit)-->1 to 64K,
(20 bit)-->1 to 1M (G=0),
4k to 4G in steps of 4k
(G=1) Limit x 4k=
(Limit)FFF H

CpE 3 | CSU Carig 7

Microprocessors
Memory Modes of Operation
Lecture
Notes 5&6
Descriptors Format: Base Address

The base address of the descriptor indicates the starting location of the memory
segment.
the paragraph boundary limitation is removed in protected mode 
segments may begin at any address
The base address of the descriptor indicates the starting location of the memory
segment
For the 80286 microprocessor, the base address is a 24-bit address, so segments
begin at any location in its 16M bytes of memory
The 80386 and above use a 32-bit base address that allows segments to begin at
any location in its 4G bytes of memory

Descriptors Format: Segment Limit

The segment limit contains the last offset address found in a segment.
80286 has a 16-bit limit:
an 80286 can access memory segments that are between 1 and 64K bytes in
length
80386 through the Pentium 4 have a 20-bit limit.
The 80386 and above access memory segments that are between 1 and 1M byte,
or 4K and 4G bytes in length.

Descriptors Format: Granularity Bit

There is another feature found in the 80386 through the Pentium 4 descriptor that is
not found in the 80286 descriptor
If G=0, the limit specifies a segment limit of 00000H to FFFFFH.
If G=1, the value of the limit is multiplied by 4K bytes (appended with
FFFH). The limit is then 00000FFFFH to FFFFFFFFH
oThe G, or granularity bit allows a segment length of 4K to 4G bytes in steps of 4K
bytes.
32-bit offset address allows segment lengths of 4G bytes 
16-bit offset address allows segment lengths of 64K bytes.

CpE 3 | CSU Carig 8

Microprocessors
Memory Modes of Operation
Lecture
Notes 5&6
Example-1 (G=0)

The segment start and end if the base address is 10000000H, the limit is 001FFH, and the G-
bit G=0

Base = Start = 10000000H

G = 0
End = Base + Limit = 10000000H + 001FFH = 100001FFH

Example-2 (G=0)

The segment start and end if the base address is 10000000H, the limit is 001FFH, and the G-
bit G=1

Base = Start = 10000000H

G = 1
End = Base + Limit = 10000000H + 001FFFFFH = 101FFFFFH

Note: limit is appended with FFFH to determine the ending segment address

Descriptors Format: L- Bit

In the 64-bit descriptor, the L bit (probably means large, but Intel calls it the 64-bit)
selects 64-bit addresses in a Pentium 4 or Core2 with 64-bit extensions when L = 1
and 32-bit compatibility mode when L=0.
In 64-bit protected operation, the code segment register is still used to select a
section of code from the memory.
Notice that the 64-bit descriptor has no limit or base address. It only contains an
access rights byte and the control bits.
In the 64-bit mode, there is no segment or limit in the descriptor and the base address
of the segment, although not placed in the descriptor, is 00 0000 0000H.
This means that all code segments start at address zero for 64-bit operation. There
are no limit checks for a 64-bit code segment

CpE 3 | CSU Carig 9

Microprocessors
Memory Modes of Operation
Lecture
Notes 5&6
Descriptors Format: AV- Bit
The AV bit, in the 80386 and above descriptor, is used by some operating systems to
indicate that the segment is available ( AV=1) or not available (AV=0 ).

Descriptors Format: D- Bit

The D bit indicates how the 80386 through the Core2 instructions access register and
memory data in the protected or real mode.
If D=0, the instructions are 16-bit instructions, compatible with the 8086– 80286
microprocessors. This means that the instructions use 16-bit offset addresses and
16-bit register by default. This mode is often called the 16- bit instruction mode or
DOS mode.
If D=1, the instructions are 32-bit instructions. By default, the 32-bit instruction mode
assumes that all offset addresses and all registers are 32 bits.
Note that the default for register size and offset address I overridden in both the 16-
and 32-bit instruction modes.
Both the MSDOS and PCDOS operating systems require that the instructions are
always used in the 16-bit instruction mode.
Windows 3.1, and an application that was written for it, also requires that the 16-bit
instruction mode is selected.
Note that the instruction mode is accessible only in a protected mode system such as
Windows Vista.

Descriptors Format: Access Rights Byte

The access rights byte controls access to the protected mode segment. 
describes segment function in the system and allows complete control over the
segment
if the segment is a data segment, the direction of growth is specified
If the segment grows beyond its limit, the operating system is interrupted, indicating
a general protection fault.
You can specify whether a data segment can be written or is write- protected.

CpE 3 | CSU Carig 10

Microprocessors
Memory Modes of Operation
Lecture
Notes 5&6

Bits of Access Rights Byte

CpE 3 | CSU Carig 11

Microprocessors
Memory Modes of Operation
Lecture
Notes 5&6
Protected Mode Applications
Operating systems operate in a 16- or 32-bit environment.
DOS uses a 16-bit environment.
Most Windows applications use a 32-bit environment called WIN32.
MSDOS/PCDOS & Windows 3.1 operating systems require 16-bit instruction mode.
Instruction mode is accessible only in a protected mode system such as Windows Vista.

Descriptors Format: L- Bit

In the 64-bit descriptor, the L bit (probably means large, but Intel calls it the 64-bit)
selects 64-bit addresses in a Pentium 4 or Core2 with 64-bit extensions when L = 1 and
32-bit compatibility mode when L=0.
In 64-bit protected operation, the code segment register is still used to select a section
of code from the memory.
Notice that the 64-bit descriptor has no limit or base address. It only contains an access
rights byte and the control bits.
In the 64-bit mode, there is no segment or limit in the descriptor and the base address of
the segment, although not placed in the descriptor, is 00 0000 0000H (1 Tbyte space).
This means that all code segments start at address zero for 64-bit operation. There are
no limit checks for a 64-bit code segment

Program-Invisible Registers
Global and local descriptor tables are found in the memory system.
To access & specify the table addresses, 80286–Core2 contain program- invisible
registers.
not directly addressed by software
although some of these registers are accessed by the system software
Each segment register contains a program-invisible portion used in the protected mode.
often called cache memory because cache is any memory that stores information

CpE 3 | CSU Carig 12

Microprocessors
Memory Modes of Operation
Lecture
Notes 5&6
Program-Invisible Registers

Notes
1. The 80286 does not contain FS and GS nor the program-invisible portions of these
registers.
2. The 80286 contains a base address that is 24-bits and a limit that is 16-bits.
3. The 80386/80486/Pentium/Pentium Pro contain a base address that is 32-bits and a
limit that is 20-bits.
4. The access rights are 8-bits in the 80386 and 12-bits in the 80386/80486/Pentium-
Core2.
When a new segment number is placed in a segment register, the microprocessor
accesses a descriptor table and loads the descriptor into the program-invisible portion of
the segment register.
held there and used to access the memory segment until the segment number is
changed
This allows the microprocessor to repeatedly access a memory segment without
referring to the descriptor table.
hence the term cache
The GDTR (global descriptor table register) and IDTR (interrupt descriptor table
register) contain the base address of the descriptor table and its limit.
when protected mode operation desired, address of the global descriptor table and
its limit are loaded into the GDTR
The location of the local descriptor table is selected from the global descriptor table.
one of the global descriptors is set up to address the local descriptor table

CpE 3 | CSU Carig 13

Microprocessors
Memory Modes of Operation
Lecture
Notes 5&6
Program-Invisible Registers
To access the local descriptor table, the LDTR (local descriptor table register) is loaded
with a selector.
selector accesses global descriptor table, & loads local descriptor table address, limit,
& access rights into the cache portion of the LDTR
The TR (task register) holds a selector, which accesses a descriptor that defines a task.
a task is most often a procedure or application
Allows multitasking systems to switch tasks to another in a simple and orderly fashion.

Memory Paging
The memory paging mechanism allows any physical memory location to be assigned to
any linear address.
Linear address is defined as the address generated by a program.
Physical address is the actual memory location accessed by a program.
With memory paging, the linear address is invisibly translated to any physical address.
In Windows, each application is allowed a 2G linear address space from location
00000000H–7FFFFFFFH even though there may not be enough memory or memory
available at these addresses.
Through paging to the hard disk drive and paging to the memory through the memory
paging unit, any Windows application can be executed

Paging Registers

The paging unit is controlled by the contents of the microprocessor’s control registers.
Beginning with Pentium, an additional control register labeled CR4 controls extensions to
the basic architecture.

CpE 3 | CSU Carig 14

Microprocessors
Memory Modes of Operation

Paging Registers

The leftmost bit (PG) position of CR0 selects paging when placed at a logic 1 level.
If the PG bit is cleared (0), the linear address generated by the program becomes the
physical address used to access memory.
If the PG bit is set (1), the linear address is converted to a physical address through the
paging mechanism.
The paging mechanism functions in both the real and protected modes.
CR3 contains the page directory base or root address
The page directory base address locates the directory for the page
translation unit
Note that this address locates the page directory at any 4K boundary in the memory
system because it is appended internally with 000H.
The page directory contains 1024 directory entries of 4 bytes each.
Each page directory entry addresses a page table that contains 1024 entries
Memory Paging
The linear address, as generated by software, is broken into three sections that are used to
access the page directory entry, page table entry, and memory page offset address.

The page directory contains 1024 directory entries of 4 bytes each.

Each page directory entry addresses a page table that contains 1024 entries

CpE 3 | CSU Carig 15

Microprocessors
Memory Modes of Operation

The linear address and its makeup for paging

Memory Paging
Intel has incorporated a special type of cache called TLB (translation look-aside buffer).
because repaging a 4K-byte section of memory requires access to the page directory
and a page table, both located in memory
The 80486 cache holds the 32 most recent page translation addresses.
if the same area of memory is accessed, the address is already present in the TLB  This
speeds program execution
Pentium contains separate TLBs for each of their instruction and data caches.

The Page Directory and Page Table

Only one page directory in the system.
The page directory contains 1024 doubleword addresses that locate up to 1024 page tables.
Page directory and each page table are 4K bytes in length.
DOS and EMM386.EXE use page tables to redefine memory between locations C8000H–
EFFFFH as upper memory blocks.
done by repaging extended memory to backfill conventional memory system to allow
DOS access to additional memory
Each entry in the page directory corresponds to 4M bytes of physical memory.
Each entry in the page table repages 4K bytes of physical memory. oWindows also repages
the memory system.

CpE 3 | CSU Carig 16

Microprocessors
Memory Modes of Operation

The linear address and its makeup for paging

CpE 3 | CSU Carig 17

 Microprocessors
Memory Modes of Operation

Flat mode of operation

Flat Mode Memory

A flat mode memory system is one in which there is no segmentation.  does not use a
segment register to address a location in the memory
First byte address is at 00 0000 0000H; the last location is at FF FFFF FFFFH.
address is 40-bits
The segment register still selects the privilege level of the software
Real mode system is not available if the processor operates in the 64-bit mode.
Protection and paging are allowed in the 64-bit mode.
The CS register is still used in the protected mode operation in the 64-bit
mode.
Most programs today are operated in the IA32 compatible mode.
current software operates properly, but this will change in a few years as memory
becomes larger and most people have 64-bit computers

The 64-bit flat mode memory model

CpE 3 | CSU Carig 18

 Microprocessors
Memory Modes of Operation

Flat Mode Memory

The programming model of the 8086 through 80286 contains 8- and 16-bit registers.
The programming model of the 80386 and above contains 8-, 16-, and 32-bit extended
registers as well as two additional 16-bit segment registers: FS and GS.

Summary
8-bit registers are AH, AL, BH, BL, CH, CL, DH, and DL.
16-bit registers are AX, BX, CX, DX, SP, BP, DI, and SI.
The segment registers are CS, DS, ES, SS, FS, and GS.
32-bit extended registers are EAX, EBX, ECX, EDX, ESP, EBP, EDI, and ESI.
The 64-bit registers in a Pentium 4 with 64-bit extensions are RAX, RBX, RCX, RDX, RSP,
RBP, RDI, RSI, and R8 through R15.
In addition, the microprocessor contains an instruction pointer (IP/EIP/RIP) and flag
register (FLAGS, EFLAGS, or RFLAGS).
All real mode memory addresses are a combination of a segment address plus an offset
address.
The starting location of a segment is defined by the 16-bit number in the segment register
that is appended with a hexadecimal zero at its rightmost end.
The offset address is a 16-bit number added to the 20-bit seg-ment address to form the
real mode memory address.
All instructions (code) are accessed by the combination of CS (segment ad-dress) plus IP or
EIP (offset address).
Data are normally referenced through a combination of the DS (data segment) and either
an offset address or the contents of a register that contains the offset address.
The 8086-Core2 use BX, DI, and SI as default offset registers for data if 16-bit registers are
selected.
The 80386 and above can use the 32-bit registers EAX, EBX, ECX, EDX, EDI, and ESI as
default offset registers for data.
Protected mode operation allows memory above the first 1M byte to be accessed by the
80286 through the Core2 microprocessors.
This extended memory system (XMS) is accessed via a segment address plus an offset
address, just as in the real mode.
In the protected mode, the segment starting address is stored in a descriptor that is
selected by the segment register.
The 80286 microprocessor allows a memory segment to start at any of its 16M bytes of
memory using a 24-bit base address.
The 80386 and above allow a memory segment to begin at any of its 4G bytes of memory
using a 32-bit base address.
This allows an 80286 memory segment limit of 64K bytes, and an 80386 and above mem-
ory segment limit of either 1M bytes

CpE 3 | CSU Carig 19

Microprocessors
Memory Modes of Operation

The segment register contains three fields of information in the protected mode.
The leftmost 13 bits of the segment register address one of 8192 descriptors from a
descriptor table.
The program-invisible registers are used by the 80286 and above to access the descriptor
tables.
Each segment register contains a cache portion that is used in protected mode to hold the
base address, limit, and access rights acquired from a descriptor.
The cache allows the microprocessor to access the memory segment without again
referring to the descriptor table until the segment register's contents are changed.
A memory page is 4K bytes in length. The linear address, as generated by a program, can be
mapped to any physical address through the paging mechanism found within the 80386
through the Pentium 4.
Memory paging is accomplished through control registers CR0 and CR3.
The PG bit of CR0 enables paging, and the contents of CR3 addresses the page directory.
The page directory contains up to 1024 page table addresses that are used to access
paging tables.
The page table contains 1024 entries that locate the physical address of a 4K-byte memory
page.
The TLB (translation look-aside buffer) caches the 32 most recent page table translations.
The flat mode memory contains 1T byte of memory using a 40-bit address.
In the future, Intel plans to increase the address width to 52 bits to access 4P bytes of
memory.
The flat mode is only available in the Pentium 4 and Core2 that have their 64-bit extensions
enabled.

CpE 3 | CSU Carig 20