In real mode, segmentation is quite simple. A logical address consists of a segment and an offset. This logical address is then converted to a physical address internally by the CPU. To convert the logical address to a physical one, the CPU shifts the segment value 4 bits to the left (equivalent to multiplication by 16) and then adds the value of the offset.

Let’s look at an example:

mov word ax, [0x07c0:0x0200]

So, the segment is 0x07c0 (which refers to the 0x07c0th 64KiB block of memory). First, the segment is shifted 4 bits to the right, leaving us with 0x7c00. Then the offset (0×0200) is added, leaving us with a physical address of 0x7e00.

Pretty simple huh?

One problem you may notice with this is that there isn’t a unique logical address for each physical address, for example:

mov word ax, [0x07c0:0x0200]
mov word ax, [0x07e0:0x0000]

Both instructions refer to exactly the same physical address (0x7e00)!

The story in protected land becomes a little more complex. Segments no longer refer to a 64KiB block of memory, instead they have the following form:

The lowest 2 bits of the segment describe the privilege level that the segment expects to be accessed in (i.e. 0 is ring 0, 1 is ring 1, etc)

The next bit describes which table the CPU should look the segment index up in. A clear bit indicates the segment will be found in the GDT, whilst a set bit indicates it’ll be found in the LDT.

The remaining 13 bits are the segment index, the index points to an entry in either the LDT or GDT.

In protected mode, a logical address is converted first to a linear address by the CPU. The linear address is then sent through the paging unit to be converted to a physical address.

The conversion to a linear address is performed by taking the upper 13 bits of the segment selector, multiplying it by 8 (the size of an entry in either the GDT and LDT) and using the resulting value as a pointer to the segment descriptor in either the GDT or LDT. The correct segment descriptor contains the linear base address of the segment, which is taken by the CPU and added to the offset.

So for example,

jmp 0x08:0x0200

The segment is 0×08, or 00001000 in binary. The lower two bits (bit 0 and 1) with a value of 0 show that the segment should only be accessed in ring 0 and the next bit (bit 2) shows that the segment descriptor can be found in the GDT. The remaining 13 bits simply equal 1, which tells the CPU that the corresponding segment descriptor is at position 1 in the GDT.

If the segment descriptor at position 1 in the GDT had a base address of 0xcafe then the CPU adds the base to the offset (0×0200) to give the linear address of 0xccfe. Other checks are made such as checking the privilege level, read and write access, etc. and if they fail, the CPU will raise an exception.

I will be discussing segment descriptors and the GDT in a later post.

Exercise: Look up segment descriptors, the GDT and the LDT in the Intel x86 Manual, Volume 3.

To start with, we must understand that there are various different video modes and standards, each which may have video memory mapped to a different region. For example, if the video mode is set to monochrome text mode, then the video memory starts at b000:0000, whereas if the video mode is set to 256 bit colour graphics then the video memory is located at a000:0000. This article will focus on the standard colour text mode, 80 columns wide and 25 lines deep, whose memory is located at b800:0000.

This article also assumes that you understand real mode segmented addressing notation (segment:offset), that you have a basic understanding of x86 assembly language and that you’re trying to write your own boot loader or operating system.

Let’s look a little more into the video memory used by colour text mode, as mentioned before, the memory is mapped to a region of ram which starts at b800:0000. Because there are 80 columns of characters and 25 lines, this gives the total number of displayable characters as 2000. Each character takes up a byte of space in memory (its ASCII code) and also requires a single attribute byte.

This means that to write the letter ‘a’ on the screen in the top left-hand corner, we would need to write the byte 0×61 to [b800:0000] and an attribute byte to [b800:0001]. Writing a ‘b’ next to the ‘a’ would require us to write the byte 0×62 to [b800:0002] along with an attribute byte into [b800:0003], and so on.

But what is this attribute byte? The lower 4 bits of the attribute byte represent the foreground colour of the character and the high 4 bits represent the background colour of the character. An attribute byte of 0x0f, for example, gives a white character on a black background.

So, let’s see an actual example of writing a character to the screen.

mov ax, 0xb800
mov gs, ax			        ; Set GS to point to video memory
xor bx, bx			        ; Set BX to point to the first character
mov byte [gs:bx], 'a'		; Write 'a'
inc bx                                ; Set BX to point to the first attribute byte
mov byte [gs:bx], 0x0f		; Write the attribute byte
inc bx                                ; Set BX to point to the second character

This can be represented rather more eloquently in C (and when the CPU is in protected mode) as:

unsigned char * p = (unsigned char *) 0xb8000;
*p++ = 'a';
*p++ = 0xf;

Exercise: Write a function in assembly which prints the string “Hello, World” to the screen. Hint: LODSB is your friend.

In a future post I’ll look into scrolling and making use of different text pages.