1

From the Art of Intel x86 Assembly, Page 149,

The 80386 added four control registers: CR0-CR3. These registers extend the msw registers of the 80286 [...]

The book says earlier that,

The 80286 microprocessor adds one major programmer-visible feature to the 8086 protected mode operation. This text will not cover the 80286 protected mode of operation for a variety of reasons. First, the protected mode of the 80286 was poorly designed. Second, it is of interest only to programmers who are writing their own operating system or low-level systems programs for such operating systems. Even if you are writing software for a protected mode operating system like UNIX or OS/2, you would not use the protected mode features of the 80286. Nonetheless, it’s worthwhile to point out the extra registers and status flags present on the 80286 just in case you come across them.

Wikipedia says this about it,

Real mode also served as a more basic mode in which protected mode could be set up, solving a sort of chicken-and-egg problem. To access the extended functionality of the 286, the operating system would set up some tables in memory that controlled memory access in protected mode, set the addresses of those tables into some special registers of the processor, and then set the processor into protected mode. This enabled 24 bit addressing which allowed the processor to access 224 bytes of memory, equivalent to 16 megabytes.[9]

I believe today CR0 puts the CPU in Protected Mode. How did the 80286 do it?

6

Actually this is a lot easier than I thought, after trying to link to another MSW note, I found it in the Intel Instruction Set: Machine Status Word (286+ only).

The machine status word seems to be a predecessor to CR0, and protected mode was set in first bit.

Of note, you can't return from Protected Mode on the 286.

MSW - Machine Status Word (286+ only)


      |31|30-5|4|3|2|1|0|  Machine Status Word
        |   |  | | | | +---- Protection Enable (PE)
        |   |  | | | +----- Math Present (MP)
        |   |  | | +------ Emulation (EM)
        |   |  | +------- Task Switched (TS)
        |   |  +-------- Extension Type (ET)
        |   +---------- Reserved
        +------------- Paging (PG)


        Bit 0   PE      Protection Enable, switches processor between
                        real and protected mode (no return on 286)
        Bit 1   MP      Math Present, controls function of the WAIT
                        instruction
        Bit 2   EM      Emulation, indicates whether coprocessor functions
                        are to be emulated
        Bit 3   TS      Task Switched, set and interrogated by coprocessor
                        on task switches and when interpretting coprocessor
                        instructions
        Bit 4   ET      Extension Type, indicates type of coprocessor in
                        system (386)
        Bits 5-30       Reserved
        bit 31  PG      Paging, indicates whether the processor uses page
                        tables to translate linear addresses to physical
                        addresses (386+)

        - see   SMSW  LMSW

Also seems to be some good follow-up material on

  • 2
    Note that the 286 only used the lower four bits of the MSW. You also need to set up a GDT and interrupt table and enable the A20 line before switching to protected mode, and do a far jump immediately afterwards to load CS properly. – Stephen Kitt Sep 21 '18 at 15:52
  • 1
    (But I suppose your question is only about the part of the quote that’s in bold.) – Stephen Kitt Sep 21 '18 at 15:57
  • 2
    The description of the PE bit seems to be the wrong way round, or at least misleading for the 286 - You can set it to enter Protected Mode, but never come back to real mode. As it is worded it seems to go "back to real mode" which doesn't work on an 80286 – tofro Sep 21 '18 at 16:24
  • 1
    @StephenKitt - the comment in the example in appendix A of the iAPX286 Programmers Reference suggests otherwise, but I'm having a hard time figuring out what that example actually does ... It has a JMP $+2 but then seems to go nowhere after that. I'll look at it in more depth when I'm not trying to read it on my phone... – Jules Sep 21 '18 at 17:04
  • 2
    I know I am a little late to the party, but I am a former Microsoft engineer. While I was not involved in this coding, I spoke with the engineers that got the 286 processor to switch back and forth between protected and real mode. It was like @paxdiablo says - it was a hack that was not directly supported by Intel, and it really was a nightmare to get back from protected mode to real mode. Coding it was truly an act of faith - it was the only code we never could get to execute in a debugger. I believe Intel never considered a person would want to switch back to real mode. – skew Oct 13 '18 at 2:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.