x86 initial CS and IP at power-on?

[Ux]

Hi folks,

Where does an 8086-descended processor get its initial IP and CS when the power is turned on?
I tried googling this got nothing.

Also, how does it go from real mode to protected 386 mode?

Thanks.

[Frank Kotler]

Well... 8086 was FFFF:FFF0 I think. I believe there's some trickery involved in newer CPUs where ROM BIOS is temporarily mapped to top of memory - FFFF:FFFFFFF0? (lord knows on a 64- bit machine!) First cs switch puts us into more "normal" conditions. Unless you're writing a BIOS, you shouldn't need to care about this.

Switch to PMODE comes much later. Simply setting bit 0 of cr0 invokes new "rules" for how segment registers are interpreted. In order for this to be useful, a Global Descriptor Table has to be loaded first. There's quite a bit more to it before you can "do" anything much! More information at:

http://www.osdev.org

Best,
Frank

[yangbowen1]

1. I don't think in 8086 it is FFFF:FFF0 because FFFF:FFF0 is 10FFE0 in physical address. It is out of the 1MB limit and will be wrapped to FFE0. This is not the top of memory. It is F000:FFF0 (FFFF0 in physical address).
See also:
cs.usfca.edu/~cruse/cs630s04/lesson02.ppt
http://www.intel.com/content/www/us/en/processors/architectures-software-developer-manuals.html
Volume 3, Chapter 9, Section 9.1
And sometimes in memory FFFF0 it is just a jump instruction.

2. For getting into protected mode, the actually mode-changing instruction is setting bit 0 of cr0 (bit PE). However, getting ready to the mode-changing is quite a lot of things. First, you should prepare a GDT and use lgdt to load it. Next, you must either prepare an IDT and use lidt to load it or use cli to close interrupts, which will MAKE THE SYSTEM REBOOT if it's not processed correctly. (Note that in real mode system uses IVT and in protected mode it uses IDT) Then, you must turn on the A20 bus by either accessing 8042 (keyboard controller) or turning on the fast-a20-gate which is more fast but NOT ALWAYS COMPATIBLE. After that, set bit 0 of cr0 (bit PE). Finally, use a far-jump instruction to make CS and EIP correct. Attention that this far-jump instruction is a mix-16-bit-and-32-bit-instruction.
See also: http://www.intel.com/content/www/us/en/processors/architectures-software-developer-manuals.html
Volume 3, Chapter 9, Section 9.9

[Keith Kanios]

Also, how does it go from real mode to protected 386 mode?

Useful article: Protected Mode @ OSDev Wiki