tags:

views:

70

answers:

3

When an 8086 or 8088 first powers up, what address does the processor begin executing at? I know the Z80 starts at 0, and the 6809 looks to FFFF for an address to start at, but I have often wondered how the x86 starts off.

EDIT:

This is assuming no BIOS intervention. I.E. if I had my own EEPROM to boot from, where should it be located in RAM to start the machine running?

A: 

8086 reset sets the program counter to FFFF0h.

Schedler
That's somewhere in BIOS area. BIOS then performs some initializations and reads the boot sector (512 bytes) to 0x7C00 and jumps there.
ruslik
@ruslik: the question was about the 8086 architecture, no the IBM PC. Hence BIOS has nothing to do with this - after all it is perfectly possible to build a machine around 8086 without using the BIOS (as it is usually understood).
Schedler
+1  A: 

The cs (code selector) register is set to 0xffff and ip (instruction pointer) is set to 0x0000.

This corresponds to the physical memory location 0xffff0 but the contents of cs/ip are important since they affect how much memory you can use without a far jump, and also how the code needs to be generated if it's not position-independent.

Basically, it's just like the old 8080 days where you have a 64K chunk you can address your code in. Once you change cs, that all changes of course.

paxdiablo
+7  A: 

This is really a much more complex question than you probably realized. On the 8086, it's pretty simple -- it starts up at FFFF:0000 (16-bytes before the end of memory).

The tricky part is on the 286 or above (i.e., anything remotely modern). In these cases, it still starts up 16 bytes before the end of memory, but of course with 24-bit addressing (286) or 32-bit addressing (386+) the physical address is different. That many not seem complex, but it really is. The complexity arises from the fact that the processor starts out executing in real mode, but that address (and all those nearby) aren't visible to the processor in real mode. Therefore, it initially executes in a rather strange mode where it's in real mode from most perspectives, but some of the high bits of the address you appear to execute are ignored and instead basically hard-wired to 1's, so the top of the physical address space is visible to the processor. Then, when you execute a far jump, the processor silently switches to "normal" real mode.

The BIOS starts off in real mode, but usually executes that way for only a short time before setting up a (minimal) protected mode environment, and switching to protected mode. From there, the BIOS executes the normal power-on self test, decompresses the BIOS and copies it into the RAM that's actually located at FFFF:0000, switches back to real mode and executes code in add-on peripheral ROMs if they're marked to execute automatically (typically switching back to protected mode in the process, but back to real mode when finished). One of those will normally be the hard-disk controller that will have code to automatically read in a boot block from a disk, and execute it to start loading the OS and such.

Jerry Coffin
Bonus points for detailed explanation, thanks!
Chris D.