CPU在RSET后的第一条执行指令的地址问题

[StateGrid]

最近在看Intel的用户手册，其中卷3A 的9.1.4 First Instruction Executed 这一节讲解了第一条指令的执行，但觉得有些模糊：

上面说，CS寄存器分两个部分，可访问的段选择子部分以及隐藏着的基地址部分。然后说加电时选择子部分是F000H，而基地址部分则是FFFF0000。 然后就说第一条指令的起始地址“因而”就是基地址部分加上EIP部分。 这里Intel用了“因而（thus）”这一词。

我想，这里隐含着的意思就是说：
即便是在实模式下面，每当CPU需要访问某个段中的数据时，地址的计算都是从段寄存器的基地址部分来取得基地址的。
每当加载段寄存器的时候cpu就会计算出基地址将其放进段寄存器的基地址部分，方便以后的使用，而不需每次都要计算基地址。
而当刚加电时，基地址部分值并不是根据实地址模式下的计算规则存放的，而是硬性放进基地址部分的，所以当执行第一条指令时，形成了FFFFFFF0的地址，这违反了常规的实地址计算规则。

在这一节里面到处都有这“base address”这一词，我想这应该是指段寄存器的基地址部分吧，毕竟首先提到这个词汇时是作为基地址部分出现的。

可如果按照我这一想法，那麽加载段寄存器的指令应该会修改相应的投影寄存器的内容，可是用户手册卷2A上讲解加载段寄存器指令时又说只有当处于保护模式下面时才会将基地址等额外内容加载进段寄存器的隐藏部分。

很奇怪，说法矛盾了？ 另外，虚拟8086模式也属于保护模式啊，那虚拟8086是怎麽处理加载段寄存器的？

[大熊猫侯佩]

//那虚拟8086是怎麽处理加载段寄存器的？

建议你看一下 李彦昌 先生的PM编程(网上盛传)，靠后的章节有v8086如何init

的范例。

[智能卡_Snooper]

8086加电，cs:ip不是指向地址空间的最高处吗？

[cnzdgs]

8086复位后CS:IP是FFFF:0。
V86模式下段寄存器的含义与实模式相同，EFLAGS中VM标志位为1，不过内存是虚拟地址。
有关Intel的用户手册，LZ可否把原文贴上。

[cnzdgs]

按这段话来理解，段寄存器中包含一个32位的基地址，无论是实模式还是保护模式，访问内存时都用基地址与偏移量叠加得出内存地址。在改变段选择寄存器的值的时候，如果是实模式，基地址为段选择寄存器左移4位；如果是保护模式，基地址从描述符中得到。当CPU复位后，处理器处于实模式状态，CS的基地址是FFFF0000，IP是FFF0，所以第1条指令的地址是FFFFFFF0，在未执行远跳转、远调用和中断的情况下，因为没有执行重新装入CS值的操作，所以基地址一直是FFFF0000。一旦执行了装入CS值的操作，基地址即变为CS左移4位的值。

[StateGrid]

诚如cnzdgs所说的，但是Intel在卷2A的指令介绍中介绍段寄存器加载指令时说道对于实模式下的加载不会改变投影寄存器
， 那这就与上述的话矛盾了。基地址没有更新岂不出错？

[cnzdgs]

“实模式下的加载不会改变投影寄存器”这句话是错的，不然你再把这段话贴出来。
顺便提一下，我以前做过一个在DOS下模式himem.sys的程序，大致做法就是切入保护模式，把ES装入一个基地址为0、大小为4G的描述符，然后再切回实模式，以后在使用时，把ES的值赋成0，然后用32位地址操作。如果说“实模式下的加载不会改变投影寄存器”，那这个“把es的值赋成0”的操作就是多余的了。这个地方我当时应该是测试过，不会写多余的代码的，你可以自己做个类似的程序试一下。

[StateGrid]

这是用户手册上关于第一条指令地址的原文：

9.1.4 First Instruction Executed
The first instruction that is fetched and executed following a hardware reset is located at physical address FFFFFFF0H. This address is 16 bytes below the processor’s uppermost physical address. The EPROM containing the software initialization code must be located at this address.
The address FFFFFFF0H is beyond the 1-MByte addressable range of the processor while in real-address mode. The processor is initialized to this starting address as follows.
The CS register has two parts: the visible segment selector part and the hidden base address part. In real-address mode, the base address is normally formed by shifting the 16-bit segment selector value 4 bits to the left to produce a 20-bit base address. However, during a hardware reset, the segment selector in the CS register is loaded with F000H and the base address is loaded with FFFF0000H. The starting address is thus formed by adding the base address to the value in the EIP register (that is, FFFF0000 + FFF0H = FFFFFFF0H).
The first time the CS register is loaded with a new value after a hardware reset, the processor will follow the normal rule for address translation in real-address mode (that is, [CS base address = CS segment selector * 16]). To insure that the base address in the CS register remains unchanged until the EPROM based software-initialization code is completed, the code must not contain a far jump or far call or allow an interrupt to occur (which would cause the CS selector value to be changed).


注意这里提到的base address ， 我觉得应该通篇都是指投影寄存器，而段寄存器部分都是用CS selector表示的。

[StateGrid]

重新整理一下：

9.1.4 First Instruction Executed
The first instruction that is fetched and executed following a hardware reset is located at physical address FFFFFFF0H. This address is 16 bytes below the processor’s uppermost physical address. The EPROM containing the software initialization code must be located at this address. The address FFFFFFF0H is beyond the 1-MByte addressable range of the processor while in real-address mode. The processor is initialized to this starting address as follows.
The CS register has two parts: the visible segment selector part and the hidden base address part. In real-address mode, the base address is normally formed by shifting the 16-bit segment selector value 4 bits to the left to produce a 20-bit base address. However, during a hardware reset, the segment selector in the CS register is loaded with F000H and the base address is loaded with FFFF0000H. The starting address is thus formed by adding the base address to the value in the EIP register (that is, FFFF0000 + FFF0H = FFFFFFF0H).
The first time the CS register is loaded with a new value after a hardware reset, the processor will follow the normal rule for address translation in real-address mode (that is, [CS base address = CS segment selector * 16]). To insure that the base address in the CS register remains unchanged until the EPROM based software-initialization code is completed, the code must not contain a far jump or far call or allow an interrupt to occur (which would cause the CS selector value to be changed).


注意这里提到的base address ， 我觉得应该通篇都是指投影寄存器，而段寄存器部分都是用CS selector表示的。如果是这样，那麽即便是在实地址模式下，cpu也是要用到投影寄存器的。

[StateGrid]

发了两次，版面都不好，重发下：

9.1.4 First Instruction Executed
The first instruction that is fetched and executed following a hardware reset is located at physical address FFFFFFF0H.
The processor is initialized to this starting address as follows.
The CS register has two parts: the visible segment selector part and the hidden base address part.
In real-address mode, the base address is normally formed by shifting the 16-bit segment selector value 4 bits to the left to produce a 20-bit base address. However, during a hardware reset, the segment selector in the CS register is loaded with F000H and the base address is loaded with FFFF0000H.
The starting address is thus formed by adding the base address to the value in the EIP register (that is, FFFF0000 + FFF0H = FFFFFFF0H).
The first time the CS register is loaded with a new value after a hardware reset, the processor will follow the normal rule for address translation in real-address mode (that is, [CS base address = CS segment selector * 16]). To insure that the base address in the CS register remains unchanged until the EPROM based software-initialization code is completed, the code must not contain a far jump or far call or allow an interrupt to occur (which would cause the CS selector value to be changed).


注意这里提到的base address ， 我觉得应该通篇都是指投影寄存器，而段寄存器部分都是用CS selector表示的。如果是这样，那麽即便是在实地址模式下，cpu也是要用到投影寄存器的。

[alan001]

启动时运行在8086模式吧,因为那时候操作系统还没有加载,还没有地址描述符

[StateGrid]

原文是在第二卷A的LDS/LES..etc指令的加载中介绍的,是在3-530中介绍的:
If one of these instructions is executed in protected mode, additional information
from the segment descriptor pointed to by the segment selector in the source
operand is loaded in the hidden part of the selected segment register.

这里说的挺奇怪的,然后看了下面的指令执行流程，发现除了实模式，其余的执行模式下对于段寄存器的加载都是会改变相应的投影寄存器的。 可是对于虚拟8086呢，它也属于保护模式啊！

还有如果是在实模式下的加载段寄存器仍然会改变投影寄存器的话，就是改变基地址部分了，那麽对于段长度部分呢？我个人觉得应该也是会改变到64K的长度，这样一旦长度超出了64K，CPU就会报错了。